@envarai/envarpay 0.2.0-alpha.1 → 0.2.0-alpha.2

package/dist/commerce/buyer-store.d.ts

@@ -15,6 +15,8 @@ export interface BuyerQuote {
     inputDigest: string;
     termsDigest: string;
     quoteId: string;
+    /** Absent for the original seller-advertised EnvarPay contract. */
+    termsSource?: 'local-policy';
 }
 export interface BuyerRecord {
     id: string;
@@ -29,6 +31,12 @@ export interface BuyerRecord {
     quote: BuyerQuote;
     input: Input;
     inputSchema: Record<string, unknown>;
+    peerMode?: 'standard-a2a';
+    standardBinding?: {
+        policyDigest: string;
+        bodyDigest: string;
+        challengeDigest: string;
+    };
     continuations?: {
         messageId: string;
         input: Input;

package/dist/commerce/buyer.d.ts

@@ -1,6 +1,6 @@
 import type { ClientEvmSigner } from '@x402/evm';
 import type { PaymentPayload, PaymentRequirements, SettleResponse } from '@x402/core/types';
-import { type BuyerPolicy, type Input } from './types.js';
+import { type BuyerPolicy, type Input, type StandardA2APeer } from './types.js';
 import { CredentialVault } from './vault.js';
 import { BuyerStore, type BuyerQuote } from './buyer-store.js';
 import { type MppBuyerOptions, type MppReceipt } from './mpp-client.js';
@@ -78,9 +78,10 @@ export declare class CommerceBuyer {
         policyVersion: 1;
         paymentsEnabled: boolean;
         approval: "per_purchase" | "within_preapproved_limits";
-        peers: ({
+        peers: (StandardA2APeer | {
             id: string;
             cardUrl: string;
+            mode?: "envarpay";
             protocol: "x402" | "mpp";
             currency: string;
             recipient: string;
@@ -88,6 +89,7 @@ export declare class CommerceBuyer {
         } | {
             id: string;
             cardUrl: string;
+            mode?: "envarpay";
             protocol: "free";
             currency: null;
             recipient: null;
@@ -102,6 +104,7 @@ export declare class CommerceBuyer {
     get(caller: string, id: string): BuyerSnapshot;
     preview(caller: string, input: BuyerPreviewInput): Promise<BuyerSnapshot>;
     private prepare;
+    private prepareStandard;
     private prepareFree;
     private replayFree;
     private prepareMpp;

package/dist/commerce/buyer.js

@@ -1,6 +1,6 @@
 import { findDefaultAsset } from '@x402/evm';
 import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
-import { AgentCard, SendMessageRequest, GetTaskRequest, Task, TaskState } from '@a2a-js/sdk';
+import { AgentCard, SendMessageRequest, GetTaskRequest, Task, TaskState, Message, Role } from '@a2a-js/sdk';
 import { ClientFactory, JsonRpcTransportFactory } from '@a2a-js/sdk/client';
 import { x402Client } from '@x402/core/client';
 import { decodePaymentRequiredHeader, decodePaymentResponseHeader, encodePaymentSignatureHeader } from '@x402/core/http';
@@ -67,6 +67,31 @@ function noExternalRefs(value) {
         noExternalRefs(child);
     }
 }
+function standardPolicyDigest(peer) {
+    return digest({ mode: peer.mode, cardUrl: peer.cardUrl, endpoint: peer.endpoint, authentication: peer.authentication,
+        protocol: peer.protocol, currency: peer.currency, recipient: peer.recipient, localContract: peer.localContract });
+}
+function standardRequirements(peer, required) {
+    let resource;
+    try {
+        resource = new URL(required.resource?.url ?? '');
+    }
+    catch {
+        throw new CommerceError('quote_mismatch', 'Standard payment resource must name the approved A2A endpoint');
+    }
+    const candidates = Array.isArray(required.accepts) ? required.accepts.filter(r => {
+        if (!r || r.scheme !== 'exact' || typeof r.asset !== 'string' || typeof r.payTo !== 'string' || `${r.network}/erc20:${r.asset.toLowerCase()}` !== peer.currency || r.payTo.toLowerCase() !== peer.recipient || r.amount !== peer.localContract.amount || !Number.isInteger(r.maxTimeoutSeconds) || r.maxTimeoutSeconds < 1 || r.maxTimeoutSeconds > 300)
+            return false;
+        const asset = findDefaultAsset(r.asset, r.network), extra = r.extra;
+        return !!asset && !!extra && typeof extra === 'object' && !Array.isArray(extra)
+            && (extra.assetTransferMethod === undefined || extra.assetTransferMethod === 'eip3009')
+            && (extra.paymentFlow === undefined || extra.paymentFlow === 'upfront')
+            && extra.name === asset.name && extra.version === asset.version;
+    }) : [];
+    if (required.x402Version !== 2 || resource.href !== peer.endpoint || resource.username || resource.password || resource.hash || candidates.length !== 1)
+        throw new CommerceError('quote_mismatch', 'Native challenge differs from the exact locally approved resource, price, asset, payee or timeout');
+    return candidates[0];
+}
 /** Independent x402 wallet; payment and execution state are deliberately separate. */
 export class CommerceBuyer {
     options;
@@ -86,8 +111,8 @@ export class CommerceBuyer {
         if (this.policy.peers.some(p => p.protocol === 'mpp') && (!options.mpp || !options.mpp.payer || !/^pm_[A-Za-z0-9]+$/.test(options.mpp.paymentMethod) || !['test', 'live'].includes(options.mpp.mode) || typeof options.mpp.createToken !== 'function' || typeof options.mpp.verifyReceipt !== 'function'))
             throw new CommerceError('mpp_provider_missing', 'MPP peers require explicit token creation and independent provider verification');
         for (const peer of this.policy.peers)
-            if (!options.peerTokens[peer.id] || options.peerTokens[peer.id].length < 16)
-                throw new CommerceError('peer_credentials', 'Each allowed peer needs its own authentication token');
+            if (!(peer.mode === 'standard-a2a' && peer.authentication === 'none') && (!options.peerTokens[peer.id] || options.peerTokens[peer.id].length < 16))
+                throw new CommerceError('peer_credentials', 'Each authenticated peer needs its own authentication token');
     }
     /** Background observation only; never signs, replays credentials or changes reservations. */
     start(intervalMs = 2000) {
@@ -117,6 +142,11 @@ export class CommerceBuyer {
     }
     endpoint(peer) {
         const explicit = this.options.peerEndpoints?.[peer.id];
+        if (peer.mode === 'standard-a2a') {
+            if (explicit && explicit !== peer.endpoint)
+                throw new CommerceError('endpoint_policy', 'A standard peer endpoint must match its locally reviewed policy');
+            return peer.endpoint;
+        }
         const card = new URL(peer.cardUrl);
         if (!explicit && (!card.pathname.endsWith('/agent-card.json') || card.search))
             throw new CommerceError('endpoint_policy', 'Configure an explicit peer endpoint for this Agent Card URL');
@@ -133,7 +163,10 @@ export class CommerceBuyer {
             if ((request.url === peer.cardUrl && request.method !== 'GET') || (request.url === endpoint && request.method !== 'POST'))
                 throw new CommerceError('peer_scope', 'Unsupported peer operation');
             const headers = new Headers(request.headers);
-            headers.set('Authorization', `Bearer ${this.options.peerTokens[peer.id]}`);
+            if (peer.mode === 'standard-a2a' && peer.authentication === 'none')
+                headers.delete('Authorization');
+            else
+                headers.set('Authorization', `Bearer ${this.options.peerTokens[peer.id]}`);
             headers.set('A2A-Version', '1.0');
             const response = await this.fetchImpl(new Request(request, { headers, redirect: 'error', signal: AbortSignal.any([request.signal, AbortSignal.timeout(30000)]) }));
             if (response.status >= 300 && response.status < 400)
@@ -183,7 +216,11 @@ export class CommerceBuyer {
         if (!response.ok)
             throw new CommerceError('peer_card', 'Unable to read allowed Agent Card');
         const card = AgentCard.fromJSON(await response.json());
-        if (!card.supportedInterfaces.some(i => i.protocolVersion === '1.0' && i.protocolBinding === 'JSONRPC' && i.url === endpoint) || card.supportedInterfaces.some(i => i.url !== endpoint))
+        if (!card.supportedInterfaces.some(i => i.protocolVersion === '1.0' && i.protocolBinding === 'JSONRPC' && i.url === endpoint))
+            throw new CommerceError('peer_interface', 'Agent Card must expose the approved A2A 1.0 JSONRPC endpoint');
+        if (peer.mode === 'standard-a2a')
+            return this.prepareStandard(caller, input, fingerprint, peer, card);
+        if (card.supportedInterfaces.some(i => i.url !== endpoint))
             throw new CommerceError('peer_interface', 'Agent Card must expose only the approved A2A 1.0 JSONRPC endpoint');
         const advertised = card.capabilities?.extensions.find(e => e.uri === COMMERCE)?.params;
         if (!advertised || advertised.offerId !== input.offerId || !advertised.serviceId || !Number.isSafeInteger(advertised.serviceRevision) || advertised.serviceRevision < 1 || !/^[0-9a-f]{64}$/.test(advertised.termsDigest ?? '') || !advertised.contract?.inputSchema || (peer.protocol !== 'free' && (advertised.collection?.kind !== 'upfront' || advertised.payment?.adapter !== peer.protocol)))
@@ -247,6 +284,63 @@ export class CommerceBuyer {
         };
         return this.snapshot(this.options.store.insert({ protocol: 'x402', caller, peerId: peer.id, cardUrl: peer.cardUrl, endpoint, messageId: input.messageId, fingerprint, input: structuredClone(input.input), inputSchema: structuredClone(advertised.contract.inputSchema), body: originalBody, quoteToken: randomBytes(32).toString('base64url'), quote: frozenQuote, required, requirements: candidates[0] }));
     }
+    async prepareStandard(caller, input, fingerprint, peer, card) {
+        const contract = peer.localContract;
+        if (card.securityRequirements.length && !card.securityRequirements.some(requirement => {
+            const names = Object.keys(requirement.schemes);
+            if (!names.length)
+                return true;
+            if (peer.authentication !== 'bearer' || names.length !== 1)
+                return false;
+            const name = names[0], scheme = card.securitySchemes[name]?.scheme;
+            return scheme?.$case === 'httpAuthSecurityScheme' && scheme.value.scheme.toLowerCase() === 'bearer' && !requirement.schemes[name].list.length;
+        }))
+            throw new CommerceError('peer_authentication', 'Agent Card authentication is not satisfied by the locally approved none/bearer mode');
+        if (input.offerId !== contract.offerId)
+            throw new CommerceError('offer_not_allowed', 'Select the locally reviewed standard-peer offer');
+        const ajv = new Ajv2020({ strict: true });
+        addFormats(ajv);
+        if (!ajv.compile(contract.inputSchema)(input.input))
+            throw new CommerceError('invalid_input', 'Input does not satisfy the locally reviewed schema');
+        const amount = atomic(contract.amount).toString();
+        if (atomic(amount) > atomic(peer.maxPerPurchase))
+            throw new CommerceError('purchase_limit', 'Local price exceeds the per-purchase limit');
+        let body = '', required;
+        const capture = async (value, init) => {
+            const request = new Request(value, init);
+            body = await request.clone().text();
+            if (Buffer.byteLength(body) > 1024 * 1024)
+                throw new CommerceError('request_too_large', 'Purchase input exceeds 1 MiB');
+            const response = await this.scopedFetch(peer, peer.endpoint)(request);
+            if (response.status !== 402)
+                throw new CommerceError('paid_quote_required', 'The operator-approved paid-only endpoint must return 402 before any authorization');
+            const header = response.headers.get('PAYMENT-REQUIRED');
+            if (!header || header.length > 65536)
+                throw new CommerceError('invalid_challenge', 'Missing or oversized native x402 challenge');
+            required = decodePaymentRequiredHeader(header);
+            throw new CommerceError('preview_captured', 'Native standard payment challenge captured');
+        };
+        // Ignore every advertised alternative; only the operator-selected interface may receive requests.
+        const selected = AgentCard.fromJSON({ ...AgentCard.toJSON(card), supportedInterfaces: [{ url: peer.endpoint, protocolBinding: 'JSONRPC', protocolVersion: '1.0' }] });
+        const client = await new ClientFactory({ transports: [new JsonRpcTransportFactory({ fetchImpl: capture })] }).createFromAgentCard(selected);
+        try {
+            await client.sendMessage(SendMessageRequest.fromJSON({ message: { messageId: input.messageId, role: 'ROLE_USER', parts: [{ data: input.input }] }, configuration: { returnImmediately: true } }));
+        }
+        catch (error) {
+            if (!required)
+                throw error;
+        }
+        if (!required || !body)
+            throw new CommerceError('invalid_challenge', 'The approved endpoint did not return a native payment challenge');
+        const requirements = standardRequirements(peer, required), policyDigest = standardPolicyDigest(peer);
+        const quote = { quoteId: randomUUID(), messageId: input.messageId, payer: this.options.signer.address.toLowerCase(), amount,
+            currency: peer.currency, recipient: peer.recipient, expiresAt: new Date(Date.now() + requirements.maxTimeoutSeconds * 1000).toISOString(),
+            serviceId: peer.id, serviceRevision: contract.revision, offerId: contract.offerId, inputDigest: digest(input.input), termsDigest: policyDigest, termsSource: 'local-policy' };
+        return this.snapshot(this.options.store.insert({ protocol: 'x402', peerMode: 'standard-a2a', caller, peerId: peer.id, cardUrl: peer.cardUrl, endpoint: peer.endpoint,
+            messageId: input.messageId, fingerprint, input: structuredClone(input.input), inputSchema: structuredClone(contract.inputSchema), body,
+            quoteToken: randomBytes(32).toString('base64url'), quote, required, requirements,
+            standardBinding: { policyDigest, bodyDigest: digest(body), challengeDigest: digest(required) } }));
+    }
     prepareFree(caller, input, fingerprint, peer, endpoint, advertised) {
         if (advertised.pricing?.kind !== 'free' || advertised.collection?.kind !== 'none' || advertised.payment !== null)
             throw new CommerceError('free_offer_required', 'This peer permits explicit free offers only');
@@ -395,6 +489,17 @@ export class CommerceBuyer {
         const peer = this.peer(record.cardUrl);
         if (peer.id !== record.peerId || this.endpoint(peer) !== record.endpoint || peer.currency !== record.quote.currency || peer.recipient !== record.quote.recipient || (peer.protocol !== 'free' && atomic(record.quote.amount) > atomic(peer.maxPerPurchase)) || record.quote.payer !== (peer.protocol === 'free' ? record.caller : peer.protocol === 'mpp' ? this.options.mpp?.payer : this.options.signer?.address.toLowerCase()) || (record.protocol === 'mpp' && record.mppMode !== this.options.mpp?.mode))
             throw new CommerceError('policy_changed', 'Original purchase no longer matches local wallet policy');
+        if ((record.peerMode === 'standard-a2a') !== (peer.mode === 'standard-a2a'))
+            throw new CommerceError('policy_changed', 'Original peer protocol profile changed');
+        if (record.peerMode === 'standard-a2a') {
+            if (peer.mode !== 'standard-a2a' || !record.standardBinding || record.standardBinding.policyDigest !== standardPolicyDigest(peer))
+                throw new CommerceError('policy_changed', 'Original local standard-peer contract or authentication changed');
+            const quote = record.quote, contract = peer.localContract;
+            if (quote.termsSource !== 'local-policy' || quote.termsDigest !== record.standardBinding.policyDigest || quote.inputDigest !== digest(record.input) || quote.messageId !== record.messageId || quote.amount !== contract.amount || quote.serviceId !== peer.id || quote.serviceRevision !== contract.revision || quote.offerId !== contract.offerId || digest(record.inputSchema) !== digest(contract.inputSchema))
+                throw new CommerceError('recovery_conflict', 'Local review quote no longer matches its frozen standard-peer contract and input');
+            if (record.standardBinding.bodyDigest !== digest(record.body) || record.standardBinding.challengeDigest !== digest(record.required) || digest(standardRequirements(peer, record.required)) !== digest(record.requirements))
+                throw new CommerceError('recovery_conflict', 'Original standard request or native challenge changed');
+        }
         if (signing && peer.protocol !== 'free' && !this.policy.paymentsEnabled)
             throw new CommerceError('payments_disabled', 'Enable payments in local wallet policy before confirming');
         return peer;
@@ -470,6 +575,8 @@ export class CommerceBuyer {
     async verify(record, saved, receipt) {
         if (record.paymentState === 'confirmed')
             return record;
+        if (record.peerMode === 'standard-a2a' && receipt && (receipt.network !== saved.requirements.network || (receipt.payer && receipt.payer.toLowerCase() !== record.quote.payer)))
+            throw new CommerceError('receipt_binding', 'Receipt differs from the original standard-peer chain or payer');
         if (receipt)
             record = this.options.store.update(record.id, { receipt });
         if (!receipt?.transaction && record.fromBlock && this.options.findOriginalReceipt)
@@ -505,8 +612,16 @@ export class CommerceBuyer {
         }
         catch { /* retain the original receipt and reservation for reconciliation */ }
         const raw = await response.json();
+        if (record.peerMode === 'standard-a2a' && (raw.jsonrpc !== '2.0' || raw.id !== JSON.parse(record.body).id))
+            throw new CommerceError('rpc_response_binding', 'Peer response does not match the original standard JSON-RPC request');
         if (response.ok && raw.result?.task)
             record = this.task(record, raw.result.task);
+        else if (record.peerMode === 'standard-a2a' && response.ok && raw.result?.message) {
+            const message = Message.fromJSON(raw.result.message);
+            if (!message.messageId || message.role !== Role.ROLE_AGENT || !message.parts.length)
+                throw new CommerceError('message_binding', 'Peer returned an invalid A2A response message');
+            record = this.options.store.update(record.id, { result: { message: Message.toJSON(message) }, executionState: 'completed', state: record.paymentState === 'confirmed' ? 'completed' : 'unknown' });
+        }
         else
             record = this.options.store.update(record.id, { state: 'unknown', errorCode: 'original_purchase_pending' });
         return this.snapshot(record);
@@ -529,6 +644,8 @@ export class CommerceBuyer {
     }
     async continue(caller, id, input) {
         const record = this.record(caller, id);
+        if (record.peerMode === 'standard-a2a')
+            throw new CommerceError('standard_continuation_unavailable', 'A standard peer has not promised included clarification; inspect its original Task without a new submission');
         if (typeof input.messageId !== 'string' || !input.messageId || input.messageId.length > 128 || input.messageId === record.messageId || !input.input || typeof input.input !== 'object' || Array.isArray(input.input))
             throw new CommerceError('invalid_continuation', 'A distinct stable message ID and full object input are required');
         const running = this.active.get(id);
@@ -621,6 +738,13 @@ export class CommerceBuyer {
                 if (original.task?.id) {
                     return this.observe(original);
                 }
+                if (original.peerMode === 'standard-a2a') {
+                    // A2A message IDs do not guarantee idempotent execution at an unrelated seller.
+                    // Keep the exact original authorization, but never POST it again after an ambiguous outcome.
+                    if (original.paymentState === 'confirmed' && original.executionState === 'completed' && original.result && typeof original.result === 'object' && 'message' in original.result)
+                        return this.snapshot(this.options.store.update(id, { state: 'completed', errorCode: undefined }));
+                    return this.snapshot(this.options.store.update(id, { state: 'unknown', executionState: 'unknown', errorCode: 'standard_task_recovery_required' }));
+                }
                 return await this.replay(original);
             }
             catch (error) {

package/dist/commerce/cli.js

@@ -19,12 +19,14 @@ import { CredentialVault } from './vault.js';
 import { X402Gate } from './x402.js';
 import { evmReceiptVerifier, evmSettlementRecovery } from './chain.js';
 import { CommerceError } from './types.js';
+import { inspectLedger } from './operations.js';
 const { values, positionals } = parseArgs({ allowPositionals: true, options: {
         config: { type: 'string' }, service: { type: 'string' }, offer: { type: 'string' }, origin: { type: 'string' },
         version: { type: 'boolean' }, help: { type: 'boolean', short: 'h' }, state: { type: 'string' }, credentials: { type: 'string' }, host: { type: 'string' },
         port: { type: 'string' }, directory: { type: 'string' }, 'envar-config': { type: 'string' }, 'envar-credentials': { type: 'string' },
+        after: { type: 'string' }, limit: { type: 'string' },
     } });
-const usage = 'envarpay init --directory DIR | validate --config seller.json | card --config seller.json --service ID --offer ID --origin URL | serve/buyer-serve --config FILE --credentials FILE --state DB --origin URL';
+const usage = 'envarpay init --directory DIR | inspect --state DB [--after ROW --limit 100] | validate --config seller.json | card --config seller.json --service ID --offer ID --origin URL | serve/buyer-serve --config FILE --credentials FILE --state DB --origin URL';
 const closers = [];
 function privateFile(path) {
     const stat = lstatSync(path);
@@ -84,6 +86,10 @@ async function run() {
         return;
     }
     const command = positionals[0];
+    if (command === 'inspect' && values.state) {
+        console.log(JSON.stringify(inspectLedger(values.state, Number(values.after ?? 0), Number(values.limit ?? 100)), null, 2));
+        return;
+    }
     if ((values['envar-config'] || values['envar-credentials']) && command !== 'serve')
         throw new CommerceError('envar_role', 'Configuration synchronization is available on seller serve only');
     if (Boolean(values['envar-config']) !== Boolean(values['envar-credentials']))

package/dist/commerce/config.js

@@ -143,6 +143,24 @@ export function loadBuyerPolicy(value) {
     const ids = new Set();
     for (const peer of policy.peers) {
         validateUrl(peer.cardUrl);
+        if (peer.mode === 'standard-a2a') {
+            const endpoint = validateUrl(peer.endpoint), card = validateUrl(peer.cardUrl);
+            if (endpoint.origin !== card.origin || endpoint.search || endpoint.href !== peer.endpoint || card.href !== peer.cardUrl)
+                throw new CommerceError('standard_peer_endpoint', 'Review an exact same-origin HTTPS A2A endpoint without query parameters');
+            noExternalRefs(peer.localContract.inputSchema);
+            if (JSON.stringify(peer.localContract.inputSchema).length > 512 * 1024)
+                throw new CommerceError('standard_peer_schema', 'Local input schema exceeds 512 KiB');
+            try {
+                const inputAjv = new Ajv2020({ strict: true });
+                addFormats(inputAjv);
+                inputAjv.compile(peer.localContract.inputSchema);
+            }
+            catch {
+                throw new CommerceError('standard_peer_schema', 'Local input schema must be a valid supported JSON Schema');
+            }
+            if (atomic(peer.localContract.amount) > atomic(peer.maxPerPurchase))
+                throw new CommerceError('purchase_limit', 'Locally reviewed standard-peer price exceeds the per-purchase limit');
+        }
         if (ids.has(peer.id))
             throw new CommerceError('duplicate_peer', 'Peer IDs must be unique');
         ids.add(peer.id);

package/dist/commerce/operations.d.ts

@@ -0,0 +1,16 @@
+/** Local owner-only diagnostics: never opens a signer, vault, provider or network. */
+export declare function inspectLedger(path: string, after?: number, limit?: number): {
+    role: string;
+    total: number;
+    attentionCount: number;
+    items: {
+        cursor: number;
+        id: string;
+        paymentState: string;
+        executionState: string;
+        taskId: string | null;
+    }[];
+    nextCursor: number;
+    hasMore: boolean;
+    paymentPerformed: boolean;
+};

package/dist/commerce/operations.js

@@ -0,0 +1,33 @@
+import { DatabaseSync } from 'node:sqlite';
+import { lstatSync } from 'node:fs';
+import { CommerceError } from './types.js';
+/** Local owner-only diagnostics: never opens a signer, vault, provider or network. */
+export function inspectLedger(path, after = 0, limit = 100) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()))
+        throw new CommerceError('private_file', 'Inspect an existing ledger owned only by the current user');
+    if (!Number.isSafeInteger(after) || after < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+        throw new CommerceError('inspection_cursor', 'Use a nonnegative row cursor and a limit from1 to100');
+    const db = new DatabaseSync(path, { readOnly: true });
+    try {
+        db.exec('PRAGMA query_only=ON; PRAGMA busy_timeout=1000');
+        const names = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(row => row.name));
+        const role = names.has('buyer_purchases') ? 'buyer' : names.has('commerce_orders') ? 'seller' : null;
+        if (!role)
+            throw new CommerceError('store_version', 'Unrecognized commerce ledger');
+        const meta = role === 'buyer' ? 'buyer_meta' : 'commerce_meta', version = role === 'buyer' ? 1 : 2;
+        if (db.prepare(`SELECT version FROM ${meta}`).get()?.version !== version)
+            throw new CommerceError('store_version', 'Unsupported commerce ledger version');
+        const table = role === 'buyer' ? 'buyer_purchases' : 'commerce_orders';
+        const total = Number(db.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get().n);
+        const filter = role === 'buyer' ? "json_extract(record_json,'$.state') IN ('signing','submitted','unknown') OR json_extract(record_json,'$.paymentState') IN ('reserved','unknown') OR json_extract(record_json,'$.executionState')='unknown'" : "payment_state IN ('settling','unknown') OR execution_state IN ('dispatching','unknown')";
+        const selected = role === 'buyer' ? "rowid AS cursor,id,json_extract(record_json,'$.paymentState') AS payment_state,json_extract(record_json,'$.executionState') AS execution_state,json_extract(record_json,'$.task.id') AS task_id" : "rowid AS cursor,id,payment_state,execution_state,task_id";
+        const rows = db.prepare(`SELECT ${selected} FROM ${table} WHERE rowid>? AND (${filter}) ORDER BY rowid LIMIT ?`).all(after, limit + 1);
+        const page = rows.slice(0, limit).map(row => ({ cursor: Number(row.cursor), id: String(row.id), paymentState: String(row.payment_state), executionState: String(row.execution_state), taskId: typeof row.task_id === 'string' ? row.task_id : null }));
+        const attentionCount = Number(db.prepare(`SELECT COUNT(*) AS n FROM ${table} WHERE ${filter}`).get().n);
+        return { role, total, attentionCount, items: page, nextCursor: page.at(-1)?.cursor ?? after, hasMore: rows.length > limit, paymentPerformed: false };
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/commerce/peer-proxy.js

@@ -230,7 +230,7 @@ export class A2APeerProxy {
         let raw = snapshot?.task
             ? structuredClone(snapshot.task)
             : {};
-        if (!code && ["failed", "unknown"].includes(String(row.phase))) {
+        if (!code && ["created", "attention", "failed", "unknown"].includes(String(row.phase))) {
             try {
                 const previous = JSON.parse(String(row.task_json));
                 if (typeof previous.metadata?.errorCode === "string")
@@ -251,9 +251,11 @@ export class A2APeerProxy {
                 status: {
                     state: needsApproval
                         ? "TASK_STATE_AUTH_REQUIRED"
-                        : failed
-                            ? "TASK_STATE_FAILED"
-                            : "TASK_STATE_WORKING",
+                        : phase === "attention"
+                            ? "TASK_STATE_INPUT_REQUIRED"
+                            : failed
+                                ? "TASK_STATE_FAILED"
+                                : "TASK_STATE_WORKING",
                 },
             };
         }
@@ -458,9 +460,13 @@ export class A2APeerProxy {
                         "peer_not_allowed",
                         "invalid_input",
                         "purchase_limit",
+                        "paid_quote_required",
+                        "offer_metadata_required",
+                        "quote_mismatch",
+                        "retired_revision",
                     ].includes(error.code);
                 this.phase(id, definitelyBlocked
-                    ? "failed"
+                    ? state === "previewing" ? "attention" : "failed"
                     : state === "confirming"
                         ? "unknown"
                         : state === "previewing"

package/dist/commerce/server.d.ts

@@ -36,6 +36,7 @@ export declare class CommerceServer {
     private running;
     private kickPending;
     private stopped;
+    private workerFailed;
     private waiters;
     private activeOrders;
     private recoveries;

package/dist/commerce/server.js

@@ -171,6 +171,7 @@ export class CommerceServer {
     running = false;
     kickPending = false;
     stopped = false;
+    workerFailed = false;
     waiters = new Map();
     activeOrders = new Set();
     recoveries = new Map();
@@ -233,8 +234,19 @@ export class CommerceServer {
         const url = new URL(request.url);
         if (url.origin !== new URL(this.options.origin).origin)
             return Response.json({ error: 'invalid_host' }, { status: 421 });
-        if (request.method === 'GET' && ['/healthz', '/readyz'].includes(url.pathname))
-            return Response.json({ status: this.stopped ? 'draining' : 'ready' }, { status: this.stopped ? 503 : 200, headers: { 'Cache-Control': 'no-store' } });
+        if (request.method === 'GET' && ['/healthz', '/readyz'].includes(url.pathname)) {
+            let ready = !this.stopped;
+            if (url.pathname === '/readyz') {
+                ready = ready && !this.workerFailed;
+                try {
+                    this.store.assertReady();
+                }
+                catch {
+                    ready = false;
+                }
+            }
+            return Response.json({ status: ready ? 'ready' : this.stopped ? 'draining' : 'unavailable' }, { status: ready ? 200 : 503, headers: { 'Cache-Control': 'no-store' } });
+        }
         const proof = /^\/\.well-known\/envar\/([0-9a-f-]{36})$/.exec(url.pathname);
         if (request.method === 'GET' && proof) {
             const challenge = this.options.ownershipChallenges?.[proof[1]];
@@ -279,6 +291,8 @@ export class CommerceServer {
         let requestId = null;
         try {
             const raw = JSON.parse(body);
+            if (raw.method === 'SendMessage' && this.workerFailed)
+                return Response.json({ error: 'worker_unavailable' }, { status: 503, headers: { 'Cache-Control': 'no-store' } });
             if (!raw || Array.isArray(raw) || typeof raw !== 'object')
                 throw new RequestMalformedError('A single JSONRPC object is required');
             requestId = raw.id ?? null;
@@ -393,14 +407,14 @@ export class CommerceServer {
         return projected;
     }
     schedule() {
-        if (this.stopped)
+        if (this.stopped || this.workerFailed)
             return;
         if (this.running) {
             this.kickPending = true;
             return;
         }
         this.running = true;
-        void this.drain().catch(() => this.options.onError?.('worker_failure')).finally(() => { this.running = false; if (this.kickPending) {
+        void this.drain().catch(() => { this.workerFailed = true; this.options.onError?.('worker_failure'); }).finally(() => { this.running = false; if (this.kickPending) {
             this.kickPending = false;
             this.schedule();
         } });

package/dist/commerce/store.d.ts

@@ -36,6 +36,8 @@ export declare class CommerceStore implements TaskStore {
     constructor(path: string);
     private migrateV1;
     close(): void;
+    /** Local readiness only. External settlement is independently verified per purchase. */
+    assertReady(): void;
     registerCatalog(config: CommerceConfig): void;
     serviceRevision(id: string): Service | undefined;
     catalogHistory(): {

package/dist/commerce/store.js

@@ -134,6 +134,13 @@ export class CommerceStore {
             this.ownerDb.close();
         }
     }
+    /** Local readiness only. External settlement is independently verified per purchase. */
+    assertReady() {
+        const row = this.db.prepare('SELECT version FROM commerce_meta').get();
+        if (row?.version !== 2)
+            throw new CommerceError('store_unavailable', 'Commerce ledger is unavailable');
+        this.db.prepare('SELECT id FROM commerce_orders LIMIT 1').get();
+    }
     registerCatalog(config) {
         this.transaction(() => {
             for (const service of config.services) {

package/dist/commerce/types.d.ts

@@ -65,13 +65,33 @@ export interface CommerceConfig {
     paymentProfiles: Record<string, PaymentProfile>;
     services: Service[];
 }
+/** A separately reviewed transport profile; local terms are never advertised as seller promises. */
+export interface StandardA2APeer {
+    id: string;
+    cardUrl: string;
+    mode: 'standard-a2a';
+    protocol: 'x402';
+    currency: string;
+    recipient: string;
+    maxPerPurchase: string;
+    endpoint: string;
+    authentication: 'none' | 'bearer';
+    localContract: {
+        revision: number;
+        offerId: string;
+        inputSchema: Record<string, unknown>;
+        amount: string;
+        paidOnly: true;
+    };
+}
 export interface BuyerPolicy {
     policyVersion: 1;
     paymentsEnabled: boolean;
     approval: 'per_purchase' | 'within_preapproved_limits';
-    peers: ({
+    peers: (StandardA2APeer | {
         id: string;
         cardUrl: string;
+        mode?: 'envarpay';
         protocol: 'x402' | 'mpp';
         currency: string;
         recipient: string;
@@ -79,6 +99,7 @@ export interface BuyerPolicy {
     } | {
         id: string;
         cardUrl: string;
+        mode?: 'envarpay';
         protocol: 'free';
         currency: null;
         recipient: null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envarai/envarpay",
-  "version": "0.2.0-alpha.1",
+  "version": "0.2.0-alpha.2",
   "description": "Independent A2A service commerce, budgeted buyers and x402/MPP payments",
   "type": "module",
   "license": "MIT",

package/schemas/buyer-policy.schema.json

@@ -70,6 +70,54 @@
           "maxPerPurchase": {
             "type": "string",
             "pattern": "^(0|[1-9][0-9]{0,77})$"
+          },
+          "mode": {
+            "enum": [
+              "envarpay",
+              "standard-a2a"
+            ]
+          },
+          "endpoint": {
+            "type": "string",
+            "format": "uri",
+            "pattern": "^https://"
+          },
+          "authentication": {
+            "enum": [
+              "none",
+              "bearer"
+            ]
+          },
+          "localContract": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "revision",
+              "offerId",
+              "inputSchema",
+              "amount",
+              "paidOnly"
+            ],
+            "properties": {
+              "revision": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              "offerId": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]{0,63}$"
+              },
+              "inputSchema": {
+                "type": "object"
+              },
+              "amount": {
+                "$ref": "#/$defs/amount"
+              },
+              "paidOnly": {
+                "const": true
+              }
+            }
           }
         },
         "allOf": [
@@ -109,6 +157,63 @@
                 }
               }
             }
+          },
+          {
+            "if": {
+              "required": [
+                "mode"
+              ],
+              "properties": {
+                "mode": {
+                  "const": "standard-a2a"
+                }
+              }
+            },
+            "then": {
+              "required": [
+                "endpoint",
+                "authentication",
+                "localContract"
+              ],
+              "properties": {
+                "protocol": {
+                  "const": "x402"
+                },
+                "endpoint": {},
+                "authentication": {},
+                "localContract": {}
+              }
+            },
+            "else": {
+              "not": {
+                "anyOf": [
+                  {
+                    "required": [
+                      "endpoint"
+                    ],
+                    "properties": {
+                      "endpoint": {}
+                    }
+                  },
+                  {
+                    "required": [
+                      "authentication"
+                    ],
+                    "properties": {
+                      "authentication": {}
+                    }
+                  },
+                  {
+                    "required": [
+                      "localContract"
+                    ],
+                    "properties": {
+                      "localContract": {}
+                    }
+                  }
+                ]
+              }
+            }
           }
         ]
       }