@envarai/envarpay 0.2.0-alpha.14 → 0.2.0-alpha.16

package/dist/commerce/chain.js

@@ -8,6 +8,17 @@ const officialUsdc = {
     'eip155:84532': '0x036cbd53842c5426634e7929541ec2318f3dcf7e',
     'eip155:8453': '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913',
 };
+function transientRpcRead(error) {
+    for (let cause = error, depth = 0; cause && typeof cause === 'object' && depth < 8; depth++) {
+        const value = cause;
+        if (value.name === 'TimeoutError' || [408, 429, 500, 502, 503, 504].includes(value.status ?? 0) || [-32005, -32011].includes(value.code ?? 0))
+            return true;
+        if (value.name === 'HttpRequestError' && value.status === undefined)
+            return true;
+        cause = value.cause;
+    }
+    return false;
+}
 /** Checks the canonical chain receipt and exact official-token Transfer. */
 export function evmReceiptVerifier(rpcUrls, confirmations = 2, confirmationWaitMs = 12000) {
     if (!Number.isInteger(confirmations) || confirmations < 1)
@@ -23,8 +34,6 @@ export function evmReceiptVerifier(rpcUrls, confirmations = 2, confirmationWaitM
         if (!Number.isSafeInteger(chainId) || !/^0x[0-9a-fA-F]{64}$/.test(receipt.transaction) || receipt.network !== requirements.network)
             return false;
         const client = createPublicClient({ transport: http(rpc, { timeout: 15000, retryCount: 0 }) });
-        if (await client.getChainId() !== chainId)
-            return false;
         const deadline = Date.now() + confirmationWaitMs;
         const wait = async () => {
             const remaining = deadline - Date.now();
@@ -33,10 +42,25 @@ export function evmReceiptVerifier(rpcUrls, confirmations = 2, confirmationWaitM
             await new Promise(resolve => setTimeout(resolve, Math.min(1000, remaining)));
             return Date.now() < deadline;
         };
+        // All retries read the original transaction on the configured RPC. A rate
+        // limit at any verification stage must not be mistaken for chain evidence.
+        const read = async (operation) => {
+            for (;;) {
+                try {
+                    return await operation();
+                }
+                catch (error) {
+                    if (!transientRpcRead(error) || !await wait())
+                        throw error;
+                }
+            }
+        };
+        if (await read(() => client.getChainId()) !== chainId)
+            return false;
         let mined;
         for (;;) {
             try {
-                mined = await client.getTransactionReceipt({ hash: receipt.transaction });
+                mined = await read(() => client.getTransactionReceipt({ hash: receipt.transaction }));
             }
             catch (error) {
                 if (error instanceof TransactionReceiptNotFoundError) {
@@ -48,10 +72,10 @@ export function evmReceiptVerifier(rpcUrls, confirmations = 2, confirmationWaitM
             }
             if (mined.status !== 'success' || mined.transactionHash.toLowerCase() !== receipt.transaction.toLowerCase())
                 return false;
-            const block = await client.getBlock({ blockNumber: mined.blockNumber });
+            const block = await read(() => client.getBlock({ blockNumber: mined.blockNumber }));
             if (block.hash !== mined.blockHash)
                 return false;
-            const latest = await client.getBlockNumber({ cacheTime: 0 });
+            const latest = await read(() => client.getBlockNumber({ cacheTime: 0 }));
             if (latest - mined.blockNumber + 1n >= BigInt(confirmations))
                 break;
             if (!await wait())

package/dist/commerce/native-inventory.d.ts

@@ -1,3 +1,4 @@
+export declare const isSkillInstallerMetadata: (path: string) => path is ".clawhub/origin.json";
 export declare function readSkillInventory(roots: string[]): {
     name: string;
     path: string;

package/dist/commerce/native-inventory.js

@@ -4,6 +4,9 @@ import { extname, join, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { parse } from 'yaml';
 const namePattern = /^[a-z][a-z0-9-]{0,63}$/;
+// Native installer provenance is included in the source digest, but never
+// copied into the executable service package or supplied to the model.
+export const isSkillInstallerMetadata = (path) => path === '.clawhub/origin.json';
 export function readSkillInventory(roots) {
     const found = [];
     const seen = new Set();
@@ -54,7 +57,7 @@ export function readSkillInventory(roots) {
                     supported = false;
                     continue;
                 }
-                if (!['.md', '.txt'].includes(extname(name).toLowerCase()) && name !== 'LICENSE')
+                if (!['.md', '.txt'].includes(extname(name).toLowerCase()) && name !== 'LICENSE' && !isSkillInstallerMetadata(prefix + name))
                     supported = false;
                 files.push([prefix + name, createHash('sha256').update(readFileSync(file)).digest('hex')]);
             }

package/dist/commerce/setup.js

@@ -1,7 +1,7 @@
 /** Guided local installation. Platform input is data, never a shell command or wallet policy. */
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync, cpSync, mkdtempSync, renameSync, rmSync, } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, resolve, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
 import { execFileSync } from "node:child_process";
@@ -10,6 +10,7 @@ import { probeOpenClaw } from "./openclaw-setup.js";
 import { readInstalledSkills } from "./native-skills.js";
 import { loadCommerceConfig, validateUrl } from "./config.js";
 import { CommerceError } from "./types.js";
+import { isSkillInstallerMetadata } from './native-inventory.js';
 const ID = /^[a-z][a-z0-9-]{0,63}$/, CONTAINER = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
 export function parseSetupBundle(raw) {
     const v = raw;
@@ -40,6 +41,8 @@ export function prepareTextSkill(source, destination, name) {
             const item = lstatSync(path);
             if (item.isSymbolicLink())
                 throw new CommerceError("setup_skill", "Skill symlinks are unsupported");
+            if (item.isFile() && isSkillInstallerMetadata(relative(source, path).split(sep).join('/')))
+                return false;
             if (item.isFile() &&
                 !/\.(md|txt)$/i.test(path) &&
                 !path.endsWith("/LICENSE"))

package/examples/hermes-skill-inventory.py

@@ -73,7 +73,8 @@ def inventory(home):
                     if size > 1024 * 1024 or len(package) >= 128:
                         supported = False
                         break
-                    if file.suffix.lower() not in {".md", ".txt"} and file.name != "LICENSE":
+                    if (file.suffix.lower() not in {".md", ".txt"} and file.name != "LICENSE"
+                            and str(file.relative_to(entry.parent)) != ".clawhub/origin.json"):
                         supported = False
                     package.append(
                         [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envarai/envarpay",
-  "version": "0.2.0-alpha.14",
+  "version": "0.2.0-alpha.16",
   "description": "Independent A2A service commerce, budgeted buyers and x402/MPP payments",
   "type": "module",
   "license": "MIT",