@envarai/envarpay 0.2.0-alpha.2 → 0.2.0-alpha.20

package/dist/commerce/cli.js

@@ -1,14 +1,12 @@
 #!/usr/bin/env node
-import { readFileSync, lstatSync, mkdirSync, writeFileSync } from 'node:fs';
+import { readFileSync, lstatSync, mkdirSync, writeFileSync, readdirSync } from 'node:fs';
 import { parseArgs } from 'node:util';
 import { createRequire } from 'node:module';
 import { randomBytes } from 'node:crypto';
 import { once } from 'node:events';
 import { dirname, join, resolve } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { privateKeyToAccount } from 'viem/accounts';
 import { AgentCard } from '@a2a-js/sdk';
-import { loadCommerceConfig, loadBuyerPolicy, digest } from './config.js';
+import { loadCommerceConfig, digest } from './config.js';
 import { createOfferCard } from './card.js';
 import { CommerceStore } from './store.js';
 import { CommerceServer, bearerAuthenticator } from './server.js';
@@ -16,17 +14,24 @@ import { EnvarIntegration } from './envar.js';
 import { EnvarSellerRuntime, PinnedUpstreams, restoreEnvarConfig } from './envar-runtime.js';
 import { listenCommerce } from './http.js';
 import { CredentialVault } from './vault.js';
-import { X402Gate } from './x402.js';
-import { evmReceiptVerifier, evmSettlementRecovery } from './chain.js';
+import { EnvarBalanceGate } from './envar-balance.js';
 import { CommerceError } from './types.js';
-import { inspectLedger } from './operations.js';
+import { createNativeSkillExecutor } from './native-skills.js';
+import { inspectLedger, inspectLocalAlerts } from './operations.js';
+import { serveManaged } from './managed.js';
+import { setupAgent } from './setup.js';
+import { SkillDiscovery } from './discovery.js';
+import { upgradeDiscovery } from './configure.js';
+import { agentSetup } from './agent-setup.js';
+import { setupExternalAgent, serveExternalAgent } from './external-runtime.js';
 const { values, positionals } = parseArgs({ allowPositionals: true, options: {
         config: { type: 'string' }, service: { type: 'string' }, offer: { type: 'string' }, origin: { type: 'string' },
         version: { type: 'boolean' }, help: { type: 'boolean', short: 'h' }, state: { type: 'string' }, credentials: { type: 'string' }, host: { type: 'string' },
         port: { type: 'string' }, directory: { type: 'string' }, 'envar-config': { type: 'string' }, 'envar-credentials': { type: 'string' },
-        after: { type: 'string' }, limit: { type: 'string' },
+        after: { type: 'string' }, limit: { type: 'string' }, 'refund-review': { type: 'boolean' }, alerts: { type: 'boolean' }, 'fail-on-alert': { type: 'boolean' }, 'integration-state': { type: 'string' }, 'no-integration': { type: 'boolean' },
+        framework: { type: 'string' }, file: { type: 'string' }, 'docker-container': { type: 'string' }, python: { type: 'string' }, 'hermes-home': { type: 'string' }, check: { type: 'boolean' },
     } });
-const usage = 'envarpay init --directory DIR | inspect --state DB [--after ROW --limit 100] | validate --config seller.json | card --config seller.json --service ID --offer ID --origin URL | serve/buyer-serve --config FILE --credentials FILE --state DB --origin URL';
+const usage = 'envarpay setup --file envar-setup.json [--docker-container NAME | --python PATH] [--hermes-home PATH] [--directory DIR]\nenvarpay onboard --file invitation.json [--framework hermes|openclaw] [--check] [--python PATH] [--docker-container NAME] [--hermes-home PATH] [--origin HTTPS_ORIGIN]\nenvarpay upgrade --directory DIR [--hermes-home PATH]\nenvarpay external-setup --directory DIR --origin HTTPS_ORIGIN | external-serve --config FILE --credentials FILE --state DB --origin HTTPS_ORIGIN\nenvarpay init --directory DIR | inspect --state DB [--after ROW --limit 100 --refund-review] | validate --config seller.json | card --config seller.json --service ID --offer ID --origin URL | serve --config FILE --credentials FILE --state DB --origin URL';
 const closers = [];
 function privateFile(path) {
     const stat = lstatSync(path);
@@ -66,16 +71,6 @@ function signals() {
 async function closeHttp(http) {
     await new Promise((resolve, reject) => http.close(error => error ? reject(error) : resolve()));
 }
-async function loadMppAdapter(path) {
-    privateFile(path);
-    const module = await import(pathToFileURL(resolve(path)).href);
-    if (typeof module.createMppBuyerOptions !== 'function')
-        throw new CommerceError('mpp_adapter_module', 'Owner-supplied module must export createMppBuyerOptions');
-    const options = await module.createMppBuyerOptions();
-    if (!options || typeof options.createToken !== 'function' || typeof options.recoverToken !== 'function' || typeof options.verifyReceipt !== 'function')
-        throw new CommerceError('mpp_adapter_module', 'MPP requires real token creation, original-operation recovery and receipt verification');
-    return options;
-}
 async function run() {
     if (values.help || positionals.length === 0 && !values.version) {
         console.log(usage);
@@ -86,17 +81,68 @@ async function run() {
         return;
     }
     const command = positionals[0];
+    if (command === 'external-setup') {
+        if (!values.directory || !values.origin)
+            throw new CommerceError('external_setup', 'Provide directory and public HTTPS origin');
+        console.log(JSON.stringify(setupExternalAgent(values.directory, values.origin)));
+        return;
+    }
+    if (command === 'external-serve') {
+        if (!values.config || !values.credentials || !values.state || !values.origin)
+            throw new CommerceError('external_serve', 'Provide config, credentials, state and origin');
+        const runtime = serveExternalAgent({ configFile: values.config, credentialsFile: values.credentials, stateFile: values.state, origin: values.origin, host: values.host ?? '127.0.0.1', port: port(4020) });
+        closers.push(() => runtime.close());
+        await once(runtime.http, 'listening');
+        signals();
+        console.log(JSON.stringify({ listening: port(4020), role: 'external-agent', paymentsEnabled: false }));
+        return;
+    }
+    if (values.framework && !['hermes', 'openclaw'].includes(values.framework))
+        throw new CommerceError('setup_runtime', 'Use hermes or openclaw');
+    if (command === 'managed-serve') {
+        if (!values.directory || !values.origin)
+            throw new CommerceError('managed_configuration', 'Managed serve requires its directory and HTTPS origin');
+        await serveManaged(values.directory, values.origin, values.host ?? '127.0.0.1', port(4020));
+        return;
+    }
+    if (command === 'onboard') {
+        if (!values.file)
+            throw new CommerceError('setup_file', 'Save the private invitation and pass --file PATH.');
+        await agentSetup({ framework: values.framework, file: values.file, directory: values.directory, python: values.python, home: values['hermes-home'], container: values['docker-container'], origin: values.origin, port: values.port ? port(4020) : undefined, checkOnly: values.check });
+        return;
+    }
+    if (command === 'upgrade' && values.directory) {
+        upgradeDiscovery(values.directory, values['hermes-home']);
+        return;
+    }
+    if (command === 'setup') {
+        if (!values.file)
+            throw new CommerceError('setup_file', 'Download the setup file from your Agent service page and pass --file PATH');
+        await setupAgent({ framework: values.framework, file: values.file, directory: values.directory, container: values['docker-container'], python: values.python, home: values['hermes-home'] });
+        return;
+    }
+    if (values.alerts || values['fail-on-alert'] || values['integration-state'] || values['no-integration']) {
+        if (command !== 'inspect' || !values.state || !values.alerts || values['refund-review'] || values.after || values.limit || (values['no-integration'] && values['integration-state']))
+            throw new CommerceError('inspection_view', 'Alert inspection needs inspect --state and --alerts, without pagination or refund review; choose at most one integration source');
+        const report = inspectLocalAlerts(values.state, { integrationPath: values['integration-state'], integrationDisabled: values['no-integration'] });
+        console.log(JSON.stringify(report, null, 2));
+        if (values['fail-on-alert'])
+            process.exitCode = report.recommendedExitCode;
+        return;
+    }
     if (command === 'inspect' && values.state) {
-        console.log(JSON.stringify(inspectLedger(values.state, Number(values.after ?? 0), Number(values.limit ?? 100)), null, 2));
+        console.log(JSON.stringify(inspectLedger(values.state, Number(values.after ?? 0), Number(values.limit ?? 100), values['refund-review'] ? 'refund-review' : 'attention'), null, 2));
         return;
     }
+    if (values['refund-review'])
+        throw new CommerceError('inspection_view', 'Refund review is available only for inspect');
     if ((values['envar-config'] || values['envar-credentials']) && command !== 'serve')
         throw new CommerceError('envar_role', 'Configuration synchronization is available on seller serve only');
     if (Boolean(values['envar-config']) !== Boolean(values['envar-credentials']))
         throw new CommerceError('envar_configuration', 'Supply both --envar-config and --envar-credentials');
     if (command === 'init' && values.directory) {
         mkdirSync(values.directory, { recursive: true, mode: 0o700 });
-        for (const [name, source] of [['seller.json', 'seller.json'], ['buyer-policy.json', 'buyer-policy.json']]) {
+        for (const [name, source] of [['seller.json', 'seller.json']]) {
             writeFileSync(join(values.directory, name), readFileSync(new URL(`../../examples/${source}`, import.meta.url)), { flag: 'wx', mode: 0o600 });
         }
         writeFileSync(join(values.directory, 'vault.key'), randomBytes(32), { flag: 'wx', mode: 0o600, flush: true });
@@ -106,60 +152,6 @@ async function run() {
     if (!values.config)
         throw new CommerceError('usage', usage);
     const raw = JSON.parse(readFileSync(values.config, 'utf8'));
-    if (command === 'buyer-serve') {
-        if (!values.origin || !values.state || !values.credentials)
-            throw new CommerceError('usage', usage);
-        const policy = loadBuyerPolicy(raw);
-        const secrets = JSON.parse(privateFile(values.credentials).toString('utf8'));
-        const needsEvm = policy.peers.some(peer => peer.protocol === 'x402'), needsMpp = policy.peers.some(peer => peer.protocol === 'mpp');
-        if (!secrets.peerTokens || (needsEvm || needsMpp) && !secrets.vaultKeyFile)
-            throw new CommerceError('buyer_credentials', 'Paid buyer needs private vault key and peer credentials');
-        let signer;
-        if (needsEvm) {
-            if (!secrets.privateKeyFile || !secrets.rpcUrls)
-                throw new CommerceError('buyer_credentials', 'x402 peers require local signer and RPC configuration');
-            const key = privateFile(secrets.privateKeyFile).toString('utf8').trim();
-            if (!/^0x[0-9a-fA-F]{64}$/.test(key))
-                throw new CommerceError('buyer_key', 'Signer file must contain one 32-byte 0x-prefixed private key');
-            signer = privateKeyToAccount(key);
-        }
-        if (needsMpp && !secrets.mppAdapterModule)
-            throw new CommerceError('mpp_adapter_module', 'MPP peers require an explicit local adapter module for authorized funding and receipt verification');
-        const mpp = needsMpp ? await loadMppAdapter(secrets.mppAdapterModule) : undefined;
-        const { BuyerStore } = await import('./buyer-store.js');
-        const { CommerceBuyer } = await import('./buyer.js');
-        const { BuyerManagement, listenBuyerManagement } = await import('./management.js');
-        const store = new BuyerStore(values.state);
-        closers.push(() => store.close());
-        const buyer = new CommerceBuyer({ policy, store, vault: secrets.vaultKeyFile ? new CredentialVault(join(dirname(values.state), 'buyer-authorizations'), privateFile(secrets.vaultKeyFile)) : undefined,
-            signer, mpp, peerTokens: secrets.peerTokens, peerEndpoints: secrets.peerEndpoints,
-            ...(needsEvm ? { verifyReceipt: evmReceiptVerifier(secrets.rpcUrls), ...evmSettlementRecovery(secrets.rpcUrls) } : {}) });
-        closers.push(() => buyer.stop());
-        if (secrets.peerProxies?.length) {
-            if (secrets.peerProxies.length > 8)
-                throw new CommerceError('proxy_limit', 'Configure at most8 explicit peer proxies per buyer');
-            const { A2APeerProxy, listenPeerProxy } = await import('./peer-proxy.js');
-            for (const settings of secrets.peerProxies) {
-                if (Object.keys(settings.tokens).some(token => Object.hasOwn(secrets.callers, token)))
-                    throw new CommerceError('proxy_token_scope', 'Agent proxy tokens must differ from owner management credentials');
-                if (!Number.isInteger(settings.port) || settings.port < 1 || settings.port > 65535)
-                    throw new CommerceError('proxy_port', 'Invalid proxy listen port');
-                const proxy = new A2APeerProxy({ ...settings, buyer });
-                closers.push(async () => { await proxy.stop(); proxy.close(); });
-                const listener = listenPeerProxy(proxy, settings.host ?? '127.0.0.1', settings.port);
-                closers.push(() => closeHttp(listener));
-                await once(listener, 'listening');
-            }
-        }
-        const management = new BuyerManagement({ buyer, origin: values.origin, authenticate: bearerAuthenticator(secrets.callers) });
-        const http = listenBuyerManagement(management, values.origin, values.host ?? '127.0.0.1', port(4021));
-        closers.push(() => closeHttp(http));
-        await once(http, 'listening');
-        buyer.start();
-        signals();
-        console.log(JSON.stringify({ listening: port(4021), role: 'buyer', paymentsEnabled: policy.paymentsEnabled }));
-        return;
-    }
     let config = loadCommerceConfig(raw);
     if (command === 'validate') {
         console.log(JSON.stringify({ valid: true, digest: digest(config), services: config.services.length, paymentPerformed: false }));
@@ -177,6 +169,10 @@ async function run() {
         syncSettings = JSON.parse(privateFile(values['envar-config']).toString('utf8'));
         if (!syncSettings?.policy)
             throw new CommerceError('envar_configuration', 'Envar settings must include an explicit local policy');
+        if (secrets.skills?.discovery?.enabledFromWeb) {
+            const installed = readdirSync(secrets.skills.skillsDirectory, { withFileTypes: true }).filter(e => e.isDirectory() && !e.isSymbolicLink() && /^[a-z][a-z0-9-]{0,63}$/.test(e.name)).map(e => e.name);
+            syncSettings.policy.allowedServices = [...new Set([...syncSettings.policy.allowedServices, ...installed])];
+        }
         const tokenFile = resolve(values['envar-credentials']);
         privateFile(tokenFile);
         integration = new EnvarIntegration({ policy: syncSettings.policy, stateDirectory: syncSettings.stateDirectory ?? join(dirname(values.state), 'envar-state'), configDirectory: syncSettings.configDirectory ?? join(dirname(values.state), 'envar-configs'), token: () => privateFile(tokenFile).toString('utf8').trim() });
@@ -187,68 +183,44 @@ async function run() {
     closers.push(() => store.close());
     if (integration)
         config = restoreEnvarConfig(config, integration, store.catalogHistory());
-    const protocols = new Set(Object.values(config.paymentProfiles).map(p => p.adapter));
-    for (const historical of store.catalogHistory())
-        for (const profile of Object.values(historical.profiles))
-            protocols.add(profile.adapter);
-    if (syncSettings?.policy.allowedX402.length)
-        protocols.add('x402');
-    if (syncSettings?.policy.allowedMppAccounts.length)
-        protocols.add('mpp');
+    const needsBalance = Boolean(integration) || Object.values(config.paymentProfiles).length > 0 || store.catalogHistory().some(entry => Object.values(entry.profiles).length > 0);
     let vault;
-    if (protocols.size) {
+    if (needsBalance) {
         if (!secrets.vaultKeyFile)
             throw new CommerceError('vault_key', 'Paid services require a private vault key file');
         vault = new CredentialVault(join(dirname(values.state), 'authorizations'), privateFile(secrets.vaultKeyFile));
     }
-    const gates = {};
-    let stripeRecipientFor;
-    if (protocols.has('x402')) {
-        if (!secrets.payers || !secrets.rpcUrls)
-            throw new CommerceError('x402_configuration', 'x402 requires explicit caller-payer bindings and network RPCs');
-        const gate = new X402Gate({ store, vault: vault, payerFor: caller => secrets.payers?.[caller], verifyReceipt: evmReceiptVerifier(secrets.rpcUrls), ...evmSettlementRecovery(secrets.rpcUrls) });
-        await gate.check(Object.values(config.paymentProfiles).filter((p) => p.adapter === 'x402'));
-        gates.x402 = gate;
-    }
-    if (protocols.has('mpp')) {
-        if (!secrets.stripe || !secrets.mppHmacKeyFile)
-            throw new CommerceError('mpp_configuration', 'MPP requires private Stripe credentials and a separate challenge key');
-        const { MppGate } = await import('./mpp.js'), { stripeProvider } = await import('./stripe-provider.js');
-        const providers = Object.fromEntries(Object.entries(secrets.stripe).map(([ref, p]) => [ref, stripeProvider({ ...p, secretKey: privateFile(p.secretKeyFile).toString('utf8').trim() })]));
-        const hmacKey = privateFile(secrets.mppHmacKeyFile);
-        if (hmacKey.length < 32)
-            throw new CommerceError('mpp_hmac_key', 'MPP requires a private challenge key of at least32 random bytes');
-        const gate = new MppGate({ store, vault: vault, origin: values.origin, hmacSecret: hmacKey.toString('base64'), providers });
-        await gate.check();
-        gates.mpp = gate;
-        stripeRecipientFor = ref => gate.merchantRecipient(ref);
+    let balanceGate;
+    if (needsBalance) {
+        if (!integration)
+            throw new CommerceError('balance_configuration', 'Envar balance requires an authenticated Envar seller integration');
+        balanceGate = new EnvarBalanceGate({ store, vault: vault, claim: args => integration.claimBalancePayment(args) });
     }
-    const upstreams = new PinnedUpstreams(join(dirname(values.state), 'upstream-bindings.json'), secrets.upstreams, secrets.upstreamInputEncoding, fetch, controller.signal);
+    const nativeSkills = secrets.skills ? createNativeSkillExecutor(secrets.skills, values.origin, config.agent.name) : undefined;
+    const discovery = secrets.skills?.discovery?.enabledFromWeb ? new SkillDiscovery(secrets.skills, secrets.skills.discovery, values.origin) : undefined;
+    if (nativeSkills)
+        closers.push(() => nativeSkills.close());
+    const upstreams = new PinnedUpstreams(join(dirname(values.state), 'upstream-bindings.json'), secrets.upstreams ?? {}, secrets.upstreamInputEncoding, fetch, controller.signal, nativeSkills?.execute);
     upstreams.prepare(config, store.catalogHistory().map(entry => entry.service));
     const validateAdapters = (candidate) => {
         for (const profile of Object.values(candidate.paymentProfiles)) {
-            if (!gates[profile.adapter])
-                throw new CommerceError('payment_method_unavailable', 'Configure the payment adapter locally before enabling this service');
-            if (profile.adapter === 'x402' && !secrets.rpcUrls?.[profile.network])
-                throw new CommerceError('x402_configuration', 'Configure the required network RPC locally');
-            if (profile.adapter === 'mpp' && !stripeRecipientFor?.(profile.accountRef))
-                throw new CommerceError('mpp_configuration', 'Configure and verify the merchant account locally');
+            if (!balanceGate || !syncSettings?.policy.allowedBalanceAccounts?.includes(profile.accountRef))
+                throw new CommerceError('balance_configuration', 'Allow this balance receiving account locally');
         }
     };
     validateAdapters(config);
-    const server = new CommerceServer({ config, origin: values.origin, store, stripeRecipientFor, ownershipChallenges: secrets.ownershipChallenges,
+    const server = new CommerceServer({ config, origin: values.origin, store, ownershipChallenges: secrets.ownershipChallenges,
         authenticate: bearerAuthenticator(secrets.callers), execute: upstreams.execute,
         paymentGate: { handle: async (request, order) => {
-                const adapter = order.quote.paymentProfile?.adapter, gate = adapter ? gates[adapter] : undefined;
-                if (!gate)
-                    throw new CommerceError('payment_method_unavailable', 'Configured payment adapter is unavailable');
-                return gate.handle(request, order);
+                if (!balanceGate)
+                    throw new CommerceError('payment_method_unavailable', 'Envar balance is unavailable');
+                return balanceGate.handle(request, order);
             } }, onError: (code, orderId) => console.error(JSON.stringify({ code, orderId })) });
     closers.push(async () => { server.stop(); controller.abort(); while (server.isRunning)
         await new Promise(r => setTimeout(r, 50)); });
     let connection;
     if (integration) {
-        connection = new EnvarSellerRuntime({ integration, server, upstreams, pollIntervalMs: syncSettings?.pollIntervalMs, validateConfig: validateAdapters, onError: code => console.error(JSON.stringify({ code, integration: 'envar' })) });
+        connection = new EnvarSellerRuntime({ integration, server, upstreams, pollIntervalMs: syncSettings?.pollIntervalMs, validateConfig: validateAdapters, beforeSync: discovery ? () => discovery.sync(integration) : undefined, onError: code => console.error(JSON.stringify({ code, integration: 'envar' })) });
         closers.push(() => connection.stop());
     }
     const http = listenCommerce(server, values.origin, values.host ?? '127.0.0.1', port(4020));
@@ -256,7 +228,7 @@ async function run() {
     await once(http, 'listening');
     connection?.start();
     signals();
-    console.log(JSON.stringify({ listening: port(4020), role: 'seller', paidTransports: [...protocols] }));
+    console.log(JSON.stringify({ listening: port(4020), role: 'seller', paymentMethod: needsBalance ? 'envar_balance' : 'free' }));
 }
 try {
     await run();

package/dist/commerce/config.d.ts

@@ -1,7 +1,8 @@
-import { type BuyerPolicy, type CommerceConfig, type PaymentProfile } from './types.js';
+import { type CommerceConfig, type Offer, type PaymentProfile, type Service } from './types.js';
 export declare function atomic(value: string): bigint;
 export declare function validateUrl(value: string, allowPrivate?: boolean): URL;
 export declare function currencyOf(profile: PaymentProfile): string;
 export declare function digest(value: unknown): string;
+/** Keep legacy quotes unchanged; skill-bound quotes freeze the installed skill revision too. */
+export declare function serviceTermsDigest(configVersion: 1 | 2, service: Service, offer: Offer, profile: PaymentProfile | null): string;
 export declare function loadCommerceConfig(value: unknown): CommerceConfig;
-export declare function loadBuyerPolicy(value: unknown): BuyerPolicy;

package/dist/commerce/config.js

@@ -10,11 +10,6 @@ const ajv = new Ajv2020({ allErrors: true, strict: true });
 addFormats(ajv);
 const schema = (name) => JSON.parse(readFileSync(new URL(`../../schemas/${name}`, import.meta.url), 'utf8'));
 const sellerValidator = ajv.compile(schema('envarpay.config.schema.json'));
-const buyerValidator = ajv.compile(schema('buyer-policy.schema.json'));
-const USDC = {
-    'eip155:84532': '0x036cbd53842c5426634e7929541ec2318f3dcf7e',
-    'eip155:8453': '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913',
-};
 export function atomic(value) {
     if (typeof value !== 'string' || !/^[1-9][0-9]{0,77}$/.test(value))
         throw new CommerceError('invalid_amount', 'Use a positive integer string in smallest currency units');
@@ -43,7 +38,7 @@ export function validateUrl(value, allowPrivate = false) {
     return url;
 }
 export function currencyOf(profile) {
-    return profile.adapter === 'x402' ? `${profile.network}/erc20:${profile.asset.toLowerCase()}` : profile.currency;
+    return profile.currency;
 }
 function assertJson(value) {
     if (typeof value === 'number' && (!Number.isFinite(value) || (Number.isInteger(value) && !Number.isSafeInteger(value))))
@@ -64,22 +59,29 @@ export function digest(value) {
         throw new CommerceError('invalid_json', 'Cannot canonicalize input');
     return createHash('sha256').update(serialized).digest('hex');
 }
+/** Keep legacy quotes unchanged; skill-bound quotes freeze the installed skill revision too. */
+export function serviceTermsDigest(configVersion, service, offer, profile) {
+    const terms = { contract: service.contract, offer, profile };
+    return digest(configVersion === 2 && service.execution.type === 'skill'
+        ? { ...terms, skill: { name: service.id, digest: service.execution.skillDigest } }
+        : terms);
+}
 export function loadCommerceConfig(value) {
     if (!sellerValidator(value))
         throw new CommerceError('invalid_config', ajv.errorsText(sellerValidator.errors));
     const config = structuredClone(value);
     const services = new Set();
-    for (const profile of Object.values(config.paymentProfiles)) {
-        if (profile.adapter === 'x402') {
-            if (USDC[profile.network] !== profile.asset.toLowerCase() || BigInt(profile.payTo) === 0n)
-                throw new CommerceError('unsupported_payment_profile', 'MVP accepts official Base or Base Sepolia USDC and a nonzero receiving address');
-            validateUrl(profile.facilitatorUrl);
-        }
-    }
     for (const service of config.services) {
         if (services.has(service.id))
             throw new CommerceError('duplicate_service', 'Service IDs must be unique');
         services.add(service.id);
+        if (config.configVersion === 2 && service.execution.type === 'skill') {
+            if (service.id !== service.name)
+                throw new CommerceError('skill_name_mismatch', 'A version 2 service must use the exact installed skill name as its ID and name');
+        }
+        else if (config.configVersion === 1 && service.execution.type !== 'a2a') {
+            throw new CommerceError('legacy_skill_mode', 'Skill-bound services require configVersion 2');
+        }
         validateUrl(service.execution.cardUrl, true);
         noExternalRefs(service.contract.inputSchema);
         const inputAjv = new Ajv2020({ strict: true });
@@ -95,9 +97,9 @@ export function loadCommerceConfig(value) {
             const profile = config.paymentProfiles[offer.paymentProfile];
             if (!profile)
                 throw new CommerceError('missing_payment_profile', 'Offer refers to an unknown payment profile');
-            let low, high;
+            let high;
             if (offer.pricing.kind === 'fixed')
-                low = high = atomic(offer.pricing.amount);
+                high = atomic(offer.pricing.amount);
             else {
                 const q = offer.pricing.quantity;
                 if (q.min > q.max)
@@ -110,73 +112,13 @@ export function loadCommerceConfig(value) {
                 }
                 if (node.type !== 'array' || q.min < Number(node.minItems ?? 0) || q.max > Number(node.maxItems ?? 10000))
                     throw new CommerceError('invalid_quantity', 'Quantity must reference a bounded declared array');
-                low = atomic(offer.pricing.unitAmount) * BigInt(q.min);
                 high = atomic(offer.pricing.unitAmount) * BigInt(q.max);
             }
             if (high >= 2n ** 256n)
                 throw new CommerceError('invalid_amount', 'Maximum total exceeds supported integer range');
-            if (profile.adapter === 'mpp' && low < 50n)
-                throw new CommerceError('card_minimum', 'USD card orders must be at least 50 cents');
+            if (high > 2n ** 63n - 1n)
+                throw new CommerceError('balance_amount', 'Envar balance prices must fit signed micro-USD');
         }
     }
     return config;
 }
-export function loadBuyerPolicy(value) {
-    if (!buyerValidator(value))
-        throw new CommerceError('invalid_policy', ajv.errorsText(buyerValidator.errors));
-    const policy = structuredClone(value);
-    const normalizedCurrency = (currency) => {
-        if (currency === 'usd')
-            return currency;
-        const match = /^(eip155:[1-9][0-9]*)\/erc20:(0x[0-9a-fA-F]{40})$/.exec(currency);
-        if (!match || USDC[match[1]] !== match[2].toLowerCase())
-            throw new CommerceError('unsupported_currency', 'Buyer budget must use USD or an official supported USDC asset');
-        return `${match[1]}/erc20:${match[2].toLowerCase()}`;
-    };
-    const limits = new Map();
-    for (const b of policy.budgets) {
-        b.currency = normalizedCurrency(b.currency);
-        if (limits.has(b.currency))
-            throw new CommerceError('duplicate_budget', 'Only one budget per currency is allowed');
-        limits.set(b.currency, atomic(b.maxTotal));
-    }
-    const ids = new Set();
-    for (const peer of policy.peers) {
-        validateUrl(peer.cardUrl);
-        if (peer.mode === 'standard-a2a') {
-            const endpoint = validateUrl(peer.endpoint), card = validateUrl(peer.cardUrl);
-            if (endpoint.origin !== card.origin || endpoint.search || endpoint.href !== peer.endpoint || card.href !== peer.cardUrl)
-                throw new CommerceError('standard_peer_endpoint', 'Review an exact same-origin HTTPS A2A endpoint without query parameters');
-            noExternalRefs(peer.localContract.inputSchema);
-            if (JSON.stringify(peer.localContract.inputSchema).length > 512 * 1024)
-                throw new CommerceError('standard_peer_schema', 'Local input schema exceeds 512 KiB');
-            try {
-                const inputAjv = new Ajv2020({ strict: true });
-                addFormats(inputAjv);
-                inputAjv.compile(peer.localContract.inputSchema);
-            }
-            catch {
-                throw new CommerceError('standard_peer_schema', 'Local input schema must be a valid supported JSON Schema');
-            }
-            if (atomic(peer.localContract.amount) > atomic(peer.maxPerPurchase))
-                throw new CommerceError('purchase_limit', 'Locally reviewed standard-peer price exceeds the per-purchase limit');
-        }
-        if (ids.has(peer.id))
-            throw new CommerceError('duplicate_peer', 'Peer IDs must be unique');
-        ids.add(peer.id);
-        if (peer.protocol === 'free')
-            continue;
-        peer.currency = normalizedCurrency(peer.currency);
-        if (peer.protocol === 'x402') {
-            if (!/^0x[0-9a-fA-F]{40}$/.test(peer.recipient) || BigInt(peer.recipient) === 0n || peer.currency === 'usd')
-                throw new CommerceError('invalid_recipient', 'x402 peers require a nonzero EVM recipient and USDC asset');
-            peer.recipient = peer.recipient.toLowerCase();
-        }
-        else if (peer.currency !== 'usd' || !/^profile_[A-Za-z0-9]+$/.test(peer.recipient))
-            throw new CommerceError('invalid_recipient', 'MPP peers require USD and a verified Stripe merchant profile');
-        const limit = limits.get(peer.currency);
-        if (limit === undefined || atomic(peer.maxPerPurchase) > limit)
-            throw new CommerceError('invalid_budget', 'Each peer needs a cumulative budget at least as large as its per-purchase limit');
-    }
-    return policy;
-}

package/dist/commerce/configure.d.ts

@@ -0,0 +1,2 @@
+export declare function refreshLauncher(directory: string): void;
+export declare function upgradeDiscovery(directory: string, home?: string): void;

package/dist/commerce/configure.js

@@ -0,0 +1,78 @@
+import { readFileSync, writeFileSync, lstatSync, existsSync, renameSync, } from "node:fs";
+import { join, resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CommerceError } from "./types.js";
+function read(path) {
+    const s = lstatSync(path);
+    if (!s.isFile() ||
+        s.isSymbolicLink() ||
+        s.size > 1024 * 1024 ||
+        s.mode & 0o077)
+        throw new CommerceError("private_file", "Use an owner-only configuration file");
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+function save(path, value) {
+    const temp = path + ".tmp";
+    writeFileSync(temp, JSON.stringify(value, null, 2) + "\n", {
+        mode: 0o600,
+        flag: "wx",
+    });
+    renameSync(temp, path);
+}
+export function refreshLauncher(directory) {
+    const root = resolve(directory), connection = read(join(root, "connection.json")), settingsPath = join(root, "runtime.json");
+    // alpha.10 start scripts recorded the port in generated source. Parse JSON argv only; never evaluate code.
+    let port;
+    if (existsSync(settingsPath))
+        port = read(settingsPath).port;
+    else {
+        const old = readFileSync(join(root, "start.mjs"), "utf8");
+        const array = /spawn\([^\n]*?,(\[[^\n]+\]),\{stdio:/.exec(old)?.[1];
+        if (!array)
+            throw new CommerceError("setup_upgrade", "Cannot infer original start settings. Use serve with original files.");
+        const args = JSON.parse(array);
+        port = Number(args[args.indexOf("--port") + 1]);
+    }
+    if (!Number.isInteger(port) || port < 1024 || port > 65535)
+        throw new CommerceError("setup_port", "Invalid local service port");
+    const args = [
+        fileURLToPath(new URL("./cli.js", import.meta.url)),
+        "serve",
+        "--config",
+        join(root, "seller.json"),
+        "--credentials",
+        join(root, "credentials.json"),
+        "--state",
+        join(root, "seller.sqlite3"),
+        "--origin",
+        new URL(connection.url).origin,
+        "--host",
+        "127.0.0.1",
+        "--port",
+        String(port),
+        "--envar-config",
+        join(root, "envar.json"),
+        "--envar-credentials",
+        join(root, "envar.token"),
+    ];
+    save(settingsPath, { port });
+    const start = join(root, "start.mjs");
+    writeFileSync(start, `import {spawn} from 'node:child_process';\nconst child=spawn(${JSON.stringify(process.execPath)},${JSON.stringify(args)},{stdio:'inherit'});\nfor(const signal of ['SIGTERM','SIGINT'])process.on(signal,()=>child.kill(signal));\nchild.on('exit',code=>process.exit(code??1));\n`, { mode: 0o700 });
+}
+export function upgradeDiscovery(directory, home) {
+    const root = resolve(directory), file = join(root, "credentials.json"), credentials = read(file);
+    if (credentials.skills?.framework !== "hermes")
+        throw new CommerceError("setup_framework", "This discovery setup supports Hermes");
+    const skill = credentials.skills;
+    const hermesHome = home ??
+        skill.discovery?.hermesHome ??
+        (skill.dockerStateDirectory
+            ? dirname(dirname(skill.dockerStateDirectory))
+            : undefined);
+    if (!hermesHome)
+        throw new CommerceError("setup_home", "Pass --hermes-home with your existing Hermes profile directory");
+    credentials.skills.discovery = { hermesHome, enabledFromWeb: true };
+    refreshLauncher(root);
+    save(file, credentials);
+    console.log(`Discovery enabled. Stop the original service with Ctrl+C, then restart:\n${process.execPath} ${JSON.stringify(join(root, "start.mjs"))}\nInstalled Skills will appear privately in Envar. No service is automatically enabled or published.`);
+}

package/dist/commerce/discovery.d.ts

@@ -0,0 +1,20 @@
+import type { NativeSkillSettings } from "./native-skills.js";
+import type { EnvarIntegration } from "./envar.js";
+export interface DiscoverySettings {
+    hermesHome: string;
+    enabledFromWeb: true;
+    roots?: string[];
+}
+export declare class SkillDiscovery {
+    private settings;
+    private discovery;
+    private origin;
+    private enabled;
+    private cached;
+    private nextScan;
+    private state;
+    readonly path: string;
+    constructor(settings: NativeSkillSettings, discovery: DiscoverySettings, origin: string);
+    private scan;
+    sync(integration: EnvarIntegration): Promise<void>;
+}