@envarai/envarpay 0.2.0-alpha.8 → 2026.1025.1

package/dist/commerce/setup.js

@@ -0,0 +1,379 @@
+/** Guided local installation. Platform input is data, never a shell command or wallet policy. */
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync, cpSync, mkdtempSync, renameSync, rmSync, } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve, relative, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { randomBytes } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+import { probeOpenClaw } from "./openclaw-setup.js";
+import { readInstalledSkills } from "./native-skills.js";
+import { loadCommerceConfig, validateUrl } from "./config.js";
+import { CommerceError } from "./types.js";
+import { isSkillInstallerMetadata } from './native-inventory.js';
+const ID = /^[a-z][a-z0-9-]{0,63}$/, CONTAINER = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
+export function parseSetupBundle(raw) {
+    const v = raw;
+    if (!v ||
+        v.version !== 1 ||
+        !/^[0-9a-f-]{36}$/.test(v.agentId) ||
+        !ID.test(v.runtimeAgentId) ||
+        typeof v.agentName !== "string" ||
+        v.agentName.length > 120 ||
+        !/^envar_agent_[A-Za-z0-9_-]{32,100}$/.test(v.token) ||
+        !Number.isFinite(Date.parse(v.expiresAt)) ||
+        Date.parse(v.expiresAt) <= Date.now())
+        throw new CommerceError("setup_file", "Download a fresh Agent setup file from Envar");
+    const origin = validateUrl(v.platformOrigin);
+    if (origin.origin !== v.platformOrigin)
+        throw new CommerceError("setup_origin", "Use the platform HTTPS origin");
+    return v;
+}
+export function prepareTextSkill(source, destination, name) {
+    if (!ID.test(name) || existsSync(destination))
+        throw new CommerceError("setup_skill", "Choose a new exact skill name");
+    const stat = lstatSync(source);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new CommerceError("setup_skill", "Choose a real skill directory");
+    cpSync(source, destination, {
+        recursive: true,
+        filter: (path) => {
+            const item = lstatSync(path);
+            if (item.isSymbolicLink())
+                throw new CommerceError("setup_skill", "Skill symlinks are unsupported");
+            if (item.isFile() && isSkillInstallerMetadata(relative(source, path).split(sep).join('/')))
+                return false;
+            if (item.isFile() &&
+                !/\.(md|txt)$/i.test(path) &&
+                !path.endsWith("/LICENSE"))
+                throw new CommerceError("setup_skill", "Choose a text-only package without scripts or binaries");
+            return true;
+        },
+    });
+    const file = join(destination, "SKILL.md"), original = readFileSync(file, "utf8");
+    if (!original.startsWith("---\n") && !original.startsWith("---\r\n"))
+        throw new CommerceError("setup_skill", "Skill needs YAML frontmatter");
+    const adapted = original.replace(/^(---\r?\n)([\s\S]*?)(\r?\n---)/, (_all, open, front, close) => open +
+        front.replace(/^envar-runtime:.*\r?\n?/gm, "") +
+        "\nenvar-runtime: instruction-only" +
+        close);
+    writeFileSync(file, adapted +
+        "\n\n## Service execution\nUse the supplied buyer input as the complete product context. Bundled Markdown references are included in the task context. Return text in the A2A result. Do not browse, access files, run scripts, or invoke other skills. If information is missing, state what is missing; do not invent it.\n", { mode: 0o600 });
+}
+function privateJson(path, value) {
+    writeFileSync(path, JSON.stringify(value, null, 2) + "\n", {
+        mode: 0o600,
+        flag: "wx",
+    });
+}
+export async function setupAgent(options) {
+    const file = resolve(options.file), info = lstatSync(file);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 16384)
+        throw new CommerceError("setup_file", "Use the downloaded setup JSON file");
+    const bundle = parseSetupBundle(JSON.parse(readFileSync(file, "utf8")));
+    if (options.container && !CONTAINER.test(options.container))
+        throw new CommerceError("setup_container", "Use a Docker container name");
+    if (!process.stdin.isTTY && !options.automatic)
+        throw new CommerceError("setup_terminal", "Run setup in an interactive terminal to select skills");
+    chmodSync(file, 0o600);
+    const prompt = options.automatic ? undefined : createInterface({ input: process.stdin, output: process.stdout });
+    const output = options.automatic ? (..._args) => { } : console.log;
+    const ask = async (label, fallback = "") => (await prompt.question(`${label}${fallback ? ` [${fallback}]` : ""}: `)).trim() || fallback;
+    let staging;
+    try {
+        output(`\nConnect ${bundle.agentName} to ${bundle.platformOrigin}\nModel credentials and tasks remain on this machine. Start with free services; no wallet is created.\n`);
+        if (!options.automatic && (await ask("Continue? (yes/no)", "no")).toLowerCase() !== "yes")
+            return;
+        const directory = resolve(options.directory ?? join(homedir(), ".envarpay", bundle.agentId));
+        if (existsSync(directory))
+            throw new CommerceError("setup_exists", "This Agent already has a local directory. Use its start script; never reset its ledger.");
+        const configuredFramework = process.env.ENVARPAY_FRAMEWORK;
+        const framework = options.framework ?? (configuredFramework === "hermes" || configuredFramework === "openclaw" ? configuredFramework : process.env.OPENCLAW_STATE_DIR ? "openclaw" : "hermes");
+        let python = options.python;
+        let probe;
+        if (framework === "openclaw") {
+            if (options.container)
+                throw new CommerceError("setup_runtime", "Run OpenClaw setup inside its own runtime");
+            python ??= "python3";
+            probe = probeOpenClaw(options.home, python);
+        }
+        else {
+            const compatibility = 'import inspect;from run_agent import AIAgent;assert all(k in inspect.signature(AIAgent).parameters for k in ["skip_context_files","skip_memory","skip_background_review","ephemeral_system_prompt","enabled_toolsets"])';
+            if (!python && options.container) {
+                for (const candidate of [
+                    "/opt/hermes-latest/bin/python",
+                    "/opt/hermes/.venv/bin/python",
+                    "python3",
+                ]) {
+                    try {
+                        execFileSync("docker", ["exec", options.container, candidate, "-c", compatibility], { stdio: "pipe", timeout: 60000 });
+                        python = candidate;
+                        break;
+                    }
+                    catch {
+                        /* try the next compatible installed interpreter */
+                    }
+                }
+                if (!python)
+                    throw new CommerceError("setup_runtime", "No compatible Hermes interpreter found in this container. Update Hermes or pass --python PATH.");
+            }
+            if (!python && options.automatic) {
+                for (const candidate of [process.env.VIRTUAL_ENV && join(process.env.VIRTUAL_ENV, "bin/python"), "/opt/hermes-latest/bin/python", "/opt/hermes/.venv/bin/python", join(homedir(), "hermes-agent/.venv/bin/python"), "python3"].filter(Boolean)) {
+                    try {
+                        execFileSync(candidate, ["-c", compatibility], { stdio: "pipe", timeout: 30000 });
+                        python = candidate;
+                        break;
+                    }
+                    catch { }
+                }
+                if (!python)
+                    throw new CommerceError("setup_runtime", "No compatible Hermes Python found. Pass its executable using --python.");
+            }
+            python ??= await ask("Hermes Python executable", join(homedir(), "hermes-agent", ".venv", "bin", "python"));
+            const probeSource = readFileSync(new URL("../../runtime/hermes-setup-probe.py", import.meta.url), "utf8");
+            try {
+                if (options.container)
+                    execFileSync("docker", ["exec", options.container, python, "-c", compatibility], { stdio: "pipe", timeout: 60000 });
+                else
+                    execFileSync(python, ["-c", compatibility], {
+                        stdio: "pipe",
+                        timeout: 60000,
+                    });
+                const args = ["-c", probeSource, ...(options.home ? [options.home] : [])];
+                const data = options.container
+                    ? execFileSync("docker", ["exec", options.container, python, ...args], {
+                        stdio: "pipe",
+                        timeout: 30000,
+                        maxBuffer: 2 * 1024 * 1024,
+                    })
+                    : execFileSync(python, args, {
+                        stdio: "pipe",
+                        timeout: 30000,
+                        maxBuffer: 2 * 1024 * 1024,
+                    });
+                probe = JSON.parse(data.toString());
+            }
+            catch {
+                throw new CommerceError("setup_model", "Could not read Hermes. Check the container/Python path and configure an OpenAI-compatible model in Hermes first.");
+            }
+        }
+        const candidates = probe.skills.filter((s) => s.textPackage && ID.test(s.name));
+        output(`Model: ${probe.model}\nInstalled text packages (review their instructions before selecting):`);
+        candidates.forEach((skill, i) => output(`${i + 1}. ${skill.name} — ${skill.description.replace(/[\r\n\x1b]/g, " ").slice(0, 160)}`));
+        output('Newly installed Skills will be discovered privately. Enable each one from the Envar service page after reviewing text-only compatibility.');
+        const selected = (options.automatic ? "" : await ask("Optional: enable existing text Skills now (comma separated, Enter to skip)"))
+            .split(",")
+            .map((s) => s.trim()).filter(Boolean);
+        if (selected.length > 32 ||
+            new Set(selected).size !== selected.length ||
+            selected.some((name) => !candidates.some((s) => s.name === name)))
+            throw new CommerceError("setup_skills", "Choose installed skill names from the list");
+        output("This adapter supplies buyer text and bundled Markdown references. Browser, script, file and API tools are disabled. Original Agent skills are preserved; a service copy is created.");
+        if (selected.length &&
+            (await ask("Do these selected skills work with text input and text output only? (yes/no)", "no")).toLowerCase() !== "yes")
+            return;
+        const port = options.automatic?.port ?? Number(await ask("Local service port", "4020"));
+        if (!Number.isInteger(port) || port < 1024 || port > 65535)
+            throw new CommerceError("setup_port", "Choose a local port from 1024 to 65535");
+        let origin;
+        const tunnelMode = options.automatic ? "url" : await ask("Public HTTPS: use an existing ngrok session or your own reverse proxy? (ngrok/url)", "ngrok");
+        if (tunnelMode === "ngrok") {
+            const api = new URL(await ask("Local ngrok API", "http://127.0.0.1:4040"));
+            if (api.protocol !== "http:" ||
+                api.hostname !== "127.0.0.1" ||
+                api.username ||
+                api.password ||
+                api.pathname !== "/")
+                throw new CommerceError("setup_tunnel", "Use the local ngrok API on 127.0.0.1");
+            const name = `envarpay-${bundle.agentId}`, addr = `http://127.0.0.1:${port}`;
+            const inventory = await fetch(new URL("/api/tunnels", api), {
+                signal: AbortSignal.timeout(10000),
+            });
+            if (!inventory.ok)
+                throw new CommerceError("setup_tunnel", "Start ngrok first, or choose your own HTTPS URL");
+            const existing = (await inventory.json()).tunnels.find((t) => t.name === name);
+            if (existing) {
+                if (existing.config.addr !== addr)
+                    throw new CommerceError("setup_tunnel", "The existing Agent tunnel uses another local port. Keep its original port.");
+                origin = existing.public_url;
+            }
+            else {
+                const response = await fetch(new URL("/api/tunnels", api), {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({
+                        name,
+                        proto: "http",
+                        addr,
+                        schemes: ["https"],
+                        inspect: false,
+                    }),
+                    signal: AbortSignal.timeout(15000),
+                });
+                if (!response.ok)
+                    throw new CommerceError("setup_tunnel", "Could not create a dedicated tunnel. Check ngrok or choose your own HTTPS URL. Existing tunnels were preserved.");
+                origin = (await response.json()).public_url;
+            }
+        }
+        else if (tunnelMode === "url") {
+            origin = options.automatic?.origin ?? await ask(`Public HTTPS origin (forward to http://127.0.0.1:${port})`);
+        }
+        else
+            throw new CommerceError("setup_tunnel", "Choose ngrok or url");
+        const publicUrl = validateUrl(origin);
+        if (publicUrl.origin !== origin ||
+            (publicUrl.port && publicUrl.port !== "443"))
+            throw new CommerceError("setup_origin", "Use an HTTPS origin on port443");
+        // Only publish a complete new setup directory. An interrupted setup cannot strand
+        // the owner behind setup_exists or overwrite a prior ledger.
+        mkdirSync(resolve(directory, ".."), { recursive: true, mode: 0o700 });
+        staging = mkdtempSync(directory + ".setup-");
+        chmodSync(staging, 0o700);
+        const skillsDirectory = join(staging, "skills");
+        mkdirSync(skillsDirectory, { mode: 0o700 });
+        for (const name of selected) {
+            const skill = candidates.find((s) => s.name === name);
+            if (options.container) {
+                const incoming = join(staging, `incoming-${name}`);
+                execFileSync("docker", ["cp", `${options.container}:${skill.path}`, incoming], { stdio: "pipe", timeout: 30000 });
+                prepareTextSkill(incoming, join(skillsDirectory, name), name);
+                rmSync(incoming, { recursive: true });
+            }
+            else
+                prepareTextSkill(skill.path, join(skillsDirectory, name), name);
+        }
+        readInstalledSkills(skillsDirectory, [], origin + "/.well-known/agent-card.json");
+        const access = randomBytes(36).toString("base64url");
+        let apiKeyFile = probe.apiKeyFile;
+        if (options.managed && apiKeyFile) {
+            const stat = lstatSync(apiKeyFile);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 16384)
+                throw new CommerceError("setup_model", "Invalid local model key file");
+            probe.apiKey = readFileSync(apiKeyFile, "utf8");
+            apiKeyFile = null;
+        }
+        if (!apiKeyFile) {
+            if (options.container) {
+                apiKeyFile = join(probe.home, "envarpay-secrets", bundle.agentId, "model.key");
+                // Key bytes travel through stdin, never process arguments or console output.
+                const writeKey = "import sys,os;from pathlib import Path;p=Path(sys.argv[1]);p.parent.mkdir(parents=True,exist_ok=True,mode=0o700);fd=os.open(p,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600);os.write(fd,sys.stdin.buffer.read());os.close(fd)";
+                try {
+                    execFileSync("docker", [
+                        "exec",
+                        "-i",
+                        options.container,
+                        python,
+                        "-c",
+                        writeKey,
+                        apiKeyFile,
+                    ], {
+                        input: probe.apiKey,
+                        stdio: ["pipe", "pipe", "pipe"],
+                        timeout: 15000,
+                    });
+                }
+                catch {
+                    throw new CommerceError("setup_model", "Could not save the local model credential. Inspect the Agent-specific envarpay-secrets directory before retrying.");
+                }
+            }
+            else {
+                apiKeyFile = join(directory, "model.key");
+                writeFileSync(join(staging, "model.key"), probe.apiKey, {
+                    mode: 0o600,
+                    flag: "wx",
+                });
+            }
+        }
+        const stateDirectory = join(directory, "tasks");
+        mkdirSync(join(staging, "tasks"), { mode: 0o700 });
+        const dockerStateDirectory = options.container
+            ? join(probe.home, "envarpay-tasks", bundle.agentId)
+            : undefined;
+        const config = loadCommerceConfig({
+            configVersion: 2,
+            agent: { id: bundle.runtimeAgentId, name: bundle.agentName },
+            paymentProfiles: {},
+            services: [],
+        });
+        privateJson(join(staging, "seller.json"), config);
+        writeFileSync(join(staging, "vault.key"), randomBytes(32), { mode: 0o600, flag: "wx" });
+        privateJson(join(staging, "credentials.json"), {
+            callers: { [access]: "owner" },
+            upstreams: {},
+            vaultKeyFile: join(directory, "vault.key"),
+            skills: {
+                framework,
+                ...(probe.command ? { command: probe.command } : {}),
+                discovery: { hermesHome: probe.home, enabledFromWeb: true, ...(probe.skillRoots ? { roots: probe.skillRoots } : {}) },
+                skillsDirectory: join(directory, "skills"),
+                freeSkills: [],
+                stateDirectory,
+                python,
+                model: probe.model,
+                baseUrl: probe.baseUrl,
+                apiKeyFile,
+                ...(options.container
+                    ? { dockerContainer: options.container, dockerStateDirectory }
+                    : {}),
+            },
+        });
+        writeFileSync(join(staging, "envar.token"), bundle.token, {
+            mode: 0o600,
+            flag: "wx",
+        });
+        privateJson(join(staging, "envar.json"), {
+            policy: {
+                enabled: true,
+                platformOrigin: bundle.platformOrigin,
+                agentId: bundle.agentId,
+                runtimeAgentId: bundle.runtimeAgentId,
+                acceptUpdates: true,
+                allowedServices: selected,
+                allowedUpstreamOrigins: [origin],
+                allowedBalanceAccounts: ["envar"],
+            },
+            stateDirectory: join(directory, "envar-state"),
+            configDirectory: join(directory, "envar-configs"),
+        });
+        privateJson(join(staging, "connection.json"), {
+            version: 1,
+            agentId: bundle.agentId,
+            url: origin + "/.well-known/agent-card.json",
+            authToken: access,
+        });
+        const cli = fileURLToPath(new URL("./cli.js", import.meta.url));
+        const args = [
+            cli,
+            "serve",
+            "--config",
+            join(directory, "seller.json"),
+            "--credentials",
+            join(directory, "credentials.json"),
+            "--state",
+            join(directory, "seller.sqlite3"),
+            "--origin",
+            origin,
+            "--host",
+            "127.0.0.1",
+            "--port",
+            String(port),
+            "--envar-config",
+            join(directory, "envar.json"),
+            "--envar-credentials",
+            join(directory, "envar.token"),
+        ];
+        const start = join(directory, "start.mjs");
+        writeFileSync(join(staging, "start.mjs"), `import {spawn} from 'node:child_process';\nconst child=spawn(${JSON.stringify(process.execPath)},${JSON.stringify(args)},{stdio:'inherit'});\nfor(const signal of ['SIGTERM','SIGINT'])process.on(signal,()=>child.kill(signal));\nchild.on('exit',code=>process.exit(code??1));\n`, { mode: 0o700, flag: "wx" });
+        writeFileSync(join(staging, "README.md"), `# ${bundle.agentName}\n\n1. Start: node ${JSON.stringify(start)}\n2. Keep this process, your Agent and the HTTPS tunnel running.\n3. In Envar, import connection.json and select Check connection.\n4. Choose a Skill. You can publish it free immediately.\n5. For a paid Skill, request Envar balance receiving approval in Envar, then enter the USD price. This setup already allows the local receiving reference \"envar\"; there is no chain wallet or payment protocol to configure.\n6. Select Test service, then Publish after Envar confirms the live unpaid quote.\n\nThe Envar Agent token expires ${bundle.expiresAt}. Keep the original files and ledger when restarting. Never share credentials.json, envar.token or vault.key.\n`, { mode: 0o600, flag: "wx" });
+        renameSync(staging, directory);
+        staging = undefined;
+        output(`\nReady. Start the local service:\n${process.execPath} ${JSON.stringify(start)}\n\nThen import this connection file in Envar:\n${join(directory, "connection.json")}\n\nKeep the service and HTTPS tunnel online. No task or payment was performed.`);
+    }
+    finally {
+        prompt?.close();
+        if (staging)
+            rmSync(staging, { recursive: true, force: true });
+    }
+}
+// Preserve the existing SDK helper name for callers using Hermes explicitly.
+export const setupHermes = (options) => setupAgent({ ...options, framework: "hermes" });

package/dist/commerce/store.d.ts

@@ -80,8 +80,18 @@ export declare class CommerceStore implements TaskStore {
     hasUnresolvedContinuation(orderId: string): boolean;
     acknowledgeRecoveredContinuations(orderId: string, task: Task): void;
     recoverInterruptedDispatches(): number;
+    prepareExternalTask(orderId: string, principal: string): void;
+    externalTasks(principal: string, services: readonly string[]): {
+        order: OrderRecord;
+        claimId: string;
+    }[];
+    claimExternalTask(taskId: string, principal: string, services: readonly string[]): {
+        order: OrderRecord;
+        claimId: string;
+    };
+    externalClaim(taskId: string, principal: string, claimId: string, services: readonly string[]): OrderRecord;
     private scope;
-    save(task: Task, context: ServerCallContext): Promise<void>;
+    save(task: Task, context: ServerCallContext, expectedOriginal?: Task): Promise<void>;
     load(taskId: string, context: ServerCallContext): Promise<Task | undefined>;
     list(params: ListTasksRequest, context: ServerCallContext): Promise<ListTasksResponse>;
     fingerprint(order: OrderRecord): string;

package/dist/commerce/store.js

@@ -97,7 +97,11 @@ export class CommerceStore {
       state TEXT NOT NULL CHECK(state IN ('ready','dispatching','done','unknown')), UNIQUE(order_id,message_id)
     );
     CREATE INDEX IF NOT EXISTS commerce_tasks_owner_tenant_updated ON commerce_tasks(owner,tenant,updated_at DESC,id);
-    CREATE INDEX IF NOT EXISTS commerce_continuations_order_state ON commerce_continuations(order_id,state);`);
+    CREATE INDEX IF NOT EXISTS commerce_continuations_order_state ON commerce_continuations(order_id,state);
+    CREATE TABLE IF NOT EXISTS commerce_external_claims(
+      order_id TEXT PRIMARY KEY REFERENCES commerce_orders(id),
+      principal TEXT NOT NULL, claim_id TEXT NOT NULL DEFAULT ''
+    );`);
     }
     migrateV1() {
         // Rebuild only the state constraint. Preserve original IDs, credentials and every payment row.
@@ -394,17 +398,47 @@ export class CommerceStore {
             return pending.length;
         });
     }
+    prepareExternalTask(orderId, principal) {
+        const order = this.order(this.db.prepare('SELECT * FROM commerce_orders WHERE id=?').get(orderId));
+        if (!order || !['confirmed', 'not_required'].includes(order.paymentState) || order.executionState !== 'dispatching')
+            throw new CommerceError('external_payment_required', 'Only a dispatched and payment-approved original order can be delegated');
+        const existing = this.db.prepare('SELECT principal FROM commerce_external_claims WHERE order_id=?').get(orderId);
+        if (existing && existing.principal !== principal)
+            throw new CommerceError('external_owner', 'Original execution belongs to another external agent');
+        this.db.prepare('INSERT OR IGNORE INTO commerce_external_claims(order_id,principal) VALUES (?,?)').run(orderId, principal);
+    }
+    externalTasks(principal, services) {
+        return this.db.prepare("SELECT o.*,c.claim_id FROM commerce_orders o JOIN commerce_external_claims c ON c.order_id=o.id WHERE c.principal=? AND o.payment_state IN ('confirmed','not_required') AND o.execution_state IN ('input_required','working') ORDER BY o.rowid LIMIT 100").all(principal).filter(r => services.includes(String(r.service_revision).split(':')[0])).map(r => ({ order: this.order(r), claimId: String(r.claim_id) }));
+    }
+    claimExternalTask(taskId, principal, services) {
+        return this.transaction(() => {
+            const row = this.db.prepare("SELECT o.*,c.claim_id FROM commerce_orders o JOIN commerce_external_claims c ON c.order_id=o.id WHERE o.task_id=? AND c.principal=? AND o.payment_state IN ('confirmed','not_required') AND o.execution_state IN ('input_required','working','completed','failed')").get(taskId, principal);
+            if (!row || !services.includes(String(row.service_revision).split(':')[0]))
+                throw new CommerceError('external_task', 'Original Task is outside this external agent scope');
+            const claimId = String(row.claim_id) || randomUUID();
+            this.db.prepare('UPDATE commerce_external_claims SET claim_id=? WHERE order_id=?').run(claimId, String(row.id));
+            return { order: this.order(row), claimId };
+        });
+    }
+    externalClaim(taskId, principal, claimId, services) {
+        const row = this.db.prepare("SELECT o.* FROM commerce_orders o JOIN commerce_external_claims c ON c.order_id=o.id WHERE o.task_id=? AND c.principal=? AND c.claim_id=? AND c.claim_id!='' AND o.payment_state IN ('confirmed','not_required')").get(taskId, principal, claimId);
+        if (!row || !services.includes(String(row.service_revision).split(':')[0]))
+            throw new CommerceError('external_claim', 'Claim does not identify an authorized original Task');
+        return this.order(row);
+    }
     scope(context) {
         if (!context.user?.isAuthenticated || !context.user.userName)
             throw new CommerceError('authentication_required', 'Authenticated task owner required');
         return { owner: context.user.userName, tenant: context.tenant ?? '' };
     }
-    async save(task, context) {
+    async save(task, context, expectedOriginal) {
         const scope = this.scope(context);
         this.transaction(() => {
             const current = this.db.prepare('SELECT owner,tenant,task_json FROM commerce_tasks WHERE id=?').get(task.id);
             if (current && (current.owner !== scope.owner || current.tenant !== scope.tenant))
                 throw new CommerceError('task_owner_conflict', 'Cannot replace another owner task');
+            if (expectedOriginal && current?.task_json !== JSON.stringify(Task.toJSON(expectedOriginal)))
+                throw new CommerceError('external_result_conflict', 'Original Task changed while preparing this result; read and recover it before retrying');
             const order = this.db.prepare('SELECT payment_state FROM commerce_orders WHERE task_id=?').get(task.id);
             if (order && !['confirmed', 'not_required'].includes(String(order.payment_state)))
                 throw new CommerceError('payment_required', 'Cannot publish task execution before payment');

package/dist/commerce/types.d.ts

@@ -27,16 +27,7 @@ export interface Offer {
     paymentProfile?: string;
 }
 export type PaymentProfile = {
-    adapter: 'x402';
-    scheme: 'exact';
-    network: string;
-    asset: string;
-    payTo: string;
-    facilitatorUrl: string;
-} | {
-    adapter: 'mpp';
-    method: 'stripe';
-    intent: 'charge';
+    adapter: 'envar_balance';
     currency: 'usd';
     accountRef: string;
 };
@@ -69,52 +60,6 @@ export interface CommerceConfig {
     paymentProfiles: Record<string, PaymentProfile>;
     services: Service[];
 }
-/** A separately reviewed transport profile; local terms are never advertised as seller promises. */
-export interface StandardA2APeer {
-    id: string;
-    cardUrl: string;
-    mode: 'standard-a2a';
-    protocol: 'x402';
-    currency: string;
-    recipient: string;
-    maxPerPurchase: string;
-    endpoint: string;
-    authentication: 'none' | 'bearer';
-    localContract: {
-        revision: number;
-        offerId: string;
-        inputSchema: Record<string, unknown>;
-        amount: string;
-        paidOnly: true;
-    };
-}
-export interface BuyerPolicy {
-    policyVersion: 1;
-    paymentsEnabled: boolean;
-    approval: 'per_purchase' | 'within_preapproved_limits';
-    peers: (StandardA2APeer | {
-        id: string;
-        cardUrl: string;
-        mode?: 'envarpay';
-        protocol: 'x402' | 'mpp';
-        currency: string;
-        recipient: string;
-        maxPerPurchase: string;
-    } | {
-        id: string;
-        cardUrl: string;
-        mode?: 'envarpay';
-        protocol: 'free';
-        currency: null;
-        recipient: null;
-        maxPerPurchase: '0';
-    })[];
-    budgets: {
-        currency: string;
-        maxTotal: string;
-        period: 'cumulative';
-    }[];
-}
 export interface PriceQuote {
     quoteVersion: 1;
     quoteId: string;

package/examples/envar-integration-policy.json

@@ -6,13 +6,5 @@
   "acceptUpdates": true,
   "allowedServices": ["research"],
   "allowedUpstreamOrigins": ["http://hermes:9000"],
-  "allowedX402": [
-    {
-      "network": "eip155:84532",
-      "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
-      "payTo": "0x2222222222222222222222222222222222222222",
-      "facilitatorOrigin": "https://facilitator.example"
-    }
-  ],
-  "allowedMppAccounts": ["seller-stripe"]
+  "allowedBalanceAccounts": ["envar"]
 }