@envarai/envarpay 0.2.0-alpha.9 → 2026.1025.1

package/README.md

@@ -1,69 +1,31 @@
-# EnvarPay TypeScript
+# `@envarai/envarpay`
 
-Independent service commerce for user-operated Agents. Public communication uses
-A2A 1.0; payments use native x402 v2 exact USDC or MPP Stripe charge. Prices and
-scope are versioned configuration, enforced before dispatch, not instructions in
-a prompt. Envar is an optional directory and management UI.
+This package runs an A2A seller gate for free services and Envar account-balance purchases. Buyers use their Envar Wallet; this package does not sign buyer payments.
 
-The 0.2 source line replaces the previous npm wallet-only MCP client. Build from
-this checkout while the release is undergoing acceptance; a source version is
-not evidence that its npm/OCI artifact is published.
+## Recommended setup
 
-## Runtime and entry points
-
-Node.js 22.14+ (Node 24 recommended). SQLite is single-instance. Contracts can be
-read without loading the seller or buyer runtime; Bun validation covers the
-contracts entry, not the SQLite server.
-
-| Entry | Purpose |
-|---|---|
-| `@envarai/envarpay` | Config types/validation, integer pricing, quotes and A2A Cards |
-| `/server` | Durable seller A2A handler, exact x402 gate and native upstream executor |
-| `/client` | Buyer policy, atomic budgets, original-operation recovery and private management |
-| `/mpp` | Opt-in native MPP seller and read-only Stripe reconciliation |
-| `/envar` | Optional bounded config pull/ack and durable observation reports |
+Use the Agent-specific setup file downloaded from Envar:
 
 ```sh
-npm ci --ignore-scripts
-npm run build
-node dist/commerce/cli.js init --directory ./private
-node dist/commerce/cli.js validate --config ./private/seller.json
+envarpay setup --file /private/path/envar-setup.json
 ```
 
-Initialization writes examples and a vault key; it never creates a purchase or
-funds a wallet. Replace example addresses/hosts and review service limits before
-starting. Keep Agent model credentials in the Agent, and signer keys in a separate
-private wallet boundary.
+Follow the terminal prompts to select a Hermes or OpenClaw runtime and its text Skills. Setup creates an owner-only directory containing `seller.json`, `credentials.json`, `envar.json`, `envar.token`, `vault.key`, `connection.json`, and `start.mjs`. Run the printed `node .../start.mjs` command, import `connection.json` in Envar, and select **Check connection**. The public [Agent guide](https://envar.ai/guide/agents) gives the platform-specific steps and the test message to send.
 
-```sh
-node dist/commerce/cli.js serve --config seller.json \
-  --credentials private/seller-auth.json --state private/seller.sqlite3 \
-  --origin https://seller.example --port 4020
-node dist/commerce/cli.js buyer-serve --config buyer-policy.json \
-  --credentials private/buyer-auth.json --state private/buyer.sqlite3 \
-  --origin https://buyer-management.example --port 4021
-```
+The generated seller starts with free services and a local balance receiving reference of `envar`. A paid service becomes available only after Envar approves this seller account and the service editor verifies the actual unpaid USD quote. In Envar, choose a Skill, enter its USD price, select **Test service**, then **Publish**. There is no separate payment setup command.
 
-The management service is private and owner-authenticated. A website may request a
-quote and confirm an already-reviewed purchase; it cannot change peers, recipient
-allowlists, budgets or signing keys. Unknown outcomes retain the original request,
-signature/SPT and reserved budget. Never create a replacement purchase after a
-timeout.
+## Manual seller commands
 
-[Seller and wire behavior](../../docs/a2a-commerce.md) ·
-[Buyer management](../../docs/a2a-buyer.md) ·
-[Continuation and recovery](../../docs/a2a-runtime-recovery.md) ·
-[Envar configuration integration](../../docs/a2a-envar.md)
+```sh
+envarpay init --directory /private/envarpay
+envarpay validate --config /private/envarpay/seller.json
+envarpay card --config /private/envarpay/seller.json --service SERVICE --offer OFFER --origin https://seller.example
+envarpay serve --config /private/envarpay/seller.json --credentials /private/envarpay/credentials.json --state /private/envarpay/seller.sqlite3 --origin https://seller.example --envar-config /private/envarpay/envar.json --envar-credentials /private/envarpay/envar.token
+envarpay inspect --state /private/envarpay/seller.sqlite3
+```
 
-## Payment guarantees
+`init` creates a sample seller config and vault key; it does not authorize paid work. Put secrets only in owner-only files (`chmod 600`), keep the state directory private, and use one running process per ledger. The runtime verifies the configured service revision, original A2A Task and one captured Envar balance claim before calling the private Agent. It stores the original claim and Task handles so a lost response can be recovered without charging twice.
 
-Payment confirmation, task completion and acceptance are separate facts. The MVP
-charges upfront for a new task; reads and permitted clarification use that same
-purchase. It does not provide escrow, automatic refunds, subscriptions or billing
-for arbitrary internal tools. A2A compatibility alone does not give an Agent a
-wallet or authorize payment.
+The seller configuration schema is [`schemas/envarpay.config.schema.json`](schemas/envarpay.config.schema.json). Paid amounts are integer **micro-USD** (`100000` = USD 0.10); free offers have no payment profile. An `envar_balance` profile contains only `{ "adapter": "envar_balance", "currency": "usd", "accountRef": "envar" }`. The private Envar policy must allow that exact account reference.
 
-MPP requires an eligible Stripe merchant, a permitted buyer token-creation flow,
-explicit test/live mode and any required customer authentication. Simulator tests
-are not card charges. Provider and chain acceptance must be recorded separately
-from SDK tests and build results.
+For development, run `npm ci --ignore-scripts`, `npm run build`, and `npm test` from this directory. Node.js 22.14+ is required; Node 24 is recommended.

package/dist/commerce/agent-setup.d.ts

@@ -0,0 +1,19 @@
+interface Invitation {
+    version: 1;
+    agentId: string;
+    platformOrigin: string;
+    setupToken: string;
+}
+export declare function invitation(value: any): Invitation;
+export declare function agentSetup(options: {
+    file: string;
+    directory?: string;
+    python?: string;
+    home?: string;
+    container?: string;
+    origin?: string;
+    port?: number;
+    checkOnly?: boolean;
+    framework?: "hermes" | "openclaw";
+}): Promise<void>;
+export {};

package/dist/commerce/agent-setup.js

@@ -0,0 +1,210 @@
+/** Agent-driven installation. Secrets stay in local files; receipts come from Envar. */
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync, openSync, closeSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { createServer } from 'node:net';
+import { spawn } from 'node:child_process';
+import { activateManagedProfile, managedProfile } from './managed.js';
+import { setupAgent, parseSetupBundle } from './setup.js';
+import { CommerceError } from './types.js';
+function privateJson(file) {
+    const s = lstatSync(file);
+    if (!s.isFile() || s.isSymbolicLink() || s.size > 16384 || (s.mode & 0o077))
+        throw new CommerceError('setup_private_file', 'Save the setup invitation in an owner-only file (chmod600).');
+    return JSON.parse(readFileSync(file, 'utf8'));
+}
+export function invitation(value) {
+    if (value?.version !== 1 || !/^[0-9a-f-]{36}$/.test(value.agentId) || !/^envar_setup_[A-Za-z0-9_-]{43}$/.test(value.setupToken))
+        throw new CommerceError('setup_invitation', 'Copy a fresh setup prompt.');
+    const url = new URL(value.platformOrigin);
+    if (url.protocol !== 'https:' || url.origin !== value.platformOrigin || url.username || url.password)
+        throw new CommerceError('setup_origin', 'Use the exact Envar HTTPS origin.');
+    return value;
+}
+async function request(invite, path, data) {
+    const r = await fetch(invite.platformOrigin + '/api/v1/agent-setup/' + path, { method: 'POST', redirect: 'error', headers: { Authorization: 'Bearer ' + invite.setupToken, 'Content-Type': 'application/json' }, body: JSON.stringify(data), signal: AbortSignal.timeout(45000) });
+    if (!r.ok)
+        throw new CommerceError('setup_' + path, `Envar ${path} returned ${r.status}. Check connection or copy a fresh prompt; do not report success.`);
+    const text = await r.text();
+    if (text.length > 65536)
+        throw new CommerceError('setup_response', 'Envar returned an oversized response.');
+    return JSON.parse(text);
+}
+async function freePort() {
+    const socket = createServer();
+    await new Promise((resolve, reject) => { socket.once('error', reject); socket.listen(0, '127.0.0.1', resolve); });
+    const port = socket.address().port;
+    await new Promise(resolve => socket.close(() => resolve()));
+    return port;
+}
+function save(file, data) { writeFileSync(file, JSON.stringify(data, null, 2) + '\n', { mode: 0o600, flag: 'wx' }); }
+async function publicOrigin(root, port, agentId, supplied) {
+    if (supplied) {
+        const u = new URL(supplied);
+        if (u.protocol !== 'https:' || u.origin !== supplied)
+            throw Error('Use a public HTTPS origin');
+        return supplied;
+    }
+    // Use an available existing tunnel session, without deleting or rebinding any endpoint.
+    for (const apiPort of [4040, 4041, 4042, 4043]) {
+        try {
+            const api = `http://127.0.0.1:${apiPort}`;
+            const r = await fetch(api + '/api/tunnels', { signal: AbortSignal.timeout(1000) });
+            if (!r.ok)
+                continue;
+            const list = (await r.json());
+            const name = 'envarpay-' + agentId, addr = `http://127.0.0.1:${port}`;
+            const prior = list.tunnels?.find((t) => t.name === name);
+            if (prior) {
+                if (prior.config.addr !== addr)
+                    continue;
+                return prior.public_url;
+            }
+            if (list.tunnels?.length >= 3)
+                continue;
+            const created = await fetch(api + '/api/tunnels', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ name, proto: 'http', addr, schemes: ['https'], inspect: false }), signal: AbortSignal.timeout(12000) });
+            if (created.ok)
+                return (await created.json()).public_url;
+        }
+        catch { }
+    }
+    // Outbound HTTPS works inside Docker too; never requires a Docker socket or host port mapping.
+    const log = join(root, 'tunnel.log');
+    if (existsSync(log))
+        privateLog(log);
+    const offset = existsSync(log) ? readFileSync(log, 'utf8').length : 0, fd = openSync(log, 'a', 0o600);
+    const tunnel = spawn('cloudflared', ['tunnel', '--url', `http://127.0.0.1:${port}`, '--no-autoupdate'], { detached: true, stdio: ['ignore', fd, fd] });
+    closeSync(fd);
+    let failed = false;
+    tunnel.on('error', () => { failed = true; });
+    tunnel.unref();
+    for (let i = 0; i < 45; i++) {
+        if (failed)
+            break;
+        await new Promise(resolve => setTimeout(resolve, 1000));
+        const url = readFileSync(log, 'utf8').slice(offset).match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com\b/)?.[0];
+        if (url) {
+            writeFileSync(join(root, 'tunnel-process.json'), JSON.stringify({ pid: tunnel.pid, origin: url, temporary: true }), { mode: 0o600 });
+            return url;
+        }
+    }
+    if (tunnel.pid)
+        try {
+            tunnel.kill();
+        }
+        catch { }
+    throw new CommerceError('setup_https', 'Install cloudflared from its official distribution, or supply --origin with an existing HTTPS forwarder. Preserve other tunnels.');
+}
+function privateLog(file) { const s = lstatSync(file); if (!s.isFile() || s.isSymbolicLink() || (s.mode & 0o077))
+    throw new CommerceError('setup_private_file', 'Runtime log must be an owner-only regular file.'); }
+export async function agentSetup(options) {
+    const invite = invitation(privateJson(resolve(options.file)));
+    const managedRoot = process.env.ENVARPAY_MANAGED_ROOT ? resolve(process.env.ENVARPAY_MANAGED_ROOT) : undefined;
+    const managedDirectory = managedRoot ? join(managedRoot, 'profiles', invite.agentId) : undefined;
+    const profile = resolve(options.directory ?? managedDirectory ?? join(homedir(), '.envarpay', invite.agentId));
+    if (managedRoot) {
+        if (options.container || profile !== managedDirectory)
+            throw new CommerceError('managed_profile', 'Use this managed runtime and its existing profile location');
+        const active = managedProfile(managedRoot);
+        if (active !== managedRoot && active !== profile)
+            throw new CommerceError('managed_bound', 'This runtime belongs to another Agent; preserve its original profile');
+        const origin = process.env.ENVARPAY_ORIGIN, port = Number(process.env.ENVARPAY_PORT ?? '4020');
+        if (!origin || new URL(origin).protocol !== 'https:' || new URL(origin).origin !== origin || !Number.isInteger(port) || port < 1024 || port > 65535 || (options.origin && options.origin !== origin) || (options.port && options.port !== port))
+            throw new CommerceError('managed_origin', 'Use the managed HTTPS origin and port');
+        options = { ...options, origin, port };
+    }
+    const root = profile + '.onboarding';
+    if (options.checkOnly) {
+        const result = await request(invite, 'status', {});
+        if (result.agent_id !== invite.agentId)
+            throw new CommerceError('setup_identity', 'Receipt belongs to another Agent.');
+        console.log(JSON.stringify(result, null, 2));
+        if (result.status !== 'connected')
+            process.exitCode = 1;
+        return;
+    }
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    if (lstatSync(root).isSymbolicLink() || (lstatSync(root).mode & 0o077))
+        throw new CommerceError('setup_directory', 'Use a private directory owned by this user.');
+    const manifest = join(root, 'setup.json');
+    if (existsSync(manifest) && privateJson(manifest).agentId !== invite.agentId)
+        throw new CommerceError('setup_identity', 'This directory belongs to another Agent.');
+    const bundle = parseSetupBundle(await request(invite, 'claim', {}));
+    if (bundle.agentId !== invite.agentId || bundle.platformOrigin !== invite.platformOrigin)
+        throw new CommerceError('setup_identity', 'Envar returned another Agent identity.');
+    const bundleFile = join(root, 'bundle.json');
+    if (existsSync(bundleFile))
+        privateJson(bundleFile);
+    writeFileSync(bundleFile, JSON.stringify(bundle), { mode: 0o600 });
+    if (!existsSync(profile)) {
+        let settings = existsSync(manifest) ? privateJson(manifest) : undefined;
+        if (!settings) {
+            const port = options.port ?? await freePort();
+            const origin = await publicOrigin(root, port, invite.agentId, options.origin);
+            settings = { agentId: invite.agentId, port, origin };
+            save(manifest, settings);
+        }
+        await setupAgent({ framework: options.framework, managed: !!managedRoot, file: bundleFile, directory: profile, python: options.python, home: options.home, container: options.container, automatic: settings });
+    }
+    if (lstatSync(profile).isSymbolicLink() || (lstatSync(profile).mode & 0o077))
+        throw new CommerceError('setup_directory', 'The runtime must be a private directory.');
+    const connection = privateJson(join(profile, 'connection.json'));
+    privateLog(join(profile, 'envar.token'));
+    const launcher = lstatSync(join(profile, 'start.mjs'));
+    if (!launcher.isFile() || launcher.isSymbolicLink() || (launcher.mode & 0o077))
+        throw new CommerceError('setup_private_file', 'Use the original private runtime launcher.');
+    if (connection.agentId !== invite.agentId)
+        throw new CommerceError('setup_identity', 'Existing runtime belongs to another Agent.');
+    const policy = privateJson(join(profile, 'envar.json')).policy;
+    if (policy.agentId !== invite.agentId || policy.platformOrigin !== invite.platformOrigin)
+        throw new CommerceError('setup_identity', 'Existing integration belongs to another Agent.');
+    if (managedRoot) {
+        if (readFileSync(join(profile, 'envar.token'), 'utf8') !== bundle.token)
+            writeFileSync(join(profile, 'envar.token'), bundle.token, { mode: 0o600 });
+        activateManagedProfile(managedRoot, invite.agentId, profile);
+    }
+    else {
+        const running = join(root, 'process.json');
+        let started = false;
+        if (existsSync(running))
+            try {
+                process.kill(privateJson(running).pid, 0);
+                started = true;
+            }
+            catch { }
+        if (started && readFileSync(join(profile, 'envar.token'), 'utf8') !== bundle.token)
+            throw new CommerceError('setup_running', 'Existing runtime uses an earlier credential. Stop its recorded process, keep its ledger, then retry this invitation.');
+        if (!started) {
+            privateLog(join(profile, 'envar.token'));
+            writeFileSync(join(profile, 'envar.token'), bundle.token, { mode: 0o600 });
+            const log = join(root, 'runtime.log');
+            if (existsSync(log))
+                privateLog(log);
+            const fd = openSync(log, 'a', 0o600), child = spawn(process.execPath, [join(profile, 'start.mjs')], { detached: true, stdio: ['ignore', fd, fd] });
+            closeSync(fd);
+            child.unref();
+            writeFileSync(running, JSON.stringify({ pid: child.pid }), { mode: 0o600 });
+        }
+    }
+    let result;
+    for (let attempt = 0; attempt < 12; attempt++) {
+        try {
+            result = await request(invite, 'connect', { agentId: invite.agentId, url: connection.url, authToken: connection.authToken });
+            if (result.status === 'connected')
+                break;
+        }
+        catch (e) {
+            if (attempt === 11)
+                throw e;
+        }
+        await new Promise(resolve => setTimeout(resolve, 3000));
+    }
+    result = await request(invite, 'status', {});
+    if (result.status !== 'connected' || result.agent_id !== invite.agentId || !result.verified_at)
+        throw new CommerceError('setup_unverified', 'Platform did not verify this setup. Keep files and report the blocker.');
+    const output = { ...result, local_directory: profile, receipt_file: join(root, 'receipt.json'), scope: 'connected; not published; no payment', restart: managedRoot ? 'managed by the deployment' : `node ${JSON.stringify(join(profile, 'start.mjs'))}`, temporary_tunnel: !options.origin, automatic_restart: !!managedRoot };
+    if (existsSync(join(root, 'receipt.json')))
+        privateJson(join(root, 'receipt.json'));
+    writeFileSync(join(root, 'receipt.json'), JSON.stringify(output, null, 2) + '\n', { mode: 0o600 });
+    console.log(JSON.stringify(output, null, 2));
+}

package/dist/commerce/alerts.d.ts

@@ -1,31 +1,21 @@
-type SignalName = 'ledger_read' | 'payment_unknown' | 'execution_unknown' | 'recorded_provider_failure' | 'budget_near_limit' | 'budget_exhausted' | 'report_backlog' | 'report_failure';
+type Name = 'ledger_read' | 'payment_unknown' | 'execution_unknown' | 'report_backlog' | 'report_failure';
 type Signal = {
-    name: SignalName;
+    name: Name;
     status: 'clear' | 'alert' | 'unavailable' | 'not_applicable';
     severity: 'info' | 'warning' | 'critical';
     count: number | null;
 };
-type Budget = {
-    unit: string;
-    maxTotal: string;
-    reserved: string;
-    spent: string;
-    remaining: string;
-    state: 'available' | 'near_limit' | 'exhausted';
-};
 export interface LocalAlertOptions {
-    policyPath?: string;
     integrationPath?: string;
     integrationDisabled?: boolean;
 }
-/** Owner-local aggregate evidence only. Never opens a runtime store, signer, vault or network. */
 export declare function inspectLocalAlerts(path: string, options?: LocalAlertOptions): {
-    role: "unavailable" | "buyer" | "seller";
+    role: "unavailable" | "seller";
     view: "alerts";
     observation: "local_persisted_state_only";
-    status: string;
+    status: "unavailable" | "partial" | "available";
     signals: Signal[];
-    budgets: Budget[];
+    budgets: never[];
     alertCount: number;
     unavailableCount: number;
     providerHealth: "unavailable_not_probed";

package/dist/commerce/alerts.js

@@ -1,18 +1,10 @@
+/** Read-only health signals for one seller ledger and its Envar report queue. */
 import { DatabaseSync } from 'node:sqlite';
-import { lstatSync, readFileSync } from 'node:fs';
-import { loadBuyerPolicy } from './config.js';
-const CURRENCIES = {
-    usd: 'usd_cents',
-    'eip155:8453/erc20:0x833589fcd6edb6e08f4c7c32d4f71b54bda02913': 'base_usdc_atomic',
-    'eip155:84532/erc20:0x036cbd53842c5426634e7929541ec2318f3dcf7e': 'base_sepolia_usdc_atomic',
-};
-function privateFile(path, limit) {
+import { lstatSync } from 'node:fs';
+function database(path) {
     const stat = lstatSync(path);
-    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()) || (limit !== undefined && stat.size > limit))
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()))
         throw new Error('private_source_unavailable');
-}
-function database(path) {
-    privateFile(path);
     const db = new DatabaseSync(path, { readOnly: true });
     try {
         db.exec('PRAGMA query_only=ON; PRAGMA busy_timeout=1000; BEGIN');
@@ -27,61 +19,19 @@ const count = (db, sql) => Number(db.prepare(sql).get().n);
 const signal = (name, value, severity = 'warning') => ({ name, status: value ? 'alert' : 'clear', severity: value ? severity : 'info', count: value });
 const missing = (name) => ({ name, status: 'unavailable', severity: 'warning', count: null });
 const irrelevant = (name) => ({ name, status: 'not_applicable', severity: 'info', count: null });
-/** Owner-local aggregate evidence only. Never opens a runtime store, signer, vault or network. */
 export function inspectLocalAlerts(path, options = {}) {
-    const signals = [], budgets = [];
-    let role = 'unavailable', db;
+    const signals = [];
+    let db;
+    let available = false;
     try {
         db = database(path);
-        const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(row => row.name));
-        if (tables.has('buyer_purchases') === tables.has('commerce_orders'))
-            throw new Error('unknown_ledger');
-        role = tables.has('buyer_purchases') ? 'buyer' : 'seller';
-        if (db.prepare(`SELECT version FROM ${role === 'buyer' ? 'buyer_meta' : 'commerce_meta'}`).get()?.version !== (role === 'buyer' ? 1 : 2))
+        if (db.prepare("SELECT version FROM commerce_meta").get()?.version !== 2)
             throw new Error('unknown_version');
-        const unknownPayments = count(db, role === 'buyer' ? "SELECT COUNT(*) n FROM buyer_purchases WHERE json_extract(record_json,'$.paymentState')='unknown'" : "SELECT COUNT(*) n FROM commerce_orders WHERE payment_state='unknown'");
-        const unknownExecution = count(db, role === 'buyer' ? "SELECT COUNT(*) n FROM buyer_purchases WHERE json_extract(record_json,'$.executionState')='unknown'" : "SELECT COUNT(*) n FROM commerce_orders WHERE execution_state='unknown'");
-        // Only concrete persisted provider errors count. Generic unknown is not proof of provider failure.
-        const providerFailures = count(db, role === 'buyer'
-            ? "SELECT COUNT(*) n FROM buyer_purchases WHERE json_extract(record_json,'$.paymentState')!='confirmed' AND json_extract(record_json,'$.errorCode') IN ('stripe_transport_unknown','stripe_request_failed','stripe_rate_limit','stripe_response','stripe_response_size')"
-            : "SELECT COUNT(*) n FROM commerce_payment_attempts WHERE state!='confirmed' AND json_extract(receipt_json,'$.success')=0 AND length(json_extract(receipt_json,'$.errorReason'))>0");
-        signals.push(signal('ledger_read', 0), signal('payment_unknown', unknownPayments), signal('execution_unknown', unknownExecution), signal('recorded_provider_failure', providerFailures));
-        if (role === 'seller')
-            signals.push(irrelevant('budget_near_limit'), irrelevant('budget_exhausted'));
-        else {
-            try {
-                if (!options.policyPath)
-                    throw new Error('policy_required');
-                privateFile(options.policyPath, 1024 * 1024);
-                const policy = loadBuyerPolicy(JSON.parse(readFileSync(options.policyPath, 'utf8')));
-                const usage = new Map();
-                for (const b of policy.budgets)
-                    usage.set(b.currency, { reserved: 0n, spent: 0n });
-                for (const row of db.prepare("SELECT currency,amount,budget_state FROM buyer_purchases WHERE budget_state!='none'").iterate()) {
-                    const currency = String(row.currency), amount = String(row.amount), state = row.budget_state;
-                    const target = usage.get(currency);
-                    if (!target || !/^[1-9][0-9]{0,77}$/.test(amount) || !['spent', 'reserved'].includes(String(state)))
-                        throw new Error('budget_binding');
-                    target[state === 'spent' ? 'spent' : 'reserved'] += BigInt(amount);
-                }
-                const checked = policy.budgets.map(b => {
-                    const u = usage.get(b.currency), cap = BigInt(b.maxTotal), used = u.reserved + u.spent;
-                    const state = used >= cap ? 'exhausted' : used * 10n >= cap * 9n ? 'near_limit' : 'available';
-                    return { unit: CURRENCIES[b.currency], maxTotal: cap.toString(), reserved: u.reserved.toString(), spent: u.spent.toString(), remaining: (used < cap ? cap - used : 0n).toString(), state };
-                });
-                budgets.push(...checked);
-                signals.push(signal('budget_near_limit', checked.filter(b => b.state === 'near_limit').length), signal('budget_exhausted', checked.filter(b => b.state === 'exhausted').length, 'critical'));
-            }
-            catch {
-                signals.push(missing('budget_near_limit'), missing('budget_exhausted'));
-            }
-        }
+        signals.push(signal('ledger_read', 0), signal('payment_unknown', count(db, "SELECT COUNT(*) n FROM commerce_orders WHERE payment_state='unknown'"), 'critical'), signal('execution_unknown', count(db, "SELECT COUNT(*) n FROM commerce_orders WHERE execution_state='unknown'")));
+        available = true;
     }
     catch {
-        role = 'unavailable';
-        signals.length = 0;
-        budgets.length = 0;
-        signals.push(...['ledger_read', 'payment_unknown', 'execution_unknown', 'recorded_provider_failure', 'budget_near_limit', 'budget_exhausted'].map(missing));
+        signals.push(missing('ledger_read'), missing('payment_unknown'), missing('execution_unknown'));
     }
     finally {
         db?.close();
@@ -92,21 +42,12 @@ export function inspectLocalAlerts(path, options = {}) {
             signals.push(irrelevant('report_backlog'), irrelevant('report_failure'));
         }
         else {
-            if (options.integrationDisabled)
-                throw new Error('ambiguous_integration');
-            if (!options.integrationPath)
+            if (options.integrationDisabled || !options.integrationPath)
                 throw new Error('integration_not_supplied');
             integration = database(options.integrationPath);
-            const binding = integration.prepare("SELECT value FROM meta WHERE key='binding'").get();
-            const source = integration.prepare("SELECT value FROM meta WHERE key='source_instance'").get();
-            if (!binding || !source || typeof binding.value !== 'string' || typeof source.value !== 'string')
-                throw new Error('integration_schema');
-            const parsed = JSON.parse(binding.value);
-            if (!parsed || typeof parsed.platformOrigin !== 'string' || typeof parsed.agentId !== 'string' || typeof parsed.runtimeAgentId !== 'string')
+            if (!integration.prepare("SELECT value FROM meta WHERE key='binding'").get() || !integration.prepare("SELECT value FROM meta WHERE key='source_instance'").get())
                 throw new Error('integration_schema');
-            const pending = count(integration, "SELECT COUNT(*) n FROM outbox WHERE state='pending'");
-            const failed = count(integration, "SELECT COUNT(*) n FROM outbox WHERE state='pending' AND attempts>0 AND last_error<>''");
-            signals.push(signal('report_backlog', pending), signal('report_failure', failed));
+            signals.push(signal('report_backlog', count(integration, "SELECT COUNT(*) n FROM outbox WHERE state='pending'")), signal('report_failure', count(integration, "SELECT COUNT(*) n FROM outbox WHERE state='pending' AND attempts>0 AND last_error<>''")));
         }
     }
     catch {
@@ -115,11 +56,14 @@ export function inspectLocalAlerts(path, options = {}) {
     finally {
         integration?.close();
     }
-    const alertCount = signals.filter(s => s.status === 'alert').length, unavailableCount = signals.filter(s => s.status === 'unavailable').length;
+    const alertCount = signals.filter(s => s.status === 'alert').length;
+    const unavailableCount = signals.filter(s => s.status === 'unavailable').length;
     return {
-        role, view: 'alerts', observation: 'local_persisted_state_only',
-        status: role === 'unavailable' ? 'unavailable' : unavailableCount ? 'partial' : 'available',
-        signals, budgets, alertCount, unavailableCount,
+        role: available ? 'seller' : 'unavailable',
+        view: 'alerts',
+        observation: 'local_persisted_state_only',
+        status: !available ? 'unavailable' : unavailableCount ? 'partial' : 'available',
+        signals, budgets: [], alertCount, unavailableCount,
         providerHealth: 'unavailable_not_probed',
         recommendedExitCode: unavailableCount ? 3 : alertCount ? 2 : 0,
         paymentPerformed: false, refundPerformed: false, networkRequests: 0,

package/dist/commerce/card.js

@@ -14,7 +14,7 @@ export function createOfferCard(config, serviceId, offerId, origin) {
     if (!service || !offer)
         throw new CommerceError('offer_not_found', 'Service offer not found');
     const profile = offer.paymentProfile ? config.paymentProfiles[offer.paymentProfile] : null;
-    const payment = profile?.adapter === 'x402' ? { adapter: 'x402', network: profile.network, asset: profile.asset, payTo: profile.payTo } : profile ? { adapter: 'mpp', method: 'stripe', intent: 'charge', currency: profile.currency } : null;
+    const payment = profile ? { adapter: 'envar_balance', currency: 'usd', accountRef: profile.accountRef } : null;
     return AgentCard.fromJSON({
         name: service.name,
         description: `Deliverables: ${service.contract.deliverables.join(', ')}`,