@lucid-agents/pi-xgate 0.1.5 → 0.1.7

package/src/taskmarket.ts

@@ -0,0 +1,484 @@
+// Adapts TaskMarket's x402 payer to the xgate Pi transport. The payer package is private, so
+// this file declares the structural subset of its v1 contract (`@taskmarket/x402-payer`
+// `src/api.ts`, X402_PAYER_API_VERSION 1) that the adapter uses; TaskMarket injects its
+// instance. The payer owns the wallet, signer, rails, policy and journals: this adapter keeps
+// no payment state of its own.
+//
+// The payer's string unions may gain values without a version bump. Every type here accepts
+// unknown strings, and the adapter treats an unknown state as unverified.
+import {
+  atomic,
+  origin as checkOrigin,
+  record,
+  route as checkRoute,
+  XgateError,
+  type Invocation,
+} from "@lucid-agents/xgate-client/types";
+import {
+  XgatePurchaseError,
+  type XgateChannelBalance,
+  type XgatePayment,
+  type XgatePurchaseResult,
+  type XgateResponseHead,
+  type XgateTransport,
+} from "./transport.ts";
+type Open<T extends string> = T | (string & {});
+export type TaskMarketChargeStatus = Open<
+  | "none"
+  | "reserved"
+  | "pending"
+  | "settled"
+  | "amount_unknown"
+  | "released"
+  | "manually_resolved"
+>;
+export type TaskMarketInvocationState = Open<
+  "in_progress" | "interrupted" | "completed" | "failed"
+>;
+export type TaskMarketPayErrorCode = Open<
+  | "invalid_request"
+  | "request_body_too_large"
+  | "response_body_too_large"
+  | "challenge_invalid"
+  | "invocation_conflict"
+  | "invocation_duplicate"
+  | "invocation_not_found"
+  | "destination_rejected"
+  | "policy_denied"
+  | "payment_declined"
+  | "no_supported_rail"
+  | "signer_unavailable"
+  | "journal_unavailable"
+  | "aborted"
+  | "outcome_uncertain"
+  | "paid_retry_prohibited"
+  | "request_failed"
+  | "allocation_not_found"
+  | "allocation_conflict"
+  | "allocation_closed"
+  | "allocation_exhausted"
+  | "allocation_mismatch"
+  | "funding_exhausted"
+  | "allocation_required"
+  | "reservation_not_found"
+>;
+export interface TaskMarketPayerLimits {
+  maxRequestBodyBytes: number;
+  maxResponseBodyBytes: number;
+  maxChallengeBodyBytes: number;
+}
+export interface TaskMarketPayRequest {
+  apiVersion: 1;
+  invocationId: string;
+  url: string;
+  method: "GET" | "POST";
+  headers?: Record<string, string>;
+  body?: Uint8Array;
+  policyRuleId?: string;
+  nonInteractive?: boolean;
+  limits?: Partial<TaskMarketPayerLimits>;
+  allocationId?: string;
+}
+export interface TaskMarketPaymentTerms {
+  origin: string;
+  pathname: string;
+  method: "GET" | "POST";
+  rail: { id: string; kind: string };
+  scheme: string;
+  network: string;
+  asset: string;
+  payTo: string;
+  authorizedAmount: string;
+  policyRuleId?: string;
+  windowMaximum?: string;
+  unattended: boolean;
+}
+export interface TaskMarketPayCallOptions {
+  signal?: AbortSignal;
+  confirmPayment?: (terms: TaskMarketPaymentTerms) => Promise<boolean>;
+}
+export interface TaskMarketPaymentSummary {
+  paymentId: string;
+  rail: { id: string; kind: string };
+  network: string;
+  scheme: string;
+  asset: string;
+  payTo: string;
+  payer: string;
+  authorizedAmount: string;
+  settledAmount?: string;
+  transaction?: string;
+  commitment?: string;
+  charge: TaskMarketChargeStatus;
+}
+export interface TaskMarketPayResponse {
+  status: number;
+  headers: Record<string, string>;
+  contentType: string;
+  bytes: number;
+  sha256: string;
+  body: Uint8Array;
+}
+export interface TaskMarketPayResult {
+  apiVersion: number;
+  invocationId: string;
+  requestFingerprint: string;
+  payment?: TaskMarketPaymentSummary;
+  response: TaskMarketPayResponse;
+}
+export interface TaskMarketInvocationStatus {
+  apiVersion: number;
+  invocationId: string;
+  requestFingerprint: string;
+  state: TaskMarketInvocationState;
+  charge: TaskMarketChargeStatus;
+  uncertain: boolean;
+  errorCode?: TaskMarketPayErrorCode;
+  createdAt: string;
+  updatedAt: string;
+  payment?: TaskMarketPaymentSummary;
+}
+/** Structural `X402Payer` v1. */
+export interface TaskMarketPayer {
+  readonly apiVersion: 1;
+  request(
+    input: TaskMarketPayRequest,
+    options?: TaskMarketPayCallOptions,
+  ): Promise<TaskMarketPayResult>;
+  status(invocationId: string): Promise<TaskMarketInvocationStatus>;
+  reconcile(invocationId: string): Promise<TaskMarketInvocationStatus>;
+}
+/** Structural `X402FundingBalance`: one session-rail deposit. */
+export interface TaskMarketFundingBalance {
+  railId: string;
+  sessionKey: string;
+  network: string;
+  asset: string;
+  depositing: string;
+  locked: string;
+  refunded: string;
+  charged: string;
+  pending: string;
+  refundable: string;
+}
+export interface TaskMarketTransportOptions {
+  payer: TaskMarketPayer;
+  /** Router origin, e.g. `https://api.xgate.run`. */
+  origin: string;
+  /** Allocation that bounds this agent's inference; forwarded on every request. */
+  allocationId?: string;
+  policyRuleId?: string;
+  /** Authorize only through unattended policy rules. */
+  nonInteractive?: boolean;
+  /** Attended confirmation, forwarded to the payer. */
+  confirmPayment?: (terms: TaskMarketPaymentTerms) => Promise<boolean>;
+  /** Restrict the offered models; the router catalog still qualifies them. */
+  models?: readonly string[];
+  /** Session-rail balances for display, e.g. TaskMarket's `X402Allocations.balances`. */
+  balances?: () => Promise<readonly TaskMarketFundingBalance[]>;
+  /** Unpaid catalog reads. Defaults to the global `fetch`. */
+  fetch?: typeof fetch;
+}
+const RESOLVED_CHARGES = ["none", "released", "settled", "manually_resolved"],
+  RESOLVED_STATES = ["completed", "failed"];
+const CATALOG_BYTES = 2 * 1024 * 1024,
+  REQUEST_BYTES = 8 * 1024 * 1024,
+  CATALOG_DEADLINE_MS = 15000;
+/** Never sends the request again for an ID the payer has seen: `purchase` maps every non-verified outcome to a terminal error. */
+export function createTaskMarketTransport(
+  options: TaskMarketTransportOptions,
+): XgateTransport & {
+  status(): Promise<unknown>;
+  reconcile(invocationId: string): Promise<unknown>;
+} {
+  const { payer } = options,
+    base = checkOrigin(options.origin),
+    fetcher = options.fetch ?? fetch;
+  if (payer.apiVersion !== 1) throw new XgateError("unsupported_payer_api");
+  const channel = async (
+    payment: TaskMarketPaymentSummary,
+  ): Promise<XgateChannelBalance | undefined> => {
+    if (!options.balances || payment.rail.kind !== "session") return;
+    try {
+      const matches = (await options.balances()).filter(
+        (b) =>
+          b.railId === payment.rail.id &&
+          b.network === payment.network &&
+          b.asset === payment.asset,
+      );
+      // Several sessions on one rail are not one channel; unlike balances are never summed.
+      if (matches.length !== 1) return;
+      const b = matches[0]!;
+      return {
+        depositingAtomic: b.depositing,
+        lockedAtomic: b.locked,
+        chargedAtomic: b.charged,
+        pendingAtomic: b.pending,
+        refundableAtomic: b.refundable,
+      };
+    } catch {
+      return; // Display only.
+    }
+  };
+  return {
+    async models(signal) {
+      const deadline = AbortSignal.timeout(CATALOG_DEADLINE_MS);
+      let response: Response;
+      try {
+        response = await fetcher(base + "/v1/models", {
+          signal: signal ? AbortSignal.any([signal, deadline]) : deadline,
+          redirect: "error",
+          cache: "no-store",
+          credentials: "omit",
+          referrerPolicy: "no-referrer",
+          headers: { accept: "application/json" },
+        });
+      } catch {
+        throw new XgateError("catalog_unavailable");
+      }
+      if (!response.ok) {
+        await response.body?.cancel().catch(() => {});
+        throw new XgateError("catalog_unavailable");
+      }
+      const v = parse(await bounded(response, CATALOG_BYTES));
+      if (!record(v) || !Array.isArray(v.data) || v.data.length > 128)
+        throw new XgateError("invalid_catalog");
+      return v.data
+        .filter(
+          (m: unknown) =>
+            record(m) &&
+            (options.models === undefined || options.models.includes(m.id)),
+        )
+        .map((m: Record<string, unknown>) => ({ ...m, xgate_origin: base }));
+    },
+    async purchase(invocation: Invocation, signal, onResponse) {
+      checkRoute(invocation.route);
+      const body = new TextEncoder().encode(invocation.body);
+      if (body.byteLength === 0 || body.byteLength > REQUEST_BYTES)
+        throw new XgateError("invalid_invocation");
+      const id = invocation.id;
+      let result: TaskMarketPayResult;
+      try {
+        result = await payer.request(
+          {
+            apiVersion: 1,
+            invocationId: id,
+            url: base + invocation.route,
+            method: "POST",
+            // Application headers only: the payer owns every payment header.
+            headers: {
+              "content-type": "application/json",
+              accept: "application/json",
+            },
+            body,
+            limits: { maxRequestBodyBytes: REQUEST_BYTES },
+            ...(options.allocationId !== undefined
+              ? { allocationId: options.allocationId }
+              : {}),
+            ...(options.policyRuleId !== undefined
+              ? { policyRuleId: options.policyRuleId }
+              : {}),
+            ...(options.nonInteractive !== undefined
+              ? { nonInteractive: options.nonInteractive }
+              : {}),
+          },
+          {
+            ...(signal ? { signal } : {}),
+            ...(options.confirmPayment
+              ? { confirmPayment: options.confirmPayment }
+              : {}),
+          },
+        );
+      } catch (error) {
+        throw failure(error, id);
+      }
+      const payment = result.payment;
+      if (result.invocationId !== id || result.apiVersion !== 1)
+        throw new XgatePurchaseError(
+          "payer_result_mismatch",
+          id,
+          true,
+          payment && display(payment),
+        );
+      // A paid xgate route never answers without a payment challenge.
+      if (!payment)
+        throw new XgatePurchaseError(
+          result.response.status === 200
+            ? "payment_missing"
+            : "request_rejected",
+          id,
+          false,
+        );
+      const shown = display(payment);
+      if (
+        payment.charge !== "settled" ||
+        typeof payment.settledAmount !== "string"
+      )
+        throw new XgatePurchaseError("payment_unverified", id, true, shown);
+      shown.chargedAtomic = payment.settledAmount;
+      try {
+        if (atomic(payment.settledAmount) > atomic(payment.authorizedAmount))
+          throw new XgateError("charge_over_authorization");
+      } catch {
+        throw new XgatePurchaseError("invalid_settlement", id, true, shown);
+      }
+      const r = result.response,
+        h = r.headers;
+      // Charged, so not pending, but the content is unusable.
+      if (
+        r.status !== 200 ||
+        !/^application\/json\b/i.test(r.contentType) ||
+        h["x-inference-privacy"] !== "anonymous" ||
+        h["x-result-retention"] !== "none" ||
+        !h["cache-control"]?.includes("no-store")
+      )
+        throw new XgatePurchaseError("response_rejected", id, false, shown);
+      let value: unknown;
+      try {
+        value = parse(r.body);
+      } catch {
+        throw new XgatePurchaseError("invalid_response", id, false, shown);
+      }
+      if (
+        !record(value) ||
+        typeof value.id !== "string" ||
+        value.result_replay_available !== undefined
+      )
+        throw new XgatePurchaseError("invalid_response", id, false, shown);
+      const head: XgateResponseHead = {
+        status: r.status,
+        headers: { "content-type": r.contentType, "cache-control": "no-store" },
+      };
+      try {
+        await onResponse?.(head);
+      } catch {
+        throw new XgatePurchaseError("response_hook_failed", id, false, shown);
+      }
+      const balance = await channel(payment);
+      if (balance) shown.channel = balance;
+      return {
+        body: value,
+        settlement: {
+          chargedAtomic: payment.settledAmount,
+          reference:
+            payment.transaction ?? payment.commitment ?? payment.paymentId,
+        },
+        purchase: payment.commitment ?? payment.paymentId,
+        payment: shown,
+      } satisfies XgatePurchaseResult;
+    },
+    async status() {
+      return {
+        transport: "taskmarket",
+        origin: base,
+        ...(options.balances
+          ? {
+              balances: (await options.balances()).map((b) => ({
+                rail: b.railId,
+                network: b.network,
+                asset: b.asset,
+                depositingAtomic: b.depositing,
+                lockedAtomic: b.locked,
+                chargedAtomic: b.charged,
+                pendingAtomic: b.pending,
+                refundableAtomic: b.refundable,
+              })),
+            }
+          : {}),
+      };
+    },
+    async reconcile(invocationId) {
+      const s = await payer.reconcile(invocationId);
+      return {
+        invocationId: s.invocationId,
+        state: s.state,
+        charge: s.charge,
+        uncertain: s.uncertain,
+        ...(s.errorCode ? { errorCode: s.errorCode } : {}),
+        ...(s.payment ? { payment: display(s.payment) } : {}),
+      };
+    },
+  };
+}
+function display(p: TaskMarketPaymentSummary): XgatePayment {
+  return {
+    network: p.network,
+    scheme: p.scheme,
+    asset: p.asset,
+    payTo: p.payTo,
+    rail: p.rail.kind,
+    authorizedAtomic: p.authorizedAmount,
+    ...(p.charge === "settled" && p.settledAmount !== undefined
+      ? { chargedAtomic: p.settledAmount }
+      : {}),
+    status: p.charge,
+    ...((p.transaction ?? p.commitment)
+      ? { reference: p.transaction ?? p.commitment }
+      : {}),
+  };
+}
+/**
+ * Maps a payer rejection. Only the stable code crosses into Pi; the payer's message may carry
+ * URLs or server text. A rejection that does not state `pending: false` counts as pending.
+ */
+function failure(error: unknown, id: string): XgatePurchaseError {
+  const e = error as {
+    code?: unknown;
+    pending?: unknown;
+    invocation?: { uncertain?: unknown; payment?: TaskMarketPaymentSummary };
+  };
+  const code =
+    typeof e?.code === "string" && /^[a-z0-9_]{1,64}$/.test(e.code)
+      ? e.code
+      : "payer_failed";
+  // A duplicate never sends again, but its recorded invocation may still be unresolved: only a
+  // positively resolved record counts as not pending.
+  const recorded = e?.invocation as
+    | { uncertain?: unknown; charge?: unknown; state?: unknown }
+    | undefined;
+  const pending =
+    e?.pending !== false ||
+    (recorded !== undefined &&
+      !(
+        recorded.uncertain === false &&
+        RESOLVED_CHARGES.includes(recorded.charge as string) &&
+        RESOLVED_STATES.includes(recorded.state as string)
+      ));
+  const summary = e?.invocation?.payment;
+  return new XgatePurchaseError(
+    code,
+    id,
+    pending,
+    record(summary) ? display(summary) : undefined,
+  );
+}
+async function bounded(response: Response, limit: number): Promise<Uint8Array> {
+  if (!response.body) throw new XgateError("invalid_catalog");
+  const reader = response.body.getReader(),
+    chunks: Uint8Array[] = [];
+  let length = 0;
+  try {
+    for (;;) {
+      const part = await reader.read();
+      if (part.done) break;
+      length += part.value.byteLength;
+      if (length > limit) throw new XgateError("catalog_bound");
+      chunks.push(part.value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {});
+    throw error instanceof XgateError
+      ? error
+      : new XgateError("catalog_unavailable");
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, length);
+}
+function parse(bytes: Uint8Array): unknown {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    throw new XgateError("invalid_response");
+  }
+}

package/src/transport.ts

@@ -0,0 +1,94 @@
+import {
+  XgateError,
+  type Invocation,
+  type PurchaseResult,
+} from "@lucid-agents/xgate-client/types";
+/** Response metadata safe to show Pi's `onResponse` hook: never payment or status credentials. */
+export interface XgateResponseHead {
+  status: number;
+  headers: Record<string, string>;
+}
+/**
+ * Rail-neutral payment terms and status for display. Pi shows them; it never selects or
+ * configures a rail. Amounts are unsigned integer strings in the asset's smallest unit, and
+ * amounts of different assets are never combined.
+ */
+export interface XgatePayment {
+  /** CAIP-2 network, e.g. `eip155:8453`. */
+  network: string;
+  /** Payment scheme as the payee advertised it, e.g. `batch-settlement`, `exact`, `session`. */
+  scheme: string;
+  asset: string;
+  payTo?: string;
+  /** Rail shape: `per-request` or `session` today; other values may appear. */
+  rail?: string;
+  /** Most this invocation could be charged. */
+  authorizedAtomic: string;
+  /** Verified charge, once known. */
+  chargedAtomic?: string;
+  /** `settled`, `pending`, `amount_unknown`, `released`, ...; anything but `settled` is unverified. */
+  status: string;
+  /** Settlement transaction or payee commitment, when one exists. */
+  reference?: string;
+  /** Session-rail balance after this payment, when the host reports one. */
+  channel?: XgateChannelBalance;
+}
+export interface XgateChannelBalance {
+  depositingAtomic: string;
+  lockedAtomic: string;
+  chargedAtomic: string;
+  pendingAtomic: string;
+  refundableAtomic: string;
+}
+export interface XgatePurchaseResult extends PurchaseResult {
+  payment?: XgatePayment;
+}
+/**
+ * A purchase that ended without a verified result. `pending` is true when money may have moved
+ * and the outcome is unknown: the invocation must be reconciled, never retried.
+ */
+export class XgatePurchaseError extends XgateError {
+  readonly invocationId: string;
+  readonly pending: boolean;
+  readonly payment?: XgatePayment;
+  constructor(
+    code: string,
+    invocationId: string,
+    pending: boolean,
+    payment?: XgatePayment,
+  ) {
+    super(code);
+    this.name = "XgatePurchaseError";
+    this.message = pending
+      ? `Xgate: ${code}. The payment outcome is unknown; do not retry. Reconcile it before another purchase.`
+      : `Xgate: ${code}. Inspect the payment status before another purchase.`;
+    this.invocationId = invocationId;
+    this.pending = pending;
+    if (payment) this.payment = payment;
+  }
+}
+/**
+ * Moves one frozen Pi request to xgate and returns the verified result. The provider owns
+ * catalog qualification, codecs and the invocation ID; the transport owns payment.
+ *
+ * `purchase` sends at most one paid submission per `Invocation.id`, never retries a paid
+ * request, and never pays again for an ID it has seen: a repeated ID rejects. It resolves
+ * only with a verified result and rejects on every other outcome, preferably with an
+ * `XgatePurchaseError` stating whether the payment is pending. `BrokerClient` is the
+ * standalone implementation.
+ */
+export interface XgateTransport {
+  /** Current router catalog rows. Called before every paid invocation. */
+  models(signal?: AbortSignal): Promise<unknown[]>;
+  purchase(
+    invocation: Invocation,
+    signal?: AbortSignal,
+    onResponse?: (response: XgateResponseHead) => Promise<void>,
+  ): Promise<XgatePurchaseResult>;
+  /** Optional `/xgate status` and `/xgate budget` view. */
+  status?(signal?: AbortSignal): Promise<unknown>;
+  /** Optional `/xgate receipts` view. */
+  receipts?(signal?: AbortSignal): Promise<unknown>;
+  /** Optional `/xgate reconcile <invocation ID>`. Never resends the request. */
+  reconcile?(invocationId: string, signal?: AbortSignal): Promise<unknown>;
+}