@lucid-agents/taskmarket 1.25.1 → 1.26.0

package/dist/{chunk-73SUBS7U.js → chunk-XV6DBK4C.js}

@@ -6,7 +6,6 @@ import {
   createEvmPerRequestRail,
   createMppTempoCredential,
   createTaskmarketFeeRail,
-  createWalletAccountFromKeystore,
   createX402Allocations,
   createX402Payer,
   getX402JournalPath,
@@ -16,19 +15,15 @@ import {
   readMppTempoChallenge,
   reconcileX402Payment,
   withX402FileLock
-} from "./chunk-6KBTN3WM.js";
+} from "./chunk-2AJZDGEL.js";
 import {
   ApiError,
-  ComputeCreditBuyOutputSchema,
-  ComputeCreditPricingSchema,
-  ComputeCreditStatusOutputSchema,
-  apiErrorEnvelopeOf,
   apiGet,
   apiOrigin,
   apiPost,
   apiUrl,
+  createWalletAccountFromKeystore,
   failureMessage,
-  getTaskmarketHome,
   idempotencyHeaders,
   legalReceiptHeadersForKeystore,
   loadKeystore,
@@ -37,9 +32,18 @@ import {
   readFailureBody,
   resolveIdempotencyKey,
   selectedNetwork,
+  tapSigningFetch,
   withChainId,
-  withIdempotentWrite
-} from "./chunk-L3A7JOO5.js";
+  withIdempotentWrite,
+  withTapSignature
+} from "./chunk-Q2FZSDFG.js";
+import {
+  ComputeCreditBuyOutputSchema,
+  ComputeCreditPricingSchema,
+  ComputeCreditStatusOutputSchema,
+  apiErrorEnvelopeOf,
+  getTaskmarketHome
+} from "./chunk-VTMYCZLT.js";
 
 // src/lib/x402-fee.ts
 import { randomUUID as randomUUID3 } from "crypto";
@@ -64,13 +68,19 @@ function refusedPaidWrite(path3, status, read, idempotencyKey) {
     apiErrorEnvelopeOf(read.body) ?? void 0
   );
 }
+var REFUSED_BEFORE_SETTLEMENT = /* @__PURE__ */ new Set([
+  "payment_preflight_rejected",
+  "recipient_receive_policy_blocked",
+  "payment_rejected",
+  "chain_not_served",
+  "chain_required",
+  "chain_conflict",
+  "invalid_input"
+]);
 function failedAfterPayment(path3, status, read, idempotencyKey) {
-  return new ApiError(
-    status,
-    failureMessage(`POST ${path3} failed after payment`, status, read),
-    idempotencyKey,
-    apiErrorEnvelopeOf(read.body) ?? void 0
-  );
+  const envelope = apiErrorEnvelopeOf(read.body) ?? void 0;
+  const prefix = envelope !== void 0 && REFUSED_BEFORE_SETTLEMENT.has(envelope.reason) ? `POST ${path3} was refused before payment; no payment was taken` : `POST ${path3} failed after payment`;
+  return new ApiError(status, failureMessage(prefix, status, read), idempotencyKey, envelope);
 }
 
 // src/lib/mpp.ts
@@ -91,10 +101,21 @@ async function mppPost(path3, body, options = {}) {
   const idempotencyKey = resolveIdempotencyKey(options.idempotencyKey);
   const chainId = options.chainId ?? selectedNetwork().chainId;
   const request = paidWriteRequest(keystore, path3, { chainId, ...body }, idempotencyKey);
+  Object.assign(request.headers, options.headers ?? {});
   const send = (headers) => fetchImpl(request.url, {
     method: "POST",
     redirect: "error",
-    headers: { ...request.headers, ...headers },
+    // Every attempt, the paid retry included, is TAP-signed afresh inside a gated action, over
+    // the headers it is sent with, so the retry's Authorization is covered.
+    headers: withTapSignature(
+      {
+        method: "POST",
+        url: request.url,
+        headers: { ...request.headers, ...headers },
+        body: request.body
+      },
+      options.tap
+    ),
     body: request.body
   });
   return withIdempotentWrite(idempotencyKey, async () => {
@@ -432,7 +453,8 @@ async function x402FeePost(path3, body, options = {}) {
       idempotencyKey: options.idempotencyKey,
       expect: options.expect,
       account: options.account,
-      fetchImpl: options.fetchImpl
+      fetchImpl: options.fetchImpl,
+      ...options.tap ? { tap: options.tap } : {}
     });
   }
   const keystore = await loadKeystore();
@@ -442,7 +464,9 @@ async function x402FeePost(path3, body, options = {}) {
     const payer = createCliX402Payer({
       firstParty: true,
       account: options.account,
-      fetchImpl: options.fetchImpl
+      // The payer sends the unpaid and the paid round itself, so a gated action signs each one
+      // at the fetch, each with its own TAP nonce.
+      fetchImpl: options.tap ? tapSigningFetch(options.fetchImpl ?? globalThis.fetch, options.tap) : options.fetchImpl
     });
     let result;
     try {

package/dist/{chunk-PE72DL5T.js → chunk-YAKNCBUK.js}

@@ -1,85 +1,27 @@
 import { createRequire as __tmCreateRequire } from 'node:module'; import { fileURLToPath as __tmFileURLToPath } from 'node:url'; import { dirname as __tmDirname } from 'node:path'; const require = __tmCreateRequire(import.meta.url); const __tmFilename = __tmFileURLToPath(import.meta.url); const __tmDirnameValue = __tmDirname(__tmFilename);
 import {
   x402FeePost
-} from "./chunk-73SUBS7U.js";
+} from "./chunk-XV6DBK4C.js";
 import {
-  createWalletAccountFromKeystore,
-  signMessage
-} from "./chunk-6KBTN3WM.js";
+  signReadAuth
+} from "./chunk-PJAWRHHZ.js";
+import {
+  taskAccessGrantHeaders
+} from "./chunk-NTLOY7SP.js";
 import {
-  READ_AUTH_ADDRESS_HEADER,
-  READ_AUTH_SIGNATURE_HEADER,
-  TASK_ACCESS_GRANT_HEADER,
-  TaskAwardSchema,
   apiGet,
   apiPost,
+  loadKeystore,
+  runWorkerAction,
+  signMessage,
+  taskRequiresTap
+} from "./chunk-Q2FZSDFG.js";
+import {
+  TaskAwardSchema,
   buildClaimMessage,
-  buildReadAuthMessage,
   buildSubmitMessage,
-  getTaskmarketHome,
-  isRecordingPendingResponse,
-  loadKeystore
-} from "./chunk-L3A7JOO5.js";
-
-// src/lib/read-auth.ts
-async function signReadAuth() {
-  let keystore;
-  try {
-    keystore = await loadKeystore();
-  } catch {
-    return null;
-  }
-  try {
-    const account = await createWalletAccountFromKeystore(keystore);
-    const signature = await account.signMessage({
-      message: buildReadAuthMessage(keystore.walletAddress)
-    });
-    return {
-      walletAddress: keystore.walletAddress,
-      headers: {
-        [READ_AUTH_ADDRESS_HEADER]: keystore.walletAddress,
-        [READ_AUTH_SIGNATURE_HEADER]: signature
-      }
-    };
-  } catch {
-    return { walletAddress: keystore.walletAddress, headers: {} };
-  }
-}
-
-// src/lib/task-access-grants.ts
-import { promises as fs } from "fs";
-import path from "path";
-function getGrantsPath() {
-  return path.join(getTaskmarketHome(), "task-access-grants.json");
-}
-async function readGrantsFile() {
-  try {
-    const raw = await fs.readFile(getGrantsPath(), "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return {};
-  }
-}
-async function loadTaskAccessGrant(taskId) {
-  const grants = await readGrantsFile();
-  const record = grants[taskId];
-  if (!record) return null;
-  if (new Date(record.expiresAt).getTime() <= Date.now()) return null;
-  return record.grant;
-}
-async function taskAccessGrantHeaders(taskId) {
-  const grant = await loadTaskAccessGrant(taskId);
-  return grant ? { [TASK_ACCESS_GRANT_HEADER]: grant } : {};
-}
-async function saveTaskAccessGrant(taskId, grant, expiresAt) {
-  const grants = await readGrantsFile();
-  grants[taskId] = { grant, expiresAt };
-  const dir = path.dirname(getGrantsPath());
-  await fs.mkdir(dir, { recursive: true });
-  await fs.writeFile(getGrantsPath(), JSON.stringify(grants, null, 2), {
-    mode: 384
-  });
-}
+  isRecordingPendingResponse
+} from "./chunk-VTMYCZLT.js";
 
 // src/sdk/artifact-upload.ts
 import { extname } from "path";
@@ -163,6 +105,57 @@ function putArtifactBytes(uploadUrl, data, mimeType, onProgress) {
   });
 }
 
+// src/lib/worker-attestation.ts
+var requirementCache = /* @__PURE__ */ new Map();
+async function defaultGet(path) {
+  const { apiGet: apiGet2 } = await import("./api-H7VPA6C6.js");
+  const { signReadAuth: signReadAuth2 } = await import("./read-auth-26D4BRUP.js");
+  const { taskAccessGrantHeaders: taskAccessGrantHeaders2 } = await import("./task-access-grants-54GQX63L.js");
+  const taskId = /^\/api\/tasks\/([^/?]+)/.exec(path)?.[1] ?? "";
+  return apiGet2(path, {
+    headers: {
+      ...(await signReadAuth2())?.headers ?? {},
+      ...await taskAccessGrantHeaders2(taskId) ?? {}
+    }
+  });
+}
+var REQUIREMENT_CACHE_MS = 6e4;
+function taskRequirementsOf(taskId, get = defaultGet, now = Date.now) {
+  const key = taskId.toLowerCase();
+  const cached = requirementCache.get(key);
+  if (cached && cached.until > now()) return cached.pending;
+  const entry = { pending: Promise.resolve(null), until: 0 };
+  entry.pending = get(`/api/tasks/${taskId}`).then((task) => task ?? null).catch(() => {
+    if (requirementCache.get(key) === entry) requirementCache.delete(key);
+    return null;
+  });
+  entry.until = now() + REQUIREMENT_CACHE_MS;
+  requirementCache.set(key, entry);
+  return entry.pending;
+}
+async function attestedWorkerAction(taskId, keystore, run, task) {
+  if (!keystore.tapKey) return run(void 0);
+  return runWorkerAction({
+    taskId,
+    task: task === void 0 ? await taskRequirementsOf(taskId) : task,
+    keystore,
+    run
+  });
+}
+var GATED_WRITE_PATH = /^\/api\/tasks\/([^/?]+)\/(?:claim|pitches|bids|proofs|submissions|submissions\/from-keys)(?:\?.*)?$/;
+function gatedWriteTaskId(path) {
+  return GATED_WRITE_PATH.exec(path)?.[1];
+}
+async function maybeAttestedWrite(path, send, get) {
+  const taskId = gatedWriteTaskId(path);
+  if (!taskId) return send(void 0);
+  const keystore = await loadKeystore().catch(() => void 0);
+  if (!keystore?.tapKey) return send(void 0);
+  const task = await taskRequirementsOf(taskId, get);
+  if (!taskRequiresTap(task)) return send(void 0);
+  return runWorkerAction({ taskId, task, keystore, run: send });
+}
+
 // src/lib/task-sdk.ts
 async function putWithProgress(upload) {
   process.stderr.write(`  Uploading ${upload.fileName}...
@@ -173,11 +166,15 @@ async function putWithProgress(upload) {
   process.stderr.write("\n");
 }
 var cliTaskTransport = {
-  get: (path2, headers) => apiGet(path2, { headers }),
+  get: (path, headers) => apiGet(path, { headers }),
   // A write the caller gave no key is sent exactly as before the SDK existed, with no options,
   // so `apiPost` resolves its key itself (explicit, then TASKMARKET_IDEMPOTENCY_KEY, then fresh).
-  post: (path2, body, options) => options === void 0 ? apiPost(path2, body) : apiPost(path2, body, options),
-  feePost: (path2, body, options) => x402FeePost(path2, body, options),
+  // A gated worker action on a task that requires `tap` is TAP-signed (lib/worker-attestation.ts).
+  post: (path, body, options) => maybeAttestedWrite(
+    path,
+    (tap) => tap ? apiPost(path, body, { ...options, tap }) : options === void 0 ? apiPost(path, body) : apiPost(path, body, options)
+  ),
+  feePost: (path, body, options) => maybeAttestedWrite(path, (tap) => x402FeePost(path, body, tap ? { ...options, tap } : options)),
   put: putWithProgress
 };
 function keystoreTaskSigner(keystore) {
@@ -210,9 +207,9 @@ var TaskOperationError = class extends Error {
     this.code = code;
   }
 };
-function withChainQuery(path2, chainId) {
-  if (chainId === void 0) return path2;
-  return `${path2}${path2.includes("?") ? "&" : "?"}chainId=${chainId}`;
+function withChainQuery(path, chainId) {
+  if (chainId === void 0) return path;
+  return `${path}${path.includes("?") ? "&" : "?"}chainId=${chainId}`;
 }
 function withChainBody(body, chainId) {
   return chainId === void 0 ? body : { ...body, chainId };
@@ -257,8 +254,17 @@ async function listTasks(ctx, filter = {}) {
   if (filter.tags) params.set("tags", filter.tags);
   if (filter.minReward) params.set("minReward", filter.minReward);
   if (filter.maxReward) params.set("maxReward", filter.maxReward);
+  if (filter.minTotalReward) params.set("minTotalReward", filter.minTotalReward);
   if (filter.deadlineHours) params.set("deadlineHours", filter.deadlineHours);
   if (filter.sponsored) params.set("sponsored", "true");
+  if (filter.identity) params.set("identity", filter.identity);
+  if (filter.verifiedBy) params.set("verifiedBy", filter.verifiedBy);
+  if (filter.requester) params.set("requester", filter.requester);
+  if (filter.hire !== void 0) params.set("hire", String(filter.hire));
+  if (filter.hireKind) params.set("hireKind", filter.hireKind);
+  if (filter.hireState) params.set("hireState", filter.hireState);
+  if (filter.hireServiceId) params.set("hireServiceId", filter.hireServiceId);
+  if (filter.reservedWorker) params.set("reservedWorker", filter.reservedWorker);
   if (filter.limit) params.set("limit", filter.limit);
   if (filter.cursor) params.set("cursor", filter.cursor);
   const result = await ctx.transport.get(
@@ -267,10 +273,11 @@ async function listTasks(ctx, filter = {}) {
   );
   return { tasks: result.tasks, hasMore: result.hasMore, nextCursor: result.nextCursor };
 }
-async function listTaskSubmissions(ctx, ref) {
+async function listTaskSubmissions(ctx, ref, filter = {}) {
   const headers = await readAuthHeaders(ctx);
+  const query = filter.passedCheck ? `?${new URLSearchParams({ passedCheck: filter.passedCheck }).toString()}` : "";
   return await ctx.transport.get(
-    withChainQuery(`/api/tasks/${ref.taskId}/submissions`, ref.chainId),
+    withChainQuery(`/api/tasks/${ref.taskId}/submissions${query}`, ref.chainId),
     headers
   );
 }
@@ -433,9 +440,8 @@ async function submitTaskFiles(ctx, ref, files, options = {}) {
 }
 
 export {
-  signReadAuth,
-  taskAccessGrantHeaders,
-  saveTaskAccessGrant,
+  taskRequirementsOf,
+  attestedWorkerAction,
   mimeTypeForPath,
   putArtifactBytes,
   cliTaskTransport,

package/dist/{chunk-XBTNZTXE.js → chunk-YIOZ7W3M.js}

@@ -4,19 +4,24 @@ import {
   WITHDRAW_DELAY_SECONDS,
   createBaseChannelPayer,
   createBaseChannelRpcReader,
-  createWalletAccountFromKeystore,
   createX402Allocations,
   getX402JournalPath,
   getX402PolicyPath,
   listX402Payments,
   loadX402Policy,
   rpcUrlForNetwork
-} from "./chunk-6KBTN3WM.js";
+} from "./chunk-2AJZDGEL.js";
 import {
-  getTaskmarketHome,
+  createWalletAccountFromKeystore,
   keystoreExists,
   loadKeystore
-} from "./chunk-L3A7JOO5.js";
+} from "./chunk-Q2FZSDFG.js";
+import {
+  getTaskmarketHome
+} from "./chunk-VTMYCZLT.js";
+import {
+  AgentLaunchError
+} from "./chunk-YM4S6IE4.js";
 import {
   failureDetail,
   failureDetailOf,
@@ -24,9 +29,6 @@ import {
   responseFailureReason,
   withFailureDetail
 } from "./chunk-XJOB4NMV.js";
-import {
-  AgentLaunchError
-} from "./chunk-YM4S6IE4.js";
 
 // src/lib/agent/channels.ts
 import { randomUUID as randomUUID2 } from "crypto";

package/dist/{doctor-K2JOWQF4.js → doctor-HENBO5YV.js}

@@ -1,35 +1,36 @@
 import { createRequire as __tmCreateRequire } from 'node:module'; import { fileURLToPath as __tmFileURLToPath } from 'node:url'; import { dirname as __tmDirname } from 'node:path'; const require = __tmCreateRequire(import.meta.url); const __tmFilename = __tmFileURLToPath(import.meta.url); const __tmDirnameValue = __tmDirname(__tmFilename);
+import {
+  listSandboxes
+} from "./chunk-FMK32RJF.js";
+import "./chunk-RPGVVVJD.js";
+import "./chunk-GT5TOHOY.js";
+import "./chunk-XV6DBK4C.js";
 import {
   AGENT_COMPATIBILITY,
   assertAgentCompatibility,
   nodeVersionSupported
 } from "./chunk-4ZC6SH7H.js";
-import {
-  listSandboxes
-} from "./chunk-4E76UNBE.js";
-import "./chunk-CGUYPUG3.js";
-import "./chunk-RFRSTYDB.js";
-import "./chunk-73SUBS7U.js";
 import {
   channelView,
   loadAgentPolicy,
   openAgentChannels
-} from "./chunk-XBTNZTXE.js";
+} from "./chunk-YIOZ7W3M.js";
 import {
   getX402PolicyPath,
   loadX402Policy,
   rpcUrlForNetwork
-} from "./chunk-6KBTN3WM.js";
+} from "./chunk-2AJZDGEL.js";
 import {
   apiUrl,
   keystoreExists,
   loadKeystore,
   withChainId
-} from "./chunk-L3A7JOO5.js";
+} from "./chunk-Q2FZSDFG.js";
+import "./chunk-VTMYCZLT.js";
+import "./chunk-YM4S6IE4.js";
 import {
   AGENT_VIEW_VERSION
 } from "./chunk-XJOB4NMV.js";
-import "./chunk-YM4S6IE4.js";
 import "./chunk-S7SJMJ2I.js";
 
 // src/lib/agent/doctor.ts
@@ -206,15 +207,6 @@ async function runDoctor(deps = {}) {
     checks
   };
 }
-function doctorLines(report) {
-  return [
-    `taskmarket agent doctor (view v${report.version}): ${report.ok ? "ready" : "problems found"}`,
-    ...report.checks.map(
-      (check) => `${check.status.toUpperCase().padEnd(4)} ${check.id}: ${check.summary}`
-    )
-  ];
-}
 export {
-  doctorLines,
   runDoctor
 };