@lucid-agents/taskmarket 1.4.0 → 1.5.0

package/dist/index.js

@@ -4054,6 +4054,7 @@ var coerce = {
 var NEVER = INVALID;
 
 // ../../packages/shared/dist/schemas/common.schemas.js
+var EthAddressSchema = external_exports.string().regex(/^0x[a-fA-F0-9]{40}$/, "Invalid Ethereum address");
 var UsdcBaseUnitsSchema = external_exports.string().regex(/^[0-9]+$/, "Amount must be a non-negative integer in USDC base units");
 var PositiveUsdcBaseUnitsSchema = UsdcBaseUnitsSchema.refine(
   // The refine still runs when the regex check has already failed; skip the
@@ -4065,6 +4066,15 @@ var Secp256k1PublicKeySchema = external_exports.string().refine((value) => {
   const key = value.replace(/^0x/, "");
   return /^(?:02|03)[0-9a-fA-F]{64}$/.test(key) || /^04[0-9a-fA-F]{128}$/.test(key);
 }, "Public key must be a compressed or uncompressed secp256k1 key");
+function csvArrayQueryParam(schema = external_exports.string()) {
+  return external_exports.preprocess((value) => {
+    if (value === void 0 || value === "")
+      return void 0;
+    if (Array.isArray(value))
+      return value;
+    return String(value).split(",").map((v) => v.trim()).filter(Boolean);
+  }, external_exports.array(schema).optional());
+}
 
 // ../../packages/shared/dist/schemas/task-drops.schemas.js
 var EthAddress = external_exports.string().regex(/^0x[a-fA-F0-9]{40}$/, "Invalid Ethereum address").toLowerCase();
@@ -4171,6 +4181,7 @@ var TaskDropPageDataSchema = external_exports.object({
 
 // ../../packages/shared/dist/schemas/task.schemas.js
 var TaskMode = external_exports.enum(["bounty", "claim", "pitch", "benchmark", "auction"]);
+var TaskVisibility = external_exports.enum(["unlisted", "public"]);
 var TaskStatus = external_exports.enum([
   "open",
   "claimed",
@@ -4237,6 +4248,7 @@ var TaskCreateSchema = external_exports.object({
   duration: external_exports.number().positive("Duration must be positive"),
   tags: external_exports.array(external_exports.string()).max(10, "Maximum 10 tags allowed"),
   mode: TaskMode.optional().default("bounty"),
+  taskVisibility: TaskVisibility.optional().default("public"),
   stakeRequired: external_exports.boolean().optional().default(false),
   stakeBps: external_exports.number().min(0).max(1e4).optional().default(0),
   pitchDeadline: external_exports.number().positive().optional(),
@@ -4329,6 +4341,7 @@ var TaskResponseSchema = external_exports.object({
   status: TaskStatus,
   tags: external_exports.array(external_exports.string()),
   mode: TaskMode,
+  taskVisibility: TaskVisibility.optional().default("public"),
   stakeRequired: external_exports.boolean(),
   stakeBps: external_exports.number(),
   pitchDeadline: external_exports.string().nullable(),
@@ -4392,7 +4405,7 @@ var TaskListInputSchema = external_exports.object({
   mode: external_exports.enum(["ALL", "bounty", "claim", "pitch", "benchmark", "auction"]).optional().default("ALL"),
   auctionType: AuctionType.optional(),
   requesterActorType: external_exports.enum(["agent", "human"]).optional(),
-  tags: external_exports.array(external_exports.string()).optional(),
+  tags: csvArrayQueryParam(),
   minReward: external_exports.string().optional(),
   maxReward: external_exports.string().optional(),
   deadlineHours: external_exports.number().int().positive().optional(),
@@ -4406,7 +4419,12 @@ var TaskListResponseSchema = external_exports.object({
   hasMore: external_exports.boolean()
 });
 var TaskInboxInputSchema = external_exports.object({
-  address: external_exports.string()
+  address: external_exports.string(),
+  // Optional proof that the caller owns `address`: a signature over
+  // `taskmarket:inbox:<address>` (see ADR-0015). When present and valid, the
+  // response additionally includes that address's own unlisted tasks; otherwise
+  // behavior is unchanged (public tasks only, same as today, for any address).
+  signature: external_exports.string().optional()
 });
 var TaskInboxResponseSchema = external_exports.object({
   asRequester: external_exports.array(TaskResponseSchema),
@@ -4741,10 +4759,9 @@ var BidResponseSchema = external_exports.object({
 });
 
 // ../../packages/shared/dist/schemas/wallet.schemas.js
-var EthAddress2 = external_exports.string().regex(/^0x[a-fA-F0-9]{40}$/, "Invalid Ethereum address");
 var SetWithdrawalAddressInputSchema = external_exports.object({
-  walletAddress: EthAddress2,
-  withdrawalAddress: EthAddress2,
+  walletAddress: EthAddressSchema,
+  withdrawalAddress: EthAddressSchema,
   signature: external_exports.string().min(1)
 });
 var SetWithdrawalAddressOutputSchema = external_exports.object({
@@ -4769,7 +4786,7 @@ var AuthorizationSchema = external_exports.object({
   nonce: external_exports.string()
 });
 var WithdrawInputSchema = external_exports.object({
-  from: EthAddress2,
+  from: EthAddressSchema,
   amountBaseUnits: external_exports.string().min(1),
   authorization: AuthorizationSchema,
   signature: external_exports.string().min(1)
@@ -4783,8 +4800,8 @@ var DreamsBalanceOutputSchema = external_exports.object({
   claimableBaseUnits: external_exports.string()
 });
 var WithdrawDreamsInputSchema = external_exports.object({
-  workerAddress: EthAddress2,
-  destination: EthAddress2,
+  workerAddress: EthAddressSchema,
+  destination: EthAddressSchema,
   nonce: external_exports.string().min(1),
   validBefore: external_exports.string().min(1),
   signature: external_exports.string().min(1)
@@ -4803,7 +4820,6 @@ var ExchangeRateOutputSchema = external_exports.object({
 });
 
 // ../../packages/shared/dist/schemas/xmtp.schemas.js
-var EthereumAddressSchema = external_exports.string().regex(/^0x[a-fA-F0-9]{40}$/);
 var XmtpPolicySchema = external_exports.enum(["allow", "deny", "quarantine"]);
 var XmtpPolicyModeSchema = external_exports.enum(["allowlist", "open"]);
 var AgentMessageEnvelopeSchema = external_exports.object({
@@ -4812,7 +4828,7 @@ var AgentMessageEnvelopeSchema = external_exports.object({
   requestId: external_exports.string().uuid(),
   replyToRequestId: external_exports.string().uuid().nullable().optional(),
   senderInboxId: external_exports.string().min(1),
-  senderAddress: EthereumAddressSchema,
+  senderAddress: EthAddressSchema,
   sentAt: external_exports.string().datetime(),
   deadlineMs: external_exports.number().int().positive().optional(),
   payload: external_exports.record(external_exports.string(), external_exports.unknown())
@@ -4876,13 +4892,13 @@ var XmtpPeerPolicyListOutputSchema = external_exports.object({
   }))
 });
 var XmtpResolvePeerInputSchema = external_exports.object({
-  address: EthereumAddressSchema.optional(),
+  address: EthAddressSchema.optional(),
   agentId: external_exports.string().min(1).optional()
 }).refine((value) => Boolean(value.address || value.agentId), {
   message: "Either address or agentId is required"
 });
 var XmtpResolvePeerOutputSchema = external_exports.object({
-  address: EthereumAddressSchema.nullable(),
+  address: EthAddressSchema.nullable(),
   inboxId: external_exports.string().nullable()
 });
 
@@ -5068,7 +5084,7 @@ var LegalStatusResponseSchema = external_exports.object({
   receipt: external_exports.string().optional(),
   subjectType: LegalSubjectTypeSchema.optional()
 });
-var LegalWalletAddressSchema = external_exports.string().regex(/^0x[a-fA-F0-9]{40}$/);
+var LegalWalletAddressSchema = EthAddressSchema;
 var LegalAffirmationsSchema = external_exports.object({
   acknowledgedRisk: external_exports.literal(true),
   agreedToAcceptableUse: external_exports.literal(true),
@@ -5401,6 +5417,30 @@ function formatDreams(baseUnits) {
 function buildSelectWorkerMessage(taskId, pitchId, workerAddress) {
   return `taskmarket:select-worker:${taskId}:${pitchId}:${workerAddress.toLowerCase()}`;
 }
+function buildInboxSelfAuthMessage(address) {
+  return `taskmarket:inbox:${address.toLowerCase()}`;
+}
+function buildMyBidsMessage(address) {
+  return `taskmarket:my-bids:${address.toLowerCase()}`;
+}
+function buildSubmitMessage(taskId) {
+  return `taskmarket:submit:${taskId}`;
+}
+function buildClaimMessage(taskId) {
+  return `taskmarket:claim:${taskId}`;
+}
+function buildForfeitMessage(taskId) {
+  return `taskmarket:forfeit:${taskId}`;
+}
+function buildSetWithdrawalAddressMessage(withdrawalAddress) {
+  return `taskmarket:set-withdrawal-address:${withdrawalAddress.toLowerCase()}`;
+}
+function buildWithdrawDreamsMessage(destination, nonce, validBefore) {
+  return `taskmarket:withdraw-dreams:${destination.toLowerCase()}:${nonce}:${validBefore}`;
+}
+function buildDeviceRegisterMessage(walletAddress) {
+  return `taskmarket:device-register:${walletAddress.toLowerCase()}`;
+}
 
 // ../../packages/shared/dist/legal.js
 var LEGAL_RECEIPT_HEADER = "X-Taskmarket-Legal-Receipt";
@@ -5954,7 +5994,11 @@ async function pollAgentId(address, maxWaitMs = 6e4) {
 // src/lib/device-registration.ts
 async function registerDevice(input) {
   const response = await fetch(`${API_URL}/api/devices`, {
-    body: JSON.stringify({ publicKey: input.publicKey, walletAddress: input.walletAddress }),
+    body: JSON.stringify({
+      publicKey: input.publicKey,
+      signature: input.signature,
+      walletAddress: input.walletAddress
+    }),
     headers: {
       "Content-Type": "application/json",
       ...buildLegalReceiptHeaders(input.legalReceipt)
@@ -6345,6 +6389,9 @@ var initCommand = new Command2("init").description("Create and register a new ag
     signMessage: (message) => privateKeyToAccount3(privateKey).signMessage({ message }),
     walletAddress: address
   }) : void 0;
+  const deviceRegisterSignature = await privateKeyToAccount3(
+    privateKey
+  ).signMessage({ message: buildDeviceRegisterMessage(address) });
   const {
     deviceId,
     apiToken,
@@ -6353,6 +6400,7 @@ var initCommand = new Command2("init").description("Create and register a new ag
   } = await registerDevice({
     legalReceipt: legalAcceptance?.receipt,
     publicKey,
+    signature: deviceRegisterSignature,
     walletAddress: address
   });
   const encryptedKey = encryptPrivateKey(deviceEncryptionKey, privateKey);
@@ -6545,7 +6593,11 @@ function usdcToBaseUnits(value, options = {}) {
 }
 
 // src/commands/task/create.ts
-var createCmd = new Command6("create").description("Create a new task (costs reward amount in USDC)").requiredOption("--description <text>", "Task description").requiredOption("--reward <usdc>", "Reward in USDC (e.g. 5 for 5 USDC)").requiredOption("--duration <hours>", "Task duration in hours").option("--mode <mode>", "Task mode: bounty, claim, pitch, benchmark, auction", "bounty").option("--tags <tags>", "Comma-separated tags").option("--pitch-deadline <hours>", "Pitch deadline in hours from now (pitch mode only)").option("--bid-deadline <hours>", "Bid deadline in hours from now (auction mode only)").option("--max-price <usdc>", "Maximum bid price in USDC (required for auction mode)").option(
+var createCmd = new Command6("create").description("Create a new task (costs reward amount in USDC)").requiredOption("--description <text>", "Task description").requiredOption("--reward <usdc>", "Reward in USDC (e.g. 5 for 5 USDC)").requiredOption("--duration <hours>", "Task duration in hours").option("--mode <mode>", "Task mode: bounty, claim, pitch, benchmark, auction", "bounty").option(
+  "--task-visibility <mode>",
+  "Task visibility: public (default) or unlisted. Unlisted only hides a task from Taskmarket's own listings/search/SEO -- it stays permanently visible on the public blockchain to anyone with the link, reading the contract directly, or running their own indexer. Not a privacy feature.",
+  "public"
+).option("--tags <tags>", "Comma-separated tags").option("--pitch-deadline <hours>", "Pitch deadline in hours from now (pitch mode only)").option("--bid-deadline <hours>", "Bid deadline in hours from now (auction mode only)").option("--max-price <usdc>", "Maximum bid price in USDC (required for auction mode)").option(
   "--auction-type <type>",
   "Auction subtype: dutch, english, reverse_dutch, reverse_english (required for auction mode)"
 ).option(
@@ -6571,6 +6623,9 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
     if (!Number.isFinite(duration) || duration <= 0) {
       return void printError("--duration must be a positive number of hours");
     }
+    if (opts.taskVisibility !== "public" && opts.taskVisibility !== "unlisted") {
+      return void printError("--task-visibility must be one of: public, unlisted");
+    }
     if (opts.mode === "auction") {
       if (!opts.maxPrice) {
         return void printError("--max-price is required for auction mode");
@@ -6614,6 +6669,7 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
       reward: rewardBaseUnits,
       duration,
       mode: opts.mode,
+      taskVisibility: opts.taskVisibility,
       tags,
       stakeRequired: false,
       stakeBps: 0
@@ -6831,7 +6887,7 @@ var submitCmd = new Command9("submit").description("Submit work for a task").arg
       printError("--file is required");
     }
     const keystore = await loadKeystore();
-    const signature = await signMessage(`taskmarket:submit:${taskId}`, keystore);
+    const signature = await signMessage(buildSubmitMessage(taskId), keystore);
     const artifactInputs = await Promise.all(
       opts.file.map(async (filePath) => {
         const mimeType = mimeTypeForPath(filePath);
@@ -6973,7 +7029,7 @@ var rateCmd = new Command12("rate").description("Rate a worker (costs 0.001 USDC
 import { Command as Command13 } from "commander";
 var claimCmd = new Command13("claim").description("Claim a task as a worker").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
   const keystore = await loadKeystore();
-  const message = `taskmarket:claim:${taskId}`;
+  const message = buildClaimMessage(taskId);
   const signature = await signMessage(message, keystore);
   const result = await apiPost(`/api/tasks/${taskId}/claim`, {
     workerAddress: keystore.walletAddress,
@@ -7362,7 +7418,7 @@ import { Command as Command30 } from "commander";
 var forfeitCmd = new Command30("forfeit").description("Reclaim a claim-mode task whose worker's claim has expired (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
   try {
     const keystore = await loadKeystore();
-    const message = `taskmarket:forfeit:${taskId}`;
+    const message = buildForfeitMessage(taskId);
     const signature = await signMessage(message, keystore);
     const result = await apiPost(`/api/tasks/${taskId}/forfeit`, {
       taskId,
@@ -7555,27 +7611,33 @@ var agentsCommand = new Command37("agents").description("Browse the agent direct
 // src/commands/inbox.ts
 import { Command as Command38 } from "commander";
 var inboxCommand = new Command38("inbox").description("Show tasks you created and tasks you are working on").action(async () => {
-  let address;
+  let keystore;
   try {
-    address = await getWalletAddress();
+    keystore = await loadKeystore();
   } catch (err) {
     const msg = err instanceof Error ? err.message : "No keystore found. Run `taskmarket init` first.";
     printError(msg);
   }
-  const taskResult = await apiGet(
-    `/api/agents/inbox?address=${encodeURIComponent(address)}`
-  );
-  let pendingBids = [];
+  const address = keystore.walletAddress;
+  let account;
   try {
-    const keystore = await loadKeystore();
-    if (keystore.deviceId && keystore.apiToken) {
-      const params = new URLSearchParams({ deviceId: keystore.deviceId });
-      pendingBids = await apiGet(`/api/bids/my?${params.toString()}`, {
-        headers: { "x-taskmarket-api-token": keystore.apiToken }
-      });
-    }
+    account = await createWalletAccountFromKeystore(keystore);
   } catch {
   }
+  const [signature, bidsSignature] = await Promise.all([
+    account?.signMessage({ message: buildInboxSelfAuthMessage(address) }).catch(() => void 0),
+    account?.signMessage({ message: buildMyBidsMessage(address) }).catch(() => void 0)
+  ]);
+  const inboxParams = new URLSearchParams({ address });
+  if (signature) inboxParams.set("signature", signature);
+  const bidParams = new URLSearchParams({ address });
+  if (bidsSignature) bidParams.set("signature", bidsSignature);
+  const [taskResult, pendingBids] = await Promise.all([
+    apiGet(`/api/agents/inbox?${inboxParams.toString()}`),
+    bidsSignature ? apiGet(`/api/bids/my?${bidParams.toString()}`).catch(
+      () => []
+    ) : Promise.resolve([])
+  ]);
   printResult({ ...taskResult, pendingBids });
 });
 
@@ -7690,6 +7752,9 @@ var walletImportCommand = new Command41("import").description("Import an existin
     signMessage: (message) => account.signMessage({ message }),
     walletAddress: address
   }) : void 0;
+  const deviceRegisterSignature = await account.signMessage({
+    message: buildDeviceRegisterMessage(address)
+  });
   const {
     deviceId,
     apiToken,
@@ -7698,6 +7763,7 @@ var walletImportCommand = new Command41("import").description("Import an existin
   } = await registerDevice({
     legalReceipt: legalAcceptance?.receipt,
     publicKey,
+    signature: deviceRegisterSignature,
     walletAddress: address
   });
   const encryptedKey = encryptPrivateKey(deviceEncryptionKey, privateKey);
@@ -7748,7 +7814,7 @@ var setWithdrawalAddressCommand = new Command42("set-withdrawal-address").descri
     printError("No keystore found. Run `taskmarket init` first.");
   }
   const walletAddress = keystore.walletAddress;
-  const message = `taskmarket:set-withdrawal-address:${address}`;
+  const message = buildSetWithdrawalAddressMessage(address);
   const signature = await signMessage(message, keystore);
   const result = await apiPost("/api/wallet/set-withdrawal-address", {
     walletAddress,
@@ -7810,7 +7876,7 @@ var withdrawDreamsCommand = new Command44("withdraw-dreams").description("Withdr
   }
   const nonce = toHex2(crypto.getRandomValues(new Uint8Array(32)));
   const validBefore = String(Math.floor(Date.now() / 1e3) + AUTHORIZATION_VALIDITY_SECONDS);
-  const message = `taskmarket:withdraw-dreams:${destination}:${nonce}:${validBefore}`;
+  const message = buildWithdrawDreamsMessage(destination, nonce, validBefore);
   const signature = await signMessage(message, keystore);
   const result = await apiPost("/api/wallet/withdraw-dreams", {
     workerAddress,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucid-agents/taskmarket",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "type": "module",
   "bin": {
     "taskmarket": "./dist/index.js"