@ola-893/agentpay-cli 0.2.0 → 0.4.0

package/src/settings.mjs

@@ -5,6 +5,8 @@ import { atomicWrite, readOptional } from './files.mjs';
 import { readConfig, readKey } from '@ola-893/agentpay-core/internal-config';
 import { runtimePolicy, serviceConfig } from '@ola-893/agentpay-core/internal-runtime-policy';
 import { inspectNearProfile, NearAgentPayClient } from '@ola-893/agentpay-core/near';
+import { inferenceConfig } from './inference.mjs';
+export { inferenceConfig } from './inference.mjs';
 
 export function usdc(value) {
   if (typeof value !== 'string' || !/^(0|[1-9][0-9]{0,24})(\.[0-9]{1,6})?$/.test(value)) throw new Error('Use a nonnegative USDC amount with at most six decimal places.');
@@ -43,22 +45,14 @@ export async function setService(project, patch) {
   await atomicWrite(profile.configPath, JSON.stringify(validated, null, 2));
   return { service: { url: validated.serviceUrl, recipient: validated.recipientId, ...validated.service }, restartRequired: 'Restart running agents/MCP servers after service changes.' };
 }
-export function inferenceConfig(input) {
-  if (!input || typeof input.model !== 'string' || !input.model.trim() || input.model.length > 256) throw new Error('Provide --model.');
-  const url = new URL(input.baseUrl);
-  if (url.username || url.password || url.search || url.hash || !(url.protocol === 'https:' || (url.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)))) throw new Error('Inference URL must use HTTPS or loopback without embedded credentials.');
-  if (input.apiKeyEnv && !/^[A-Z][A-Z0-9_]{0,127}$/.test(input.apiKeyEnv)) throw new Error('Provide an environment variable NAME via --api-key-env, never the key itself.');
-  const maxSteps = input.maxSteps ?? 12;
-  if (!Number.isInteger(maxSteps) || maxSteps < 1 || maxSteps > 100) throw new Error('maxSteps must be between 1 and 100.');
-  if (input.thinking !== undefined && typeof input.thinking !== 'boolean') throw new Error('thinking must be true or false.');
-  return { protocol: 'openai-chat', baseUrl: url.href.replace(/\/$/, ''), model: input.model, ...(input.apiKeyEnv ? { apiKeyEnv: input.apiKeyEnv } : {}), ...(input.thinking !== undefined ? { thinking: input.thinking } : {}), maxSteps };
-}
 export async function setInference(project, input) {
   const profile = await liveProfile(project);
   const inference = inferenceConfig(input);
   const { file, configPath, stateRoot, ...saved } = profile;
   await atomicWrite(file, JSON.stringify({ ...saved, inference }, null, 2));
-  return { inference, credentialsStored: false, next: 'agentpay agent run --prompt "Use the configured paid API to answer my question."' };
+  return { inference, credentialsStored: false,
+    ...(inference.provider === 'near-ai' ? { attestationVerified: false, policySignerLocation: 'local host' } : {}),
+    next: 'agentpay agent run --prompt "Use the configured paid API to answer my question."' };
 }
 export async function setLimits(project, patch, ownerKeyFile) {
   if (!ownerKeyFile) throw new Error('--owner-key is required for an on-chain policy change; it is never saved in the agent profile.');

package/src/setup.mjs

@@ -16,7 +16,7 @@ export const publicRecording = fileURLToPath(new URL('../ui/near/testnet.json',
 export async function setupTestnet(project, options) {
   if (!options.ownerId || !options.ownerKeyFile) return {
     status: 'OWNER_SETUP_REQUIRED', network: 'testnet', signedTransactions: 0,
-    next: 'agentpay init --network testnet --owner-id YOUR.testnet --owner-key /absolute/path/owner.json',
+    next: (options.setupCommand ?? 'agentpay init') + ' --network testnet --owner-id YOUR.testnet --owner-key /absolute/path/owner.json',
     steps: ['Create/export a named NEAR testnet owner account using your wallet or near-cli-rs. Keep its Ed25519 credential JSON private (0600).', 'Fund it with at least 6 test NEAR after storage reserve. The setup creates a vault and restricted agent; recipient defaults to the owner for the local fixture.', 'Run the command above for read-only preflight, then add --deploy to submit setup transactions. No deployment.json or Rust build is required.', 'After setup, use the Circle faucet (Near Testnet) for the printed owner address, then agentpay fund --amount 100000 --owner-key /absolute/path/owner.json.', 'Run Configure the service, inference and financial/runtime guardrails, then enable payments and run agentpay agent run --prompt "...".'],
     nearAccounts: 'https://docs.near.org/tools/cli', usdcFaucet: 'https://faucet.circle.com/',
     noSponsor: true,
@@ -45,8 +45,8 @@ export async function setupTestnet(project, options) {
   };
 }
 
-export async function fundProject(project, { ownerKeyFile, amount }) {
-  if (!/^[1-9][0-9]{0,20}$/.test(amount ?? '') || BigInt(amount) > 100000n) throw new Error('Provide --amount in raw six-decimal USDC units, at most 100000 (0.1 test USDC) per funding call.');
+export async function fundProject(project, { ownerKeyFile, amount, decimal = false }) {
+  if (!/^[1-9][0-9]{0,20}$/.test(amount ?? '') || (!decimal && BigInt(amount) > 100000n)) throw new Error(decimal ? 'Provide a positive test USDC amount.' : 'Provide --amount in raw six-decimal USDC units, at most 100000 (0.1 test USDC) per funding call.');
   if (!ownerKeyFile) throw new Error('--owner-key is required only for this explicit funding operation.');
   const profile = await liveProfile(project);
   const config = await readConfig(profile.configPath);

package/src/ui.mjs

@@ -7,11 +7,11 @@ import { verifyRun } from '@ola-893/agentpay-core/internal-evidence-audit';
 
 const uiRoot = fileURLToPath(new URL('../ui/', import.meta.url));
 const mime = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.json': 'application/json', '.svg': 'image/svg+xml', '.png': 'image/png', '.woff2': 'font/woff2', '.ico': 'image/x-icon' };
-export async function startUi({ port = 0, recording = 'testnet' } = {}) {
+export async function startUi({ port = 0, recording = 'testnet', runFile } = {}) {
   if (!['testnet', 'sandbox'].includes(recording)) throw new Error('Choose --recording testnet or sandbox.');
-  const captured = JSON.parse(await readFile(resolve(uiRoot, 'near', `${recording}.json`), 'utf8'));
+  const captured = JSON.parse(await readFile(runFile ? resolve(runFile) : resolve(uiRoot, 'near', `${recording}.json`), 'utf8'));
   verifyRun(captured);
-  if (captured.network !== recording || captured.simulated) throw new Error('REPLAY_PROVENANCE_MISMATCH');
+  if ((!runFile && captured.network !== recording) || captured.simulated) throw new Error('REPLAY_PROVENANCE_MISMATCH');
   const server = createServer(async (req, res) => {
     const send = (status, body, type = 'text/plain') => {
       res.writeHead(status, { 'content-type': type, 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', 'x-frame-options': 'DENY', 'referrer-policy': 'no-referrer' });
@@ -23,6 +23,7 @@ export async function startUi({ port = 0, recording = 'testnet' } = {}) {
       const decoded = decodeURIComponent(req.url.split('?')[0]);
       if (decoded.split('/').some(x => x === '..' || x.startsWith('.')) || decoded.includes('\\') || decoded.includes('\0')) return send(403, 'Path denied.');
       if (decoded.startsWith('/api/') || decoded === '/api') return send(404, 'No signing API is exposed by this viewer.');
+      if (runFile && ['/near/latest.json', '/near/testnet.json', '/near/sandbox.json'].includes(decoded)) return send(200, JSON.stringify(captured), 'application/json');
       let path = ['/', '/docs'].includes(decoded) ? '/index.html' : decoded;
       if (path === '/near/latest.json') path = `/near/${recording === 'sandbox' ? 'sandbox' : 'testnet'}.json`;
       const file = await realpath(resolve(uiRoot, `.${path}`));

package/src/vault-money.mjs

@@ -0,0 +1,69 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readdir, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { actions, baseEncode, encodeTransaction, JsonRpcProvider } from 'near-api-js';
+import { atomicWrite, readOptional } from './files.mjs';
+import { fingerprint } from './agents.mjs';
+
+const explorer = hash => `https://testnet.nearblocks.io/txns/${hash}`;
+
+async function finalize(file, intent, outcome) {
+  const tx = outcome.transaction;
+  if (outcome.final_execution_status !== 'FINAL' || tx?.hash !== intent.hash || tx.signer_id !== intent.accountId || tx.receiver_id !== intent.vaultId) throw new Error('VAULT_PAYOUT_OUTCOME_UNCONFIRMED');
+  const status = outcome.status;
+  const ok = status && typeof status === 'object' && 'SuccessValue' in status &&
+    Buffer.from(status.SuccessValue, 'base64').toString() === 'true' &&
+    !outcome.receipts_outcome?.some(receipt => receipt.outcome.status?.Failure);
+  const result = { resolved: true, paid: Boolean(ok), method: intent.method, transactionHash: intent.hash, explorerUrl: explorer(intent.hash) };
+  await atomicWrite(join(file, '..', `receipt-${intent.hash}.json`), JSON.stringify(result));
+  await unlink(file);
+  return result;
+}
+
+export async function payout(agent, client, method, args = {}) {
+  const root = join(agent.path, 'payouts');
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const file = join(root, fingerprint(`${client.vaultId}:${client.accountId}`) + '.pending');
+  const lockFile = file + '.lock';
+  const lock = await open(lockFile, 'wx', 0o600).catch(error => {
+    if (error.code === 'EEXIST') throw new Error('VAULT_PAYOUT_BUSY');
+    throw error;
+  });
+  try {
+    const existing = await readOptional(file);
+    if (existing) throw new Error(`VAULT_PAYOUT_RECONCILIATION_REQUIRED: ${explorer(JSON.parse(existing).hash)}`);
+    const signed = await client.account.createSignedTransaction({ receiverId: client.vaultId, actions: [actions.functionCall(method, args, 100000000000000n)] });
+    const hash = baseEncode(createHash('sha256').update(encodeTransaction(signed.transaction)).digest());
+    const intent = { hash, method, accountId: client.accountId, vaultId: client.vaultId, rpcUrl: client.provider.connection.url };
+    await atomicWrite(file, JSON.stringify(intent));
+    let result;
+    try { result = await finalize(file, intent, await client.provider.sendTransactionUntil(signed, 'FINAL')); }
+    catch { throw new Error(`VAULT_PAYOUT_RECONCILIATION_REQUIRED: ${explorer(hash)}`); }
+    if (!result.paid) throw new Error(`VAULT_PAYOUT_FAILED: ${result.explorerUrl}`);
+    return result;
+  } finally { await lock.close(); await unlink(lockFile); }
+}
+
+export async function reconcilePayouts(agent) {
+  const root = join(agent.path, 'payouts');
+  let files;
+  try { files = await readdir(root); } catch (error) { if (error.code === 'ENOENT') return { resolved: true, transactions: [] }; throw error; }
+  const transactions = [];
+  for (const name of files.filter(item => /^[a-f0-9]{64}\.pending$/.test(item))) {
+    const file = join(root, name), lockFile = file + '.lock';
+    let lock;
+    try { lock = await open(lockFile, 'wx', 0o600); }
+    catch (error) { if (error.code !== 'EEXIST') throw error; transactions.push({ resolved: false, reason: 'VAULT_PAYOUT_BUSY' }); continue; }
+    try {
+      const pending = await readOptional(file);
+      if (!pending) continue;
+      const intent = JSON.parse(pending);
+      const provider = new JsonRpcProvider({ url: intent.rpcUrl });
+      try {
+        const outcome = await provider.viewTransactionStatus({ txHash: intent.hash, accountId: intent.accountId, waitUntil: 'FINAL' });
+        transactions.push(await finalize(file, intent, outcome));
+      } catch { transactions.push({ resolved: false, transactionHash: intent.hash, explorerUrl: explorer(intent.hash) }); }
+    } finally { await lock.close(); await unlink(lockFile); }
+  }
+  return { resolved: transactions.every(x => x.resolved), transactions };
+}