@oneshot-agent/sdk 0.44.0 → 0.47.0

package/dist/index.js

@@ -37,6 +37,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OneShot = exports.executeSwap = exports.getSwapQuote = exports.ReadOnlyWalletProvider = exports.CdpWalletProvider = exports.EthersWalletProvider = void 0;
+const hunts_1 = require("./hunts");
+__exportStar(require("./hunts"), exports);
 const physical_mail_1 = require("./physical-mail");
 __exportStar(require("./physical-mail"), exports);
 __exportStar(require("./approvals"), exports);
@@ -57,39 +59,17 @@ Object.defineProperty(exports, "getSwapQuote", { enumerable: true, get: function
 Object.defineProperty(exports, "executeSwap", { enumerable: true, get: function () { return swap_1.executeSwap; } });
 __exportStar(require("./errors"), exports);
 const approvals_1 = require("./approvals");
-// Receipt verification (`canonicalizeReceipt`, `verifyReceipt`,
-// `receiptFromWire`, and their supporting types `SignableReceipt`,
-// `ReceiptSignatureFields`, `ReceiptJwk`, `ReceiptJwks`,
-// `ReceiptVerificationResult`, `ReceiptVerificationFailureReason`) is
-// intentionally NOT re-exported here, values OR types. `./receipt`
-// statically imports `node:crypto`, and this file is the SDK's main entry —
-// re-exporting its values would give every consumer (including browser/edge
-// bundles, which this file otherwise avoids requiring Node builtins for;
-// see the deliberate `btoa` fallback below) a hard Node-only dependency
-// with no way to opt out. Import from the `@oneshot-agent/sdk/receipt`
-// subpath instead (see package.json `exports` and the README's
-// "Verifying Receipts" section).
-//
-// Types alone erase at compile time and carry no runtime import, so a
-// type-only re-export here would be runtime-safe — but `SignableReceipt`
-// declares `providerCost` (libs/agent-sdk/src/receipt.ts), the field whose
-// removal from the public SDK surface `tests/unit/sdk-provider-cost-removed
-// .test.ts` guards. Re-exporting it from the main entry would put it back
-// on the surface that guard exists to keep clean, just via the type system
-// instead of a runtime value. `providerCost` must stay inside
-// `SignableReceipt` itself (it's part of what the signer actually signs —
-// see `canonicalizeReceipt`), so the fix is not exposing that type here,
-// not removing the field. Import `SignableReceipt` from the `./receipt`
-// subpath directly if you need it.
+// `./receipt` is NOT re-exported here, values or types: it statically imports
+// `node:crypto`, which would force a hard Node dependency on every consumer
+// including browser bundles; and its `SignableReceipt.providerCost` field must
+// stay off this public surface (see tests/unit/sdk-provider-cost-removed.test.ts).
+// Import from the `@oneshot-agent/sdk/receipt` subpath instead.
 // Keep in sync with package.json `version`. Guarded by version.test.ts.
-const SDK_VERSION = '0.44.0';
+const SDK_VERSION = '0.47.0';
 /** HTTP poll cadence while push is unconfirmed: fast first checks, settling at 2s. */
 const HTTP_POLL_BACKOFF_MS = [300, 600, 1000, 2000];
 /** HTTP poll cadence once the WebSocket has delivered for this request. */
 const HTTP_POLL_RELAXED_MS = 5000;
-// ============================================================================
-// Environment Configuration
-// ============================================================================
 const BASE_URL = 'https://win.oneshotagent.com';
 const RPC_URL = 'https://mainnet.base.org';
 const CHAIN_ID = 8453;
@@ -122,16 +102,7 @@ function validateSwapBufferMultiplier(m) {
     }
     return m;
 }
-// ============================================================================
-// Public types — defined in ./types.ts. Re-exported below so existing
-// consumer imports (`import { EmailToolOptions, ... } from '@oneshot-agent/sdk'`)
-// keep resolving unchanged. The OneShot class below pulls the names it needs
-// for internal use via the import block.
-// ============================================================================
 __exportStar(require("./types"), exports);
-// ============================================================================
-// OneShot SDK
-// ============================================================================
 /**
  * OneShot Agent SDK - Execute commercial transactions with automatic x402 payments.
  *
@@ -218,6 +189,7 @@ class OneShot {
      * For CDP wallets, use OneShot.create() instead.
      */
     constructor(config, walletProvider) {
+        this.hunts = new hunts_1.Hunts(this);
         this.physicalMail = new physical_mail_1.PhysicalMail(async (path, method, body, mime) => {
             const response = await fetch(`${this.baseUrl}/v1/tools/physical-mail${path}`, {
                 method, headers: { ...await this.signedReadHeaders(method === 'GET' ? 'read' : 'write'), 'Content-Type': mime ?? 'application/json' },
@@ -239,6 +211,7 @@ class OneShot {
         /** ETH mode: serializes read → decide → swap → reserve per instance (also prevents concurrent swap nonce races). */
         this._usdcLock = Promise.resolve();
         this.baseUrl = config.baseUrl ?? BASE_URL;
+        this.huntUrl = config.huntUrl;
         this.debug = config.debug ?? false;
         this.logger = config.logger ?? console.log;
         this._currency = config.currency ?? 'USDC';
@@ -294,9 +267,6 @@ class OneShot {
             this.log(`SDK initialized — chain=${CHAIN_ID} currency=${this._currency}`);
         }
     }
-    // ---------------------------------------------------------------------------
-    // Public getters
-    // ---------------------------------------------------------------------------
     get address() {
         return this.provider.address;
     }
@@ -320,9 +290,6 @@ class OneShot {
     get budgetConfig() {
         return this._budgets;
     }
-    // ---------------------------------------------------------------------------
-    // Public methods
-    // ---------------------------------------------------------------------------
     async tool(toolName, options) {
         return this.executeToolRequest(`/v1/tools/${toolName}`, options);
     }
@@ -780,6 +747,8 @@ class OneShot {
             payload.source_url = options.source_url;
         if (options.sections)
             payload.sections = options.sections;
+        if (options.pages?.length)
+            payload.pages = options.pages;
         if (options.lead_capture)
             payload.lead_capture = options.lead_capture;
         if (options.brand)
@@ -790,18 +759,40 @@ class OneShot {
             payload.domain = options.domain;
         if (options.build_id)
             payload.build_id = options.build_id;
+        return this.submitBuild(payload, options);
+    }
+    /**
+     * Apply natural-language changes to one of your builds. The site's existing
+     * code is edited (not regenerated) and redeployed to the same URL.
+     *
+     * @example
+     * ```typescript
+     * const result = await agent.refineBuild({
+     *   build_id: previous.request_id,
+     *   changes: 'Make the hero darker and add an FAQ page at /faq',
+     * });
+     * ```
+     */
+    async refineBuild(options) {
+        this.validate(options.build_id, 'build_id');
+        this.validate(options.changes, 'changes');
+        return this.submitBuild({ build_id: options.build_id, changes: options.changes }, options);
+    }
+    async submitBuild(payload, options) {
         const { execResp: buildResp } = await this.runQuoteToPay({
             endpoint: '/v1/tools/build',
             payload,
             signal: options.signal,
             maxCost: options.maxCost,
+            approvalId: options.approvalId,
             // Build analysis can be slow server-side; bound the quote leg client-side.
             quoteTimeoutMs: 120000,
             expectMsg: 'Expected 402 for quote',
             totalOf: (ctx) => ctx.pricing.total,
             onQuote: (ctx) => {
                 this.log(`Build quote: $${ctx.pricing.total} for "${ctx.product_name}"`);
-                this.log(`Type: ${ctx.analysis.inferred_type}, Sections: ${ctx.analysis.estimated_sections}`);
+                if (!ctx.is_refine)
+                    this.log(`Type: ${ctx.analysis.inferred_type}, Sections: ${ctx.analysis.estimated_sections}`);
             },
             on400: async (resp) => {
                 const errorData = await resp.json();
@@ -964,13 +955,6 @@ class OneShot {
             throw new errors_2.ToolError('Failed to delete browser profile', response.status, await response.text());
         }
     }
-    // ── LinkedIn — messaging through a human-connected account (issue #756) ──
-    //
-    // The human connects THEIR OWN LinkedIn account through a hosted login link
-    // and grants specific actions. Connection/reads are free (signed proof);
-    // sync, reply, profile view and react are paid fixed-price tools. Every
-    // write is idempotency-keyed automatically — a message LinkedIn accepted
-    // cannot be recalled.
     async linkedinFree(method, path, opts) {
         const url = new URL(`${this.baseUrl}/v1/tools/linkedin${path}`);
         for (const [k, v] of Object.entries(opts.query ?? {}))
@@ -1147,9 +1131,6 @@ class OneShot {
         }
         return response.json();
     }
-    // ---------------------------------------------------------------------------
-    // Inbound voice — the agent's number answers its own calls
-    // ---------------------------------------------------------------------------
     /**
      * Get this agent a voice number without placing a call. Returns the existing
      * active number for free; otherwise buys one and charges the one-time phone
@@ -1337,9 +1318,6 @@ class OneShot {
         ]);
         return ethers_1.ethers.formatUnits(balance, decimals);
     }
-    // ---------------------------------------------------------------------------
-    // Compute methods
-    // ---------------------------------------------------------------------------
     /**
      * Create a compute goal — the orchestrator will plan, execute, and iterate autonomously.
      *
@@ -1671,9 +1649,6 @@ class OneShot {
         const json = await resp.json();
         return json.data;
     }
-    // ---------------------------------------------------------------------------
-    // Analytics methods
-    // ---------------------------------------------------------------------------
     /**
      * Get spend breakdown by category
      *
@@ -1831,9 +1806,6 @@ class OneShot {
         }
         return response.json();
     }
-    // ---------------------------------------------------------------------------
-    // Private helpers
-    // ---------------------------------------------------------------------------
     log(msg) {
         if (this.debug)
             this.logger(`[OneShot] ${msg}`);
@@ -1898,7 +1870,7 @@ class OneShot {
      * locally. A fresh nonce per call prevents replay. Signing failure falls back
      * to plain headers, with a one-time warning.
      */
-    async signedReadHeaders(scope = 'read') {
+    async signedReadHeaders(scope = 'read', domainName = 'OneShot Agent Auth') {
         const base = this.headers();
         // The bearer token already binds the request to the agent (and is
         // revocable); the API accepts it in place of the signed proof.
@@ -1908,7 +1880,14 @@ class OneShot {
             const agent = this.provider.address;
             const issuedAt = Math.floor(Date.now() / 1000);
             const nonce = ethers_1.ethers.hexlify(ethers_1.ethers.randomBytes(32));
-            const signature = await this.provider.signTypedData({ name: 'OneShot Agent Auth', version: '1' }, {
+            const signature = await this.provider.signTypedData(
+            // `domainName` lets a different origin (e.g. Soul Hunt, which keeps
+            // its own nonce store — see hunts.ts) use a DIFFERENT EIP-712 domain
+            // than api-service's. EIP-712 mixes the domain into the signed hash,
+            // so a proof is only valid for the one origin it was signed for and
+            // can't be replayed across service boundaries (security finding
+            // F-t_d4805d6f-3, round 2).
+            { name: domainName, version: '1' }, {
                 AgentReadAuth: [
                     { name: 'agent', type: 'address' },
                     { name: 'scope', type: 'string' },
@@ -2051,9 +2030,6 @@ class OneShot {
         const body = await response.json();
         return (body.data ?? body);
     }
-    // ---------------------------------------------------------------------------
-    // Access tokens (wallet sessions only)
-    // ---------------------------------------------------------------------------
     assertWalletSession(action) {
         if (this._accessToken) {
             throw new errors_2.ValidationError(`Access tokens cannot ${action}; use a wallet session`, 'accessToken');
@@ -2936,9 +2912,6 @@ class OneShot {
             throw new errors_2.OneShotError('Operation cancelled before payment');
         }
     }
-    // ---------------------------------------------------------------------------
-    // ETH-currency mode: USDC ledger + buffered swaps
-    // ---------------------------------------------------------------------------
     /**
      * ETH mode only. Make sure the wallet's *effective* USDC (on-chain balance
      * minus payments signed but not yet settled) covers this charge, swapping
@@ -2977,7 +2950,7 @@ class OneShot {
             return this.reserveUsdc(charge);
         });
     }
-    /** ETH mode is Base-mainnet-only (that is where the Uniswap route lives); fail clearly before any RPC. */
+    /** ETH mode is Base-mainnet-only; fail clearly before any RPC. */
     assertEthModeSupported(paymentInfo) {
         const chainId = chainIdFromNetwork(paymentInfo.network) ?? CHAIN_ID;
         if (chainId !== CHAIN_ID) {
@@ -2995,7 +2968,7 @@ class OneShot {
         this._usdcLock = run.then(() => undefined, () => undefined);
         return run;
     }
-    /** On-chain USDC balance (atomic units), deduped within one block. Overridable in tests. */
+    /** On-chain USDC balance (atomic units), deduped within one block. */
     async readUsdcBalance(usdcAddress) {
         const cached = this._usdcBalanceCache;
         if (cached && Date.now() - cached.at < USDC_BALANCE_CACHE_MS)
@@ -3057,13 +3030,13 @@ class OneShot {
         }
         return amount;
     }
-    /** Max ETH the buffered swap could cost (quote), or undefined if unavailable. Overridable in tests. */
+    /** Max ETH the buffered swap could cost (quote), or undefined if unavailable. */
     async quoteSwapAmountInMax(usdcAmount, chainId) {
         const { getSwapQuote } = await Promise.resolve().then(() => __importStar(require('./swap')));
         const quote = await getSwapQuote(this.rpcProvider, usdcAmount, chainId, this._slippage);
         return quote?.amountInMax;
     }
-    /** Perform the on-chain swap. Overridable in tests. */
+    /** Perform the on-chain swap. */
     async executeUsdcSwap(usdcAmount, chainId) {
         const { executeSwap } = await Promise.resolve().then(() => __importStar(require('./swap')));
         return executeSwap(this.provider, this.rpcProvider, usdcAmount, chainId, this._slippage);