@paybox-sh/sdk 2.1.0 → 2.2.0

package/dist/{chunk-OZ7KVOBT.js → chunk-DWDC6W5P.js}

@@ -479,8 +479,8 @@ function buildSwapEnvelopes(txs, binding, creds) {
     );
   }
   return txs.map((t) => {
-    const payload = t.vm === "solana" ? solanaSigningPayload(t.transaction) : eip1559SigningHash(t.transaction);
-    const { signed_body, agent_signature } = buildEnvelope(payload, binding, creds);
+    const payload2 = t.vm === "solana" ? solanaSigningPayload(t.transaction) : eip1559SigningHash(t.transaction);
+    const { signed_body, agent_signature } = buildEnvelope(payload2, binding, creds);
     return { api_pub: creds.apiPubHex, signed_body, agent_signature };
   });
 }
@@ -638,42 +638,43 @@ function credsFromToken(token) {
 function toBinding(b) {
   return { walletId: b.wallet_id, keyId: b.key_id ?? "", derivationPath: b.derivation_path ?? "" };
 }
-async function resolveBinding(post, requestId, creds) {
+async function resolveBinding(post, requestId2, creds) {
   const env = buildIssuedAtEnvelope(creds);
-  const r = await post(`/agent/requests/${requestId}/binding`, {
+  const r = await post(`/agent/requests/${requestId2}/binding`, {
     api_pub: creds.apiPubHex,
     signed_body: env.signed_body,
     agent_signature: env.agent_signature
   });
   return toBinding(r);
 }
-async function signWalletRequest(post, requestId, intent, creds, binding) {
-  const resolved = binding && binding.key_id && binding.derivation_path ? toBinding(binding) : await resolveBinding(post, requestId, creds);
-  const transport = (envelope) => post(`/agent/requests/${requestId}/moonx-sign`, {
+async function signWalletRequest(post, requestId2, intent, creds, binding) {
+  const resolved = binding && binding.key_id && binding.derivation_path ? toBinding(binding) : await resolveBinding(post, requestId2, creds);
+  const transport = (envelope) => post(`/agent/requests/${requestId2}/moonx-sign`, {
     api_pub: creds.apiPubHex,
     ...envelope
   });
   const result = await signIntent(intent, creds, resolved, transport);
   if (!result.ok) throw new Error(result.error);
-  await post(`/agent/requests/${requestId}/signature`, { artifact: result.artifact });
+  await post(`/agent/requests/${requestId2}/signature`, { artifact: result.artifact });
   return result.artifact;
 }
-function isSolanaRefreshablePlan(plan) {
+function isRefreshablePlan(plan) {
+  if (typeof plan.refresh_before_sign === "boolean") return plan.refresh_before_sign;
   const txs = plan.txs;
   const solana = txs.some((t) => t.vm === "solana");
   return solana && txs.some(
-    (t) => t.kind === "swap" || t.kind === "prediction_trade" || t.kind === "jupiter_swap"
+    (t) => t.kind === "swap" || t.kind === "prediction_trade"
   );
 }
-async function refreshPlan(post, requestId) {
-  const r = await post(`/agent/requests/${requestId}/refresh`, {});
+async function refreshPlan(post, requestId2) {
+  const r = await post(`/agent/requests/${requestId2}/refresh`, {});
   if (!r || typeof r.plan !== "object" || r.plan === null) {
     throw new Error("refresh returned no plan");
   }
   return r.plan;
 }
-async function refreshSwapPlan(post, requestId) {
-  const refreshed = await refreshPlan(post, requestId);
+async function refreshSwapPlan(post, requestId2) {
+  const refreshed = await refreshPlan(post, requestId2);
   if (!Array.isArray(refreshed.txs) || refreshed.txs.length === 0) {
     throw new Error("swap refresh returned a plan with no txs");
   }
@@ -682,42 +683,43 @@ async function refreshSwapPlan(post, requestId) {
 function isSolanaRailX402(plan) {
   return plan.x402?.rail === "solana";
 }
-async function refreshX402SolanaTx(post, requestId) {
-  const refreshed = await refreshPlan(post, requestId);
+async function refreshX402SolanaTx(post, requestId2) {
+  const refreshed = await refreshPlan(post, requestId2);
   const tx = refreshed.solana?.transaction;
   if (typeof tx !== "string" || tx.length === 0) {
     throw new Error("x402 refresh returned a plan with no Solana transaction");
   }
   return tx;
 }
-async function signSwapRequest(post, requestId, plan, creds) {
-  const signPlan = isSolanaRefreshablePlan(plan) ? await refreshSwapPlan(post, requestId) : plan;
+async function signSwapRequest(post, requestId2, plan, creds, validate) {
+  const signPlan = isRefreshablePlan(plan) ? await refreshSwapPlan(post, requestId2) : plan;
+  validate?.(signPlan);
   let binding = {
     walletId: signPlan.binding.wallet_id,
     keyId: signPlan.binding.key_id ?? "",
     derivationPath: signPlan.binding.derivation_path ?? ""
   };
   if (binding.walletId && (!binding.keyId || !binding.derivationPath)) {
-    binding = await resolveBinding(post, requestId, creds);
+    binding = await resolveBinding(post, requestId2, creds);
   }
   const envelopes = buildSwapEnvelopes(signPlan.txs, binding, creds);
-  await post(`/agent/requests/${requestId}/envelopes`, { envelopes });
+  await post(`/agent/requests/${requestId2}/envelopes`, { envelopes });
 }
-async function signX402Request(post, requestId, plan, creds) {
+async function signX402Request(post, requestId2, plan, creds) {
   let binding = {
     walletId: plan.binding.wallet_id,
     keyId: plan.binding.key_id ?? "",
     derivationPath: plan.binding.derivation_path ?? ""
   };
   if (binding.walletId && (!binding.keyId || !binding.derivationPath)) {
-    binding = await resolveBinding(post, requestId, creds);
+    binding = await resolveBinding(post, requestId2, creds);
   }
-  const envelope = isSolanaRailX402(plan) ? buildX402SolanaEnvelope(await refreshX402SolanaTx(post, requestId), binding, creds) : buildX402Envelope(
+  const envelope = isSolanaRailX402(plan) ? buildX402SolanaEnvelope(await refreshX402SolanaTx(post, requestId2), binding, creds) : buildX402Envelope(
     plan.typed_data,
     binding,
     creds
   );
-  await post(`/agent/requests/${requestId}/envelopes`, { envelopes: [envelope] });
+  await post(`/agent/requests/${requestId2}/envelopes`, { envelopes: [envelope] });
 }
 
 // src/mcp.ts
@@ -769,7 +771,7 @@ var McpTransport = class {
       throw error;
     }
   }
-  async post(payload, method, signingSurface) {
+  async post(payload2, method, signingSurface) {
     const response = await this.fetchImpl(this.endpoint, {
       method: "POST",
       headers: {
@@ -779,7 +781,7 @@ var McpTransport = class {
         "mcp-protocol-version": PROTOCOL_VERSION,
         ...signingSurface ? { "x-paybox-signing-surface": signingSurface } : {}
       },
-      body: JSON.stringify(payload)
+      body: JSON.stringify(payload2)
     });
     const text = await response.text();
     if (!response.ok) {
@@ -816,6 +818,220 @@ var McpTransport = class {
   }
 };
 
+// src/execution.ts
+import { setTimeout as delay } from "node:timers/promises";
+
+// src/plugins/signing.ts
+function supportedSigningAction(value) {
+  if (value.operation != null) {
+    const operation = value.operation;
+    const intent = operation.intent;
+    if (operation.type !== "wallet_sign" || value.next_action?.kind !== "sign" || !intent || !["transaction", "solanaTransaction"].includes(intent.op)) return null;
+    try {
+      if (intent.op === "transaction") eip1559SigningHash(intent.transaction);
+      else if (intent.op === "solanaTransaction" && typeof intent.address === "string" && intent.address) deserializeSolanaTx(intent.transactionBase64);
+      else return null;
+    } catch {
+      return null;
+    }
+    const binding = operation.wallet_id == null ? null : {
+      wallet_id: operation.wallet_id,
+      key_id: operation.key_id ?? null,
+      derivation_path: operation.derivation_path ?? null
+    };
+    if (binding && (typeof binding.wallet_id !== "string" || binding.key_id !== null && typeof binding.key_id !== "string" || binding.derivation_path !== null && typeof binding.derivation_path !== "string")) return null;
+    return { type: "wallet_sign", intent, binding };
+  }
+  const plan = supportedSigningPlan(value.plan);
+  return plan ? { type: "transactions", plan } : null;
+}
+function supportedSigningPlan(value) {
+  if (!value || typeof value !== "object") return null;
+  const plan = value;
+  if (plan.version !== void 0 || plan.schema_version !== void 0 || plan.gasless != null || typeof plan.refresh_before_sign !== "boolean") return null;
+  const binding = plan.binding;
+  if (!binding || typeof binding.wallet_id !== "string" || !binding.wallet_id || binding.key_id != null && typeof binding.key_id !== "string" || binding.derivation_path != null && typeof binding.derivation_path !== "string" || typeof plan.sender !== "string" || !plan.sender || !Array.isArray(plan.txs) || plan.txs.length === 0) return null;
+  try {
+    for (const tx of plan.txs) {
+      if (!tx || tx.vm !== plan.txs[0].vm) return null;
+      if (tx.vm === "solana" && typeof tx.transaction === "string") deserializeSolanaTx(tx.transaction);
+      else if (tx.vm === "evm" && tx.transaction && typeof tx.transaction === "object" && !Array.isArray(tx.transaction)) eip1559SigningHash(tx.transaction);
+      else return null;
+    }
+  } catch {
+    return null;
+  }
+  return value;
+}
+
+// src/execution.ts
+var UnsupportedPlanError = class extends Error {
+};
+var invocationIdMeta = "com.moonpay.paybox/invocationId";
+var requestIdMeta = "com.moonpay.paybox/requestId";
+function requestId(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value) ? value.toLowerCase() : null;
+}
+function payload(result) {
+  const value = result.structuredContent ?? toolJson("plugin execution", { ...result, isError: false });
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid response");
+  return value;
+}
+var statuses = /* @__PURE__ */ new Set([
+  "pending_approval",
+  "pending_funding",
+  "pending_signature",
+  "pending_settlement",
+  "pending_confirmation",
+  "success",
+  "denied",
+  "error"
+]);
+async function executePlugin(start, options, connect) {
+  const timeoutMs = options.timeoutMs ?? 3e5;
+  const intervalMs = options.intervalMs ?? 2e3;
+  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647 || !Number.isInteger(intervalMs) || intervalMs <= 0 || intervalMs > 3e4) {
+    throw new RangeError("timeoutMs must be 1..2147483647 and intervalMs must be 1..30000");
+  }
+  let id = typeof start === "string" ? requestId(start) : null;
+  if (typeof start === "string" && !id) throw new TypeError("requestId must be a UUID");
+  let response = null;
+  const result = (outcome, reason) => ({
+    outcome,
+    requestId: id,
+    response,
+    ...reason ? { reason } : {}
+  });
+  const controller = new AbortController();
+  let stopped = "cancelled";
+  const cancel = () => controller.abort();
+  options.signal?.addEventListener("abort", cancel, { once: true });
+  if (options.signal?.aborted) cancel();
+  const timer = setTimeout(() => {
+    if (!controller.signal.aborted) {
+      stopped = "deadline_exceeded";
+      controller.abort();
+    }
+  }, timeoutMs);
+  let onAbort;
+  const aborted = new Promise((resolve) => {
+    onAbort = () => resolve(result(stopped));
+    if (controller.signal.aborted) onAbort();
+    else controller.signal.addEventListener("abort", onAbort, { once: true });
+  });
+  const ports = connect(controller.signal);
+  const read = async () => {
+    controller.signal.throwIfAborted();
+    const next = await ports.getRequest(id);
+    controller.signal.throwIfAborted();
+    if (!next || requestId(next.request_id) !== id || !statuses.has(next.status)) {
+      throw new Error("invalid request response");
+    }
+    response = pendingFundingResponse(next) ?? next;
+    return response;
+  };
+  const terminal = (current) => {
+    if (current.status === "error" || current.status === "denied") return result("terminal");
+    if (current.status !== "success") return null;
+    const value = current.output?.value;
+    const fields = current.output?.output_type === "tx_hash" ? ["tx_hash"] : current.output?.output_type === "signature" ? ["signature", "serializedTransaction", "signedTransactionBase64"] : [];
+    return fields.some((field) => typeof value?.[field] === "string" && value[field].trim()) ? result("terminal") : result("unsupported", "success_output_not_supported");
+  };
+  const drive = async () => {
+    try {
+      controller.signal.throwIfAborted();
+      let toolError = false;
+      if (typeof start !== "string") {
+        const raw = await ports.callTool("use_plugin", {
+          plugin_id: start.pluginId,
+          tool_id: start.toolId,
+          input: start.input,
+          invocation_id: start.invocationId
+        });
+        controller.signal.throwIfAborted();
+        const funding = pendingFundingToolResponse(raw);
+        if (funding) {
+          response = funding;
+          id = requestId(funding.request_id);
+          return result("unsupported", "funding_required");
+        }
+        let data;
+        try {
+          data = payload(raw);
+        } catch {
+          return result("reconcile_required", raw.isError ? "tool_error" : "invalid_plugin_result");
+        }
+        toolError = raw.isError === true || data.status === "error";
+        const nextId = requestId(data.request_id);
+        if (!nextId) return result(toolError ? "reconcile_required" : "unsupported", toolError ? "tool_error" : "no_request_id");
+        if (requestId(start.pluginId)) {
+          const invocationId = requestId(raw._meta?.[invocationIdMeta]);
+          const expectedInvocationId = requestId(start.invocationId);
+          const boundRequestId = requestId(raw._meta?.[requestIdMeta]);
+          if (!invocationId || start.invocationId !== void 0 && invocationId !== expectedInvocationId || boundRequestId !== nextId) {
+            return result("reconcile_required", "request_id_mismatch");
+          }
+        }
+        id = nextId;
+      }
+      let current = await read();
+      let attempted = false;
+      let pauseMs = intervalMs;
+      for (; ; ) {
+        controller.signal.throwIfAborted();
+        const done = terminal(current);
+        if (done) return done;
+        if (current.status === "pending_funding") return result("unsupported", "funding_required");
+        if (toolError) return result("reconcile_required", "tool_error");
+        if (current.status === "pending_approval" && !options.waitForApproval) {
+          return result("approval_required");
+        }
+        if (current.status === "pending_signature") {
+          if (attempted) return result("reconcile_required", "submission_not_confirmed");
+          if (options.autoSign === false || !ports.sign) return result("signing_required");
+          try {
+            const raw = await ports.callTool("reopen_signing_window", { request_id: id });
+            if (raw.isError) throw new Error("reopen failed");
+            const reopened = payload(raw);
+            if (requestId(reopened.request_id) !== id) return result("unsupported", "request_id_mismatch");
+            current = await read();
+            if (current.status !== "pending_signature") continue;
+            if (reopened.status !== "pending_signature") return result("reconcile_required", "request_changed");
+            const action = supportedSigningAction(reopened);
+            if (!action) return result("unsupported", "signing_plan_not_supported");
+            attempted = true;
+            await ports.sign(id, action, (refreshed) => {
+              controller.signal.throwIfAborted();
+              if (!supportedSigningPlan(refreshed)) throw new UnsupportedPlanError();
+            });
+          } catch (error) {
+            current = await read();
+            const done2 = terminal(current);
+            if (done2) return done2;
+            if (error instanceof UnsupportedPlanError) return result("unsupported", "refreshed_plan_not_supported");
+            if (current.status === "pending_signature") return result("reconcile_required", "signing_interrupted");
+          }
+          current = await read();
+          continue;
+        }
+        await delay(pauseMs, void 0, { signal: controller.signal });
+        const previous = current.status;
+        current = await read();
+        pauseMs = current.status === previous ? Math.min(pauseMs * 2, 3e4) : intervalMs;
+      }
+    } catch {
+      return result(controller.signal.aborted ? stopped : "reconcile_required", "execution_interrupted");
+    }
+  };
+  try {
+    return await Promise.race([drive(), aborted]);
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", cancel);
+    controller.signal.removeEventListener("abort", onAbort);
+  }
+}
+
 // src/client.ts
 var DEFAULT_BASE_URL = "https://api.paybox.sh";
 var EXPIRY_SKEW_MS = 6e4;
@@ -907,6 +1123,7 @@ var PayboxClient = class _PayboxClient {
     );
   }
   async request(method, path, init = {}) {
+    init.signal?.throwIfAborted();
     const url = new URL(this.baseUrl + path);
     for (const [k, v] of Object.entries(init.query ?? {})) {
       if (v != null) url.searchParams.set(k, v);
@@ -917,8 +1134,10 @@ var PayboxClient = class _PayboxClient {
       headers["content-type"] = "application/json";
       body = JSON.stringify(init.body);
     }
-    const res = await this.fetchImpl(url, { method, headers, body });
+    init.signal?.throwIfAborted();
+    const res = await this.fetchImpl(url, { method, headers, body, signal: init.signal });
     const text = await res.text();
+    init.signal?.throwIfAborted();
     if (!res.ok) throw new PayboxError(res.status, text, `${method} ${path}`);
     return nonSigningFundingResult(text ? JSON.parse(text) : void 0);
   }
@@ -991,21 +1210,21 @@ var PayboxClient = class _PayboxClient {
       (r) => r
     );
   }
-  async completeWalletSignRequest(requestId) {
+  async completeWalletSignRequest(requestId2) {
     const creds = this.signingCreds();
     if (!creds) {
       throw new Error("cannot complete wallet-sign request without a valid local signing key");
     }
     const result = await this.mcp.callTool(
       "reopen_signing_window",
-      { request_id: requestId },
+      { request_id: requestId2 },
       "in-process"
     );
     const parked = toolJson("reopen_signing_window", result);
-    if (parked.request_id !== requestId) {
+    if (parked.request_id !== requestId2) {
       throw new Error("paybox returned a different request_id for the parked signature");
     }
-    if (parked.status === "success") return this.getRequest(requestId);
+    if (parked.status === "success") return this.getRequest(requestId2);
     if (parked.status !== "pending_signature") {
       throw new Error(`cannot complete wallet-sign request while it is ${parked.status ?? "unknown"}`);
     }
@@ -1019,10 +1238,10 @@ var PayboxClient = class _PayboxClient {
       derivation_path: parked.operation.derivation_path ?? null
     };
     await this.signWithReconcile(
-      requestId,
-      () => signWalletRequest(this.poster, requestId, intent, creds, binding)
+      requestId2,
+      () => signWalletRequest(this.poster, requestId2, intent, creds, binding)
     );
-    return this.getRequest(requestId);
+    return this.getRequest(requestId2);
   }
   async requestSwap(args, opts = {}) {
     return this.withExpiryRetry(
@@ -1071,12 +1290,12 @@ var PayboxClient = class _PayboxClient {
       await this.requestAfterSign(response.request_id, opts.waitForApproval)
     );
   }
-  async waitWhileApproval(requestId, wait) {
+  async waitWhileApproval(requestId2, wait) {
     const o = typeof wait === "object" ? wait : {};
     const interval = o.intervalMs ?? 2e3;
     const deadline = Date.now() + (o.timeoutMs ?? 3e5);
     for (; ; ) {
-      const r = await this.getRequest(requestId);
+      const r = await this.getRequest(requestId2);
       if (r.status !== "pending_approval" || Date.now() > deadline) return r;
       await new Promise((res) => setTimeout(res, interval));
     }
@@ -1089,11 +1308,11 @@ var PayboxClient = class _PayboxClient {
     }
     return first;
   }
-  async signWithReconcile(requestId, sign) {
+  async signWithReconcile(requestId2, sign) {
     try {
       await sign();
     } catch {
-      const reconciled = await this.getRequest(requestId);
+      const reconciled = await this.getRequest(requestId2);
       if (reconciled.status !== "pending_signature") return;
       await sign();
     }
@@ -1145,6 +1364,34 @@ var PayboxClient = class _PayboxClient {
       invocation_id: args.invocationId
     }));
   }
+  runPlugin(args, options = {}) {
+    return this.executePlugin(args, options);
+  }
+  resumeRequest(requestId2, options = {}) {
+    return this.executePlugin(requestId2, options);
+  }
+  executePlugin(start, options) {
+    return executePlugin(start, options, (signal) => {
+      const mcp = new McpTransport({
+        baseUrl: this.baseUrl,
+        bearer: () => this.bearer(),
+        fetchImpl: (input, init) => {
+          signal.throwIfAborted();
+          return this.fetchImpl(input, { ...init, signal });
+        }
+      });
+      const post = (path, body) => this.request("POST", path, { body, signal });
+      const creds = this.signingCreds();
+      return {
+        callTool: (name, args) => mcp.callTool(name, args, name === "reopen_signing_window" ? "in-process" : void 0),
+        getRequest: (id) => this.request("GET", `/agent/requests/${id}`, { signal }),
+        sign: creds ? async (id, action, validate) => {
+          if (action.type === "transactions") await signSwapRequest(post, id, action.plan, creds, validate);
+          else await signWalletRequest(post, id, action.intent, creds, action.binding);
+        } : void 0
+      };
+    });
+  }
   async payX402(args, opts = {}) {
     return this.withExpiryRetry(
       async () => {
@@ -1199,8 +1446,8 @@ var PayboxClient = class _PayboxClient {
       await this.requestAfterSign(response.request_id, opts.waitForApproval)
     );
   }
-  claimPaymentCredentials(requestId) {
-    return this.request("POST", `/agent/requests/${requestId}/credentials`);
+  claimPaymentCredentials(requestId2) {
+    return this.request("POST", `/agent/requests/${requestId2}/credentials`);
   }
   requestAccountChange(note) {
     return this.request("POST", "/agent/account-change", { body: { note } });
@@ -1223,18 +1470,18 @@ var PayboxClient = class _PayboxClient {
       }
     });
   }
-  getRequest(requestId) {
-    return this.request("GET", `/agent/requests/${requestId}`);
+  getRequest(requestId2) {
+    return this.request("GET", `/agent/requests/${requestId2}`);
   }
-  requestAfterSign(requestId, wait) {
-    if (!wait) return this.getRequest(requestId);
-    return this.waitForRequest(requestId, typeof wait === "object" ? wait : {});
+  requestAfterSign(requestId2, wait) {
+    if (!wait) return this.getRequest(requestId2);
+    return this.waitForRequest(requestId2, typeof wait === "object" ? wait : {});
   }
-  async waitForRequest(requestId, opts = {}) {
+  async waitForRequest(requestId2, opts = {}) {
     const interval = opts.intervalMs ?? 2e3;
     const deadline = Date.now() + (opts.timeoutMs ?? 3e5);
     for (; ; ) {
-      const r = await this.getRequest(requestId);
+      const r = await this.getRequest(requestId2);
       const pending = r.status === "pending_approval" || r.status === "pending_funding" || r.status === "pending_signature" || r.status === "pending_settlement" || r.status === "pending_confirmation";
       if (!pending || Date.now() > deadline) return r;
       await new Promise((res) => setTimeout(res, interval));
@@ -1262,4 +1509,4 @@ export {
   PayboxError,
   PayboxClient
 };
-//# sourceMappingURL=chunk-OZ7KVOBT.js.map
+//# sourceMappingURL=chunk-DWDC6W5P.js.map