@t2000/cli 10.12.0 → 10.13.1

package/dist/index.js

@@ -8,6 +8,7 @@ import {
   MAX_JOB_USDC,
   MIN_LP_USDC,
   T2000,
+  assertBuyerRequirements,
   buildPublishAgentCoinTx,
   buildTokenizeTx,
   clearLimits,
@@ -33,7 +34,7 @@ import {
   verifyJobForSeller,
   verifyReceipt,
   walletExists
-} from "./chunk-322SPE2Y.js";
+} from "./chunk-I6UGZOTH.js";
 import "./chunk-634W6JCI.js";
 import "./chunk-3ZUWXUSN.js";
 import "./chunk-QSITA6GU.js";
@@ -22286,7 +22287,7 @@ async function runEstimate(url, opts) {
   let req = accepts.find((a) => a.scheme === "exact" && a.network?.startsWith("sui:")) ?? accepts[0];
   let dialect = "x402";
   if (!req) {
-    const { parseMppSuiChallenge } = await import("./dist-6X5CQWZV.js");
+    const { parseMppSuiChallenge } = await import("./dist-G2XQHKA6.js");
     const challenge = await parseMppSuiChallenge(response);
     if (!challenge) {
       throw new Error(
@@ -23390,7 +23391,7 @@ function registerMcpStart(parent) {
   parent.command("start", { isDefault: true }).description("Start MCP server (stdio transport \u2014 for AI client integration)").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").action(async (opts) => {
     let mod;
     try {
-      mod = await import("./dist-MUMCWXCF.js");
+      mod = await import("./dist-GIJDTUKJ.js");
     } catch {
       console.error("MCP server not installed. Run:\n  npm install -g @t2000/mcp");
       process.exit(1);
@@ -24833,15 +24834,33 @@ function parseDuration(input) {
   if (ms <= 0) throw new Error(`Duration must be positive (got "${input}").`);
   return Math.round(ms);
 }
-async function resolveCommitment(input) {
-  if (/^0x[0-9a-fA-F]+$/.test(input) && input.length % 2 === 0) return input;
+var SHA256_HEX_RE = /^0x[0-9a-fA-F]{64}$/;
+var SPEC_STORE_MAX_BYTES = 16 * 1024;
+async function resolveSpecUpload(base, input) {
+  const trimmed = input.trim();
+  if (SHA256_HEX_RE.test(trimmed)) {
+    return { hash: trimmed.toLowerCase(), uploaded: false };
+  }
   let bytes;
   try {
     bytes = await readFile3(input);
   } catch {
     bytes = Buffer.from(input, "utf8");
   }
-  return `0x${createHash("sha256").update(bytes).digest("hex")}`;
+  if (bytes.length > SPEC_STORE_MAX_BYTES) {
+    throw new Error(
+      `Content is ${bytes.length} bytes \u2014 the job-spec store caps at 16 KiB. Upload a short note that LINKS the artifact (URL / IPFS), or pin a precomputed commitment with --hash-only 0x<sha256>.`
+    );
+  }
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new Error(
+      "Content is not UTF-8 text \u2014 the job-spec store holds text only. Upload a short note that LINKS the artifact, or pin a precomputed commitment with --hash-only 0x<sha256>."
+    );
+  }
+  return { hash: `0x${await putJobSpec(base, text)}`, uploaded: true };
 }
 function stateColor(state) {
   if (state === "released") return import_picocolors15.default.green(state);
@@ -24915,7 +24934,7 @@ deadline). v1 caps jobs at ${MAX_JOB_USDC} USDC.
 Typical flow:
   buyer   $ t2 job create 5 0xSELLER --spec brief.md --deadline 24h
   seller  $ t2 job verify 0xJOB --price 5
-  seller  $ t2 job deliver 0xJOB report.pdf
+  seller  $ t2 job deliver 0xJOB report.md
   buyer   $ t2 job release 0xJOB          (or: t2 job reject 0xJOB)
   either  $ t2 job watch 0xJOB
   seller  $ t2 job watch --mine           (the provider inbox \u2014 all your jobs)
@@ -24927,7 +24946,7 @@ Buying a SERVICE (t2 ACP) \u2014 price + terms come from the listing:
   seller  $ t2 job spec 0xJOB              (read the buyer's requirements)
 `
   );
-  group.command("create").argument("[amount]", `USDC to escrow (max ${MAX_JOB_USDC}; omit when buying a --service)`).argument("[seller]", "The seller's Sui address (omit when buying a --service)").description("Create + fund an escrow job in one transaction (buyer)").option("--spec <file-or-text>", "Job spec \u2014 a file path or inline text (hashed on-chain), or a 0x\u2026 hash").option("--agent <address>", "Buy a service: the seller's agent address").option("--service <slug>", "The service slug (see t2 browse / t2 service list <agent>)").option("--requirements <file-or-json-or-text>", "Your requirements for the service (what the seller asked for)").option("--deadline <duration>", "Time the seller has to deliver (e.g. 30m, 24h, 7d)", "24h").option("--review <duration>", "Your accept/reject window after delivery", "24h").option("--split <bps>", "Your share in bps if you reject (0\u201310000)", String(DEFAULT_REJECT_SPLIT_BPS)).option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--api <url>", `API base URL (default ${DEFAULT_API_BASE5})`).action(
+  group.command("create").argument("[amount]", `USDC to escrow (max ${MAX_JOB_USDC}; omit when buying a --service)`).argument("[seller]", "The seller's Sui address (omit when buying a --service)").description("Create + fund an escrow job in one transaction (buyer)").option("--spec <file-or-text>", "Job spec \u2014 a file path or inline text (UPLOADED so the seller can read it; sha256 pinned on-chain), or a bare 0x\u2026 sha256 (confidential: pins without uploading)").option("--agent <address>", "Buy a service: the seller's agent address").option("--service <slug>", "The service slug (see t2 browse / t2 service list <agent>)").option("--requirements <file-or-json-or-text>", "What the seller asked buyers to provide \u2014 if the listing lists JSON keys, fill EVERY key (JSON object; extra keys OK)").option("--deadline <duration>", "Time the seller has to deliver (e.g. 30m, 24h, 7d)", "24h").option("--review <duration>", "Your accept/reject window after delivery", "24h").option("--split <bps>", "Your share in bps if you reject (0\u201310000)", String(DEFAULT_REJECT_SPLIT_BPS)).option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--api <url>", `API base URL (default ${DEFAULT_API_BASE5})`).action(
     async (amountArg, sellerArg, opts) => {
       try {
         const base = opts.api ?? DEFAULT_API_BASE5;
@@ -24964,17 +24983,7 @@ Buying a SERVICE (t2 ACP) \u2014 price + terms come from the listing:
               requirements = text.trim();
             }
           }
-          if (service.requirements != null && requirements == null) {
-            const want = typeof service.requirements === "string" ? service.requirements : `JSON matching: ${JSON.stringify(service.requirements)}`;
-            throw new Error(
-              `This service needs --requirements. The seller asks for: ${want}`
-            );
-          }
-          if (service.requirements != null && typeof service.requirements === "object" && (typeof requirements !== "object" || requirements === null)) {
-            throw new Error(
-              `This service expects JSON requirements matching: ${JSON.stringify(service.requirements)}`
-            );
-          }
+          assertBuyerRequirements(service.requirements, requirements);
           const buyer = (await withAgent({ keyPath: opts.key })).address();
           const spec = JSON.stringify({
             type: "t2-acp-job-spec@1",
@@ -25009,7 +25018,7 @@ Buying a SERVICE (t2 ACP) \u2014 price + terms come from the listing:
             throw new Error(`Amount must be a positive number (got "${amountArg}").`);
           }
           seller = validateAddress(sellerArg);
-          specHash = await resolveCommitment(opts.spec);
+          ({ hash: specHash } = await resolveSpecUpload(base, opts.spec));
           deliverByMs = Date.now() + parseDuration(opts.deadline);
           reviewWindowMs = opts.review ? parseDuration(opts.review) : DEFAULT_REVIEW_WINDOW_MS;
           rejectSplitBps = Number.parseInt(opts.split, 10);
@@ -25085,23 +25094,39 @@ Buying a SERVICE (t2 ACP) \u2014 price + terms come from the listing:
       handleError(error);
     }
   });
-  group.command("deliver").argument("<jobId>", "The Job object id (0x\u2026)").argument("<proof>", "Delivery artifact \u2014 a file path or text (hashed on-chain), or a 0x\u2026 hash").description("Post your proof-of-delivery before the deadline (seller)").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--api <url>", `API base URL (default ${DEFAULT_API_BASE5})`).action(async (jobId, proof, opts) => {
+  group.command("deliver").argument("<jobId>", "The Job object id (0x\u2026)").argument("<proof>", "Delivery body \u2014 a file path or text (UPLOADED so the buyer can read it; sha256 pinned on-chain), or a bare 0x\u2026 sha256").description("Post your delivery before the deadline (seller) \u2014 the body uploads to the job-spec store so the buyer can read it, and its sha256 pins on-chain").option("--hash-only", "Pin <proof> as a precomputed 0x\u2026 sha256 WITHOUT uploading a body \u2014 the confidential / large-artifact path (the buyer can't read it on-platform; hand the artifact over out-of-band)").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--api <url>", `API base URL (default ${DEFAULT_API_BASE5})`).action(async (jobId, proof, opts) => {
     try {
-      const deliveryHash = await resolveCommitment(proof);
+      const base = opts.api ?? DEFAULT_API_BASE5;
+      let deliveryHash;
+      let uploaded = false;
+      if (opts.hashOnly) {
+        const hash = proof.trim().toLowerCase();
+        if (!SHA256_HEX_RE.test(hash)) {
+          throw new Error("--hash-only expects a 0x\u2026 64-char sha256 (e.g. from `shasum -a 256`).");
+        }
+        deliveryHash = hash;
+      } else {
+        ({ hash: deliveryHash, uploaded } = await resolveSpecUpload(base, proof));
+      }
       const { digest } = await sponsoredJobVerb({
-        base: opts.api ?? DEFAULT_API_BASE5,
+        base,
         keyPath: opts.key,
         action: "deliver",
         params: { jobId, deliveryHash }
       });
       if (isJsonMode()) {
-        printJson({ jobId, deliveryHash, digest });
+        printJson({ jobId, deliveryHash, uploaded, digest });
         return;
       }
       printBlank();
       printSuccess("Delivery posted \u2014 the buyer's review window is now open.");
       printKeyValue("Delivery hash", deliveryHash);
       if (digest) printKeyValue("Tx", digest);
+      if (uploaded) {
+        printInfo("Body uploaded \u2014 the buyer reads it content-addressed (tamper-evident against the on-chain hash).");
+      } else {
+        printInfo("Hash-only commitment \u2014 the buyer cannot read the body on-platform; hand the artifact over out-of-band.");
+      }
       printInfo("If the buyer neither accepts nor rejects before the window closes, anyone (including you) can run `t2 job release` to settle.");
       printBlank();
     } catch (error) {
@@ -25396,7 +25421,7 @@ Examples:
   );
   group.command("create").description("List a service under your Agent ID (re-run to update it)").requiredOption("--name <name>", "Service name (max 80 chars)").requiredOption("--price <usdc>", "Fixed price in USDC (0.01\u201350)").requiredOption("--sla <duration>", "Delivery SLA \u2014 e.g. 30m, 24h, 7d").requiredOption("--description <text>", "What this service is (max 2000 chars)").requiredOption("--deliverable <text>", "What the buyer receives (max 1000 chars)").option("--slug <slug>", "Machine name (default: derived from --name)").option(
     "--requirements <file-or-json-or-text>",
-    "What the buyer must provide \u2014 free text or a JSON schema (file path ok)"
+    "What the buyer must provide \u2014 prefer a JSON object of required fields (keys enforced non-empty at hire); free text ok (file path ok)"
   ).option("--review <duration>", "Buyer's accept/reject window after delivery", "24h").option("--split <bps>", "Buyer's share in bps if they reject (0\u201310000)", "8000").option(
     "--category <category>",
     `Directory category for your listing: ${AGENT_CATEGORIES.join(" | ")} (required unless already set on your profile)`