primcli 1.6.0 → 1.6.1

package/dist/oclif/index.js

@@ -7,7 +7,7 @@ import process$1 from "node:process";
 import { createInterface } from "node:readline/promises";
 import { hostname } from "node:os";
 import { spawn } from "node:child_process";
-import { X402Error, createX402Client } from "@primitivedotdev/sdk/x402";
+import { concat, hexToBytes, keccak256, stringToBytes } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -24411,6 +24411,352 @@ var OrgSecretsSetCommand = class OrgSecretsSetCommand extends Command {
 	}
 };
 //#endregion
+//#region ../sdk-node/dist/x402/index.js
+/**
+* x402 client-side signing.
+*
+* The payer signs an EIP-3009 `transferWithAuthorization` over the customer's
+* own key; the key never leaves them. This module derives the interaction-bound
+* nonce and assembles the EIP-712 typed data and the wire payload. The byte
+* layout here MUST match the platform verifier exactly; a normative test vector
+* (see sign.test.ts) locks the nonce derivation to the same value the server
+* recomputes.
+*/
+/** A challenge nonce is 32 bytes rendered as 64 lowercase hex chars, no 0x. */
+const CHALLENGE_NONCE_RE = /^[0-9a-f]{64}$/;
+/** Single-byte domain separator between the variable-length string fields. */
+const FIELD_SEPARATOR = new Uint8Array([0]);
+/**
+* Derive the EIP-3009 nonce bound to a specific interaction step:
+*
+*   keccak256( utf8(lower(interaction_id)) || 0x00
+*            || utf8(lower(challenge_step_id)) || 0x00
+*            || hexdecode(challenge_nonce) )
+*
+* The `0x00` separators pin the field boundaries (undelimited concatenation of
+* variable-length strings is collision-ambiguous), and the challenge nonce is
+* decoded to its 32 raw bytes before hashing. The platform recomputes this and
+* rejects a mismatch.
+*/
+function deriveEip3009Nonce(input) {
+	if (!CHALLENGE_NONCE_RE.test(input.challengeNonce)) throw new Error("challengeNonce must be exactly 64 lowercase hex chars (32 bytes), no 0x prefix");
+	return keccak256(concat([
+		stringToBytes(input.interactionId.toLowerCase()),
+		FIELD_SEPARATOR,
+		stringToBytes(input.challengeStepId.toLowerCase()),
+		FIELD_SEPARATOR,
+		hexToBytes(`0x${input.challengeNonce}`)
+	]));
+}
+/**
+* The EIP-3009 `TransferWithAuthorization` EIP-712 type. The field order and
+* types are part of the on-chain contract and MUST NOT change.
+*/
+const TRANSFER_WITH_AUTHORIZATION_TYPES = { TransferWithAuthorization: [
+	{
+		name: "from",
+		type: "address"
+	},
+	{
+		name: "to",
+		type: "address"
+	},
+	{
+		name: "value",
+		type: "uint256"
+	},
+	{
+		name: "validAfter",
+		type: "uint256"
+	},
+	{
+		name: "validBefore",
+		type: "uint256"
+	},
+	{
+		name: "nonce",
+		type: "bytes32"
+	}
+] };
+function transferWithAuthorizationTypedData(domain, auth) {
+	return {
+		domain: {
+			name: domain.name,
+			version: domain.version,
+			chainId: domain.chainId,
+			verifyingContract: domain.verifyingContract
+		},
+		types: TRANSFER_WITH_AUTHORIZATION_TYPES,
+		primaryType: "TransferWithAuthorization",
+		message: auth
+	};
+}
+/**
+* Build the payout-address ownership message. This MUST be byte-identical to the
+* platform's `buildPayoutRegistrationMessage`, or registration fails the
+* ownership proof. The org id is in the signed bytes, so a captured signature
+* can never register the address under a different org.
+*/
+function buildPayoutRegistrationMessage(input) {
+	return [
+		"Primitive x402 payout address authorization",
+		"",
+		"I authorize this address as a payout destination for my Primitive organization.",
+		"",
+		`org: ${input.org}`,
+		`address: ${input.address.toLowerCase()}`,
+		`network: ${input.network}`,
+		`issued: ${input.issuedAt}`
+	].join("\n");
+}
+/** Assemble the wire payload from a signed authorization. */
+function toPaymentPayload(network, auth, signature) {
+	return {
+		x402Version: 1,
+		scheme: "exact",
+		network,
+		payload: {
+			signature,
+			authorization: {
+				from: auth.from,
+				to: auth.to,
+				value: auth.value.toString(),
+				validAfter: auth.validAfter.toString(),
+				validBefore: auth.validBefore.toString(),
+				nonce: auth.nonce
+			}
+		}
+	};
+}
+const CHAIN_IDS = {
+	"base-sepolia": 84532,
+	base: 8453
+};
+const CLOCK_SKEW_SEC = 300;
+const SETTLEMENT_MARGIN_SEC = 300;
+const DEFAULT_BASE_URL = "https://api.primitive.dev";
+const CHARGE_INPUT_KEYS = {
+	amount: true,
+	amountUsdc: true,
+	network: true,
+	payerOrg: true,
+	description: true,
+	resource: true,
+	expiresIn: true,
+	idempotencyKey: true
+};
+function usdcToBaseUnits$1(human) {
+	const trimmed = human.trim();
+	if (!/^\d+(\.\d+)?$/.test(trimmed)) return null;
+	const [whole, frac = ""] = trimmed.split(".");
+	if (frac.length > 6) return null;
+	const base = BigInt(whole) * 1000000n + BigInt(frac.padEnd(6, "0"));
+	return base > 0n ? base.toString() : null;
+}
+var X402Error = class extends Error {
+	/** HTTP status, or 0 for a client-side / transport error that never reached the server. */
+	status;
+	body;
+	/** The `Retry-After` response header, if the server sent one. */
+	retryAfter;
+	constructor(message, status, body, options) {
+		super(message, options?.cause !== void 0 ? { cause: options.cause } : void 0);
+		this.name = "X402Error";
+		this.status = status;
+		this.body = body;
+		this.retryAfter = options?.retryAfter ?? null;
+	}
+};
+/**
+* Assert a challenge is fully hydrated before signing, so a missing field fails
+* with a named X402Error instead of an opaque viem/BigInt error mid-sign.
+*/
+function validateChallenge(c) {
+	const bad = (field) => {
+		throw new X402Error(`challenge is missing or malformed: ${field}`, 0);
+	};
+	if (!c || typeof c !== "object") bad("challenge");
+	if (!c.id) bad("id");
+	if (!c.network) bad("network");
+	if (!c.expires_at) bad("expires_at");
+	const nb = c.nonce_binding;
+	if (!nb?.interaction_id || !nb.challenge_step_id || !nb.challenge_nonce) bad("nonce_binding");
+	const pr = c.payment_requirements;
+	if (!pr) bad("payment_requirements");
+	if (!pr.maxAmountRequired) bad("payment_requirements.maxAmountRequired");
+	if (!/^0x[0-9a-fA-F]{40}$/.test(pr.payTo ?? "")) bad("payment_requirements.payTo (expected a 0x address)");
+	if (!/^0x[0-9a-fA-F]{40}$/.test(pr.asset ?? "")) bad("payment_requirements.asset (expected a 0x address)");
+	if (!pr.extra?.name || !pr.extra.version) bad("payment_requirements.extra (name/version)");
+}
+var X402Client = class {
+	#apiKey;
+	#baseUrl;
+	#fetch;
+	#timeoutMs;
+	constructor(options = {}) {
+		this.#apiKey = options.apiKey ?? process.env.PRIMITIVE_API_KEY ?? "";
+		this.#baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+		this.#fetch = options.fetch ?? fetch;
+		this.#timeoutMs = options.timeoutMs ?? 3e4;
+	}
+	async #request(method, path, body, init) {
+		if (!this.#apiKey) throw new X402Error("no API key configured; set PRIMITIVE_API_KEY or pass { apiKey } to the client", 0);
+		const timeout = AbortSignal.timeout(this.#timeoutMs);
+		const signal = init?.signal ? AbortSignal.any([timeout, init.signal]) : timeout;
+		let res;
+		try {
+			res = await this.#fetch(`${this.#baseUrl}${path}`, {
+				method,
+				headers: {
+					authorization: `Bearer ${this.#apiKey}`,
+					"content-type": "application/json",
+					...init?.headers
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body),
+				signal
+			});
+		} catch (cause) {
+			throw new X402Error(cause instanceof Error && cause.name === "TimeoutError" ? `request to ${path} timed out after ${this.#timeoutMs}ms` : `request to ${path} failed: ${cause instanceof Error ? cause.message : String(cause)}`, 0, void 0, { cause });
+		}
+		const retryAfter = res.headers.get("retry-after");
+		const text = await res.text().catch(() => "");
+		let json;
+		if (text) try {
+			json = JSON.parse(text);
+		} catch {
+			throw new X402Error(`non-JSON response (${res.status}) from ${path}: ${text.slice(0, 200)}`, res.status, text.slice(0, 500), { retryAfter });
+		}
+		if (!res.ok || json?.success === false) throw new X402Error(json?.error?.message ?? `request failed with ${res.status}`, res.status, json ?? text.slice(0, 500), { retryAfter });
+		if (!json || json.success !== true || json.data === void 0) throw new X402Error(`unexpected response shape (${res.status}) from ${path}: missing success/data envelope`, res.status, json ?? text.slice(0, 500), { retryAfter });
+		return json.data;
+	}
+	/** Request a payment (payee side). Returns the challenge to hand to the payer. */
+	async charge(input) {
+		for (const key of Object.keys(input)) if (!(key in CHARGE_INPUT_KEYS)) throw new X402Error(`unknown charge() option "${key}"; expected one of: ${Object.keys(CHARGE_INPUT_KEYS).join(", ")}`, 0);
+		if (input.amount !== void 0 && input.amountUsdc !== void 0) throw new X402Error("charge() takes exactly one of `amount` (base units) or `amountUsdc` (human USDC), not both", 0);
+		const amount = input.amountUsdc !== void 0 ? usdcToBaseUnits$1(input.amountUsdc) : input.amount ?? null;
+		if (!amount || !/^[1-9][0-9]{0,38}$/.test(amount)) throw new X402Error("charge() requires `amount` as a positive integer string in token base units (e.g. \"10000\"), or `amountUsdc` as a positive USDC amount with at most 6 decimals (e.g. \"0.01\")", 0);
+		const body = {
+			amount,
+			network: input.network ?? "base-sepolia"
+		};
+		if (input.payerOrg) body.payer_org = input.payerOrg;
+		if (input.description) body.description = input.description;
+		if (input.resource) body.resource = input.resource;
+		if (input.expiresIn !== void 0) body.expires_in = input.expiresIn;
+		return this.#request("POST", "/v1/x402/challenges", body, { headers: input.idempotencyKey ? { "idempotency-key": input.idempotencyKey } : void 0 });
+	}
+	/**
+	* Pay a challenge (payer side). Derives the interaction-bound authorization,
+	* signs it locally with the caller's key, and submits it for settlement.
+	*/
+	async pay(challenge, options) {
+		if (!options?.signer?.address || typeof options.signer.signTypedData !== "function") throw new X402Error("pay() requires options.signer with { address, signTypedData } (e.g. a viem LocalAccount)", 0);
+		validateChallenge(challenge);
+		const chainId = CHAIN_IDS[challenge.network];
+		if (chainId === void 0) throw new X402Error(`unsupported network: ${challenge.network}`, 0);
+		const pr = challenge.payment_requirements;
+		if (pr.network !== challenge.network) throw new X402Error(`challenge network mismatch: ${challenge.network} vs payment_requirements ${pr.network}`, 0);
+		if (pr.scheme !== "exact") throw new X402Error(`unsupported payment scheme: ${pr.scheme}`, 0);
+		const nonce = deriveEip3009Nonce({
+			interactionId: challenge.nonce_binding.interaction_id,
+			challengeStepId: challenge.nonce_binding.challenge_step_id,
+			challengeNonce: challenge.nonce_binding.challenge_nonce
+		});
+		const nowSec = Math.floor(Date.now() / 1e3);
+		const expiresAtMs = Date.parse(challenge.expires_at);
+		if (Number.isNaN(expiresAtMs)) throw new X402Error(`challenge has an invalid expires_at: ${challenge.expires_at}`, 0);
+		const expiresAtSec = Math.floor(expiresAtMs / 1e3);
+		if (expiresAtSec <= nowSec) throw new X402Error(`challenge has already expired (expires_at ${challenge.expires_at}); not signing`, 0);
+		const validAfter = BigInt(nowSec - CLOCK_SKEW_SEC);
+		const validBefore = BigInt(expiresAtSec + SETTLEMENT_MARGIN_SEC);
+		const auth = {
+			from: options.signer.address,
+			to: pr.payTo,
+			value: BigInt(pr.maxAmountRequired),
+			validAfter,
+			validBefore,
+			nonce
+		};
+		const signature = await options.signer.signTypedData(transferWithAuthorizationTypedData({
+			name: pr.extra.name,
+			version: pr.extra.version,
+			chainId,
+			verifyingContract: pr.asset
+		}, auth));
+		return this.#request("POST", `/v1/x402/challenges/${challenge.id}/pay`, { payment: toPaymentPayload(challenge.network, auth, signature) });
+	}
+	/** Fetch a challenge by id (scoped to the challenger org that created it). */
+	async getChallenge(id) {
+		if (!id) throw new X402Error("getChallenge() requires a challenge id", 0);
+		return this.#request("GET", `/v1/x402/challenges/${encodeURIComponent(id)}`);
+	}
+	/** Resolve the caller's own organization id from the account endpoint. */
+	async #resolveOrgId() {
+		const account = await this.#request("GET", "/v1/account");
+		if (!account?.id) throw new X402Error("could not resolve your organization id from /v1/account; pass { org } explicitly", 0);
+		return account.id;
+	}
+	/**
+	* Register a payout address for your org (payee side). The signer proves
+	* control of its own address with an org-bound `personal_sign`; the proven
+	* address becomes (or updates to) the default payout destination for the
+	* network. `charge()` resolves its `pay_to` from this directory, so a payee
+	* must register before requesting payments.
+	*
+	* `org` is optional: when omitted it is resolved from your authenticated
+	* account, so most callers never need to supply it.
+	*/
+	async registerPayoutAddress(input, options) {
+		if (typeof options?.signer?.signMessage !== "function") throw new X402Error("registerPayoutAddress() requires a signer with signMessage (e.g. a viem LocalAccount)", 0);
+		const org = input.org ?? await this.#resolveOrgId();
+		const network = input.network ?? "base-sepolia";
+		const issuedAt = input.issuedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+		const address = options.signer.address;
+		const message = buildPayoutRegistrationMessage({
+			org,
+			address,
+			network,
+			issuedAt
+		});
+		const signature = await options.signer.signMessage({ message });
+		return this.#request("POST", "/v1/x402/payout-addresses", {
+			address,
+			network,
+			signature,
+			issued_at: issuedAt,
+			...input.label !== void 0 ? { label: input.label } : {}
+		});
+	}
+	/** List your org's registered payout addresses. */
+	async listPayoutAddresses() {
+		return this.#request("GET", "/v1/x402/payout-addresses");
+	}
+	/**
+	* List the most recent payments your org's spend policy declined (newest
+	* first). Use this to see why an outbound payment was refused.
+	*/
+	async listDeclinedPayments() {
+		return this.#request("GET", "/v1/x402/declined-payments");
+	}
+	/** Read your org's spend policy (kill-switch + caps + allowlist). */
+	async getSpendPolicy() {
+		return this.#request("GET", "/v1/x402/spend-policy");
+	}
+	/**
+	* Update your org's spend policy. The endpoint is a PUT, but the server
+	* applies it as a merge: only the fields you include are changed and omitted
+	* fields keep their current value, so a partial update can't silently reset
+	* the kill-switch. Pass `null` to clear a cap.
+	*/
+	async setSpendPolicy(update) {
+		return this.#request("PUT", "/v1/x402/spend-policy", update);
+	}
+};
+function createX402Client(options = {}) {
+	return new X402Client(options);
+}
+//#endregion
 //#region src/oclif/commands/payments-shared.ts
 const PRIVATE_KEY_ENV = "PRIMITIVE_X402_PRIVATE_KEY";
 const PRIVATE_KEY_FLAG_DESCRIPTION = `Hex private key (0x-prefixed) of the wallet that signs. Prefer the ${PRIVATE_KEY_ENV} environment variable so the key is not exposed in shell history or the process list. The key is used locally to sign and never sent to Primitive.`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,