primcli 1.6.0 → 1.7.0

package/dist/oclif/index.js

@@ -7,7 +7,7 @@ import process$1 from "node:process";
 import { createInterface } from "node:readline/promises";
 import { hostname } from "node:os";
 import { spawn } from "node:child_process";
-import { X402Error, createX402Client } from "@primitivedotdev/sdk/x402";
+import { concat, getAddress, hexToBytes, keccak256, stringToBytes } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -21020,8 +21020,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.6.0";
-const CLI_VERSION_RANGE = "^1.6.0";
+const SDK_VERSION_RANGE = "^1.7.0";
+const CLI_VERSION_RANGE = "^1.7.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -24411,6 +24411,420 @@ var OrgSecretsSetCommand = class OrgSecretsSetCommand extends Command {
 	}
 };
 //#endregion
+//#region ../sdk-node/dist/x402/index.js
+/**
+* x402 client-side signing.
+*
+* The payer signs an EIP-3009 `transferWithAuthorization` over the customer's
+* own key; the key never leaves them. This module derives the interaction-bound
+* nonce and assembles the EIP-712 typed data and the wire payload. The byte
+* layout here MUST match the platform verifier exactly; a normative test vector
+* (see sign.test.ts) locks the nonce derivation to the same value the server
+* recomputes.
+*/
+/** A challenge nonce is 32 bytes rendered as 64 lowercase hex chars, no 0x. */
+const CHALLENGE_NONCE_RE = /^[0-9a-f]{64}$/;
+/** Single-byte domain separator between the variable-length string fields. */
+const FIELD_SEPARATOR = new Uint8Array([0]);
+/**
+* Derive the EIP-3009 nonce bound to a specific interaction step:
+*
+*   keccak256( utf8(lower(interaction_id)) || 0x00
+*            || utf8(lower(challenge_step_id)) || 0x00
+*            || hexdecode(challenge_nonce) )
+*
+* The `0x00` separators pin the field boundaries (undelimited concatenation of
+* variable-length strings is collision-ambiguous), and the challenge nonce is
+* decoded to its 32 raw bytes before hashing. The platform recomputes this and
+* rejects a mismatch.
+*/
+function deriveEip3009Nonce(input) {
+	if (!CHALLENGE_NONCE_RE.test(input.challengeNonce)) throw new Error("challengeNonce must be exactly 64 lowercase hex chars (32 bytes), no 0x prefix");
+	return keccak256(concat([
+		stringToBytes(input.interactionId.toLowerCase()),
+		FIELD_SEPARATOR,
+		stringToBytes(input.challengeStepId.toLowerCase()),
+		FIELD_SEPARATOR,
+		hexToBytes(`0x${input.challengeNonce}`)
+	]));
+}
+/**
+* The EIP-3009 `TransferWithAuthorization` EIP-712 type. The field order and
+* types are part of the on-chain contract and MUST NOT change.
+*/
+const TRANSFER_WITH_AUTHORIZATION_TYPES = { TransferWithAuthorization: [
+	{
+		name: "from",
+		type: "address"
+	},
+	{
+		name: "to",
+		type: "address"
+	},
+	{
+		name: "value",
+		type: "uint256"
+	},
+	{
+		name: "validAfter",
+		type: "uint256"
+	},
+	{
+		name: "validBefore",
+		type: "uint256"
+	},
+	{
+		name: "nonce",
+		type: "bytes32"
+	}
+] };
+function transferWithAuthorizationTypedData(domain, auth) {
+	return {
+		domain: {
+			name: domain.name,
+			version: domain.version,
+			chainId: domain.chainId,
+			verifyingContract: domain.verifyingContract
+		},
+		types: TRANSFER_WITH_AUTHORIZATION_TYPES,
+		primaryType: "TransferWithAuthorization",
+		message: auth
+	};
+}
+/**
+* Build the payout-address ownership message. This MUST be byte-identical to the
+* platform's `buildPayoutRegistrationMessage`, or registration fails the
+* ownership proof. The org id is in the signed bytes, so a captured signature
+* can never register the address under a different org.
+*/
+function buildPayoutRegistrationMessage(input) {
+	return [
+		"Primitive x402 payout address authorization",
+		"",
+		"I authorize this address as a payout destination for my Primitive organization.",
+		"",
+		`org: ${input.org}`,
+		`address: ${input.address.toLowerCase()}`,
+		`network: ${input.network}`,
+		`issued: ${input.issuedAt}`
+	].join("\n");
+}
+/** Assemble the wire payload from a signed authorization. */
+function toPaymentPayload(network, auth, signature) {
+	return {
+		x402Version: 1,
+		scheme: "exact",
+		network,
+		payload: {
+			signature,
+			authorization: {
+				from: auth.from,
+				to: auth.to,
+				value: auth.value.toString(),
+				validAfter: auth.validAfter.toString(),
+				validBefore: auth.validBefore.toString(),
+				nonce: auth.nonce
+			}
+		}
+	};
+}
+/**
+* Compute the EIP-3009 validity window for a payment. `validBefore` is the
+* value that governs on-chain validity, so it MUST cover the challenge's
+* `expires_at` plus a settlement margin; `validAfter` is set generously in the
+* past for clock skew. The total window is hard-capped at `maxWindowSec` so
+* neither a far-future `challengeExpiresAtSec` nor a widened margin can produce
+* a window the platform verifier would later reject.
+*/
+function computePaymentValidityWindow(params) {
+	const margin = params.settlementMarginSec ?? 300;
+	const skew = params.clockSkewSec ?? 300;
+	const validBefore = BigInt(params.challengeExpiresAtSec + margin);
+	const validAfter = BigInt(params.nowSec - skew);
+	if (validBefore <= validAfter) throw new Error("invalid validity window: validBefore must be after validAfter (challenge already expired?)");
+	const maxWindow = BigInt(params.maxWindowSec ?? 86400);
+	if (validBefore - validAfter > maxWindow) throw new Error(`invalid validity window: total window exceeds the ${maxWindow}s cap (challenge expiry too far out?)`);
+	return {
+		validAfter,
+		validBefore
+	};
+}
+/**
+* The interaction-aware signer: derive the bound nonce, assemble the
+* authorization, and sign it. This is the one piece a stock x402 signer cannot
+* do (it generates the nonce internally with no injection point), so the payer
+* side needs this Primitive-provided helper. The key never leaves the caller.
+*/
+async function signInteractionPayment(params) {
+	const authorization = {
+		from: getAddress(params.payer),
+		to: getAddress(params.payTo),
+		value: params.amount,
+		validAfter: params.validAfter,
+		validBefore: params.validBefore,
+		nonce: deriveEip3009Nonce(params.nonceBinding)
+	};
+	return {
+		authorization,
+		signature: await params.sign(transferWithAuthorizationTypedData(params.domain, authorization))
+	};
+}
+/** The authorization nonce is 32 bytes rendered as a 0x-prefixed 64-char hex string. */
+const NONCE_HEX_RE = /^0x[0-9a-fA-F]{64}$/;
+/** A shape-valid EIP signature is 65 bytes (r,s,v) rendered as 130 hex chars. */
+const SIGNATURE_HEX_RE = /^0x[0-9a-fA-F]{130}$/;
+/**
+* Assemble (and validate) the exact-EVM x402 wire payload from an
+* interaction-bound, locally-signed authorization. The numeric authorization
+* fields are decimal strings in the wire schema, so the bigints are stringified
+* here; the nonce passes through as hex. Validation rejects a malformed nonce or
+* signature loudly rather than emitting a payload the platform will reject.
+*/
+function buildExactEvmPaymentPayload(params) {
+	if (params.network !== "base" && params.network !== "base-sepolia") throw new Error(`buildExactEvmPaymentPayload: unsupported network ${params.network}`);
+	if (!SIGNATURE_HEX_RE.test(params.signature)) throw new Error("buildExactEvmPaymentPayload: signature must be a 0x-prefixed 65-byte (130 hex char) EIP signature");
+	if (!NONCE_HEX_RE.test(params.authorization.nonce)) throw new Error("buildExactEvmPaymentPayload: authorization.nonce must be a 0x-prefixed 32-byte (64 hex char) value");
+	return toPaymentPayload(params.network, params.authorization, params.signature);
+}
+const CHAIN_IDS = {
+	"base-sepolia": 84532,
+	base: 8453
+};
+const DEFAULT_BASE_URL = "https://api.primitive.dev";
+const CHARGE_INPUT_KEYS = {
+	amount: true,
+	amountUsdc: true,
+	network: true,
+	payerOrg: true,
+	description: true,
+	resource: true,
+	expiresIn: true,
+	idempotencyKey: true
+};
+function usdcToBaseUnits$1(human) {
+	const trimmed = human.trim();
+	if (!/^\d+(\.\d+)?$/.test(trimmed)) return null;
+	const [whole, frac = ""] = trimmed.split(".");
+	if (frac.length > 6) return null;
+	const base = BigInt(whole) * 1000000n + BigInt(frac.padEnd(6, "0"));
+	return base > 0n ? base.toString() : null;
+}
+var X402Error = class extends Error {
+	/** HTTP status, or 0 for a client-side / transport error that never reached the server. */
+	status;
+	body;
+	/** The `Retry-After` response header, if the server sent one. */
+	retryAfter;
+	constructor(message, status, body, options) {
+		super(message, options?.cause !== void 0 ? { cause: options.cause } : void 0);
+		this.name = "X402Error";
+		this.status = status;
+		this.body = body;
+		this.retryAfter = options?.retryAfter ?? null;
+	}
+};
+/**
+* Assert a challenge is fully hydrated before signing, so a missing field fails
+* with a named X402Error instead of an opaque viem/BigInt error mid-sign.
+*/
+function validateChallenge(c) {
+	const bad = (field) => {
+		throw new X402Error(`challenge is missing or malformed: ${field}`, 0);
+	};
+	if (!c || typeof c !== "object") bad("challenge");
+	if (!c.id) bad("id");
+	if (!c.network) bad("network");
+	if (!c.expires_at) bad("expires_at");
+	const nb = c.nonce_binding;
+	if (!nb?.interaction_id || !nb.challenge_step_id || !nb.challenge_nonce) bad("nonce_binding");
+	const pr = c.payment_requirements;
+	if (!pr) bad("payment_requirements");
+	if (!/^[1-9][0-9]{0,38}$/.test(pr.maxAmountRequired ?? "")) bad("payment_requirements.maxAmountRequired (expected a positive integer string in token base units)");
+	if (!/^0x[0-9a-fA-F]{40}$/.test(pr.payTo ?? "")) bad("payment_requirements.payTo (expected a 0x address)");
+	if (!/^0x[0-9a-fA-F]{40}$/.test(pr.asset ?? "")) bad("payment_requirements.asset (expected a 0x address)");
+	if (!pr.extra?.name || !pr.extra.version) bad("payment_requirements.extra (name/version)");
+}
+var X402Client = class {
+	#apiKey;
+	#baseUrl;
+	#fetch;
+	#timeoutMs;
+	constructor(options = {}) {
+		this.#apiKey = options.apiKey ?? process.env.PRIMITIVE_API_KEY ?? "";
+		this.#baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+		this.#fetch = options.fetch ?? fetch;
+		this.#timeoutMs = options.timeoutMs ?? 3e4;
+	}
+	async #request(method, path, body, init) {
+		if (!this.#apiKey) throw new X402Error("no API key configured; set PRIMITIVE_API_KEY or pass { apiKey } to the client", 0);
+		const timeout = AbortSignal.timeout(this.#timeoutMs);
+		const signal = init?.signal ? AbortSignal.any([timeout, init.signal]) : timeout;
+		let res;
+		try {
+			res = await this.#fetch(`${this.#baseUrl}${path}`, {
+				method,
+				headers: {
+					authorization: `Bearer ${this.#apiKey}`,
+					"content-type": "application/json",
+					...init?.headers
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body),
+				signal
+			});
+		} catch (cause) {
+			throw new X402Error(cause instanceof Error && cause.name === "TimeoutError" ? `request to ${path} timed out after ${this.#timeoutMs}ms` : `request to ${path} failed: ${cause instanceof Error ? cause.message : String(cause)}`, 0, void 0, { cause });
+		}
+		const retryAfter = res.headers.get("retry-after");
+		const text = await res.text().catch(() => "");
+		let json;
+		if (text) try {
+			json = JSON.parse(text);
+		} catch {
+			throw new X402Error(`non-JSON response (${res.status}) from ${path}: ${text.slice(0, 200)}`, res.status, text.slice(0, 500), { retryAfter });
+		}
+		if (!res.ok || json?.success === false) throw new X402Error(json?.error?.message ?? `request failed with ${res.status}`, res.status, json ?? text.slice(0, 500), { retryAfter });
+		if (!json || json.success !== true || json.data === void 0) throw new X402Error(`unexpected response shape (${res.status}) from ${path}: missing success/data envelope`, res.status, json ?? text.slice(0, 500), { retryAfter });
+		return json.data;
+	}
+	/** Request a payment (payee side). Returns the challenge to hand to the payer. */
+	async charge(input) {
+		for (const key of Object.keys(input)) if (!(key in CHARGE_INPUT_KEYS)) throw new X402Error(`unknown charge() option "${key}"; expected one of: ${Object.keys(CHARGE_INPUT_KEYS).join(", ")}`, 0);
+		if (input.amount !== void 0 && input.amountUsdc !== void 0) throw new X402Error("charge() takes exactly one of `amount` (base units) or `amountUsdc` (human USDC), not both", 0);
+		const amount = input.amountUsdc !== void 0 ? usdcToBaseUnits$1(input.amountUsdc) : input.amount ?? null;
+		if (!amount || !/^[1-9][0-9]{0,38}$/.test(amount)) throw new X402Error("charge() requires `amount` as a positive integer string in token base units (e.g. \"10000\"), or `amountUsdc` as a positive USDC amount with at most 6 decimals (e.g. \"0.01\")", 0);
+		const body = {
+			amount,
+			network: input.network ?? "base-sepolia"
+		};
+		if (input.payerOrg) body.payer_org = input.payerOrg;
+		if (input.description) body.description = input.description;
+		if (input.resource) body.resource = input.resource;
+		if (input.expiresIn !== void 0) body.expires_in = input.expiresIn;
+		return this.#request("POST", "/v1/x402/challenges", body, { headers: input.idempotencyKey ? { "idempotency-key": input.idempotencyKey } : void 0 });
+	}
+	/**
+	* Pay a challenge (payer side). Derives the interaction-bound authorization,
+	* signs it locally with the caller's key, and submits it for settlement.
+	*/
+	async pay(challenge, options) {
+		if (!options?.signer?.address || typeof options.signer.signTypedData !== "function") throw new X402Error("pay() requires options.signer with { address, signTypedData } (e.g. a viem LocalAccount)", 0);
+		validateChallenge(challenge);
+		const chainId = CHAIN_IDS[challenge.network];
+		if (chainId === void 0) throw new X402Error(`unsupported network: ${challenge.network}`, 0);
+		const pr = challenge.payment_requirements;
+		if (pr.network !== challenge.network) throw new X402Error(`challenge network mismatch: ${challenge.network} vs payment_requirements ${pr.network}`, 0);
+		if (pr.scheme !== "exact") throw new X402Error(`unsupported payment scheme: ${pr.scheme}`, 0);
+		const nowSec = Math.floor(Date.now() / 1e3);
+		const expiresAtMs = Date.parse(challenge.expires_at);
+		if (Number.isNaN(expiresAtMs)) throw new X402Error(`challenge has an invalid expires_at: ${challenge.expires_at}`, 0);
+		const expiresAtSec = Math.floor(expiresAtMs / 1e3);
+		if (expiresAtSec <= nowSec) throw new X402Error(`challenge has already expired (expires_at ${challenge.expires_at}); not signing`, 0);
+		let validAfter;
+		let validBefore;
+		try {
+			({validAfter, validBefore} = computePaymentValidityWindow({
+				challengeExpiresAtSec: expiresAtSec,
+				nowSec
+			}));
+		} catch (cause) {
+			throw new X402Error(cause instanceof Error ? cause.message : String(cause), 0, void 0, { cause });
+		}
+		const { authorization, signature } = await signInteractionPayment({
+			sign: (typedData) => options.signer.signTypedData(typedData),
+			payer: options.signer.address,
+			domain: {
+				name: pr.extra.name,
+				version: pr.extra.version,
+				chainId,
+				verifyingContract: pr.asset
+			},
+			payTo: pr.payTo,
+			amount: BigInt(pr.maxAmountRequired),
+			nonceBinding: {
+				interactionId: challenge.nonce_binding.interaction_id,
+				challengeStepId: challenge.nonce_binding.challenge_step_id,
+				challengeNonce: challenge.nonce_binding.challenge_nonce
+			},
+			validAfter,
+			validBefore
+		});
+		return this.#request("POST", `/v1/x402/challenges/${challenge.id}/pay`, { payment: buildExactEvmPaymentPayload({
+			network: challenge.network,
+			authorization,
+			signature
+		}) });
+	}
+	/** Fetch a challenge by id (scoped to the challenger org that created it). */
+	async getChallenge(id) {
+		if (!id) throw new X402Error("getChallenge() requires a challenge id", 0);
+		return this.#request("GET", `/v1/x402/challenges/${encodeURIComponent(id)}`);
+	}
+	/** Resolve the caller's own organization id from the account endpoint. */
+	async #resolveOrgId() {
+		const account = await this.#request("GET", "/v1/account");
+		if (!account?.id) throw new X402Error("could not resolve your organization id from /v1/account; pass { org } explicitly", 0);
+		return account.id;
+	}
+	/**
+	* Register a payout address for your org (payee side). The signer proves
+	* control of its own address with an org-bound `personal_sign`; the proven
+	* address becomes (or updates to) the default payout destination for the
+	* network. `charge()` resolves its `pay_to` from this directory, so a payee
+	* must register before requesting payments.
+	*
+	* `org` is optional: when omitted it is resolved from your authenticated
+	* account, so most callers never need to supply it.
+	*/
+	async registerPayoutAddress(input, options) {
+		if (typeof options?.signer?.signMessage !== "function") throw new X402Error("registerPayoutAddress() requires a signer with signMessage (e.g. a viem LocalAccount)", 0);
+		const org = input.org ?? await this.#resolveOrgId();
+		const network = input.network ?? "base-sepolia";
+		const issuedAt = input.issuedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+		const address = options.signer.address;
+		const message = buildPayoutRegistrationMessage({
+			org,
+			address,
+			network,
+			issuedAt
+		});
+		const signature = await options.signer.signMessage({ message });
+		return this.#request("POST", "/v1/x402/payout-addresses", {
+			address,
+			network,
+			signature,
+			issued_at: issuedAt,
+			...input.label !== void 0 ? { label: input.label } : {}
+		});
+	}
+	/** List your org's registered payout addresses. */
+	async listPayoutAddresses() {
+		return this.#request("GET", "/v1/x402/payout-addresses");
+	}
+	/**
+	* List the most recent payments your org's spend policy declined (newest
+	* first). Use this to see why an outbound payment was refused.
+	*/
+	async listDeclinedPayments() {
+		return this.#request("GET", "/v1/x402/declined-payments");
+	}
+	/** Read your org's spend policy (kill-switch + caps + allowlist). */
+	async getSpendPolicy() {
+		return this.#request("GET", "/v1/x402/spend-policy");
+	}
+	/**
+	* Update your org's spend policy. The endpoint is a PUT, but the server
+	* applies it as a merge: only the fields you include are changed and omitted
+	* fields keep their current value, so a partial update can't silently reset
+	* the kill-switch. Pass `null` to clear a cap.
+	*/
+	async setSpendPolicy(update) {
+		return this.#request("PUT", "/v1/x402/spend-policy", update);
+	}
+};
+function createX402Client(options = {}) {
+	return new X402Client(options);
+}
+//#endregion
 //#region src/oclif/commands/payments-shared.ts
 const PRIVATE_KEY_ENV = "PRIMITIVE_X402_PRIVATE_KEY";
 const PRIVATE_KEY_FLAG_DESCRIPTION = `Hex private key (0x-prefixed) of the wallet that signs. Prefer the ${PRIVATE_KEY_ENV} environment variable so the key is not exposed in shell history or the process list. The key is used locally to sign and never sent to Primitive.`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,