primcli 1.6.1 → 1.7.0

package/dist/oclif/index.js

@@ -7,7 +7,7 @@ import process$1 from "node:process";
 import { createInterface } from "node:readline/promises";
 import { hostname } from "node:os";
 import { spawn } from "node:child_process";
-import { concat, hexToBytes, keccak256, stringToBytes } from "viem";
+import { concat, getAddress, hexToBytes, keccak256, stringToBytes } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -21020,8 +21020,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.6.0";
-const CLI_VERSION_RANGE = "^1.6.0";
+const SDK_VERSION_RANGE = "^1.7.0";
+const CLI_VERSION_RANGE = "^1.7.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -24528,12 +24528,68 @@ function toPaymentPayload(network, auth, signature) {
 		}
 	};
 }
+/**
+* Compute the EIP-3009 validity window for a payment. `validBefore` is the
+* value that governs on-chain validity, so it MUST cover the challenge's
+* `expires_at` plus a settlement margin; `validAfter` is set generously in the
+* past for clock skew. The total window is hard-capped at `maxWindowSec` so
+* neither a far-future `challengeExpiresAtSec` nor a widened margin can produce
+* a window the platform verifier would later reject.
+*/
+function computePaymentValidityWindow(params) {
+	const margin = params.settlementMarginSec ?? 300;
+	const skew = params.clockSkewSec ?? 300;
+	const validBefore = BigInt(params.challengeExpiresAtSec + margin);
+	const validAfter = BigInt(params.nowSec - skew);
+	if (validBefore <= validAfter) throw new Error("invalid validity window: validBefore must be after validAfter (challenge already expired?)");
+	const maxWindow = BigInt(params.maxWindowSec ?? 86400);
+	if (validBefore - validAfter > maxWindow) throw new Error(`invalid validity window: total window exceeds the ${maxWindow}s cap (challenge expiry too far out?)`);
+	return {
+		validAfter,
+		validBefore
+	};
+}
+/**
+* The interaction-aware signer: derive the bound nonce, assemble the
+* authorization, and sign it. This is the one piece a stock x402 signer cannot
+* do (it generates the nonce internally with no injection point), so the payer
+* side needs this Primitive-provided helper. The key never leaves the caller.
+*/
+async function signInteractionPayment(params) {
+	const authorization = {
+		from: getAddress(params.payer),
+		to: getAddress(params.payTo),
+		value: params.amount,
+		validAfter: params.validAfter,
+		validBefore: params.validBefore,
+		nonce: deriveEip3009Nonce(params.nonceBinding)
+	};
+	return {
+		authorization,
+		signature: await params.sign(transferWithAuthorizationTypedData(params.domain, authorization))
+	};
+}
+/** The authorization nonce is 32 bytes rendered as a 0x-prefixed 64-char hex string. */
+const NONCE_HEX_RE = /^0x[0-9a-fA-F]{64}$/;
+/** A shape-valid EIP signature is 65 bytes (r,s,v) rendered as 130 hex chars. */
+const SIGNATURE_HEX_RE = /^0x[0-9a-fA-F]{130}$/;
+/**
+* Assemble (and validate) the exact-EVM x402 wire payload from an
+* interaction-bound, locally-signed authorization. The numeric authorization
+* fields are decimal strings in the wire schema, so the bigints are stringified
+* here; the nonce passes through as hex. Validation rejects a malformed nonce or
+* signature loudly rather than emitting a payload the platform will reject.
+*/
+function buildExactEvmPaymentPayload(params) {
+	if (params.network !== "base" && params.network !== "base-sepolia") throw new Error(`buildExactEvmPaymentPayload: unsupported network ${params.network}`);
+	if (!SIGNATURE_HEX_RE.test(params.signature)) throw new Error("buildExactEvmPaymentPayload: signature must be a 0x-prefixed 65-byte (130 hex char) EIP signature");
+	if (!NONCE_HEX_RE.test(params.authorization.nonce)) throw new Error("buildExactEvmPaymentPayload: authorization.nonce must be a 0x-prefixed 32-byte (64 hex char) value");
+	return toPaymentPayload(params.network, params.authorization, params.signature);
+}
 const CHAIN_IDS = {
 	"base-sepolia": 84532,
 	base: 8453
 };
-const CLOCK_SKEW_SEC = 300;
-const SETTLEMENT_MARGIN_SEC = 300;
 const DEFAULT_BASE_URL = "https://api.primitive.dev";
 const CHARGE_INPUT_KEYS = {
 	amount: true,
@@ -24583,7 +24639,7 @@ function validateChallenge(c) {
 	if (!nb?.interaction_id || !nb.challenge_step_id || !nb.challenge_nonce) bad("nonce_binding");
 	const pr = c.payment_requirements;
 	if (!pr) bad("payment_requirements");
-	if (!pr.maxAmountRequired) bad("payment_requirements.maxAmountRequired");
+	if (!/^[1-9][0-9]{0,38}$/.test(pr.maxAmountRequired ?? "")) bad("payment_requirements.maxAmountRequired (expected a positive integer string in token base units)");
 	if (!/^0x[0-9a-fA-F]{40}$/.test(pr.payTo ?? "")) bad("payment_requirements.payTo (expected a 0x address)");
 	if (!/^0x[0-9a-fA-F]{40}$/.test(pr.asset ?? "")) bad("payment_requirements.asset (expected a 0x address)");
 	if (!pr.extra?.name || !pr.extra.version) bad("payment_requirements.extra (name/version)");
@@ -24658,33 +24714,45 @@ var X402Client = class {
 		const pr = challenge.payment_requirements;
 		if (pr.network !== challenge.network) throw new X402Error(`challenge network mismatch: ${challenge.network} vs payment_requirements ${pr.network}`, 0);
 		if (pr.scheme !== "exact") throw new X402Error(`unsupported payment scheme: ${pr.scheme}`, 0);
-		const nonce = deriveEip3009Nonce({
-			interactionId: challenge.nonce_binding.interaction_id,
-			challengeStepId: challenge.nonce_binding.challenge_step_id,
-			challengeNonce: challenge.nonce_binding.challenge_nonce
-		});
 		const nowSec = Math.floor(Date.now() / 1e3);
 		const expiresAtMs = Date.parse(challenge.expires_at);
 		if (Number.isNaN(expiresAtMs)) throw new X402Error(`challenge has an invalid expires_at: ${challenge.expires_at}`, 0);
 		const expiresAtSec = Math.floor(expiresAtMs / 1e3);
 		if (expiresAtSec <= nowSec) throw new X402Error(`challenge has already expired (expires_at ${challenge.expires_at}); not signing`, 0);
-		const validAfter = BigInt(nowSec - CLOCK_SKEW_SEC);
-		const validBefore = BigInt(expiresAtSec + SETTLEMENT_MARGIN_SEC);
-		const auth = {
-			from: options.signer.address,
-			to: pr.payTo,
-			value: BigInt(pr.maxAmountRequired),
+		let validAfter;
+		let validBefore;
+		try {
+			({validAfter, validBefore} = computePaymentValidityWindow({
+				challengeExpiresAtSec: expiresAtSec,
+				nowSec
+			}));
+		} catch (cause) {
+			throw new X402Error(cause instanceof Error ? cause.message : String(cause), 0, void 0, { cause });
+		}
+		const { authorization, signature } = await signInteractionPayment({
+			sign: (typedData) => options.signer.signTypedData(typedData),
+			payer: options.signer.address,
+			domain: {
+				name: pr.extra.name,
+				version: pr.extra.version,
+				chainId,
+				verifyingContract: pr.asset
+			},
+			payTo: pr.payTo,
+			amount: BigInt(pr.maxAmountRequired),
+			nonceBinding: {
+				interactionId: challenge.nonce_binding.interaction_id,
+				challengeStepId: challenge.nonce_binding.challenge_step_id,
+				challengeNonce: challenge.nonce_binding.challenge_nonce
+			},
 			validAfter,
-			validBefore,
-			nonce
-		};
-		const signature = await options.signer.signTypedData(transferWithAuthorizationTypedData({
-			name: pr.extra.name,
-			version: pr.extra.version,
-			chainId,
-			verifyingContract: pr.asset
-		}, auth));
-		return this.#request("POST", `/v1/x402/challenges/${challenge.id}/pay`, { payment: toPaymentPayload(challenge.network, auth, signature) });
+			validBefore
+		});
+		return this.#request("POST", `/v1/x402/challenges/${challenge.id}/pay`, { payment: buildExactEvmPaymentPayload({
+			network: challenge.network,
+			authorization,
+			signature
+		}) });
 	}
 	/** Fetch a challenge by id (scoped to the challenger org that created it). */
 	async getChallenge(id) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,