thaifi-wallet-cli 0.1.2 → 0.1.3

package/dist/commands/request.js

@@ -1,13 +1,124 @@
-/** `thaifi request <url>` — curl-like HTTP client with x402/MPP auto-payments. */
+/** `thaifi request <url>` — curl-like HTTP client with MPP/x402 auto-payments. */
+import { concatHex, keccak256, slice, stringToBytes } from "viem";
 import { loadStore } from "../store.js";
 import { createAgentClient } from "../chain.js";
 import { CONFIG, PATHUSD_DECIMALS } from "../config.js";
+function b64uDecode(s) {
+    return Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+}
+function b64uEncode(s) {
+    return Buffer.from(s, "utf8")
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+/**
+ * Parse an MPP `WWW-Authenticate: Payment id="…", request="<b64u json>"` header.
+ * See https://mpp.dev — Machine Payments Protocol.
+ */
+export function parseMppChallenge(header) {
+    const m = /^Payment\s+(.+)$/i.exec(header.trim());
+    if (!m)
+        return null;
+    const params = {};
+    const re = /([a-zA-Z]+)=((?:"((?:[^"\\]|\\.)*)")|[^\s,]+)/g;
+    let pm;
+    while ((pm = re.exec(m[1]))) {
+        const value = pm[3] !== undefined ? pm[3].replace(/\\(.)/g, "$1") : pm[2];
+        params[pm[1].toLowerCase()] = value;
+    }
+    if (!params.id || !params.request || !params.method)
+        return null;
+    let request;
+    try {
+        request = JSON.parse(b64uDecode(params.request));
+    }
+    catch {
+        return null;
+    }
+    const challenge = {
+        id: params.id,
+        realm: params.realm ?? "",
+        method: params.method,
+        intent: params.intent ?? "charge",
+        request,
+        requestRaw: params.request,
+    };
+    if (params.opaque !== undefined)
+        challenge.opaque = params.opaque;
+    if (params.expires !== undefined)
+        challenge.expires = params.expires;
+    return challenge;
+}
+/** MPP tempo charge → on-chain TIP-20 transfer (push mode: we broadcast, then send the hash). */
+function mppTempoChallenge(challenge) {
+    const req = challenge.request;
+    if (!req.amount || !req.recipient)
+        return null;
+    const amount = BigInt(req.amount);
+    // mppx omits `decimals` for pathUSD-denominated challenges.
+    const decimals = req.decimals ?? 6;
+    return {
+        payTo: req.recipient,
+        amount,
+        token: req.currency,
+        memo: req.memo ?? attributionMemo(challenge.realm, challenge.id),
+        decimals,
+        proofHeader: (txHash) => {
+            // Wire format: challenge.request is the base64url string, not a nested object.
+            const credential = {
+                challenge: {
+                    id: challenge.id,
+                    realm: challenge.realm,
+                    method: challenge.method,
+                    intent: challenge.intent,
+                    request: challenge.requestRaw,
+                    ...(challenge.opaque !== undefined && { opaque: challenge.opaque }),
+                    ...(challenge.expires !== undefined && { expires: challenge.expires }),
+                },
+                payload: { type: "hash", hash: txHash },
+                source: `did:pkh:eip155:${CONFIG.chainId}:${storeAddress()}`,
+            };
+            return "Payment " + b64uEncode(JSON.stringify(credential));
+        },
+    };
+}
+function storeAddress() {
+    const store = loadStore();
+    return store?.userAddress ?? "0x0";
+}
+const fingerprint = (value) => slice(keccak256(stringToBytes(value)), 0, 10);
+/**
+ * MPP attribution memo (bytes32) per mppx Attribution encoding:
+ * tag = keccak256("mpp")[0..4], version 0x01, serverId = realm fingerprint,
+ * clientId = CLI fingerprint, nonce = keccak256(challengeId)[0..7 bytes].
+ * Required by servers that don't pre-assign a memo to the challenge.
+ */
+function attributionMemo(realm, challengeId) {
+    const tag = slice(keccak256(stringToBytes("mpp")), 0, 4);
+    return concatHex([
+        tag,
+        "0x01",
+        fingerprint(realm),
+        fingerprint("thaifi-wallet-cli"),
+        slice(keccak256(stringToBytes(challengeId)), 0, 7),
+    ]);
+}
 /**
- * Extract an x402/MPP payment challenge from a 402 response.
- * Supports the common shapes: JSON body `{ accepts: [...] }` (x402) and
- * `payTo`/`amount` fields; falls back to the `X-Payment-Required` header.
+ * Extract a payment challenge from a 402 response.
+ * MPP (`WWW-Authenticate: Payment …`) first; legacy x402 JSON body as fallback.
  */
 async function parseChallenge(res, defaultToken) {
+    const wwwAuth = res.headers.get("www-authenticate");
+    if (wwwAuth) {
+        const mpp = parseMppChallenge(wwwAuth);
+        if (mpp && mpp.method === "tempo" && mpp.intent === "charge") {
+            const parsed = mppTempoChallenge(mpp);
+            if (parsed)
+                return parsed;
+        }
+    }
     let body = null;
     try {
         body = await res.json();
@@ -18,18 +129,8 @@ async function parseChallenge(res, defaultToken) {
     const accept = body?.accepts?.[0] ?? body?.payments?.[0] ?? body;
     const payTo = accept?.payTo ?? accept?.payToAddress ?? accept?.recipient;
     const maxAmount = accept?.maxAmountRequired ?? accept?.amount ?? accept?.price;
-    if (!payTo || maxAmount === undefined) {
-        const header = res.headers.get("x-payment-required");
-        if (!header)
-            return null;
-        try {
-            const h = JSON.parse(Buffer.from(header, "base64").toString());
-            return parseChallenge(new Response(JSON.stringify(h), { status: 200 }), defaultToken);
-        }
-        catch {
-            return null;
-        }
-    }
+    if (!payTo || maxAmount === undefined)
+        return null;
     const amount = typeof maxAmount === "string" && /^\d+$/.test(maxAmount)
         ? BigInt(maxAmount)
         : BigInt(Math.round(Number(maxAmount) * 10 ** PATHUSD_DECIMALS));
@@ -37,9 +138,38 @@ async function parseChallenge(res, defaultToken) {
         payTo: payTo,
         amount,
         token: accept?.asset ?? accept?.token ?? defaultToken,
-        raw: body,
+        decimals: PATHUSD_DECIMALS,
+        proofHeader: (txHash) => Buffer.from(JSON.stringify({
+            scheme: "exact",
+            txHash,
+            from: storeAddress(),
+            to: payTo,
+            amount: "0x" + amount.toString(16),
+            token: accept?.asset ?? accept?.token ?? defaultToken,
+        })).toString("base64"),
     };
 }
+/** If the JSON response carries a generated image, save it and print a summary. */
+async function maybeSaveImage(text) {
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const b64 = body?.image_base64 ?? body?.data?.image_base64;
+    if (typeof b64 !== "string" || b64.length < 1000)
+        return null;
+    const id = (body?.id ?? body?.data?.id ?? "image").toString().replace(/[^\w-]/g, "");
+    const mime = (body?.mime_type ?? body?.data?.mime_type ?? "image/png").toString();
+    const ext = mime.includes("jpeg") ? "jpg" : mime.includes("webp") ? "webp" : "png";
+    const file = `iapp-${id}.${ext}`;
+    const { writeFileSync } = await import("node:fs");
+    writeFileSync(file, Buffer.from(b64, "base64"));
+    const { width, height, time } = body;
+    return `${file} (${mime}${width ? `, ${width}x${height}` : ""}${time?.total ? `, ${time.total}s` : ""})`;
+}
 export async function request(url, options) {
     const store = loadStore();
     if (!store?.userAddress) {
@@ -69,7 +199,7 @@ export async function request(url, options) {
             process.exitCode = 1;
             return;
         }
-        const usd = Number(challenge.amount) / 10 ** PATHUSD_DECIMALS;
+        const usd = Number(challenge.amount) / 10 ** (challenge.decimals ?? PATHUSD_DECIMALS);
         if (options.maxSpend !== undefined && usd > options.maxSpend) {
             console.error("Payment of $" + usd + " exceeds --max-spend $" + options.maxSpend + " — aborting.");
             process.exitCode = 1;
@@ -82,6 +212,7 @@ export async function request(url, options) {
             to: challenge.payTo,
             amount: challenge.amount,
             token,
+            ...(challenge.memo ? { memo: challenge.memo } : {}),
         });
         const receipt = await client.waitForTransactionReceipt({ hash });
         if (receipt.status !== "success") {
@@ -90,17 +221,9 @@ export async function request(url, options) {
             return;
         }
         console.log("Paid. Tx: " + hash);
-        const proof = Buffer.from(JSON.stringify({
-            scheme: "exact",
-            txHash: hash,
-            from: store.userAddress,
-            to: challenge.payTo,
-            amount: "0x" + challenge.amount.toString(16),
-            token,
-        })).toString("base64");
         res = await fetch(url, {
             method: options.method,
-            headers: { ...options.headers, "X-Payment": proof },
+            headers: { ...options.headers, Authorization: challenge.proofHeader(hash) },
             body: options.body,
         });
     }
@@ -109,10 +232,21 @@ export async function request(url, options) {
     const text = await res.text();
     if (contentType.includes("json")) {
         try {
-            console.log(JSON.stringify(JSON.parse(text), null, 2));
+            const saved = await maybeSaveImage(text);
+            if (saved) {
+                console.log("Saved image → " + saved);
+                const body = JSON.parse(text);
+                for (const k of ["status", "id", "width", "height", "mime_type", "font"]) {
+                    if (body[k] !== undefined)
+                        console.log("  " + k + ": " + body[k]);
+                }
+            }
+            else {
+                console.log(JSON.stringify(JSON.parse(text), null, 2));
+            }
         }
         catch {
-            console.log(text);
+            console.log(text.slice(0, 4000));
         }
     }
     else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thaifi-wallet-cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "ThaiFi Wallet CLI for AI agents — pair with wallet.thaifi.com, sign with on-chain access keys (spending limits enforced on-chain), x402/MPP payments",
   "type": "module",
   "bin": {