The machine store —
a store built for AI agents.

#!/usr/bin/env bash
# x402 (protocol v2) by hand, in two curls — see the 402, then pay it.
# Endpoint: POST https://x402.fablerlabs.com/audit/agent-config
#           (scores a CLAUDE.md / CONSTITUTION.md 0–100; see x402/src/engines/audit.ts)
#
# In v2 the payment requirements are NOT in the 402 body (it's empty {}) — they
# ride in a base64-encoded PAYMENT-REQUIRED response header. curl can't sign an
# EIP-3009 authorization, so step 2 sends a PAYMENT-SIGNATURE header you produced
# with a real signer (see node-viem.mjs / python-httpx.py). Put that base64
# header in X402_PAYMENT. NEVER a private key.
set -euo pipefail
URL="https://x402.fablerlabs.com/audit/agent-config"
BODY='{"content":"# CLAUDE.md\n\n## Commands\nnpm test\n","kind":"claude-md"}'

# 1) Unpaid request → 402 Payment Required. Dump the response headers and pull the
#    base64 PAYMENT-REQUIRED value; decoding it shows the requirements
#    ({x402Version:2, accepts:[{scheme, network, asset, amount, payTo, extra}]}).
echo "── 1. unpaid request → expect HTTP 402 + PAYMENT-REQUIRED header ──"
HDRS="$(curl -sS -D - -o /dev/null -w 'HTTP %{http_code}\n' \
  -X POST "$URL" -H 'Content-Type: application/json' -d "$BODY" || true)"
echo "$HDRS"
CHALLENGE_B64="$(printf '%s\n' "$HDRS" | tr -d '\r' | awk -F': ' 'tolower($1)=="payment-required"{print $2}')"
if [ -n "${CHALLENGE_B64:-}" ]; then
  echo "── decoded payment requirements ──"
  printf '%s' "$CHALLENGE_B64" | base64 -d 2>/dev/null || echo "(could not base64-decode; header value above)"
  echo
fi

# 2) Retry with the signed payment header → 200 and the JSON audit result.
if [ -n "${X402_PAYMENT:-}" ]; then
  echo "── 2. paid retry → expect HTTP 200 ──"
  curl -sS -w '\nHTTP %{http_code}\n' \
    -X POST "$URL" -H 'Content-Type: application/json' \
    -H "PAYMENT-SIGNATURE: $X402_PAYMENT" -d "$BODY"
else
  echo "set X402_PAYMENT=<base64 PAYMENT-SIGNATURE header> to run the paid retry" >&2
fi

// node-viem.mjs — pay an x402 (protocol v2) endpoint from Node with a hand-built
// EIP-3009 authorization, so you can see exactly what gets signed and paid.
// One-time:  npm i viem            (Node 18+, ESM: file ends in .mjs)
// Env:       X402_PRIVATE_KEY = hex key of a funded Base wallet (USDC + a little
//            ETH for the facilitator). NEVER hard-code or commit a key; use a
//            low-balance, single-purpose agent wallet.
import { randomBytes } from "node:crypto";
import { privateKeyToAccount } from "viem/accounts";
import { getAddress, toHex } from "viem";

const URL_ = "https://x402.fablerlabs.com/audit/agent-config";
const BODY = { content: "# CLAUDE.md\n\n## Commands\nnpm test\n", kind: "claude-md" }; // or kind:"constitution"

const key = process.env.X402_PRIVATE_KEY;
if (!key) throw new Error("set X402_PRIVATE_KEY to a funded Base wallet key");
const account = privateKeyToAccount(key.startsWith("0x") ? key : `0x${key}`);
const b64 = (obj) => Buffer.from(JSON.stringify(obj)).toString("base64");

// 1) Unpaid request → 402. In v2 the requirements ride in the base64
//    PAYMENT-REQUIRED response header (the body is empty), not the body.
const challengeRes = await fetch(URL_, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(BODY),
});
if (challengeRes.status !== 402) throw new Error(`expected 402, got ${challengeRes.status}`);
const challenge = JSON.parse(Buffer.from(challengeRes.headers.get("PAYMENT-REQUIRED"), "base64").toString());
const req = challenge.accepts[0]; // first advertised payment method

// 2) Sign a TransferWithAuthorization (EIP-3009) for exactly the asked amount.
//    `req.extra.{name,version}` are the token's EIP-712 domain params; `req.amount`
//    is the atomic USDC amount (v2 renamed v1's maxAmountRequired → amount).
const now = Math.floor(Date.now() / 1000);
const authorization = {
  from: account.address,
  to: getAddress(req.payTo),
  value: req.amount,
  validAfter: "0",
  validBefore: String(now + req.maxTimeoutSeconds),
  nonce: toHex(randomBytes(32)),
};
const signature = await account.signTypedData({
  domain: { name: req.extra.name, version: req.extra.version, chainId: 8453, verifyingContract: getAddress(req.asset) }, // 8453 = Base
  types: {
    TransferWithAuthorization: [
      { name: "from", type: "address" }, { name: "to", type: "address" },
      { name: "value", type: "uint256" }, { name: "validAfter", type: "uint256" },
      { name: "validBefore", type: "uint256" }, { name: "nonce", type: "bytes32" },
    ],
  },
  primaryType: "TransferWithAuthorization",
  message: {
    from: authorization.from, to: authorization.to, value: BigInt(authorization.value),
    validAfter: 0n, validBefore: BigInt(authorization.validBefore), nonce: authorization.nonce,
  },
});

// 3) Retry with the base64 PAYMENT-SIGNATURE header → 200 + the JSON audit result.
//    The payload echoes the chosen requirement back in `accepted` (v2 shape).
const payment = {
  x402Version: 2,
  accepted: req,
  payload: { authorization, signature },
  ...(challenge.extensions ? { extensions: challenge.extensions } : {}),
};
const res = await fetch(URL_, {
  method: "POST",
  headers: { "Content-Type": "application/json", "PAYMENT-SIGNATURE": b64(payment) },
  body: JSON.stringify(BODY),
});
console.log("HTTP", res.status);
console.log(await res.json()); // { score, findings, summary }
// Settlement (tx hash, payer) comes back in the PAYMENT-RESPONSE response header:
const settle = res.headers.get("PAYMENT-RESPONSE");
if (settle) console.log("settlement", JSON.parse(Buffer.from(settle, "base64").toString()));

# python-httpx.py — pay an x402 (protocol v2) endpoint with a hand-built EIP-3009
# authorization, so you can see exactly what gets signed and paid.
# One-time:  pip install httpx eth-account
# Env:       X402_PRIVATE_KEY = hex key of a funded Base wallet (USDC + a little gas).
#            NEVER hard-code or commit a key; use a low-balance agent wallet.
import base64, json, os, secrets, time, httpx
from eth_account import Account
from eth_utils import to_hex

URL = "https://x402.fablerlabs.com/audit/agent-config"
BODY = {"content": "# CLAUDE.md\n\n## Commands\nnpm test\n", "kind": "claude-md"}
acct = Account.from_key(os.environ["X402_PRIVATE_KEY"])

with httpx.Client(timeout=30) as c:
    r = c.post(URL, json=BODY)                        # 1) unpaid → 402
    if r.status_code != 402:
        raise SystemExit(f"expected 402, got {r.status_code}: {r.text[:200]}")
    # v2 carries the requirements in the base64 PAYMENT-REQUIRED header (body is
    # empty), not the body. Decode it, then take the first advertised method.
    challenge = json.loads(base64.b64decode(r.headers["payment-required"]))
    req = challenge["accepts"][0]

    # 2) Sign a TransferWithAuthorization (EIP-3009) for exactly the asked amount.
    #    req["amount"] is the atomic USDC amount (v2 renamed v1's maxAmountRequired);
    #    req["extra"] carries the token's EIP-712 domain name/version.
    nonce = secrets.token_bytes(32)
    auth = {"from": acct.address, "to": req["payTo"],
            "value": int(req["amount"]), "validAfter": 0,
            "validBefore": int(time.time()) + int(req["maxTimeoutSeconds"]),
            "nonce": to_hex(nonce)}
    typed = {"primaryType": "TransferWithAuthorization",
             "types": {"TransferWithAuthorization": [
                 {"name": "from", "type": "address"}, {"name": "to", "type": "address"},
                 {"name": "value", "type": "uint256"}, {"name": "validAfter", "type": "uint256"},
                 {"name": "validBefore", "type": "uint256"}, {"name": "nonce", "type": "bytes32"}]},
             "domain": {"name": req["extra"]["name"], "version": req["extra"]["version"],
                        "chainId": 8453, "verifyingContract": req["asset"]},  # 8453 = Base
             "message": {**auth, "nonce": nonce}}      # sign nonce as raw bytes32
    sig = to_hex(Account.sign_typed_data(acct.key, full_message=typed).signature)

    # 3) Base64 the PAYMENT-SIGNATURE header and retry → 200 + the JSON audit result.
    #    The v2 payload echoes the chosen requirement back in `accepted`.
    payment = {"x402Version": 2, "accepted": req,
               "payload": {"signature": sig, "authorization": auth}}
    header = base64.b64encode(json.dumps(payment).encode()).decode()
    paid = c.post(URL, json=BODY, headers={"PAYMENT-SIGNATURE": header})
    print("HTTP", paid.status_code, paid.json())       # → { score, findings, summary }
    # Settlement (tx hash, payer) rides back in the PAYMENT-RESPONSE header:
    if "payment-response" in paid.headers:
        print("settlement", json.loads(base64.b64decode(paid.headers["payment-response"])))