The machine store —
a store built for AI agents.

#!/usr/bin/env bash
# x402 by hand, in two curls — see the 402, then pay it.
# Endpoint: POST https://x402.fablerlabs.com/audit/agent-config
#           (scores a CLAUDE.md / CONSTITUTION.md 0–100; see x402/src/engines/audit.ts)
#
# curl cannot itself sign an EIP-3009 payment authorization, so step 2 sends an
# X-PAYMENT header you produced with a real signer (see node-x402-fetch.mjs /
# python-httpx.py). Put that base64 header in X402_PAYMENT. NEVER a private key.
set -euo pipefail
URL="https://x402.fablerlabs.com/audit/agent-config"
BODY='{"content":"# CLAUDE.md\n\n## Commands\nnpm test\n","kind":"claude-md"}'

# 1) Unpaid request → 402 Payment Required. The body advertises the payment
#    requirements (network, USDC asset, amount, payTo) you need to sign.
echo "── 1. unpaid request → expect HTTP 402 ──"
curl -sS -w '\nHTTP %{http_code}\n' \
  -X POST "$URL" -H 'Content-Type: application/json' -d "$BODY" || true

# 2) Retry with the signed payment header → 200 and the JSON audit result.
if [ -n "${X402_PAYMENT:-}" ]; then
  echo "── 2. paid retry → expect HTTP 200 ──"
  curl -sS -w '\nHTTP %{http_code}\n' \
    -X POST "$URL" -H 'Content-Type: application/json' \
    -H "X-PAYMENT: $X402_PAYMENT" -d "$BODY"
else
  echo "set X402_PAYMENT=<base64 X-PAYMENT header> to run the paid retry" >&2
fi

// node-x402-fetch.mjs — pay an x402 endpoint from Node in ~10 lines.
// One-time:  npm i x402-fetch viem     (Node 18+, ESM: file ends in .mjs)
// Env:       X402_PRIVATE_KEY = hex key of a funded Base wallet (USDC + a little
//            ETH for the facilitator). NEVER hard-code or commit a key; use a
//            low-balance, single-purpose agent wallet.
import { wrapFetchWithPayment } from "x402-fetch";
import { privateKeyToAccount } from "viem/accounts";

const key = process.env.X402_PRIVATE_KEY;
if (!key) throw new Error("set X402_PRIVATE_KEY to a funded Base wallet key");
const account = privateKeyToAccount(key.startsWith("0x") ? key : `0x${key}`);

// wrapFetchWithPayment intercepts any 402, signs the EIP-3009 authorization
// with `account`, and transparently retries with the X-PAYMENT header.
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://x402.fablerlabs.com/audit/agent-config", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    content: "# CLAUDE.md\n\n## Commands\nnpm test\n",
    kind: "claude-md",          // or "constitution"
  }),
});

console.log("HTTP", res.status);
console.log(await res.json());   // { score, findings, summary }

# python-httpx.py — pay an x402 endpoint with a hand-built EIP-3009 authorization.
# One-time:  pip install httpx eth-account
# Env:       X402_PRIVATE_KEY = hex key of a funded Base wallet (USDC + a little gas).
#            NEVER hard-code or commit a key; use a low-balance agent wallet.
import base64, json, os, secrets, time, httpx
from eth_account import Account
from eth_utils import to_hex

URL = "https://x402.fablerlabs.com/audit/agent-config"
BODY = {"content": "# CLAUDE.md\n\n## Commands\nnpm test\n", "kind": "claude-md"}
acct = Account.from_key(os.environ["X402_PRIVATE_KEY"])

with httpx.Client(timeout=30) as c:
    r = c.post(URL, json=BODY)                       # 1) unpaid → 402 + requirements
    if r.status_code != 402:
        raise SystemExit(f"expected 402, got {r.status_code}: {r.text[:200]}")
    req = r.json()["accepts"][0]                      # first advertised payment method

    # 2) Sign a TransferWithAuthorization (EIP-3009) for exactly the asked amount.
    nonce = secrets.token_bytes(32)
    auth = {"from": acct.address, "to": req["payTo"],
            "value": int(req["maxAmountRequired"]), "validAfter": 0,
            "validBefore": int(time.time()) + int(req["maxTimeoutSeconds"]),
            "nonce": to_hex(nonce)}
    typed = {"primaryType": "TransferWithAuthorization",
             "types": {"TransferWithAuthorization": [
                 {"name": "from", "type": "address"}, {"name": "to", "type": "address"},
                 {"name": "value", "type": "uint256"}, {"name": "validAfter", "type": "uint256"},
                 {"name": "validBefore", "type": "uint256"}, {"name": "nonce", "type": "bytes32"}]},
             "domain": {"name": req["extra"]["name"], "version": req["extra"]["version"],
                        "chainId": 8453, "verifyingContract": req["asset"]},  # 8453 = Base
             "message": {**auth, "nonce": nonce}}     # sign nonce as raw bytes32
    sig = to_hex(Account.sign_typed_data(acct.key, full_message=typed).signature)

    # 3) Base64 the X-PAYMENT header and retry → 200 + the JSON audit result.
    payment = {"x402Version": 1, "scheme": req["scheme"], "network": req["network"],
               "payload": {"signature": sig, "authorization": auth}}
    header = base64.b64encode(json.dumps(payment).encode()).decode()
    paid = c.post(URL, json=BODY, headers={"X-PAYMENT": header})
    print("HTTP", paid.status_code, paid.json())      # → { score, findings, summary }