SuperAPI

import crypto from "crypto";

const BASE = "https://marketplace-prod.anyway.sh";
// ── Parse Agent Wallet Key ────────────────────────────────
const key = JSON.parse(
  Buffer.from(process.env.ANYWAY_AGENT_WALLET_KEY, "base64").toString()
);

// ── Auth helpers ─────────────────────────────────────────

const privateKey = crypto.createPrivateKey({
  key: Buffer.from(key.privateKey, "base64"), type: "pkcs8", format: "der",
});
const pubkey = crypto.createPublicKey(privateKey)
  .export({ type: "spki", format: "der" }).toString("base64");

const sign = (data) => crypto.sign("sha256", Buffer.from(data),
  { key: privateKey, dsaEncoding: "der" }).toString("base64");

// Agent API auth: P-256 sig over "METHOD\nPATH\nTIMESTAMP"
function authHeaders(method, path) {
  const ts = String(Math.floor(Date.now() / 1000));
  return {
    "Content-Type": "application/json",
    "X-Agent-Pubkey": pubkey,
    "X-Agent-Timestamp": ts,
    "X-Agent-Signature": sign(`${method}\n${path}\n${ts}`),
  };
}

// ⚠️ Privy auth sig MUST be JCS-canonicalized (sorted keys), not JSON.stringify
function jcs(v) {
  if (v === null || typeof v !== "object") return JSON.stringify(v);
  if (Array.isArray(v)) return `[${v.map(jcs).join(",")}]`;
  return `{${Object.keys(v).sort().map(k => `${JSON.stringify(k)}:${jcs(v[k])}`).join(",")}}`;
}

// ── Payment flow ─────────────────────────────────────────

// 1. Get wallet info from API
const { data: wallet } = await (await fetch("https://app-prod.anyway.sh/v1/agent-wallet",
  { headers: authHeaders("GET", "/v1/agent-wallet") })).json();

// 2. Call SuperAPI endpoint → 402 challenge
//    GET endpoints  (e.g. twit-sh, robtex): params in URL query string
//    POST endpoints (e.g. stableenrich, tx402): params in JSON body
//    Always check /v1/api/info/{service_id} for the correct method.
const url = `${BASE}/v1/api/x402/twit-sh/tweets/search?words=bitcoin&count=5`;
const res = await fetch(url);
const challenge = JSON.parse(
  Buffer.from(res.headers.get("payment-required"), "base64").toString()
);
const accepted = challenge.accepts[0];

// 3. Build EIP-712 typed data from challenge
const typedData = {
  domain: {
    name: accepted.extra.name, version: accepted.extra.version,
    chainId: Number(accepted.network.split(":")[1]),
    verifyingContract: accepted.asset,
  },
  types: { // ⚠️ Must include BOTH EIP712Domain and TransferWithAuthorization
    EIP712Domain: [
      { name: "name", type: "string" }, { name: "version", type: "string" },
      { name: "chainId", type: "uint256" }, { name: "verifyingContract", type: "address" },
    ],
    TransferWithAuthorization: [
      { name: "from", type: "address" }, { name: "to", type: "address" },
      { name: "value", type: "uint256" }, { name: "validAfter", type: "uint256" },
      { name: "validBefore", type: "uint256" }, { name: "nonce", type: "bytes32" },
    ],
  },
  primary_type: "TransferWithAuthorization", // ⚠️ must be snake_case
  message: {
    from: wallet.walletAddress, to: accepted.payTo, value: accepted.amount,
    validAfter: "0", validBefore: String(Math.floor(Date.now() / 1000) + 600),
    nonce: "0x" + crypto.randomBytes(32).toString("hex"),
  },
};

// 4. Sign via Anyway Wallet
//    - Privy auth sig = P-256 over JCS-canonicalized CAIP-222 payload
//    - Agent auth headers = P-256 over "POST\n/path\ntimestamp"
const privySig = sign(jcs({
  version: 1, method: "POST",
  url: `https://api.privy.io/v1/wallets/${wallet.providerWalletId}/rpc`, // ⚠️ exact path must be /rpc
  body: { method: "eth_signTypedData_v4", params: { typed_data: typedData } },
  headers: { "privy-app-id": wallet.appId },
}));
const signPath = "/v1/agent-wallet/sign-typed-data";
const { data: { signature } } = await (await fetch(`https://app-prod.anyway.sh${signPath}`, {
  method: "POST", headers: authHeaders("POST", signPath),
  body: JSON.stringify({ typed_data: typedData, signature: privySig }),
})).json();

// 5. Retry with PAYMENT-SIGNATURE → get result
const settled = await fetch(url, {
  headers: {
    "PAYMENT-SIGNATURE": Buffer.from(JSON.stringify({
      x402Version: 2, scheme: accepted.scheme, network: accepted.network,
      accepted, payload: { signature, authorization: typedData.message },
    })).toString("base64"),
  },
});
console.log(await settled.json());