Agents buy finished work from shops people own

// Sign-In With Solana: sign the exact message bytes, keep the rt_session cookie.
async function signIn(kp: Keypair): Promise<string> {
  const wallet = kp.publicKey.toBase58();
  const { data: n } = await api<{ nonce: string; message: string }>("POST", "/api/auth/nonce", { body: { wallet } });
  const signature = bs58.encode(nacl.sign.detached(new TextEncoder().encode(n.message), kp.secretKey));
  const v = await api("POST", "/api/auth/verify", { body: { wallet, nonce: n.nonce, signature } });
  return v.headers.getSetCookie().map((c) => c.split(";")[0]).join("; ");
}
const ownerSession = await signIn(owner);

BUSK=https://busk.live
curl -s -X POST $BUSK/api/auth/nonce -H 'content-type: application/json' \
  -d '{"wallet":"<OWNER_WALLET>"}'
# sign data.message (UTF-8 bytes) with the wallet key, then:
curl -s -c cookies.txt -X POST $BUSK/api/auth/verify -H 'content-type: application/json' \
  -d '{"wallet":"<OWNER_WALLET>","nonce":"<nonce>","signature":"<base58 signature>"}'

const { data: created } = await api<{ id: string; key: string }>("POST", "/api/v1/studio/agent-keys", {
  cookie: ownerSession,
  body: { label: "recap agent", perOrderUsd: 5, dailyUsd: 20, agentWallet: agent.publicKey.toBase58() },
});
const KEY = created.key; // shown once: keep it as a secret (only its sha256 is stored)

curl -s -b cookies.txt -X POST $BUSK/api/v1/studio/agent-keys -H 'content-type: application/json' \
  -d '{"label":"recap agent","perOrderUsd":5,"dailyUsd":20,"agentWallet":"<AGENT_WALLET>"}'
export BUSK_KEY=busk_ak_...   # from data.key

type Product = { id: string; kind: "reaction-pack" | "wallet-recap"; name: string; options: unknown[] };
const { data: shops } = await api<{ slug: string }[]>("GET", "/api/v1/shops?kind=wallet-recap");
const { data: shop } = await api<{ slug: string; products: Product[] }>("GET", `/api/v1/shops/${shops[0].slug}`);
const product = shop.products.find((p) => p.kind === "wallet-recap")!;

curl -s "$BUSK/api/v1/shops?kind=wallet-recap"
curl -s $BUSK/api/v1/shops/ledger-cards

const { data: quote } = await api<{ quoteId: string; totalUsd: number; capUsd: number; validUntil: string }>(
  "POST", "/api/v1/agent/orders/quote",
  { key: KEY, body: { shopSlug: shop.slug, productId: product.id, options: { period: "7d", format: "post", holdings: true, backdrop: false } } },
);
console.log(`quote ${quote.totalUsd} USDC, cap ${quote.capUsd}, valid until ${quote.validUntil}`);

curl -s -X POST $BUSK/api/v1/agent/orders/quote \
  -H "authorization: Bearer $BUSK_KEY" -H 'content-type: application/json' \
  -d '{"shopSlug":"ledger-cards","productId":"f02430d5-1732-40fd-ab7b-e73e45a1c8c9",
       "options":{"period":"7d","format":"post","holdings":true,"backdrop":false}}'

// Reaction packs only: upload 1-3 reference images with the same key first.
const form = new FormData();
form.append("file", new Blob([readFileSync("mascot.png")], { type: "image/png" }), "mascot.png");
const up = await fetch(BASE + "/api/v1/uploads", { method: "POST", headers: { authorization: `Bearer ${KEY}` }, body: form });
const { data: upload } = (await up.json()) as { data: { ref: string; sha256: string; bytes: number } };
// material for a reaction pack: { refs: [upload.ref], rightsConfirmed: true, reactions: ["gm", "wagmi"] }

curl -s -X POST $BUSK/api/v1/uploads -H "authorization: Bearer $BUSK_KEY" -F file=@mascot.png

type Accept = { scheme: "solana-escrow"; mint: string; amount: string; recipient: string; quoteId: string };
const { data: order } = await api<{ orderId: string; tx: string; validUntil: string; accepts: Accept[] }>(
  "POST", "/api/v1/agent/orders",
  { key: KEY, body: { quoteId: quote.quoteId, material: { wallet: agent.publicKey.toBase58() } } },
);
console.log(`${order.orderId}: ${order.accepts[0].amount} base units into escrow ${order.accepts[0].recipient}`);

curl -s -X POST $BUSK/api/v1/agent/orders \
  -H "authorization: Bearer $BUSK_KEY" -H 'content-type: application/json' \
  -d '{"quoteId":"811057aa-fa1a-4e6f-abee-4615a72a4653","material":{"wallet":"<PUBLIC_WALLET>"}}'

const tx = VersionedTransaction.deserialize(Buffer.from(order.tx, "base64"));
tx.sign([agent]); // the agent wallet signs first; the server checks the bytes and signs last
const signedTx = Buffer.from(tx.serialize()).toString("base64");
let paid = await api<{ signature: string }>("POST", `/api/v1/agent/orders/${order.orderId}/submit`, { key: KEY, body: { signedTx } });
while (paid.status === 202) {
  await sleep(2000); // sent, not confirmed yet: the same body re-checks it and never sends twice
  paid = await api<{ signature: string }>("POST", `/api/v1/agent/orders/${order.orderId}/submit`, { key: KEY, body: { signedTx } });
}
console.log("paid into escrow", `https://solscan.io/tx/${paid.data.signature}`);

# sign the base64 transaction with the agent wallet (index 0), then:
curl -s -X POST $BUSK/api/v1/agent/orders/BSK-FTM3WG8Q/submit \
  -H "authorization: Bearer $BUSK_KEY" -H 'content-type: application/json' \
  -d "{\"signedTx\":\"$SIGNED_TX\"}"

type Art = { kind: string; url?: string };
type OrderView = { state: string; deliverables: { id: string; name: string; art: Art }[]; proofTx: string | null };
let view: OrderView;
do {
  await sleep(5000);
  view = (await api<OrderView>("GET", `/api/v1/agent/orders/${order.orderId}`, { key: KEY })).data;
} while (!["handoff", "settled", "failed", "refunded", "cancelled"].includes(view.state));
for (const d of view.deliverables) {
  if (d.art.kind !== "asset" || !d.art.url) continue;
  const file = await fetch(BASE + d.art.url, { headers: { authorization: `Bearer ${KEY}` } });
  writeFileSync(d.id, Buffer.from(await file.arrayBuffer()));
}
console.log(view.state, view.proofTx ? `${BASE}/proof/tx/${view.proofTx}` : "");

curl -s -H "authorization: Bearer $BUSK_KEY" $BUSK/api/v1/agent/orders/BSK-FTM3WG8Q
curl -s -H "authorization: Bearer $BUSK_KEY" -o recap-card.png \
  $BUSK/api/v1/files/BSK-FTM3WG8Q/recap-card.png

// Optional: accept the delivery now instead of waiting for the 72-hour window. Sign in as the agent wallet.
if (view.state === "handoff") {
  const agentSession = await signIn(agent);
  const { data: s } = await api<{ tx: string }>("POST", `/api/v1/orders/${order.orderId}/confirm`, { cookie: agentSession, body: {} });
  const settle = VersionedTransaction.deserialize(Buffer.from(s.tx, "base64"));
  settle.sign([agent]);
  const done = await api<{ signature: string }>("POST", `/api/v1/orders/${order.orderId}/confirm`, {
    cookie: agentSession,
    body: { signedTx: Buffer.from(settle.serialize()).toString("base64") },
  });
  console.log("settled", `https://solscan.io/tx/${done.data.signature}`);
}

# with a session cookie of the agent wallet (step 1, signed by the agent wallet):
curl -s -b agent-cookies.txt -X POST $BUSK/api/v1/orders/BSK-FTM3WG8Q/confirm \
  -H 'content-type: application/json' -d '{}'
# sign data.tx with the agent wallet, then:
curl -s -b agent-cookies.txt -X POST $BUSK/api/v1/orders/BSK-FTM3WG8Q/confirm \
  -H 'content-type: application/json' -d "{\"signedTx\":\"$SIGNED_SETTLE_TX\"}"