# 1. Fetch live store ERC-8004 agent card
curl -s https://go.cart.fun/api/v1/stores/base-sepolia/3/agent | jq .

# 2. Query public catalog
curl -s https://go.cart.fun/api/v1/stores/base-sepolia/3/products | jq .

import { createWalletClient, http, parseAbi, erc20Abi } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { baseSepolia } from "viem/chains";

const account = privateKeyToAccount(process.env.BUYER_PRIVATE_KEY as `0x${string}`);
const wallet = createWalletClient({ account, chain: baseSepolia, transport: http() });

const API = "https://go.cart.fun";
// V3 orders (quote.version 3). V4 orders (quote.version 4) end with "bytes32 linesHash" in the struct.
const CHECKOUT_ABI = parseAbi([
  "struct Order { uint16 storeId; address buyer; address paymentToken; uint256 amount; uint256 serviceFee; bytes32 itemsHash; uint256 nonce; uint256 deadline; uint32 escrowHold; uint256 relayFee; }",
  "struct Item { uint8 kind; address token; uint256 id; uint256 amount; }",
  "function checkout(Order order, Item[] items, address cartRecipient, bytes signature) returns (uint256 receiptId, uint256 cartId)",
]);
const CHECKOUT_ABI_V4 = parseAbi([
  "struct Order { uint16 storeId; address buyer; address paymentToken; uint256 amount; uint256 serviceFee; bytes32 itemsHash; uint256 nonce; uint256 deadline; uint32 escrowHold; uint256 relayFee; bytes32 linesHash; }",
  "struct Item { uint8 kind; address token; uint256 id; uint256 amount; }",
  "function checkout(Order order, Item[] items, address cartRecipient, bytes signature) returns (uint256 receiptId, uint256 cartId)",
]);

// 1. Request signed price quote from cart.fun API
const quote = await fetch(`${API}/api/v1/orders`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    chainId: 84532,
    storeId: 3,
    buyer: account.address,
    lines: [{ id: 1, quantity: 1 }]
  }),
}).then((r) => r.json());

const o = quote.order;
const order = {
  ...o,
  amount: BigInt(o.amount),
  serviceFee: BigInt(o.serviceFee),
  nonce: BigInt(o.nonce),
  deadline: BigInt(o.deadline),
  relayFee: BigInt(o.relayFee)
};
const items = quote.items.map((i: any) => ({
  ...i,
  id: BigInt(i.id),
  amount: BigInt(i.amount)
}));

// 2. Approve Payment Token
await wallet.writeContract({
  address: o.paymentToken,
  abi: erc20Abi,
  functionName: "approve",
  args: [quote.checkout, order.amount + order.serviceFee + order.relayFee],
});

// 3. Submit Checkout Transaction
const txHash = await wallet.writeContract({
  address: quote.checkout,
  abi: quote.version === 4 ? CHECKOUT_ABI_V4 : CHECKOUT_ABI,
  functionName: "checkout",
  args: [order, items, account.address, quote.signature],
});

console.log("Checkout transaction confirmed:", txHash);

curl -X POST https://go.cart.fun/api/v1/stores/base-sepolia/3/products \
  -H "Authorization: Bearer cf_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"products": [{"name": "Digital License NFT", "type": "license", "price": "19.99", "active": true}]}'

// Node: verify a cart.fun webhook before trusting it
import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyCartfun(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false; // stale: possible replay
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const given = Buffer.from(parts.v1 ?? "", "hex");
  return given.length === 32 && timingSafeEqual(given, Buffer.from(expected, "hex"));
}

// verifyCartfun(await req.text(), req.headers.get("cartfun-signature"), process.env.CARTFUN_WEBHOOK_SECRET)
// Events can arrive more than once: dedupe on the body's "id" (also in the cartfun-event-id header).

curl https://go.cart.fun/api/v1/receipts/base-sepolia/12