Integrate the Purchase API into an iMessage agent

git clone https://github.com/tiny-agent-company/purchase-imessage-agent my-shopping-agent
cd my-shopping-agent
npm install
cp .env.example .env.local

curl -X PUT https://api.linqapp.com/api/partner/v3/webhook-subscriptions/$SUBSCRIPTION_ID \
  -H "Authorization: Bearer $LINQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target_url": "https://my-shopping-agent.vercel.app/eve/v1/linq"}'

const c = await agentcard<{ access_token: string; refresh_token: string; expires_in: number; user: { id: string } }>(
  "POST",
  `/api/v2/vault_sessions/${vaultSessionId}/exchange`,
);
await saveConnection(phone, {
  user_id: c.user.id,
  access_token: c.access_token,
  refresh_token: c.refresh_token,
  expires_at: Date.now() + c.expires_in * 1000,
});

const attempt = await agentcard<{ id: string; channel: string; expires_at: string }>(
  "POST",
  "/api/v2/connect/start",
  email ? { email } : { phone }, // email only when the user says the text never came
);
await rememberConnectAttempt(phone, attempt.id); // ten minutes, keyed by phone

const conn = await userToken(phone);
if (!conn) return { status: "not_connected", next: "Call connect_user, then verify_code." };

const body: Record<string, unknown> = {};
if (conversation_id) body.conversation_id = conversation_id;
if (confirm) {
  body.confirm = confirm;            // the cart hash from a previous turn
  body.payment_source = "vault";     // the user's own card, approved with their passkey
} else {
  body.ask = ask;                    // what the user said, in their words
}
const r = await agentcardAs<BuyResponse>(conn.access_token, "POST", "/buy", body);

return {
  status: r.status,
  conversation_id: r.conversation_id,
  reply: r.reply,
  cart: r.cart ? summarize(r.cart) : null,   // lines as "1 × name ($24.99)", fees, total, hash
  products,                                  // name, price, url, image_url
  approval_link_sent,
  decline_code: r.decline_code ?? undefined,
  order_id: r.order_id ?? undefined,
  payment_source: r.payment_source ?? undefined,
};

export async function sendMedia(to: string, url: string): Promise<void> {
  await linq("POST", "/chats", {
    from: await senderNumber(),
    to: [to],
    message: { parts: [{ type: "media", url }] },
  });
}

const conn = await userToken(await phoneOf(ctx));
const r = await agentcard<{ data?: VaultCard[] }>(
  "GET",
  `/api/v2/vault_cards?user_id=${encodeURIComponent(conn.user_id)}`,
);

const session = await agentcard<VaultSession>("POST", "/api/v2/vault_sessions", { user_id: conn.user_id });
await rememberVaultSession(session.id, ctx.session.id); // for the card-stored webhook, as in the first guide
await sendText(phone, session.url);                      // the link, alone in its own bubble

if (r.approval_url) {
  await sendText(phone, r.approval_url);
  approvalLinkSent = true;
  const id = new URL(r.approval_url).searchParams.get("id"); // cauth_…
  if (id && confirm) {
    await rememberApproval(id, { eveSessionId: ctx.session.id, conversationId: r.conversation_id, hash: confirm });
  }
}

{
  "type": "checkout_authorization.approved",
  "livemode": true,
  "data": {
    "authorization_id": "cauth_80a08296fda037b12d62c351",
    "user_id": "usr_…",
    "merchant": "Amazon, Walmart, Target & Best Buy",
    "amount": 3644,
    "amount_display": "$36.44",
    "psp": "stripe",
    "mode": "token"
  }
}

if (event.type.startsWith("checkout_authorization.")) {
  const authId = String(event.data.authorization_id ?? "");
  const pending = authId ? await approvalFor(authId) : null;
  if (!pending) return new Response("ok"); // not one of this agent's confirms
  const text = approvalNote(event, pending);
  if (text) waitUntil(attachSession(pending.eveSessionId).send(text, { auth: WEBHOOK_AUTH }));
  return new Response("ok");
}

const inProgress = r.decline_code === "in_progress" || (r.status === "error" && !r.decline_code);
if (confirm && inProgress) {
  await new Promise((res) => setTimeout(res, 12_000));
  const conv = await agentcardAs<Conversation>(conn.access_token, "GET", `/buy/conversations/${r.conversation_id}`);
  const orderId = conv.last_checkout?.order_id ?? conv.orders?.filter((o) => o.status !== "failed" && o.status !== "cancelled").at(-1)?.order_id;
  if (orderId) return { status: "order_placed", conversation_id: r.conversation_id, order_id: orderId, cart: summarize(r.cart) };
}

export async function phoneOf(ctx): Promise<string> {
  const phone = ctx.session.auth.current?.attributes?.user_name;
  if (typeof phone === "string" && phone) {
    await rememberPhone(ctx.session.id, phone).catch(() => undefined);
    return phone;
  }
  const remembered = await phoneForSession(ctx.session.id);
  if (remembered) return remembered;
  throw new Error("No phone number on this conversation");
}

buy me a 20 oz bag of whole bean coffee from amazon