# AuctionTrace autonomous buyer client

This client performs the complete Release 008 purchase operation:

1. reads the live catalog from `https://api.auctiontrace.com`;
2. accepts only x402 v2 exact payment on Base mainnet using canonical Base USDC;
3. refuses any price above $5.00 USDC;
4. pays the protected Release 008 access route;
5. downloads the time-limited private ZIP;
6. verifies its byte size and SHA-256 against the catalog; and
7. verifies every inner package file against `manifest.json`; and
8. emits a machine-readable receipt without printing the private key, payer
   address, signed download URL, or local output path.

It uses the standard x402 payment flow. AuctionTrace does not require a
proprietary payment-identifier extension.

## Run

Create an empty directory and download the four exact client files:

```sh
mkdir auctiontrace-buyer-client
cd auctiontrace-buyer-client
curl --fail --remote-name https://api.auctiontrace.com/buyer-client/package.json
curl --fail --remote-name https://api.auctiontrace.com/buyer-client/package-lock.json
curl --fail --remote-name https://api.auctiontrace.com/buyer-client/tsconfig.json
curl --fail --remote-name https://api.auctiontrace.com/buyer-client/purchase.ts
```

Then install the locked dependencies and run:

```sh
npm ci --ignore-scripts
AUCTIONTRACE_BUYER_PRIVATE_KEY=0x... npm run purchase -- --output auctiontrace-release-008.zip
```

The wallet must be able to pay $5.00 USDC on Base mainnet and any required
network fee. The private key is read only from
`AUCTIONTRACE_BUYER_PRIVATE_KEY`; do not put it in command history, source
files, support messages, questionnaire responses, or logs.

An agent with a separately trusted recipient allowlist can add:

```sh
npm run purchase -- --output auctiontrace-release-008.zip --expected-pay-to 0x...
```

The command refuses to overwrite an existing file and exits nonzero on a
catalog, payment, download, or integrity mismatch.

Support: `help@auctiontrace.com`. Send the returned `payment_id`, public
transaction hash, UTC failure time, and sanitized error text. Never send a
private key, signed payment payload, bearer token, proprietary strategy code,
private network address, or local filesystem path.