@agentlayer.tech/wallet 0.1.13 → 0.1.15

package/.openclaw/extensions/pay-bridge/dist/index.js

@@ -0,0 +1,196 @@
+import {
+  executePayApiRequest,
+  getPayServiceEndpoints,
+  getPayStatus,
+  getPayWalletInfo,
+  searchPayServices,
+} from "./core.mjs";
+
+const PLUGIN_ID = "pay-bridge";
+
+function asContent(data) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify(data, null, 2),
+      },
+    ],
+  };
+}
+
+function resolvePluginConfig(api) {
+  const globalConfig = api?.config ?? {};
+  const pluginEntry = globalConfig?.plugins?.entries?.[PLUGIN_ID];
+  return pluginEntry?.config ?? globalConfig?.config ?? {};
+}
+
+function registerTool(api, definition) {
+  api.registerTool({
+    name: definition.name,
+    description: definition.description,
+    parameters: definition.parameters,
+    returns: {
+      type: "object",
+      additionalProperties: true,
+    },
+    async execute(_id, params = {}) {
+      const config = resolvePluginConfig(api);
+      let result;
+      if (definition.name === "pay_status") {
+        result = await getPayStatus(config, { cwd: process.cwd() });
+      } else if (definition.name === "pay_wallet_info") {
+        result = await getPayWalletInfo(config, { cwd: process.cwd() });
+      } else if (definition.name === "pay_search_services") {
+        result = await searchPayServices(config, params, { cwd: process.cwd() });
+      } else if (definition.name === "pay_get_service_endpoints") {
+        result = await getPayServiceEndpoints(config, params, { cwd: process.cwd() });
+      } else if (definition.name === "pay_api_request") {
+        result = await executePayApiRequest(config, params, { cwd: process.cwd() });
+      } else {
+        throw new Error(`Unsupported pay-bridge tool: ${definition.name}`);
+      }
+      return asContent(result);
+    },
+  });
+}
+
+const toolDefinitions = [
+  {
+    name: "pay_status",
+    description:
+      "Check whether the local pay.sh CLI is installed and whether a pay wallet/account is configured. Use this before any paid API workflow.",
+    parameters: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "pay_wallet_info",
+    description:
+      "Show pay wallet/account status. This wallet is separate from the AgentLayer execution wallet and is only for pay.sh API payments.",
+    parameters: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "pay_search_services",
+    description:
+      "Search the pay.sh skills catalog for paid APIs. Prefer this instead of guessing URLs manually.",
+    parameters: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description: "Search text for service names, descriptions, or endpoint paths.",
+        },
+        category: {
+          type: "string",
+          description: "Optional category filter such as ai_ml, maps, data, compute, search, crypto_finance.",
+        },
+        account: {
+          type: "string",
+          description: "Optional pay account override.",
+        },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "pay_get_service_endpoints",
+    description:
+      "List the discoverable endpoints for a pay.sh service/resource pair and return their gateway URLs. Use the returned URL with pay_api_request.",
+    parameters: {
+      type: "object",
+      properties: {
+        service_fqn: {
+          type: "string",
+          description: "Fully qualified pay service name, for example solana-foundation/google/language.",
+        },
+        resource: {
+          type: "string",
+          description: "Resource name inside the service, for example entities or jobs.",
+        },
+        account: {
+          type: "string",
+          description: "Optional pay account override.",
+        },
+      },
+      required: ["service_fqn", "resource"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "pay_api_request",
+    description:
+      "Call a paid API through the local pay.sh CLI using a URL returned by pay_get_service_endpoints. Requires explicit user_confirmed=true and keeps the pay wallet separate from AgentLayer execution wallets.",
+    optional: true,
+    parameters: {
+      type: "object",
+      properties: {
+        service_fqn: {
+          type: "string",
+          description: "Fully qualified pay service name used to validate the request URL.",
+        },
+        resource: {
+          type: "string",
+          description: "Resource name used to validate the request URL.",
+        },
+        url: {
+          type: "string",
+          description: "Exact HTTPS gateway URL returned by pay_get_service_endpoints.",
+        },
+        method: {
+          type: "string",
+          description: "HTTP method such as GET or POST.",
+        },
+        headers: {
+          type: "object",
+          additionalProperties: { type: "string" },
+          description: "Optional HTTP headers.",
+        },
+        query: {
+          type: "object",
+          additionalProperties: true,
+          description: "Optional query parameters to append to the URL.",
+        },
+        json_body: {
+          description: "Optional JSON request body.",
+        },
+        text_body: {
+          type: "string",
+          description: "Optional raw text request body. Do not provide with json_body.",
+        },
+        account: {
+          type: "string",
+          description: "Optional pay account override.",
+        },
+        parse_json_response: {
+          type: "boolean",
+          description: "If true, attempt to parse the response body as JSON.",
+        },
+        purpose: {
+          type: "string",
+          description: "Short user-facing reason for this paid API call.",
+        },
+        user_confirmed: {
+          type: "boolean",
+          description: "Must be true for paid API requests.",
+        },
+      },
+      required: ["service_fqn", "resource", "url", "method", "purpose", "user_confirmed"],
+      additionalProperties: false,
+    },
+  },
+];
+
+export default function registerPayBridgePlugin(api) {
+  api?.logger?.info?.("[pay-bridge] registering pay.sh OpenClaw plugin");
+  for (const definition of toolDefinitions) {
+    registerTool(api, definition);
+  }
+  api?.logger?.info?.(`[pay-bridge] registered ${toolDefinitions.length} pay tools`);
+}

package/.openclaw/extensions/pay-bridge/index.ts

@@ -0,0 +1,196 @@
+import {
+  executePayApiRequest,
+  getPayServiceEndpoints,
+  getPayStatus,
+  getPayWalletInfo,
+  searchPayServices,
+} from "./core.mjs";
+
+const PLUGIN_ID = "pay-bridge";
+
+function asContent(data) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify(data, null, 2),
+      },
+    ],
+  };
+}
+
+function resolvePluginConfig(api) {
+  const globalConfig = api?.config ?? {};
+  const pluginEntry = globalConfig?.plugins?.entries?.[PLUGIN_ID];
+  return pluginEntry?.config ?? globalConfig?.config ?? {};
+}
+
+function registerTool(api, definition) {
+  api.registerTool({
+    name: definition.name,
+    description: definition.description,
+    parameters: definition.parameters,
+    returns: {
+      type: "object",
+      additionalProperties: true,
+    },
+    async execute(_id, params = {}) {
+      const config = resolvePluginConfig(api);
+      let result;
+      if (definition.name === "pay_status") {
+        result = await getPayStatus(config, { cwd: process.cwd() });
+      } else if (definition.name === "pay_wallet_info") {
+        result = await getPayWalletInfo(config, { cwd: process.cwd() });
+      } else if (definition.name === "pay_search_services") {
+        result = await searchPayServices(config, params, { cwd: process.cwd() });
+      } else if (definition.name === "pay_get_service_endpoints") {
+        result = await getPayServiceEndpoints(config, params, { cwd: process.cwd() });
+      } else if (definition.name === "pay_api_request") {
+        result = await executePayApiRequest(config, params, { cwd: process.cwd() });
+      } else {
+        throw new Error(`Unsupported pay-bridge tool: ${definition.name}`);
+      }
+      return asContent(result);
+    },
+  });
+}
+
+const toolDefinitions = [
+  {
+    name: "pay_status",
+    description:
+      "Check whether the local pay.sh CLI is installed and whether a pay wallet/account is configured. Use this before any paid API workflow.",
+    parameters: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "pay_wallet_info",
+    description:
+      "Show pay wallet/account status. This wallet is separate from the AgentLayer execution wallet and is only for pay.sh API payments.",
+    parameters: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "pay_search_services",
+    description:
+      "Search the pay.sh skills catalog for paid APIs. Prefer this instead of guessing URLs manually.",
+    parameters: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description: "Search text for service names, descriptions, or endpoint paths.",
+        },
+        category: {
+          type: "string",
+          description: "Optional category filter such as ai_ml, maps, data, compute, search, crypto_finance.",
+        },
+        account: {
+          type: "string",
+          description: "Optional pay account override.",
+        },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "pay_get_service_endpoints",
+    description:
+      "List the discoverable endpoints for a pay.sh service/resource pair and return their gateway URLs. Use the returned URL with pay_api_request.",
+    parameters: {
+      type: "object",
+      properties: {
+        service_fqn: {
+          type: "string",
+          description: "Fully qualified pay service name, for example solana-foundation/google/language.",
+        },
+        resource: {
+          type: "string",
+          description: "Resource name inside the service, for example entities or jobs.",
+        },
+        account: {
+          type: "string",
+          description: "Optional pay account override.",
+        },
+      },
+      required: ["service_fqn", "resource"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "pay_api_request",
+    description:
+      "Call a paid API through the local pay.sh CLI using a URL returned by pay_get_service_endpoints. Requires explicit user_confirmed=true and keeps the pay wallet separate from AgentLayer execution wallets.",
+    optional: true,
+    parameters: {
+      type: "object",
+      properties: {
+        service_fqn: {
+          type: "string",
+          description: "Fully qualified pay service name used to validate the request URL.",
+        },
+        resource: {
+          type: "string",
+          description: "Resource name used to validate the request URL.",
+        },
+        url: {
+          type: "string",
+          description: "Exact HTTPS gateway URL returned by pay_get_service_endpoints.",
+        },
+        method: {
+          type: "string",
+          description: "HTTP method such as GET or POST.",
+        },
+        headers: {
+          type: "object",
+          additionalProperties: { type: "string" },
+          description: "Optional HTTP headers.",
+        },
+        query: {
+          type: "object",
+          additionalProperties: true,
+          description: "Optional query parameters to append to the URL.",
+        },
+        json_body: {
+          description: "Optional JSON request body.",
+        },
+        text_body: {
+          type: "string",
+          description: "Optional raw text request body. Do not provide with json_body.",
+        },
+        account: {
+          type: "string",
+          description: "Optional pay account override.",
+        },
+        parse_json_response: {
+          type: "boolean",
+          description: "If true, attempt to parse the response body as JSON.",
+        },
+        purpose: {
+          type: "string",
+          description: "Short user-facing reason for this paid API call.",
+        },
+        user_confirmed: {
+          type: "boolean",
+          description: "Must be true for paid API requests.",
+        },
+      },
+      required: ["service_fqn", "resource", "url", "method", "purpose", "user_confirmed"],
+      additionalProperties: false,
+    },
+  },
+];
+
+export default function registerPayBridgePlugin(api) {
+  api?.logger?.info?.("[pay-bridge] registering pay.sh OpenClaw plugin");
+  for (const definition of toolDefinitions) {
+    registerTool(api, definition);
+  }
+  api?.logger?.info?.(`[pay-bridge] registered ${toolDefinitions.length} pay tools`);
+}

package/.openclaw/extensions/pay-bridge/openclaw.plugin.json

@@ -0,0 +1,34 @@
+{
+  "id": "pay-bridge",
+  "name": "pay.sh Bridge",
+  "description": "Thin OpenClaw bridge to the local pay.sh CLI for paid API discovery and execution.",
+  "version": "0.1.0",
+  "contracts": {
+    "tools": [
+      "pay_status",
+      "pay_wallet_info",
+      "pay_search_services",
+      "pay_get_service_endpoints",
+      "pay_api_request"
+    ]
+  },
+  "skills": ["skills/pay-operator"],
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "payBinary": {
+        "type": "string",
+        "description": "Absolute path or executable name for the local pay.sh binary."
+      },
+      "defaultAccount": {
+        "type": "string",
+        "description": "Optional pay account name to use when a tool call does not specify one."
+      },
+      "requireHttps": {
+        "type": "boolean",
+        "description": "If true, pay_api_request refuses non-HTTPS URLs."
+      }
+    }
+  }
+}

package/.openclaw/extensions/pay-bridge/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@agentlayertech/pay-bridge-plugin",
+  "version": "0.1.15",
+  "description": "OpenClaw plugin bridge for the local pay.sh CLI.",
+  "type": "module",
+  "license": "SEE LICENSE IN ../../../LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lopushok9/Agent-Layer.git",
+    "directory": ".openclaw/extensions/pay-bridge"
+  },
+  "bugs": {
+    "url": "https://github.com/lopushok9/Agent-Layer/issues"
+  },
+  "homepage": "https://github.com/lopushok9/Agent-Layer/tree/main/.openclaw/extensions/pay-bridge#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "index.ts",
+    "core.mjs",
+    "dist/",
+    "openclaw.plugin.json",
+    "README.md",
+    "skills/"
+  ],
+  "openclaw": {
+    "extensions": [
+      "./index.ts"
+    ],
+    "runtimeExtensions": [
+      "./dist/index.js"
+    ],
+    "compat": {
+      "pluginApi": ">=2026.3.24-beta.2",
+      "minGatewayVersion": "2026.3.24-beta.2"
+    },
+    "build": {
+      "openclawVersion": "2026.3.24-beta.2",
+      "pluginSdkVersion": "2026.3.24-beta.2"
+    }
+  },
+  "keywords": [
+    "openclaw",
+    "plugin",
+    "pay",
+    "payments"
+  ]
+}

package/.openclaw/extensions/pay-bridge/skills/pay-operator/SKILL.md

@@ -0,0 +1,20 @@
+# pay-operator
+
+Use this skill when the user wants to discover or call paid APIs through `pay`.
+
+## Rules
+
+- Treat the `pay` wallet as separate from the AgentLayer execution wallet.
+- Do not use `agent-wallet` tools for `pay` account management.
+- Do not fall back to shell commands when the `pay-bridge` tools exist.
+- Prefer this order:
+  1. `pay_status`
+  2. `pay_search_services`
+  3. `pay_get_service_endpoints`
+  4. `pay_api_request`
+
+## Notes
+
+- `pay_api_request` requires `purpose` and `user_confirmed=true`.
+- Use the exact gateway URL returned by `pay_get_service_endpoints`.
+- If `pay_status` shows no configured account, stop and ask the user to finish `pay setup`.

package/.openclaw/extensions/pay-bridge/smoke_pay_bridge.mjs

@@ -0,0 +1,38 @@
+import assert from "node:assert/strict";
+
+import {
+  endpointPayloadContainsUrl,
+  parseAccountListOutput,
+  parseWhoamiOutput,
+} from "./core.mjs";
+
+const whoami = parseWhoamiOutput(`
+yuriytsygankov
+\u001b[2m(no mainnet account — run \`pay setup\`)\u001b[0m
+`);
+assert.equal(whoami.system_user, "yuriytsygankov");
+assert.equal(whoami.has_mainnet_account, false);
+
+const accounts = parseAccountListOutput(`
+\u001b[2mNo accounts found. Run \`pay account new\` to create one.\u001b[0m
+`);
+assert.equal(accounts.has_accounts, false);
+
+const endpointPayload = {
+  endpoints: [
+    {
+      method: "POST",
+      url: "https://api.example.com/v1/invoke",
+    },
+  ],
+};
+assert.equal(
+  endpointPayloadContainsUrl(endpointPayload, "https://api.example.com/v1/invoke"),
+  true
+);
+assert.equal(
+  endpointPayloadContainsUrl(endpointPayload, "https://api.example.com/v1/other"),
+  false
+);
+
+console.log("smoke_pay_bridge: ok");

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## Unreleased
 
+- Added ClawHub-publishable OpenClaw plugin package metadata for
+  `.openclaw/extensions/agent-wallet` and `.openclaw/extensions/pay-bridge`,
+  including required `openclaw.compat`, `openclaw.build`, and
+  `runtimeExtensions` fields for native `openclaw plugins install clawhub:...`
+  installs.
+- Added a reproducible OpenClaw plugin package build/check script at
+  `scripts/manage_openclaw_plugin_packages.mjs` to generate published runtime
+  JS artifacts under `.openclaw/extensions/*/dist/`.
+- Updated the `agent-wallet` OpenClaw bridge to auto-check the packaged runtime
+  path at `~/.openclaw/agent-wallet-runtime/current/agent-wallet` before local
+  workspace fallbacks, so a ClawHub-installed plugin can ride on top of the
+  existing npm runtime installer.
+- Documented the dual-install model: keep `npx @agentlayer.tech/wallet install`
+  for runtime/bootstrap, and use `openclaw plugins install clawhub:...` for the
+  native OpenClaw plugin packages.
+- Added a GitHub Actions workflow at `.github/workflows/clawhub-plugins.yml`
+  that can dry-run ClawHub publishes on pull requests and publish both OpenClaw
+  plugin packages on `v*` tags or manual dispatch.
+
+## v0.1.14 - 2026-05-13
+
+- Added a separate `.openclaw/extensions/pay-bridge/` plugin that keeps
+  `pay.sh` API payments outside the main AgentLayer execution wallet stack.
+- Added OpenClaw tools for local `pay` discovery and execution:
+  `pay_status`, `pay_wallet_info`, `pay_search_services`,
+  `pay_get_service_endpoints`, and `pay_api_request`.
+- Updated the local OpenClaw installer/runtime config flow to package and
+  enable the `pay-bridge` plugin alongside `agent-wallet`, including its
+  tool allowlist and absolute `pay` binary path when available.
 - Added an optional Hermes Agent bridge plugin under `hermes/plugins/agent_wallet`
   that forwards into the existing Python wallet CLI instead of duplicating
   OpenClaw wallet tools or policy.

package/README.md

@@ -18,7 +18,7 @@ AgentLayer is a beta local-first wallet and finance stack for agents.
 The repository includes:
 
 - `agent-wallet/` - the main wallet backend for AgentLayer
-- `.openclaw/` - the local AgentLayer bridge layer
+- `.openclaw/` - the local AgentLayer bridge layer, including the OpenClaw wallet bridge and the `pay.sh` API-payments bridge
 - `hermes/` - optional Hermes Agent plugin bridge for the same wallet backend
 - `wdk-btc-wallet/` - the local Bitcoin wallet service
 - `wdk-evm-wallet/` - the local EVM wallet service
@@ -51,6 +51,15 @@ Install through npm:
 npx @agentlayer.tech/wallet install --yes
 ```
 
+Install the native OpenClaw plugins from ClawHub:
+
+```bash
+openclaw plugins install clawhub:@agentlayertech/agent-wallet-plugin
+openclaw plugins install clawhub:@agentlayertech/pay-bridge-plugin
+```
+
+Those ClawHub packages do not replace the npm installer. Keep `npx @agentlayer.tech/wallet install --yes` for laying down the local wallet runtime, Python backend, and helper services. The ClawHub packages only install the OpenClaw plugin surfaces that point at that runtime.
+
 Or install the CLI globally first:
 
 ```bash
@@ -77,6 +86,29 @@ wallet update --yes
 wallet rollback
 ```
 
+## Native OpenClaw plugin installs
+
+Use ClawHub when you want the plugin itself to be installed through OpenClaw:
+
+```bash
+openclaw plugins install clawhub:@agentlayertech/agent-wallet-plugin
+openclaw plugins install clawhub:@agentlayertech/pay-bridge-plugin
+```
+
+Recommended order:
+
+1. Install or update the local runtime with `npx @agentlayer.tech/wallet install --yes`.
+2. Install the plugin package from ClawHub with `openclaw plugins install clawhub:...`.
+3. Restart the OpenClaw gateway and enable/configure the plugin entry in `openclaw.json`.
+
+The `agent-wallet` ClawHub plugin auto-checks the standard runtime path at:
+
+```bash
+~/.openclaw/agent-wallet-runtime/current/agent-wallet
+```
+
+If your runtime lives elsewhere, set `plugins.entries.agent-wallet.config.packageRoot` explicitly.
+
 Install from a local clone:
 
 ```bash