@agentwares/agentguard 0.1.3 → 0.1.4

package/dist/cli.js

@@ -937,7 +937,7 @@ import {
 } from "@agentwares/agentguard-core/node";
 import { existsSync as exists, readFileSync as readFileSync2 } from "fs";
 
-// ../../packages/mcp-kit/dist/chunk-NF4BQXVM.js
+// ../../packages/mcp-kit/dist/chunk-7LRFDQNC.js
 import { completable } from "@modelcontextprotocol/sdk/server/completable.js";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import {
@@ -949,6 +949,18 @@ import {
 import { z } from "zod";
 
 // ../../packages/x402/dist/index.js
+var USDC_BASE = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+var USDC_DECIMALS = 6;
+var USDC_EIP712_DOMAIN = { name: "USD Coin", version: "2" };
+function toAtomicUnits(amountUsd, decimals = USDC_DECIMALS) {
+  const trimmed = amountUsd.trim();
+  if (!/^\d+(\.\d+)?$/.test(trimmed)) throw new Error(`not a decimal amount: ${amountUsd}`);
+  const [whole = "0", fraction = ""] = trimmed.split(".");
+  if (fraction.length > decimals) {
+    throw new Error(`${amountUsd} has more than ${decimals} decimal places`);
+  }
+  return `${whole}${fraction.padEnd(decimals, "0")}`.replace(/^0+(?=\d)/, "");
+}
 var DEFAULT_X402_NETWORK = "eip155:8453";
 var X402_HEADER = "X-Payment-Requirements";
 var X402_REQUIRED_HEADER = "PAYMENT-REQUIRED";
@@ -964,13 +976,18 @@ function buildPaymentRequired(opts) {
   if (opts.payTo) {
     accepts.push({
       rail: "x402",
+      scheme: "exact",
       amountUsd,
+      amount: toAtomicUnits(amountUsd, opts.assetDecimals),
       resource: opts.resource,
       description: opts.description,
+      mimeType: "application/json",
       network: opts.network ?? DEFAULT_X402_NETWORK,
-      asset: "USDC",
+      asset: opts.asset ?? USDC_BASE,
+      extra: opts.assetDomain ?? USDC_EIP712_DOMAIN,
       payTo: opts.payTo,
-      maxTimeoutSeconds: 300
+      maxTimeoutSeconds: 300,
+      ...opts.bazaar ? { bazaar: opts.bazaar } : {}
     });
   }
   if (creditsPayTo) {
@@ -988,7 +1005,11 @@ function buildPaymentRequired(opts) {
   }
   const live = opts.live === true;
   const selfServe = opts.selfServe;
-  const liveFix = selfServe ? `Free first: retry with sample=true \u2014 no key, no payment. To pay: POST ${selfServe.keysUrl} (no auth, no signup) returns a key and a Stripe Checkout URL. Funding that key needs a person to complete the Checkout page in a browser; if you are running unattended, surface the URL to your operator rather than retrying. Once funded, send Authorization: Bearer <key>, plus Idempotency-Key so a repeated call is charged once.` : "Retry with a PAYMENT header satisfying one of `accepts`, or send an API key with credit balance.";
+  const x402Rail = accepts.find((a) => a.rail === "x402" && a.payTo);
+  const usdcFix = x402Rail ? `Pay in USDC with no account and no human: take the \`accepts\` entry with \`rail: "x402"\`, sign an EIP-3009 transferWithAuthorization for ${x402Rail.amountUsd} USDC to ${x402Rail.payTo} on ${x402Rail.network}, and retry with it base64 in the X-PAYMENT header. The facilitator submits the transfer, so you need USDC and no gas. ` : "";
+  const sampleFix = opts.sampleMode ? "Free first: retry with sample=true \u2014 no key, no payment. " : "";
+  const cardFix = selfServe ? `Or pay by card: POST ${selfServe.keysUrl} (no auth, no signup) returns a key and a Stripe Checkout URL. Funding that key needs a person at a browser; if you are running unattended, surface the URL to your operator rather than retrying, or use the USDC rail above. Once funded, send Authorization: Bearer <key>, plus Idempotency-Key so a repeated call is charged once.` : "";
+  const liveFix = usdcFix || cardFix ? `${sampleFix}${usdcFix}${cardFix}`.trim() : "Retry with a PAYMENT header satisfying one of `accepts`, or send an API key with credit balance.";
   const body = {
     code: "PAYMENT_REQUIRED",
     cause: live ? `This call costs $${amountUsd}. No valid payment or credit was presented.` : `This call costs $${amountUsd}. Pay-per-call (x402 / Stripe MPP) is coming soon; use an API key with prepaid credits.`,
@@ -997,10 +1018,19 @@ function buildPaymentRequired(opts) {
     priceUsd: opts.priceUsd,
     accepts,
     comingSoon: !live,
-    alternatives: ["api_key_credits", "sample_mode"],
-    ...selfServe ? { selfServe } : {}
+    alternatives: [
+      ...creditsPayTo ? ["api_key_credits"] : [],
+      ...opts.sampleMode ? ["sample_mode"] : []
+    ],
+    ...selfServe ? { selfServe } : {},
+    ...opts.bazaar ? { extensions: { bazaar: opts.bazaar } } : {}
   };
-  const encoded = JSON.stringify({ x402Version: 2, accepts, resource: opts.resource });
+  const encoded = JSON.stringify({
+    x402Version: 2,
+    accepts,
+    resource: opts.resource,
+    ...opts.bazaar ? { extensions: { bazaar: opts.bazaar } } : {}
+  });
   const headers = {
     "Content-Type": "application/json",
     "WWW-Authenticate": `Payment realm="agentwares", methods="x402 prepaid_credits", price="${amountUsd} USD"`,
@@ -1021,7 +1051,7 @@ var StubVerifier = class {
   }
 };
 
-// ../../packages/mcp-kit/dist/chunk-NF4BQXVM.js
+// ../../packages/mcp-kit/dist/chunk-7LRFDQNC.js
 import { z as z2 } from "zod";
 import { z as z3 } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -1493,21 +1523,26 @@ function withPayment(tool, opts) {
         if (auth.ok) return tool.handler(record, { ...ctx, userId: auth.userId });
         reason = auth.reason;
       }
+      const resource = ctx.resourceUrl ?? tool.name;
       const required = buildPaymentRequired({
-        resource: tool.name,
+        resource,
         priceUsd: opts.priceUsd,
         live: opts.live,
         description: opts.description,
         payTo: opts.payTo,
         creditsPayTo: opts.creditsPayTo,
         signupUrl: opts.signupUrl,
-        selfServe: opts.selfServe
+        selfServe: opts.selfServe,
+        // withPayment always adds a free `sample` flag to the tool's input schema
+        sampleMode: true,
+        ...opts.bazaar ? { bazaar: opts.bazaar } : {}
       });
       const advertised = required.body.accepts.find((a) => a.rail === "prepaid_credits") ?? required.body.accepts[0];
       const requirement = advertised ?? {
         rail: "prepaid_credits",
         amountUsd: String(required.body.priceUsd),
-        resource: tool.name
+        resource,
+        ...opts.description ? { description: opts.description } : {}
       };
       const verified = await verifier.verify(
         new Request(`https://mcp.local/${tool.name}`, { headers: ctx.headers }),
@@ -2740,6 +2775,7 @@ function readServers(file) {
   return servers;
 }
 var PROXY_SERVER_NAME = "agentguard";
+var PROXY_PACKAGE = "@agentwares/agentguard";
 function isProxyEntry(entry) {
   return (entry.args ?? []).some((a) => a === "agentguard" || /(^|\/)agentguard(\.js)?$/.test(a)) && (entry.args ?? []).includes("proxy");
 }
@@ -2783,7 +2819,7 @@ function backupPath(file) {
   return `${file.path}.agentguard-backup`;
 }
 function proxyEntry(file, policyPath, opts = {}) {
-  const args = ["-y", "agentguard", "proxy", "--config", policyPath];
+  const args = ["-y", PROXY_PACKAGE, "proxy", "--config", policyPath];
   if (opts.agent) args.push("--agent", opts.agent);
   const entry = { command: "npx", args };
   if (file.serversKey === "servers") entry.type = "stdio";
@@ -3836,6 +3872,11 @@ async function initCommand(args, io) {
   }
   if (flagBool(args, "rewrite") !== false) {
     for (const c of chosen) {
+      if (resolve3(c.path) === resolve3(policyPath)) {
+        throw new Error(
+          `refusing: ${rel(c.path)} is both the policy file (--config) and a client config. Rewriting it would replace the policy with the proxy entry and leave the proxy pointing at itself. Use --config for the policy path and --client for the client's config, or let --config default to agentguard.yaml.`
+        );
+      }
       const { backup, replaced } = rewriteClientConfig(c, policyPath, {
         agent: flagString(args, "agent")
       });