@crestdeploymentsystems/trusted-fetch 1.0.0

package/README.md

@@ -0,0 +1,58 @@
+# @crestdeploymentsystems/trusted-fetch
+
+x402 payments with pre-payment trust verification. Drop-in replacement for `@x402/fetch` that checks service trust before sending money.
+
+## Install
+
+```bash
+npm install @crestdeploymentsystems/trusted-fetch
+```
+
+## Usage
+
+```javascript
+import { wrapFetchWithPayment } from "@x402/fetch";
+import { createTrustedFetch } from "@crestdeploymentsystems/trusted-fetch";
+
+// Your normal x402 setup
+const fetchWithPayment = wrapFetchWithPayment(fetch, client);
+
+// Wrap it with trust verification
+const trustedFetch = createTrustedFetch(fetchWithPayment, {
+  threshold: 50,          // minimum trust score (0-100)
+  onCheck: (url, trust) => console.log(`${url}: ${trust.score}/${trust.grade}`),
+  onRefuse: (url, trust) => console.log(`Refused to pay ${url}: score too low`),
+});
+
+// Use exactly like fetchWithPayment -- but safe
+const res = await trustedFetch("https://some-x402-service.com/api/data", {
+  method: "GET",
+});
+```
+
+## How it works
+
+Before every x402 payment, `trustedFetch` calls [supership.crestsystems.ai/check](https://supership.crestsystems.ai/check) to get a trust score for the service. If the score is below your threshold, the payment is refused and an error is thrown. Your money stays in your wallet.
+
+The check is free. Skipping it is expensive.
+
+## Options
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `threshold` | 50 | Minimum trust score (0-100) to proceed with payment |
+| `checkUrl` | supership.crestsystems.ai/check | Trust check endpoint |
+| `onCheck` | null | Callback after every trust check |
+| `onRefuse` | null | Callback when payment is refused |
+
+## Why
+
+Agents making x402 payments have no way to know if a service is trustworthy before paying. `trusted-fetch` adds a pre-flight trust check that protects against:
+- Scam services that take payment and return nothing
+- Services with known security issues
+- Newly deployed services with no track record
+- Services that have degraded since you last called them
+
+## Built by
+
+[Crest Deployment Systems](https://crestsystems.ai) -- deploying scalable intelligence.

package/index.mjs

@@ -0,0 +1,33 @@
+const SUPERSHIP_CHECK = "https://supership.crestsystems.ai/check";
+const DEFAULT_THRESHOLD = 50;
+
+export function createTrustedFetch(fetchWithPayment, options = {}) {
+  const threshold = options.threshold ?? DEFAULT_THRESHOLD;
+  const checkUrl = options.checkUrl ?? SUPERSHIP_CHECK;
+  const onRefuse = options.onRefuse ?? null;
+  const onCheck = options.onCheck ?? null;
+
+  return async function trustedFetch(url, init) {
+    const serviceUrl = new URL(url).origin;
+
+    let trust;
+    try {
+      const checkRes = await fetch(`${checkUrl}?url=${encodeURIComponent(serviceUrl)}`);
+      trust = await checkRes.json();
+    } catch {
+      trust = { score: 0, grade: "F", recommendation: "unknown", confidence_debt: ["check_failed"] };
+    }
+
+    if (onCheck) onCheck(serviceUrl, trust);
+
+    if (trust.score < threshold) {
+      const reason = `Trust score ${trust.score}/${trust.grade} below threshold ${threshold}. Recommendation: ${trust.recommendation}. Confidence debt: ${(trust.confidence_debt || []).join(", ")}`;
+      if (onRefuse) onRefuse(serviceUrl, trust, reason);
+      throw new Error(`[trusted-fetch] Payment refused: ${reason}`);
+    }
+
+    return fetchWithPayment(url, init);
+  };
+}
+
+export { SUPERSHIP_CHECK, DEFAULT_THRESHOLD };

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@crestdeploymentsystems/trusted-fetch",
+  "version": "1.0.0",
+  "mcpName": "io.github.andysalvo/trusted-fetch",
+  "description": "x402 fetch with pre-payment trust check. Drop-in replacement for @x402/fetch that calls supership before paying.",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "keywords": ["x402", "trust", "security", "preflight", "supership", "agent", "payment", "fetch"],
+  "author": "Crest Deployment Systems LLC",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/andysalvo/trusted-fetch.git"
+  },
+  "homepage": "https://supership.crestsystems.ai",
+  "peerDependencies": {
+    "@x402/fetch": ">=0.1.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}