@forgeintel/sdk 0.5.0-beta.0 → 0.5.0-beta.10

package/README.md

@@ -1,6 +1,6 @@
 # @forgeintel/sdk
 
-> **Beta.** Install with `npm install @forgeintel/sdk@beta`. The API may change before 1.0.
+> **Beta.** Install with `npm install @forgeintel/sdk`. The API may change before 1.0.
 
 The Forge SDK for x402 paid APIs. Paid responses carry a `feedback_id`, the 402 challenge asks agents to rate the call, a rating is one free GET, and every call is reported to your Forge dashboard in the background. Never on your critical path: no network calls while your API serves a request, and it fails open. Aware of x402 v1 and v2, and of OpenAPI 2.0 through 3.2. Every change is additive, and anything it doesn't understand passes through untouched.
 
@@ -10,9 +10,9 @@ The Forge SDK for x402 paid APIs. Paid responses carry a `feedback_id`, the 402
 import { createForge } from "@forgeintel/sdk";
 
 const forge = createForge({
-  apiKey: process.env.FORGE_API_KEY,         // from your Forge project's Agents page
-  backendUrl: process.env.FORGE_BACKEND_URL, // Forge: <API origin>/api/sdk/v2
-  publicUrl: "https://api.example.com",      // your public origin (never taken from the Host header)
+  apiKey: process.env.FORGE_API_KEY,
+  agentContext: false,
+  feedback: true,
 });
 
 app.use(forge.middleware());                        // 1. first: before payments and your /openapi.json route
@@ -26,7 +26,7 @@ Works with `@x402/express` (v2) and `x402-express` (v1), on Express 4.21+ or 5.
 ```ts
 import { createForge } from "@forgeintel/sdk/hono";
 
-const forge = createForge({ apiKey, backendUrl, publicUrl });
+const forge = createForge({ apiKey, agentContext: false, feedback: true });
 app.use(forge.middleware());                        // before paymentMiddleware from @x402/hono
 app.use(paymentMiddleware(routes, resourceServer));
 ```
@@ -36,7 +36,7 @@ app.use(paymentMiddleware(routes, resourceServer));
 ```ts
 import { createForge } from "@forgeintel/sdk/next";
 
-export const forge = createForge({ apiKey, backendUrl, publicUrl });
+export const forge = createForge({ apiKey, agentContext: false, feedback: true });
 // app/api/…/route.ts: Forge outermost, around @x402/next's withX402
 export const POST = forge.withForge(withX402(handler, route, resourceServer));
 // app/feedback/[[...path]]/route.ts: Forge's own routes
@@ -57,8 +57,8 @@ Zero runtime dependencies. Node ≥ 20.19. Works from both `import` and `require
 
 | When | What happens |
 | --- | --- |
-| 402 challenge | Appends a soft ask to the description: *After your call, please rate this service for other agents: GET …/feedback/rate?feedback_id=FEEDBACK_ID&outcome=fully (or partially, no)…*, and asks for `&issue=` when the outcome isn't `fully`, so a bad rating says why. On x402 v2 it also adds an `extensions["forge-feedback"]` block. Payment terms and your own extensions are never touched. |
-| Paid 2xx response | Adds the `Forge-Feedback-Id` header. JSON object bodies also get `feedback_id`, `feedback_url` (with `outcome=` left blank) and `rate_this_call`, unless your OpenAPI schema for that response couldn't safely take them. |
+| 402 challenge | Appends one line to the description: *Paid responses include a feedback_id. Please rate the result for other agents with one free GET: https://…/feedback/rate?feedback_id=FEEDBACK_ID&outcome=fully\|partially\|no.* On x402 v2 it also adds an `extensions["forge-feedback"]` block with the outcome and issue values. The description never exceeds 500 characters (the CDP facilitator rejects longer ones): a shorter line is used when the full one doesn't fit, and none when neither does. Payment terms are never touched. |
+| Paid 2xx response | Adds the `Forge-Feedback-Id` header. JSON object bodies also get one `forge_feedback` object: `feedback_id`, `rate` (with `outcome=` left blank) and `rate_this_call`, unless your body already has a `forge_feedback` key or your OpenAPI schema for that response couldn't safely take it. Rating links are absolute: your origin registered in Forge, fetched in the background, or the request's own x402 resource origin. |
 | `GET /openapi.json` | Your document is served enriched: feedback routes documented, feedback fields added to paid response schemas, one sentence in `x-guidance`. |
 | `GET /feedback/rate` | Quick rating: `feedback_id`, `outcome`, optional `issue`. |
 | `POST /feedback` | Same fields, plus an optional `note` (≤ 280 chars). |
@@ -84,8 +84,8 @@ OpenAPI: Swagger 2.0 and OpenAPI 3.0, 3.1 and 3.2. Additive only; shared compone
 | Option | Default | |
 | --- | --- | --- |
 | `apiKey` | required | Merchant key. Also the HMAC key for IDs. |
-| `backendUrl` | required | Forge backend origin. |
-| `publicUrl` | required | This service's public origin. Used in rating URLs. |
+| `backendUrl` | `https://app-api.forgeintel.co/api/sdk/v2` | Optional collector override. |
+| `publicUrl` | Same-origin paths | Optional public origin for absolute rating URLs. Never infer it from request headers. |
 | `feedback` | `true` | Master switch for rating prompts, IDs, response additions and feedback routes. `false` leaves telemetry, client headers and independent agent context on. |
 | `basePath` | `/feedback` | Feedback routes (`/feedback`, `/feedback/rate`, `/feedback/summary`). |
 | `tone` | `"soft"` | `"lifecycle"` describes this service's flow as four steps (402, pay, response, rate). Both stay soft asks. |
@@ -93,9 +93,9 @@ OpenAPI: Swagger 2.0 and OpenAPI 3.0, 3.1 and 3.2. Additive only; shared compone
 | `challengeSentence` | built-in | Override for wording experiments. `{rate_url}` and `{summary_url}` are substituted. Wording that presents the rating as required, makes anything depend on it, or asks for user data is refused (with a warning). |
 | `challengeExtension` | `true` | Add the `forge-feedback` extension to x402 v2 challenges. |
 | `receiptExtension` | `true` | Add it, with the real `feedback_id`, to the x402 v2 payment receipt (`PAYMENT-RESPONSE`). |
-| `agentContext` | `true` | Ask for self-reported `agent_context` (agent name, search query), record it, and remove it before your code runs. `{ searchQuery: false }` or `false` to limit. |
-| `injectBody` | `true` | Add `feedback_id` / `feedback_url` to paid JSON bodies. |
-| `rateHint` | built-in | The `rate_this_call` field. A string overrides it (`{feedback_url}` is substituted); `false` removes it. |
+| `agentContext` | `true` | Require self-reported `agent_context` (agent name, search query) on paid requests before payment processing; record and strip it before your code runs. `{ searchQuery: false }` requires only the agent name; `false` disables collection and enforcement. |
+| `injectBody` | `true` | Add the `forge_feedback` object to paid JSON bodies. |
+| `rateHint` | built-in | The `forge_feedback.rate_this_call` field. A string overrides it (`{feedback_url}` is substituted); `false` removes it. |
 | `injectText` | `false` | Append a two-line trailer to paid `text/plain` bodies. |
 | `openapi` | intercept `/openapi.json` | `false` to disable, or `{ paths, document, isPaidOperation, describeOperations }`. |
 | `ttlMs` | 24h | Local pre-check; keep in sync with the backend. |
@@ -108,3 +108,20 @@ OpenAPI: Swagger 2.0 and OpenAPI 3.0, 3.1 and 3.2. Additive only; shared compone
 Source, examples and design notes: [github.com/ClawCash/forge-feedback](https://github.com/ClawCash/forge-feedback).
 
 Client headers are captured automatically at discovery, challenge, payment, and rating stages, including unknown clients. Forge identifies awal, AgentCash, pay.sh and x402scan-mcp from known headers; other clients remain unknown. There is no client-signals switch. Legacy `agent_context.client` inputs remain accepted but are no longer requested.
+
+### Agent context on paid requests
+
+```ts
+const forge = createForge({
+  apiKey: process.env.FORGE_API_KEY!,
+  agentContext: true,
+});
+```
+
+When enabled, context is always required on payment-bearing requests. `false` disables asking and recording. Forge documents `agent_context` and its `agent_type` and `search_query` fields as required. Any agent name is accepted; known spellings are normalized (`Claude` and `claude-code` become `Claude Code`). Send the search query, or `"direct"`. When the merchant declares a `bazaar` extension, Forge adds the same field there (schema and example), so agents that discover the service through Bazaar see it too. `{ searchQuery: false }` requires only the agent type. The legacy `required: false` option is ignored; disable `agentContext` to opt out. Context is self-reported, not authenticated identity.
+
+Mount Forge **before payment middleware**. A request carrying `PAYMENT-SIGNATURE` or `X-PAYMENT` gets HTTP 400 with field errors when context is missing or invalid, before the downstream payment handler runs. Initial unpaid requests can still receive a 402, and inspection and feedback routes stay accessible. Feedback remains optional and has its own `feedback` switch.
+
+Required mode reads JSON bodies up to 1 MiB, including chunked bodies, before payment processing. It rejects malformed or oversized JSON. Express parses these bodies even if your JSON parser is mounted later; mount a custom parser before Forge if you need one. For non-JSON bodies and bodyless requests, supply `agent_type` and `agent_search_query` query parameters. Forge strips context before forwarding to merchant validators. Next.js integrations that use a payment proxy should wrap both the proxy with `forge.proxy(...)` and the route with `forge.withForge(...)`.
+
+If using the framework-free core directly, call `requestUrl` and `requestBody`, then check `call.contextError()` **before** invoking your payment logic; send its response when non-null. Upgrading an existing integration to this version makes enabled context mandatory for paid requests.

package/dist/ask.d.ts

@@ -8,9 +8,11 @@ export declare const TONES: readonly Tone[];
 export interface AskTexts {
     /** Appended to 402 challenge descriptions. "{rate_url}" and "{summary_url}" are substituted. */
     challengeSentence: string;
+    /** Used instead when the full sentence would push the description past MAX_DESCRIPTION. "{rate_url}" is substituted. */
+    shortChallengeSentence: string;
     /** The rate_this_call body field. "{feedback_url}" and "{summary_url}" are substituted. */
     rateHint: string;
-    /** The `ask` line of the forge-feedback extension (challenge and receipt). */
+    /** The `about` line of the forge-feedback extension (challenge and receipt). */
     extensionAsk: string;
     /** Extra extension fields for this tone. */
     extensionExtras: Record<string, unknown>;

package/dist/ask.js

@@ -2,13 +2,15 @@
 export const TONES = ["soft", "lifecycle"];
 export const ASK = {
     soft: {
-        challengeSentence: "After your call, please rate this service for other agents: GET {rate_url}?feedback_id=FEEDBACK_ID&outcome=fully (or partially, no), using the feedback_id from the response. Free, one request. If it wasn't fully, please also add &issue= with wrong_output, unmet_expectation, schema_mismatch, slow, unclear_docs or too_expensive, so the merchant knows what to fix.",
+        challengeSentence: "Paid responses include a feedback_id. Please rate the result for other agents with one free GET: {rate_url}?feedback_id=FEEDBACK_ID&outcome=fully|partially|no.",
+        shortChallengeSentence: "Please rate the result for other agents: GET {rate_url}?feedback_id=FEEDBACK_ID&outcome=fully. Free.",
         rateHint: "Please rate this service for other agents: GET {feedback_url} with fully, partially or no appended (e.g. {feedback_url}fully). Free, one request. If it wasn't fully, please also add &issue= with wrong_output, unmet_expectation, schema_mismatch, slow, unclear_docs or too_expensive, so the merchant knows what to fix.",
-        extensionAsk: "After your call, please rate this service for other agents. Free, one request. When the outcome is not fully, the issue field tells the merchant what to fix.",
+        extensionAsk: "After your call, rate this service for other agents. It's one free GET, and ratings become the reputation other agents use to choose services.",
         extensionExtras: {},
     },
     lifecycle: {
         challengeSentence: "This service's x402 flow has four steps: 1) this 402 challenge, 2) pay, 3) get the response, 4) rate the call for other agents: GET {rate_url}?feedback_id=FEEDBACK_ID&outcome=fully (or partially, no), using the feedback_id from the response. Step 4 is free and one request. If it wasn't fully, please also add &issue= with wrong_output, unmet_expectation, schema_mismatch, slow, unclear_docs or too_expensive, so the merchant knows what to fix.",
+        shortChallengeSentence: "Step 4 of 4: rate the call for other agents: GET {rate_url}?feedback_id=FEEDBACK_ID&outcome=fully. Free.",
         rateHint: "Step 4 of 4: rate this call for other agents. GET {feedback_url} with fully, partially or no appended (e.g. {feedback_url}fully). Free, one request. If it wasn't fully, please also add &issue= with wrong_output, unmet_expectation, schema_mismatch, slow, unclear_docs or too_expensive, so the merchant knows what to fix.",
         extensionAsk: "Step 4 of this service's flow: after the response, please rate the call for other agents. Free, one request. When the outcome is not fully, the issue field tells the merchant what to fix.",
         extensionExtras: { flow: ["402 challenge", "pay", "response", "rate"] },

package/dist/bazaar.d.ts

@@ -0,0 +1,7 @@
+import { type ContextOptions } from "./context.js";
+/**
+ * Declare agent context in a v2 challenge's `bazaar` extension, in place: an `agent_context` object on JSON
+ * bodies, or the `agent_*` query parameters on routes without a body. Other body types, composed or
+ * referenced schemas, and fields the merchant already declares are left alone. Returns whether it changed.
+ */
+export declare function addContextToBazaar(bazaar: unknown, options: ContextOptions): boolean;

package/dist/bazaar.js

@@ -0,0 +1,58 @@
+import { CONTEXT_FIELD, agentContextExample, agentContextQuerySchema, agentContextSchema } from "./context.js";
+const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+/** Keywords whose meaning an added property could change; such schemas are left alone. */
+const COMPOSED = ["$ref", "allOf", "anyOf", "oneOf", "not", "if", "then", "else", "dependentSchemas", "patternProperties"];
+function declarable(schema) {
+    if (!isObj(schema) || COMPOSED.some((key) => key in schema))
+        return false;
+    if (schema.type !== undefined && schema.type !== "object")
+        return false;
+    if (schema.properties !== undefined && !isObj(schema.properties))
+        return false;
+    return schema.required === undefined || Array.isArray(schema.required);
+}
+/**
+ * Add properties to one part of the Bazaar input (`body` or `queryParams`): the JSON Schema in `schema` and
+ * the example in `info`, together. Facilitators index the Bazaar copy a client echoes with its payment only
+ * when `info` validates against `schema`, so declaring a required field without an example drops the listing.
+ * `@x402/core` checks the echo as a superset of what the server advertised, so adding keys keeps payments valid.
+ */
+function extend(schemas, info, key, properties, required, example) {
+    const schema = schemas[key];
+    if (!declarable(schema))
+        return false;
+    const current = info[key];
+    if (current !== undefined && !isObj(current))
+        return false;
+    const declared = isObj(schema.properties) ? schema.properties : {};
+    const listed = (schema.required ?? []);
+    // The merchant already describes these fields: their declaration wins.
+    if (Object.keys(properties).some((name) => name in declared || listed.includes(name) || (isObj(current) && name in current)))
+        return false;
+    schema.properties = { ...declared, ...properties };
+    if (required.length)
+        schema.required = [...new Set([...listed, ...required])];
+    info[key] = { ...current, ...example };
+    return true;
+}
+/**
+ * Declare agent context in a v2 challenge's `bazaar` extension, in place: an `agent_context` object on JSON
+ * bodies, or the `agent_*` query parameters on routes without a body. Other body types, composed or
+ * referenced schemas, and fields the merchant already declares are left alone. Returns whether it changed.
+ */
+export function addContextToBazaar(bazaar, options) {
+    if (!isObj(bazaar) || !isObj(bazaar.info) || !isObj(bazaar.info.input) || !isObj(bazaar.schema))
+        return false;
+    const inputSchema = bazaar.schema.properties?.input;
+    if (!isObj(inputSchema) || !isObj(inputSchema.properties))
+        return false;
+    const info = bazaar.info.input;
+    const required = options.required !== false;
+    if (info.bodyType !== undefined || "body" in inputSchema.properties) {
+        if (info.bodyType !== "json")
+            return false;
+        return extend(inputSchema.properties, info, "body", { [CONTEXT_FIELD]: agentContextSchema(options) }, required ? [CONTEXT_FIELD] : [], { [CONTEXT_FIELD]: agentContextExample(options) });
+    }
+    const query = agentContextQuerySchema(options);
+    return extend(inputSchema.properties, info, "queryParams", query.properties, query.required, agentContextExample(options, "query"));
+}

package/dist/context.d.ts

@@ -1,5 +1,13 @@
 /** Suggested agent names; anything else is kept as given. */
-export declare const AGENT_TYPES: readonly ["Claude Code", "Codex", "Cursor", "Grok", "Hermes", "Instinct", "OpenClaw", "Other", "Unknown"];
+export declare const AGENT_TYPES: readonly ["Claude Code", "Codex", "Cursor", "Grok Bot", "Muse", "Hermes", "Instinct", "OpenClaw", "Others"];
+/**
+ * Example values for discovery documents that need one (Bazaar's `info`). Agents sometimes copy examples
+ * verbatim, so they are placeholders, and an unedited placeholder is recorded as missing rather than as a name.
+ */
+export declare const CONTEXT_PLACEHOLDERS: {
+    readonly agent_type: "your agent name";
+    readonly search_query: "your search query, or direct";
+};
 /** Suggested x402 clients; anything else is kept as given. */
 export declare const CLIENTS: readonly ["agentcash", "awal", "pay.sh", "other", "unknown"];
 /** JSON body field (POST, PUT, …). */
@@ -31,31 +39,31 @@ export declare function takeFromUrl(url: string): {
     url: string;
     raw?: Record<string, string>;
 };
-/** JSON Schema for the optional `agent_context` body property. */
-export declare function agentContextSchema({ searchQuery }?: {
+export interface ContextOptions {
     searchQuery?: boolean;
-}): {
-    type: string;
-    description: string;
+    required?: boolean;
+}
+/** JSON Schema for the `agent_context` body property. */
+export declare function agentContextSchema({ searchQuery, required }?: ContextOptions): {
     properties: {
         search_query?: {
+            description: string;
+            minLength?: number | undefined;
             type: string;
             maxLength: number;
-            description: string;
         } | undefined;
         agent_type: {
-            type: string;
-            enum: ("Claude Code" | "Codex" | "Cursor" | "Grok" | "Hermes" | "Instinct" | "OpenClaw" | "Other" | "Unknown")[];
             description: string;
-        };
-        agent_type_other: {
+            minLength?: number | undefined;
             type: string;
             maxLength: number;
-            description: string;
         };
     };
+    required?: string[] | undefined;
+    type: string;
+    description: string;
 };
-/** The optional query parameters, for operations without a request body. */
+/** The query parameters, for operations without a request body. */
 export declare function agentContextParameters({ searchQuery }?: {
     searchQuery?: boolean;
 }): {
@@ -63,7 +71,16 @@ export declare function agentContextParameters({ searchQuery }?: {
     description: string;
     schema: Record<string, unknown>;
 }[];
-/** One line for the forge-feedback extension, so clients that only inspect the 402 learn about it too. */
-export declare function agentContextAsk({ searchQuery }?: {
-    searchQuery?: boolean;
-}): "Please add agent_context {agent_type, search_query} to your paid request's JSON body (without a body: agent_type, agent_search_query query parameters). Self-reported; omit what you don't know. search_query is what you searched to find this service, never your user's request." | "Please add agent_context {agent_type} to your paid request's JSON body (without a body: agent_type query parameter). Self-reported; omit what you don't know.";
+/** The same parameters as JSON Schema properties, for discovery documents that describe a query object (Bazaar). */
+export declare function agentContextQuerySchema({ searchQuery, required }?: ContextOptions): {
+    properties: Record<string, Record<string, unknown>>;
+    required: string[];
+};
+/** Placeholder values matching agentContextSchema (body) or agentContextQuerySchema (query). */
+export declare function agentContextExample({ searchQuery }?: ContextOptions, where?: "body" | "query"): {
+    [x: string]: "your agent name" | "your search query, or direct";
+};
+/** One line for the forge-agent-context extension, so clients that only inspect the 402 learn about it too. */
+export declare function agentContextAsk({ searchQuery, required }?: ContextOptions): string;
+/** Validate the original values, before lenient parsing can truncate or discard them. */
+export declare function contextIssues(raw: Record<string, unknown>, { searchQuery }: ContextOptions): string[];

package/dist/context.js

@@ -1,9 +1,21 @@
-// Agent context: optional, self-reported facts about the calling agent, sent with the paid request.
-// Forge reads it and removes it before the merchant's validators and handlers run, so the merchant's
-// API contract never changes. Never required: a required field breaks strict validators and makes
-// agents invent answers.
+// Self-reported facts about the calling agent, removed before merchant validation.
+// Enabled context is required on payment-bearing requests.
 /** Suggested agent names; anything else is kept as given. */
-export const AGENT_TYPES = ["Claude Code", "Codex", "Cursor", "Grok", "Hermes", "Instinct", "OpenClaw", "Other", "Unknown"];
+export const AGENT_TYPES = ["Claude Code", "Codex", "Cursor", "Grok Bot", "Muse", "Hermes", "Instinct", "OpenClaw", "Others"];
+/** Spellings agents use for the suggested names, compared lowercase with only letters and digits kept. */
+const AGENT_ALIASES = {
+    claude: "Claude Code", claudecode: "Claude Code", claudecodecli: "Claude Code", anthropicclaudecode: "Claude Code",
+    codex: "Codex", codexcli: "Codex", openaicodex: "Codex",
+    cursor: "Cursor", cursoragent: "Cursor", cursorai: "Cursor",
+    grok: "Grok Bot", grokbot: "Grok Bot",
+    muse: "Muse", hermes: "Hermes", hermesagent: "Hermes", instinct: "Instinct", openclaw: "OpenClaw",
+    other: "Others", others: "Others", othersspecify: "Others", unknown: "Others",
+};
+/**
+ * Example values for discovery documents that need one (Bazaar's `info`). Agents sometimes copy examples
+ * verbatim, so they are placeholders, and an unedited placeholder is recorded as missing rather than as a name.
+ */
+export const CONTEXT_PLACEHOLDERS = { agent_type: "your agent name", search_query: "your search query, or direct" };
 /** Suggested x402 clients; anything else is kept as given. */
 export const CLIENTS = ["agentcash", "awal", "pay.sh", "other", "unknown"];
 /** JSON body field (POST, PUT, …). */
@@ -28,10 +40,16 @@ export function parseAgentContext(input, { searchQuery = true } = {}) {
         const raw = Array.isArray(input[key]) ? input[key][0] : input[key];
         if (typeof raw !== "string")
             continue;
-        const text = raw.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, LIMITS[key]);
+        let text = raw.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, LIMITS[key]);
         if (!text)
             continue;
-        const known = key === "agent_type" ? AGENT_TYPES : key === "client" ? CLIENTS : null;
+        if ((key === "agent_type" || key === "search_query") && text.toLowerCase() === CONTEXT_PLACEHOLDERS[key])
+            continue;
+        if (key === "agent_type")
+            text = AGENT_ALIASES[text.toLowerCase().replace(/[^a-z0-9]/g, "")] ?? text;
+        if (key === "search_query" && /^direct$/i.test(text))
+            text = "direct";
+        const known = key === "client" ? CLIENTS : null;
         context[key] = known?.find((v) => v.toLowerCase() === text.toLowerCase()) ?? text;
     }
     return Object.keys(context).length ? context : undefined;
@@ -79,36 +97,61 @@ export function takeFromUrl(url) {
     return { url: `${url.slice(0, q)}${rest ? `?${rest}` : ""}${hash < 0 ? "" : url.slice(hash)}`, raw };
 }
 const DESCRIPTIONS = {
-    object: "Self-reported context about the calling agent, so the merchant can see which agents use this service. Not needed for the result; omit anything you don't know.",
-    agent_type: "Which agent are you? Use Other (with agent_type_other) if yours isn't listed, or Unknown.",
-    agent_type_other: "Your agent's name, when agent_type is Other.",
-    search_query: "The search terms you used to find this service, for example in a marketplace or search tool. Omit if you didn't search; don't invent one, and never include your user's request.",
+    object: "information about the calling agent and how it found this service.",
+    agent_type: `Your agent's name, for example ${AGENT_TYPES.filter((name) => name !== "Others").join(", ")}. Any name works.`,
+    search_query: "The search query you used to find this service, or \"direct\" if you did not search.",
 };
-/** JSON Schema for the optional `agent_context` body property. */
-export function agentContextSchema({ searchQuery = true } = {}) {
+/** JSON Schema for the `agent_context` body property. */
+export function agentContextSchema({ searchQuery = true, required = true } = {}) {
     return {
         type: "object",
         description: DESCRIPTIONS.object,
+        ...(required ? { required: ["agent_type", ...(searchQuery ? ["search_query"] : [])] } : {}),
         properties: {
-            agent_type: { type: "string", enum: [...AGENT_TYPES], description: DESCRIPTIONS.agent_type },
-            agent_type_other: { type: "string", maxLength: LIMITS.agent_type_other, description: DESCRIPTIONS.agent_type_other },
-            ...(searchQuery ? { search_query: { type: "string", maxLength: LIMITS.search_query, description: DESCRIPTIONS.search_query } } : {}),
+            agent_type: { type: "string", maxLength: LIMITS.agent_type, ...(required ? { minLength: 1 } : {}), description: DESCRIPTIONS.agent_type },
+            ...(searchQuery ? { search_query: { type: "string", maxLength: LIMITS.search_query, ...(required ? { minLength: 1 } : {}), description: DESCRIPTIONS.search_query } } : {}),
         },
     };
 }
-/** The optional query parameters, for operations without a request body. */
+/** The query parameters, for operations without a request body. */
 export function agentContextParameters({ searchQuery = true } = {}) {
     const params = [
-        { name: CONTEXT_QUERY.agent_type, description: DESCRIPTIONS.agent_type, schema: { type: "string", enum: [...AGENT_TYPES] } },
-        { name: CONTEXT_QUERY.agent_type_other, description: DESCRIPTIONS.agent_type_other, schema: { type: "string", maxLength: LIMITS.agent_type_other } },
+        { name: CONTEXT_QUERY.agent_type, description: DESCRIPTIONS.agent_type, schema: { type: "string", maxLength: LIMITS.agent_type } },
     ];
     if (searchQuery)
         params.push({ name: CONTEXT_QUERY.search_query, description: DESCRIPTIONS.search_query, schema: { type: "string", maxLength: LIMITS.search_query } });
     return params;
 }
-/** One line for the forge-feedback extension, so clients that only inspect the 402 learn about it too. */
-export function agentContextAsk({ searchQuery = true } = {}) {
-    return searchQuery
-        ? "Please add agent_context {agent_type, search_query} to your paid request's JSON body (without a body: agent_type, agent_search_query query parameters). Self-reported; omit what you don't know. search_query is what you searched to find this service, never your user's request."
-        : "Please add agent_context {agent_type} to your paid request's JSON body (without a body: agent_type query parameter). Self-reported; omit what you don't know.";
+/** The same parameters as JSON Schema properties, for discovery documents that describe a query object (Bazaar). */
+export function agentContextQuerySchema({ searchQuery = true, required = true } = {}) {
+    const properties = {};
+    for (const p of agentContextParameters({ searchQuery }))
+        properties[p.name] = { ...p.schema, ...(required ? { minLength: 1 } : {}), description: p.description };
+    return { properties, required: required ? Object.keys(properties) : [] };
+}
+/** Placeholder values matching agentContextSchema (body) or agentContextQuerySchema (query). */
+export function agentContextExample({ searchQuery = true } = {}, where = "body") {
+    const names = where === "query" ? { agent_type: CONTEXT_QUERY.agent_type, search_query: CONTEXT_QUERY.search_query } : { agent_type: "agent_type", search_query: "search_query" };
+    return {
+        [names.agent_type]: CONTEXT_PLACEHOLDERS.agent_type,
+        ...(searchQuery ? { [names.search_query]: CONTEXT_PLACEHOLDERS.search_query } : {}),
+    };
+}
+/** One line for the forge-agent-context extension, so clients that only inspect the 402 learn about it too. */
+export function agentContextAsk({ searchQuery = true, required = true } = {}) {
+    const fields = searchQuery ? "agent_type, search_query" : "agent_type";
+    const query = searchQuery ? "agent_type, agent_search_query query parameters" : "agent_type query parameter";
+    return `${required ? "Required before payment" : "Please add"}: agent_context {${fields}} in your paid request's JSON body (without a body: ${query}).${searchQuery ? ' search_query: share the query you used to find this service, or "direct" if you did not search.' : ""}`;
+}
+/** Validate the original values, before lenient parsing can truncate or discard them. */
+export function contextIssues(raw, { searchQuery = true }) {
+    const issues = [];
+    for (const key of ["agent_type", ...(searchQuery ? ["search_query"] : [])]) {
+        const value = raw[key];
+        if (typeof value !== "string" || !value.trim() || value.length > LIMITS[key] || /[\u0000-\u001f\u007f]/.test(value)) {
+            issues.push(`${key} must be a non-empty string of at most ${LIMITS[key]} characters`);
+        }
+    }
+    // Any name is accepted: known spellings are normalized by parseAgentContext, others are kept as given.
+    return issues;
 }

package/dist/core.d.ts

@@ -16,12 +16,12 @@ export interface ForgeOptions {
     /** Merchant API key issued by the Forge backend. Also the HMAC key for feedback IDs. */
     apiKey: string;
     /**
-     * Where events and ratings go. An origin (https://backend.example.com) uses its /v1/events, /v1/feedback and
-     * /v1/summary routes; a URL with a path (https://api.forgeintel.co/api/sdk/v2) uses {path}/events, and so on.
+     * Optional collector override. Defaults to Forge's production /api/sdk/v2 collector.
+     * An origin-only override uses its /v1 routes; a URL with a path uses {path}/events and so on.
      */
-    backendUrl: string;
-    /** This service's public origin, e.g. https://pixels.gateway.clawca.sh. Never derived from the Host header. */
-    publicUrl: string;
+    backendUrl?: string;
+    /** Optional public origin for absolute feedback links. By default links use same-origin paths. Never derived from the Host header. */
+    publicUrl?: string;
     /** Enable rating prompts, feedback IDs and feedback routes. Default true. Telemetry and agent context are independent. */
     feedback?: boolean;
     /** Path for the feedback routes. Default "/feedback" (quick rating at "/feedback/rate"). */
@@ -50,14 +50,17 @@ export interface ForgeOptions {
      */
     receiptExtension?: boolean;
     /**
-     * Agent context: optional, self-reported `agent_context` {agent_type, search_query} on the paid request
+     * Agent context: required, self-reported `agent_context` {agent_type, search_query} on the paid request
      * (JSON body, or agent_type / agent_search_query query parameters). Forge documents it in the
      * extension and OpenAPI, reads it, reports it with the call, and removes it before your validators and handlers
      * run. Default true. `{ searchQuery: false }` stops asking for (and recording) the search query; `false` stops
      * asking and recording altogether (the fields are still removed if an agent sends them).
+     * Enabled context rejects payment-bearing requests with missing/invalid context before payment middleware.
+     * `required` is retained for compatibility; `false` is ignored. Use `false` for agentContext to disable it.
      */
     agentContext?: boolean | {
         searchQuery?: boolean;
+        required?: boolean;
     };
     /** Add feedback_id and feedback_url to JSON object bodies of paid responses. Default true. */
     injectBody?: boolean;
@@ -106,6 +109,10 @@ export interface ForgeResponse {
 export interface ForgeCall {
     /** Set when the request carried a payment header (x402 v2 PAYMENT-SIGNATURE or v1 X-PAYMENT). */
     readonly feedbackId: string | undefined;
+    /** Whether this payment-bearing request must provide agent context. */
+    readonly contextRequired: boolean;
+    /** Call after requestUrl/requestBody and BEFORE payment processing. Null means context is acceptable. */
+    contextError(): ForgeResponse | null;
     /** A JSON body about to be sent: 402 challenges get the rating ask, paid 2xx objects get the feedback fields. */
     json(status: number, body: unknown): unknown;
     /** A text body about to be sent: gets the two-line trailer on paid 2xx text/plain when injectText is on. */
@@ -171,6 +178,7 @@ export declare const FEEDBACK_HEADERS: {
 export declare const BODY_LIMIT: number;
 /** Max OpenAPI document an adapter should buffer for enrichment. */
 export declare const SPEC_LIMIT: number;
+export declare const DEFAULT_BACKEND_URL = "https://app-api.forgeintel.co/api/sdk/v2";
 /**
  * Check options without throwing. Invalid required options are errors (Forge runs disabled);
  * invalid optional values are warnings and fall back to their defaults.