@insumermodel/mppx-condition-gate 3.1.1 → 3.1.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 douglasborthwick-crypto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -21,7 +21,7 @@ The signed attestation is verifiable offline via [JWKS](https://insumermodel.com
 
 ### Why you must supply the payer
 
-mppx credentials carry an optional `source` DID, but mppx documents it as *"an asserted identity, not independent proof of control"* — it is a claim by the caller, not a proof. Versions before 3.0.0 granted free access on it, which let anyone name a qualifying wallet and skip payment ([GHSA-jg6q-3qfh-r9f8](https://github.com/douglasborthwick-crypto/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8)). The gate now refuses to guess.
+mppx credentials carry an optional `source` DID, but mppx documents it as *"an asserted identity, not independent proof of control"* — it is a claim by the caller, not a proof. Versions before 3.0.0 granted free access on it, which let anyone name a qualifying wallet and skip payment ([GHSA-jg6q-3qfh-r9f8](https://github.com/insumerapi/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8)). The gate now refuses to guess.
 
 `provenPayer` receives **only** the validation `details` — never the credential and never `source` — so the unproven identity is not reachable from it. Return a payer only if the payment method has actually established control of it. **Every path that cannot justify free access falls through to payment:** no resolver, no `validate` hook on the method, a resolver returning `null` or throwing, a credential that fails validation, conditions not met, or an attestation error.
 
@@ -230,7 +230,7 @@ curl -X POST https://api.insumermodel.com/v1/keys/create \
 
 Either way, set `INSUMER_API_KEY` as an environment variable in your runtime.
 
-**Top up** an existing key on-chain via `POST /v1/credits/buy`. Accepted: USDC or USDT on any major EVM chain, USDC on Solana, or BTC on Bitcoin. See the [credits endpoint](https://insumermodel.com/developers/api-reference/) for transaction format.
+**Top up** an existing key on-chain via `POST /v1/credits/buy`. Accepted: USDC or USDT on Ethereum (1), Base (8453), Polygon (137), Arbitrum (42161), Optimism (10), BNB Chain (56), or Avalanche (43114); USDC or USDT on Solana; BTC on Bitcoin; or USDT (TRC-20) on Tron. See the [credits endpoint](https://insumermodel.com/developers/api-reference/) for transaction format.
 
 **Pricing model**: the wallet holder pays nothing at the gated route. The operator running the gate pays per attestation call out of the key's credit balance. Cost per attestation depends on tier and condition mix.
 
@@ -268,6 +268,15 @@ if (receipt.reference.startsWith('condition-gate:free:')) {
 }
 ```
 
+The same check applies on the server. mppx reports a free grant through its `payment.success` event (`onPaymentSuccess`), because the gate returns a successful receipt. If you count revenue or log payments from that event, read `receipt.reference` first: a reference starting with `condition-gate:free:` means access was granted and no money moved.
+
+```ts
+mppx.onPaymentSuccess(({ receipt }) => {
+  if (receipt.reference.startsWith('condition-gate:free:')) return // free access, nothing settled
+  recordPayment(receipt)
+})
+```
+
 ## When the API is unreachable
 
 If the attestation API is unreachable, the adapter falls through to the original payment method. Wallets that would have qualified for free access pay normally; everyone else is unaffected.
@@ -300,7 +309,7 @@ The `parsXrplDid` typo from v1 is fixed: use `parseXrplDid`. The cache helper re
 
 ## Migrating from 2.x (security release)
 
-3.0.0 fixes an authentication bypass ([GHSA-jg6q-3qfh-r9f8](https://github.com/douglasborthwick-crypto/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8)). All 2.x versions, and all versions of the predecessor `@insumermodel/mppx-token-gate`, are affected.
+3.0.0 fixes an authentication bypass ([GHSA-jg6q-3qfh-r9f8](https://github.com/insumerapi/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8)). All 2.x versions, and all versions of the predecessor `@insumermodel/mppx-token-gate`, are affected.
 
 Add a `provenPayer` resolver:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insumermodel/mppx-condition-gate",
-  "version": "3.1.1",
+  "version": "3.1.3",
   "description": "Condition-based access for mppx routes. Wallet auth via signed attestations. Six condition types: token balance, NFT ownership, EAS attestation, Farcaster ID, ratio_to_amount, ratio_to_supply.",
   "type": "module",
   "main": "dist/index.js",
@@ -42,15 +42,15 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/douglasborthwick-crypto/mppx-condition-gate.git"
+    "url": "git+https://github.com/insumerapi/mppx-condition-gate.git"
   },
   "peerDependencies": {
     "mppx": ">=0.8.14"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",
-    "mppx": "0.9.3",
+    "mppx": "0.13.1",
     "typescript": "^5.7.0",
-    "viem": "2.56.5"
+    "viem": "2.57.2"
   }
 }