@m2msentinel/sdk 1.2.1 → 1.2.3

package/README.md

@@ -40,13 +40,13 @@ Autonomous agents handling value must never rely on a single oracle or heuristic
 npm install @m2msentinel/sdk
 
 # Or unscoped package
-npm install m2m-sentinel-sdk@1.2.1
+npm install m2m-sentinel-sdk@1.2.3
 ```
 
 ### Python (PyPI)
 
 ```bash
-pip install m2m-sentinel==1.2.1
+pip install m2m-sentinel==1.2.3
 ```
 
 ### MCP Server (Model Context Protocol)
@@ -77,6 +77,17 @@ console.log('Capability evidence:', audit.audit.dissection.capabilities);
 console.log('Proxy Target:', audit.audit.proxyResolution.targetAddress);
 console.log('Reachability:', audit.audit.reachability || 'NOT_ESTABLISHED');
 
+// Transaction-specific observation before a caller-owned signing decision.
+const preflight = await client.preflightTransaction({
+  chainId: 8453,
+  to: '0x1111111111111111111111111111111111111111',
+  data: '0x40c10f19'
+});
+console.log('Selector:', preflight.selectorHex);
+console.log('Executing target:', preflight.resolvedExecutionTarget);
+console.log('Observation block:', preflight.observationBlock.blockNumber);
+// The caller must apply its own policy; M2M Sentinel does not return a safety verdict.
+
 // 2. Autonomous Headless x402 Micropayments (EIP-3009 Local Signing)
 const x402Client = new X402SignerClient({
   walletSigner: myAgentWallet, // ethers / viem signer
@@ -115,7 +126,7 @@ const signer = new X402SignerClient({
 
 ## Authentication and x402
 
-Send API keys only in `x-api-key` (or `Authorization: Bearer`). Query-string credentials are rejected with HTTP 401. Payable routes also support x402 v2 on Base USDC. An unpaid call returns a base64 `PAYMENT-REQUIRED` challenge; a successful settlement returns `PAYMENT-RESPONSE`.
+Send API keys only in `x-api-key` (or `Authorization: Bearer`). Query-string credentials are rejected with HTTP 401. Payable routes also support x402 v2 on Base USDC. An unpaid call returns a base64 `PAYMENT-REQUIRED` challenge; a successful settlement returns `PAYMENT-RESPONSE`. `POST /v1/transaction/preflight` is API-key/RapidAPI metered and is deliberately not in the x402 catalog; it has no x402 price.
 
 ---
 
@@ -126,6 +137,7 @@ Send API keys only in `x-api-key` (or `Authorization: Bearer`). Query-string cre
 - `GET /v1/plans`
 - `GET /v1/demo/audit/:address` for the published sample allowlist
 - `GET /v1/audit/:address` (requires API key or x402 payment)
+- `POST /v1/transaction/preflight` (requires an API key or verified RapidAPI proxy authentication; not x402-payable)
 
 The JavaScript, TypeScript, and Python clients expose multi-period purchase/renewal and wallet recovery without requiring callers to hand-build requests:
 

package/agent_adapter.js

@@ -67,7 +67,7 @@ class M2MSentinelActionProvider {
 
     const headers = {
       Accept: 'application/json',
-      'User-Agent': 'M2MSentinel-AgentKit/1.2.1',
+      'User-Agent': 'M2MSentinel-AgentKit/1.2.3',
       ...options.headers
     };
     if (this.apiKey && !headers['x-api-key']) {

package/index.d.ts

@@ -14,6 +14,15 @@ export interface RecoveryChallengeOptions {
   txHash?: string;
 }
 
+export interface TransactionPreflightRequest {
+  chainId: number | string;
+  to: string;
+  data: string;
+  from?: string;
+  value?: number | string;
+  blockNumber?: number | string;
+}
+
 export interface M2MSentinelErrorOptions {
   status?: number;
   body?: unknown;
@@ -56,6 +65,7 @@ export class M2MSentinelClient {
   getCapabilityScore(address: string, options?: M2MSentinelClientOptions): Promise<any>;
   /** Legacy alias. The response is a capability coverage index, not a safety score. */
   getSecurityScore(address: string, options?: M2MSentinelClientOptions): Promise<any>;
+  preflightTransaction(transaction: TransactionPreflightRequest, options?: M2MSentinelClientOptions): Promise<any>;
   getGasFees(options?: M2MSentinelClientOptions): Promise<any>;
   getDexMetrics(options?: M2MSentinelClientOptions): Promise<any>;
   getTokenPrice(symbol: string, options?: M2MSentinelClientOptions): Promise<any>;

package/index.js

@@ -128,6 +128,9 @@ class M2MSentinelClient {
   getCapabilityScore(address, options) { return this.request('GET', '/v1/security/score/' + encodeURIComponent(address), undefined, options); }
   // Legacy method name; the response is a capability coverage index, not a safety score.
   getSecurityScore(address, options) { return this.request('GET', '/v1/security/score/' + encodeURIComponent(address), undefined, options); }
+  preflightTransaction(transaction, options) {
+    return this.request('POST', '/v1/transaction/preflight', transaction, options);
+  }
   getGasFees(options) { return this.request('GET', '/v1/gas/fees', undefined, options); }
   getDexMetrics(options) { return this.request('GET', '/v1/dex/metrics', undefined, options); }
   getTokenPrice(symbol, options) { return this.request('GET', '/v1/token/price/' + encodeURIComponent(symbol), undefined, options); }

package/mcp_server.js

@@ -8,7 +8,7 @@ const readline = require('readline');
 let BASE_URL = process.env.M2M_SENTINEL_BASE_URL || 'https://api.m2msentinel.com';
 let API_KEY = process.env.M2M_SENTINEL_API_KEY || '';
 const TIMEOUT_MS = Number(process.env.M2M_SENTINEL_TIMEOUT_MS || 30000);
-const VERSION = '1.2.1';
+const VERSION = '1.2.3';
 
 const TOOLS = [
   {
@@ -387,7 +387,7 @@ async function runCli(args) {
       console.log(`Network:         Base Mainnet (8453)`);
       console.log(`Latency:         ${res.latencyMs}ms`);
       console.log('================================================================');
-      
+
       const proxy = auditObj.proxyResolution || auditObj.proxy || {};
       const isProxy = !!proxy.isProxy;
       if (isProxy) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m2msentinel/sdk",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "mcpName": "io.github.M2M-Sentinel/m2m-sentinel-sdk",
   "publishConfig": {
     "access": "public"

package/typescript/index.ts

@@ -18,6 +18,15 @@ export interface RecoveryChallengeOptions {
   txHash?: string;
 }
 
+export interface TransactionPreflightRequest {
+  chainId: number | string;
+  to: string;
+  data: string;
+  from?: string;
+  value?: number | string;
+  blockNumber?: number | string;
+}
+
 export interface M2MSentinelErrorOptions {
   status?: number;
   body?: any;
@@ -155,6 +164,7 @@ export class M2MSentinelClient {
   public getCapabilityScore(address: string, options?: M2MSentinelClientOptions) { return this.request<any>('GET', `/v1/security/score/${encodeURIComponent(address)}`, undefined, options); }
   /** Legacy name. The response is a capability coverage index, not a safety score. */
   public getSecurityScore(address: string, options?: M2MSentinelClientOptions) { return this.request<any>('GET', `/v1/security/score/${encodeURIComponent(address)}`, undefined, options); }
+  public preflightTransaction(transaction: TransactionPreflightRequest, options?: M2MSentinelClientOptions) { return this.request<any>('POST', '/v1/transaction/preflight', transaction, options); }
   public getGasFees(options?: M2MSentinelClientOptions) { return this.request<any>('GET', '/v1/gas/fees', undefined, options); }
   public getDexMetrics(options?: M2MSentinelClientOptions) { return this.request<any>('GET', '/v1/dex/metrics', undefined, options); }
   public getTokenPrice(symbol: string, options?: M2MSentinelClientOptions) { return this.request<any>('GET', `/v1/token/price/${encodeURIComponent(symbol)}`, undefined, options); }

package/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "m2m-sentinel-sdk",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Source-distributed TypeScript client for M2M Sentinel Base capability intelligence API",
   "main": "index.ts",
   "types": "index.ts",

package/typescript/x402.ts

@@ -39,6 +39,9 @@ export interface X402PaymentChallenge {
 export interface X402SignedAuthorizationV2 {
   x402Version: 2;
   resource?: any;
+  /** The server's advertised extensions, echoed back. The CDP Bazaar indexes a
+   *  resource from the bazaar extension carried by the settlement. */
+  extensions?: any;
   /** The chosen offer echoed back verbatim. The server deep-equality matches
    *  this against its own requirements to learn which offer is being paid. */
   accepted: any;
@@ -271,6 +274,12 @@ export class X402SignerClient {
         x402Version: 2,
         resource: challenge.resource,
         accepted: offer,
+          // Echo the server's advertised extensions back. The canonical client
+          // merges paymentRequired.extensions into the payload; omitting the
+          // field still settles the payment, so this failed silently -- but the
+          // CDP Bazaar indexes a resource from the bazaar extension carried by
+          // the settlement, so a payment without it is invisible to discovery.
+        extensions: challenge.extensions,
         payload: {
           authorization: {
             from: fromAddress,
@@ -309,7 +318,7 @@ export class X402SignerClient {
 
   async fetchWithAutoPayment(path: string, options: any = {}): Promise<any> {
     const url = path.startsWith('http') ? path : `${this.baseUrl}/${path.replace(/^\/+/, '')}`;
-    const headers = { 'Accept': 'application/json', 'User-Agent': '@m2msentinel/sdk-ts/1.2.1', ...(options.headers || {}) };
+    const headers = { 'Accept': 'application/json', 'User-Agent': '@m2msentinel/sdk-ts/1.2.3', ...(options.headers || {}) };
 
     let res = await fetch(url, { method: options.method || 'GET', headers, body: options.body });
     if (res.status !== 402) {

package/x402_signer.js

@@ -189,6 +189,12 @@ class X402SignerClient {
         x402Version: 2,
         resource: challenge.resource,
         accepted: offer,
+          // Echo the server's advertised extensions back. The canonical client
+          // merges paymentRequired.extensions into the payload; omitting the
+          // field still settles the payment, so this failed silently -- but the
+          // CDP Bazaar indexes a resource from the bazaar extension carried by
+          // the settlement, so a payment without it is invisible to discovery.
+        extensions: challenge.extensions,
         payload: {
           authorization: {
             from: message.from,
@@ -265,7 +271,7 @@ class X402SignerClient {
         path: url.pathname + url.search,
         method: options.method || 'GET',
         headers: {
-          'User-Agent': 'M2M-Sentinel-X402Signer/1.2.1',
+          'User-Agent': 'M2M-Sentinel-X402Signer/1.2.3',
           'Accept': 'application/json',
           ...(options.headers || {})
         },