@paystage/preflight 0.2.1 → 0.2.2

package/README.md

@@ -87,8 +87,24 @@ CAIP-2 identifiers.
 | `review`      | Allowed but above a human threshold — ask a human before paying.        |
 | `do_not_pay`  | Violates policy (network, asset, payTo, amount, timeout, or malformed). |
 
+## Supply chain and access
+
+Socket.dev scores this package on what it *can* do, not what it does with it, so the
+flags it raises are worth explaining rather than removing:
+
+| Flag | Why it is there |
+| --- | --- |
+| Filesystem access | Reads the policy JSON you point it at (`policy_path` / `PAYSTAGE_POLICY_PATH`). Nothing is written. |
+| Environment variable access | `PAYSTAGE_POLICY_PATH` only (and `PAYSTAGE_RPC_URL` via `auth-watch`). |
+| Network access, URL strings | None in this package. The RPC endpoints you may see in the tree belong to `@paystage/auth-watch`. |
+
+No shell, no `eval`, no telemetry, no key custody. The full table is in
+[SECURITY.md](../../SECURITY.md); the deny list is published with a citation per
+entry in [KNOWN_DRAINERS.md](./KNOWN_DRAINERS.md).
+
 ## Links
 
 - Website: <https://paystage.xyz>
+- X: <https://x.com/paystage_xyz>
 - Source: <https://github.com/base-buzz/paystage>
 - License: MIT

package/dist/evaluate.d.ts

@@ -34,5 +34,12 @@ export interface EvaluateResult {
     summary: string;
     dailyCapNote?: string;
 }
-export declare function evaluatePayment(pr: PaymentRequest, policy: Policy): EvaluateResult;
+export interface EvaluateOptions {
+    /**
+     * Which agent is asking. Required when the policy declares per-agent budgets:
+     * a policy with agents must never fall back to the loosest rules in the file.
+     */
+    agentId?: string;
+}
+export declare function evaluatePayment(pr: PaymentRequest, policy: Policy, options?: EvaluateOptions): EvaluateResult;
 //# sourceMappingURL=evaluate.d.ts.map

package/dist/evaluate.js

@@ -1,4 +1,4 @@
-import { humanToAtomic, atomicToHuman, } from "@paystage/policy";
+import { humanToAtomic, atomicToHuman, resolveAgentPolicy, } from "@paystage/policy";
 import { isKnownDrainer } from "./known-drainers.js";
 function eq(a, b) {
     return a.toLowerCase() === b.toLowerCase();
@@ -88,7 +88,20 @@ function cheapest(accepts) {
         return a.maxTimeoutSeconds - b.maxTimeoutSeconds;
     })[0];
 }
-export function evaluatePayment(pr, policy) {
+export function evaluatePayment(pr, policy, options = {}) {
+    // Rule 0: per-agent budgets. Resolve first — every later rule must run against the
+    // narrowed policy, not the global one, or a cheap agent could be judged by the
+    // expensive agent's ceiling.
+    const resolution = resolveAgentPolicy(policy, options.agentId);
+    if (!resolution.ok) {
+        return {
+            decision: "do_not_pay",
+            acceptResults: [],
+            reasons: [resolution.reason],
+            summary: "Agent identity could not be resolved against the policy.",
+        };
+    }
+    const effective = resolution.policy;
     // Rule 1: malformed
     if (!pr || pr.x402Version !== 2) {
         return {
@@ -106,7 +119,7 @@ export function evaluatePayment(pr, policy) {
             summary: "Payment request has no acceptable payment options.",
         };
     }
-    const acceptResults = pr.accepts.map((a) => evaluateAccept(a, policy));
+    const acceptResults = pr.accepts.map((a) => evaluateAccept(a, effective));
     const payAccepts = acceptResults
         .filter((r) => r.status === "pay")
         .map((r) => r.accept);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paystage/preflight",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Evaluate x402 PaymentRequired against a local spending policy before an agent pays",
   "license": "MIT",
   "type": "module",
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "^2.4.0",
-    "@paystage/policy": "0.2.0",
+    "@paystage/policy": "0.2.1",
     "zod": "^4.6.7"
   },
   "devDependencies": {

package/server.json

@@ -3,7 +3,7 @@
   "name": "xyz.paystage/preflight",
   "title": "PayStage Preflight",
   "description": "Evaluate x402 PaymentRequired against a local spending policy before an agent pays",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "websiteUrl": "https://paystage.xyz",
   "repository": {
     "url": "https://github.com/base-buzz/paystage",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@paystage/preflight",
-      "version": "0.2.0",
+      "version": "0.2.2",
       "transport": {
         "type": "stdio"
       },