@rine-network/openclaw 0.2.1 → 0.3.0

package/README.md

@@ -141,12 +141,30 @@ real peer. With a non-`*` `channels.rine.allowFrom`, add the agent's own handle
 ## Tools
 
 `rine_whoami`, `rine_discover`, `rine_read`, `rine_inbox`, `rine_thread`, and
-(allowlist-gated, mutating) `rine_send`, `rine_onboard`. Decryption happens on demand inside the handler; the raw
-`encrypted_payload` is **never** surfaced to a transcript — only `decrypted` + `verified`.
-
-`rine_send` / `rine_onboard` are `optional` tools — allowlist them (or run with an approval
-channel) before the model can call them. On a headless install they degrade with an
-actionable error rather than hanging.
+(allowlist-gated, mutating) `rine_send`, `rine_pay`, `rine_fulfill`, `rine_onboard`.
+Decryption happens on demand inside the handler; the raw `encrypted_payload` is **never**
+surfaced to a transcript — only `decrypted` + `verified`.
+
+`rine_send`, `rine_pay`, `rine_fulfill`, and `rine_onboard` are `optional` tools —
+allowlist them (or run with an approval channel) before the model can call them. On a
+headless install they degrade with an actionable error rather than hanging.
+
+## Payments (x402)
+
+An inbound x402 payment frame wakes the agent (the frame stays agent-visible, no canned
+reply is sent), and the agent pays or charges through two allowlist-gated
+[x402](https://docs.rine.network/concepts/x402-payments/) tools. `rine_pay` reads a
+`rine.v1.x402_payment_required` quote, checks it against the agent's deny-by-default spend
+policy, signs an EIP-3009 stablecoin authorization with the agent's wallet key, and sends
+the payment in-thread — returning one of the shared payer statuses (`payment-submitted`,
+`no-wallet`, `not-payment-required`, `policy-refused`, `above-auto-pay-threshold`,
+`already-paid`, `wallet-busy`). `rine_fulfill` verifies and settles a received
+`rine.v1.x402_payment` through a facilitator and threads a receipt. The wallet key lives
+only on the Gateway host and is never surfaced to a transcript.
+
+Auto-pay is **opt-in, off by default**: set `channels.rine.payments.autoPay: true` in
+`openclaw.json` to default `rine_pay` to paying only quotes at/below the wallet policy's
+auto-pay threshold. Caps, deny-by-default, and the reserve lock bound every path regardless.
 
 ## Sender allowlist
 

package/dist/{channel-BPBnthxw.js → channel-gwGzeOb6.js}

@@ -1,5 +1,5 @@
 import { patchTopLevelChannelConfigSection } from "openclaw/plugin-sdk/setup";
-import { HttpClient, getCredentialEntry, getOrRefreshToken, resolveApiUrl, resolveConfigDir } from "@rine-network/core";
+import { HttpClient, getCredentialEntry, getOrRefreshToken, jitteredRefreshMargin, resolveApiUrl, resolveConfigDir } from "@rine-network/core";
 import { tools } from "@rine-network/mcp/tools";
 //#region src/constants.ts
 /**
@@ -49,10 +49,15 @@ function asAllowFrom(v) {
 	}
 	return ["*"];
 }
+/** Opt-in payments posture: auto-pay defaults OFF (D2). */
+function asPayments(v) {
+	return { autoPay: asRecord(v).autoPay === true };
+}
 /** Resolve the typed config from a raw config record (or `{}`), applying defaults. */
 function resolveRineConfig(raw = {}) {
 	return {
 		transport: asTransport(raw.transport),
+		payments: asPayments(raw.payments),
 		configDir: asString(raw.configDir),
 		agentId: asString(raw.agentId),
 		baseUrl: asString(raw.baseUrl),
@@ -150,7 +155,11 @@ const POLL_REQUEST_TIMEOUT_MS = 3e4;
 */
 function buildRineClient(creds) {
 	const { configDir, apiUrl, entry } = creds;
-	const getJwt = (force) => getOrRefreshToken(configDir, apiUrl, entry, DEFAULT_ACCOUNT_ID, { force });
+	const refreshMargin = jitteredRefreshMargin();
+	const getJwt = (force) => getOrRefreshToken(configDir, apiUrl, entry, DEFAULT_ACCOUNT_ID, {
+		force,
+		refreshMargin
+	});
 	const client = new HttpClient({
 		tokenFn: getJwt,
 		apiUrl,

package/dist/index.js

@@ -1,4 +1,4 @@
-import { i as readRineCredentials, n as buildRineClient, o as resolveRineConfigFromCfg, r as sendRineReply, s as INTERNAL_TOOLS, t as rinePlugin } from "./channel-BPBnthxw.js";
+import { i as readRineCredentials, n as buildRineClient, o as resolveRineConfigFromCfg, r as sendRineReply, s as INTERNAL_TOOLS, t as rinePlugin } from "./channel-gwGzeOb6.js";
 import { i as normalizeStandardWebhook, n as normalizeA2A, t as isAllowed } from "./inbound-DEe69mNL.js";
 import { defineChannelPluginEntry } from "openclaw/plugin-sdk/channel-core";
 import { fetchAgents, resolveAgent } from "@rine-network/core";
@@ -80,40 +80,26 @@ var configSchema = {
 				"default": false,
 				"description": "Whether OpenClaw's channel-health-monitor may restart this channel. Recommended false for rine — nothing to monitor."
 			} }
+		},
+		"payments": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "x402 payment posture. Opt-in auto-pay is OFF by default: rine_pay stays an explicit, caps-bounded tool call. The spend caps, autoPayThreshold, deny-by-default policy and journal live in the wallet spend policy (rine wallet policy), not here.",
+			"properties": { "autoPay": {
+				"type": "boolean",
+				"default": false,
+				"description": "When true, rine_pay defaults to threshold-gated auto-pay — it pays a quote only at/below the wallet policy's autoPayThreshold, else returns above-auto-pay-threshold. Default false: each rine_pay call is the explicit authorization (still bounded by the spend caps)."
+			} }
 		}
 	}
 };
 //#endregion
 //#region src/dispatch.ts
-/**
-* The Funnel relay self-sends this type (`from == to`); it is a one-way event the agent ACTS
-* on and must never auto-reply to (the reply is a self-send the server rejects). Compared as a
-* literal so the guard never depends on the installed SDK exporting a named constant — mirrors
-* the rine-hermes `_FUNNEL_WEBHOOK_TYPE` precedent.
-*/
-const WEBHOOK_TYPE = "rine.v1.webhook";
-/**
-* A one-way inbound: a Funnel webhook, or any self-addressed message (`from == to`). The agent
-* wakes to act via tools, but an auto-reply would target itself and be rejected (REQ-FSH-02).
-*/
-function isOneWayEvent(msg) {
-	return msg.type === WEBHOOK_TYPE || msg.selfSend === true;
-}
+/** Extract a human message from an unknown throwable (shared with `runtime-dispatch.ts`). */
 function msgOf(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 /**
-* The inline pointer body — ciphertext stays out of the transcript; agent calls `rine_read`.
-*
-* The body also binds the reply target to the SENDER. Without this, a model that replies via the
-* optional `rine_send` tool can copy the message's own `to_agent_id` (= this agent's id, surfaced
-* by `rine_read`) and self-target, producing `Unknown target` (TODO-4). The auto-routing path is
-* `rine_reply message_id=<id>`, which derives the recipient from the original sender server-side.
-*/
-function pointerText(msg) {
-	return `[rine ${msg.type} from ${msg.fromHandle}] message ${msg.id} (read with rine_read; reply with rine_reply message_id=${msg.id} — it auto-routes to ${msg.fromHandle}. If you use rine_send instead, set to=${msg.fromHandle}, never your own agent id.)`;
-}
-/**
 * Build the shared `onMessage` path all transports converge on.
 *
 * Invariants (acceptance §6):
@@ -161,6 +147,48 @@ function makeOnMessage(deps) {
 		return true;
 	};
 }
+//#endregion
+//#region src/runtime-dispatch.ts
+/**
+* The Funnel relay self-sends this type (`from == to`); it is a one-way event the agent ACTS
+* on and must never auto-reply to (the reply is a self-send the server rejects). Compared as a
+* literal so the guard never depends on the installed SDK exporting a named constant — mirrors
+* the rine-hermes `_FUNNEL_WEBHOOK_TYPE` precedent.
+*/
+const WEBHOOK_TYPE = "rine.v1.webhook";
+/**
+* A one-way inbound: a Funnel webhook, or any self-addressed message (`from == to`). The agent
+* wakes to act via tools, but an auto-reply would target itself and be rejected (REQ-FSH-02).
+*/
+function isOneWayEvent(msg) {
+	return msg.type === WEBHOOK_TYPE || msg.selfSend === true;
+}
+/**
+* The three x402 payment frames: the 402 quote, the signed authorization, and the settlement
+* receipt. Like a one-way event the agent still wakes to ACT (pay via the `rine_pay` tool, read
+* the receipt), but a canned TEXT auto-reply would be injected into the payment thread and
+* corrupt the x402 handshake. Compared as literals so the guard never depends on the installed
+* core SDK exporting `X402_MESSAGE_TYPE` — mirrors the WEBHOOK_TYPE precedent above.
+*/
+const X402_FRAME_TYPES = new Set([
+	"rine.v1.x402_payment_required",
+	"rine.v1.x402_payment",
+	"rine.v1.x402_receipt"
+]);
+function isX402Frame(msg) {
+	return X402_FRAME_TYPES.has(msg.type);
+}
+/**
+* The inline pointer body — ciphertext stays out of the transcript; agent calls `rine_read`.
+*
+* The body also binds the reply target to the SENDER. Without this, a model that replies via the
+* optional `rine_send` tool can copy the message's own `to_agent_id` (= this agent's id, surfaced
+* by `rine_read`) and self-target, producing `Unknown target` (TODO-4). The auto-routing path is
+* `rine_reply message_id=<id>`, which derives the recipient from the original sender server-side.
+*/
+function pointerText(msg) {
+	return `[rine ${msg.type} from ${msg.fromHandle}] message ${msg.id} (read with rine_read; reply with rine_reply message_id=${msg.id} — it auto-routes to ${msg.fromHandle}. If you use rine_send instead, set to=${msg.fromHandle}, never your own agent id.)`;
+}
 /**
 * Production dispatch fn: wakes an agent turn for one inbound rine message via the
 * canonical `dispatchInboundDirectDmWithRuntime` helper. `api.config` (cfg) and
@@ -203,6 +231,10 @@ function makeRuntimeDispatcher(params) {
 					logger.debug?.(`rine: no auto-reply for one-way ${msg.type} ${msg.id} (act via tools; reply would target self)`);
 					return;
 				}
+				if (isX402Frame(msg)) {
+					logger.debug?.(`rine: no auto-reply for x402 frame ${msg.type} ${msg.id} (act via the rine_pay tool; a text reply would corrupt the payment handshake)`);
+					return;
+				}
 				if (opts?.replayed) {
 					logger.debug?.(`rine: no auto-reply for catch-up/replayed ${msg.id} (live-phase frames only)`);
 					return;
@@ -482,10 +514,25 @@ const EXPOSED_TOOLS = [
 	"rine_read",
 	"rine_inbox",
 	"rine_thread",
-	"rine_onboard"
+	"rine_onboard",
+	"rine_pay",
+	"rine_fulfill"
 ];
 /** Mutating tools gated behind the allowlist (manifest `toolMetadata.optional`). */
-const OPTIONAL_TOOLS = new Set(["rine_send", "rine_onboard"]);
+const OPTIONAL_TOOLS = new Set([
+	"rine_send",
+	"rine_onboard",
+	"rine_pay",
+	"rine_fulfill"
+]);
+/**
+* Payee tools exposed only when the installed mcp actually provides them. `rine_fulfill`
+* ships in the mcp minor that lands the payee path; every PUBLISHED openclaw pins an mcp
+* `^`-range that includes it, so real installs always expose it. This lenience only covers
+* the version window where a locally-linked mcp predates the payee tool — it never masks a
+* skew of a tool openclaw's core function depends on (those stay strict via `requireTool`).
+*/
+const LENIENT_TOOLS = new Set(["rine_fulfill"]);
 const CIPHERTEXT_KEYS = ["encrypted_payload", "self_encrypted_payload"];
 /**
 * Strip raw ciphertext from any tool result before it reaches a transcript.
@@ -511,10 +558,19 @@ function requireTool(byName, name, all) {
 	if (!def) throw new Error(`rine: expected mcp tool "${name}" not found in @rine-network/mcp/tools (got: ${all.map((t) => t.name).join(", ")}) — version skew`);
 	return def;
 }
-/** Filter mcp tools to the exposed set; fail loud on a missing name (version skew). */
+/**
+* Filter mcp tools to the exposed set; fail loud on a missing name (version skew). A
+* {@link LENIENT_TOOLS} entry absent from the installed mcp is skipped (not thrown) so a
+* locally-linked mcp that predates the payee tool still loads — everything else is strict.
+*/
 function selectExposedTools(all = tools) {
 	const byName = new Map(all.map((t) => [t.name, t]));
-	return EXPOSED_TOOLS.map((name) => requireTool(byName, name, all));
+	const out = [];
+	for (const name of EXPOSED_TOOLS) {
+		if (LENIENT_TOOLS.has(name) && !byName.has(name)) continue;
+		out.push(requireTool(byName, name, all));
+	}
+	return out;
 }
 /**
 * Validate the undeclared internal tools the plugin relies on (e.g. `rine_reply`,
@@ -555,18 +611,39 @@ function toOpenClawTool(def, ctx) {
 	};
 }
 /**
-* Register the exposed rine tools on the plugin api. `rine_send`/`rine_onboard`
-* are registered `{ optional: true }` (allowlist gating per manifest toolMetadata).
-* Internal deps (`rine_reply`) are validated here too so version skew fails at load.
+* Opt-in auto-pay (D2). When `channels.rine.payments.autoPay` is true, the exposed
+* `rine_pay` tool defaults its `auto_pay` argument to `true` — so a call that omits the
+* argument pays only at/below the wallet policy's `autoPayThreshold` (and returns
+* `above-auto-pay-threshold` otherwise). The model may still pass `auto_pay: false`
+* explicitly to override. Default OFF leaves the shipped explicit-authorization semantics
+* untouched. The wrapper only re-defaults one argument — the caps, deny-by-default policy,
+* journal and reserve-lock all stay in rine-core, unchanged.
+*/
+function withAutoPayDefault(def, autoPay) {
+	if (!autoPay || def.name !== "rine_pay") return def;
+	return {
+		...def,
+		handler: (ctx, params) => def.handler(ctx, {
+			auto_pay: true,
+			...params ?? {}
+		})
+	};
+}
+/**
+* Register the exposed rine tools on the plugin api. `rine_send`/`rine_onboard` and the
+* fund-moving `rine_pay`/`rine_fulfill` are registered `{ optional: true }` (allowlist
+* gating per manifest toolMetadata). Internal deps (`rine_reply`) are validated here too so
+* version skew fails at load. With `opts.autoPay`, `rine_pay` is threshold-gated by default.
 */
-function registerRineTools(api, ctx) {
-	assertInternalTools();
-	for (const def of selectExposedTools()) {
-		const opts = OPTIONAL_TOOLS.has(def.name) ? {
+function registerRineTools(api, ctx, opts = {}) {
+	assertInternalTools(opts.tools);
+	for (const def of selectExposedTools(opts.tools)) {
+		const tuned = withAutoPayDefault(def, opts.autoPay === true);
+		const regOpts = OPTIONAL_TOOLS.has(def.name) ? {
 			name: def.name,
 			optional: true
 		} : { name: def.name };
-		api.registerTool(toOpenClawTool(def, ctx), opts);
+		api.registerTool(toOpenClawTool(tuned, ctx), regOpts);
 	}
 }
 //#endregion
@@ -587,7 +664,8 @@ var rine_openclaw_default = defineChannelPluginEntry({
 		uiHints
 	},
 	registerFull(api) {
-		registerRineTools(api, buildRineClient(readRineCredentials(resolveRineConfigFromCfg(api.config))).toolContext);
+		const config = resolveRineConfigFromCfg(api.config);
+		registerRineTools(api, buildRineClient(readRineCredentials(config)).toolContext, { autoPay: config.payments.autoPay });
 		registerExposeRoute(api);
 		api.registerService(makeRineService(api));
 	}

package/dist/setup.js

@@ -1,4 +1,4 @@
-import { a as resolveRineConfig, i as readRineCredentials, t as rinePlugin } from "./channel-BPBnthxw.js";
+import { a as resolveRineConfig, i as readRineCredentials, t as rinePlugin } from "./channel-gwGzeOb6.js";
 import { defineSetupPluginEntry } from "openclaw/plugin-sdk/channel-core";
 //#region setup.ts
 /** Auto-detect existing rine creds for the setup flow. Pure read; no writes. */

package/dist/src/dispatch.d.ts

@@ -1,11 +1,11 @@
-import type { OpenClawConfig, PluginLogger, PluginRuntime } from "openclaw/plugin-sdk";
+import type { PluginLogger } from "openclaw/plugin-sdk";
 import type { RineClient } from "./rine-client.js";
 import type { RineConfig, RineInbound } from "./types.js";
 /**
  * The agent-turn dispatch fn — injected so the dedupe/ordering logic is unit-testable
- * without the SDK. In production it wraps `dispatchInboundDirectDmWithRuntime`
- * (`openclaw/plugin-sdk/channel-inbound`), the canonical inbound→agent-turn helper that
- * routes, finalizes the PascalCase ctx, records the session, and dispatches.
+ * without the SDK. In production it wraps `dispatchInboundDirectDmWithRuntime` via
+ * `makeRuntimeDispatcher` (`runtime-dispatch.ts`), the canonical inbound→agent-turn
+ * helper that routes, finalizes the PascalCase ctx, records the session, and dispatches.
  */
 export type DispatchFn = (msg: RineInbound, signal: AbortSignal, opts?: DispatchOpts) => Promise<void>;
 /**
@@ -36,15 +36,8 @@ export interface OnMessageDeps {
  * a transient error that must be retried, so the cursor must stay behind it.
  */
 export type OnMessage = (msg: RineInbound, opts?: DispatchOpts) => Promise<boolean>;
-/**
- * The inline pointer body — ciphertext stays out of the transcript; agent calls `rine_read`.
- *
- * The body also binds the reply target to the SENDER. Without this, a model that replies via the
- * optional `rine_send` tool can copy the message's own `to_agent_id` (= this agent's id, surfaced
- * by `rine_read`) and self-target, producing `Unknown target` (TODO-4). The auto-routing path is
- * `rine_reply message_id=<id>`, which derives the recipient from the original sender server-side.
- */
-export declare function pointerText(msg: RineInbound): string;
+/** Extract a human message from an unknown throwable (shared with `runtime-dispatch.ts`). */
+export declare function msgOf(err: unknown): string;
 /**
  * Build the shared `onMessage` path all transports converge on.
  *
@@ -56,18 +49,3 @@ export declare function pointerText(msg: RineInbound): string;
  *    delivered (recoverable after the operator fixes allowFrom + restarts the gateway).
  */
 export declare function makeOnMessage(deps: OnMessageDeps): OnMessage;
-/**
- * Production dispatch fn: wakes an agent turn for one inbound rine message via the
- * canonical `dispatchInboundDirectDmWithRuntime` helper. `api.config` (cfg) and
- * `api.runtime` (the `DirectDmRuntime` facade) are threaded in from the service.
- *
- * Keeps the pointer-body design: `pointerText(msg)` carries only a "read with rine_read"
- * pointer, so ciphertext never enters the transcript.
- */
-export declare function makeRuntimeDispatcher(params: {
-    cfg: OpenClawConfig;
-    runtime: PluginRuntime;
-    client: RineClient;
-    agentId: string;
-    logger: PluginLogger;
-}): DispatchFn;

package/dist/src/runtime-dispatch.d.ts

@@ -0,0 +1,28 @@
+import type { OpenClawConfig, PluginLogger, PluginRuntime } from "openclaw/plugin-sdk";
+import { type DispatchFn } from "./dispatch.js";
+import type { RineClient } from "./rine-client.js";
+import type { RineInbound } from "./types.js";
+/**
+ * The inline pointer body — ciphertext stays out of the transcript; agent calls `rine_read`.
+ *
+ * The body also binds the reply target to the SENDER. Without this, a model that replies via the
+ * optional `rine_send` tool can copy the message's own `to_agent_id` (= this agent's id, surfaced
+ * by `rine_read`) and self-target, producing `Unknown target` (TODO-4). The auto-routing path is
+ * `rine_reply message_id=<id>`, which derives the recipient from the original sender server-side.
+ */
+export declare function pointerText(msg: RineInbound): string;
+/**
+ * Production dispatch fn: wakes an agent turn for one inbound rine message via the
+ * canonical `dispatchInboundDirectDmWithRuntime` helper. `api.config` (cfg) and
+ * `api.runtime` (the `DirectDmRuntime` facade) are threaded in from the service.
+ *
+ * Keeps the pointer-body design: `pointerText(msg)` carries only a "read with rine_read"
+ * pointer, so ciphertext never enters the transcript.
+ */
+export declare function makeRuntimeDispatcher(params: {
+    cfg: OpenClawConfig;
+    runtime: PluginRuntime;
+    client: RineClient;
+    agentId: string;
+    logger: PluginLogger;
+}): DispatchFn;

package/dist/src/tools.d.ts

@@ -2,7 +2,7 @@ import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
 import type { AnyAgentTool } from "openclaw/plugin-sdk";
 import type { ToolContext, ToolDef } from "@rine-network/mcp/tools";
 /** Tools exposed by the plugin (filtered from the mcp tool array). */
-export declare const EXPOSED_TOOLS: readonly ["rine_whoami", "rine_discover", "rine_send", "rine_read", "rine_inbox", "rine_thread", "rine_onboard"];
+export declare const EXPOSED_TOOLS: readonly ["rine_whoami", "rine_discover", "rine_send", "rine_read", "rine_inbox", "rine_thread", "rine_onboard", "rine_pay", "rine_fulfill"];
 /** Mutating tools gated behind the allowlist (manifest `toolMetadata.optional`). */
 export declare const OPTIONAL_TOOLS: Set<string>;
 /**
@@ -12,7 +12,11 @@ export declare const OPTIONAL_TOOLS: Set<string>;
  * `decrypted`/`verified` fields the mcp handlers add.
  */
 export declare function stripCiphertext(value: unknown): unknown;
-/** Filter mcp tools to the exposed set; fail loud on a missing name (version skew). */
+/**
+ * Filter mcp tools to the exposed set; fail loud on a missing name (version skew). A
+ * {@link LENIENT_TOOLS} entry absent from the installed mcp is skipped (not thrown) so a
+ * locally-linked mcp that predates the payee tool still loads — everything else is strict.
+ */
 export declare function selectExposedTools(all?: ToolDef[]): ToolDef[];
 /**
  * Validate the undeclared internal tools the plugin relies on (e.g. `rine_reply`,
@@ -33,8 +37,24 @@ export declare function assertInternalTools(all?: ToolDef[]): void;
  */
 export declare function toOpenClawTool(def: ToolDef, ctx: ToolContext): AnyAgentTool;
 /**
- * Register the exposed rine tools on the plugin api. `rine_send`/`rine_onboard`
- * are registered `{ optional: true }` (allowlist gating per manifest toolMetadata).
- * Internal deps (`rine_reply`) are validated here too so version skew fails at load.
+ * Opt-in auto-pay (D2). When `channels.rine.payments.autoPay` is true, the exposed
+ * `rine_pay` tool defaults its `auto_pay` argument to `true` — so a call that omits the
+ * argument pays only at/below the wallet policy's `autoPayThreshold` (and returns
+ * `above-auto-pay-threshold` otherwise). The model may still pass `auto_pay: false`
+ * explicitly to override. Default OFF leaves the shipped explicit-authorization semantics
+ * untouched. The wrapper only re-defaults one argument — the caps, deny-by-default policy,
+ * journal and reserve-lock all stay in rine-core, unchanged.
+ */
+export declare function withAutoPayDefault(def: ToolDef, autoPay: boolean): ToolDef;
+/** Options for {@link registerRineTools}. `tools` is a test seam (defaults to mcpTools). */
+export interface RegisterToolsOptions {
+    autoPay?: boolean;
+    tools?: ToolDef[];
+}
+/**
+ * Register the exposed rine tools on the plugin api. `rine_send`/`rine_onboard` and the
+ * fund-moving `rine_pay`/`rine_fulfill` are registered `{ optional: true }` (allowlist
+ * gating per manifest toolMetadata). Internal deps (`rine_reply`) are validated here too so
+ * version skew fails at load. With `opts.autoPay`, `rine_pay` is threshold-gated by default.
  */
-export declare function registerRineTools(api: OpenClawPluginApi, ctx: ToolContext): void;
+export declare function registerRineTools(api: OpenClawPluginApi, ctx: ToolContext, opts?: RegisterToolsOptions): void;

package/dist/src/types.d.ts

@@ -35,6 +35,19 @@ export interface RineInbound {
     /** Group id (uuid) for group decrypt. */
     groupId?: string;
 }
+/**
+ * x402 payment posture (D2). Opt-in, default OFF: with `autoPay` false the exposed
+ * `rine_pay` tool keeps its shipped explicit-authorization semantics (each call is the
+ * authorization, bounded by the wallet spend caps). With `autoPay` true the tool defaults
+ * to threshold-gated auto-pay — it pays a quote only at/below the wallet policy's
+ * `autoPayThreshold` and returns `above-auto-pay-threshold` otherwise. The threshold, caps,
+ * deny-by-default policy, journal and reserve-lock all live in the wallet spend policy
+ * (`rine wallet policy`, enforced in rine-core); this flag only flips the tool-call default,
+ * it never widens a cap and never touches dispatch.
+ */
+export interface RinePaymentsConfig {
+    autoPay: boolean;
+}
 /** Resolved plugin config (after defaults). Mirrors `openclaw.plugin.json` configSchema. */
 export interface RineConfig {
     transport: "expose" | "sse" | "poll";
@@ -47,6 +60,7 @@ export interface RineConfig {
     exposeBaseUrl?: string;
     a2aAcceptCleartext: boolean;
     allowFrom: string[];
+    payments: RinePaymentsConfig;
 }
 /** Disposition for a sender vs the allowlist. */
 export type AllowDecision = "allowed" | "quarantined";

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "kind": "channel",
   "name": "rine",
   "description": "Agent-to-agent E2EE messaging over the rine network (A2A relay / SSE / poll).",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "channels": ["rine"],
   "skills": ["skills/rine"],
   "activation": { "onStartup": true },
@@ -15,12 +15,16 @@
       "rine_read",
       "rine_inbox",
       "rine_thread",
-      "rine_onboard"
+      "rine_onboard",
+      "rine_pay",
+      "rine_fulfill"
     ]
   },
   "toolMetadata": {
     "rine_send": { "optional": true },
-    "rine_onboard": { "optional": true }
+    "rine_onboard": { "optional": true },
+    "rine_pay": { "optional": true },
+    "rine_fulfill": { "optional": true }
   },
   "uiHints": {
     "exposeBaseUrl": {
@@ -98,6 +102,18 @@
                 "description": "Whether OpenClaw's channel-health-monitor may restart this channel. Recommended false for rine — nothing to monitor."
               }
             }
+          },
+          "payments": {
+            "type": "object",
+            "additionalProperties": false,
+            "description": "x402 payment posture. Opt-in auto-pay is OFF by default: rine_pay stays an explicit, caps-bounded tool call. The spend caps, autoPayThreshold, deny-by-default policy and journal live in the wallet spend policy (rine wallet policy), not here.",
+            "properties": {
+              "autoPay": {
+                "type": "boolean",
+                "default": false,
+                "description": "When true, rine_pay defaults to threshold-gated auto-pay — it pays a quote only at/below the wallet policy's autoPayThreshold, else returns above-auto-pay-threshold. Default false: each rine_pay call is the explicit authorization (still bounded by the spend caps)."
+              }
+            }
           }
         }
       }
@@ -166,6 +182,18 @@
             "description": "Whether OpenClaw's channel-health-monitor may restart this channel. Recommended false for rine — nothing to monitor."
           }
         }
+      },
+      "payments": {
+        "type": "object",
+        "additionalProperties": false,
+        "description": "x402 payment posture. Opt-in auto-pay is OFF by default: rine_pay stays an explicit, caps-bounded tool call. The spend caps, autoPayThreshold, deny-by-default policy and journal live in the wallet spend policy (rine wallet policy), not here.",
+        "properties": {
+          "autoPay": {
+            "type": "boolean",
+            "default": false,
+            "description": "When true, rine_pay defaults to threshold-gated auto-pay — it pays a quote only at/below the wallet policy's autoPayThreshold, else returns above-auto-pay-threshold. Default false: each rine_pay call is the explicit authorization (still bounded by the spend caps)."
+          }
+        }
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rine-network/openclaw",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Official OpenClaw plugin for rine.network \u2014 agent-to-agent E2EE messaging as a native channel, with A2A-relay / SSE / poll transports, tools, and the bundled rine skill.",
   "type": "module",
   "main": "dist/index.js",
@@ -64,8 +64,8 @@
     "prepublishOnly": "node scripts/check-no-file-deps.mjs"
   },
   "dependencies": {
-    "@rine-network/core": "^0.8.1",
-    "@rine-network/mcp": "^0.6.0"
+    "@rine-network/core": "^0.11.0",
+    "@rine-network/mcp": "^0.8.0"
   },
   "peerDependencies": {
     "openclaw": ">=2026.6.1"