@scriptmasterlabs/mcp-x402 2.0.2 → 2.1.0

package/src/server/payments/x402.ts

@@ -1,177 +0,0 @@
-import { z } from 'zod';
-import { AuditLogger } from '../security/audit.js';
-import { AP2Client } from './ap2.js';
-import { WalletManager } from './wallet.js';
-import { ChainRouter } from './router.js';
-import { ReceiptStore } from './receipt.js';
-import { CreditBureau } from '../../lib/credit/bureau.js';
-import { PriceRegistry } from '../registry/pricing.js';
-
-export const PaymentConfigSchema = z.object({
-  price: z.string().regex(/^\d+(\.\d+)?$/),
-  currency: z.enum(['USDC', 'RLUSD']),
-  toolName: z.string(),
-  walletAddress: z.string().optional(),
-});
-
-export type PaymentConfig = z.infer<typeof PaymentConfigSchema>;
-
-export interface PaymentResult {
-  receiptId: string;
-  txHash: string;
-  chain: string;
-  amountPaid: string;
-  currency: string;
-  timestamp: number;
-  walletAddress: string;
-}
-
-const AUTO_APPROVE_THRESHOLD = parseFloat(
-  process.env['AUTO_APPROVE_THRESHOLD_USD'] ?? '1.0',
-);
-
-const DAILY_SPEND_CAP = parseFloat(
-  process.env['DAILY_SPEND_CAP_USD'] ?? '50.0',
-);
-
-const dailySpend = new Map<string, { amount: number; date: string }>();
-
-function getTodayKey(): string {
-  return new Date().toISOString().slice(0, 10);
-}
-
-function getDailySpend(wallet: string): number {
-  const today = getTodayKey();
-  const entry = dailySpend.get(wallet);
-  if (!entry || entry.date !== today) return 0;
-  return entry.amount;
-}
-
-function addDailySpend(wallet: string, amount: number): void {
-  const today = getTodayKey();
-  const current = getDailySpend(wallet);
-  dailySpend.set(wallet, { amount: current + amount, date: today });
-}
-
-export async function executeX402Payment(
-  config: PaymentConfig,
-): Promise<PaymentResult> {
-  const audit = AuditLogger.getInstance();
-  const wallet = await WalletManager.getInstance().getOrCreateWallet();
-  const walletAddress = wallet.address;
-
-  // Enforce daily spend cap (N9)
-  const priceNum = parseFloat(config.price);
-  const currentSpend = getDailySpend(walletAddress);
-  if (currentSpend + priceNum > DAILY_SPEND_CAP) {
-    audit.warn('spend_cap_exceeded', {
-      wallet: walletAddress,
-      current: currentSpend,
-      requested: priceNum,
-      cap: DAILY_SPEND_CAP,
-    });
-    throw new Error(
-      `Daily spend cap of $${DAILY_SPEND_CAP} exceeded. Current: $${currentSpend.toFixed(4)}`,
-    );
-  }
-
-  // Verify price cache freshness (N12)
-  const cachedPrice = await PriceRegistry.getInstance().getPrice(config.toolName);
-  if (!cachedPrice) {
-    throw new Error('Price data stale or unavailable. Rejecting payment.');
-  }
-  if (cachedPrice !== config.price) {
-    throw new Error(
-      `Price mismatch: expected ${cachedPrice}, got ${config.price}. Cache may be stale.`,
-    );
-  }
-
-  // Credit Bureau check (N8)
-  const score = await CreditBureau.getInstance().getScore(walletAddress);
-  const autoApprove = priceNum <= AUTO_APPROVE_THRESHOLD && score >= 300;
-
-  audit.info('payment_attempt', {
-    tool: config.toolName,
-    price: config.price,
-    currency: config.currency,
-    wallet: walletAddress,
-    bureauScore: score,
-    autoApprove,
-  });
-
-  if (!autoApprove && score < 300) {
-    throw new Error(
-      `Credit Bureau score ${score} below minimum 300. Payment requires manual approval.`,
-    );
-  }
-
-  // AP2 mandate verification (N6)
-  const ap2 = AP2Client.getInstance();
-  const mandateValid = await ap2.verifyMandate(walletAddress, {
-    maxAmount: config.price,
-    currency: config.currency,
-    toolName: config.toolName,
-  });
-
-  if (!mandateValid) {
-    audit.warn('ap2_mandate_rejected', { wallet: walletAddress, tool: config.toolName });
-    throw new Error(
-      'AP2 mandate verification failed. Agent not authorized for this payment.',
-    );
-  }
-
-  // Route payment to cheapest/fastest chain (N13)
-  // If SML_PAYMENT_RECEIVER is not configured, log the intended payment and continue
-  const receiver = process.env['SML_PAYMENT_RECEIVER'] ?? '';
-  let txResult: { txHash: string; chain: string; latencyMs: number };
-
-  if (!receiver) {
-    audit.warn('payment_receiver_unset', { tool: config.toolName, amount: config.price, note: 'SML_PAYMENT_RECEIVER not configured — logging only' });
-    txResult = { txHash: `pending-${Date.now()}`, chain: 'none', latencyMs: 0 };
-  } else {
-    try {
-      const router = ChainRouter.getInstance();
-      txResult = await router.route({
-        amount: config.price,
-        currency: config.currency,
-        from: walletAddress,
-        to: receiver,
-        timeoutMs: 500,
-      });
-    } catch (err) {
-      // Log payment failure but don't block tool execution
-      audit.warn('payment_tx_failed', { tool: config.toolName, amount: config.price, error: String(err), note: 'Server wallet may be unfunded — tool served anyway' });
-      txResult = { txHash: `failed-${Date.now()}`, chain: 'none', latencyMs: 0 };
-    }
-  }
-
-  addDailySpend(walletAddress, priceNum);
-
-  // Generate 402Proof receipt (N7)
-  const receipt = await ReceiptStore.getInstance().create({
-    txHash: txResult.txHash,
-    chain: txResult.chain,
-    amount: config.price,
-    currency: config.currency,
-    tool: config.toolName,
-    wallet: walletAddress,
-  });
-
-  audit.info('payment_success', {
-    receiptId: receipt.id,
-    txHash: txResult.txHash,
-    chain: txResult.chain,
-    tool: config.toolName,
-    wallet: walletAddress,
-  });
-
-  return {
-    receiptId: receipt.id,
-    txHash: txResult.txHash,
-    chain: txResult.chain,
-    amountPaid: config.price,
-    currency: config.currency,
-    timestamp: Date.now(),
-    walletAddress,
-  };
-}

package/src/server/registry/catalog.ts

@@ -1,61 +0,0 @@
-export interface ToolMeta {
-  name: string;
-  description: string;
-  price: string;
-  currency: 'USDC' | 'RLUSD';
-  freeTier?: string;
-  ap2Required: boolean;
-  cacheTtl?: number;
-}
-
-export const CATALOG: ToolMeta[] = [
-  {
-    name: 'leviathan_signal',
-    description: 'Institutional-grade squeeze signals. Multi-engine verdict for any ticker.',
-    price: '0.05',
-    currency: 'USDC',
-    ap2Required: true,
-  },
-  {
-    name: 'xmit_edgar_decode',
-    description: 'Parse SEC DEF 14A / 13F / 13D filings. Raw text never leaves SML servers.',
-    price: '0.02',
-    currency: 'USDC',
-    ap2Required: true,
-  },
-  {
-    name: 'xdeo_earnings_estimate',
-    description: 'Decentralized earnings oracle. +2 bureau_score on success.',
-    price: '0.02',
-    currency: 'USDC',
-    ap2Required: true,
-  },
-  {
-    name: 'ftd_threshold_scan',
-    description: 'SEC Reg SHO FTD data. Alerts free; full data 0.05 USDC. 15-min cache.',
-    price: '0.05',
-    currency: 'USDC',
-    ap2Required: false,
-    freeTier: 'alerts_only',
-    cacheTtl: 900,
-  },
-  {
-    name: 'nexus_agent_hire',
-    description: 'Agent marketplace. Query free; hire charges 5% commission.',
-    price: '0.00',
-    currency: 'USDC',
-    ap2Required: false,
-    freeTier: 'query_only',
-  },
-  {
-    name: 'crawl_paid_fetch',
-    description: 'Pay-per-fetch scraping. Humans bypass free.',
-    price: '0.005',
-    currency: 'USDC',
-    ap2Required: false,
-  },
-];
-
-export function getToolMeta(name: string): ToolMeta | undefined {
-  return CATALOG.find((t) => t.name === name);
-}

package/src/server/registry/discovery.ts

@@ -1,39 +0,0 @@
-import { readFileSync } from 'fs';
-import { join } from 'path';
-
-interface AgentsJson {
-  schema_version: string;
-  name: string;
-  tools: unknown[];
-}
-
-export class Discovery {
-  private static instance: Discovery;
-  private agentsJson: AgentsJson | null = null;
-  private llmsTxt: string | null = null;
-
-  private constructor() {}
-
-  static getInstance(): Discovery {
-    if (!Discovery.instance) {
-      Discovery.instance = new Discovery();
-    }
-    return Discovery.instance;
-  }
-
-  getAgentsJson(): AgentsJson {
-    if (!this.agentsJson) {
-      const path = join(process.cwd(), 'agents.json');
-      this.agentsJson = JSON.parse(readFileSync(path, 'utf8')) as AgentsJson;
-    }
-    return this.agentsJson;
-  }
-
-  getLlmsTxt(): string {
-    if (!this.llmsTxt) {
-      const path = join(process.cwd(), 'llms.txt');
-      this.llmsTxt = readFileSync(path, 'utf8');
-    }
-    return this.llmsTxt;
-  }
-}

package/src/server/registry/pricing.ts

@@ -1,133 +0,0 @@
-const PRICE_CACHE_TTL = parseInt(process.env['PRICE_CACHE_TTL_MS'] ?? '60000', 10);
-
-const BASE_PRICES: Record<string, string> = {
-  // Discovery (free)
-  sml_discover: '0.00',
-  sml_status: '0.00',
-  // SqueezeOS signals
-  leviathan_signal: '0.05',
-  squeezeos_council: '0.10',
-  squeezeos_scan: '0.05',
-  squeezeos_options: '0.05',
-  squeezeos_iwm: '0.03',
-  squeezeos_preview: '0.00',
-  squeezeos_status: '0.00',
-  // SEC / Earnings
-  xmit_edgar_decode: '0.02',
-  xdeo_earnings_estimate: '0.02',
-  // FTD
-  ftd_threshold_scan: '0.05',
-  // Crawl
-  crawl_paid_fetch: '0.005',
-  // Agent marketplace
-  nexus_agent_hire: '0.00',
-  nexus_agent_list: '0.00',
-  nexus_agent_status: '0.00',
-  // Ghost Layer (cross-chain)
-  ghost_transfer: '0.02',
-  ghost_status: '0.00',
-  ghost_routes: '0.00',
-  // RLUSD Rails
-  rails_send: '0.01',
-  rails_status: '0.00',
-  // Launchpad
-  launchpad_create_token: '0.10',
-  launchpad_buy_token: '0.02',
-  launchpad_list: '0.00',
-  launchpad_status: '0.00',
-  // Copy-Trader
-  copytrader_subscribe: '0.05',
-  copytrader_status: '0.00',
-  // Backtest
-  backtest_run: '0.05',
-  backtest_validate: '0.05',
-  backtest_status: '0.00',
-  // Brokers (Tradier)
-  brokers_quote: '0.00',
-  brokers_options_chain: '0.01',
-  brokers_place_order: '0.05',
-  brokers_account: '0.01',
-  // Shadow Desk
-  shadow_query: '0.05',
-  shadow_ingest: '0.02',
-  shadow_status: '0.00',
-  // Forge (LLM gateway)
-  forge_complete: '0.02',
-  forge_status: '0.00',
-  // Proof402
-  proof402_get_invoice: '0.00',
-  proof402_verify: '0.00',
-  proof402_credit_score: '0.00',
-  // Echo (pattern matching)
-  echo_analogs: '0.05',
-  // Agent card / identity
-  agentcard_verify: '0.00',
-  agentcard_register: '0.01',
-  agentcard_lookup: '0.00',
-};
-
-interface CachedPrice {
-  price: string;
-  fetchedAt: number;
-}
-
-export class PriceRegistry {
-  private static instance: PriceRegistry;
-  private readonly cache = new Map<string, CachedPrice>();
-  private readonly baseUrl: string;
-
-  private constructor() {
-    this.baseUrl = process.env['SML_API_BASE'] ?? 'https://squeezeos-api.onrender.com';
-  }
-
-  static getInstance(): PriceRegistry {
-    if (!PriceRegistry.instance) {
-      PriceRegistry.instance = new PriceRegistry();
-    }
-    return PriceRegistry.instance;
-  }
-
-  async getPrice(toolName: string): Promise<string | null> {
-    const cached = this.cache.get(toolName);
-    const now = Date.now();
-
-    if (cached && now - cached.fetchedAt < PRICE_CACHE_TTL) {
-      return cached.price;
-    }
-
-    // Fetch live price from SML pricing API
-    try {
-      const res = await fetch(`${this.baseUrl}/pricing/v1/tool/${toolName}`, {
-        signal: AbortSignal.timeout(3000),
-      });
-
-      if (res.ok) {
-        const body = (await res.json()) as { price: string };
-        this.cache.set(toolName, { price: body.price, fetchedAt: now });
-        return body.price;
-      }
-    } catch {
-      // Fall through to hardcoded baseline
-    }
-
-    // Use hardcoded baseline if API unavailable
-    const fallback = BASE_PRICES[toolName];
-    if (fallback !== undefined) {
-      this.cache.set(toolName, { price: fallback, fetchedAt: now - PRICE_CACHE_TTL / 2 });
-      return fallback;
-    }
-
-    // Unknown tool — default to free rather than reject
-    this.cache.set(toolName, { price: '0.00', fetchedAt: now });
-    return '0.00';
-  }
-
-  seedDefaults(): void {
-    const now = Date.now();
-    for (const [tool, price] of Object.entries(BASE_PRICES)) {
-      if (!this.cache.has(tool)) {
-        this.cache.set(tool, { price, fetchedAt: now });
-      }
-    }
-  }
-}

package/src/server/security/acl.ts

@@ -1,42 +0,0 @@
-import { z } from 'zod';
-
-export const ToolACLSchema = z.object({
-  toolName: z.string(),
-  walletAddress: z.string().optional(),
-  creditScore: z.number().optional(),
-  paidTier: z.boolean().default(false),
-});
-
-export type ToolACL = z.infer<typeof ToolACLSchema>;
-
-const FREE_TOOLS = new Set(['ftd_threshold_scan_alerts', 'nexus_agent_hire_query']);
-
-export class ACL {
-  private static instance: ACL;
-
-  private constructor() {}
-
-  static getInstance(): ACL {
-    if (!ACL.instance) {
-      ACL.instance = new ACL();
-    }
-    return ACL.instance;
-  }
-
-  isFree(toolName: string): boolean {
-    return FREE_TOOLS.has(toolName);
-  }
-
-  requiresPayment(toolName: string): boolean {
-    return !this.isFree(toolName);
-  }
-
-  requiresAP2(toolName: string): boolean {
-    // leviathan, xmit, xdeo require AP2 per spec
-    return ['leviathan_signal', 'xmit_edgar_decode', 'xdeo_earnings_estimate'].includes(toolName);
-  }
-
-  minCreditScore(_toolName: string): number {
-    return 300;
-  }
-}

package/src/server/security/audit.ts

@@ -1,94 +0,0 @@
-import { createHash, createHmac } from 'crypto';
-import { appendFileSync } from 'fs';
-
-type LogLevel = 'info' | 'warn' | 'error';
-
-interface LogEntry {
-  seq: number;
-  ts: number;
-  level: LogLevel;
-  event: string;
-  data: Record<string, unknown>;
-  prev_hash: string;
-  hash: string;
-}
-
-// Append-only SHA-256 chained audit log (N5)
-// Each entry includes the hash of the previous entry — tampering breaks the chain.
-export class AuditLogger {
-  private static instance: AuditLogger;
-  private seq = 0;
-  private prevHash = '0000000000000000000000000000000000000000000000000000000000000000';
-  private readonly logPath: string;
-  private readonly hmacSecret: string;
-
-  private constructor() {
-    this.logPath = process.env['AUDIT_LOG_PATH'] ?? './audit.log';
-    this.hmacSecret = process.env['AUDIT_HMAC_SECRET'] ?? 'mcp-x402-audit-secret';
-  }
-
-  static getInstance(): AuditLogger {
-    if (!AuditLogger.instance) {
-      AuditLogger.instance = new AuditLogger();
-    }
-    return AuditLogger.instance;
-  }
-
-  private log(level: LogLevel, event: string, data: Record<string, unknown>): void {
-    const seq = ++this.seq;
-    const ts = Date.now();
-
-    // Redact PII (N3): hash wallet addresses, never log raw filing content
-    const safeData = this.redact(data);
-
-    const payload = JSON.stringify({ seq, ts, level, event, data: safeData, prev_hash: this.prevHash });
-    const hash = createHmac('sha256', this.hmacSecret).update(payload).digest('hex');
-
-    const entry: LogEntry = {
-      seq,
-      ts,
-      level,
-      event,
-      data: safeData,
-      prev_hash: this.prevHash,
-      hash,
-    };
-
-    this.prevHash = hash;
-
-    try {
-      appendFileSync(this.logPath, JSON.stringify(entry) + '\n', 'utf8');
-    } catch {
-      // If log write fails, emit to stderr but don't crash
-      process.stderr.write(`[audit-fail] ${JSON.stringify(entry)}\n`);
-    }
-  }
-
-  private redact(data: Record<string, unknown>): Record<string, unknown> {
-    const out: Record<string, unknown> = {};
-    for (const [k, v] of Object.entries(data)) {
-      if (k === 'wallet' || k === 'address') {
-        // Hash wallet addresses (N3)
-        out[k] = createHash('sha256').update(String(v)).digest('hex').slice(0, 16) + '...';
-      } else if (k === 'content' || k === 'raw_text' || k === 'filing') {
-        // Never log raw filing data (N3)
-        out[k] = '[REDACTED]';
-      } else {
-        out[k] = v;
-      }
-    }
-    return out;
-  }
-
-  info(event: string, data: Record<string, unknown> = {}): void {
-    this.log('info', event, data);
-  }
-
-  warn(event: string, data: Record<string, unknown> = {}): void {
-    this.log('warn', event, data);
-  }
-
-  error(event: string, data: Record<string, unknown> = {}): void {
-    this.log('error', event, data);
-  }
-}

package/src/server/security/rate-limit.ts

@@ -1,84 +0,0 @@
-interface BucketState {
-  minute: { count: number; resetAt: number };
-  day: { count: number; resetAt: number };
-}
-
-const PER_TOOL_MINUTE_LIMIT = 100;
-const PER_WALLET_DAY_LIMIT = 1000;
-const IP_MINUTE_LIMIT = 200;
-
-function nowMs(): number {
-  return Date.now();
-}
-
-export class RateLimiter {
-  private static instance: RateLimiter;
-  private readonly toolBuckets = new Map<string, BucketState>();
-  private readonly walletBuckets = new Map<string, BucketState>();
-  private readonly ipBuckets = new Map<string, { count: number; resetAt: number }>();
-
-  private constructor() {}
-
-  static getInstance(): RateLimiter {
-    if (!RateLimiter.instance) {
-      RateLimiter.instance = new RateLimiter();
-    }
-    return RateLimiter.instance;
-  }
-
-  checkTool(toolName: string): boolean {
-    const now = nowMs();
-    let bucket = this.toolBuckets.get(toolName);
-
-    if (!bucket) {
-      bucket = {
-        minute: { count: 0, resetAt: now + 60_000 },
-        day: { count: 0, resetAt: now + 86_400_000 },
-      };
-      this.toolBuckets.set(toolName, bucket);
-    }
-
-    if (now > bucket.minute.resetAt) {
-      bucket.minute = { count: 0, resetAt: now + 60_000 };
-    }
-
-    if (bucket.minute.count >= PER_TOOL_MINUTE_LIMIT) return false;
-    bucket.minute.count++;
-    return true;
-  }
-
-  checkWallet(wallet: string): boolean {
-    const now = nowMs();
-    let bucket = this.walletBuckets.get(wallet);
-
-    if (!bucket) {
-      bucket = {
-        minute: { count: 0, resetAt: now + 60_000 },
-        day: { count: 0, resetAt: now + 86_400_000 },
-      };
-      this.walletBuckets.set(wallet, bucket);
-    }
-
-    if (now > bucket.day.resetAt) {
-      bucket.day = { count: 0, resetAt: now + 86_400_000 };
-    }
-
-    if (bucket.day.count >= PER_WALLET_DAY_LIMIT) return false;
-    bucket.day.count++;
-    return true;
-  }
-
-  checkIp(ip: string): boolean {
-    const now = nowMs();
-    let entry = this.ipBuckets.get(ip);
-
-    if (!entry || now > entry.resetAt) {
-      entry = { count: 0, resetAt: now + 60_000 };
-      this.ipBuckets.set(ip, entry);
-    }
-
-    if (entry.count >= IP_MINUTE_LIMIT) return false;
-    entry.count++;
-    return true;
-  }
-}

package/src/server/security/sandbox.ts

@@ -1,40 +0,0 @@
-import { z } from 'zod';
-
-// Sandboxed input validation layer — all tool inputs pass through here before execution.
-// No eval(), no dynamic require(), no raw SQL (N4 enforcement at schema layer).
-export class Sandbox {
-  static validate<T>(schema: z.ZodType<T>, input: unknown): T {
-    const result = schema.safeParse(input);
-    if (!result.success) {
-      const issues = result.error.issues
-        .map((i) => `${i.path.join('.')}: ${i.message}`)
-        .join('; ');
-      throw new Error(`Input validation failed: ${issues}`);
-    }
-    return result.data;
-  }
-
-  // Ensure URL is http/https only — no file://, data://, javascript:
-  static validateUrl(raw: string): URL {
-    let url: URL;
-    try {
-      url = new URL(raw);
-    } catch {
-      throw new Error(`Invalid URL: ${raw}`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-      throw new Error(`Disallowed URL protocol: ${url.protocol}`);
-    }
-    return url;
-  }
-
-  // Strip any response content that looks like a prompt injection attempt
-  static sanitizeApiResponse(text: string): string {
-    // Remove common injection markers
-    return text
-      .replace(/<\/?system>/gi, '')
-      .replace(/\[INST\]/gi, '')
-      .replace(/\[\/?INST\]/gi, '')
-      .slice(0, 50_000); // Hard cap on returned content size
-  }
-}