@scriptmasterlabs/mcp-x402 2.0.2 → 2.1.1

package/src/server/payments/router.ts

@@ -1,110 +0,0 @@
-import { AuditLogger } from '../security/audit.js';
-import { BaseChain } from '../../lib/chains/base.js';
-import { XRPLChain } from '../../lib/chains/xrpl.js';
-import { SolanaChain } from '../../lib/chains/solana.js';
-
-export interface RouteParams {
-  amount: string;
-  currency: 'USDC' | 'RLUSD';
-  from: string;
-  to: string;
-  timeoutMs?: number;
-}
-
-export interface RouteResult {
-  txHash: string;
-  chain: string;
-  latencyMs: number;
-}
-
-// Chain preference order: cheapest/fastest first (N13)
-const CHAIN_PREFERENCE = ['base', 'xrpl', 'solana'] as const;
-
-export class ChainRouter {
-  private static instance: ChainRouter;
-
-  private constructor(
-    private readonly base = BaseChain.getInstance(),
-    private readonly xrpl = XRPLChain.getInstance(),
-    private readonly solana = SolanaChain.getInstance(),
-  ) {}
-
-  static getInstance(): ChainRouter {
-    if (!ChainRouter.instance) {
-      ChainRouter.instance = new ChainRouter();
-    }
-    return ChainRouter.instance;
-  }
-
-  async route(params: RouteParams): Promise<RouteResult> {
-    const audit = AuditLogger.getInstance();
-    const timeout = params.timeoutMs ?? 3000;
-
-    // For RLUSD, prefer XRPL
-    const ordered =
-      params.currency === 'RLUSD'
-        ? (['xrpl', 'base', 'solana'] as const)
-        : CHAIN_PREFERENCE;
-
-    const errors: string[] = [];
-
-    for (const chain of ordered) {
-      try {
-        const start = Date.now();
-        let txHash: string;
-
-        switch (chain) {
-          case 'base':
-            txHash = await this.withTimeout(
-              this.base.sendPayment(params),
-              timeout,
-              'base',
-            );
-            break;
-          case 'xrpl':
-            txHash = await this.withTimeout(
-              this.xrpl.sendPayment(params),
-              timeout,
-              'xrpl',
-            );
-            break;
-          case 'solana':
-            txHash = await this.withTimeout(
-              this.solana.sendPayment(params),
-              timeout,
-              'solana',
-            );
-            break;
-        }
-
-        const latencyMs = Date.now() - start;
-        audit.info('chain_route_success', { chain, latencyMs, tx: txHash });
-
-        return { txHash, chain, latencyMs };
-      } catch (err) {
-        const msg = String(err);
-        errors.push(`${chain}: ${msg}`);
-        audit.warn('chain_route_fail', { chain, error: msg });
-      }
-    }
-
-    throw new Error(`All chains failed.\n${errors.join('\n')}`);
-  }
-
-  private withTimeout<T>(
-    promise: Promise<T>,
-    ms: number,
-    chain: string,
-  ): Promise<T> {
-    return new Promise((resolve, reject) => {
-      const t = setTimeout(
-        () => reject(new Error(`${chain} timeout after ${ms}ms`)),
-        ms,
-      );
-      promise.then(
-        (v) => { clearTimeout(t); resolve(v); },
-        (e) => { clearTimeout(t); reject(e); },
-      );
-    });
-  }
-}

package/src/server/payments/wallet.ts

@@ -1,123 +0,0 @@
-import { AuditLogger } from '../security/audit.js';
-
-const KEYCHAIN_SERVICE = 'mcp-x402';
-const KEYCHAIN_ACCOUNT = 'master-seed';
-
-export interface WalletInfo {
-  address: string;
-  chain: 'base' | 'xrpl' | 'solana';
-}
-
-export class WalletManager {
-  private static instance: WalletManager;
-  private cachedAddress: string | null = null;
-  private cachedSeed: string | null = null;
-
-  private constructor() {}
-
-  static getInstance(): WalletManager {
-    if (!WalletManager.instance) {
-      WalletManager.instance = new WalletManager();
-    }
-    return WalletManager.instance;
-  }
-
-  // Try OS keychain; returns null if keytar is unavailable (Docker/cloud) or no entry exists.
-  private async keytarGet(): Promise<string | null> {
-    try {
-      const kt = await import('keytar');
-      return await kt.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
-    } catch {
-      return null;
-    }
-  }
-
-  private async keytarSet(value: string): Promise<void> {
-    try {
-      const kt = await import('keytar');
-      await kt.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, value);
-    } catch {
-      // Silently skip — keytar unavailable in this environment
-    }
-  }
-
-  // Seed resolution priority:
-  // 1. OS keychain (local desktop — most secure)
-  // 2. WALLET_SEED env var (Render secret — cloud/Docker deployment)
-  // 3. CI_WALLET_SEED env var (CI only, never production)
-  // 4. Generate fresh and try to persist in keychain
-  async getSeed(): Promise<string> {
-    if (this.cachedSeed) return this.cachedSeed;
-
-    const audit = AuditLogger.getInstance();
-
-    let seed = await this.keytarGet();
-
-    if (!seed) {
-      const envSeed = process.env['WALLET_SEED'];
-      if (envSeed) {
-        seed = envSeed;
-        audit.warn('wallet_env_seed', { note: 'Using WALLET_SEED env var (cloud deployment).' });
-      } else if (process.env['CI_WALLET_SEED'] && process.env['NODE_ENV'] !== 'production') {
-        seed = process.env['CI_WALLET_SEED'];
-        audit.warn('wallet_ci_fallback', { note: 'Using CI_WALLET_SEED. NEVER do this in production.' });
-      } else {
-        const { generateMnemonic } = await import('bip39');
-        seed = generateMnemonic(256);
-        await this.keytarSet(seed);
-        audit.info('wallet_created', { note: 'New BIP-39 seed generated.' });
-      }
-    }
-
-    this.cachedSeed = seed;
-    return seed;
-  }
-
-  async getOrCreateWallet(): Promise<WalletInfo> {
-    if (this.cachedAddress) {
-      return { address: this.cachedAddress, chain: 'base' };
-    }
-
-    const audit = AuditLogger.getInstance();
-    const seed = await this.getSeed();
-    const address = await this.deriveAddress(seed);
-    this.cachedAddress = address;
-    audit.info('wallet_loaded', { address });
-    return { address, chain: 'base' };
-  }
-
-  private async deriveAddress(mnemonic: string): Promise<string> {
-    // BIP-44 deterministic derivation: m/44'/60'/0'/0/0 (Base = EVM)
-    const { mnemonicToSeedSync } = await import('bip39');
-    const { default: HDKey } = await import('hdkey');
-    const { privateKeyToAccount } = await import('viem/accounts');
-
-    const seed = mnemonicToSeedSync(mnemonic);
-    const hdkey = HDKey.fromMasterSeed(seed);
-    const child = hdkey.derive("m/44'/60'/0'/0/0");
-
-    if (!child.privateKey) {
-      throw new Error('Failed to derive private key from HD path');
-    }
-
-    const account = privateKeyToAccount(`0x${child.privateKey.toString('hex')}`);
-    return account.address;
-  }
-
-  async signPayload(payload: string): Promise<string> {
-    const mnemonic = await this.getSeed();
-
-    const { mnemonicToSeedSync } = await import('bip39');
-    const { default: HDKey } = await import('hdkey');
-    const { privateKeyToAccount } = await import('viem/accounts');
-
-    const seed = mnemonicToSeedSync(mnemonic);
-    const hdkey = HDKey.fromMasterSeed(seed);
-    const child = hdkey.derive("m/44'/60'/0'/0/0");
-
-    if (!child.privateKey) throw new Error('Key derivation failed');
-
-    const account = privateKeyToAccount(`0x${child.privateKey.toString('hex')}`);
-    return account.signMessage({ message: payload });
-  }
-}

package/src/server/payments/x402.ts

@@ -1,177 +0,0 @@
-import { z } from 'zod';
-import { AuditLogger } from '../security/audit.js';
-import { AP2Client } from './ap2.js';
-import { WalletManager } from './wallet.js';
-import { ChainRouter } from './router.js';
-import { ReceiptStore } from './receipt.js';
-import { CreditBureau } from '../../lib/credit/bureau.js';
-import { PriceRegistry } from '../registry/pricing.js';
-
-export const PaymentConfigSchema = z.object({
-  price: z.string().regex(/^\d+(\.\d+)?$/),
-  currency: z.enum(['USDC', 'RLUSD']),
-  toolName: z.string(),
-  walletAddress: z.string().optional(),
-});
-
-export type PaymentConfig = z.infer<typeof PaymentConfigSchema>;
-
-export interface PaymentResult {
-  receiptId: string;
-  txHash: string;
-  chain: string;
-  amountPaid: string;
-  currency: string;
-  timestamp: number;
-  walletAddress: string;
-}
-
-const AUTO_APPROVE_THRESHOLD = parseFloat(
-  process.env['AUTO_APPROVE_THRESHOLD_USD'] ?? '1.0',
-);
-
-const DAILY_SPEND_CAP = parseFloat(
-  process.env['DAILY_SPEND_CAP_USD'] ?? '50.0',
-);
-
-const dailySpend = new Map<string, { amount: number; date: string }>();
-
-function getTodayKey(): string {
-  return new Date().toISOString().slice(0, 10);
-}
-
-function getDailySpend(wallet: string): number {
-  const today = getTodayKey();
-  const entry = dailySpend.get(wallet);
-  if (!entry || entry.date !== today) return 0;
-  return entry.amount;
-}
-
-function addDailySpend(wallet: string, amount: number): void {
-  const today = getTodayKey();
-  const current = getDailySpend(wallet);
-  dailySpend.set(wallet, { amount: current + amount, date: today });
-}
-
-export async function executeX402Payment(
-  config: PaymentConfig,
-): Promise<PaymentResult> {
-  const audit = AuditLogger.getInstance();
-  const wallet = await WalletManager.getInstance().getOrCreateWallet();
-  const walletAddress = wallet.address;
-
-  // Enforce daily spend cap (N9)
-  const priceNum = parseFloat(config.price);
-  const currentSpend = getDailySpend(walletAddress);
-  if (currentSpend + priceNum > DAILY_SPEND_CAP) {
-    audit.warn('spend_cap_exceeded', {
-      wallet: walletAddress,
-      current: currentSpend,
-      requested: priceNum,
-      cap: DAILY_SPEND_CAP,
-    });
-    throw new Error(
-      `Daily spend cap of $${DAILY_SPEND_CAP} exceeded. Current: $${currentSpend.toFixed(4)}`,
-    );
-  }
-
-  // Verify price cache freshness (N12)
-  const cachedPrice = await PriceRegistry.getInstance().getPrice(config.toolName);
-  if (!cachedPrice) {
-    throw new Error('Price data stale or unavailable. Rejecting payment.');
-  }
-  if (cachedPrice !== config.price) {
-    throw new Error(
-      `Price mismatch: expected ${cachedPrice}, got ${config.price}. Cache may be stale.`,
-    );
-  }
-
-  // Credit Bureau check (N8)
-  const score = await CreditBureau.getInstance().getScore(walletAddress);
-  const autoApprove = priceNum <= AUTO_APPROVE_THRESHOLD && score >= 300;
-
-  audit.info('payment_attempt', {
-    tool: config.toolName,
-    price: config.price,
-    currency: config.currency,
-    wallet: walletAddress,
-    bureauScore: score,
-    autoApprove,
-  });
-
-  if (!autoApprove && score < 300) {
-    throw new Error(
-      `Credit Bureau score ${score} below minimum 300. Payment requires manual approval.`,
-    );
-  }
-
-  // AP2 mandate verification (N6)
-  const ap2 = AP2Client.getInstance();
-  const mandateValid = await ap2.verifyMandate(walletAddress, {
-    maxAmount: config.price,
-    currency: config.currency,
-    toolName: config.toolName,
-  });
-
-  if (!mandateValid) {
-    audit.warn('ap2_mandate_rejected', { wallet: walletAddress, tool: config.toolName });
-    throw new Error(
-      'AP2 mandate verification failed. Agent not authorized for this payment.',
-    );
-  }
-
-  // Route payment to cheapest/fastest chain (N13)
-  // If SML_PAYMENT_RECEIVER is not configured, log the intended payment and continue
-  const receiver = process.env['SML_PAYMENT_RECEIVER'] ?? '';
-  let txResult: { txHash: string; chain: string; latencyMs: number };
-
-  if (!receiver) {
-    audit.warn('payment_receiver_unset', { tool: config.toolName, amount: config.price, note: 'SML_PAYMENT_RECEIVER not configured — logging only' });
-    txResult = { txHash: `pending-${Date.now()}`, chain: 'none', latencyMs: 0 };
-  } else {
-    try {
-      const router = ChainRouter.getInstance();
-      txResult = await router.route({
-        amount: config.price,
-        currency: config.currency,
-        from: walletAddress,
-        to: receiver,
-        timeoutMs: 500,
-      });
-    } catch (err) {
-      // Log payment failure but don't block tool execution
-      audit.warn('payment_tx_failed', { tool: config.toolName, amount: config.price, error: String(err), note: 'Server wallet may be unfunded — tool served anyway' });
-      txResult = { txHash: `failed-${Date.now()}`, chain: 'none', latencyMs: 0 };
-    }
-  }
-
-  addDailySpend(walletAddress, priceNum);
-
-  // Generate 402Proof receipt (N7)
-  const receipt = await ReceiptStore.getInstance().create({
-    txHash: txResult.txHash,
-    chain: txResult.chain,
-    amount: config.price,
-    currency: config.currency,
-    tool: config.toolName,
-    wallet: walletAddress,
-  });
-
-  audit.info('payment_success', {
-    receiptId: receipt.id,
-    txHash: txResult.txHash,
-    chain: txResult.chain,
-    tool: config.toolName,
-    wallet: walletAddress,
-  });
-
-  return {
-    receiptId: receipt.id,
-    txHash: txResult.txHash,
-    chain: txResult.chain,
-    amountPaid: config.price,
-    currency: config.currency,
-    timestamp: Date.now(),
-    walletAddress,
-  };
-}

package/src/server/registry/catalog.ts

@@ -1,61 +0,0 @@
-export interface ToolMeta {
-  name: string;
-  description: string;
-  price: string;
-  currency: 'USDC' | 'RLUSD';
-  freeTier?: string;
-  ap2Required: boolean;
-  cacheTtl?: number;
-}
-
-export const CATALOG: ToolMeta[] = [
-  {
-    name: 'leviathan_signal',
-    description: 'Institutional-grade squeeze signals. Multi-engine verdict for any ticker.',
-    price: '0.05',
-    currency: 'USDC',
-    ap2Required: true,
-  },
-  {
-    name: 'xmit_edgar_decode',
-    description: 'Parse SEC DEF 14A / 13F / 13D filings. Raw text never leaves SML servers.',
-    price: '0.02',
-    currency: 'USDC',
-    ap2Required: true,
-  },
-  {
-    name: 'xdeo_earnings_estimate',
-    description: 'Decentralized earnings oracle. +2 bureau_score on success.',
-    price: '0.02',
-    currency: 'USDC',
-    ap2Required: true,
-  },
-  {
-    name: 'ftd_threshold_scan',
-    description: 'SEC Reg SHO FTD data. Alerts free; full data 0.05 USDC. 15-min cache.',
-    price: '0.05',
-    currency: 'USDC',
-    ap2Required: false,
-    freeTier: 'alerts_only',
-    cacheTtl: 900,
-  },
-  {
-    name: 'nexus_agent_hire',
-    description: 'Agent marketplace. Query free; hire charges 5% commission.',
-    price: '0.00',
-    currency: 'USDC',
-    ap2Required: false,
-    freeTier: 'query_only',
-  },
-  {
-    name: 'crawl_paid_fetch',
-    description: 'Pay-per-fetch scraping. Humans bypass free.',
-    price: '0.005',
-    currency: 'USDC',
-    ap2Required: false,
-  },
-];
-
-export function getToolMeta(name: string): ToolMeta | undefined {
-  return CATALOG.find((t) => t.name === name);
-}

package/src/server/registry/discovery.ts

@@ -1,39 +0,0 @@
-import { readFileSync } from 'fs';
-import { join } from 'path';
-
-interface AgentsJson {
-  schema_version: string;
-  name: string;
-  tools: unknown[];
-}
-
-export class Discovery {
-  private static instance: Discovery;
-  private agentsJson: AgentsJson | null = null;
-  private llmsTxt: string | null = null;
-
-  private constructor() {}
-
-  static getInstance(): Discovery {
-    if (!Discovery.instance) {
-      Discovery.instance = new Discovery();
-    }
-    return Discovery.instance;
-  }
-
-  getAgentsJson(): AgentsJson {
-    if (!this.agentsJson) {
-      const path = join(process.cwd(), 'agents.json');
-      this.agentsJson = JSON.parse(readFileSync(path, 'utf8')) as AgentsJson;
-    }
-    return this.agentsJson;
-  }
-
-  getLlmsTxt(): string {
-    if (!this.llmsTxt) {
-      const path = join(process.cwd(), 'llms.txt');
-      this.llmsTxt = readFileSync(path, 'utf8');
-    }
-    return this.llmsTxt;
-  }
-}

package/src/server/registry/pricing.ts

@@ -1,133 +0,0 @@
-const PRICE_CACHE_TTL = parseInt(process.env['PRICE_CACHE_TTL_MS'] ?? '60000', 10);
-
-const BASE_PRICES: Record<string, string> = {
-  // Discovery (free)
-  sml_discover: '0.00',
-  sml_status: '0.00',
-  // SqueezeOS signals
-  leviathan_signal: '0.05',
-  squeezeos_council: '0.10',
-  squeezeos_scan: '0.05',
-  squeezeos_options: '0.05',
-  squeezeos_iwm: '0.03',
-  squeezeos_preview: '0.00',
-  squeezeos_status: '0.00',
-  // SEC / Earnings
-  xmit_edgar_decode: '0.02',
-  xdeo_earnings_estimate: '0.02',
-  // FTD
-  ftd_threshold_scan: '0.05',
-  // Crawl
-  crawl_paid_fetch: '0.005',
-  // Agent marketplace
-  nexus_agent_hire: '0.00',
-  nexus_agent_list: '0.00',
-  nexus_agent_status: '0.00',
-  // Ghost Layer (cross-chain)
-  ghost_transfer: '0.02',
-  ghost_status: '0.00',
-  ghost_routes: '0.00',
-  // RLUSD Rails
-  rails_send: '0.01',
-  rails_status: '0.00',
-  // Launchpad
-  launchpad_create_token: '0.10',
-  launchpad_buy_token: '0.02',
-  launchpad_list: '0.00',
-  launchpad_status: '0.00',
-  // Copy-Trader
-  copytrader_subscribe: '0.05',
-  copytrader_status: '0.00',
-  // Backtest
-  backtest_run: '0.05',
-  backtest_validate: '0.05',
-  backtest_status: '0.00',
-  // Brokers (Tradier)
-  brokers_quote: '0.00',
-  brokers_options_chain: '0.01',
-  brokers_place_order: '0.05',
-  brokers_account: '0.01',
-  // Shadow Desk
-  shadow_query: '0.05',
-  shadow_ingest: '0.02',
-  shadow_status: '0.00',
-  // Forge (LLM gateway)
-  forge_complete: '0.02',
-  forge_status: '0.00',
-  // Proof402
-  proof402_get_invoice: '0.00',
-  proof402_verify: '0.00',
-  proof402_credit_score: '0.00',
-  // Echo (pattern matching)
-  echo_analogs: '0.05',
-  // Agent card / identity
-  agentcard_verify: '0.00',
-  agentcard_register: '0.01',
-  agentcard_lookup: '0.00',
-};
-
-interface CachedPrice {
-  price: string;
-  fetchedAt: number;
-}
-
-export class PriceRegistry {
-  private static instance: PriceRegistry;
-  private readonly cache = new Map<string, CachedPrice>();
-  private readonly baseUrl: string;
-
-  private constructor() {
-    this.baseUrl = process.env['SML_API_BASE'] ?? 'https://squeezeos-api.onrender.com';
-  }
-
-  static getInstance(): PriceRegistry {
-    if (!PriceRegistry.instance) {
-      PriceRegistry.instance = new PriceRegistry();
-    }
-    return PriceRegistry.instance;
-  }
-
-  async getPrice(toolName: string): Promise<string | null> {
-    const cached = this.cache.get(toolName);
-    const now = Date.now();
-
-    if (cached && now - cached.fetchedAt < PRICE_CACHE_TTL) {
-      return cached.price;
-    }
-
-    // Fetch live price from SML pricing API
-    try {
-      const res = await fetch(`${this.baseUrl}/pricing/v1/tool/${toolName}`, {
-        signal: AbortSignal.timeout(3000),
-      });
-
-      if (res.ok) {
-        const body = (await res.json()) as { price: string };
-        this.cache.set(toolName, { price: body.price, fetchedAt: now });
-        return body.price;
-      }
-    } catch {
-      // Fall through to hardcoded baseline
-    }
-
-    // Use hardcoded baseline if API unavailable
-    const fallback = BASE_PRICES[toolName];
-    if (fallback !== undefined) {
-      this.cache.set(toolName, { price: fallback, fetchedAt: now - PRICE_CACHE_TTL / 2 });
-      return fallback;
-    }
-
-    // Unknown tool — default to free rather than reject
-    this.cache.set(toolName, { price: '0.00', fetchedAt: now });
-    return '0.00';
-  }
-
-  seedDefaults(): void {
-    const now = Date.now();
-    for (const [tool, price] of Object.entries(BASE_PRICES)) {
-      if (!this.cache.has(tool)) {
-        this.cache.set(tool, { price, fetchedAt: now });
-      }
-    }
-  }
-}

package/src/server/security/acl.ts

@@ -1,42 +0,0 @@
-import { z } from 'zod';
-
-export const ToolACLSchema = z.object({
-  toolName: z.string(),
-  walletAddress: z.string().optional(),
-  creditScore: z.number().optional(),
-  paidTier: z.boolean().default(false),
-});
-
-export type ToolACL = z.infer<typeof ToolACLSchema>;
-
-const FREE_TOOLS = new Set(['ftd_threshold_scan_alerts', 'nexus_agent_hire_query']);
-
-export class ACL {
-  private static instance: ACL;
-
-  private constructor() {}
-
-  static getInstance(): ACL {
-    if (!ACL.instance) {
-      ACL.instance = new ACL();
-    }
-    return ACL.instance;
-  }
-
-  isFree(toolName: string): boolean {
-    return FREE_TOOLS.has(toolName);
-  }
-
-  requiresPayment(toolName: string): boolean {
-    return !this.isFree(toolName);
-  }
-
-  requiresAP2(toolName: string): boolean {
-    // leviathan, xmit, xdeo require AP2 per spec
-    return ['leviathan_signal', 'xmit_edgar_decode', 'xdeo_earnings_estimate'].includes(toolName);
-  }
-
-  minCreditScore(_toolName: string): number {
-    return 300;
-  }
-}