create-metamynd-agent 0.12.2 → 0.12.6

package/README.md

@@ -10,11 +10,14 @@ default, a second `gateway/` process** built on
 The agent's own `guardTool()` call is a fast, local, client-side check; the gateway is the real
 enforcement boundary — see [Separate tool gateway](#separate-tool-gateway-default) below.
 
-> **Prerequisite:** an agent is always owned by a person/org with a **MetaMynd account**. Verification
-> is *reported*, not required, to get started: an unverified owner works on Testnet within the
-> free-tier limits, and verifying once in the dashboard (KYC/KYB) is what unlocks mainnet.
-> This CLI always provisions **Testnet** agents; a mainnet agent is launched from the dashboard's
-> **Launchpad** (`/dashboard/launchpad`) once you are verified.
+> **Prerequisite:** an agent is always owned by a person/org with a **MetaMynd account**. The hosted
+> flow provisions under your account's **verified principal** (KYC/KYB; on a beta deployment the
+> platform can auto-approve one on first use) — if there is none, provisioning stops with "complete
+> KYC/KYB first". That is all it needs: this CLI always provisions **Testnet** agents, so mainnet
+> eligibility is not required. A mainnet agent is launched from the dashboard's **Launchpad**
+> (`/dashboard/launchpad`) and needs a **mainnet-eligible** principal (verified by the identity
+> provider, or reviewed by a person on the platform's team). `--harness` and `--sandbox` need no
+> account or verification at all.
 
 ## Free local harness (no account, no network, `--harness`)
 

package/index.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 // create-metamynd-agent — scaffold a MetaMynd/AgentSafe-governed agent in one command.
 //
-// Logs a KYB-verified owner in, provisions the agent in ONE call
+// Logs the owner in (provisioning uses the owner's verified principal; the agent is always
+// Testnet — mainnet goes through the dashboard Launchpad), provisions the agent in ONE call
 // (POST /onboarding/agent → identity + mandate + starter SOP + enforced Standards),
 // writes the portable `agent.metamynd.json` and a runnable agent example, PLUS (by default)
 // a separate `gateway/` process — a second, independent guard that re-verifies every request
@@ -102,7 +103,13 @@ const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.6.0 brings buildAuthMessage's `resource` field and buildLocalDecisionMessage into this
 // package's own bundled policy-core.mjs (alongside the guard's own 0.10.0) — no scaffolded
 // template code changes, but the floor must still cover the real current version.
-const MCP_GUARD_VERSION = '^0.12.0';
+// 0.13.0: a daemon-held service key (keyProvider: 'daemon') now signs claims and settlements as the gateway's
+// DID instead of claiming anonymously — refused on every mainnet hold before. No template change.
+// 0.14.0: the claim can declare an x402 payment (x402: true) so the issuer observes lowered settlements. No template
+// change (the scaffolded gateways don't pay by x402), but the floor must cover the real current version.
+// 0.15.0: payloadDigestOf/toWireJson exported and refundAuthorization (its own signed `refund` action). No template
+// change (the scaffolded gateways don't refund), but the floor must cover the real current version.
+const MCP_GUARD_VERSION = '^0.15.0';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
 // never scaffold a range that could resolve below it.
@@ -114,7 +121,10 @@ const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.5.0 adds the OPTIONAL Credential Vault `resolveCredential` hook on createHttpGateway (Module
 // G) — additive and backward-compatible (every existing consumer sees zero behavior change), but
 // the floor must still cover the real current version per this repo's own package-version check.
-const GATEWAY_VERSION = '^0.11.0';
+// 0.12.0: per-route `x402: true` declares an x402 payment on the claim. No template change.
+// 0.13.0: a configured resolveCredential that refuses now FAILS CLOSED (502 CREDENTIAL_UNAVAILABLE) instead of forwarding
+// without a credential. No template change (the scaffolded gateway does not use the Credential Vault).
+const GATEWAY_VERSION = '^0.13.0';
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 const DEFAULT_GATEWAY_PORT = 4401; // distinct from --harness's dashboard (4400)
 
@@ -219,11 +229,13 @@ ${c.b('Environment')}
 ${c.b('Network')}
   Every hosted agent this CLI provisions is a ${c.b('Testnet')} agent, whatever your verification status —
   there is deliberately no mainnet flag. To launch a ${c.b('Mainnet')} agent, use the Launchpad in the
-  dashboard (https://metamynd.ai/dashboard/launchpad): its Mainnet option is available once your
-  owner verification (KYC/KYB) is complete.
+  dashboard (https://metamynd.ai/dashboard/launchpad): its Mainnet option needs a mainnet-eligible
+  principal (verified by the identity provider, or reviewed by a person on the platform's team).
 
 ${c.b('What it does')}
-  1. Logs in as a KYB-verified owner       → owner access token
+  1. Logs in as the owner                   → owner access token
+     (provisioning uses your account's verified principal — KYC/KYB, or one the platform
+     auto-approves on a beta deployment; mainnet eligibility is NOT needed for Testnet)
   2. POST /onboarding/agent (one call)      → identity + mandate + SOP + Standards
   3. Writes agent.metamynd.json + index.mjs, PLUS (by default) a separate gateway/ process —
      the real enforcement boundary, not index.mjs's own guard.guardTool() call. --no-gateway

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.12.2",
+  "version": "0.12.6",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {