leash-monad 0.1.0 → 0.1.2

package/README.md

@@ -16,7 +16,7 @@ import { checkAgent } from "leash-monad";
 const v = await checkAgent(agentAddress, myAddress, "2.00");   // Monad mainnet by default
 if (!v.ok) return res.status(403).json(v);
 // v = { status: "OK", ok: true, remainingToday: "3.0", expiry: 1791887540,
-//       erc8004Id: "10281", account: "0xB1C6…", reason: "This agent is leashed and this payment fits its budget." }
+//       erc8004Id: "10299", account: "0xB1C6…", reason: "This agent is leashed and this payment fits its budget." }
 ```
 
 | `status` | Meaning |
@@ -65,7 +65,7 @@ nothing leaves the account.
 
 | | Chain | LeashHub |
 |---|---|---|
-| `mainnet` (default) | Monad, 143 | `0xecefc8c322e2aa77327c2b4912caec04323f4f37` |
+| `mainnet` (default) | Monad, 143 | `0x64a489074dd6a4b3b977e5f635a178366a8c12c3` |
 | `testnet` | Monad Testnet, 10143 | `0x8b427106c04e66dfc6e8d58fa4de0478a54f510a` |
 
 Pass `{ network: "testnet" }` as the last argument to any call.

package/dist/index.cjs

@@ -41,7 +41,7 @@ var networks = {
     chainId: 143,
     rpc: "https://rpc.monad.xyz",
     explorer: "https://monadvision.com",
-    hub: "0xecefc8c322e2aa77327c2b4912caec04323f4f37",
+    hub: "0x64a489074dd6a4b3b977e5f635a178366a8c12c3",
     identityRegistry: "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432",
     testUsd: "0x4adf40e6e5113339635e6dc54ff638e7b63bbea3"
   },
@@ -124,6 +124,10 @@ async function leashGate(req, cfg) {
   const client = clientFor(cfg);
   const rc = await client.getTransactionReceipt({ hash: payment }).catch(() => null);
   if (!rc || rc.status !== "success") return { allow: false, status: 402, body: { error: "payment_not_found", ref } };
+  const mined = await client.getBlock({ blockNumber: rc.blockNumber });
+  if (Date.now() / 1e3 - Number(mined.timestamp) > (cfg.maxPaymentAgeSeconds ?? 300)) {
+    return { allow: false, status: 402, body: { error: "payment_expired", ref, reason: "That payment is too old to use again. Pay for this request." } };
+  }
   const d = cfg.decimals ?? 6, need = (0, import_viem2.parseUnits)(cfg.priceUsd, d);
   for (const log of rc.logs) {
     try {
@@ -132,6 +136,9 @@ async function leashGate(req, cfg) {
       const a = ev.args;
       const account = await client.readContract({ address: net(cfg).hub, abi: hubAbi, functionName: "accountOf", args: [agent] });
       if (log.address.toLowerCase() === account.toLowerCase() && a.agent.toLowerCase() === agent.toLowerCase() && a.seller.toLowerCase() === cfg.seller.toLowerCase() && a.amount >= need && a.ref === ref) {
+        if (cfg.claim && !await cfg.claim(payment)) {
+          return { allow: false, status: 402, body: { error: "payment_used", ref, reason: "That payment was already used. Pay for this request." } };
+        }
         const verdict = await checkAgent(agent, cfg.seller, "0", cfg);
         return { allow: true, agent, paid: (0, import_viem2.formatUnits)(a.amount, d), tx: payment, verdict };
       }

package/dist/index.d.ts

@@ -60,11 +60,17 @@ export type GateResult = {
  *   agent pays through its Leash (one tx), then retries with x-leash-payment: <txHash>
  *   2nd request: the gate checks the receipt's Paid event (agent, seller, amount >= price, ref) -> allow
  */
-export declare function leashGate(req: GateRequest, cfg: {
+export type GateConfig = {
     seller: Address;
     priceUsd: string;
     resource?: string;
-} & Options): Promise<GateResult>;
+    /** Refuse payments mined longer ago than this (default 300 s). Limits how long one payment proof stays usable. */
+    maxPaymentAgeSeconds?: number;
+    /** Record a payment as used; return false if it was already used. Plug in your store (Redis, a DB row) so one
+     *  payment buys exactly one response. Without it, a payment can be replayed until it is maxPaymentAgeSeconds old. */
+    claim?: (tx: Hex) => boolean | Promise<boolean>;
+} & Options;
+export declare function leashGate(req: GateRequest, cfg: GateConfig): Promise<GateResult>;
 /** Pay a seller from inside the leash. Reverts on-chain (and throws here) if it would break the leash. */
 export declare function payWithLeash(agentAccount: Account, seller: Address, amountUsd: string, ref: Hex, o?: Options & {
     gas?: bigint;

package/dist/index.mjs

@@ -18,7 +18,7 @@ var networks = {
     chainId: 143,
     rpc: "https://rpc.monad.xyz",
     explorer: "https://monadvision.com",
-    hub: "0xecefc8c322e2aa77327c2b4912caec04323f4f37",
+    hub: "0x64a489074dd6a4b3b977e5f635a178366a8c12c3",
     identityRegistry: "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432",
     testUsd: "0x4adf40e6e5113339635e6dc54ff638e7b63bbea3"
   },
@@ -101,6 +101,10 @@ async function leashGate(req, cfg) {
   const client = clientFor(cfg);
   const rc = await client.getTransactionReceipt({ hash: payment }).catch(() => null);
   if (!rc || rc.status !== "success") return { allow: false, status: 402, body: { error: "payment_not_found", ref } };
+  const mined = await client.getBlock({ blockNumber: rc.blockNumber });
+  if (Date.now() / 1e3 - Number(mined.timestamp) > (cfg.maxPaymentAgeSeconds ?? 300)) {
+    return { allow: false, status: 402, body: { error: "payment_expired", ref, reason: "That payment is too old to use again. Pay for this request." } };
+  }
   const d = cfg.decimals ?? 6, need = parseUnits(cfg.priceUsd, d);
   for (const log of rc.logs) {
     try {
@@ -109,6 +113,9 @@ async function leashGate(req, cfg) {
       const a = ev.args;
       const account = await client.readContract({ address: net(cfg).hub, abi: hubAbi, functionName: "accountOf", args: [agent] });
       if (log.address.toLowerCase() === account.toLowerCase() && a.agent.toLowerCase() === agent.toLowerCase() && a.seller.toLowerCase() === cfg.seller.toLowerCase() && a.amount >= need && a.ref === ref) {
+        if (cfg.claim && !await cfg.claim(payment)) {
+          return { allow: false, status: 402, body: { error: "payment_used", ref, reason: "That payment was already used. Pay for this request." } };
+        }
         const verdict = await checkAgent(agent, cfg.seller, "0", cfg);
         return { allow: true, agent, paid: formatUnits(a.amount, d), tx: payment, verdict };
       }

package/dist/networks.d.ts

@@ -15,7 +15,7 @@ export declare const networks: {
         chainId: number;
         rpc: string;
         explorer: string;
-        hub: "0xecefc8c322e2aa77327c2b4912caec04323f4f37";
+        hub: "0x64a489074dd6a4b3b977e5f635a178366a8c12c3";
         identityRegistry: "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432";
         testUsd: "0x4adf40e6e5113339635e6dc54ff638e7b63bbea3";
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leash-monad",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Spend limits for AI agents on Monad. One call tells a seller whose agent it is, what it may spend today, and whether a payment will go through.",
   "license": "MIT",
   "author": "Robert Moore",