leash-monad 0.1.1 → 0.1.2

package/dist/index.cjs

@@ -124,6 +124,10 @@ async function leashGate(req, cfg) {
   const client = clientFor(cfg);
   const rc = await client.getTransactionReceipt({ hash: payment }).catch(() => null);
   if (!rc || rc.status !== "success") return { allow: false, status: 402, body: { error: "payment_not_found", ref } };
+  const mined = await client.getBlock({ blockNumber: rc.blockNumber });
+  if (Date.now() / 1e3 - Number(mined.timestamp) > (cfg.maxPaymentAgeSeconds ?? 300)) {
+    return { allow: false, status: 402, body: { error: "payment_expired", ref, reason: "That payment is too old to use again. Pay for this request." } };
+  }
   const d = cfg.decimals ?? 6, need = (0, import_viem2.parseUnits)(cfg.priceUsd, d);
   for (const log of rc.logs) {
     try {
@@ -132,6 +136,9 @@ async function leashGate(req, cfg) {
       const a = ev.args;
       const account = await client.readContract({ address: net(cfg).hub, abi: hubAbi, functionName: "accountOf", args: [agent] });
       if (log.address.toLowerCase() === account.toLowerCase() && a.agent.toLowerCase() === agent.toLowerCase() && a.seller.toLowerCase() === cfg.seller.toLowerCase() && a.amount >= need && a.ref === ref) {
+        if (cfg.claim && !await cfg.claim(payment)) {
+          return { allow: false, status: 402, body: { error: "payment_used", ref, reason: "That payment was already used. Pay for this request." } };
+        }
         const verdict = await checkAgent(agent, cfg.seller, "0", cfg);
         return { allow: true, agent, paid: (0, import_viem2.formatUnits)(a.amount, d), tx: payment, verdict };
       }

package/dist/index.d.ts

@@ -60,11 +60,17 @@ export type GateResult = {
  *   agent pays through its Leash (one tx), then retries with x-leash-payment: <txHash>
  *   2nd request: the gate checks the receipt's Paid event (agent, seller, amount >= price, ref) -> allow
  */
-export declare function leashGate(req: GateRequest, cfg: {
+export type GateConfig = {
     seller: Address;
     priceUsd: string;
     resource?: string;
-} & Options): Promise<GateResult>;
+    /** Refuse payments mined longer ago than this (default 300 s). Limits how long one payment proof stays usable. */
+    maxPaymentAgeSeconds?: number;
+    /** Record a payment as used; return false if it was already used. Plug in your store (Redis, a DB row) so one
+     *  payment buys exactly one response. Without it, a payment can be replayed until it is maxPaymentAgeSeconds old. */
+    claim?: (tx: Hex) => boolean | Promise<boolean>;
+} & Options;
+export declare function leashGate(req: GateRequest, cfg: GateConfig): Promise<GateResult>;
 /** Pay a seller from inside the leash. Reverts on-chain (and throws here) if it would break the leash. */
 export declare function payWithLeash(agentAccount: Account, seller: Address, amountUsd: string, ref: Hex, o?: Options & {
     gas?: bigint;

package/dist/index.mjs

@@ -101,6 +101,10 @@ async function leashGate(req, cfg) {
   const client = clientFor(cfg);
   const rc = await client.getTransactionReceipt({ hash: payment }).catch(() => null);
   if (!rc || rc.status !== "success") return { allow: false, status: 402, body: { error: "payment_not_found", ref } };
+  const mined = await client.getBlock({ blockNumber: rc.blockNumber });
+  if (Date.now() / 1e3 - Number(mined.timestamp) > (cfg.maxPaymentAgeSeconds ?? 300)) {
+    return { allow: false, status: 402, body: { error: "payment_expired", ref, reason: "That payment is too old to use again. Pay for this request." } };
+  }
   const d = cfg.decimals ?? 6, need = parseUnits(cfg.priceUsd, d);
   for (const log of rc.logs) {
     try {
@@ -109,6 +113,9 @@ async function leashGate(req, cfg) {
       const a = ev.args;
       const account = await client.readContract({ address: net(cfg).hub, abi: hubAbi, functionName: "accountOf", args: [agent] });
       if (log.address.toLowerCase() === account.toLowerCase() && a.agent.toLowerCase() === agent.toLowerCase() && a.seller.toLowerCase() === cfg.seller.toLowerCase() && a.amount >= need && a.ref === ref) {
+        if (cfg.claim && !await cfg.claim(payment)) {
+          return { allow: false, status: 402, body: { error: "payment_used", ref, reason: "That payment was already used. Pay for this request." } };
+        }
         const verdict = await checkAgent(agent, cfg.seller, "0", cfg);
         return { allow: true, agent, paid: formatUnits(a.amount, d), tx: payment, verdict };
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leash-monad",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Spend limits for AI agents on Monad. One call tells a seller whose agent it is, what it may spend today, and whether a payment will go through.",
   "license": "MIT",
   "author": "Robert Moore",