leash-monad 0.1.2 → 0.1.3

package/README.md

@@ -48,6 +48,18 @@ app.get("/api/forecast", async (req, res) => {
 
 A revoked, expired or over-cap agent gets a 403 with the reason before you've done any work.
 
+**One payment, one response.** Pass `claim` so a payment can't be replayed: it receives the payment's tx hash and
+returns `false` if you've seen it before (a unique row in your database is enough). Payments older than
+`maxPaymentAgeSeconds` (default 300) are refused either way, and so are payments in any token outside
+`acceptTokens` (default: USDC and the Leash test dollar), because a leash can name any ERC-20.
+
+```ts
+const g = await leashGate(req, { seller: MY_ADDRESS, priceUsd: "1", claim: (tx) => db.insertIfNew("payments", tx) });
+```
+
+Full examples, each runnable: [Express](../examples/express-seller.mjs), [Next.js route](../examples/next-route.ts),
+[check only](../examples/check-before-serving.mjs), [agent side](../examples/agent-pays.mjs).
+
 ## Pay (agent)
 
 ```ts
@@ -61,6 +73,14 @@ const res = await fetchWithLeash("https://leash-monad.vercel.app/api/forecast",
 On a 402 it pays inside the leash and retries once. If the leash says no, the payment reverts on-chain and
 nothing leaves the account.
 
+## Getting a leashed agent
+
+1. `npx leash-monad-mcp --new-key` prints a fresh agent address and key (or use any key your agent already has).
+2. Open [leash-monad.vercel.app/own.html](https://leash-monad.vercel.app/own.html), sign in with a passkey and leash
+   that address: daily cap, sellers, expiry, demo dollars or USDC.
+3. Use the key with `fetchWithLeash` / `payWithLeash`, or give it to an MCP client through
+   [`leash-monad-mcp`](https://www.npmjs.com/package/leash-monad-mcp).
+
 ## Networks
 
 | | Chain | LeashHub |

package/dist/index.cjs

@@ -43,7 +43,8 @@ var networks = {
     explorer: "https://monadvision.com",
     hub: "0x64a489074dd6a4b3b977e5f635a178366a8c12c3",
     identityRegistry: "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432",
-    testUsd: "0x4adf40e6e5113339635e6dc54ff638e7b63bbea3"
+    testUsd: "0x4adf40e6e5113339635e6dc54ff638e7b63bbea3",
+    usdc: "0x754704Bc059F8C67012fEd69BC8A327a5aafb603"
   },
   testnet: {
     name: "Monad Testnet",
@@ -135,6 +136,10 @@ async function leashGate(req, cfg) {
       if (ev.eventName !== "Paid") continue;
       const a = ev.args;
       const account = await client.readContract({ address: net(cfg).hub, abi: hubAbi, functionName: "accountOf", args: [agent] });
+      const accepted = (cfg.acceptTokens ?? [net(cfg).usdc, net(cfg).testUsd]).filter(Boolean).map((t) => t.toLowerCase());
+      if (!accepted.includes(a.token.toLowerCase())) {
+        return { allow: false, status: 402, body: { error: "token_not_accepted", ref, reason: "That payment was in a token this seller doesn't accept." } };
+      }
       if (log.address.toLowerCase() === account.toLowerCase() && a.agent.toLowerCase() === agent.toLowerCase() && a.seller.toLowerCase() === cfg.seller.toLowerCase() && a.amount >= need && a.ref === ref) {
         if (cfg.claim && !await cfg.claim(payment)) {
           return { allow: false, status: 402, body: { error: "payment_used", ref, reason: "That payment was already used. Pay for this request." } };

package/dist/index.d.ts

@@ -69,6 +69,9 @@ export type GateConfig = {
     /** Record a payment as used; return false if it was already used. Plug in your store (Redis, a DB row) so one
      *  payment buys exactly one response. Without it, a payment can be replayed until it is maxPaymentAgeSeconds old. */
     claim?: (tx: Hex) => boolean | Promise<boolean>;
+    /** Tokens you accept as payment. Default: the network's USDC and the Leash test dollar. A leash can name any
+     *  ERC-20, so without this check an agent could "pay" in a token worth nothing. */
+    acceptTokens?: Address[];
 } & Options;
 export declare function leashGate(req: GateRequest, cfg: GateConfig): Promise<GateResult>;
 /** Pay a seller from inside the leash. Reverts on-chain (and throws here) if it would break the leash. */

package/dist/index.mjs

@@ -20,7 +20,8 @@ var networks = {
     explorer: "https://monadvision.com",
     hub: "0x64a489074dd6a4b3b977e5f635a178366a8c12c3",
     identityRegistry: "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432",
-    testUsd: "0x4adf40e6e5113339635e6dc54ff638e7b63bbea3"
+    testUsd: "0x4adf40e6e5113339635e6dc54ff638e7b63bbea3",
+    usdc: "0x754704Bc059F8C67012fEd69BC8A327a5aafb603"
   },
   testnet: {
     name: "Monad Testnet",
@@ -112,6 +113,10 @@ async function leashGate(req, cfg) {
       if (ev.eventName !== "Paid") continue;
       const a = ev.args;
       const account = await client.readContract({ address: net(cfg).hub, abi: hubAbi, functionName: "accountOf", args: [agent] });
+      const accepted = (cfg.acceptTokens ?? [net(cfg).usdc, net(cfg).testUsd]).filter(Boolean).map((t) => t.toLowerCase());
+      if (!accepted.includes(a.token.toLowerCase())) {
+        return { allow: false, status: 402, body: { error: "token_not_accepted", ref, reason: "That payment was in a token this seller doesn't accept." } };
+      }
       if (log.address.toLowerCase() === account.toLowerCase() && a.agent.toLowerCase() === agent.toLowerCase() && a.seller.toLowerCase() === cfg.seller.toLowerCase() && a.amount >= need && a.ref === ref) {
         if (cfg.claim && !await cfg.claim(payment)) {
           return { allow: false, status: 402, body: { error: "payment_used", ref, reason: "That payment was already used. Pay for this request." } };

package/dist/networks.d.ts

@@ -7,6 +7,8 @@ export type LeashNetwork = {
     hub: Address;
     identityRegistry: Address;
     testUsd?: Address;
+    /** Circle's USDC on this network, when there is one. */
+    usdc?: Address;
 };
 /** Live deployments. Mainnet is the default everywhere in this package. */
 export declare const networks: {
@@ -18,6 +20,7 @@ export declare const networks: {
         hub: "0x64a489074dd6a4b3b977e5f635a178366a8c12c3";
         identityRegistry: "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432";
         testUsd: "0x4adf40e6e5113339635e6dc54ff638e7b63bbea3";
+        usdc: "0x754704Bc059F8C67012fEd69BC8A327a5aafb603";
     };
     testnet: {
         name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leash-monad",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Spend limits for AI agents on Monad. One call tells a seller whose agent it is, what it may spend today, and whether a payment will go through.",
   "license": "MIT",
   "author": "Robert Moore",