minia2a-skill 1.2.1 → 1.3.1

package/README.md

@@ -71,10 +71,23 @@ Every call is priced in the 402 response. The buyer pays USDC (or spends free cr
 minia2a discover [query] [--category cat] [--sort volume|price]
 minia2a meta
 minia2a register --name <n> --wallet <0x...> --signature <0x...>
-minia2a call <id> --wallet <0x...> [--input '{}'] [--probe]
+minia2a publish --name <n> --endpoint <url> --price <cents> --description <text> \
+                [--category tools|premium|defi|data] --wallet <0x...> --signature <0x...>
+minia2a call <id> --wallet <0x...> [--signature <0x...> --timestamp <unix>] \
+                  [--input '{}'] [--probe]
 minia2a help
 ```
 
+`register` is the **buyer** side (it provisions free credits). `publish` is the
+**seller** side (it lists your API for pay-per-call). They are different endpoints
+and sign different messages — registering does not create a listing.
+
+`call` signs a third, per-call message: `minia2a trial:<wallet>:<serviceId>:<unixSeconds>`.
+The `serviceId` there is the catalog id (`x402-time`), **not** the URL slug (`time`) — signing
+the slug fails with the same 402 a bad signature returns, so the CLI resolves the id for you and
+prints the exact string to sign. Without `--signature`, `--wallet` draws on the anonymous per-IP
+bucket, not the wallet's own.
+
 All commands output JSON. Exit code 0 = success. `--probe` returns the 402 payment JSON without consuming credits.
 
 ## Agent Wrappers
@@ -101,8 +114,10 @@ minia2a discover
 # 3. Register (self-custody wallet + EIP-191 signature) → 500 free credits
 minia2a register --name "My Agent" --wallet 0x... --signature 0x...
 
-# 4. Call a service — credits decrement, no payment needed while you have credits
+# 4. Call a service. --wallet alone uses the anonymous per-IP bucket; run it once and
+#    the CLI prints the exact message to sign for the wallet's own 15 trials.
 minia2a call x402-time --wallet 0x...
+minia2a call x402-time --wallet 0x... --timestamp 1787113324 --signature 0x...
 ```
 
 ## Pricing

package/cli/minia2a

@@ -12,7 +12,10 @@ Usage:
   minia2a discover [query] [--category <cat>] [--sort volume|price]
   minia2a meta
   minia2a register --name <n> --wallet <0x...> --signature <0x...>
-  minia2a call <service-id> --wallet <0x...> [--input <json>] [--probe]
+  minia2a publish --name <n> --endpoint <url> --price <cents> --description <text>
+                  [--category <cat>] --wallet <0x...> --signature <0x...>
+  minia2a call <service-id> --wallet <0x...> [--signature <0x...> --timestamp <unix>]
+                            [--input <json>] [--probe]
   minia2a help [topic]
 
 No human signup. Register with a self-custody wallet + EIP-191 signature
@@ -110,6 +113,75 @@ async function register() {
   }
 }
 
+// Seller path. `register` above is BUYER-side (it provisions credits, not a listing) —
+// publishing a service is a different endpoint with a different signed message.
+const CATEGORIES = ['tools', 'premium', 'defi', 'data'];
+
+async function publish() {
+  const name = flag('name');
+  const endpoint = flag('endpoint');
+  const price = flag('price');
+  const wallet = flag('wallet');
+  const signature = flag('signature');
+  let category = flag('category');
+
+  if (!name || name === true) bail('--name <name> required');
+  if (!endpoint || endpoint === true) bail('--endpoint <https://...> required');
+  if (!wallet || wallet === true) bail('--wallet <0x...> required (revenue settles here)');
+
+  if (!/^https?:\/\//i.test(endpoint)) bail('--endpoint must be an absolute http(s) URL');
+
+  // Rejected server-side anyway (SSRF guard) — fail early with a clearer reason.
+  if (/^https?:\/\/(localhost|127\.|10\.|192\.168\.|169\.254\.|\[::1\])/i.test(endpoint)) {
+    bail('--endpoint must be publicly reachable; internal/loopback addresses are rejected');
+  }
+
+  const priceCents = Number(price);
+  if (!Number.isInteger(priceCents) || priceCents < 1 || priceCents > 10000) {
+    bail('--price <cents> required: integer 1–10000 (1 = $0.01, 10000 = $100.00)');
+  }
+
+  // Server enforces a 20-char minimum; catch it here so the failure is legible.
+  const description = flag('description');
+  if (!description || description === true || String(description).length < 20) {
+    bail('--description <text> required: at least 20 characters (buyers see this in the catalog)');
+  }
+
+  if (!category || category === true) category = 'tools';
+  if (!CATEGORIES.includes(category)) {
+    bail(`--category must be one of: ${CATEGORIES.join(', ')}`);
+  }
+
+  if (!signature || signature === true) {
+    // Same contract as register: the CLI never holds your key.
+    console.error('A signature is required. Sign this exact message with your wallet (EIP-191 personal_sign):\n');
+    console.error(`  minia2a publish: ${wallet}\n`);
+    console.error('Then re-run with --signature <0x...>:\n');
+    console.error(`  minia2a publish --name "${name}" --endpoint "${endpoint}" --price ${priceCents} --wallet "${wallet}" --signature "0xYOUR_SIGNATURE"\n`);
+    console.error('(cast example: cast wallet sign --data 0x... "minia2a publish: <wallet>")');
+    process.exit(1);
+  }
+
+  const body = { name, endpoint, price_cents: priceCents, category, description, wallet, signature };
+  try {
+    const r = await fetch(`${API}/api/v1/publish-service`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body)
+    });
+    const d = await r.json();
+    json(d);
+    if (!r.ok) process.exit(3);
+    // The catalog does not round-trip an HTTP method yet, so POST-only endpoints
+    // get called with GET by generic clients. Warn rather than let it fail silently.
+    console.error('\nPublished. Note: the catalog does not yet record an HTTP method —');
+    console.error('callers default to GET. If your endpoint requires POST, state that in');
+    console.error('the service description until method round-trip ships.');
+  } catch (e) {
+    bail(`Cannot reach marketplace: ${e.message}`, 3);
+  }
+}
+
 async function call(id) {
   if (!id) bail('Usage: minia2a call <service-id> --wallet <0x...> [--input <json>] [--probe]');
   const wallet = flag('wallet');
@@ -134,8 +206,32 @@ async function call(id) {
   const url = new URL(ep);
   url.searchParams.set(probe ? 'probe' : 'wallet', probe ? '1' : wallet);
 
+  // A registered wallet's own 15 trials are only reachable with a signed call. The signed
+  // message uses the catalog id (x402-time), not the URL slug (time) — signing the slug fails
+  // with exactly the 402 a bad signature produces, so print the id-correct message rather than
+  // letting the caller guess it.
+  const trialHeaders = {};
+  const signature = flag('signature');
+  if (!probe && wallet && wallet !== true) {
+    const ts = flag('timestamp') && flag('timestamp') !== true
+      ? String(flag('timestamp'))
+      : String(Math.floor(Date.now() / 1000));
+    if (signature && signature !== true) {
+      trialHeaders['X-Wallet-Signature'] = signature;
+      trialHeaders['X-Trial-Timestamp'] = ts;
+    } else {
+      console.error('Note: --wallet alone does not draw on the wallet\'s trial bucket — this call');
+      console.error('will use the anonymous per-IP bucket. To use the wallet\'s own 15 trials, sign');
+      console.error('this exact message (EIP-191 personal_sign):\n');
+      console.error(`  minia2a trial:${wallet}:${svc.id}:${ts}\n`);
+      console.error('then rerun within 5 minutes:\n');
+      console.error(`  minia2a call ${id} --wallet ${wallet} --timestamp ${ts} --signature 0xYOUR_SIGNATURE\n`);
+      console.error(`(cast example: cast wallet sign "minia2a trial:${wallet}:${svc.id}:${ts}")\n`);
+    }
+  }
+
   try {
-    const opts = { headers: { 'User-Agent': 'minia2a-skill/1.x' } };
+    const opts = { headers: { 'User-Agent': 'minia2a-skill/1.x', ...trialHeaders } };
     let r;
     if (input !== undefined) {
       opts.method = 'POST';
@@ -151,11 +247,19 @@ async function call(id) {
     if (r.status === 402) {
       // Payment required — surface the machine-readable x402 payload.
       console.error(`Payment required (HTTP 402) for ${svc.name}. Price: $${svc.price} USDC.`);
+      if (trialHeaders['X-Wallet-Signature']) {
+        console.error(`Signed as ${wallet}: either this wallet's 15 trials are spent, or the wallet`);
+        console.error('is not registered, or the timestamp is older than 5 minutes.');
+      }
       console.error('x402 accepts[]:');
       json(d);
       process.exit(3);
     }
 
+    // Which bucket paid for the call — "wallet" means the signature was accepted.
+    const mode = r.headers.get('x-trial-mode');
+    if (mode) console.error(`trial: mode=${mode} remaining=${r.headers.get('x-trial-remaining') ?? '?'}`);
+
     json(d);
     if (!r.ok) process.exit(3);
   } catch (e) {
@@ -169,7 +273,8 @@ async function help() {
     console.error(`minia2a help: ${topic}\n`);
     console.error('The full machine-readable guide lives at https://minia2a.uk/AGENTS.md');
     console.error('Quick reference:');
-    console.error('  register — POST /api/v1/register-simple {name, wallet, signature} → 500 free credits');
+    console.error('  register — POST /api/v1/register-simple {name, wallet, signature} → 500 free credits (BUYER side)');
+    console.error('  publish  — POST /api/v1/publish-service {name, endpoint, price_cents, category, wallet, signature} (SELLER side)');
     console.error('  call     — GET <service-endpoint>?wallet=0x... (credits decrement)');
     console.error('  probe    — append ?probe=1 to any endpoint → HTTP 402 with payment JSON (free)');
     return;
@@ -189,6 +294,9 @@ async function help() {
       case 'info':
       case 'stats':
         return await meta();
+      case 'publish':
+      case 'sell':
+        return await publish();
       case 'register':
       case 'reg':
         return await register();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "minia2a-skill",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "Agent skill for minia2a.uk — 1,600+ x402 services. AI agents earn USDC. 500 free credits. Zero-dep CLI. Try: npm i -g minia2a-cli.",
   "bin": {
     "minia2a": "./cli/minia2a"