twzrd-x402-gate 0.9.11 → 0.9.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/QUICKSTART.md +17 -14
- package/README.md +59 -45
- package/dist/auto-gate.d.ts +11 -5
- package/dist/auto-gate.d.ts.map +1 -1
- package/dist/auto-gate.js +18 -10
- package/dist/auto-gate.js.map +1 -1
- package/dist/buyer-defaults.d.ts +4 -3
- package/dist/buyer-defaults.d.ts.map +1 -1
- package/dist/buyer-defaults.js +5 -4
- package/dist/buyer-defaults.js.map +1 -1
- package/dist/cloudflare-x402.d.ts +3 -3
- package/dist/cloudflare-x402.js +3 -3
- package/dist/config.d.ts +2 -1
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +8 -9
- package/dist/config.js.map +1 -1
- package/dist/consumer-adjacency.d.ts +1 -1
- package/dist/consumer-adjacency.js +1 -1
- package/dist/doctor.js +6 -6
- package/dist/doctor.js.map +1 -1
- package/dist/evaluate.d.ts +17 -15
- package/dist/evaluate.d.ts.map +1 -1
- package/dist/evaluate.js +48 -52
- package/dist/evaluate.js.map +1 -1
- package/dist/foreign-key.d.ts +6 -2
- package/dist/foreign-key.d.ts.map +1 -1
- package/dist/foreign-key.js +11 -6
- package/dist/foreign-key.js.map +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/intelligence.js +2 -2
- package/dist/intelligence.js.map +1 -1
- package/dist/merchant-card.d.ts +7 -3
- package/dist/merchant-card.d.ts.map +1 -1
- package/dist/merchant-card.js +13 -5
- package/dist/merchant-card.js.map +1 -1
- package/dist/policy.d.ts.map +1 -1
- package/dist/policy.js +35 -12
- package/dist/policy.js.map +1 -1
- package/dist/quick.d.ts +4 -3
- package/dist/quick.d.ts.map +1 -1
- package/dist/quick.js.map +1 -1
- package/dist/seller-hook.d.ts +6 -2
- package/dist/seller-hook.d.ts.map +1 -1
- package/dist/seller-hook.js +6 -1
- package/dist/seller-hook.js.map +1 -1
- package/dist/spend-control.d.ts.map +1 -1
- package/dist/spend-control.js +16 -0
- package/dist/spend-control.js.map +1 -1
- package/dist/types.d.ts +20 -9
- package/dist/types.d.ts.map +1 -1
- package/dist/with-guard.d.ts +3 -3
- package/dist/with-guard.js +3 -3
- package/dist/x402-client-hook.d.ts +8 -2
- package/dist/x402-client-hook.d.ts.map +1 -1
- package/dist/x402-client-hook.js +47 -39
- package/dist/x402-client-hook.js.map +1 -1
- package/package.json +2 -2
package/QUICKSTART.md
CHANGED
|
@@ -6,13 +6,13 @@ is unreachable the gate never *invents* a wash flag. A failed preflight, or a me
|
|
|
6
6
|
outage on a scored path, blocks by default (`TWZRD_FAIL_OPEN=true` to allow). A reachable
|
|
7
7
|
card with no wash signal still proceeds.
|
|
8
8
|
|
|
9
|
-
**Pin:** `twzrd-x402-gate@0.9.
|
|
9
|
+
**Pin:** `twzrd-x402-gate@0.9.13` + stock PayAI client `x402-solana@3.0.0` (official
|
|
10
10
|
`beforePayment` seat). `@x402/core` Path E remains supported; refuse script is fallback.
|
|
11
11
|
|
|
12
12
|
## 1. Stock PayAI client (default seat — copy-paste)
|
|
13
13
|
|
|
14
14
|
```bash
|
|
15
|
-
npm install twzrd-x402-gate@0.9.
|
|
15
|
+
npm install twzrd-x402-gate@0.9.13 x402-solana@3.0.0
|
|
16
16
|
```
|
|
17
17
|
|
|
18
18
|
> **ESM-only.** The package ships `import` conditions only — a CommonJS
|
|
@@ -37,7 +37,7 @@ Then: `await client.fetch("https://merchant.example/paid");`
|
|
|
37
37
|
## 1b. Official `@x402/core` client (Path E)
|
|
38
38
|
|
|
39
39
|
```bash
|
|
40
|
-
npm install twzrd-x402-gate@0.9.
|
|
40
|
+
npm install twzrd-x402-gate@0.9.13 @x402/core @x402/fetch @x402/svm
|
|
41
41
|
```
|
|
42
42
|
|
|
43
43
|
```typescript
|
|
@@ -73,9 +73,11 @@ const client = await createPayKitClient({
|
|
|
73
73
|
Equivalent: `onBeforeX402PaymentCreation: installTwzrdAutoGate("pay-kit", { refuseWashFlagged: true })`.
|
|
74
74
|
The hook is the official `@x402/core` context shape (same evaluator as Path E).
|
|
75
75
|
`@solana/pay-kit` is optional — this package does not hard-depend on it.
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
76
|
+
`createTwzrdPayKitBeforePaymentHook` does not read `TWZRD_AUTO_GATE` or
|
|
77
|
+
`TWZRD_GATE_ENABLED`. `installTwzrdAutoGate("pay-kit", opts)` is the seat that
|
|
78
|
+
reads that kill switch per call and then calls the factory. You cannot
|
|
79
|
+
`installTwzrdAutoGate(client)` after `createPayKitClient` — PayKit only accepts
|
|
80
|
+
the hook at construction.
|
|
79
81
|
|
|
80
82
|
## 1d. Cold-start a foreign diet (0 USDC)
|
|
81
83
|
|
|
@@ -147,9 +149,10 @@ createTwzrdBeforePaymentHook({
|
|
|
147
149
|
|
|
148
150
|
## 3b. Turn on Path A (buyer cash, not the rail)
|
|
149
151
|
|
|
150
|
-
Refuse stays free until you wire a paying fetch. Then
|
|
151
|
-
|
|
152
|
-
|
|
152
|
+
Refuse stays free until you wire a paying fetch. Then a proceeding `warn`
|
|
153
|
+
settles the first paid hop: `GET /v1/intel/quick/{payTo}` at $0.001. Optional
|
|
154
|
+
V7 `$0.05` `/trust` stays on material allow or explicit `autoReceipt`.
|
|
155
|
+
Facilitator settle hooks stay free.
|
|
153
156
|
|
|
154
157
|
```typescript
|
|
155
158
|
import { wrapFetchWithPayment } from "@x402/svm";
|
|
@@ -169,7 +172,7 @@ payWrap as `x402Fetch`.
|
|
|
169
172
|
|
|
170
173
|
| Knob | Effect |
|
|
171
174
|
|------|--------|
|
|
172
|
-
| `TWZRD_AUTO_GATE=0` | Kill switch
|
|
175
|
+
| `TWZRD_AUTO_GATE=0` | Kill switch for `installTwzrdAutoGate` only — that seat proceeds unguarded. `createTwzrdBeforePaymentHook` does not read `TWZRD_AUTO_GATE` or `TWZRD_GATE_ENABLED`, so a direct call still aborts a bad payment. `installTwzrdAutoGate` reads the switch per call on the x402-client / x402-solana / pay-kit / MPP seats before it calls the factory. The fetch (payWrap) seat resolves it once when the fetch is composed — rebuild the fetch to change it. |
|
|
173
176
|
| `refuseWashFlagged: false` | Stop refusing wash-flagged merchants (default `true`) |
|
|
174
177
|
| `gateOnCanSpend: true` | Opt-in hard cap: also block when `can_spend=false` (default `false`) |
|
|
175
178
|
|
|
@@ -177,9 +180,9 @@ Everything else (thresholds, wash caps, fail posture, settle guard): [README](./
|
|
|
177
180
|
|
|
178
181
|
## What this will NOT do
|
|
179
182
|
|
|
180
|
-
- **
|
|
181
|
-
|
|
182
|
-
`TWZRD_UNSUPPORTED_NETWORK_MODE=strict`. Observe is
|
|
183
|
-
`wash_flagged` still refuses before sign.
|
|
183
|
+
- **Base mainnet is scored.** Solana mainnet and Base mainnet (`eip155:8453`)
|
|
184
|
+
run the scored preflight. Other EVM networks do not: they get an explicit
|
|
185
|
+
`unknown` unless you set `TWZRD_UNSUPPORTED_NETWORK_MODE=strict`. Observe is
|
|
186
|
+
not a wash bypass — `wash_flagged` still refuses before sign.
|
|
184
187
|
- **No delivery guarantee.** It screens the merchant before you pay, nothing after.
|
|
185
188
|
- **Not a wallet.** It never holds keys or signs — it only decides if your signer runs.
|
package/README.md
CHANGED
|
@@ -36,12 +36,12 @@ verify receipts yourself: [REVIEW.md](https://github.com/twzrd-sol/twzrd-trust/b
|
|
|
36
36
|
**Core product (buyer gate):** after the client selects the exact payment requirement and
|
|
37
37
|
**before** payment payload creation / wallet signing — free preflight + merchant_card wash
|
|
38
38
|
refuse. Protects the **payer** from a risky **merchant** (`payTo`). Chain-neutral envelope;
|
|
39
|
-
**Solana
|
|
39
|
+
**Solana mainnet and Base mainnet (`eip155:8453`)** are scored. Other EVM networks do not run the scored preflight.
|
|
40
40
|
|
|
41
41
|
### Default-on AutoGate (5 lines)
|
|
42
42
|
|
|
43
43
|
```bash
|
|
44
|
-
npm install twzrd-x402-gate @x402/core @x402/fetch @x402/svm
|
|
44
|
+
npm install twzrd-x402-gate@0.9.13 @x402/core @x402/fetch @x402/svm
|
|
45
45
|
```
|
|
46
46
|
|
|
47
47
|
```typescript
|
|
@@ -80,7 +80,7 @@ transfer on-chain. Wash/sybil edges are primarily discounted in TWZRD scoring, n
|
|
|
80
80
|
revenue refusal.
|
|
81
81
|
|
|
82
82
|
```bash
|
|
83
|
-
npm install twzrd-x402-gate@0.9.
|
|
83
|
+
npm install twzrd-x402-gate@0.9.13
|
|
84
84
|
```
|
|
85
85
|
|
|
86
86
|
```typescript
|
|
@@ -125,7 +125,7 @@ Fixture-backed SVM extract tests live in `test/seller-hook.test.ts` +
|
|
|
125
125
|
Install the published gate and run against wash fixtures:
|
|
126
126
|
|
|
127
127
|
```bash
|
|
128
|
-
npm install twzrd-x402-gate@0.9.
|
|
128
|
+
npm install twzrd-x402-gate@0.9.13
|
|
129
129
|
# from package root after install, or from a checkout:
|
|
130
130
|
npm run wash-dogfood
|
|
131
131
|
```
|
|
@@ -261,7 +261,7 @@ const payingFetch = installTwzrdAutoGate((guarded) =>
|
|
|
261
261
|
);
|
|
262
262
|
```
|
|
263
263
|
|
|
264
|
-
## Buyer flow
|
|
264
|
+
## Buyer flow — locked sequence
|
|
265
265
|
|
|
266
266
|
Canonical path for every agent that spends USDC on Solana x402:
|
|
267
267
|
|
|
@@ -269,7 +269,7 @@ Canonical path for every agent that spends USDC on Solana x402:
|
|
|
269
269
|
|------|------|------|----------------|
|
|
270
270
|
| 1 | `POST /v1/intel/preflight` | free | `decision=block` → refuse (`twzrd_decision_block`). Score floor / optional `can_spend` also deny. |
|
|
271
271
|
| 2 | `GET /v1/intel/merchant_card/{payTo}` | free | `wash_flagged: true` → refuse by default (`twzrd_wash_flagged`). **Only tightens** step 1. |
|
|
272
|
-
| 3 |
|
|
272
|
+
| 3 | First paid hop `quickCheck` | $0.001 | On an approved `warn` with `x402Fetch` wired: `GET /v1/intel/quick/{payTo}` only. That hop does not request `GET /v1/intel/trust/{payTo}`. `/trust` at $0.05 is a separate allow-path receipt, not the warn hop. |
|
|
273
273
|
| 4 | Pay (or refuse) | resource price | Only if steps 1–2 approved (and any opt-in paid escalate did not block). |
|
|
274
274
|
|
|
275
275
|
**Fail-open (no invent):**
|
|
@@ -286,7 +286,7 @@ Canonical path for every agent that spends USDC on Solana x402:
|
|
|
286
286
|
- `wash_flagged=true` + `washMaxUsdc` set + `priceUsdc <= cap` → allow, `washCapped=true`, reason `twzrd_wash_capped_{price}_le_{cap}`.
|
|
287
287
|
- `wash_flagged=true` + price above cap (or price unknown) → refuse with `twzrd_wash_flagged_above_cap_*`.
|
|
288
288
|
|
|
289
|
-
**Order note:** `onWarnUpsell` (points at paid
|
|
289
|
+
**Order note:** `onWarnUpsell` (points at first paid hop `GET /v1/intel/quick` $0.001) fires on preflight `warn` **before** the merchant_card wash check. A wash-flagged seller that preflighted as `warn` may still get the upsell hook, then be refused on step 2. Optional V7 `GET /v1/intel/trust` $0.05 stays `autoReceipt` / `requireReceipt` / `escalateOnWarn:false`.
|
|
290
290
|
|
|
291
291
|
Dogfood (one public live proof path):
|
|
292
292
|
- Free only (wash refuse): `npm run wash-dogfood` → [`examples/wash-refuse-dogfood.ts`](./examples/wash-refuse-dogfood.ts)
|
|
@@ -297,7 +297,7 @@ Dogfood (one public live proof path):
|
|
|
297
297
|
## Install
|
|
298
298
|
|
|
299
299
|
```bash
|
|
300
|
-
npm install twzrd-x402-gate@0.9.
|
|
300
|
+
npm install twzrd-x402-gate@0.9.13
|
|
301
301
|
```
|
|
302
302
|
|
|
303
303
|
Do not hardcode a version in this doc — every past pin here (**0.5.4**, **0.7.1**, **0.8.5**,
|
|
@@ -479,7 +479,7 @@ probe request → TWZRD scores challenge A → (if allowed) AgentCash request
|
|
|
479
479
|
|
|
480
480
|
- Exit `2` = policy blocked (AgentCash never started).
|
|
481
481
|
- Exit `0` = passthrough / dry-run allowed / AgentCash returned success (binding unproven).
|
|
482
|
-
- Base
|
|
482
|
+
- Base mainnet (`eip155:8453`) is scored, like Solana mainnet. Other EVM networks do not run the scored preflight (see Networks).
|
|
483
483
|
|
|
484
484
|
### CLI: `twzrd-bounty-preflight` (worker-side refuse, zero spend)
|
|
485
485
|
|
|
@@ -502,9 +502,10 @@ npx twzrd-bounty-preflight --board https://clawtasks.com/api/bounties?status=ope
|
|
|
502
502
|
```
|
|
503
503
|
|
|
504
504
|
Refuse reasons, in order: `gate_block` / `gate_wash_flagged` (TWZRD refused the
|
|
505
|
-
payee), `gate_unscored` (the payee's rail is outside the
|
|
506
|
-
|
|
507
|
-
trust allow; opt in with
|
|
505
|
+
payee), `gate_unscored` (the payee's rail is outside the scored corpus — Solana
|
|
506
|
+
mainnet and Base mainnet (`eip155:8453`) are scored; other rails are not; the
|
|
507
|
+
gate's "allow" there is a policy pass-through, never a trust allow; opt in with
|
|
508
|
+
`--allow-unscored-payee`, wash still refuses),
|
|
508
509
|
`payout_network_unsupported` / `payout_network_unknown`, `attempt_cost_over_max`
|
|
509
510
|
(attempt fee + board entry fee + stake vs the ceiling), `below_break_even` /
|
|
510
511
|
`assumed_win_prob_missing` (your declared win probability vs
|
|
@@ -527,9 +528,9 @@ Canonical entry point (design: `docs/strategy/install-autogate-design.md`). One
|
|
|
527
528
|
| `installTwzrdAutoGate("mpp", opts)` | MPP `onChallenge` (returns handler) |
|
|
528
529
|
|
|
529
530
|
Aliases: `installTwzrdX402ClientHook`, `createTwzrdMppOnChallenge` remain; docs prefer AutoGate.
|
|
530
|
-
Kill switch: `TWZRD_GATE_ENABLED=false` or `TWZRD_AUTO_GATE=0
|
|
531
|
-
|
|
532
|
-
|
|
531
|
+
Kill switch: `TWZRD_GATE_ENABLED=false` or `TWZRD_AUTO_GATE=0` applies to `installTwzrdAutoGate` only. `createTwzrdBeforePaymentHook` does not read those variables. Uninstall x402 installs with `uninstallTwzrdAutoGate(client)`.
|
|
532
|
+
`installTwzrdAutoGate` reads that switch **per call** on the x402-client, x402-solana, pay-kit and MPP seats before it calls the factory, so flipping it moves an already-installed
|
|
533
|
+
AutoGate seat in both directions. The **fetch / payWrap** seat is the exception: it resolves the switch once, when the fetch is composed,
|
|
533
534
|
so a fetch built while the switch was off stays ungated after you clear it — rebuild the fetch. `options.disabled: true` is a
|
|
534
535
|
permanent install-time opt-out everywhere and no env change revives it.
|
|
535
536
|
|
|
@@ -556,9 +557,11 @@ Any x402 client that composes over an underlying `fetch` works the same way —
|
|
|
556
557
|
whatever `payWrap` your client's API expects (agentcash, ClawRouter, PayAI, a custom
|
|
557
558
|
`@x402/svm` scheme, etc.).
|
|
558
559
|
|
|
559
|
-
|
|
560
|
-
`{ disabled: true }`
|
|
561
|
-
|
|
560
|
+
This `installTwzrdAutoGate(payWrap)` seat is default **ON**. Disable that seat with
|
|
561
|
+
`TWZRD_AUTO_GATE=0` or `TWZRD_GATE_ENABLED=false`, or with `{ disabled: true }`
|
|
562
|
+
(install option, for example in tests) — the raw fetch is handed straight to
|
|
563
|
+
`payWrap`, unguarded. `createTwzrdBeforePaymentHook` does not read those
|
|
564
|
+
variables. Setting them does not stop that factory from aborting a bad payment.
|
|
562
565
|
|
|
563
566
|
What happens on every HTTP 402 the raw fetch returns:
|
|
564
567
|
1. Reads the Solana-network entry from `accepts[]` (falls back to first entry) to get the seller wallet.
|
|
@@ -568,18 +571,18 @@ What happens on every HTTP 402 the raw fetch returns:
|
|
|
568
571
|
|
|
569
572
|
Non-402 responses pass through unchanged.
|
|
570
573
|
|
|
571
|
-
### Networks (Solana
|
|
574
|
+
### Networks (Solana mainnet and Base mainnet scored)
|
|
572
575
|
|
|
573
|
-
The gate **recognizes** multi-chain 402s
|
|
576
|
+
The gate **recognizes** multi-chain 402s. **Solana mainnet and Base mainnet (`eip155:8453`)** run the scored preflight. Other EVM networks do not. `eip155:137` does not run `twzrdPreflight` or the scored preflight.
|
|
574
577
|
|
|
575
578
|
| Network | Reputation scored? | Default policy (`unsupportedNetworkMode`) |
|
|
576
579
|
|---------|-------------------|-------------------------------------------|
|
|
577
580
|
| Solana mainnet | Yes — free preflight + merchant_card | allow/block from intel |
|
|
578
|
-
| Base
|
|
579
|
-
|
|
|
581
|
+
| Base mainnet (`eip155:8453`, `base`) | Yes — free preflight + merchant_card | allow/block from intel |
|
|
582
|
+
| Other EVM (`eip155:*` except 8453) | **No** scored preflight | `observe` (default): `decision=unknown`, `policyAction=allow`, telemetry `unsupported_network_seen`. **Wash still runs** — `wash_flagged` refuses before sign. |
|
|
583
|
+
| Other EVM in `strict` mode | No | `policyAction=block` before sign |
|
|
580
584
|
|
|
581
|
-
|
|
582
|
-
represented as a TWZRD trust `allow`. Set `TWZRD_UNSUPPORTED_NETWORK_MODE=strict` (or
|
|
585
|
+
An unscored network is never represented as a TWZRD trust `allow`. Set `TWZRD_UNSUPPORTED_NETWORK_MODE=strict` (or
|
|
583
586
|
`{ unsupportedNetworkMode: "strict" }`) to hard-block unscored networks.
|
|
584
587
|
|
|
585
588
|
`requireReceipt` (Path A) follows the same line: `hard` receipts apply to **scored networks
|
|
@@ -668,12 +671,19 @@ Opt out of wash refuse: `withTwzrdGuard(fetch, { refuseWashFlagged: false })` or
|
|
|
668
671
|
|
|
669
672
|
Non-402 responses pass through unchanged.
|
|
670
673
|
|
|
671
|
-
###
|
|
674
|
+
### First paid hop on warn (revenue path)
|
|
675
|
+
|
|
676
|
+
Wiring `x402Fetch` turns on buyer defaults: a proceeding `warn` settles
|
|
677
|
+
`GET /v1/intel/quick/{payTo}` at **$0.001** (escalateOnWarn). That is the first paid hop.
|
|
678
|
+
|
|
679
|
+
Optional V7 — `autoReceipt` or material-allow `requireReceipt` — buys
|
|
680
|
+
`GET /v1/intel/trust/{payTo}` at $0.05 for a signed credential. Opt out of the
|
|
681
|
+
cheap hop with `escalateOnWarn: false` if the host explicitly wants /trust first.
|
|
672
682
|
|
|
673
683
|
```typescript
|
|
674
684
|
const safeFetch = withTwzrdGuard(x402Fetch, {
|
|
675
|
-
|
|
676
|
-
|
|
685
|
+
x402Fetch, // warn → $0.001 /quick first
|
|
686
|
+
autoReceipt: true, // optional V7: also buy $0.05 /trust on allow (not after /quick)
|
|
677
687
|
onReceipt: (receipt, tx) => {
|
|
678
688
|
// receipt is a twzrd_receipt (V7 + ERC-8004 reputation_credential)
|
|
679
689
|
console.log("Trust receipt captured:", tx);
|
|
@@ -681,9 +691,8 @@ const safeFetch = withTwzrdGuard(x402Fetch, {
|
|
|
681
691
|
});
|
|
682
692
|
```
|
|
683
693
|
|
|
684
|
-
`autoReceipt` is **off by default** — it spends the **buyer's** USDC, so you opt in. When on
|
|
685
|
-
|
|
686
|
-
for the counterparty before you pay the resource.
|
|
694
|
+
`autoReceipt` is **off by default** — it spends the **buyer's** USDC, so you opt in. When on
|
|
695
|
+
and `/quick` did not already settle, warn/allow can buy the $0.05 V7 credential.
|
|
687
696
|
|
|
688
697
|
**`x402Fetch` is yours to supply** (this package is dependency-free). Wire the proven
|
|
689
698
|
`@x402/svm` sponsored-feePayer client — the same one `twzrd-mcp-server` uses:
|
|
@@ -702,7 +711,7 @@ is the next step.
|
|
|
702
711
|
|
|
703
712
|
The reputation ladder has three rungs: **free** preflight (`allow/warn/block`), **$0.001**
|
|
704
713
|
`quickCheck` (tier + score, no receipt), **$0.05** `autoReceipt` (full intel + signed V7
|
|
705
|
-
receipt). When
|
|
714
|
+
receipt). When an evaluated `warn` is inconclusive and you want a
|
|
706
715
|
cheap *paid* confirmation before committing — without paying 50× for the portable receipt —
|
|
707
716
|
use `quickCheck`:
|
|
708
717
|
|
|
@@ -721,10 +730,12 @@ allow/warn/block decision stays the free preflight's job.
|
|
|
721
730
|
|
|
722
731
|
### Autonomous risk-escalation — `escalateOnWarn` (pay-to-confirm on warn)
|
|
723
732
|
|
|
724
|
-
|
|
725
|
-
|
|
726
|
-
|
|
727
|
-
|
|
733
|
+
An evaluated `warn` (no `null_reason`, score present) **proceeds** by default. A card
|
|
734
|
+
with `null_reason: unknown_subject` does not sign on Solana mainnet or Base mainnet, so
|
|
735
|
+
this hop does not run for it. `escalateOnWarn` closes the loop on a proceeding `warn`:
|
|
736
|
+
the guard settles the cheap **$0.001** `GET /v1/intel/quick/{payTo}` and **re-decides on
|
|
737
|
+
the paid score** — below the floor the payment is **blocked**, at/above it proceeds. That
|
|
738
|
+
hop does not request `GET /v1/intel/trust/`. The paid call fires from your
|
|
728
739
|
agent's own risk policy (no human), and the paid signal actually gates the spend (unlike
|
|
729
740
|
`autoReceipt`, which is upsell-only and never changes the decision).
|
|
730
741
|
|
|
@@ -881,17 +892,19 @@ const gatedFetch = wrapFetchWithTwzrdGate(fetch, resolveConfig());
|
|
|
881
892
|
|
|
882
893
|
A payment is **blocked** when:
|
|
883
894
|
1. `decision ∈ blockDecisions` (default: `["block"]`)
|
|
884
|
-
2. `trust_score < preflightMinScore` (default: `40`)
|
|
895
|
+
2. `trust_score < preflightMinScore` (default: `40`), after an evaluated card. `null_reason: unknown_subject` (or `score: null`) is not a low score: on Solana mainnet and Base mainnet it does not sign, even when `trust_score` is the floor 45.
|
|
885
896
|
3. `can_spend === false` — **only** when `gateOnCanSpend: true` (default `false`, opt-in)
|
|
897
|
+
4. the price is above `recommended_cap_usdc` when the card was otherwise approved
|
|
898
|
+
|
|
899
|
+
`null_reason: unknown_subject` returns reason `twzrd_unevaluated_subject_unknown_subject`. A price above `recommended_cap_usdc` returns a reason that starts with `twzrd_over_recommended_cap_`. A direct `createTwzrdBeforePaymentHook` abort of a block card returns reason `twzrd_decision_block`. That reason string is not `block` and is not `twzrd_fail_closed`. A missing `payTo` returns reason `twzrd_unidentifiable_payment_recipient` from `twzrdApprovePayment`. That reason is not `twzrd_missing_payTo`. When the buyer preflight fetch throws and `TWZRD_FAIL_OPEN` is unset, `twzrdApprovePayment` returns reason `twzrd_fail_closed`. That reason is not `twzrd_preflight_fetch_error`.
|
|
886
900
|
|
|
887
|
-
`warn` is allowed unless overridden.
|
|
901
|
+
An evaluated `warn` (no `null_reason`, score present) is allowed unless overridden. When the buyer preflight fetch throws and `TWZRD_FAIL_OPEN` is unset, `twzrdApprovePayment` returns `approved: false` with reason `twzrd_fail_closed` and the wallet does not sign. An omitted `failOpen` on `createTwzrdSettleGuard` is a different default: a thrown screen returns without abort. 0.9.13 is not uniformly fail-closed.
|
|
888
902
|
|
|
889
|
-
A 402 whose payment requirements yield **no identifiable seller wallet** (missing/empty `payTo`, or an unparseable `accepts[]`) is a different case from "unknown seller" — it always **blocks** with `reason: twzrd_unidentifiable_payment_recipient`, without ever calling the preflight network. This is unconditional (not affected by `failOpen`):
|
|
903
|
+
A 402 whose payment requirements yield **no identifiable seller wallet** (missing/empty `payTo`, or an unparseable `accepts[]`) is a different case from "unknown seller" — it always **blocks** with `reason: twzrd_unidentifiable_payment_recipient`, without ever calling the preflight network. The wallet does not sign. This is unconditional (not affected by buyer `failOpen`): that switch governs a buyer preflight outage, not a missing payTo. An omitted `failOpen` on `createTwzrdSettleGuard` is a different default: a thrown screen returns without abort.
|
|
890
904
|
|
|
891
905
|
> **`can_spend` note:** the free preflight returns `can_spend=false` for most sellers
|
|
892
|
-
> not yet in the TWZRD corpus, including legitimate ones.
|
|
893
|
-
>
|
|
894
|
-
> Set `gateOnCanSpend: true` for strict mode.
|
|
906
|
+
> not yet in the TWZRD corpus, including legitimate ones. `can_spend: false` alone does not block (`gateOnCanSpend` defaults false). That is separate from `null_reason: unknown_subject`, which does not sign on a scored network.
|
|
907
|
+
> Set `gateOnCanSpend: true` to also block on `can_spend: false`.
|
|
895
908
|
|
|
896
909
|
## Config
|
|
897
910
|
|
|
@@ -900,9 +913,9 @@ A 402 whose payment requirements yield **no identifiable seller wallet** (missin
|
|
|
900
913
|
| `intelBase` | `TWZRD_INTEL_BASE` | `https://intel.twzrd.xyz` | Preflight API base |
|
|
901
914
|
| `preflightMinScore` | `TWZRD_PREFLIGHT_MIN_SCORE` | `40` | Block below this score |
|
|
902
915
|
| `blockDecisions` | `TWZRD_BLOCK_DECISIONS` | `block` | Decisions that throw |
|
|
903
|
-
| `failOpen` | `TWZRD_FAIL_OPEN` | `false` | `
|
|
916
|
+
| `failOpen` (buyer preflight only) | `TWZRD_FAIL_OPEN` | `false` | Buyer outage only: default does not sign. `createTwzrdSettleGuard` omitted `failOpen` is the other default — a thrown screen returns without abort |
|
|
904
917
|
| `gateOnCanSpend` | `TWZRD_GATE_ON_CAN_SPEND` | `false` | Also block when `can_spend=false` |
|
|
905
|
-
| `autoReceipt` | — | `false` |
|
|
918
|
+
| `autoReceipt` | — | `false` | Optional V7: auto-buy $0.05 `/trust` when `/quick` did not already settle |
|
|
906
919
|
| `x402Fetch` | — | — | x402-capable fetch for `autoReceipt` |
|
|
907
920
|
| `onReceipt` | — | — | Callback after receipt is captured |
|
|
908
921
|
| `disabled` (`installTwzrdAutoGate` only) | `TWZRD_AUTO_GATE=0`/`false` | `false` | Bypass the guard entirely — `payWrap` gets the raw, unguarded fetch |
|
|
@@ -997,9 +1010,10 @@ The gate path only ever calls free endpoints — the preflight plus, by default
|
|
|
997
1010
|
(`quickCheck`, `autoReceipt`) is otherwise opt-in, with one documented
|
|
998
1011
|
exception (QUICKSTART 3b): on the fetch / payWrap seat, wiring a paying fetch
|
|
999
1012
|
auto-enables buyer Path A, so a proceeding `warn` settles the $0.001 quick
|
|
1000
|
-
tier (
|
|
1013
|
+
tier (`GET /v1/intel/quick/{payTo}`) through your wallet with no further flag —
|
|
1001
1014
|
opt out with `escalateOnWarn: false`, `requireReceipt: false`, or by leaving
|
|
1002
|
-
`x402Fetch` unwired.
|
|
1015
|
+
`x402Fetch` unwired. Optional V7 `/trust` at $0.05 stays on material allow or
|
|
1016
|
+
explicit `autoReceipt`. The merchant-facing payment still waits on the free
|
|
1003
1017
|
preflight's verdict.
|
|
1004
1018
|
|
|
1005
1019
|
## License
|
package/dist/auto-gate.d.ts
CHANGED
|
@@ -11,15 +11,20 @@
|
|
|
11
11
|
* 5. PayKit seat — onBeforeX402PaymentCreation on createPayKitClient
|
|
12
12
|
* (Foundation pay-kit #303; optional / duck-typed)
|
|
13
13
|
*
|
|
14
|
-
* Default ON.
|
|
14
|
+
* Default ON for this installer. The kill switch is read only by
|
|
15
|
+
* installTwzrdAutoGate, not by createTwzrdBeforePaymentHook:
|
|
15
16
|
* TWZRD_AUTO_GATE=0|false
|
|
16
17
|
* TWZRD_GATE_ENABLED=0|false
|
|
17
18
|
* options.disabled: true
|
|
18
19
|
*
|
|
19
20
|
* Kill-switch timing, which differs by kind and is deliberate:
|
|
20
|
-
* -
|
|
21
|
-
* pay-kit and x402-client
|
|
22
|
-
*
|
|
21
|
+
* - installTwzrdAutoGate re-reads the ENV switches PER CALL on the MPP,
|
|
22
|
+
* x402-solana, pay-kit and x402-client seats, then either skips or calls
|
|
23
|
+
* the underlying factory. createTwzrdBeforePaymentHook itself does not
|
|
24
|
+
* read TWZRD_AUTO_GATE or TWZRD_GATE_ENABLED. Setting those variables
|
|
25
|
+
* does not stop a direct call to that factory from aborting a bad payment.
|
|
26
|
+
* Flipping the switch takes effect on an already-installed AutoGate seat.
|
|
27
|
+
* It is a running switch for that installer, not only a deploy-time one.
|
|
23
28
|
* - `options.disabled: true` is an install-time opt-out and is permanent for
|
|
24
29
|
* that install: nothing is constructed and no later env change revives it.
|
|
25
30
|
* - EXCEPTION, adapter 1: the fetch / payWrap adapter still resolves the
|
|
@@ -114,7 +119,8 @@ export declare function installTwzrdAutoGate(adapter: "pay-kit", options?: Insta
|
|
|
114
119
|
/**
|
|
115
120
|
* Disable a prior installTwzrdAutoGate on an x402 client (soft uninstall).
|
|
116
121
|
* Fetch compositions cannot be uninstalled — rebuild with disabled:true instead.
|
|
117
|
-
*
|
|
122
|
+
* AutoGate kill switch (this installer only): TWZRD_GATE_ENABLED=false or
|
|
123
|
+
* TWZRD_AUTO_GATE=0. createTwzrdBeforePaymentHook does not read those variables.
|
|
118
124
|
*/
|
|
119
125
|
export declare function uninstallTwzrdAutoGate(client: X402ClientLike): void;
|
|
120
126
|
//# sourceMappingURL=auto-gate.d.ts.map
|
package/dist/auto-gate.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auto-gate.d.ts","sourceRoot":"","sources":["../src/auto-gate.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"auto-gate.d.ts","sourceRoot":"","sources":["../src/auto-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAIL,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAEvB;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,KAAK,KAAK,OAAO,KAAK,CAAC;AAEnE,MAAM,MAAM,0BAA0B,GAAG;IACvC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,iBAAiB,GACzD,0BAA0B,GAAG;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,KAAK,CAAC;CACzB,CAAC;AAEJ,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAEjE,MAAM,MAAM,0BAA0B,GAAG,4BAA4B,GACnE,0BAA0B,CAAC;AAE7B,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,GAC3D,0BAA0B,CAAC;AAS7B,8DAA8D;AAC9D,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAOjF;AAcD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,KAAK,CAAC;AAEhB;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,0BAA0B,GACnC,cAAc,CAAC;AAElB;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,KAAK,EACd,OAAO,EAAE,yBAAyB,GACjC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAE5F;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,0BAA0B,GACnC,CACD,YAAY,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChE,OAAO,CAAC,EAAE,8BAA8B,KACrC,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS,EAClB,OAAO,CAAC,EAAE,0BAA0B,GACnC,CAAC,OAAO,EAAE,4BAA4B,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAwJnF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAWnE"}
|
package/dist/auto-gate.js
CHANGED
|
@@ -11,15 +11,20 @@
|
|
|
11
11
|
* 5. PayKit seat — onBeforeX402PaymentCreation on createPayKitClient
|
|
12
12
|
* (Foundation pay-kit #303; optional / duck-typed)
|
|
13
13
|
*
|
|
14
|
-
* Default ON.
|
|
14
|
+
* Default ON for this installer. The kill switch is read only by
|
|
15
|
+
* installTwzrdAutoGate, not by createTwzrdBeforePaymentHook:
|
|
15
16
|
* TWZRD_AUTO_GATE=0|false
|
|
16
17
|
* TWZRD_GATE_ENABLED=0|false
|
|
17
18
|
* options.disabled: true
|
|
18
19
|
*
|
|
19
20
|
* Kill-switch timing, which differs by kind and is deliberate:
|
|
20
|
-
* -
|
|
21
|
-
* pay-kit and x402-client
|
|
22
|
-
*
|
|
21
|
+
* - installTwzrdAutoGate re-reads the ENV switches PER CALL on the MPP,
|
|
22
|
+
* x402-solana, pay-kit and x402-client seats, then either skips or calls
|
|
23
|
+
* the underlying factory. createTwzrdBeforePaymentHook itself does not
|
|
24
|
+
* read TWZRD_AUTO_GATE or TWZRD_GATE_ENABLED. Setting those variables
|
|
25
|
+
* does not stop a direct call to that factory from aborting a bad payment.
|
|
26
|
+
* Flipping the switch takes effect on an already-installed AutoGate seat.
|
|
27
|
+
* It is a running switch for that installer, not only a deploy-time one.
|
|
23
28
|
* - `options.disabled: true` is an install-time opt-out and is permanent for
|
|
24
29
|
* that install: nothing is constructed and no later env change revives it.
|
|
25
30
|
* - EXCEPTION, adapter 1: the fetch / payWrap adapter still resolves the
|
|
@@ -66,9 +71,9 @@ export function installTwzrdAutoGate(target, options) {
|
|
|
66
71
|
return async (_challenge, helpers) => helpers.createCredential();
|
|
67
72
|
}
|
|
68
73
|
// AUDIT FIX: the env kill switch used to be read ONCE here, so a hook built
|
|
69
|
-
// before TWZRD_AUTO_GATE=0 kept gating forever while the x402-client
|
|
70
|
-
// honoured the same variable per call.
|
|
71
|
-
//
|
|
74
|
+
// before TWZRD_AUTO_GATE=0 kept gating forever while the x402-client seat
|
|
75
|
+
// honoured the same variable per call. This installer re-reads it per call.
|
|
76
|
+
// The inner factory does not read TWZRD_AUTO_GATE or TWZRD_GATE_ENABLED.
|
|
72
77
|
const gated = createTwzrdMppOnChallenge(mppOpts);
|
|
73
78
|
return async (challenge, helpers) => isTwzrdAutoGateDisabled(mppOpts) ? helpers.createCredential() : gated(challenge, helpers);
|
|
74
79
|
}
|
|
@@ -78,7 +83,9 @@ export function installTwzrdAutoGate(target, options) {
|
|
|
78
83
|
if (solOpts?.disabled === true) {
|
|
79
84
|
return async () => undefined;
|
|
80
85
|
}
|
|
81
|
-
// AUDIT FIX: same as the MPP seat —
|
|
86
|
+
// AUDIT FIX: same as the MPP seat — installTwzrdAutoGate re-reads the env
|
|
87
|
+
// per call, then calls createTwzrdBeforePaymentHook. That factory does not
|
|
88
|
+
// read TWZRD_AUTO_GATE or TWZRD_GATE_ENABLED.
|
|
82
89
|
const gated = createTwzrdBeforePaymentHook(solOpts);
|
|
83
90
|
return async (requirements, context) => isTwzrdAutoGateDisabled(solOpts) ? undefined : gated(requirements, context);
|
|
84
91
|
}
|
|
@@ -164,7 +171,7 @@ export function installTwzrdAutoGate(target, options) {
|
|
|
164
171
|
return target(echoing);
|
|
165
172
|
}
|
|
166
173
|
// The payWrap they already supply is a paying fetch. Use it as Path A
|
|
167
|
-
// x402Fetch so the canonical install fires warn
|
|
174
|
+
// x402Fetch so the canonical install fires warn → $0.001 /quick without a
|
|
168
175
|
// second argument. payWrap(echoing) is unguarded — no recursion into the gate.
|
|
169
176
|
const x402Fetch = fetchOpts?.x402Fetch ?? target(echoing);
|
|
170
177
|
return target(withTwzrdGuard(raw, { ...fetchOpts, x402Fetch }));
|
|
@@ -174,7 +181,8 @@ export function installTwzrdAutoGate(target, options) {
|
|
|
174
181
|
/**
|
|
175
182
|
* Disable a prior installTwzrdAutoGate on an x402 client (soft uninstall).
|
|
176
183
|
* Fetch compositions cannot be uninstalled — rebuild with disabled:true instead.
|
|
177
|
-
*
|
|
184
|
+
* AutoGate kill switch (this installer only): TWZRD_GATE_ENABLED=false or
|
|
185
|
+
* TWZRD_AUTO_GATE=0. createTwzrdBeforePaymentHook does not read those variables.
|
|
178
186
|
*/
|
|
179
187
|
export function uninstallTwzrdAutoGate(client) {
|
|
180
188
|
const states = clientInstalls.get(client);
|
package/dist/auto-gate.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auto-gate.js","sourceRoot":"","sources":["../src/auto-gate.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"auto-gate.js","sourceRoot":"","sources":["../src/auto-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,cAAc,EAA0B,MAAM,iBAAiB,CAAC;AACzE,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,0BAA0B,GAO3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,GAI1B,MAAM,eAAe,CAAC;AAoCvB;;6CAE6C;AAC7C,MAAM,cAAc,GAAG,IAAI,OAAO,EAAgC,CAAC;AAEnE,8DAA8D;AAC9D,MAAM,UAAU,uBAAuB,CAAC,OAAgC;IACtE,IAAI,OAAO,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACzC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,OAAO,CAAC,KAAK,UAAU,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,CACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAQ,CAAoB,CAAC,uBAAuB,KAAK,UAAU,CACpE,CAAC;AACJ,CAAC;AA6ED,MAAM,UAAU,oBAAoB,CAClC,MAAoE,EACpE,OAA8F;IAU9F,wEAAwE;IACxE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,OAAoC,CAAC;QACrD,sEAAsE;QACtE,IAAI,OAAO,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,EACV,UAAwB,EACxB,OAA8B,EACD,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC/D,CAAC;QACD,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,KAAK,EACV,SAAuB,EACvB,OAA8B,EACD,EAAE,CAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IAED,sEAAsE;IACtE,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAiD,CAAC;QAClE,IAAI,OAAO,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;QAC/B,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,KAAK,EACV,YAAgE,EAChE,OAAwC,EACF,EAAE,CACxC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,wEAAwE;IACxE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,OAAiD,CAAC;QACrE,IAAI,UAAU,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;QAC/B,CAAC;QACD,MAAM,KAAK,GAAG,kCAAkC,CAAC,UAAU,CAAC,CAAC;QAC7D,OAAO,KAAK,EACV,OAAqC,EACC,EAAE,CACxC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,wEAAwE;IACxE,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAiD,CAAC;QACnE,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,8EAA8E;QAC9E,0EAA0E;QAC1E,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,QAAQ,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,cAAc,CAAC,GAAG,CAAC,MAAgB,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CACV,oIAAoI,CACrI,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;QACpD,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC1B,cAAc,CAAC,GAAG,CAAC,MAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAEnD,2EAA2E;QAC3E,sEAAsE;QACtE,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxF,MAAM,YAAY,GAAG,MAAM,CAAC,uBAAuB,CAAC;QACpD,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,QAAQ,IAAI,uBAAuB,EAAE,EAAE,CAAC;gBAChD,OAAO,SAAS,CAAC,CAAC,oBAAoB;YACxC,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC,CAAC,CAA8C,CAAC;QACnD,MAAM,CAAC,uBAAuB,GAAG,OAAO,CAAC;QAEzC,IAAI,CAAC;YACH,0BAA0B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO;gBAAE,MAAM,CAAC,uBAAuB,GAAG,YAAY,CAAC;;gBACtD,OAAQ,MAAkC,CAAC,uBAAuB,CAAC;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,0CAA0C;YAC1C,EAAE;YACF,2EAA2E;YAC3E,0EAA0E;YAC1E,mEAAmE;YACnE,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,MAAM,CAAC,uBAAuB,KAAK,OAAO,EAAE,CAAC;gBAC/C,MAAM,CAAC,uBAAuB,GAAG,YAAY,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,OAAkD,CAAC;QACrE,MAAM,GAAG,GAAG,SAAS,EAAE,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,SAAS,GAAG,SAAS,EAAE,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,SAAS,CACjB,mKAAmK,CACpK,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,4EAA4E;QAC5E,0EAA0E;QAC1E,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QAClD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,IAAI,CACV,oFAAoF,CACrF,CAAC;AACJ,CAAC"}
|
package/dist/buyer-defaults.d.ts
CHANGED
|
@@ -7,11 +7,12 @@
|
|
|
7
7
|
*
|
|
8
8
|
* Ladder (when x402Fetch is present and flags are unset):
|
|
9
9
|
* block → free refuse
|
|
10
|
-
* warn
|
|
11
|
-
*
|
|
12
|
-
* allow + price >= $2.50 → $0.05 V6
|
|
10
|
+
* warn (any price) → $0.001 GET /quick (escalateOnWarn)
|
|
11
|
+
* allow + price >= $2.50 → optional V7 $0.05 GET /trust (requireReceipt)
|
|
13
12
|
* allow + price < $2.50 → free proceed
|
|
14
13
|
*
|
|
14
|
+
* First paid hop is always /quick on warn. $0.05 /trust is opt-in V7
|
|
15
|
+
* (material allow, autoReceipt, or escalateOnWarn: false + requireReceipt).
|
|
15
16
|
* Opt out: `requireReceipt: false` and/or `escalateOnWarn: false`.
|
|
16
17
|
*/
|
|
17
18
|
import type { RequireReceiptPolicy } from "./receipt-policy.js";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"buyer-defaults.d.ts","sourceRoot":"","sources":["../src/buyer-defaults.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"buyer-defaults.d.ts","sourceRoot":"","sources":["../src/buyer-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,wEAAwE;AACxE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,eAAO,MAAM,6BAA6B,EAAE,oBAK3C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;CAE1C,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL;IACE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAChD,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAUhF"}
|
package/dist/buyer-defaults.js
CHANGED
|
@@ -7,18 +7,19 @@
|
|
|
7
7
|
*
|
|
8
8
|
* Ladder (when x402Fetch is present and flags are unset):
|
|
9
9
|
* block → free refuse
|
|
10
|
-
* warn
|
|
11
|
-
*
|
|
12
|
-
* allow + price >= $2.50 → $0.05 V6
|
|
10
|
+
* warn (any price) → $0.001 GET /quick (escalateOnWarn)
|
|
11
|
+
* allow + price >= $2.50 → optional V7 $0.05 GET /trust (requireReceipt)
|
|
13
12
|
* allow + price < $2.50 → free proceed
|
|
14
13
|
*
|
|
14
|
+
* First paid hop is always /quick on warn. $0.05 /trust is opt-in V7
|
|
15
|
+
* (material allow, autoReceipt, or escalateOnWarn: false + requireReceipt).
|
|
15
16
|
* Opt out: `requireReceipt: false` and/or `escalateOnWarn: false`.
|
|
16
17
|
*/
|
|
17
18
|
/** ROI break-even from productization (0.05 lookup vs ~2% bad rate). */
|
|
18
19
|
export const DEFAULT_BUYER_MATERIAL_USDC = 2.5;
|
|
19
20
|
export const DEFAULT_BUYER_REQUIRE_RECEIPT = {
|
|
20
21
|
minSpendUsdc: DEFAULT_BUYER_MATERIAL_USDC,
|
|
21
|
-
onWarn:
|
|
22
|
+
onWarn: false,
|
|
22
23
|
hard: true,
|
|
23
24
|
materialWarnOnly: true,
|
|
24
25
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"buyer-defaults.js","sourceRoot":"","sources":["../src/buyer-defaults.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"buyer-defaults.js","sourceRoot":"","sources":["../src/buyer-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,wEAAwE;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,MAAM,CAAC,MAAM,6BAA6B,GAAyB;IACjE,YAAY,EAAE,2BAA2B;IACzC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,IAAI;IACV,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,YAAY,EAAE,CAAC;CAChB,CAAC;AAeF;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GAAoB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,EAAE,GAAG,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,EAAE,GAAG,8BAA8B,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -6,9 +6,9 @@
|
|
|
6
6
|
* payload. This adapter turns that callback into the same TWZRD decision used
|
|
7
7
|
* by the generic MCP hook.
|
|
8
8
|
*
|
|
9
|
-
* This is an approval boundary
|
|
10
|
-
*
|
|
11
|
-
* refuses
|
|
9
|
+
* This is an approval boundary. Solana mainnet and Base mainnet (`eip155:8453`)
|
|
10
|
+
* run the scored preflight. Other EVM networks stay `decision=unknown`: observe
|
|
11
|
+
* permits them and strict refuses them before the Cloudflare client pays.
|
|
12
12
|
*/
|
|
13
13
|
import type { TwzrdGateConfig, X402PaymentRequiredBody } from "./types.js";
|
|
14
14
|
/** Dependency-free structural shape passed to Cloudflare's callback. */
|
package/dist/cloudflare-x402.js
CHANGED
|
@@ -6,9 +6,9 @@
|
|
|
6
6
|
* payload. This adapter turns that callback into the same TWZRD decision used
|
|
7
7
|
* by the generic MCP hook.
|
|
8
8
|
*
|
|
9
|
-
* This is an approval boundary
|
|
10
|
-
*
|
|
11
|
-
* refuses
|
|
9
|
+
* This is an approval boundary. Solana mainnet and Base mainnet (`eip155:8453`)
|
|
10
|
+
* run the scored preflight. Other EVM networks stay `decision=unknown`: observe
|
|
11
|
+
* permits them and strict refuses them before the Cloudflare client pays.
|
|
12
12
|
*/
|
|
13
13
|
import { resolveConfig } from "./config.js";
|
|
14
14
|
import { twzrdOnPaymentRequested } from "./mcp-hook.js";
|
package/dist/config.d.ts
CHANGED
|
@@ -10,7 +10,8 @@ export type ResolvedTwzrdGateConfig = {
|
|
|
10
10
|
/** Soft cap USDC when wash_flagged; null = hard refuse */
|
|
11
11
|
washMaxUsdc: number | null;
|
|
12
12
|
/**
|
|
13
|
-
*
|
|
13
|
+
* Policy for networks that are not scored. Solana mainnet and Base mainnet
|
|
14
|
+
* (`eip155:8453`) are scored. Other EVM networks are not. Default observe.
|
|
14
15
|
* @see UnsupportedNetworkMode in network.ts
|
|
15
16
|
*/
|
|
16
17
|
unsupportedNetworkMode: "observe" | "strict";
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,gEAAgE;IAChE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,gEAAgE;IAChE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,sBAAsB,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7C,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,0EAA0E;IAC1E,WAAW,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD,CAAC;AAYF,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,eAAe,GAAG,uBAAuB,CAyFlF"}
|