wip-agent-pay 1.0.1

package/providers/coinbase.js

@@ -0,0 +1,55 @@
+// providers/coinbase.js
+// v1 Coinbase provider (isolated portfolio only)
+//
+// Worker is live. Coinbase transfer is still TODO (v1.1).
+// Right now: mints real one-time URLs on the Worker, but no actual
+// funds move yet. When Coinbase API is wired, Step 2 sends USDC
+// before minting the URL.
+
+import { execSync } from 'node:child_process';
+
+const WORKER_URL = 'https://pay-wip-computer.wipcomputer.workers.dev';
+
+export default async function authorize(amount, service, note = '') {
+  console.log(`\n  wip-agent-pay ... authorizing`);
+  console.log(`  Amount: ${amount}`);
+  console.log(`  Service: ${service}`);
+  if (note) console.log(`  Note: ${note}`);
+
+  // --- Step 1: Pull Worker secret from 1Password ---
+  let workerSecret;
+  try {
+    workerSecret = execSync(
+      'OP_SERVICE_ACCOUNT_TOKEN=$(cat ~/.openclaw/secrets/op-sa-token) ' +
+      'op item get "wip-agent-pay-worker-secret" --vault "Agent Secrets" --fields label=credential --reveal',
+      { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }
+    ).trim();
+  } catch (err) {
+    return { success: false, error: '1Password: could not retrieve worker secret' };
+  }
+
+  // --- Step 2: Send funds via Coinbase Advanced Trade API ---
+  // TODO (v1.1): Wire real Coinbase transfer
+  // When wired, this step will:
+  //   1. Pull API key + secret from 1Password (wip-agent-pay-coinbase)
+  //   2. Send USDC from isolated "wip-agent-pay" portfolio
+  //   3. Only proceed to Step 3 if transfer succeeds
+
+  // --- Step 3: Mint one-time URL via Worker ---
+  const res = await fetch(`${WORKER_URL}/create`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`
+    },
+    body: JSON.stringify({ amount, service, note, expiresMin: 3 })
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    return { success: false, error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  const { url } = await res.json();
+  return { success: true, provider: 'coinbase', amount, service, note, url };
+}

package/providers/index.js

@@ -0,0 +1,155 @@
+// providers/index.js
+// Provider router. Picks the right provider based on command + flags.
+//
+// Default (no flag): Pool Mode A. Apple Pay per transaction. Parker's float.
+// --wallet=cdp:     Path 1. Sign from user's CDP wallet.
+// --wallet=privy:   Path 1. Sign from user's Privy wallet.
+
+import { execSync } from 'node:child_process';
+import mintAuthorize from './coinbase.js';
+
+const WORKER_URL = 'https://pay-wip-computer.wipcomputer.workers.dev';
+
+// Lazy imports ... only load what's needed
+async function getX402() { return (await import('./x402.js')).default; }
+async function getStripe() { return (await import('./stripe.js')).default; }
+async function getPrivy() { return (await import('./privy.js')).default; }
+async function getPool() { return await import('./passthrough.js'); }
+
+function getWorkerSecret() {
+  return execSync(
+    'OP_SERVICE_ACCOUNT_TOKEN=$(cat ~/.openclaw/secrets/op-sa-token) ' +
+    'op item get "wip-agent-pay-worker-secret" --vault "Agent Secrets" --fields label=credential --reveal',
+    { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }
+  ).trim();
+}
+
+/**
+ * Pay for a paywalled URL.
+ *
+ * Default (Pool Mode A): Apple Pay per transaction. Parker's float covers x402.
+ * --wallet=cdp (Path 1): Sign with user's CDP wallet.
+ * --wallet=privy (Path 1): Sign with user's Privy wallet.
+ */
+export async function pay(url, opts = {}) {
+  // Path 1: self-custody wallet
+  if (opts.wallet === 'cdp') {
+    const x402Pay = await getX402();
+    return x402Pay(url);
+  }
+  if (opts.wallet === 'privy') {
+    const privyPay = await getPrivy();
+    return privyPay(url);
+  }
+
+  // Pool Mode A (default): Apple Pay + pool wallet
+  const pool = await getPool();
+  return pool.default(url);
+}
+
+/**
+ * Fund wallet via Stripe (money in).
+ * Opens Apple Pay checkout, deposits to agent wallet.
+ */
+export async function fund(amount, opts = {}) {
+  const stripeFund = await getStripe();
+  return stripeFund(amount, opts);
+}
+
+/**
+ * Mint a one-time URL (existing Mode B flow).
+ */
+export async function mint(amount, service, note = '') {
+  return mintAuthorize(amount, service, note);
+}
+
+/**
+ * Check wallet balance.
+ */
+export async function balance(opts = {}) {
+  let workerSecret;
+  try { workerSecret = getWorkerSecret(); } catch {
+    return { error: '1Password: could not retrieve worker secret' };
+  }
+
+  const wallet = opts.wallet || 'cdp';
+  const res = await fetch(`${WORKER_URL}/balance`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`,
+    },
+    body: JSON.stringify({ wallet }),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    return { error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  return res.json();
+}
+
+/**
+ * Get transaction history.
+ */
+export async function history(opts = {}) {
+  let workerSecret;
+  try { workerSecret = getWorkerSecret(); } catch {
+    return { error: '1Password: could not retrieve worker secret' };
+  }
+
+  const wallet = opts.wallet || 'cdp';
+  const limit = opts.limit || 20;
+  const res = await fetch(`${WORKER_URL}/history`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`,
+    },
+    body: JSON.stringify({ wallet, limit }),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    return { error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  return res.json();
+}
+
+/**
+ * Get or set budget (spending limits).
+ */
+export async function budget(opts = {}) {
+  let workerSecret;
+  try { workerSecret = getWorkerSecret(); } catch {
+    return { error: '1Password: could not retrieve worker secret' };
+  }
+
+  const wallet = opts.wallet || 'cdp';
+  const res = await fetch(`${WORKER_URL}/budget`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`,
+    },
+    body: JSON.stringify({
+      wallet,
+      // If setting a budget
+      ...(opts.daily !== undefined && { daily: opts.daily }),
+      ...(opts.perTx !== undefined && { perTx: opts.perTx }),
+      ...(opts.total !== undefined && { total: opts.total }),
+    }),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    return { error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  return res.json();
+}
+
+// Default export for backwards compatibility (mint flow)
+export default mintAuthorize;

package/providers/passthrough.js

@@ -0,0 +1,139 @@
+// providers/passthrough.js
+// Pool Mode (Mode A): User pays via Apple Pay (Stripe Checkout).
+// Worker signs x402 from Parker's pool wallet. Content returned.
+//
+// Pricing: x402 price + Stripe fees + $0.25 flat fee.
+// Max pool transaction: $25. Over $25 redirects to Mode C (user's own wallet).
+
+import { execSync } from 'node:child_process';
+
+const WORKER_URL = 'https://pay-wip-computer.wipcomputer.workers.dev';
+
+function getWorkerSecret() {
+  return execSync(
+    'OP_SERVICE_ACCOUNT_TOKEN=$(cat ~/.openclaw/secrets/op-sa-token) ' +
+    'op item get "wip-agent-pay-worker-secret" --vault "Agent Secrets" --fields label=credential --reveal',
+    { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }
+  ).trim();
+}
+
+/**
+ * Pay for a paywalled URL via Pool Mode.
+ * Worker fetches 402, calculates total (x402 + Stripe fees + $0.25),
+ * creates Stripe Checkout. Returns checkout URL for Apple Pay.
+ *
+ * @param {string} url - The paywalled URL
+ * @returns {{ success, checkoutUrl, paymentId, amount, pricing, service, error }}
+ */
+export default async function pool(url) {
+  console.log(`\n  wip-pay ... checking price`);
+  console.log(`  URL: ${url}`);
+
+  let workerSecret;
+  try { workerSecret = getWorkerSecret(); } catch {
+    return { success: false, error: '1Password: could not retrieve worker secret' };
+  }
+
+  // Hit the URL via Worker to get 402 + create Stripe Checkout
+  const res = await fetch(`${WORKER_URL}/pool/pay`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`,
+    },
+    body: JSON.stringify({ url }),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    try {
+      const data = JSON.parse(body);
+      // Over pool limit ... redirect to Mode C
+      if (data.status === 'over-pool-limit') {
+        return {
+          success: false,
+          overPoolLimit: true,
+          amount: data.amount,
+          service: data.service,
+          poolMax: data.poolMax,
+          error: data.error,
+        };
+      }
+    } catch { /* not JSON */ }
+    return { success: false, error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  const data = await res.json();
+
+  // No paywall ... content came back free
+  if (data.status === 'no-paywall') {
+    return { success: true, content: data.content, amount: 0, free: true };
+  }
+
+  // 402 found ... checkout URL ready
+  return {
+    success: true,
+    needsPayment: true,
+    checkoutUrl: data.checkoutUrl,
+    paymentId: data.paymentId,
+    amount: data.amount,
+    pricing: data.pricing,
+    service: data.service,
+  };
+}
+
+/**
+ * Check if a pool payment has been confirmed.
+ * Call this after user completes Apple Pay checkout.
+ * Worker checks Stripe, signs x402 from pool wallet, returns content.
+ *
+ * @param {string} paymentId - The payment ID from pool()
+ * @returns {{ success, content, amount, service, error }}
+ */
+export async function confirm(paymentId) {
+  let workerSecret;
+  try { workerSecret = getWorkerSecret(); } catch {
+    return { success: false, error: '1Password: could not retrieve worker secret' };
+  }
+
+  const res = await fetch(`${WORKER_URL}/pool/confirm`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`,
+    },
+    body: JSON.stringify({ paymentId }),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    return { success: false, error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  return res.json();
+}
+
+/**
+ * Poll for payment confirmation with timeout.
+ * Stripe Checkout -> webhook -> Worker signs x402 -> content returned.
+ *
+ * @param {string} paymentId
+ * @param {number} timeoutMs - Max wait time (default: 120s)
+ * @param {number} intervalMs - Poll interval (default: 2s)
+ */
+export async function waitForPayment(paymentId, timeoutMs = 120000, intervalMs = 2000) {
+  const deadline = Date.now() + timeoutMs;
+
+  while (Date.now() < deadline) {
+    const result = await confirm(paymentId);
+    if (result.success && result.status === 'paid') {
+      return result;
+    }
+    if (result.error && result.error !== 'pending') {
+      return result;
+    }
+    await new Promise(r => setTimeout(r, intervalMs));
+  }
+
+  return { success: false, error: 'Payment timed out. User may not have completed checkout.' };
+}

package/providers/privy.js

@@ -0,0 +1,50 @@
+// providers/privy.js
+// Privy embedded wallet provider. Server-side wallet with spend policies.
+// Worker handles x402 negotiation and Privy RPC signing.
+//
+// Like CDP, but no Coinbase. Privy holds the keys. Broad chain support.
+
+import { execSync } from 'node:child_process';
+
+const WORKER_URL = 'https://pay-wip-computer.wipcomputer.workers.dev';
+
+/**
+ * Pay for a paywalled URL via x402 using Privy wallet.
+ *
+ * @param {string} url - The paywalled URL
+ * @returns {{ success, content, amount, service, txHash, error }}
+ */
+export default async function pay(url) {
+  console.log(`\n  wip-agent-pay ... paying via x402 (Privy)`);
+  console.log(`  URL: ${url}`);
+
+  // Pull Worker secret from 1Password
+  let workerSecret;
+  try {
+    workerSecret = execSync(
+      'OP_SERVICE_ACCOUNT_TOKEN=$(cat ~/.openclaw/secrets/op-sa-token) ' +
+      'op item get "wip-agent-pay-worker-secret" --vault "Agent Secrets" --fields label=credential --reveal',
+      { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }
+    ).trim();
+  } catch {
+    return { success: false, error: '1Password: could not retrieve worker secret' };
+  }
+
+  // Call Worker /privy/pay
+  const res = await fetch(`${WORKER_URL}/privy/pay`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`,
+    },
+    body: JSON.stringify({ url }),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    return { success: false, error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  const result = await res.json();
+  return { success: true, ...result };
+}

package/providers/stripe.js

@@ -0,0 +1,54 @@
+// providers/stripe.js
+// Stripe funding provider. Opens Apple Pay checkout to fund agent wallet.
+// Worker creates Stripe Checkout session. User taps Face ID. Done.
+//
+// The user never sees crypto. Stripe handles fiat. Worker handles the rest.
+
+import { execSync } from 'node:child_process';
+
+const WORKER_URL = 'https://pay-wip-computer.wipcomputer.workers.dev';
+
+/**
+ * Fund agent wallet via Apple Pay / Stripe Checkout.
+ *
+ * @param {number} amount - USD amount to fund
+ * @param {object} opts - { wallet: 'cdp'|'privy' }
+ * @returns {{ success, checkoutUrl, fundId, error }}
+ */
+export default async function fund(amount, opts = {}) {
+  const wallet = opts.wallet || 'cdp';
+
+  console.log(`\n  wip-agent-pay ... funding wallet`);
+  console.log(`  Amount: $${amount}`);
+  console.log(`  Wallet: ${wallet}`);
+
+  // Pull Worker secret from 1Password
+  let workerSecret;
+  try {
+    workerSecret = execSync(
+      'OP_SERVICE_ACCOUNT_TOKEN=$(cat ~/.openclaw/secrets/op-sa-token) ' +
+      'op item get "wip-agent-pay-worker-secret" --vault "Agent Secrets" --fields label=credential --reveal',
+      { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }
+    ).trim();
+  } catch {
+    return { success: false, error: '1Password: could not retrieve worker secret' };
+  }
+
+  // Call Worker /stripe/checkout
+  const res = await fetch(`${WORKER_URL}/stripe/checkout`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`,
+    },
+    body: JSON.stringify({ amount, wallet }),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    return { success: false, error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  const { checkoutUrl, fundId } = await res.json();
+  return { success: true, checkoutUrl, fundId, amount, wallet };
+}

package/providers/x402.js

@@ -0,0 +1,50 @@
+// providers/x402.js
+// x402 payment provider. Agent hits a paywalled URL, Worker handles
+// the 402 negotiation, CDP signing, and retry. Returns content.
+//
+// The agent never sees crypto. The Worker does everything.
+
+import { execSync } from 'node:child_process';
+
+const WORKER_URL = 'https://pay-wip-computer.wipcomputer.workers.dev';
+
+/**
+ * Pay for a paywalled URL via x402.
+ *
+ * @param {string} url - The paywalled URL
+ * @returns {{ success, content, amount, service, txHash, error }}
+ */
+export default async function pay(url) {
+  console.log(`\n  wip-agent-pay ... paying via x402`);
+  console.log(`  URL: ${url}`);
+
+  // Pull Worker secret from 1Password
+  let workerSecret;
+  try {
+    workerSecret = execSync(
+      'OP_SERVICE_ACCOUNT_TOKEN=$(cat ~/.openclaw/secrets/op-sa-token) ' +
+      'op item get "wip-agent-pay-worker-secret" --vault "Agent Secrets" --fields label=credential --reveal',
+      { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }
+    ).trim();
+  } catch {
+    return { success: false, error: '1Password: could not retrieve worker secret' };
+  }
+
+  // Call Worker /x402/pay ... Worker handles 402 negotiation, CDP signing, retry
+  const res = await fetch(`${WORKER_URL}/x402/pay`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${workerSecret}`,
+    },
+    body: JSON.stringify({ url }),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    return { success: false, error: `Worker returned ${res.status}: ${body}` };
+  }
+
+  const result = await res.json();
+  return { success: true, ...result };
+}

package/skills/agent-pay/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: wip-agent-pay
+version: 1.0.0
+description: Disposable wallet for agents. x402 protocol + Coinbase isolated portfolio + one-time self-destructing URLs .
+tags: [payment, x402, coinbase, agent, 1password, universal-interface, cloudflare, disposable-wallet]
+score: 10
+install: npm install -g wip-agent-pay
+run: wip-agent-pay 0.10 morning-stew "MS-#8"
+metadata:
+  category: finance
+  capabilities:
+    - micropayment
+    - disposable-wallet
+    - one-time-url
+  interface: CLI + Module + MCP + OpenClaw Plugin + Skill
+  requires:
+    binaries: [node]
+openclaw:
+  emoji: "💳"
+  install:
+    env: []
+author:
+  name: Parker Todd Brooks
+---
+
+# wip-agent-pay
+
+Give your agent a disposable wallet. Powered by x402, Coinbase, and one-time self-destructing URLs.
+
+**Agent says "authorize $0.10" ... skill pulls creds from 1Password ... sends USDC from isolated portfolio ... returns a one-time URL  ... agent uses it once ... URL dies.**