wolverine-ai 5.0.4 → 5.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolverine-ai",
-  "version": "5.0.4",
+  "version": "5.1.0",
   "description": "Self-healing Node.js server framework powered by AI. Catches crashes, diagnoses errors, generates fixes, verifies, and restarts — automatically.",
   "main": "src/index.js",
   "bin": {

package/src/brain/brain.js

@@ -190,8 +190,12 @@ const SEED_DOCS = [
     metadata: { topic: "notifications" },
   },
   {
-    text: "Vault + x402 payments: encrypted key storage in .wolverine/vault/. AES-256-GCM. Private key NEVER as JS string — Buffer only, wiped after use. x402 protocol: HTTP 402 Payment Required for USDC payments on Base. Fastify plugin (src/middleware/x402-fastify.js) adds crypto to any route via config flag. Fixed price: { config: { x402: { price: '$0.10' } } }. Variable price (credit purchases): { config: { x402: { variable: true, min: '$1', max: '$10000', priceField: 'dollars' } } } — reads amount from request body. Flow: client requests → 402 with Payment-Required header → client SDK signs USDC auth → retries with Payment-Signature → server verifies via facilitator → 200 + receipt. req.x402.paid/amount/txHash available in handler after payment. Vault wallet is auto-detected as payTo. GET /x402/info shows payment config. Buyer SDKs: @x402/fetch, @x402/axios auto-handle 402→sign→retry.",
-    metadata: { topic: "vault-x402" },
+    text: "x402 paid APIs — turn any route into a paid API with one flag. Register the plugin once: fastify.register(require('wolverine-ai/src/middleware/x402-fastify')). Then add { config: { x402: { price: '$0.10' } } } to any route definition. That's it — the route now requires USDC payment on Base. Routes WITHOUT x402 config are completely unaffected (zero overhead). Two modes: (1) Fixed price: { x402: { price: '$0.10' } } — every call costs exactly $0.10. (2) Variable price: { x402: { variable: true, min: '$1', max: '$10000', priceField: 'dollars' } } — caller specifies amount in request body. Flow: no Payment-Signature header → 402 + Payment-Required header with price/network/payTo. Client SDK (@x402/fetch or wallet signing) handles payment → retries with Payment-Signature → middleware verifies signature (EIP-3009 TransferWithAuthorization for USDC, or x402 facilitator) → req.x402 = { paid: true, amount: '$5.00', from: '0x...', txHash } → handler runs. Vault wallet auto-detected as payTo address. Wolverine's adaptive rate limiter still protects paid routes from overload. Analytics track paid vs free calls. CLI: wolverine --x402-info shows setup guide.",
+    metadata: { topic: "x402-paid-apis" },
+  },
+  {
+    text: "x402 examples — making a paid API is as simple as adding a route. FREE route (normal): fastify.get('/api/data', async (req) => { return getData(); }). PAID route (just add x402 flag): fastify.get('/api/premium-data', { config: { x402: { price: '$0.01' } } }, async (req) => { return getPremiumData(); }). CREDIT PURCHASE route (variable): fastify.post('/buy-credits', { config: { x402: { variable: true, min: '$1', max: '$10000', priceField: 'dollars' } } }, async (req) => { const credits = parseFloat(req.x402.amount.replace('$','')) * 100; await addCredits(req.body.accountId, credits); return { credits }; }). Payment verification is automatic — the handler only runs after USDC is confirmed. No blockchain code needed in route handlers.",
+    metadata: { topic: "x402-examples" },
   },
   {
     text: "MCP integration: connect external tools via Model Context Protocol. Configure in .wolverine/mcp.json with per-server tool allowlists. Security: arg sanitization (secrets redacted before sending to MCP servers), result injection scanning, rate limiting per server, audit logging. Tools appear as mcp__server__tool in the agent. Supports stdio and HTTP transports.",

package/src/middleware/x402-fastify.js

@@ -187,8 +187,8 @@ async function _verifyPayment(paymentSig, price) {
     try {
       const { ethers } = require("ethers");
       // Normalize all addresses to proper EIP-55 checksum format
-      const fromAddr = ethers.getAddress(auth.from);
-      const toAddr = ethers.getAddress(auth.to);
+      const fromAddr = ethers.getAddress(auth.from.toLowerCase());
+      const toAddr = ethers.getAddress(auth.to.toLowerCase());
 
       const domain = {
         name: "USD Coin",

package/src/vault/wallet-ops.js

@@ -119,7 +119,15 @@ function _getCrypto() {
   const crypto = require("crypto");
 
   function keccak256(data) {
-    return crypto.createHash("sha3-256").update(data).digest();
+    // Ethereum uses keccak256 (NOT NIST SHA3-256)
+    try {
+      const { keccak256: k } = require("ethers");
+      const buf = data instanceof Uint8Array ? data : Buffer.from(data);
+      const hex = k(buf);
+      return Buffer.from(hex.slice(2), "hex");
+    } catch {
+      return crypto.createHash("sha3-256").update(data).digest();
+    }
   }
 
   function getPublicKey(privKeyBuf, compressed = false) {