wolverine-ai 5.4.1 → 5.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolverine-ai",
-  "version": "5.4.1",
+  "version": "5.4.3",
   "description": "Self-healing Node.js server framework powered by AI. Catches crashes, diagnoses errors, generates fixes, verifies, and restarts — automatically.",
   "main": "src/index.js",
   "bin": {

package/src/middleware/x402-fastify.js

@@ -174,50 +174,29 @@ async function x402Plugin(fastify, opts) {
       return;
     }
 
-    // Payment verified — attach info to request
+    // Settle via facilitator BEFORE handler runs — USDC must move before granting access
     const payer = decodedPayment.payload.authorization.from;
-    request.x402 = { paid: true, amount: price, from: payer, value: userValue, verified: true };
-
-    // Log payment
-    _logPayment({ route: request.url, method: request.method, amount: price, from: payer, verified: true, timestamp: Date.now() });
-  });
-
-  // Settlement hook — settle AFTER successful handler response
-  fastify.addHook("onSend", async (request, reply, payload) => {
-    if (!request.x402?.paid || !_facilitatorClient) return payload;
-    if (reply.statusCode >= 400) return payload;
-
     try {
-      const paymentHeader = request.headers["x-payment"] || request.headers["payment-signature"];
-      const raw = JSON.parse(Buffer.from(paymentHeader, "base64").toString("utf-8"));
-      const decodedPayment = { x402Version: raw.x402Version || 1, scheme: raw.scheme || "exact", network: raw.network || _network, payload: raw.payload };
-
-      const userValue = decodedPayment.payload.authorization.value;
-      const { getAddress } = await import("viem");
-      const proto = request.headers["x-forwarded-proto"] || "https";
-      const host = request.headers["x-forwarded-host"] || request.headers.host || "localhost";
-      const requirements = {
-        scheme: "exact", network: _network, maxAmountRequired: userValue,
-        resource: `${proto}://${host}${request.url}`, description: "", mimeType: "application/json",
-        payTo: getAddress(_payTo), maxTimeoutSeconds: 60, asset: getAddress(USDC_ADDRESS), extra: USDC_EIP712,
-      };
-
-      const settleResult = await _facilitatorClient.settle(decodedPayment, requirements);
-      if (settleResult.success) {
-        request.x402.txHash = settleResult.transaction;
-        request.x402.settled = true;
-        console.log(`  💰 x402 settled: ${settleResult.transaction || "confirmed"} (${request.x402.amount} from ${request.x402.from?.slice(0, 10)})`);
-        // Update payment log
-        _logPayment({ route: request.url, method: request.method, amount: request.x402.amount, from: request.x402.from, txHash: settleResult.transaction, verified: true, settled: true, timestamp: Date.now() });
-      } else {
+      const settleResult = await _facilitatorClient.settle(decodedPayment, actualRequirements);
+      if (!settleResult.success) {
         console.log(`  ⚠️ x402 settle failed: ${settleResult.errorReason || "unknown"}`);
+        reply.code(402).send({ error: "Payment settlement failed", reason: settleResult.errorReason });
+        return;
       }
+      const txHash = settleResult.transaction || null;
+      console.log(`  💰 x402 settled: ${txHash || "confirmed"} (${price} from ${payer?.slice(0, 10)})`);
+
+      request.x402 = { paid: true, amount: price, from: payer, value: userValue, verified: true, settled: true, txHash };
+      _logPayment({ route: request.url, method: request.method, amount: price, from: payer, txHash, verified: true, settled: true, timestamp: Date.now() });
     } catch (err) {
       console.log(`  ⚠️ x402 settle error: ${err.message}`);
+      reply.code(402).send({ error: "Payment settlement failed: " + err.message });
+      return;
     }
-    return payload;
   });
 
+  // No onSend settle needed — settlement happens in preHandler before handler runs
+
   // Public info endpoint
   fastify.get("/x402/info", async () => ({
     payTo: _payTo, network: _network, protocol: "x402", x402Version: 1,

package/src/templates/server/index.js

@@ -22,6 +22,9 @@ if (clusterEnabled && cluster.isPrimary && workerCount > 1) {
   // Single worker or cluster worker — run the server
   const fastify = require("fastify")({ logger: false });
 
+  // x402 payment middleware (auto-detects vault, no-op if no vault)
+  try { fastify.register(require("wolverine-ai/src/middleware/x402-fastify")); } catch {}
+
   // Routes
   fastify.register(require("./routes/health"), { prefix: "/health" });
   fastify.register(require("./routes/api"), { prefix: "/api" });

package/src/templates/server/routes/api.js

@@ -1,26 +1,25 @@
 /**
- * Demo API routes — shows both free endpoints and x402 paid APIs.
+ * Demo API routes — free endpoints and x402 paid APIs.
  *
- * Wolverine's vault provides an encrypted Ethereum wallet (AES-256-GCM)
- * for each server instance. The wallet is used as the payment receiver
- * for x402 paid APIs on the Base network (USDC).
+ * x402 Setup (one-time):
+ *   1. wolverine --init-vault          Create encrypted wallet
+ *   2. Set CDP_API_KEY_ID + CDP_API_KEY_SECRET in .env.local
+ *      (free at https://cdp.coinbase.com)
+ *   3. Add { config: { x402: { price: "$0.01" } } } to any route
  *
- * Vault commands:
- *   wolverine --init-vault      Create encrypted wallet
- *   wolverine --x402-info       Show wallet address & config
+ * That's it — the route now requires USDC payment on Base.
+ * The middleware handles 402 responses, wallet signing, facilitator
+ * verification, and on-chain settlement automatically.
  *
- * The vault is stored in .wolverine/vault/ and is:
- *   - Auto-backed up in every server snapshot
- *   - Protected from agent access (sandbox-blocked)
- *   - Private keys never exist as JS strings (Buffer only)
- *   - Rollback-protected (never overwritten by restore)
- *
- * Dashboard: localhost:3001 — view wallet balances, x402 revenue,
- * payment history, and all server health metrics in real time.
+ * Protocol: https://docs.cdp.coinbase.com/x402/welcome
+ * Network:  Base mainnet — USDC payments
+ * Wallet:   Auto-detected from vault
+ * Node:     22+ required
  */
 
 async function routes(fastify) {
-  // ── Free endpoints ──
+  // ── Free endpoints (no x402 config = no payment required) ──
+
   fastify.get("/", async () => ({ message: "Hello from Wolverine API" }));
 
   fastify.get("/users", async () => ({
@@ -30,29 +29,19 @@ async function routes(fastify) {
     ],
   }));
 
-  // ── x402 Paid API ──────────────────────────────────────────────
-  // Any route becomes a paid API by adding x402 config.
-  // Callers without a valid USDC payment get a 402 with payment instructions.
-  // Callers with a valid Payment-Signature header get the response.
-  //
-  // Protocol: https://docs.cdp.coinbase.com/x402/welcome
-  // Network:  Base (eip155:8453) — USDC payments
-  // Wallet:   Auto-detected from vault (wolverine --init-vault)
-  //
-  // To change pricing live without restart:
-  //   Update the price in config and the next request picks it up.
-  //   Or use the dashboard command: "change /api/premium price to $0.05"
-
-  // Fixed price — charge $0.01 per call:
+  // ── Paid endpoint — fixed price ──
+  // Just add x402 config. Handler only runs after USDC settles on-chain.
   fastify.get("/premium", {
     config: { x402: { price: "$0.01", description: "Premium data endpoint" } },
   }, async (req) => ({
     data: "This response cost $0.01 in USDC on Base",
-    paid: req.x402?.amount,
-    from: req.x402?.from,
+    paid: req.x402.amount,
+    from: req.x402.from,
+    txHash: req.x402.txHash,
   }));
 
-  // Variable price — caller chooses amount (e.g. buying credits):
+  // ── Paid endpoint — variable price ──
+  // Caller specifies amount in request body. Good for credit purchases.
   // POST /api/purchase { "dollars": "5.00" }
   fastify.post("/purchase", {
     config: {
@@ -65,9 +54,10 @@ async function routes(fastify) {
       },
     },
   }, async (req) => ({
-    message: `Received ${req.x402?.amount} USDC payment`,
-    from: req.x402?.from,
-    receipt: req.x402?.receipt ? "valid" : "none",
+    message: `Received ${req.x402.amount} USDC payment`,
+    from: req.x402.from,
+    txHash: req.x402.txHash,
+    settled: req.x402.settled,
   }));
 }