envarpay 0.1.0a6__tar.gz

envarpay-0.1.0a6/.dockerignore

@@ -0,0 +1,16 @@
+.venv
+__pycache__
+**/__pycache__
+.pytest_cache
+.ruff_cache
+.env*
+**/.env*
+*.key
+**/*.key
+*.token
+**/*.token
+*.sqlite3*
+**/*.sqlite3*
+agent-pay
+.git
+plans

envarpay-0.1.0a6/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,25 @@
+name: Bug report
+description: Report a reproducible integration or correctness problem
+body:
+  - type: markdown
+    attributes:
+      value: "Never include private keys, API tokens, signed authorizations or state databases. Use private security reporting for vulnerabilities."
+  - type: input
+    id: version
+    attributes:
+      label: EnvarPay version and Python version
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal reproduction
+      description: Use redacted configuration and synthetic inputs.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected and actual behavior
+    validations:
+      required: true

envarpay-0.1.0a6/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability privately
+    url: https://github.com/EnvarAI/EnvarPay/security/advisories/new
+    about: Do not disclose exploitable payment issues or credentials in public issues.

envarpay-0.1.0a6/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,14 @@
+name: Integration or feature request
+description: Describe an agent, wallet or workflow you want to connect
+body:
+  - type: textarea
+    id: need
+    attributes:
+      label: What are you trying to do?
+    validations:
+      required: true
+  - type: textarea
+    id: protocol
+    attributes:
+      label: Runtime, protocol and existing integration
+      description: Link to official documentation if available.

envarpay-0.1.0a6/.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Python ${{ matrix.python }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.11', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - run: python -m pip install -e '.[test]'
+      - run: ruff check src tests examples
+      - run: ruff format --check src tests examples
+      - run: pytest -q
+      - run: python -m build
+      - name: Install wheel in a separate environment
+        run: |
+          python -m venv /tmp/envarpay-wheel
+          /tmp/envarpay-wheel/bin/pip install dist/*.whl
+          /tmp/envarpay-wheel/bin/envarpay --version
+          /tmp/envarpay-wheel/bin/pip check
+
+  # No wallets, API keys or blockchain payments are used by CI.

envarpay-0.1.0a6/.github/workflows/container.yml

@@ -0,0 +1,39 @@
+name: Service container
+
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - .dockerignore
+      - .github/workflows/container.yml
+      - pyproject.toml
+      - README.pypi.md
+      - src/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: docker build -t envarpay:check .
+      - run: docker run --rm --network none envarpay:check --version
+      - name: Check non-root setup without signing
+        run: |
+          docker run --rm --network none --entrypoint sh envarpay:check -ec '
+            test "$(id -u)" = 10001
+            envarpay init --role buyer --pay-to 0x3333333333333333333333333333333333333333 --directory /data/check --json
+            envarpay doctor --config /data/check/buyer.toml
+            test ! -e /data/check/buyer.key
+          '
+
+# Builds only. No registry credentials, image push, model call or blockchain payment.

envarpay-0.1.0a6/.github/workflows/publish-python.yml

@@ -0,0 +1,89 @@
+name: Python distribution
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/publish-python.yml
+      - pyproject.toml
+      - README.pypi.md
+      - src/**
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag matching pyproject.toml (for example v0.1.0a6)
+        type: string
+        required: true
+      publish:
+        description: Publish the verified artifacts to PyPI (requires configured Trusted Publisher)
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: python-distribution-${{ github.event_name }}-${{ inputs.tag || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - name: Verify selected release
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+          MANUAL: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          python - <<'PY'
+          import os, pathlib, re, tomllib
+          project = tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]
+          assert project["name"] == "envarpay"
+          if os.environ["MANUAL"] == "true":
+              tag = os.environ["RELEASE_TAG"]
+              assert re.fullmatch(r"v[0-9]+\.[0-9]+\.[0-9]+(?:a[0-9]+|b[0-9]+|rc[0-9]+)?", tag)
+              assert tag == "v" + project["version"], "Tag and package version must match"
+          PY
+      - run: python -m pip install build 'twine>=7,<8'
+      - run: python -m build
+      - run: python -m twine check --strict dist/*
+      - name: Inspect the installed wheel
+        run: |
+          python -m venv /tmp/envarpay-release-check
+          /tmp/envarpay-release-check/bin/pip install dist/*.whl
+          /tmp/envarpay-release-check/bin/envarpay --version
+          /tmp/envarpay-release-check/bin/pip check
+      - name: Record artifact hashes
+        run: sha256sum dist/* >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: python-distribution
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/envarpay/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: python-distribution
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+
+# No tag push, PR or merge publishes a package. Publishing is an explicit manual
+# action after the PyPI owner configures the repository/workflow/environment trust.

envarpay-0.1.0a6/.github/workflows/runtime-build.yml

@@ -0,0 +1,70 @@
+name: Runtime build artifacts (no payments)
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/runtime-build.yml
+      - examples/cross-framework/build_artifacts.py
+      - examples/cross-framework/sources.json
+
+permissions:
+  contents: read
+
+jobs:
+  python-wheels:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - run: python examples/cross-framework/build_artifacts.py python
+      - uses: actions/upload-artifact@v4
+        with:
+          name: runtime-python-linux-arm64
+          path: runtime-artifacts/
+          retention-days: 7
+  hermes-wheels:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+      - run: python -m pip install uv
+      - run: python examples/cross-framework/build_artifacts.py hermes
+      - uses: actions/upload-artifact@v4
+        with:
+          name: runtime-hermes-linux-arm64
+          path: runtime-artifacts/
+          retention-days: 7
+  native-cli:
+    strategy:
+      fail-fast: false
+      matrix:
+        runtime: [goose, opencode, openclaw]
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '26'
+      - run: python3 examples/cross-framework/build_artifacts.py ${{ matrix.runtime }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: runtime-${{ matrix.runtime }}-linux-arm64
+          path: runtime-artifacts/
+          retention-days: 7
+
+# These jobs only compile/download public dependencies. No wallet, model key,
+# facilitator call, agent delivery or chain-payment acceptance runs here.

envarpay-0.1.0a6/.github/workflows/task-escrow.yml

@@ -0,0 +1,49 @@
+name: Task escrow
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  local-evm:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - run: pip install -e '.[test,task]'
+      - run: npm ci --ignore-scripts --prefix contracts/task
+      - run: npm run build --prefix contracts/task
+      - name: Check reproducible contract artifact
+        run: git diff --exit-code -- src/envarpay/tasks/escrow.json contracts/task/MockUSDC.json
+      - name: Run local EVM tests without public funds
+        run: |
+          node contracts/task/node_modules/ganache/dist/node/cli.js --server.host 127.0.0.1 --server.port 18546 --chain.chainId 31337 --wallet.deterministic --miner.blockTime 1 --logging.quiet > /tmp/evm.log 2>&1 &
+          EVM_PID=$!
+          trap 'kill "$EVM_PID"' EXIT
+          python - <<'PY'
+          import time, urllib.request
+          for _ in range(40):
+              try:
+                  urllib.request.urlopen('http://127.0.0.1:18546', timeout=1)
+              except urllib.error.HTTPError:
+                  break
+              except OSError:
+                  time.sleep(.25)
+              else:
+                  break
+          PY
+          ENVARPAY_TASK_TEST_RPC=http://127.0.0.1:18546 pytest -q tests/tasks
+      - run: python -m build
+      - name: Verify clean task wheel install
+        run: |
+          python -m venv /tmp/task-wheel
+          /tmp/task-wheel/bin/pip install 'dist/'*.whl 'web3>=7,<8'
+          /tmp/task-wheel/bin/envarpay task --help
+          /tmp/task-wheel/bin/python -c 'from envarpay.tasks.chain import artifact; assert artifact()["abi"]'

envarpay-0.1.0a6/.gitignore

@@ -0,0 +1,13 @@
+dist/
+*.egg-info/
+.venv/
+.pytest_cache/
+.ruff_cache/
+__pycache__/
+state/
+*.key
+*.sqlite3*
+agent-pay/
+.env*
+runtime-artifacts/
+runtime-sources/

envarpay-0.1.0a6/CHANGELOG.md

@@ -0,0 +1,55 @@
+# Changelog
+
+## 0.1.0a6 — unreleased distribution candidate
+
+- Replace fragile README diagram/badge rendering with repository-owned SVG assets.
+- Add a PyPI-specific long description, manual Trusted Publishing preparation and an agent-independent non-root container build.
+- Document actual registry availability and the distinct roles of Python/TypeScript SDKs, MCP services and native plugins.
+- Include the 0.1.0a5 security baseline; no registry upload or new payment is implied.
+
+## 0.1.0a5
+
+- Require patched Starlette 1.3.1 or newer for the HTTP services.
+- Recover unresolved purchases only on their original network and asset.
+- Query the original seller when an error response omitted the settlement transaction, without creating another signature or settlement.
+
+## 0.1.0a4 — unreleased
+
+- Add agent/role-aware initialization with exact decimal USDC amounts, wallet connection files and a personalized SETUP.md. No automatic wallet-key creation or payment.
+- Show readable setup instructions (`--json` provides machine-readable output), and configured recipients, prices and limits in doctor output.
+- Add dedicated guides for six frameworks, a configuration reference, seller recipes and portable native Python examples.
+- Preserve private-service setup and exclude its generated access token from Git.
+- Fix direct CLI status/reconcile access without a prior sync command; align the SDK Docker recipe with the new source version.
+
+## 0.1.0a3
+
+- Connect existing authenticated MCP/HTTP services without embedding Hermes.
+- Add optional directory discovery, reporting, original-operation recovery, remote-wallet access and opt-in receiving updates.
+
+## 0.1.0a2 — source preview
+
+- Unify distribution, CLI and Python import as envarpay; preserve original config and ledger paths.
+- Add host-config snippets for OpenClaw, Hermes, OpenCode and Goose without editing personal configs.
+- Add an experimental bounded HTTP runtime connector for dedicated existing agent services.
+- Add native Docker buyer/seller harnesses, reviewed profiles and offline source-build recipes for six frameworks.
+- Record 28 real cross-framework paid deliveries and two failed settlements, with raw-RPC audit and per-transaction evidence.
+- Isolate local TCP tests from inherited/system proxies; add onboarding/policy-generation tests.
+- Gateway HTTP acceptance, full 30/30 acceptance, mainnet and PyPI publication remain pending.
+
+
+## 0.1.0a1
+
+Initial public alpha of EnvarPay, extracted from the earlier two-Hermes payment POC.
+
+- Python SDK and CLI for seller payment gates and bounded buyer wallets.
+- Existing MCP backends and optional official Hermes integration.
+- MCP Streamable HTTP, SSE and stdio; official x402 v2 exact USDC / EIP-3009.
+- Upfront settlement plus exact Transfer and nonce verification before execution.
+- Persistent local budget reservations, original-authorization storage, duplicate
+  request protection and read-only reconciliation.
+- Setup/configuration helpers, English/Chinese guides and MIT licensing.
+
+Defaults: Base Sepolia, payment disabled, 10000 atomic test-USDC per call and total.
+No automatic refunds, multi-host recovery, external signer provider, A2A task
+support or new mainnet verification is claimed. See [POC evidence](docs/proof-of-concept.md)
+for the distinction between the prior real payment and package/CI tests.

envarpay-0.1.0a6/CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Contributing to EnvarPay
+
+Useful first contributions include another MCP client integration, reproductions
+of SDK compatibility issues, clearer onboarding and stronger failure-path tests.
+Before a large change, open an issue describing the user need and protocol scope.
+
+## Local development
+
+```sh
+python -m venv .venv
+source .venv/bin/activate
+python -m pip install -e '.[test]'
+ruff check src tests examples
+ruff format --check src tests examples
+pytest -q
+python -m build
+```
+
+Tests use real local MCP transports and simulated facilitator responses. They
+do not transfer funds or call a model API. Keep that distinction explicit when
+reporting results. Never add a private key, API token, `.env`, state database or
+signed authorization to a PR or issue.
+
+## Pull requests
+
+- Keep the change focused; describe the observable behavior and validation.
+- Preserve standard MCP and x402 wire formats. Avoid private settlement endpoints.
+- Keep payment disabled in examples, use testnet defaults, and retain budgets on
+  uncertain outcomes. Do not silently replace a signed authorization on retry.
+- Test monetary behavior and failures, including duplicate/concurrent requests.
+- Do not make a mainnet payment, publish a package, or use production credentials
+  as part of a test run.
+- Contributions are made under the repository's [MIT license](LICENSE).
+
+Security findings belong in the [private vulnerability reporting channel](https://github.com/EnvarAI/EnvarPay/security/advisories/new),
+not in a public issue with live credentials or an exploitable authorization.

envarpay-0.1.0a6/Dockerfile

@@ -0,0 +1,18 @@
+# Agent-independent service image. No Hermes/OpenClaw/model runtime is bundled.
+FROM python:3.13-slim AS build
+WORKDIR /build
+COPY pyproject.toml README.pypi.md LICENSE ./
+COPY src ./src
+RUN python -m pip wheel --no-cache-dir --wheel-dir /wheels .
+
+FROM python:3.13-slim
+COPY --from=build /wheels /wheels
+RUN python -m pip install --no-cache-dir --no-index --find-links=/wheels envarpay \
+    && python -m pip check \
+    && groupadd --gid 10001 envarpay \
+    && useradd --uid 10001 --gid 10001 --no-create-home envarpay \
+    && mkdir /data && chown 10001:10001 /data && chmod 700 /data
+USER 10001:10001
+WORKDIR /data
+ENTRYPOINT ["envarpay"]
+CMD ["--help"]

envarpay-0.1.0a6/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 EnvarAI contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

envarpay-0.1.0a6/PKG-INFO

@@ -0,0 +1,100 @@
+Metadata-Version: 2.5
+Name: envarpay
+Version: 0.1.0a6
+Summary: Get your agents paid. MCP and x402 payment SDK and CLI for agents.
+Project-URL: Homepage, https://github.com/EnvarAI/EnvarPay
+Project-URL: Repository, https://github.com/EnvarAI/EnvarPay
+Project-URL: Issues, https://github.com/EnvarAI/EnvarPay/issues
+Project-URL: Documentation, https://github.com/EnvarAI/EnvarPay/tree/main/docs
+Author: EnvarAI contributors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agents,hermes,mcp,payments,usdc,x402
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.11
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: jsonschema<5,>=4.20
+Requires-Dist: loguru<1,>=0.7
+Requires-Dist: mcp==1.28.1
+Requires-Dist: pydantic<3,>=2.11
+Requires-Dist: starlette<2,>=1.3.1
+Requires-Dist: tomli-w<2,>=1.2
+Requires-Dist: uvicorn<1,>=0.31
+Requires-Dist: x402[evm,mcp]==2.24.0
+Provides-Extra: task
+Requires-Dist: web3<8,>=7; extra == 'task'
+Provides-Extra: test
+Requires-Dist: build>=1.2; extra == 'test'
+Requires-Dist: pytest-asyncio>=0.25; extra == 'test'
+Requires-Dist: pytest>=8; extra == 'test'
+Requires-Dist: respx>=0.22; extra == 'test'
+Requires-Dist: ruff>=0.12; extra == 'test'
+Requires-Dist: web3<8,>=7; extra == 'test'
+Description-Content-Type: text/markdown
+
+# EnvarPay
+
+Add a budgeted payment wallet and an upfront USDC payment gate to existing agents.
+EnvarPay uses the official MCP and x402 v2 SDKs. Your agent keeps its own runtime,
+model and tools.
+
+## Install
+
+These registry commands apply after publication. For the current source preview,
+see [installation channels](https://github.com/EnvarAI/EnvarPay/blob/main/docs/packages.md).
+
+For a persistent CLI installation:
+
+```sh
+uv tool install envarpay==0.1.0a6
+envarpay --help
+```
+
+For the Python API, use an isolated environment:
+
+```sh
+python -m pip install envarpay==0.1.0a6
+```
+
+Python 3.11 or newer is required. Keep the wallet environment separate from
+frameworks using a different MCP major version.
+
+## Choose a capability
+
+- **Pay:** `envarpay wallet` exposes policy-constrained MCP tools to your agent.
+- **Receive:** `envarpay serve` puts a payment gate in front of a private MCP or HTTP service.
+- **Set up:** `envarpay init --agent NAME --role buyer|seller|both` generates editable configs and instructions.
+- **Inspect:** `envarpay doctor`, `status` and the explicit original-operation recovery flow.
+
+Start with the guide for your framework:
+
+- [OpenClaw](https://github.com/EnvarAI/EnvarPay/blob/main/docs/integrations/openclaw.md)
+- [Hermes](https://github.com/EnvarAI/EnvarPay/blob/main/docs/integrations/hermes.md)
+- [OpenCode](https://github.com/EnvarAI/EnvarPay/blob/main/docs/integrations/opencode.md)
+- [Goose](https://github.com/EnvarAI/EnvarPay/blob/main/docs/integrations/goose.md)
+- [LangGraph / LangChain](https://github.com/EnvarAI/EnvarPay/blob/main/docs/integrations/langgraph.md)
+- [Pydantic AI](https://github.com/EnvarAI/EnvarPay/blob/main/docs/integrations/pydantic-ai.md)
+
+MCP connections work across languages. An agent does not need to be written in
+Python to connect to this service. This distribution includes a Python SDK and
+CLI; it does not claim to include a TypeScript SDK or a framework-native plugin.
+
+## Alpha boundaries
+
+Payments default to **off**, using Base Sepolia test USDC and explicit recipient,
+tool and budget policies. Preserve the original request ID, authorization and
+ledger on uncertainty. A paid request can still fail during execution; payment
+does not establish output quality or an automatic refund.
+
+The historical [testnet matrix](https://github.com/EnvarAI/EnvarPay/blob/main/docs/integrations/validation.md)
+records 28 successful paid deliveries and two failed settlements across six
+native frameworks. Package installation and CI are not additional payment evidence.
+
+[Repository](https://github.com/EnvarAI/EnvarPay) ·
+[Configuration](https://github.com/EnvarAI/EnvarPay/blob/main/docs/configuration.md) ·
+[Python API](https://github.com/EnvarAI/EnvarPay/blob/main/docs/python-sdk.md) ·
+[Security](https://github.com/EnvarAI/EnvarPay/security/advisories/new)