@arispay/payagent-mcp - npm Package Compare versions

Comparing version 3.2.1 to 3.2.2

dist/index.js

@@ -119,2 +119,60 @@ #!/usr/bin/env node
 
+// src/funding-handoff.ts
+function resolveFundingHandoffBase(env = process.env) {
+  const raw = env.BUYFORME_URL?.trim();
+  if (!raw) return null;
+  return raw.replace(/\/$/, "");
+}
+function unavailablePayload(walletName) {
+  return {
+    error: {
+      code: "FUNDING_HANDOFF_UNAVAILABLE",
+      message: "EUR\xD8P funding needs a browser handoff for KYC, and no production handoff host exists. This rail is unavailable until an operator-controlled host is configured (BUYFORME_URL).",
+      retryable: false,
+      detail: {
+        rail: "europ",
+        wallet: walletName,
+        reason: "no_production_handoff_host"
+      }
+    },
+    alternatives: [
+      {
+        id: "card",
+        description: "Fund the master wallet by card instead: call fund_wallet with rail='card' (mints a hosted card-setup URL; delegated custody, human-funded).",
+        tool: "fund_wallet",
+        args: { rail: "card" }
+      },
+      {
+        id: "lane-p-self-custody",
+        description: "Machine-native alternative (no ArisPay funding account): fund your own EVM wallet with USDC on Base and pay x402 endpoints directly with local EIP-3009 signing. Set PAYAGENT_PRIVATE_KEY and call pay_api, or use payFetchLocal from the payagent SDK. Note: platform spend limits, allowed-domain rules, and the payment feed do not apply in this mode \u2014 your key, your controls.",
+        tool: "pay_api",
+        env: { PAYAGENT_PRIVATE_KEY: "<your-evm-private-key>" },
+        sdk: "payFetchLocal (payagent)"
+      }
+    ]
+  };
+}
+function buildEuropFundingResult(base, walletName, walletId) {
+  if (!base) {
+    return {
+      text: JSON.stringify(unavailablePayload(walletName), null, 2),
+      isError: true
+    };
+  }
+  const handoffUrl = `${base}/onboarding/fund-europ?agentId=${encodeURIComponent(walletId)}`;
+  const lines = [
+    `Fund the master wallet for \`${walletName}\` with EUR\xD8P via Schuman:`,
+    "",
+    `  ${handoffUrl}`,
+    "",
+    "Open that link in a browser to:",
+    "  1. Verify your identity with Schuman Financial (one-time KYC).",
+    "  2. Receive a dedicated SEPA vIBAN.",
+    "  3. Send EUR by bank transfer; Schuman mints EUR\xD8P once it clears.",
+    "",
+    "After the deposit clears, the master funding account is credited and this sub-wallet can spend."
+  ];
+  return { text: lines.join("\n"), isError: false };
+}
+
 // src/pay-api-helpers.ts
@@ -138,3 +196,3 @@ function looksLikeInsufficientFunds(message) {
 var SELF_ENDUSER_EXTERNAL_ID = "self";
-var buyformeUrl = process.env.BUYFORME_URL?.replace(/\/$/, "") ?? "https://buyforme.arispay.app";
+var fundingHandoffBase = resolveFundingHandoffBase();
 function requireDevKey() {
@@ -289,3 +347,3 @@ const key = getApiKey();
   "fund_wallet",
-  "Add money to the master funding account so a sub-wallet can spend. rail='europ' opens the Schuman KYC / vIBAN flow in a browser; rail='card' mints a hosted card-setup URL.",
+  "Add money to the master funding account so a sub-wallet can spend. rail='card' mints a hosted card-setup URL. rail='europ' needs an operator-configured handoff host (BUYFORME_URL); without one it returns a structured FUNDING_HANDOFF_UNAVAILABLE error that lists alternatives, including permissionless x402 via PAYAGENT_PRIVATE_KEY.",
   {
@@ -305,18 +363,4 @@ wallet: z.string().describe("Name of a sub-wallet (used only for handoff context)."),
       if (rail === "europ") {
-        const handoffUrl = `${buyformeUrl}/onboarding/fund-europ?agentId=${encodeURIComponent(
-          resolved.id
-        )}`;
-        const lines2 = [
-          `Fund the master wallet for \`${wallet}\` with EUR\xD8P via Schuman:`,
-          "",
-          `  ${handoffUrl}`,
-          "",
-          "Open that link in a browser to:",
-          "  1. Verify your identity with Schuman Financial (one-time KYC).",
-          "  2. Receive a dedicated SEPA vIBAN.",
-          "  3. Send EUR by bank transfer; Schuman mints EUR\xD8P once it clears.",
-          "",
-          "After the deposit clears, the master funding account is credited and this sub-wallet can spend."
-        ];
-        return textResult(lines2.join("\n"));
+        const result = buildEuropFundingResult(fundingHandoffBase, wallet, resolved.id);
+        return textResult(result.text, result.isError);
       }
@@ -338,3 +382,3 @@ const endUserId = await resolveSelfEndUserId(client);
         "",
-        "After the card is verified, you can top up. Card top-ups are not yet exposed via MCP; use the BuyForMe web app or the ArisPay dashboard for now."
+        "After the card is verified, you can top up. Card top-ups are not yet exposed via MCP; use the ArisPay dashboard for now."
       ];
@@ -341,0 +385,0 @@ return textResult(lines.join("\n"));

package.json

 {
   "name": "@arispay/payagent-mcp",
-  "version": "3.2.1",
+  "version": "3.2.2",
   "description": "MCP server that gives AI agents a wallet: pay x402 APIs (USD + EUR), check balances, self-onboard with one tool call. Use with Claude, Cursor, or any MCP client — delegated custody, no private keys on the agent.",
@@ -18,8 +18,2 @@ "type": "module",
   },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "type-check": "tsc --noEmit",
-    "prepublishOnly": "npm run build"
-  },
   "keywords": [
@@ -73,3 +67,8 @@ "arispay",
     "url": "https://github.com/arispay-inc/arispay-x402/issues"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "type-check": "tsc --noEmit"
   }
-}
+}

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

110722

6.01%

Lines of code

908

5.21%

No dependency changes