@true402.dev/langchain - npm Package Compare versions

Comparing version 0.1.0 to 0.1.1

dist/index.d.ts

@@ -10,2 +10,8 @@ import { DynamicStructuredTool } from '@langchain/core/tools';
     rpcUrl?: string;
+    /**
+     * Hard ceiling, in USDC, on a single signed payment (default 0.10). The client REFUSES to sign a 402
+     * that demands more — so a rogue/compromised endpoint (or a MITM past TLS) can't drain the payer. The
+     * true402 stalls cost ~$0.003–0.015, so the default leaves headroom while blocking abuse.
+     */
+    maxAmountUsd?: number;
 }
@@ -12,0 +18,0 @@ /** POST a payload to a true402 stall path (e.g. '/v1/base/token-report'), paying over x402. */

dist/index.js

@@ -13,2 +13,4 @@ // src/index.ts
 ];
+var BASE_USDC = getAddress("0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913");
+var BASE_NETWORK = "eip155:8453";
 async function payStall(path, payload, opts) {
@@ -27,4 +29,8 @@ const baseUrl = opts.baseUrl ?? "https://true402.dev/api";
   if (!req) throw new Error('no x402 "exact" payment requirement in the 402');
+  if (req.network && req.network !== BASE_NETWORK) throw new Error(`unexpected payment network "${req.network}" (expected ${BASE_NETWORK}) \u2014 refusing to sign`);
   const usdc = getAddress(req.asset);
+  if (usdc !== BASE_USDC) throw new Error(`unexpected payment asset ${usdc} (expected Base USDC) \u2014 refusing to sign`);
   const value = BigInt(req.amount ?? req.maxAmountRequired ?? "0");
+  const capAtomic = BigInt(Math.round((opts.maxAmountUsd ?? 0.1) * 1e6));
+  if (value > capAtomic) throw new Error(`402 demands ${value} USDC base units, over the $${opts.maxAmountUsd ?? 0.1} cap (maxAmountUsd) \u2014 refusing to sign`);
   const pub = createPublicClient({ chain: base, transport: http(rpcUrl) });
@@ -31,0 +37,0 @@ const held = await pub.readContract({ address: usdc, abi: USDC_ABI, functionName: "balanceOf", args: [account.address] });

package.json

 {
   "name": "@true402.dev/langchain",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "true402 tools for LangChain — pay-per-call on-chain rug/honeypot & address safety for Base AI agents over x402 (USDC, no account, no API key).",
@@ -9,3 +9,5 @@ "type": "module",
   "types": "dist/index.d.ts",
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "scripts": {
@@ -16,4 +18,14 @@ "build": "tsup src/index.ts --format esm --dts --clean",
   "keywords": [
-    "langchain", "langchain-tools", "x402", "base", "rug-check", "honeypot",
-    "token-safety", "crypto", "ai-agent", "agent-tools", "defi", "web3"
+    "langchain",
+    "langchain-tools",
+    "x402",
+    "base",
+    "rug-check",
+    "honeypot",
+    "token-safety",
+    "crypto",
+    "ai-agent",
+    "agent-tools",
+    "defi",
+    "web3"
   ],
@@ -20,0 +32,0 @@ "homepage": "https://true402.dev",

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

9720

11.97%

Lines of code

133

9.92%

No dependency changes