agent-first-pay 0.4.0

{
  "$schema": "https://cmn.dev/schemas/v1/spore-core.json",
  "id": "agent-first-pay",
  "name": "Agent-First Pay",
  "version": "0.4.0",
  "domain": "cmn.dev",
  "key": "ed25519.7BmCWmBb2YeUWR7pmHvwAvi9wRm96VpZsJvZFSTfc2Uu",
  "synopsis": "Agent-first cryptocurrency micropayment tool — multi-network wallet (Cashu, Lightning, Solana, EVM, Bitcoin), send/receive, spend limits, pipe/RPC/REST modes",
  "intent": [
    "Give AI agents a persistent cryptocurrency payment client that supports Lightning (NWC, phoenixd, lnbits), Solana, EVM (Base, Arbitrum), eCash (Cashu), and Bitcoin on-chain (BDK + Esplora, SegWit/Taproot), with JSONL pipe mode for scripting, RPC daemon mode for multi-client sharing, and REST API mode for HTTP access — the agent sends payment requests as JSON and receives structured results without managing wallet connections or key material"
  ],
  "mutations": [
    "Fix timing attack vulnerability in REST API key comparison by using constant-time byte comparison instead of short-circuit string equality",
    "Replace non-standard EVM key derivation (raw seed bytes) with proper BIP44 m/44'/60'/0'/0/0 hierarchical derivation via alloy MnemonicBuilder, producing addresses compatible with MetaMask and standard wallets",
    "Add configurable token-bucket rate limiting for REST and RPC endpoints with per-second and max-concurrent controls, preventing DoS via request flooding",
    "Block spend-limit-gated payments when the cached FX quote has fully expired instead of silently using stale rates, ensuring USD-denominated limits remain accurate",
    "Fix try_provider macro to continue trying remaining providers after a non-fatal error instead of stopping at the first failure, improving multi-provider resilience",
    "Unify wallet storage from per-network directories into a single wallets/ directory with one shared catalog, simplifying the data model and removing legacy path compatibility code",
    "Add sol and evm to default container build features so Docker and Apple container deployments include all supported networks out of the box"
  ],
  "license": "MIT",
  "bonds": [
    {
      "relation": "spawned_from",
      "uri": "cmn://cmn.dev/b3.BRYrnB2XFLsAu9V5bAYmzh3USmrjQp8fYNbAw17ZLHVz"
    }
  ],
  "tree": {
    "algorithm": "blob_tree_blake3_nfc",
    "exclude_names": [
      ".git"
    ],
    "follow_rules": [
      ".gitignore"
    ]
  }
}