Call it from an agent

#!/usr/bin/env bash
# =============================================================================
# Agents Trust - Recommend, paid over x402, done by hand.
#
#   GET https://api.agents-trust.com/recommend?need=weather+forecast&limit=3
#
# Same job and the same six steps as the Python and TypeScript tabs, no SDK.
# Needs: curl, jq, base64 (preinstalled on macOS and most Linux).
#
# STATUS (2026-09-10): the Agents Trust Worker sends the 402 challenge. The
# price is 0.01 USDC a query on Base or Solana. Step 1 below answers 402 with
# the terms in PAYMENT-REQUIRED and the same envelope as JSON; steps 2-6 are the paid path.
# The decoded 402 printed under step 2 is a real capture from a DIFFERENT x402
# server (x402.org/protected), labelled as such, kept because its amount and
# network differ from ours and make the fields easier to tell apart.
# =============================================================================

URL='https://api.agents-trust.com/recommend?need=weather+forecast&limit=3'


# --- 1. The unpaid GET -------------------------------------------------------
# -D keeps the response headers in a file: under x402 v2 the challenge lives in
# the canonical header and a matching JSON body. Keep the header for SDK clients.

curl -sS -D /tmp/at-head.txt -o /tmp/at-body.json "$URL"
cat /tmp/at-head.txt
jq . /tmp/at-body.json

# Expect: HTTP/2 402, a JSON quote, and the same terms in step 2. (The
#         three demo needs the website shows answer 200 for free instead.)


# --- 2. Read the challenge ---------------------------------------------------
# x402 v2 puts the requirements in a base64 PAYMENT-REQUIRED response header
# and Agents Trust mirrors it as JSON in the body. v1 uses a JSON body.
# Sniff, never assume - version drift between servers is live right now.

if grep -qi '^payment-required:' /tmp/at-head.txt; then      # x402 v2
  grep -i '^payment-required:' /tmp/at-head.txt \
    | cut -d' ' -f2- | tr -d '\r' | base64 -d > /tmp/at-402.json
else                                                         # x402 v1, or no challenge
  cp /tmp/at-body.json /tmp/at-402.json
fi
jq . /tmp/at-402.json

# A REAL v2 challenge, captured from https://x402.org/protected on 2026-09-03
# and decoded. Agents Trust emits this shape. The amount below is x402.org's
# price on Base Sepolia, not ours - ours is "10000" (0.01 USDC) on Base mainnet
# or Solana:
#
# {
#   "x402Version": 2,
#   "error": "Payment required",
#   "resource": {
#     "url": "https://x402.vercel.app/protected",
#     "description": "Access to protected content",
#     "mimeType": ""
#   },
#   "accepts": [
#     { "scheme": "exact",
#       "network": "eip155:84532",
#       "amount": "10000",
#       "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
#       "payTo": "0x209693Bc6afc0C5328bA36FaF03C514EF312287C",
#       "maxTimeoutSeconds": 300,
#       "extra": { "name": "USDC", "version": "2" } },
#     { "scheme": "exact",
#       "network": "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1",
#       "amount": "10000",
#       "asset": "4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU",
#       "payTo": "CKPKJWNdJEqa81x7CkZ14BVPiY6y16Sxs7owznqtWYp5",
#       "maxTimeoutSeconds": 300,
#       "extra": { "feePayer": "CKPKJWNdJEqa81x7CkZ14BVPiY6y16Sxs7owznqtWYp5" } }
#   ]
# }
#
# Three renames to guard your parser against, v2 -> v1:
#   amount               -> maxAmountRequired
#   "eip155:8453"        -> "base"          (CAIP-2 -> short network name)
#   top-level "resource" -> resource/description/mimeType repeated per accepts[]
# Branch on x402Version, and tolerate both spellings: servers in the wild have
# been seen emitting amount AND maxAmountRequired in a single entry. Read
# "error" as an opaque string; despite the schema it carries free text.


# --- 3. Pick one accepts[] entry, and check it against your own cap ----------
# Match on a scheme + network you can actually settle on, then compare `amount`
# to YOUR ceiling before you sign anything. `amount` is a decimal STRING of
# atomic units - USDC has 6 decimals, so "10000" is $0.01, which is also
# the Agents Trust quote. Compare to your cap anyway; never trust a doc over
# the 402.

CAP_ATOMIC=10000   # $0.01 in USDC atomic units. Your cap, and it equals our quote today.

jq --argjson cap "$CAP_ATOMIC" \
   '.accepts[]? | select(((.amount // .maxAmountRequired) | tonumber) <= $cap)' \
   /tmp/at-402.json

# ^ this filter is exactly what the TypeScript PaymentPolicy and the Python
# spend control do for you. (jq's tonumber is a double - fine at USDC scale,
# but use bigint math in real code.)


# --- 4. Build and sign the payment payload -----------------------------------
#        THIS IS THE PART A LIBRARY DOES FOR YOU. There is no curl flag for it.
#
# For EVM `exact` you have to, in your own code:
#   a. assemble an EIP-712 message, primaryType TransferWithAuthorization:
#        domain = { name:              extra.name,       # e.g. "USDC"
#                   version:           extra.version,    # e.g. "2"
#                   chainId:           <from network>,
#                   verifyingContract: asset }
#        from        = your wallet address
#        to          = payTo
#        value       = amount                        (string)
#        validAfter  = now - 600                     (string; 10 min clock slack)
#        validBefore = now + maxTimeoutSeconds       (string; the real expiry)
#        nonce       = 32 random bytes, 0x-hex       (the on-chain replay guard)
#   b. sign it with your private key -> a 65-byte signature;
#   c. wrap it in the PaymentPayload envelope below;
#   d. standard-base64 the JSON.
#
# Steps (a) and (b) need a secp256k1 EIP-712 signer. curl has none; openssl has
# none. On Solana it is not even a signature: you build the entire SPL
# TransferChecked transaction, partially sign it, and ship it base64 as
# payload.transaction, with the facilitator co-signing as feePayer. That is the
# whole reason the other two tabs are a handful of lines.

# The envelope, verified v1 `exact` EVM shape. Every value is a STRING,
# including the numeric ones:
cat > /tmp/at-payload.json <<'JSON'
{
  "x402Version": 1,
  "scheme": "exact",
  "network": "base",
  "payload": {
    "signature": "0x2d6a7588...148b571c",
    "authorization": {
      "from": "0x857b06519E91e3A54538791bDbb0E22373e36b66",
      "to": "0x209693Bc6afc0C5328bA36FaF03C514EF312287C",
      "value": "10000",
      "validAfter": "1740672089",
      "validBefore": "1740672154",
      "nonce": "0xf3746613c2d920b5fdabc0856f2aeb2d4f88ee6037b8cc5d04a71a4462f13480"
    }
  }
}
JSON

# Standard base64 of the UTF-8 JSON: standard alphabet (+ and /), "=" padding
# kept. NOT base64url, not compressed, no "Bearer " prefix.
PROOF=$(jq -c . /tmp/at-payload.json | base64 | tr -d '\n')


# --- 5. Replay the IDENTICAL request with the proof header -------------------
# Same method, same URL, same query, same body. One header is added and nothing
# else changes. v2 names it PAYMENT-SIGNATURE; v1 names it X-PAYMENT. Send the
# one that matches the x402Version you read in step 2.

curl -sS -D /tmp/at-paid-head.txt -o /tmp/at-paid.json   -H "PAYMENT-SIGNATURE: $PROOF"   "$URL"

# A paid 200 contains the answer before settlement completes. Save its
# x-at-payment-attempt-id header; PAYMENT-RESPONSE is absent.
ATTEMPT_ID=$(awk 'tolower($1)=="x-at-payment-attempt-id:" {gsub("\r", "", $2); print $2}' /tmp/at-paid-head.txt)
if [ -n "$ATTEMPT_ID" ]; then
  curl -sS "https://api.agents-trust.com/receipt?payment_attempt_id=$ATTEMPT_ID" | jq .
fi
# pending is normal immediately after the answer. Poll this free lookup for a
# bounded time and reconcile on chain before paying again.
jq . /tmp/at-paid.json

# The other paid GET follows the same steps:
#   https://api.agents-trust.com/inspect?url=<exact url>

"""
Agents Trust - Recommend, paid over x402, with the official Python SDK.

    GET https://api.agents-trust.com/recommend?need=weather+forecast&limit=3

Same job and the same six steps as the curl and TypeScript tabs:
  1. unpaid GET                        -> the server answers 402 with its terms
  2. read the challenge                -> asset, amount, payTo, network
  3. cap what you are willing to pay
  4. sign, and replay the IDENTICAL GET with the proof header
  5. read the answer and x-at-payment-attempt-id
  6. get the eventual receipt from the free /receipt route

STATUS (2026-09-10): the Agents Trust Worker sends the 402 challenge. The
price is 0.01 USDC a query, settled on Base or Solana. Run this and step 1
returns 402; the paid branch below sends a verified proof and prints the answer. The
three demo needs the website shows still answer 200 for free, which is the
only way into the unpaid branch. Nothing here fakes a 402.

Install:
    pip install "x402[evm,requests]>=2.21,<3" requests
Run:
    X402_WALLET_PRIVATE_KEY=0x... python agents_trust_client.py
"""

import json
import os
import sys

import requests
from eth_account import Account

from x402 import x402ClientSync
from x402.http import x402HTTPClientSync
from x402.http.clients import x402_requests

# Import PaymentError from the *requests* adapter. `x402.http.clients.PaymentError`
# is a DIFFERENT class (the httpx one) and will not catch this.
from x402.http.clients.requests import PaymentError
from x402.http.constants import PAYMENT_REQUIRED_HEADER
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

URL = "https://api.agents-trust.com/recommend"
PARAMS = {"need": "weather forecast", "limit": 3}

# --- 3. Your spend cap -------------------------------------------------------
# This is YOUR ceiling. The Agents Trust quote is $0.01 (10000 atomic
# units of USDC), and the SDK refuses any challenge above your ceiling before
# anything is signed.
MAX_PRICE = os.getenv("X402_MAX_PRICE", "$0.01")


def build_client() -> tuple[x402ClientSync, str]:
    """Wallet + spend cap + the EVM `exact` scheme. Steps 3 and 4's machinery."""
    # NEVER hardcode a key. Export it from your shell or secret manager:
    #   export X402_WALLET_PRIVATE_KEY=$(op read op://vault/x402-wallet/key)
    private_key = os.getenv("X402_WALLET_PRIVATE_KEY")
    if not private_key:
        sys.exit(
            "Set X402_WALLET_PRIVATE_KEY (0x-prefixed hex) to a funded wallet.\n"
            "  export X402_WALLET_PRIVATE_KEY=$(op read op://vault/x402-wallet/key)"
        )

    account = Account.from_key(private_key)
    client = x402ClientSync().set_spend_controls({"max_amount_per_payment": MAX_PRICE})
    # No network pinned here: whatever chain the server lists in `accepts` wins.
    # (The TypeScript tab pins Base mainnet instead - either is a valid policy.)
    register_exact_evm_client(client, EthAccountSigner(account))
    return client, account.address


def describe_challenge(response: requests.Response) -> None:
    """Step 2: decode the 402's payment requirements, v1 body or v2 header."""
    helper = x402HTTPClientSync(x402ClientSync())
    required = helper.get_payment_required_response(
        lambda name: response.headers.get(name), response.content
    )
    print(f"  x402 version: {required.x402_version}")
    for i, opt in enumerate(required.accepts, 1):
        # `amount` is a string in the asset's smallest unit (USDC has 6 decimals).
        print(
            f"  option {i}: {opt.amount} of {opt.asset} on {opt.network}"
            f" -> payTo {opt.pay_to} (scheme={opt.scheme},"
            f" timeout={opt.max_timeout_seconds}s)"
        )


def main() -> None:
    # --- 1. The unpaid GET ---------------------------------------------------
    print(f"GET {URL} (no payment)")
    probe = requests.get(URL, params=PARAMS, timeout=30)
    print(f"  -> HTTP {probe.status_code}")

    if probe.status_code != 402:
        # Only the website's fixed demo sample answers without a challenge.
        print(
            "  Server did not ask for payment: this need is in the free demo "
            "sample. Every other input is challenged with a 402.\n"
        )
        print(json.dumps(probe.json(), indent=2)[:2000])
        return

    # --- 2. Read the challenge ----------------------------------------------
    print(f"\n402 Payment Required. Reading {PAYMENT_REQUIRED_HEADER}:")
    describe_challenge(probe)

    # --- 3 + 4. Cap, sign, and replay the IDENTICAL GET ----------------------
    client, address = build_client()
    print(f"\nPaying from {address} (cap {MAX_PRICE}), retrying the same GET...")

    with x402_requests(client) as session:
        # This session re-issues the same GET, takes the 402, applies the spend
        # cap, signs a TransferWithAuthorization for the selected requirement,
        # and resends the identical request with PAYMENT-SIGNATURE added.
        # Nothing else about the request changes.
        try:
            paid = session.get(URL, params=PARAMS, timeout=60)
        except PaymentError as exc:
            # e.g. the price exceeds MAX_PRICE, or no funded asset matches.
            sys.exit(f"Payment refused: {exc}")
        paid.raise_for_status()
        print(f"  -> HTTP {paid.status_code}")

        # --- 5. Free receipt lookup ------------------------------------------
        payment_id = paid.headers.get("x-at-payment-attempt-id")
        if payment_id:
            receipt = requests.get(
                "https://api.agents-trust.com/receipt",
                params={"payment_attempt_id": payment_id}, timeout=10,
            )
            receipt.raise_for_status()
            print(f"\nSettlement state: {receipt.json()}")
            # A pending state is normal immediately after the answer. Poll this
            # free route for a bounded time before any payment retry.

        # --- 6. The answer ---------------------------------------------------
        print("\nResult:")
        print(json.dumps(paid.json(), indent=2))


if __name__ == "__main__":
    main()

# The other paid GET uses this same client; only the URL changes:
#   https://api.agents-trust.com/inspect?url=<exact url>

/**
 * Agents Trust - Recommend, paid over x402, with the official fetch wrapper.
 *
 *   GET https://api.agents-trust.com/recommend?need=weather+forecast&limit=3
 *
 * Same job and the same six steps as the curl and Python tabs:
 *   1. unpaid GET                      -> the server answers 402 with its terms
 *   2. read the challenge              -> asset, amount, payTo, network
 *   3. cap what you are willing to pay
 *   4. sign, and replay the IDENTICAL GET with the proof header
 *   5. read the answer and payment-attempt id
 *   6. look up the eventual settlement on the free /receipt route
 *
 * STATUS (2026-09-10): the Agents Trust Worker sends the 402 challenge. The
 * price is 0.01 USDC a query, settled on Base or Solana. Run this and
 * wrapFetchWithPayment takes the 402 path: it signs against the quoted 10000
 * atomic USDC and hands back a verified answer before settlement completes.
 * The paid 200 carries x-at-payment-attempt-id for the free receipt lookup. The
 * three demo needs the website shows still answer 200 for free, and the
 * wrapper forwards that response through untouched.
 *
 * Setup:
 *   pnpm add @x402/fetch @x402/evm viem
 *   # package.json needs "type": "module"  (top-level await, Node 20+)
 * Run:
 *   EVM_PRIVATE_KEY=0x... npx tsx agents-trust-client.ts
 */
import { privateKeyToAccount } from "viem/accounts";
import {
  wrapFetchWithPayment,
  x402Client,
  type PaymentPolicy,
} from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";

const TARGET =
  "https://api.agents-trust.com/recommend?need=weather+forecast&limit=3";

// ---------------------------------------------------------------------------
// Wallet key from the environment. Never a literal, never committed.
// ---------------------------------------------------------------------------
const PRIVATE_KEY = process.env.EVM_PRIVATE_KEY;
if (!PRIVATE_KEY || !/^0x[0-9a-fA-F]{64}$/.test(PRIVATE_KEY)) {
  throw new Error(
    "Set EVM_PRIVATE_KEY to a 0x-prefixed 32-byte hex key, funded with USDC on the settlement chain.",
  );
}
const signer = privateKeyToAccount(PRIVATE_KEY as `0x${string}`);

// ---------------------------------------------------------------------------
// 3. Your spend cap.
//
// x402 v2 dropped v1's third `maxValue` argument to wrapFetchWithPayment. The
// replacement is a PaymentPolicy: it runs over the server's quoted options
// before one is selected, so you filter or reject them yourself.
//
// `amount` is a decimal STRING in atomic token units (USDC has 6 decimals, so
// 10000n is $0.01). This is YOUR ceiling, and today it
// equals the Agents Trust quote. Read the quote off the 402 anyway; never
// copy it from a doc.
// ---------------------------------------------------------------------------
const MAX_ATOMIC = 10000n; // $0.01 in USDC atomic units. Your cap, your call.

const capSpend: PaymentPolicy = (_x402Version, accepts) => {
  const affordable = accepts.filter(r => BigInt(r.amount) <= MAX_ATOMIC);
  if (affordable.length === 0) {
    const quoted = accepts.map(r => `${r.amount} (${r.network})`).join(", ");
    throw new Error(
      `Refusing to pay: quoted [${quoted}] atomic units exceeds cap ${MAX_ATOMIC}.`,
    );
  }
  return affordable;
};

// ---------------------------------------------------------------------------
// Build the client. `networks` pins settlement to Base mainnet; drop it and the
// scheme registers the eip155:* wildcard, which would pay on ANY EVM chain the
// server names. (The Python tab leaves it unpinned - either is a valid policy.)
// ---------------------------------------------------------------------------
const client = new x402Client();
registerExactEvmScheme(client, {
  signer,
  policies: [capSpend],
  networks: ["eip155:8453"], // Base mainnet
});

const fetchWithPayment = wrapFetchWithPayment(fetch, client);

// ---------------------------------------------------------------------------
// 1 + 2. The unpaid GET, and the challenge it comes back with.
//
// Illustrative: this prints what the server ACTUALLY returns right now - a 402
// once the challenge is enforced, a 200 until then. Nothing is simulated.
// Delete this block in production; the wrapper below does the unpaid GET itself.
// ---------------------------------------------------------------------------
const probe = await fetch(TARGET, { method: "GET" });
console.log(`[probe] unpaid GET -> ${probe.status} ${probe.statusText}`);

if (probe.status === 402) {
  // v2 carries the requirements as base64 JSON in the PAYMENT-REQUIRED header
  // and Agents Trust mirrors them as JSON in the body. v1 uses the body.
  const header = probe.headers.get("PAYMENT-REQUIRED");
  const challenge = header ? JSON.parse(atob(header)) : await probe.json();
  console.log("[probe] challenge:", JSON.stringify(challenge, null, 2));
  // accepts[]: { scheme, network, amount (v1: maxAmountRequired), asset,
  //              payTo, maxTimeoutSeconds, extra }
} else {
  console.log("[probe] no challenge issued; the endpoint answered without payment.");
}

// ---------------------------------------------------------------------------
// 4. Cap, sign, and replay - all inside this one call. wrapFetchWithPayment:
//      a. issues the unpaid GET;
//      b. on 402, parses `accepts` and applies your policies;
//      c. signs an EIP-712 TransferWithAuthorization with your key
//         (no gas, no on-chain transaction from you);
//      d. replays the IDENTICAL request - same method, URL, query, body -
//         with only the PAYMENT-SIGNATURE proof header added.
//    A non-402 response is returned as-is, which is today's path.
// ---------------------------------------------------------------------------
const response = await fetchWithPayment(TARGET, { method: "GET" });

if (!response.ok) {
  throw new Error(
    `${response.status} ${response.statusText} - ${(await response.text()).slice(0, 300)}`,
  );
}

const data = await response.json();

// ---------------------------------------------------------------------------
// 5. Free receipt lookup for a paid answer. The first result may be pending.
//    No PAYMENT-RESPONSE header is sent on the paid 200.
// ---------------------------------------------------------------------------
const paymentId = response.headers.get("x-at-payment-attempt-id");
if (paymentId) {
  const receipt = await fetch(
    "https://api.agents-trust.com/receipt?payment_attempt_id=" + encodeURIComponent(paymentId),
  );
  if (!receipt.ok) throw new Error("Receipt lookup failed: " + receipt.status);
  console.log("[paid] settlement state:", await receipt.json());
  // Poll this free route for a bounded time if state is pending.
}

// ---------------------------------------------------------------------------
// 6. The answer.
// ---------------------------------------------------------------------------
console.log(JSON.stringify(data, null, 2));

// The identical client calls the other paid GET - only the URL changes:
//   https://api.agents-trust.com/inspect?url=<exact url>