Per-call and per-task ceilings
Integer base-unit limits are evaluated before signing; a shared ledger reserves task spend atomically.
[ Open x402 buyer controls ]
A wallet should be the last gate, not the first.
A zero-dependency reference library that decides whether an agent may pay before any signature—and verifies what settled afterward. It is policy infrastructure, not a wallet or facilitator.
Explicit allowlists
Scheme, CAIP-2 network, asset, payee, and exact HTTPS resource must all match.
Schema prerequisite
The caller must supply valid schema evidence from x402-doctor or another validator.
Scoped human approval
Approval binds policy, task, resource, network, asset, payee, maximum amount, and expiry.
Replay controls
Authorization identities and successful settlement transactions are independently claimed once.
Settlement evidence
PAYMENT-RESPONSE is bound to network and payer; optional chain evidence binds token, payer, payee, and amount.
[ Pre-signing boundary ]
One decision before custody is touched.
The policy returns structured allow, deny, or approval-required codes. A caller invokes its Viem, CDP, LangChain.js, or MCP signing adapter only after an allow decision and atomic budget reservation.
const decision = await authorizePayment({
policy,
ledger,
intent: {
taskId: runId,
authorizationId: transferAuthorization.nonce,
requestedResource: targetUrl,
declaredResource: challenge.resource.url,
requirement,
schema: { status: doctorReport.ok ? 'valid' : 'invalid' },
},
})
if (!decision.allowed) {
throw new Error(`${decision.code}: ${decision.message}`)
}
// The wallet signer is invoked only after the policy allows and reserves.[ Honest integration boundary ]
Framework-neutral does not mean framework-magical.
LangChain.js, MCP TypeScript clients, and Viem can call the package directly. Python LangChain and CrewAI applications can enforce the same public JSON contract at their wallet boundary; this release does not claim to be a native Python package. Production deployments must replace the included single-process reference ledger with an atomic shared store.