402mob-merchant-sdk 0.3.0 → 0.3.1

package/README.md

@@ -26,7 +26,7 @@ Install from npm:
 npm install 402mob-merchant-sdk
 ```
 
-This source prepares SDK version **0.3.0**, adding seller Work Ticket methods and public buyer status reads. The published npm version remains **0.2.0** until 0.3.0 is separately released. See the [npm package page](https://www.npmjs.com/package/402mob-merchant-sdk) or browse the [source repository](https://github.com/gggggggg424242/402mob-merchant-sdk).
+Version **0.3.1** requires standard 65-byte EIP-191 signatures for enrollment and credential rotation, rejecting malformed or compact 64-byte signatures before submission. It retains resource resolution and seller Work Ticket methods from 0.3.0. See the [npm package](https://www.npmjs.com/package/402mob-merchant-sdk) and [source](https://github.com/gggggggg424242/402mob-merchant-sdk).
 
 Requires Node.js 18 or newer. The SDK uses the built-in Fetch API and has no runtime dependencies.
 
@@ -201,7 +201,7 @@ Adds `setDiscoverable(discoverable)`, which calls the authenticated `PUT /v1/age
 The source now rejects unreadable or incomplete successful API responses with `MerchantApiError` code `invalid_response`. Challenge fields and zero-USDC instructions are checked before invoking the wallet callback; enrollment and rotation responses must contain a merchant ID and a nonempty API key. An invalid completion response can mean the server already completed the operation: recover access through credential rotation if its one-time key was lost. This validation is included in published 0.1.2. Integrations using 0.1.1 should validate required fields explicitly. Preserve the original challenge and submitted transaction hash when completion is interrupted; rerunning `enrollWithTransaction` creates a fresh challenge and invokes the wallet callback again. A completion error is not permission to submit another proof transaction automatically.
 
 
-## Work Ticket reads and recovery (0.3.0 source)
+## Work Ticket reads and recovery
 
 Buyer agents can call `client.getWorkTicketStatus(ticketId)` without an API key to read state, quote terms, payment references, and result hashes. This public response excludes the buyer wallet, private input, and signed buyer receipt. It does not fetch result bytes or authorize payment.
 
@@ -211,4 +211,4 @@ The supported states are `open`, `claimed`, `quoted`, `accepted`, `paying`, `pai
 
 SDK requests reject HTTP redirects and never retry automatically. An interrupted mutation may have completed. Read the ticket before repeating a claim or quote; quote and claim creation are not idempotent. Repeating identical result content is supported while retained. For payment recovery through HTTP or MCP, reuse the original checkout key and authorization, including after delivery or a buyer receipt. The SDK does not submit payments.
 
-These methods are prepared in the 0.3.0 source release; publishing the package is a separate step.
+These methods are available from version 0.3.0.

package/dist/index.js

@@ -1,3 +1,9 @@
+function requireEip191Signature(signature) {
+    if (!/^0x[0-9a-fA-F]{130}$/.test(signature)) {
+        throw new TypeError("signature must be a 65-byte EIP-191 signature encoded as 0x-prefixed hex.");
+    }
+    return signature;
+}
 export class MerchantApiError extends Error {
     status;
     code;
@@ -44,7 +50,7 @@ export class MerchantClient {
         return this.request("POST", "/v1/merchants/enrollment-challenges", input);
     }
     completeEnrollmentWithSignature(input) {
-        return this.request("POST", "/v1/merchants/enrollments", input);
+        return this.request("POST", "/v1/merchants/enrollments", { ...input, signature: requireEip191Signature(input.signature) });
     }
     completeEnrollmentWithTransaction(input) {
         return this.request("POST", "/v1/merchants/enrollments/transaction", input);
@@ -52,7 +58,7 @@ export class MerchantClient {
     /** Request a challenge, ask the caller's wallet adapter to sign its exact message, then enroll. */
     async enrollWithSignature(input) {
         const challenge = await this.createEnrollmentChallenge({ wallet: input.wallet, name: input.name });
-        const signature = await input.signMessage(challenge.message);
+        const signature = requireEip191Signature(await input.signMessage(challenge.message));
         return this.completeEnrollmentWithSignature({
             wallet: input.wallet,
             name: input.name,
@@ -75,14 +81,14 @@ export class MerchantClient {
         return this.request("POST", "/v1/merchants/credential-challenges", { wallet });
     }
     rotateCredentialWithSignature(wallet, challengeId, signature) {
-        return this.request("POST", "/v1/merchants/credentials/rotate", { wallet, challengeId, signature });
+        return this.request("POST", "/v1/merchants/credentials/rotate", { wallet, challengeId, signature: requireEip191Signature(signature) });
     }
     rotateCredentialWithTransaction(input) {
         return this.request("POST", "/v1/merchants/credentials/rotate-transaction", input);
     }
     async rotateWithSignature(input) {
         const challenge = await this.createCredentialRotationChallenge(input.wallet);
-        const signature = await input.signMessage(challenge.message);
+        const signature = requireEip191Signature(await input.signMessage(challenge.message));
         return this.rotateCredentialWithSignature(input.wallet, challenge.challengeId, signature);
     }
     async rotateWithTransaction(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "402mob-merchant-sdk",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "TypeScript client for resolving agent resources and enrolling and operating 402Mob merchants.",
   "license": "MIT",
   "repository": {