@astrasyncai/verification-gateway 5.14.0 → 5.15.0

package/dist/transport/index.js

@@ -530,6 +530,7 @@ function bufferToBase64(bytes) {
 }
 
 // src/transport/rfc9421-verify.ts
+var import_crypto = require("crypto");
 var import_http_message_signatures = require("http-message-signatures");
 
 // src/transport/nonce-store.ts
@@ -601,6 +602,16 @@ async function verifyRFC9421(request, options) {
       normalizeRequest(request)
     );
     if (result === true) {
+      const digestError = checkContentDigest(request);
+      if (digestError) {
+        return {
+          ok: false,
+          kid: resolvedKid,
+          registry: resolver.name,
+          algorithm: resolvedAlg,
+          error: digestError
+        };
+      }
       return {
         ok: true,
         kid: resolvedKid,
@@ -625,6 +636,21 @@ async function verifyRFC9421(request, options) {
     };
   }
 }
+function checkContentDigest(request) {
+  if (request.body === void 0) return null;
+  const raw = Object.entries(request.headers).find(
+    ([k]) => k.toLowerCase() === "content-digest"
+  )?.[1];
+  if (!raw) return null;
+  const header = Array.isArray(raw) ? raw.join(", ") : raw;
+  const entries = [...header.matchAll(/(sha-256|sha-512)=:([A-Za-z0-9+/=]+):/g)];
+  if (entries.length === 0) return null;
+  for (const [, alg, value] of entries) {
+    const expected = (0, import_crypto.createHash)(alg === "sha-256" ? "sha256" : "sha512").update(request.body, "utf8").digest("base64");
+    if (expected !== value) return "content-digest does not match the body";
+  }
+  return null;
+}
 function normalizeRequest(request) {
   return {
     method: request.method.toUpperCase(),
@@ -726,7 +752,7 @@ async function getCrypto() {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.15.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -874,8 +900,9 @@ function extractBearer(authHeader) {
 function extractPaymentToken(body) {
   const paymentData = body.payment_data;
   if (!paymentData) return void 0;
-  const raw = coerceString3(paymentData.token);
-  const provider = coerceString3(paymentData.provider);
+  const instrument = paymentData.instrument;
+  const raw = coerceString3(instrument?.credential?.token) ?? coerceString3(paymentData.token);
+  const provider = coerceString3(paymentData.provider) ?? coerceString3(paymentData.handler_id);
   if (!raw) return { raw: void 0, type: null, provider };
   const type = classifyPaymentToken(raw);
   return { raw, type, provider };
@@ -1738,8 +1765,10 @@ async function getSubtle() {
 // src/transport/mpp.ts
 var import_mppx = require("mppx");
 function extractMPPFromRequest(request) {
-  const auth = readHeader3(request.headers, "authorization");
-  if (!auth || !/^\s*Payment\s+/i.test(auth)) return null;
+  const alt = readHeader3(request.headers, "payment-authorization");
+  const authHeader = readHeader3(request.headers, "authorization");
+  const auth = authHeader && /^\s*Payment\s+/i.test(authHeader) ? authHeader : alt ? /^\s*Payment\s+/i.test(alt) ? alt : `Payment ${alt.trim()}` : void 0;
+  if (!auth) return null;
   try {
     const credential = import_mppx.Credential.deserialize(auth);
     return {
@@ -1926,6 +1955,16 @@ function verifyMPP(input) {
 var import_schemas = require("@x402/core/schemas");
 var import_utils = require("@x402/core/utils");
 function extractX402FromRequest(request) {
+  const v2Header = readHeader4(request.headers, "payment-signature");
+  if (v2Header) {
+    try {
+      const decoded = (0, import_utils.safeBase64Decode)(v2Header);
+      const parsed = decoded ? tryParsePayload(JSON.parse(decoded)) : null;
+      if (parsed) return buildPayloadContext(parsed, "header");
+    } catch {
+    }
+    return { kind: "error", version: 2, source: "header", error: { type: "invalid-x402-payload" } };
+  }
   const headerValue = readHeader4(request.headers, "x-payment");
   if (request.body && typeof request.body === "object") {
     const parsed = tryParsePayload(request.body);
@@ -1952,6 +1991,21 @@ function extractX402FromRequest(request) {
 }
 function extractX402FromResponse(response) {
   if (response.status !== 402) return null;
+  const v2Header = readHeader4(response.headers, "payment-required");
+  if (v2Header) {
+    try {
+      const decoded = (0, import_utils.safeBase64Decode)(v2Header);
+      const parsed = decoded ? tryParseRequired(JSON.parse(decoded)) : null;
+      if (parsed) return buildRequiredContext(parsed, "header");
+    } catch {
+    }
+    return {
+      kind: "error",
+      version: 2,
+      source: "header",
+      error: { type: "invalid-x402-required" }
+    };
+  }
   if (response.body && typeof response.body === "object") {
     const parsed = tryParseRequired(response.body);
     if (parsed) return buildRequiredContext(parsed, "body");
@@ -2465,6 +2519,8 @@ function resolvePaymentToken(input) {
   const mppMethod = input.mpp?.context.credential?.challenge?.method;
   if (mppMethod === "tempo") return { present: true, type: "tempo-tx" };
   if (mppMethod === "stripe") return { present: true, type: "stripe-spt" };
+  if (input.x402?.paymentPayload) return { present: true, type: "x402-payload" };
+  if (input.ap2?.triple.payment) return { present: true, type: "ap2-payment-mandate" };
   return void 0;
 }
 function runConstraintEval(input) {