@astrasyncai/verification-gateway 5.14.0 → 5.15.0

package/dist/transport/index.mjs

@@ -437,6 +437,7 @@ function bufferToBase64(bytes) {
 }
 
 // src/transport/rfc9421-verify.ts
+import { createHash } from "crypto";
 import { httpbis } from "http-message-signatures";
 
 // src/transport/nonce-store.ts
@@ -508,6 +509,16 @@ async function verifyRFC9421(request, options) {
       normalizeRequest(request)
     );
     if (result === true) {
+      const digestError = checkContentDigest(request);
+      if (digestError) {
+        return {
+          ok: false,
+          kid: resolvedKid,
+          registry: resolver.name,
+          algorithm: resolvedAlg,
+          error: digestError
+        };
+      }
       return {
         ok: true,
         kid: resolvedKid,
@@ -532,6 +543,21 @@ async function verifyRFC9421(request, options) {
     };
   }
 }
+function checkContentDigest(request) {
+  if (request.body === void 0) return null;
+  const raw = Object.entries(request.headers).find(
+    ([k]) => k.toLowerCase() === "content-digest"
+  )?.[1];
+  if (!raw) return null;
+  const header = Array.isArray(raw) ? raw.join(", ") : raw;
+  const entries = [...header.matchAll(/(sha-256|sha-512)=:([A-Za-z0-9+/=]+):/g)];
+  if (entries.length === 0) return null;
+  for (const [, alg, value] of entries) {
+    const expected = createHash(alg === "sha-256" ? "sha256" : "sha512").update(request.body, "utf8").digest("base64");
+    if (expected !== value) return "content-digest does not match the body";
+  }
+  return null;
+}
 function normalizeRequest(request) {
   return {
     method: request.method.toUpperCase(),
@@ -633,7 +659,7 @@ async function getCrypto() {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.15.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -781,8 +807,9 @@ function extractBearer(authHeader) {
 function extractPaymentToken(body) {
   const paymentData = body.payment_data;
   if (!paymentData) return void 0;
-  const raw = coerceString3(paymentData.token);
-  const provider = coerceString3(paymentData.provider);
+  const instrument = paymentData.instrument;
+  const raw = coerceString3(instrument?.credential?.token) ?? coerceString3(paymentData.token);
+  const provider = coerceString3(paymentData.provider) ?? coerceString3(paymentData.handler_id);
   if (!raw) return { raw: void 0, type: null, provider };
   const type = classifyPaymentToken(raw);
   return { raw, type, provider };
@@ -825,7 +852,7 @@ function coerceString3(v) {
 
 // src/transport/vi.ts
 import { splitSdJwt, decodeSdJwtSync } from "@sd-jwt/core";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function extractVIClaims(sdJwtCompact) {
   if (!sdJwtCompact || typeof sdJwtCompact !== "string") return null;
   let decoded;
@@ -976,7 +1003,7 @@ function coerceNumber2(v) {
 }
 function sha256Sync(data) {
   const buf = typeof data === "string" ? Buffer.from(data, "utf-8") : Buffer.from(new Uint8Array(data));
-  const hash = createHash("sha256").update(buf).digest();
+  const hash = createHash2("sha256").update(buf).digest();
   return new Uint8Array(hash.buffer, hash.byteOffset, hash.byteLength);
 }
 
@@ -1218,7 +1245,7 @@ var claim = {
 
 // src/transport/ap2.ts
 import { decodeSdJwtSync as decodeSdJwtSync2 } from "@sd-jwt/core";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 function extractAP2Mandate(sdJwtCompact) {
   if (!sdJwtCompact || typeof sdJwtCompact !== "string") return null;
   let decoded;
@@ -1358,7 +1385,7 @@ function coerceStringOrNumber(v) {
 }
 function sha256Sync2(data) {
   const buf = typeof data === "string" ? Buffer.from(data, "utf-8") : Buffer.from(new Uint8Array(data));
-  const hash = createHash2("sha256").update(buf).digest();
+  const hash = createHash3("sha256").update(buf).digest();
   return new Uint8Array(hash.buffer, hash.byteOffset, hash.byteLength);
 }
 
@@ -1645,8 +1672,10 @@ async function getSubtle() {
 // src/transport/mpp.ts
 import { Challenge, Credential, Receipt } from "mppx";
 function extractMPPFromRequest(request) {
-  const auth = readHeader3(request.headers, "authorization");
-  if (!auth || !/^\s*Payment\s+/i.test(auth)) return null;
+  const alt = readHeader3(request.headers, "payment-authorization");
+  const authHeader = readHeader3(request.headers, "authorization");
+  const auth = authHeader && /^\s*Payment\s+/i.test(authHeader) ? authHeader : alt ? /^\s*Payment\s+/i.test(alt) ? alt : `Payment ${alt.trim()}` : void 0;
+  if (!auth) return null;
   try {
     const credential = Credential.deserialize(auth);
     return {
@@ -1836,6 +1865,16 @@ import {
 } from "@x402/core/schemas";
 import { safeBase64Decode } from "@x402/core/utils";
 function extractX402FromRequest(request) {
+  const v2Header = readHeader4(request.headers, "payment-signature");
+  if (v2Header) {
+    try {
+      const decoded = safeBase64Decode(v2Header);
+      const parsed = decoded ? tryParsePayload(JSON.parse(decoded)) : null;
+      if (parsed) return buildPayloadContext(parsed, "header");
+    } catch {
+    }
+    return { kind: "error", version: 2, source: "header", error: { type: "invalid-x402-payload" } };
+  }
   const headerValue = readHeader4(request.headers, "x-payment");
   if (request.body && typeof request.body === "object") {
     const parsed = tryParsePayload(request.body);
@@ -1862,6 +1901,21 @@ function extractX402FromRequest(request) {
 }
 function extractX402FromResponse(response) {
   if (response.status !== 402) return null;
+  const v2Header = readHeader4(response.headers, "payment-required");
+  if (v2Header) {
+    try {
+      const decoded = safeBase64Decode(v2Header);
+      const parsed = decoded ? tryParseRequired(JSON.parse(decoded)) : null;
+      if (parsed) return buildRequiredContext(parsed, "header");
+    } catch {
+    }
+    return {
+      kind: "error",
+      version: 2,
+      source: "header",
+      error: { type: "invalid-x402-required" }
+    };
+  }
   if (response.body && typeof response.body === "object") {
     const parsed = tryParseRequired(response.body);
     if (parsed) return buildRequiredContext(parsed, "body");
@@ -1979,7 +2033,7 @@ function readHeader4(headers, name) {
 }
 
 // src/transport/vi-verify.ts
-import { createHash as createHash3, webcrypto } from "crypto";
+import { createHash as createHash4, webcrypto } from "crypto";
 async function verifyVIChain(input) {
   const errors = [];
   const tolerance = input.clockSkewSec ?? 60;
@@ -2120,7 +2174,7 @@ function computeCheckoutHashFromL2(l2) {
   const checkoutDisclosure = l2.payload.checkout ?? l2.payload.checkout_mandate;
   if (!checkoutDisclosure) return null;
   const canonical = canonicalStringify(checkoutDisclosure);
-  const hash = createHash3("sha256").update(canonical).digest("base64url").replace(/=+$/, "");
+  const hash = createHash4("sha256").update(canonical).digest("base64url").replace(/=+$/, "");
   return hash;
 }
 function canonicalStringify(value) {
@@ -2375,6 +2429,8 @@ function resolvePaymentToken(input) {
   const mppMethod = input.mpp?.context.credential?.challenge?.method;
   if (mppMethod === "tempo") return { present: true, type: "tempo-tx" };
   if (mppMethod === "stripe") return { present: true, type: "stripe-spt" };
+  if (input.x402?.paymentPayload) return { present: true, type: "x402-payload" };
+  if (input.ap2?.triple.payment) return { present: true, type: "ap2-payment-mandate" };
   return void 0;
 }
 function runConstraintEval(input) {