@bankofai/x402-cli 1.0.0-beta.4 → 1.0.0-beta.5

package/dist/cli.js

@@ -8,9 +8,9 @@ import { spawn } from "node:child_process";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import YAML from "yaml";
-import { createPaymentPayload, decodeRequired, decodeResponse, encodeRequired, encodeResponse, encodeSignature, headers } from "./x402.js";
-import { findTokenByAddress, getToken, normalizeNetwork, toSmallestUnit } from "./tokens.js";
-const BOOLEAN_FLAGS = new Set(["daemon", "dry-run", "help", "human", "include-blocked", "json", "version"]);
+import { createPaymentPayload, decodeRequired, decodeResponse, decodeSignature, encodeRequired, encodeResponse, encodeSignature, headers } from "./x402.js";
+import { assertRawAmount, findTokenByAddress, getToken, normalizeNetwork, toSmallestUnit } from "./tokens.js";
+const BOOLEAN_FLAGS = new Set(["daemon", "dry-run", "force", "help", "human", "include-blocked", "json", "version"]);
 const require = createRequire(import.meta.url);
 function parseArgs(argv) {
     const [command = "help", ...rest] = argv;
@@ -55,7 +55,7 @@ function parseArgs(argv) {
         else if (BOOLEAN_FLAGS.has(key)) {
             options[key] = true;
         }
-        else if (!next || next.startsWith("-")) {
+        else if (!next || next.startsWith("--")) {
             options[key] = true;
         }
         else {
@@ -344,7 +344,11 @@ function readYaml(file) {
     return YAML.parse(fs.readFileSync(file, "utf8"));
 }
 function expandEnv(value) {
-    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? "");
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => {
+        if (!(name in process.env))
+            throw new Error(`environment variable \${${name}} is not set`);
+        return process.env[name] ?? "";
+    });
 }
 function expandDeep(value) {
     if (typeof value === "string")
@@ -386,6 +390,14 @@ function validateProvider(provider, file = "provider.yml") {
         if (typeof value !== "string" || !value.trim())
             throw new Error(`${file}: ${name} is required`);
     }
+    try {
+        const url = new URL(provider.forward_url);
+        if (!["http:", "https:"].includes(url.protocol))
+            throw new Error("unsupported protocol");
+    }
+    catch {
+        throw new Error(`${file}: forward_url must be a valid http(s) URL`);
+    }
     if (!Array.isArray(provider.endpoints) || !provider.endpoints.length) {
         throw new Error(`${file}: endpoints must contain at least one endpoint`);
     }
@@ -394,6 +406,12 @@ function validateProvider(provider, file = "provider.yml") {
         if (typeof endpoint.method !== "string" || typeof endpoint.path !== "string") {
             throw new Error(`${file}: each endpoint needs method and path`);
         }
+        if (!endpoint.method.trim() || !endpoint.path.trim() || !endpoint.path.startsWith("/")) {
+            throw new Error(`${file}: endpoint method/path must be non-empty and path must start with /`);
+        }
+        const price = providerPrice(endpoint);
+        if (!Number.isFinite(price) || price < 0)
+            throw new Error(`${file}: endpoint price_usd must be a finite number >= 0`);
         const key = `${endpoint.method.toUpperCase()} ${endpoint.path}`;
         if (seen.has(key))
             throw new Error(`${file}: duplicate endpoint ${key}`);
@@ -568,11 +586,42 @@ function cachedCatalogPath() {
 function providerFilename(fqn) {
     return `${fqn.replace(/\//g, "__")}.json`;
 }
+function sanitizeProviderName(name) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(name) || name.includes("..")) {
+        throw new Error("provider name must be a safe FQN using letters, numbers, dots, underscores, dashes, or slashes");
+    }
+    return name;
+}
+function safeOutputPath(baseDir, ...parts) {
+    const root = path.resolve(baseDir);
+    const target = path.resolve(root, ...parts);
+    if (target !== root && !target.startsWith(`${root}${path.sep}`)) {
+        throw new Error(`refusing to write outside output directory: ${target}`);
+    }
+    return target;
+}
+function ensureWritable(file, options) {
+    if (fs.existsSync(file) && !hasFlag(options, "force")) {
+        throw new Error(`${file} already exists; pass --force to overwrite`);
+    }
+}
 function defaultCatalogSource() {
+    const envSource = process.env.X402_CATALOG || process.env.X402_GATEWAY_CATALOG;
+    if (envSource)
+        return envSource;
     return fs.existsSync(cachedCatalogPath())
         ? cachedCatalogPath()
         : "https://x402-catalog.bankofai.io/api/catalog.json";
 }
+function positiveIntegerOption(options, key, fallback) {
+    const value = opt(options, key, String(fallback));
+    if (!/^\d+$/.test(value))
+        throw new Error(`--${key} must be a positive integer`);
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0)
+        throw new Error(`--${key} must be a positive integer`);
+    return parsed;
+}
 function remoteBaseFromCatalogPayload(payload) {
     const base = payload.base_url ?? payload.baseUrl;
     return typeof base === "string" && /^https?:\/\//.test(base) ? `${base.replace(/\/+$/, "")}/` : undefined;
@@ -599,7 +648,7 @@ function catalogDetailSource(source, section, name) {
             : base.pathname.endsWith("/")
                 ? base.pathname
                 : `${base.pathname}/`;
-        base.pathname = `${pathname}${section}/${name}.json`;
+        base.pathname = `${pathname}${section}/${providerFilename(name)}`;
         base.search = "";
         base.hash = "";
         return base.toString();
@@ -616,8 +665,6 @@ async function readCatalogProvider(source, name) {
     const summary = providers.find((item) => item.name === name || item.fqn === name);
     if (!summary)
         throw new Error(`provider not found: ${name}`);
-    if (Array.isArray(summary.endpoints) && summary.endpoints.length)
-        return summary;
     const fqn = summary.fqn ?? summary.name ?? name;
     try {
         return await readJson(catalogDetailSource(source, "providers", fqn));
@@ -764,12 +811,18 @@ async function catalogExportGateway(gatewayUrl, options) {
     const providerFqn = opt(options, "provider");
     if (!providerFqn)
         throw new Error("--provider is required");
+    sanitizeProviderName(providerFqn);
     const base = gatewayUrl.replace(/\/+$/, "");
-    const detail = await readJson(`${base}/__402/catalog/providers/${providerFqn}.json`);
-    const target = opt(options, "output-dir", path.join("providers", providerFqn));
+    const detail = await readJson(`${base}/__402/catalog/providers/${providerFilename(providerFqn)}`);
+    const outputRoot = opt(options, "output-dir", "providers");
+    const target = opt(options, "output-dir")
+        ? path.resolve(outputRoot)
+        : safeOutputPath("providers", providerFilename(providerFqn).replace(/\.json$/, ""));
     fs.mkdirSync(target, { recursive: true });
     const catalogPath = path.join(target, "catalog.json");
     const payMdPath = path.join(target, "pay.md");
+    ensureWritable(catalogPath, options);
+    ensureWritable(payMdPath, options);
     writeJson(catalogPath, submissionCatalog(detail));
     fs.writeFileSync(payMdPath, payMarkdownFromDetail(detail));
     emit({ command: "catalog export-gateway", mode: outputMode(options), result: { provider: providerFqn, catalog: catalogPath, payMd: payMdPath } });
@@ -790,7 +843,11 @@ function buildRequirement(options) {
     const decimals = decimalsOption !== undefined ? Number(decimalsOption) : registryToken.decimals;
     if (!Number.isInteger(decimals) || decimals < 0)
         throw new Error("--decimals must be a non-negative integer");
-    const amount = opt(options, "rawAmount") ?? toSmallestUnit(opt(options, "amount", "0.0001"), decimals);
+    const rawAmount = opt(options, "rawAmount") ?? opt(options, "raw-amount");
+    const humanAmount = opt(options, "amount");
+    if (rawAmount && humanAmount)
+        throw new Error("--amount and --rawAmount are mutually exclusive");
+    const amount = rawAmount ? assertRawAmount(rawAmount, "--rawAmount") : toSmallestUnit(humanAmount ?? "0.0001", decimals);
     const assetAddress = explicitAsset ?? registryToken.address;
     const assetTransferMethod = registryToken?.assetTransferMethod ?? "permit2";
     return {
@@ -829,6 +886,9 @@ function stripFlag(argv, flag) {
     return argv.filter(item => item !== flag);
 }
 function serveDaemon(argv, options) {
+    const requirement = buildRequirement(options);
+    if (!requirement.payTo)
+        throw new Error("--pay-to is required");
     const daemonArgs = stripFlag(stripFlag(argv, "--daemon"), "-d");
     const script = fileURLToPath(import.meta.url);
     const child = spawn(process.execPath, [script, ...daemonArgs], {
@@ -843,7 +903,7 @@ function serveDaemon(argv, options) {
     emit({
         command: "server",
         mode: outputMode(options),
-        network: normalizeNetwork(opt(options, "network", "tron:nile")),
+        network: requirement.network,
         scheme: "exact",
         result: {
             pid: child.pid,
@@ -856,7 +916,7 @@ function serveDaemon(argv, options) {
 function validateAmountLimits(selected, options) {
     const maxRaw = opt(options, "max-rawAmount") ?? opt(options, "max-raw-amount");
     const maxAmount = opt(options, "max-amount");
-    if (maxRaw && BigInt(selected.amount) > BigInt(maxRaw)) {
+    if (maxRaw && BigInt(selected.amount) > BigInt(assertRawAmount(maxRaw, "--max-rawAmount"))) {
         throw new Error(`payment raw amount ${selected.amount} exceeds --max-rawAmount ${maxRaw}`);
     }
     if (maxAmount) {
@@ -889,17 +949,18 @@ async function serve(options) {
     };
     const server = http.createServer(async (request, response) => {
         try {
-            if (request.url?.startsWith("/health")) {
+            const pathname = new URL(request.url ?? "/", `http://${host}:${port}`).pathname;
+            if (pathname === "/health") {
                 response.writeHead(200, { "content-type": "application/json" });
                 response.end(JSON.stringify({ ok: true }));
                 return;
             }
-            if (request.url?.startsWith("/.well-known/x402")) {
+            if (pathname === "/.well-known/x402") {
                 response.writeHead(200, { "content-type": "application/json" });
-                response.end(JSON.stringify({ network: requirement.network, scheme: "exact", asset: requirement.asset, amount: requirement.amount, payTo: requirement.payTo, pay_url: resourceUrl }));
+                response.end(JSON.stringify({ network: requirement.network, scheme: "exact", asset: requirement.asset, rawAmount: requirement.amount, amount: requirement.amount, payTo: requirement.payTo, pay_url: resourceUrl }));
                 return;
             }
-            if (!request.url?.startsWith("/pay")) {
+            if (pathname !== "/pay") {
                 response.writeHead(404).end("not found");
                 return;
             }
@@ -912,22 +973,33 @@ async function serve(options) {
                 response.end(JSON.stringify(challenge));
                 return;
             }
-            const payload = Buffer.from(signature, "base64").toString("utf8").startsWith("{")
-                ? JSON.parse(Buffer.from(signature, "base64").toString("utf8"))
-                : signature;
+            let payload;
+            try {
+                payload = decodeSignature(signature);
+            }
+            catch {
+                response.writeHead(400, { "content-type": "application/json" });
+                response.end(JSON.stringify({ error: "invalid payment signature" }));
+                return;
+            }
             const verify = await facilitatorPost(facilitatorUrl, "/verify", {
                 paymentPayload: payload,
                 paymentRequirements: requirement,
             });
-            if (verify?.valid === false || verify?.isValid === false) {
+            if (!(verify?.valid === true || verify?.isValid === true)) {
                 response.writeHead(400, { "content-type": "application/json" });
-                response.end(JSON.stringify({ error: "payment verification failed", verify }));
+                response.end(JSON.stringify({ error: "payment verification failed" }));
                 return;
             }
             const settle = await facilitatorPost(facilitatorUrl, "/settle", {
                 paymentPayload: payload,
                 paymentRequirements: requirement,
             });
+            if (!(settle?.success === true || settle?.settled === true || typeof settle?.transaction === "string" || typeof settle?.txHash === "string")) {
+                response.writeHead(502, { "content-type": "application/json" });
+                response.end(JSON.stringify({ error: "settlement failed" }));
+                return;
+            }
             response.writeHead(200, {
                 "content-type": "application/json",
                 [headers.response]: encodeResponse(settle),
@@ -939,13 +1011,18 @@ async function serve(options) {
             response.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
         }
     });
-    server.listen(port, host, () => {
-        emit({
-            command: "server",
-            network: requirement.network,
-            scheme: "exact",
-            mode: outputMode(options),
-            result: { pay_url: resourceUrl, token: opt(options, "token", "USDT"), rawAmount: requirement.amount, pay_to: requirement.payTo },
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            emit({
+                command: "server",
+                network: requirement.network,
+                scheme: "exact",
+                mode: outputMode(options),
+                result: { pay_url: resourceUrl, token: opt(options, "token", "USDT"), rawAmount: requirement.amount, pay_to: requirement.payTo },
+            });
+            resolve();
         });
     });
 }
@@ -1025,7 +1102,7 @@ async function pay(url, options) {
     const paid = await fetch(url, {
         method,
         headers: retryHeaders,
-        body: opt(options, "body"),
+        body: ["GET", "HEAD"].includes(method.toUpperCase()) ? undefined : opt(options, "body"),
     });
     const body = await responsePayload(paid);
     const paymentResponse = paid.headers.get(headers.response);
@@ -1281,7 +1358,7 @@ async function searchCatalog(source, query, options) {
     }
     return hits
         .sort((a, b) => b.score - a.score || a.fqn.localeCompare(b.fqn))
-        .slice(0, Number(opt(options, "limit", "10")));
+        .slice(0, positiveIntegerOption(options, "limit", 10));
 }
 function searchHitToJson(hit) {
     return {

package/dist/tokens.js

@@ -92,8 +92,19 @@ export function findTokenByAddress(network, address) {
     const lower = address.toLowerCase();
     return Object.values(TOKENS[normalizeNetwork(network)] ?? {}).find(token => token.address.toLowerCase() === lower);
 }
+export function assertRawAmount(value, name = "raw amount") {
+    if (!/^\d+$/.test(value))
+        throw new Error(`${name} must be a non-negative integer string`);
+    return value.replace(/^0+(?=\d)/, "");
+}
 export function toSmallestUnit(amount, decimals) {
+    if (!Number.isInteger(decimals) || decimals < 0)
+        throw new Error("token decimals must be a non-negative integer");
+    if (!/^\d+(\.\d+)?$/.test(amount))
+        throw new Error("amount must be a non-negative decimal string");
     const [whole, fraction = ""] = amount.split(".");
+    if (fraction.length > decimals)
+        throw new Error(`amount has more than ${decimals} decimal places`);
     const padded = (fraction + "0".repeat(decimals)).slice(0, decimals);
-    return (BigInt(whole || "0") * 10n ** BigInt(decimals) + BigInt(padded || "0")).toString();
+    return assertRawAmount((BigInt(whole || "0") * 10n ** BigInt(decimals) + BigInt(padded || "0")).toString());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bankofai/x402-cli",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.5",
   "type": "module",
   "files": [
     "dist"
@@ -22,9 +22,10 @@
   "dependencies": {
     "@bankofai/x402-core": "1.0.0",
     "@bankofai/x402-evm": "1.0.0",
+    "@bankofai/x402-gateway": "^1.0.0-beta.1",
     "@bankofai/x402-tron": "1.0.0",
-    "tronweb": "^6.0.4",
-    "viem": "^2.40.3",
+    "tronweb": "6.0.2",
+    "viem": "^2.55.0",
     "yaml": "^2.8.2"
   },
   "devDependencies": {