@bankofai/x402-cli 1.0.1-beta.0 → 1.0.1-beta.10

package/dist/daemon.js

@@ -0,0 +1,47 @@
+import net from "node:net";
+import { spawn } from "node:child_process";
+import { setTimeout as delay } from "node:timers/promises";
+import { opt, outputMode } from "./args.js";
+import { emit } from "./output.js";
+function stripFlag(argv, flag) {
+    return argv.filter(item => item !== flag);
+}
+async function waitForPort(host, port, timeout = 5_000) {
+    const deadline = Date.now() + timeout;
+    while (Date.now() < deadline) {
+        const connected = await new Promise(resolve => {
+            const socket = net.createConnection({ host, port });
+            socket.setTimeout(250);
+            socket.once("connect", () => { socket.destroy(); resolve(true); });
+            socket.once("error", () => resolve(false));
+            socket.once("timeout", () => { socket.destroy(); resolve(false); });
+        });
+        if (connected)
+            return;
+        await delay(50);
+    }
+    throw new Error(`daemon did not become ready on ${host}:${port}`);
+}
+export async function startServeDaemon(argv, options, requirement, script) {
+    if (!requirement.payTo)
+        throw new Error("--pay-to is required");
+    const daemonArgs = stripFlag(stripFlag(argv, "--daemon"), "-d");
+    const child = spawn(process.execPath, [script, ...daemonArgs], { detached: true, stdio: "ignore", env: process.env });
+    child.unref();
+    const host = opt(options, "host", "127.0.0.1");
+    const port = Number(opt(options, "port", "4020"));
+    const resourceUrl = opt(options, "resource-url", `http://${host}:${port}/pay`);
+    try {
+        await waitForPort(host === "0.0.0.0" ? "127.0.0.1" : host === "::" ? "::1" : host, port);
+    }
+    catch (error) {
+        if (child.pid)
+            try {
+                process.kill(child.pid);
+            }
+            catch { /* child already exited */ }
+        throw error;
+    }
+    emit({ command: "server", mode: outputMode(options), network: requirement.network, scheme: requirement.scheme,
+        result: { pid: child.pid, pay_url: resourceUrl, resource_url: resourceUrl, daemon: true } });
+}

package/dist/gateway/catalog.js

@@ -0,0 +1,56 @@
+import { paymentRequirements, priceUsd } from "./config.js";
+function configs(input) {
+    return input instanceof Map ? [...input.values()].map(entry => entry.config) : [...input];
+}
+export function providerCatalogProjection(provider) {
+    return {
+        name: provider.name,
+        title: provider.title ?? provider.name,
+        description: "",
+        category: "other",
+        network: provider.operator.network,
+        currency: provider.operator.currencies?.usd?.[0] ?? "USDT",
+        endpoints: (provider.endpoints ?? []).map(endpoint => {
+            const price = priceUsd(endpoint);
+            const requirements = paymentRequirements(provider, price);
+            return {
+                method: endpoint.method.toUpperCase(),
+                path: `/providers/${provider.name}${endpoint.path}`,
+                upstream_path: endpoint.path,
+                description: "",
+                paid: price > 0 ? {
+                    scheme: requirements[0]?.scheme,
+                    network: requirements[0]?.network,
+                    currency: provider.operator.currencies?.usd?.[0] ?? "USDT",
+                    price_usd: price,
+                } : null,
+                x402_routes: requirements.map(requirement => ({
+                    provider: provider.name,
+                    network: requirement.network,
+                    scheme: requirement.scheme,
+                    ...(requirement.extra?.assetTransferMethod ? { assetTransferMethod: requirement.extra.assetTransferMethod } : {}),
+                    url: `/providers/${provider.name}${endpoint.path}`,
+                })),
+            };
+        }),
+    };
+}
+export function buildGatewayCatalog(input) {
+    return { version: 1, generatedAt: new Date().toISOString(), providers: configs(input).map(providerCatalogProjection) };
+}
+export function providerPaymentAssets(input) {
+    return configs(input).flatMap(provider => (provider.endpoints ?? []).flatMap(endpoint => {
+        const price = priceUsd(endpoint);
+        const currencies = provider.operator.currencies?.usd ?? ["USDT"];
+        return paymentRequirements(provider, price).map((requirement, index) => ({
+            provider: provider.name,
+            method: endpoint.method,
+            path: `/providers/${provider.name}${endpoint.path}`,
+            network: requirement.network,
+            currency: currencies[index % currencies.length],
+            price_usd: price,
+            scheme: requirement.scheme,
+            ...(requirement.extra?.assetTransferMethod ? { assetTransferMethod: requirement.extra.assetTransferMethod } : {}),
+        }));
+    }));
+}

package/dist/gateway/config.js

@@ -30,6 +30,11 @@ function assertHttpUrl(value, name) {
         const url = new URL(value);
         if (!["http:", "https:"].includes(url.protocol))
             throw new Error("unsupported protocol");
+        if (url.username || url.password || url.search || url.hash)
+            throw new Error("credentials, query, and fragment are not allowed");
+        if (url.protocol === "http:" && !["localhost", "127.0.0.1", "::1"].includes(url.hostname) && process.env.X402_GATEWAY_ALLOW_INSECURE_HTTP !== "true") {
+            throw new Error("remote HTTP is not allowed");
+        }
     }
     catch {
         throw new Error(`${name} must be a valid http(s) URL`);
@@ -80,6 +85,13 @@ function validateProvider(config, file) {
     if (authMethod && !["header", "query_param", "access_token", "oauth2"].includes(authMethod)) {
         throw new Error(`${file}: unsupported routing.auth.method ${authMethod}`);
     }
+    const auth = config.routing?.auth;
+    if (auth) {
+        if (!auth.value && !auth.value_from_env)
+            throw new Error(`${file}: routing.auth requires value or value_from_env`);
+        if (auth.value_from_env && !process.env[auth.value_from_env])
+            throw new Error(`${file}: environment variable ${auth.value_from_env} is not set`);
+    }
     if (!config.endpoints?.length)
         throw new Error(`${file}: endpoints must contain at least one endpoint`);
     const seen = new Set();
@@ -104,30 +116,83 @@ export function loadProvider(file) {
     validateProvider(config, file);
     config.operator.network = normalizeNetwork(config.operator.network);
     normalizePaymentProtocol(config, file);
+    validatePaymentCapabilities(config, file);
+    const facilitatorUrl = config.operator.facilitator_url ||
+        process.env.X402_FACILITATOR_URL ||
+        process.env.FACILITATOR_URL ||
+        "https://facilitator.bankofai.io";
+    assertHttpUrl(facilitatorUrl, `${file}: facilitator URL`);
+    const configuredApiKeyEnv = config.operator.facilitator_api_key_env;
+    if (configuredApiKeyEnv && !process.env[configuredApiKeyEnv]) {
+        throw new Error(`${file}: environment variable ${configuredApiKeyEnv} is not set`);
+    }
     return {
         config,
-        facilitatorUrl: config.operator.facilitator_url ||
-            process.env.X402_FACILITATOR_URL ||
-            process.env.FACILITATOR_URL ||
-            "https://facilitator.bankofai.io",
+        facilitatorUrl,
         facilitatorApiKey: config.operator.facilitator_api_key ||
-            (config.operator.facilitator_api_key_env
-                ? process.env[config.operator.facilitator_api_key_env]
+            (configuredApiKeyEnv
+                ? process.env[configuredApiKeyEnv]
                 : undefined) ||
             process.env.X402_FACILITATOR_API_KEY ||
             process.env.FACILITATOR_API_KEY,
     };
 }
 function normalizePaymentProtocol(config, file) {
-    const raw = String(config.operator.protocol || config.operator.scheme || "exact").toLowerCase();
-    const normalized = raw.replace(/[-:\s]/g, "_");
-    if (!["exact", "exact_permit", "permit2", "exact_permit2"].includes(normalized)) {
-        throw new Error(`${file}: unsupported x402 protocol ${raw}; use exact + permit2`);
+    if (config.operator.schemes !== undefined && (!Array.isArray(config.operator.schemes) || !config.operator.schemes.length)) {
+        throw new Error(`${file}: operator.schemes must be a non-empty string array`);
+    }
+    const rawSchemes = config.operator.schemes ?? [config.operator.protocol || config.operator.scheme || "exact"];
+    const schemes = [...new Set(rawSchemes.map(value => {
+            if (typeof value !== "string" || !value.trim())
+                throw new Error(`${file}: operator.schemes must contain non-empty strings`);
+            const raw = String(value).toLowerCase();
+            const normalized = raw.replace(/[-:\s]/g, "_");
+            if (!["exact", "exact_gasfree", "exact_permit", "permit2", "exact_permit2"].includes(normalized)) {
+                throw new Error(`${file}: unsupported x402 protocol ${raw}; use exact or exact_gasfree`);
+            }
+            return normalized === "exact_gasfree" ? "exact_gasfree" : "exact";
+        }))];
+    if (schemes.includes("exact_gasfree") && !config.operator.network.startsWith("tron:")) {
+        throw new Error(`${file}: exact_gasfree is supported only on TRON networks`);
+    }
+    config.operator.schemes = schemes;
+    config.operator.scheme = schemes[0];
+    config.operator.protocol = schemes[0];
+    if (schemes.includes("exact")) {
+        config.operator.asset_transfer_method = "permit2";
+        config.operator.assetTransferMethod = "permit2";
+    }
+    else {
+        delete config.operator.asset_transfer_method;
+        delete config.operator.assetTransferMethod;
+    }
+}
+function validatePaymentCapabilities(config, file) {
+    const symbols = config.operator.currencies?.usd ?? ["USDT"];
+    if (!Array.isArray(symbols) || !symbols.length || symbols.some(symbol => typeof symbol !== "string" || !symbol.trim())) {
+        throw new Error(`${file}: operator.currencies.usd must be a non-empty string array`);
+    }
+    if (new Set(symbols.map(symbol => symbol.toUpperCase())).size !== symbols.length)
+        throw new Error(`${file}: operator.currencies.usd must not contain duplicates`);
+    for (const symbol of symbols)
+        getToken(config.operator.network, symbol);
+    const recipient = config.recipients?.[config.operator.recipient]?.account ?? config.operator.recipient;
+    assertString(recipient, `${file}: resolved recipient`);
+    const validRecipient = config.operator.network.startsWith("tron:")
+        ? /^T[1-9A-HJ-NP-Za-km-z]{33}$/.test(recipient)
+        : /^0x[0-9a-fA-F]{40}$/.test(recipient);
+    if (!validRecipient)
+        throw new Error(`${file}: operator.recipient must be a valid address or a resolvable recipient alias`);
+    for (const endpoint of config.endpoints ?? []) {
+        if (!endpoint.metering)
+            continue;
+        const prices = [endpoint.metering.dimensions?.[0]?.tiers?.[0]?.price_usd,
+            ...(endpoint.metering.variants ?? []).map(variant => variant.dimensions?.[0]?.tiers?.[0]?.price_usd)]
+            .filter((price) => typeof price === "number" && price > 0);
+        for (const price of prices)
+            if (!paymentRequirements(config, price).length)
+                throw new Error(`${file}: paid endpoint cannot generate payment requirements`);
     }
-    config.operator.scheme = "exact";
-    config.operator.protocol = "exact";
-    config.operator.asset_transfer_method = "permit2";
-    config.operator.assetTransferMethod = "permit2";
 }
 export function loadProviders(providerPath) {
     const stat = fs.statSync(providerPath);
@@ -152,6 +217,8 @@ export function endpointFor(provider, method, routePath) {
     return provider.endpoints?.find(endpoint => endpoint.method.toUpperCase() === method.toUpperCase() && pathMatches(endpoint.path, routePath));
 }
 function pathMatches(template, routePath) {
+    if (!routePath.startsWith("/") || routePath.startsWith("//") || routePath.includes("\\") || routePath.includes("\0") || /%(?:2f|5c)/i.test(routePath))
+        return false;
     const templateParts = template.split("/").filter(Boolean);
     const routeParts = routePath.split("/").filter(Boolean);
     if (templateParts.length !== routeParts.length)
@@ -178,20 +245,23 @@ export function paymentRequirements(provider, price) {
     const network = normalizeNetwork(provider.operator.network);
     const symbols = provider.operator.currencies?.usd ?? ["USDT"];
     const payTo = provider.recipients?.[provider.operator.recipient]?.account ?? provider.operator.recipient;
-    return symbols.map(symbol => {
+    const schemes = provider.operator.schemes?.length
+        ? provider.operator.schemes.map(scheme => scheme === "exact_gasfree" ? "exact_gasfree" : "exact")
+        : [provider.operator.scheme === "exact_gasfree" ? "exact_gasfree" : "exact"];
+    return schemes.flatMap(scheme => symbols.map(symbol => {
         const token = getToken(network, symbol);
         const transferMethod = provider.operator.assetTransferMethod || provider.operator.asset_transfer_method || token.assetTransferMethod;
         const amount = toSmallestUnit(price, token.decimals);
         if (amount === "0")
             throw new Error(`positive price produced zero amount for ${symbol} on ${network}`);
         return {
-            scheme: "exact",
+            scheme,
             network,
             amount,
             asset: token.address,
             payTo,
             maxTimeoutSeconds: provider.operator.valid_for_seconds ?? 300,
-            extra: transferMethod === "permit2" ? { assetTransferMethod: "permit2" } : {},
+            extra: scheme === "exact" && transferMethod === "permit2" ? { assetTransferMethod: "permit2" } : {},
         };
-    });
+    }));
 }

package/dist/gateway/index.js

@@ -0,0 +1,3 @@
+export { endpointFor, loadProvider, loadProviders, paymentRequirements, priceUsd, } from "./config.js";
+export { getToken, normalizeNetwork, toSmallestUnit, TOKENS, } from "./tokens.js";
+export { buildGatewayCatalog, providerCatalogProjection, providerPaymentAssets } from "./catalog.js";