@bankofai/x402-cli 1.0.1-beta.1 → 1.0.1-beta.10

package/dist/daemon.js

@@ -0,0 +1,47 @@
+import net from "node:net";
+import { spawn } from "node:child_process";
+import { setTimeout as delay } from "node:timers/promises";
+import { opt, outputMode } from "./args.js";
+import { emit } from "./output.js";
+function stripFlag(argv, flag) {
+    return argv.filter(item => item !== flag);
+}
+async function waitForPort(host, port, timeout = 5_000) {
+    const deadline = Date.now() + timeout;
+    while (Date.now() < deadline) {
+        const connected = await new Promise(resolve => {
+            const socket = net.createConnection({ host, port });
+            socket.setTimeout(250);
+            socket.once("connect", () => { socket.destroy(); resolve(true); });
+            socket.once("error", () => resolve(false));
+            socket.once("timeout", () => { socket.destroy(); resolve(false); });
+        });
+        if (connected)
+            return;
+        await delay(50);
+    }
+    throw new Error(`daemon did not become ready on ${host}:${port}`);
+}
+export async function startServeDaemon(argv, options, requirement, script) {
+    if (!requirement.payTo)
+        throw new Error("--pay-to is required");
+    const daemonArgs = stripFlag(stripFlag(argv, "--daemon"), "-d");
+    const child = spawn(process.execPath, [script, ...daemonArgs], { detached: true, stdio: "ignore", env: process.env });
+    child.unref();
+    const host = opt(options, "host", "127.0.0.1");
+    const port = Number(opt(options, "port", "4020"));
+    const resourceUrl = opt(options, "resource-url", `http://${host}:${port}/pay`);
+    try {
+        await waitForPort(host === "0.0.0.0" ? "127.0.0.1" : host === "::" ? "::1" : host, port);
+    }
+    catch (error) {
+        if (child.pid)
+            try {
+                process.kill(child.pid);
+            }
+            catch { /* child already exited */ }
+        throw error;
+    }
+    emit({ command: "server", mode: outputMode(options), network: requirement.network, scheme: requirement.scheme,
+        result: { pid: child.pid, pay_url: resourceUrl, resource_url: resourceUrl, daemon: true } });
+}

package/dist/gateway/catalog.js

@@ -0,0 +1,56 @@
+import { paymentRequirements, priceUsd } from "./config.js";
+function configs(input) {
+    return input instanceof Map ? [...input.values()].map(entry => entry.config) : [...input];
+}
+export function providerCatalogProjection(provider) {
+    return {
+        name: provider.name,
+        title: provider.title ?? provider.name,
+        description: "",
+        category: "other",
+        network: provider.operator.network,
+        currency: provider.operator.currencies?.usd?.[0] ?? "USDT",
+        endpoints: (provider.endpoints ?? []).map(endpoint => {
+            const price = priceUsd(endpoint);
+            const requirements = paymentRequirements(provider, price);
+            return {
+                method: endpoint.method.toUpperCase(),
+                path: `/providers/${provider.name}${endpoint.path}`,
+                upstream_path: endpoint.path,
+                description: "",
+                paid: price > 0 ? {
+                    scheme: requirements[0]?.scheme,
+                    network: requirements[0]?.network,
+                    currency: provider.operator.currencies?.usd?.[0] ?? "USDT",
+                    price_usd: price,
+                } : null,
+                x402_routes: requirements.map(requirement => ({
+                    provider: provider.name,
+                    network: requirement.network,
+                    scheme: requirement.scheme,
+                    ...(requirement.extra?.assetTransferMethod ? { assetTransferMethod: requirement.extra.assetTransferMethod } : {}),
+                    url: `/providers/${provider.name}${endpoint.path}`,
+                })),
+            };
+        }),
+    };
+}
+export function buildGatewayCatalog(input) {
+    return { version: 1, generatedAt: new Date().toISOString(), providers: configs(input).map(providerCatalogProjection) };
+}
+export function providerPaymentAssets(input) {
+    return configs(input).flatMap(provider => (provider.endpoints ?? []).flatMap(endpoint => {
+        const price = priceUsd(endpoint);
+        const currencies = provider.operator.currencies?.usd ?? ["USDT"];
+        return paymentRequirements(provider, price).map((requirement, index) => ({
+            provider: provider.name,
+            method: endpoint.method,
+            path: `/providers/${provider.name}${endpoint.path}`,
+            network: requirement.network,
+            currency: currencies[index % currencies.length],
+            price_usd: price,
+            scheme: requirement.scheme,
+            ...(requirement.extra?.assetTransferMethod ? { assetTransferMethod: requirement.extra.assetTransferMethod } : {}),
+        }));
+    }));
+}

package/dist/gateway/config.js

@@ -30,6 +30,11 @@ function assertHttpUrl(value, name) {
         const url = new URL(value);
         if (!["http:", "https:"].includes(url.protocol))
             throw new Error("unsupported protocol");
+        if (url.username || url.password || url.search || url.hash)
+            throw new Error("credentials, query, and fragment are not allowed");
+        if (url.protocol === "http:" && !["localhost", "127.0.0.1", "::1"].includes(url.hostname) && process.env.X402_GATEWAY_ALLOW_INSECURE_HTTP !== "true") {
+            throw new Error("remote HTTP is not allowed");
+        }
     }
     catch {
         throw new Error(`${name} must be a valid http(s) URL`);
@@ -80,6 +85,13 @@ function validateProvider(config, file) {
     if (authMethod && !["header", "query_param", "access_token", "oauth2"].includes(authMethod)) {
         throw new Error(`${file}: unsupported routing.auth.method ${authMethod}`);
     }
+    const auth = config.routing?.auth;
+    if (auth) {
+        if (!auth.value && !auth.value_from_env)
+            throw new Error(`${file}: routing.auth requires value or value_from_env`);
+        if (auth.value_from_env && !process.env[auth.value_from_env])
+            throw new Error(`${file}: environment variable ${auth.value_from_env} is not set`);
+    }
     if (!config.endpoints?.length)
         throw new Error(`${file}: endpoints must contain at least one endpoint`);
     const seen = new Set();
@@ -104,25 +116,35 @@ export function loadProvider(file) {
     validateProvider(config, file);
     config.operator.network = normalizeNetwork(config.operator.network);
     normalizePaymentProtocol(config, file);
+    validatePaymentCapabilities(config, file);
+    const facilitatorUrl = config.operator.facilitator_url ||
+        process.env.X402_FACILITATOR_URL ||
+        process.env.FACILITATOR_URL ||
+        "https://facilitator.bankofai.io";
+    assertHttpUrl(facilitatorUrl, `${file}: facilitator URL`);
+    const configuredApiKeyEnv = config.operator.facilitator_api_key_env;
+    if (configuredApiKeyEnv && !process.env[configuredApiKeyEnv]) {
+        throw new Error(`${file}: environment variable ${configuredApiKeyEnv} is not set`);
+    }
     return {
         config,
-        facilitatorUrl: config.operator.facilitator_url ||
-            process.env.X402_FACILITATOR_URL ||
-            process.env.FACILITATOR_URL ||
-            "https://facilitator.bankofai.io",
+        facilitatorUrl,
         facilitatorApiKey: config.operator.facilitator_api_key ||
-            (config.operator.facilitator_api_key_env
-                ? process.env[config.operator.facilitator_api_key_env]
+            (configuredApiKeyEnv
+                ? process.env[configuredApiKeyEnv]
                 : undefined) ||
             process.env.X402_FACILITATOR_API_KEY ||
             process.env.FACILITATOR_API_KEY,
     };
 }
 function normalizePaymentProtocol(config, file) {
-    const rawSchemes = config.operator.schemes?.length
-        ? config.operator.schemes
-        : [config.operator.protocol || config.operator.scheme || "exact"];
+    if (config.operator.schemes !== undefined && (!Array.isArray(config.operator.schemes) || !config.operator.schemes.length)) {
+        throw new Error(`${file}: operator.schemes must be a non-empty string array`);
+    }
+    const rawSchemes = config.operator.schemes ?? [config.operator.protocol || config.operator.scheme || "exact"];
     const schemes = [...new Set(rawSchemes.map(value => {
+            if (typeof value !== "string" || !value.trim())
+                throw new Error(`${file}: operator.schemes must contain non-empty strings`);
             const raw = String(value).toLowerCase();
             const normalized = raw.replace(/[-:\s]/g, "_");
             if (!["exact", "exact_gasfree", "exact_permit", "permit2", "exact_permit2"].includes(normalized)) {
@@ -145,6 +167,33 @@ function normalizePaymentProtocol(config, file) {
         delete config.operator.assetTransferMethod;
     }
 }
+function validatePaymentCapabilities(config, file) {
+    const symbols = config.operator.currencies?.usd ?? ["USDT"];
+    if (!Array.isArray(symbols) || !symbols.length || symbols.some(symbol => typeof symbol !== "string" || !symbol.trim())) {
+        throw new Error(`${file}: operator.currencies.usd must be a non-empty string array`);
+    }
+    if (new Set(symbols.map(symbol => symbol.toUpperCase())).size !== symbols.length)
+        throw new Error(`${file}: operator.currencies.usd must not contain duplicates`);
+    for (const symbol of symbols)
+        getToken(config.operator.network, symbol);
+    const recipient = config.recipients?.[config.operator.recipient]?.account ?? config.operator.recipient;
+    assertString(recipient, `${file}: resolved recipient`);
+    const validRecipient = config.operator.network.startsWith("tron:")
+        ? /^T[1-9A-HJ-NP-Za-km-z]{33}$/.test(recipient)
+        : /^0x[0-9a-fA-F]{40}$/.test(recipient);
+    if (!validRecipient)
+        throw new Error(`${file}: operator.recipient must be a valid address or a resolvable recipient alias`);
+    for (const endpoint of config.endpoints ?? []) {
+        if (!endpoint.metering)
+            continue;
+        const prices = [endpoint.metering.dimensions?.[0]?.tiers?.[0]?.price_usd,
+            ...(endpoint.metering.variants ?? []).map(variant => variant.dimensions?.[0]?.tiers?.[0]?.price_usd)]
+            .filter((price) => typeof price === "number" && price > 0);
+        for (const price of prices)
+            if (!paymentRequirements(config, price).length)
+                throw new Error(`${file}: paid endpoint cannot generate payment requirements`);
+    }
+}
 export function loadProviders(providerPath) {
     const stat = fs.statSync(providerPath);
     const files = stat.isDirectory()
@@ -168,6 +217,8 @@ export function endpointFor(provider, method, routePath) {
     return provider.endpoints?.find(endpoint => endpoint.method.toUpperCase() === method.toUpperCase() && pathMatches(endpoint.path, routePath));
 }
 function pathMatches(template, routePath) {
+    if (!routePath.startsWith("/") || routePath.startsWith("//") || routePath.includes("\\") || routePath.includes("\0") || /%(?:2f|5c)/i.test(routePath))
+        return false;
     const templateParts = template.split("/").filter(Boolean);
     const routeParts = routePath.split("/").filter(Boolean);
     if (templateParts.length !== routeParts.length)

package/dist/gateway/index.js

@@ -0,0 +1,3 @@
+export { endpointFor, loadProvider, loadProviders, paymentRequirements, priceUsd, } from "./config.js";
+export { getToken, normalizeNetwork, toSmallestUnit, TOKENS, } from "./tokens.js";
+export { buildGatewayCatalog, providerCatalogProjection, providerPaymentAssets } from "./catalog.js";

package/dist/gateway/server.js

@@ -1,14 +1,17 @@
 import http from "node:http";
+import { timingSafeEqual } from "node:crypto";
 import { URL } from "node:url";
 import { endpointFor, paymentRequirements, priceUsd } from "./config.js";
 import { decodeSignature, encodeRequired, encodeResponse, headers, matchRequirement } from "./x402.js";
 class HttpError extends Error {
     status;
     publicMessage;
-    constructor(status, publicMessage, message = publicMessage) {
+    responseHeaders;
+    constructor(status, publicMessage, message = publicMessage, responseHeaders = {}) {
         super(message);
         this.status = status;
         this.publicMessage = publicMessage;
+        this.responseHeaders = responseHeaders;
     }
 }
 class RequestTooLargeError extends HttpError {
@@ -16,9 +19,23 @@ class RequestTooLargeError extends HttpError {
         super(413, "request body too large");
     }
 }
-const MAX_BODY_BYTES = Number(process.env.X402_GATEWAY_MAX_BODY_BYTES ?? 1_000_000);
-const FACILITATOR_TIMEOUT_MS = Number(process.env.X402_GATEWAY_FACILITATOR_TIMEOUT_MS ?? 10_000);
-const UPSTREAM_TIMEOUT_MS = Number(process.env.X402_GATEWAY_UPSTREAM_TIMEOUT_MS ?? 30_000);
+function positiveIntegerEnv(name, fallback) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === "")
+        return fallback;
+    if (!/^\d+$/.test(raw))
+        throw new Error(`${name} must be a positive integer`);
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value <= 0 || value > 2_147_483_647)
+        throw new Error(`${name} must be an integer between 1 and 2147483647`);
+    return value;
+}
+const MAX_BODY_BYTES = positiveIntegerEnv("X402_GATEWAY_MAX_BODY_BYTES", 1_000_000);
+const FACILITATOR_TIMEOUT_MS = positiveIntegerEnv("X402_GATEWAY_FACILITATOR_TIMEOUT_MS", 10_000);
+const UPSTREAM_TIMEOUT_MS = positiveIntegerEnv("X402_GATEWAY_UPSTREAM_TIMEOUT_MS", 30_000);
+const MAX_RESPONSE_BYTES = positiveIntegerEnv("X402_GATEWAY_MAX_RESPONSE_BYTES", 10_000_000);
+const MAX_CONCURRENT_REQUESTS = positiveIntegerEnv("X402_GATEWAY_MAX_CONCURRENT_REQUESTS", 100);
+const RATE_LIMIT_PER_MINUTE = positiveIntegerEnv("X402_GATEWAY_RATE_LIMIT_PER_MINUTE", 300);
 const STRIP_REQUEST_HEADERS = new Set([
     "host",
     "connection",
@@ -36,6 +53,8 @@ const STRIP_REQUEST_HEADERS = new Set([
     "payment-signature",
     "payment-required",
     "x-payment-required",
+    "payment-response",
+    "x-payment-response",
     "accept-encoding",
 ]);
 const STRIP_RESPONSE_HEADERS = new Set([
@@ -46,14 +65,23 @@ const STRIP_RESPONSE_HEADERS = new Set([
     "authorization",
     "proxy-authorization",
     "set-cookie",
+    "payment-required",
+    "x-payment-required",
+    "payment-signature",
+    "x-payment",
+    "payment-response",
+    "x-payment-response",
 ]);
-const metrics = {
-    requests: 0,
-    paidRequests: 0,
-    verifyFailures: 0,
-    settleFailures: 0,
-    upstreamFailures: 0,
-};
+function createMetrics() {
+    return {
+        requests: 0,
+        paidRequests: 0,
+        verifyFailures: 0,
+        settleFailures: 0,
+        upstreamFailures: 0,
+        rejectedRequests: 0,
+    };
+}
 async function readBody(request) {
     const chunks = [];
     let total = 0;
@@ -67,17 +95,20 @@ async function readBody(request) {
     return Buffer.concat(chunks);
 }
 function json(response, status, body, extraHeaders = {}) {
-    response.writeHead(status, { "content-type": "application/json", ...extraHeaders });
+    response.writeHead(status, { "content-type": "application/json", "cache-control": "no-store", "x-content-type-options": "nosniff", ...extraHeaders });
     response.end(JSON.stringify(body));
 }
 async function fetchWithTimeout(url, init, timeoutMs, label = "upstream") {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        return await fetch(url, { ...init, signal: controller.signal });
+        const response = await fetch(url, { ...init, redirect: "manual", signal: controller.signal });
+        if (response.status >= 300 && response.status < 400)
+            throw new HttpError(502, `${label} redirect refused`);
+        return response;
     }
     catch (error) {
-        if (error?.name === "AbortError")
+        if (error instanceof Error && error.name === "AbortError")
             throw new HttpError(504, `${label} request timed out`);
         throw error;
     }
@@ -85,13 +116,30 @@ async function fetchWithTimeout(url, init, timeoutMs, label = "upstream") {
         clearTimeout(timer);
     }
 }
+async function readResponseBytes(response, limit = MAX_RESPONSE_BYTES) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > limit)
+        throw new HttpError(502, "upstream response too large");
+    if (!response.body)
+        return Buffer.alloc(0);
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of response.body) {
+        const buffer = Buffer.from(chunk);
+        total += buffer.length;
+        if (total > limit)
+            throw new HttpError(502, "upstream response too large");
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks);
+}
 async function facilitatorPost(entry, path, body) {
     const headers = { "content-type": "application/json" };
     if (entry.facilitatorApiKey) {
         headers["x-api-key"] = entry.facilitatorApiKey;
     }
-    const response = await fetchWithTimeout(new URL(path, entry.facilitatorUrl), { method: "POST", headers, body: JSON.stringify(body) }, FACILITATOR_TIMEOUT_MS, "facilitator");
-    const text = await response.text();
+    const response = await fetchWithTimeout(new URL(path.replace(/^\/+/, ""), `${entry.facilitatorUrl.replace(/\/+$/, "")}/`), { method: "POST", headers, body: JSON.stringify(body) }, FACILITATOR_TIMEOUT_MS, "facilitator");
+    const text = (await readResponseBytes(response, Math.min(MAX_RESPONSE_BYTES, 1_000_000))).toString("utf8");
     let data = {};
     try {
         data = text ? JSON.parse(text) : {};
@@ -102,10 +150,34 @@ async function facilitatorPost(entry, path, body) {
     }
     if (!response.ok) {
         logFacilitatorFailure(entry, path, response, body, data);
+        if (response.status === 429) {
+            const retryAfter = response.headers.get("retry-after");
+            throw new HttpError(429, "facilitator rate limited", `facilitator ${path} rate limited`, retryAfter ? { "retry-after": retryAfter } : {});
+        }
         throw new HttpError(502, "facilitator request failed", `facilitator ${path} failed: ${response.status}`);
     }
     return data;
 }
+function configuredPublicBaseUrl() {
+    const value = process.env.X402_GATEWAY_PUBLIC_BASE_URL?.trim();
+    if (!value)
+        return undefined;
+    try {
+        const url = new URL(value);
+        if (!["http:", "https:"].includes(url.protocol))
+            throw new Error("unsupported protocol");
+        return `${value.replace(/\/+$/, "")}/`;
+    }
+    catch {
+        throw new Error("X402_GATEWAY_PUBLIC_BASE_URL must be a valid http(s) URL");
+    }
+}
+function resourceUrl(url, publicBaseUrl) {
+    const path = `${url.pathname}${url.search}`;
+    if (!publicBaseUrl)
+        return path;
+    return new URL(path, publicBaseUrl).toString();
+}
 function logFacilitatorFailure(entry, path, response, body, data) {
     const requirement = body?.paymentRequirements;
     const nestedError = data?.error && typeof data.error === "object" ? data.error : undefined;
@@ -128,17 +200,19 @@ function isVerifySuccess(verify) {
     return verify?.valid === true || verify?.isValid === true;
 }
 function isSettleSuccess(settle) {
-    return (settle?.success === true ||
-        settle?.settled === true ||
-        (typeof settle?.transaction === "string" && settle.transaction.length > 0) ||
-        (typeof settle?.txHash === "string" && settle.txHash.length > 0));
+    return settle?.success === true && typeof settle?.transaction === "string" && settle.transaction.length > 0 && typeof settle?.network === "string" && settle.network.length > 0;
 }
 function isAdminAllowed(request) {
     const token = process.env.X402_GATEWAY_ADMIN_TOKEN;
     if (!token)
         return process.env.X402_GATEWAY_ADMIN_ALLOW_PUBLIC === "true";
     const auth = request.headers.authorization ?? "";
-    return auth === `Bearer ${token}`;
+    const expected = Buffer.from(`Bearer ${token}`);
+    const actual = Buffer.from(auth);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function clientAddress(request) {
+    return request.socket.remoteAddress ?? "unknown";
 }
 function requestParams(url, body, request) {
     const params = {};
@@ -165,11 +239,12 @@ function requestParams(url, body, request) {
 }
 function upstreamHeaders(request, entry) {
     const headersOut = new Headers();
+    const connectionHeaders = new Set(String(request.headers.connection ?? "").split(",").map(value => value.trim().toLowerCase()).filter(Boolean));
     for (const [key, value] of Object.entries(request.headers)) {
         if (!value)
             continue;
         const lower = key.toLowerCase();
-        if (STRIP_REQUEST_HEADERS.has(lower))
+        if (STRIP_REQUEST_HEADERS.has(lower) || connectionHeaders.has(lower))
             continue;
         headersOut.set(key, Array.isArray(value) ? value.join(",") : value);
     }
@@ -184,7 +259,14 @@ function upstreamHeaders(request, entry) {
 }
 function upstreamUrl(entry, request, routePath) {
     const sourceUrl = new URL(request.url ?? "/", "http://local");
-    const upstream = new URL(routePath + (sourceUrl.search || ""), entry.config.forward_url);
+    if (!routePath.startsWith("/") || routePath.startsWith("//") || routePath.includes("\\") || routePath.includes("\0") || /%(?:2f|5c)/i.test(routePath))
+        throw new HttpError(400, "invalid provider path");
+    const base = new URL(entry.config.forward_url);
+    const upstream = new URL(base);
+    upstream.pathname = routePath;
+    upstream.search = sourceUrl.search;
+    if (upstream.origin !== base.origin)
+        throw new HttpError(400, "invalid provider path");
     const auth = entry.config.routing?.auth;
     const value = auth?.value ?? (auth?.value_from_env ? process.env[auth.value_from_env] : undefined);
     if (auth?.method === "query_param" && value) {
@@ -192,7 +274,7 @@ function upstreamUrl(entry, request, routePath) {
     }
     return upstream;
 }
-async function forward(entry, request, response, routePath, body, paymentResponse) {
+async function forward(metrics, entry, request, response, routePath, body, paymentResponse) {
     const upstream = upstreamUrl(entry, request, routePath);
     let upstreamResponse;
     try {
@@ -216,11 +298,24 @@ async function forward(entry, request, response, routePath, body, paymentRespons
     });
     if (paymentResponse)
         responseHeaders[headers.response] = encodeResponse(paymentResponse);
+    let responseBody;
+    try {
+        responseBody = await readResponseBytes(upstreamResponse);
+    }
+    catch (error) {
+        metrics.upstreamFailures += 1;
+        throw error;
+    }
     response.writeHead(upstreamResponse.status, responseHeaders);
-    response.end(Buffer.from(await upstreamResponse.arrayBuffer()));
+    response.end(responseBody);
 }
 export function createGatewayServer(providers) {
-    return http.createServer(async (request, response) => {
+    const publicBaseUrl = configuredPublicBaseUrl();
+    const metrics = createMetrics();
+    const rateLimits = new Map();
+    let activeRequests = 0;
+    const server = http.createServer(async (request, response) => {
+        let countedActive = false;
         try {
             metrics.requests += 1;
             const url = new URL(request.url ?? "/", "http://local");
@@ -266,6 +361,7 @@ export function createGatewayServer(providers) {
                     `x402_gateway_verify_failures_total ${metrics.verifyFailures}`,
                     `x402_gateway_settle_failures_total ${metrics.settleFailures}`,
                     `x402_gateway_upstream_failures_total ${metrics.upstreamFailures}`,
+                    `x402_gateway_rejected_requests_total ${metrics.rejectedRequests}`,
                     "",
                 ].join("\n"));
                 return;
@@ -286,10 +382,32 @@ export function createGatewayServer(providers) {
                 json(response, 404, { error: "endpoint not found" });
                 return;
             }
+            const now = Date.now();
+            const address = clientAddress(request);
+            let rate = rateLimits.get(address);
+            if (!rate || rate.resetAt <= now) {
+                rate = { count: 0, resetAt: now + 60_000 };
+                rateLimits.set(address, rate);
+            }
+            rate.count += 1;
+            if (rate.count > RATE_LIMIT_PER_MINUTE) {
+                metrics.rejectedRequests += 1;
+                const retryAfter = Math.max(1, Math.ceil((rate.resetAt - now) / 1000));
+                throw new HttpError(429, "gateway rate limited", undefined, { "retry-after": String(retryAfter) });
+            }
+            if (activeRequests >= MAX_CONCURRENT_REQUESTS) {
+                metrics.rejectedRequests += 1;
+                throw new HttpError(503, "gateway is busy", undefined, { "retry-after": "1" });
+            }
+            activeRequests += 1;
+            countedActive = true;
             const body = await readBody(request);
-            const requirements = paymentRequirements(entry.config, priceUsd(endpoint, requestParams(url, body, request)));
+            const price = priceUsd(endpoint, requestParams(url, body, request));
+            const requirements = paymentRequirements(entry.config, price);
+            if (price > 0 && !requirements.length)
+                throw new HttpError(500, "paid endpoint has no payment requirements");
             if (!requirements.length) {
-                await forward(entry, request, response, routePath, body);
+                await forward(metrics, entry, request, response, routePath, body);
                 return;
             }
             const paymentHeader = request.headers[headers.signature.toLowerCase()];
@@ -298,7 +416,7 @@ export function createGatewayServer(providers) {
                 const challenge = {
                     x402Version: 2,
                     error: "Payment required",
-                    resource: { url: url.pathname },
+                    resource: { url: resourceUrl(url, publicBaseUrl) },
                     accepts,
                 };
                 json(response, 402, challenge, { [headers.required]: encodeRequired(challenge) });
@@ -343,15 +461,37 @@ export function createGatewayServer(providers) {
                 return;
             }
             metrics.paidRequests += 1;
-            await forward(entry, request, response, routePath, body, settle);
+            try {
+                await forward(metrics, entry, request, response, routePath, body, settle);
+            }
+            catch (error) {
+                const status = error instanceof HttpError ? error.status : 502;
+                const extraHeaders = error instanceof HttpError ? error.responseHeaders : {};
+                json(response, status, {
+                    error: "upstream failed after payment settlement",
+                    settled: true,
+                }, {
+                    ...extraHeaders,
+                    [headers.response]: encodeResponse(settle),
+                });
+            }
         }
         catch (error) {
             if (error instanceof HttpError) {
-                json(response, error.status, { error: error.publicMessage });
+                json(response, error.status, { error: error.publicMessage }, error.responseHeaders);
                 return;
             }
             console.error(error);
             json(response, 500, { error: "internal server error" });
         }
+        finally {
+            if (countedActive)
+                activeRequests -= 1;
+        }
     });
+    server.requestTimeout = UPSTREAM_TIMEOUT_MS + FACILITATOR_TIMEOUT_MS * 2 + 5_000;
+    server.headersTimeout = Math.min(server.requestTimeout, 60_000);
+    server.keepAliveTimeout = 5_000;
+    server.maxConnections = MAX_CONCURRENT_REQUESTS * 2;
+    return server;
 }

package/dist/gateway/tokens.js

@@ -16,19 +16,25 @@ export const TOKENS = {
     },
 };
 export function normalizeNetwork(network) {
-    return ({
+    const legacyTronIds = {
         "tron-mainnet": "tron:0x2b6653dc",
         "tron:mainnet": "tron:0x2b6653dc",
-        "mainnet": "tron:0x2b6653dc",
+        mainnet: "tron:0x2b6653dc",
         "tron-shasta": "tron:0x94a9059e",
         "tron:shasta": "tron:0x94a9059e",
-        "shasta": "tron:0x94a9059e",
+        shasta: "tron:0x94a9059e",
         "tron-nile": "tron:0xcd8690dc",
         "tron:nile": "tron:0xcd8690dc",
-        "nile": "tron:0xcd8690dc",
+        nile: "tron:0xcd8690dc",
+    };
+    const canonical = legacyTronIds[network];
+    if (canonical) {
+        throw new Error(`legacy TRON network identifier ${network} is not supported; use ${canonical}`);
+    }
+    return {
         "bsc-mainnet": "eip155:56",
         "bsc-testnet": "eip155:97",
-    }[network] ?? network);
+    }[network] ?? network;
 }
 export function getToken(network, symbol) {
     const normalized = normalizeNetwork(network);