@bankofai/x402-cli 1.0.1-beta.7 → 1.0.1-beta.8

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import http from "node:http";
 import { setTimeout as delay } from "node:timers/promises";
+import net from "node:net";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -11,6 +12,7 @@ import YAML from "yaml";
 import { createPaymentPayload, decodeRequired, decodeResponse, decodeSignature, encodeRequired, encodeResponse, encodeSignature, headers } from "./x402.js";
 import { assertRawAmount, findTokenByAddress, getToken, normalizeNetwork, toSmallestUnit } from "./tokens.js";
 const BOOLEAN_FLAGS = new Set(["daemon", "dry-run", "force", "help", "human", "include-blocked", "json", "raw", "version"]);
+const MAX_HTTP_BODY_BYTES = 10 * 1024 * 1024;
 const require = createRequire(import.meta.url);
 const DEFAULT_TIMEOUT_MS = 30_000;
 const CATALOG_UPDATE_RETRIES = 3;
@@ -71,7 +73,7 @@ function parseArgs(argv) {
             options[key] = true;
         }
         else if (!next || next.startsWith("--")) {
-            options[key] = true;
+            throw new CliError("MISSING_ARGUMENT", `--${key} requires a value`, `Pass --${key} <value>.`, 2);
         }
         else {
             if (key === "header") {
@@ -653,7 +655,36 @@ async function readText(source, options) {
     const response = await fetchWithTimeout(source, {}, timeoutMs(options), `fetch ${source}`);
     if (!response.ok)
         throw new Error(`failed to fetch ${source}: ${response.status}`);
-    return response.text();
+    return readBoundedText(response, `response from ${source}`);
+}
+async function readBoundedText(response, label) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > MAX_HTTP_BODY_BYTES) {
+        throw new Error(`${label} exceeds ${MAX_HTTP_BODY_BYTES} byte limit`);
+    }
+    if (!response.body)
+        return "";
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > MAX_HTTP_BODY_BYTES) {
+            await reader.cancel();
+            throw new Error(`${label} exceeds ${MAX_HTTP_BODY_BYTES} byte limit`);
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
 }
 async function readJson(source, options) {
     return JSON.parse(await readText(source, options));
@@ -663,7 +694,7 @@ function writeJson(file, value) {
     fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
 }
 async function responsePayload(response) {
-    const text = await response.text();
+    const text = await readBoundedText(response, "HTTP response");
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.toLowerCase().includes("json")) {
         try {
@@ -696,7 +727,7 @@ function cachedCatalogPath() {
     return path.join(cacheDir(), "catalog.json");
 }
 function providerFilename(fqn) {
-    return `${fqn.replace(/\//g, "__")}.json`;
+    return `${sanitizeProviderName(fqn).replace(/\//g, "__")}.json`;
 }
 function sanitizeProviderName(name) {
     if (!/^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(name) || name.includes("..")) {
@@ -758,8 +789,11 @@ function remoteBaseFromCatalogPayload(payload) {
 }
 async function remoteBaseFromSource(source, payload, options) {
     const fromPayload = payload ? remoteBaseFromCatalogPayload(payload) : undefined;
-    if (fromPayload)
+    if (fromPayload) {
+        if (/^https?:\/\//.test(source) && new URL(fromPayload).origin !== new URL(source).origin)
+            throw new Error("catalog base_url must use the same origin as the catalog source");
         return fromPayload;
+    }
     if (source.startsWith("http://") || source.startsWith("https://")) {
         return `${source.slice(0, source.lastIndexOf("/") + 1)}`;
     }
@@ -771,6 +805,7 @@ async function remoteBaseFromSource(source, payload, options) {
     }
 }
 function catalogDetailSource(source, section, name) {
+    name = sanitizeProviderName(name);
     if (source.startsWith("http://") || source.startsWith("https://")) {
         const base = new URL(source);
         const pathname = base.pathname.endsWith("/catalog.json")
@@ -994,8 +1029,8 @@ function buildRequirement(options) {
     if (!explicitAsset && !registryToken)
         throw new Error(`unknown token ${tokenSymbol} on ${network}`);
     const decimals = decimalsOption !== undefined ? Number(decimalsOption) : registryToken.decimals;
-    if (!Number.isInteger(decimals) || decimals < 0)
-        throw new Error("--decimals must be a non-negative integer");
+    if (!Number.isInteger(decimals) || decimals < 0 || decimals > 255)
+        throw new Error("--decimals must be an integer between 0 and 255");
     const rawAmount = opt(options, "rawAmount") ?? opt(options, "raw-amount");
     const humanAmount = opt(options, "amount");
     if (rawAmount && humanAmount)
@@ -1003,13 +1038,17 @@ function buildRequirement(options) {
     const amount = rawAmount ? assertRawAmount(rawAmount, "--raw-amount") : toSmallestUnit(humanAmount ?? "0.0001", decimals);
     const assetAddress = explicitAsset ?? registryToken.address;
     const assetTransferMethod = registryToken?.assetTransferMethod ?? "permit2";
+    const maxTimeoutSeconds = Number(opt(options, "valid-for-seconds", "300"));
+    if (!Number.isInteger(maxTimeoutSeconds) || maxTimeoutSeconds <= 0 || maxTimeoutSeconds > 86400) {
+        throw new Error("--valid-for-seconds must be an integer between 1 and 86400");
+    }
     return {
         scheme,
         network,
         amount,
         asset: assetAddress,
         payTo: opt(options, "pay-to") ?? opt(options, "payTo") ?? "",
-        maxTimeoutSeconds: Number(opt(options, "valid-for-seconds", "300")),
+        maxTimeoutSeconds,
         extra: scheme === "exact" && assetTransferMethod ? { assetTransferMethod } : {},
     };
 }
@@ -1019,10 +1058,16 @@ async function facilitatorPost(baseUrl, path, body, options) {
         headers: { "content-type": "application/json" },
         body: JSON.stringify(body),
     }, timeoutMs(options), `facilitator ${path}`);
-    const text = await response.text();
-    const data = text ? JSON.parse(text) : {};
+    const text = await readBoundedText(response, `facilitator ${path} response`);
+    let data = {};
+    try {
+        data = text ? JSON.parse(text) : {};
+    }
+    catch {
+        throw new Error(`facilitator ${path} returned invalid JSON`);
+    }
     if (!response.ok)
-        throw new Error(`facilitator ${path} failed: ${response.status} ${text}`);
+        throw new Error(`facilitator ${path} failed with HTTP ${response.status}`);
     return data;
 }
 function requestHeaders(options) {
@@ -1038,7 +1083,23 @@ function requestHeaders(options) {
 function stripFlag(argv, flag) {
     return argv.filter(item => item !== flag);
 }
-function serveDaemon(argv, options) {
+async function waitForPort(host, port, timeout = 5_000) {
+    const deadline = Date.now() + timeout;
+    while (Date.now() < deadline) {
+        const connected = await new Promise(resolve => {
+            const socket = net.createConnection({ host, port });
+            socket.setTimeout(250);
+            socket.once("connect", () => { socket.destroy(); resolve(true); });
+            socket.once("error", () => resolve(false));
+            socket.once("timeout", () => { socket.destroy(); resolve(false); });
+        });
+        if (connected)
+            return;
+        await delay(50);
+    }
+    throw new Error(`daemon did not become ready on ${host}:${port}`);
+}
+async function serveDaemon(argv, options) {
     const requirement = buildRequirement(options);
     if (!requirement.payTo)
         throw new Error("--pay-to is required");
@@ -1053,6 +1114,18 @@ function serveDaemon(argv, options) {
     const host = opt(options, "host", "127.0.0.1");
     const port = Number(opt(options, "port", "4020"));
     const resourceUrl = opt(options, "resource-url", `http://${host}:${port}/pay`);
+    try {
+        await waitForPort(host === "0.0.0.0" ? "127.0.0.1" : host === "::" ? "::1" : host, port);
+    }
+    catch (error) {
+        if (child.pid) {
+            try {
+                process.kill(child.pid);
+            }
+            catch { /* child already exited */ }
+        }
+        throw error;
+    }
     emit({
         command: "server",
         mode: outputMode(options),
@@ -1079,8 +1152,8 @@ function validateAmountLimits(selected, options) {
             throw new Error("cannot evaluate --max-amount for an unknown asset; pass --max-raw-amount or --decimals");
         }
         const decimals = decimalsOption !== undefined ? Number(decimalsOption) : token.decimals;
-        if (!Number.isInteger(decimals) || decimals < 0)
-            throw new Error("--decimals must be a non-negative integer");
+        if (!Number.isInteger(decimals) || decimals < 0 || decimals > 255)
+            throw new Error("--decimals must be an integer between 0 and 255");
         if (BigInt(selected.amount) > BigInt(toSmallestUnit(maxAmount, decimals))) {
             throw new Error(`payment amount exceeds --max-amount ${maxAmount}`);
         }
@@ -1107,8 +1180,8 @@ function gasfreeFeeLimitRaw(selected, options) {
         throw new Error("cannot evaluate --max-gasfree-fee for an unknown asset; pass --max-gasfree-fee-raw or --decimals");
     }
     const decimals = decimalsOption !== undefined ? Number(decimalsOption) : token.decimals;
-    if (!Number.isInteger(decimals) || decimals < 0)
-        throw new Error("--decimals must be a non-negative integer");
+    if (!Number.isInteger(decimals) || decimals < 0 || decimals > 255)
+        throw new Error("--decimals must be an integer between 0 and 255");
     return toSmallestUnit(maxHuman, decimals);
 }
 async function serve(options) {
@@ -1173,7 +1246,7 @@ async function serve(options) {
                 paymentPayload: payload,
                 paymentRequirements: requirement,
             }, options);
-            if (!(settle?.success === true || settle?.settled === true || typeof settle?.transaction === "string" || typeof settle?.txHash === "string")) {
+            if (!(settle?.success === true && typeof settle?.transaction === "string" && settle.transaction.length > 0 && typeof settle?.network === "string" && settle.network.length > 0)) {
                 response.writeHead(502, { "content-type": "application/json" });
                 response.end(JSON.stringify({ error: "settlement failed" }));
                 return;
@@ -1182,7 +1255,7 @@ async function serve(options) {
                 "content-type": "application/json",
                 [headers.response]: encodeResponse(settle),
             });
-            response.end(JSON.stringify({ success: true, network: requirement.network, scheme: requirement.scheme, transaction: settle.transaction ?? settle.txHash ?? null }));
+            response.end(JSON.stringify({ success: true, network: requirement.network, scheme: requirement.scheme, transaction: settle.transaction }));
         }
         catch (error) {
             response.writeHead(500, { "content-type": "application/json" });
@@ -1209,6 +1282,17 @@ function selectRequirement(accepts, options) {
     const scheme = opt(options, "scheme");
     const token = opt(options, "token");
     const selected = accepts.find(req => {
+        if (!req || !["exact", "exact_gasfree"].includes(req.scheme) || typeof req.network !== "string" || typeof req.asset !== "string")
+            return false;
+        if (req.scheme === "exact_gasfree" && !req.network.startsWith("tron:"))
+            return false;
+        try {
+            if (!findTokenByAddress(req.network, req.asset))
+                return false;
+        }
+        catch {
+            return false;
+        }
         if (network && normalizeNetwork(network) !== req.network)
             return false;
         if (scheme && scheme !== req.scheme)
@@ -1233,6 +1317,9 @@ function selectRequirement(accepts, options) {
 async function pay(url, options) {
     requireArgument(url, "URL", "x402-cli pay <url> [options]");
     const method = opt(options, "method", "GET");
+    if (!/^[A-Z]+$/.test(method) || !["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"].includes(method)) {
+        throw new CliError("INVALID_ARGUMENT", `unsupported HTTP method ${method}`, "Use an uppercase standard HTTP method.", 2);
+    }
     const baseHeaders = requestHeaders(options);
     const probe = await fetchWithTimeout(url, {
         method,
@@ -1298,7 +1385,7 @@ async function pay(url, options) {
     const body = await responsePayload(paid);
     const paymentResponse = paid.headers.get(headers.response);
     const settlement = paymentResponse ? decodeResponse(paymentResponse) : undefined;
-    const settled = settlement !== undefined;
+    const settled = settlement?.success === true && typeof settlement?.transaction === "string" && settlement.transaction.length > 0 && typeof settlement?.network === "string" && settlement.network.length > 0;
     const result = {
         url,
         status: paid.status,
@@ -1312,6 +1399,9 @@ async function pay(url, options) {
         } : {}),
         ...(creation.gasfreeEstimate ? { gasfreeEstimate: creation.gasfreeEstimate } : {}),
     };
+    if (paymentResponse && !settled) {
+        throw new CliError("INVALID_SETTLEMENT", "gateway returned an invalid or unsuccessful PAYMENT-RESPONSE", "Do not treat this request as paid; contact the gateway operator.", 1, result);
+    }
     if (!paid.ok) {
         const retryAfter = paid.headers.get("retry-after");
         throw new CliError(paid.status === 429 ? "RATE_LIMITED" : "HTTP_ERROR", `HTTP ${paid.status} from ${url}${retryAfter ? ` (retry after ${retryAfter}s)` : ""}: ${typeof body === "string" ? body.slice(0, 500) : JSON.stringify(body).slice(0, 500)}`, paymentResponse
@@ -1664,7 +1754,7 @@ async function catalogPayJson(source, name, options) {
 }
 async function handleGateway(args) {
     const { command, positional, options } = parseArgs(args);
-    if (hasFlag(options, "help") || command === "help") {
+    if (hasFlag(options, "help") || ["help", "--help", "-h"].includes(command)) {
         process.stdout.write(helpText(command === "catalog" || positional[0] === "catalog" ? "gateway-catalog" : "gateway"));
         return;
     }
@@ -1697,7 +1787,7 @@ async function handleGatewayCatalog(positional, options) {
 }
 async function handleCatalog(args) {
     const { command, positional, options } = parseArgs(args);
-    if (hasFlag(options, "help") || command === "help") {
+    if (hasFlag(options, "help") || ["help", "--help", "-h"].includes(command)) {
         const topic = command === "help" ? positional[0] : command;
         process.stdout.write(helpText(topic ? `catalog-${topic}` : "catalog"));
         return;
@@ -1742,7 +1832,7 @@ async function main() {
     }
     if (command === "serve") {
         if (hasFlag(options, "daemon"))
-            serveDaemon(argv, options);
+            await serveDaemon(argv, options);
         else
             await serve(options);
     }

package/dist/gateway/config.js

@@ -30,6 +30,11 @@ function assertHttpUrl(value, name) {
         const url = new URL(value);
         if (!["http:", "https:"].includes(url.protocol))
             throw new Error("unsupported protocol");
+        if (url.username || url.password || url.search || url.hash)
+            throw new Error("credentials, query, and fragment are not allowed");
+        if (url.protocol === "http:" && !["localhost", "127.0.0.1", "::1"].includes(url.hostname) && process.env.X402_GATEWAY_ALLOW_INSECURE_HTTP !== "true") {
+            throw new Error("remote HTTP is not allowed");
+        }
     }
     catch {
         throw new Error(`${name} must be a valid http(s) URL`);
@@ -80,6 +85,13 @@ function validateProvider(config, file) {
     if (authMethod && !["header", "query_param", "access_token", "oauth2"].includes(authMethod)) {
         throw new Error(`${file}: unsupported routing.auth.method ${authMethod}`);
     }
+    const auth = config.routing?.auth;
+    if (auth) {
+        if (!auth.value && !auth.value_from_env)
+            throw new Error(`${file}: routing.auth requires value or value_from_env`);
+        if (auth.value_from_env && !process.env[auth.value_from_env])
+            throw new Error(`${file}: environment variable ${auth.value_from_env} is not set`);
+    }
     if (!config.endpoints?.length)
         throw new Error(`${file}: endpoints must contain at least one endpoint`);
     const seen = new Set();
@@ -104,6 +116,7 @@ export function loadProvider(file) {
     validateProvider(config, file);
     config.operator.network = normalizeNetwork(config.operator.network);
     normalizePaymentProtocol(config, file);
+    validatePaymentCapabilities(config, file);
     const facilitatorUrl = config.operator.facilitator_url ||
         process.env.X402_FACILITATOR_URL ||
         process.env.FACILITATOR_URL ||
@@ -125,10 +138,13 @@ export function loadProvider(file) {
     };
 }
 function normalizePaymentProtocol(config, file) {
-    const rawSchemes = config.operator.schemes?.length
-        ? config.operator.schemes
-        : [config.operator.protocol || config.operator.scheme || "exact"];
+    if (config.operator.schemes !== undefined && (!Array.isArray(config.operator.schemes) || !config.operator.schemes.length)) {
+        throw new Error(`${file}: operator.schemes must be a non-empty string array`);
+    }
+    const rawSchemes = config.operator.schemes ?? [config.operator.protocol || config.operator.scheme || "exact"];
     const schemes = [...new Set(rawSchemes.map(value => {
+            if (typeof value !== "string" || !value.trim())
+                throw new Error(`${file}: operator.schemes must contain non-empty strings`);
             const raw = String(value).toLowerCase();
             const normalized = raw.replace(/[-:\s]/g, "_");
             if (!["exact", "exact_gasfree", "exact_permit", "permit2", "exact_permit2"].includes(normalized)) {
@@ -151,6 +167,33 @@ function normalizePaymentProtocol(config, file) {
         delete config.operator.assetTransferMethod;
     }
 }
+function validatePaymentCapabilities(config, file) {
+    const symbols = config.operator.currencies?.usd ?? ["USDT"];
+    if (!Array.isArray(symbols) || !symbols.length || symbols.some(symbol => typeof symbol !== "string" || !symbol.trim())) {
+        throw new Error(`${file}: operator.currencies.usd must be a non-empty string array`);
+    }
+    if (new Set(symbols.map(symbol => symbol.toUpperCase())).size !== symbols.length)
+        throw new Error(`${file}: operator.currencies.usd must not contain duplicates`);
+    for (const symbol of symbols)
+        getToken(config.operator.network, symbol);
+    const recipient = config.recipients?.[config.operator.recipient]?.account ?? config.operator.recipient;
+    assertString(recipient, `${file}: resolved recipient`);
+    const validRecipient = config.operator.network.startsWith("tron:")
+        ? /^T[1-9A-HJ-NP-Za-km-z]{33}$/.test(recipient)
+        : /^0x[0-9a-fA-F]{40}$/.test(recipient);
+    if (!validRecipient)
+        throw new Error(`${file}: operator.recipient must be a valid address or a resolvable recipient alias`);
+    for (const endpoint of config.endpoints ?? []) {
+        if (!endpoint.metering)
+            continue;
+        const prices = [endpoint.metering.dimensions?.[0]?.tiers?.[0]?.price_usd,
+            ...(endpoint.metering.variants ?? []).map(variant => variant.dimensions?.[0]?.tiers?.[0]?.price_usd)]
+            .filter((price) => typeof price === "number" && price > 0);
+        for (const price of prices)
+            if (!paymentRequirements(config, price).length)
+                throw new Error(`${file}: paid endpoint cannot generate payment requirements`);
+    }
+}
 export function loadProviders(providerPath) {
     const stat = fs.statSync(providerPath);
     const files = stat.isDirectory()
@@ -174,6 +217,8 @@ export function endpointFor(provider, method, routePath) {
     return provider.endpoints?.find(endpoint => endpoint.method.toUpperCase() === method.toUpperCase() && pathMatches(endpoint.path, routePath));
 }
 function pathMatches(template, routePath) {
+    if (!routePath.startsWith("/") || routePath.startsWith("//") || routePath.includes("\\") || routePath.includes("\0") || /%(?:2f|5c)/i.test(routePath))
+        return false;
     const templateParts = template.split("/").filter(Boolean);
     const routeParts = routePath.split("/").filter(Boolean);
     if (templateParts.length !== routeParts.length)

package/dist/gateway/server.js

@@ -1,4 +1,5 @@
 import http from "node:http";
+import { timingSafeEqual } from "node:crypto";
 import { URL } from "node:url";
 import { endpointFor, paymentRequirements, priceUsd } from "./config.js";
 import { decodeSignature, encodeRequired, encodeResponse, headers, matchRequirement } from "./x402.js";
@@ -25,13 +26,16 @@ function positiveIntegerEnv(name, fallback) {
     if (!/^\d+$/.test(raw))
         throw new Error(`${name} must be a positive integer`);
     const value = Number(raw);
-    if (!Number.isSafeInteger(value) || value <= 0)
-        throw new Error(`${name} must be a positive integer`);
+    if (!Number.isSafeInteger(value) || value <= 0 || value > 2_147_483_647)
+        throw new Error(`${name} must be an integer between 1 and 2147483647`);
     return value;
 }
 const MAX_BODY_BYTES = positiveIntegerEnv("X402_GATEWAY_MAX_BODY_BYTES", 1_000_000);
 const FACILITATOR_TIMEOUT_MS = positiveIntegerEnv("X402_GATEWAY_FACILITATOR_TIMEOUT_MS", 10_000);
 const UPSTREAM_TIMEOUT_MS = positiveIntegerEnv("X402_GATEWAY_UPSTREAM_TIMEOUT_MS", 30_000);
+const MAX_RESPONSE_BYTES = positiveIntegerEnv("X402_GATEWAY_MAX_RESPONSE_BYTES", 10_000_000);
+const MAX_CONCURRENT_REQUESTS = positiveIntegerEnv("X402_GATEWAY_MAX_CONCURRENT_REQUESTS", 100);
+const RATE_LIMIT_PER_MINUTE = positiveIntegerEnv("X402_GATEWAY_RATE_LIMIT_PER_MINUTE", 300);
 const STRIP_REQUEST_HEADERS = new Set([
     "host",
     "connection",
@@ -49,6 +53,8 @@ const STRIP_REQUEST_HEADERS = new Set([
     "payment-signature",
     "payment-required",
     "x-payment-required",
+    "payment-response",
+    "x-payment-response",
     "accept-encoding",
 ]);
 const STRIP_RESPONSE_HEADERS = new Set([
@@ -73,6 +79,7 @@ function createMetrics() {
         verifyFailures: 0,
         settleFailures: 0,
         upstreamFailures: 0,
+        rejectedRequests: 0,
     };
 }
 async function readBody(request) {
@@ -88,14 +95,17 @@ async function readBody(request) {
     return Buffer.concat(chunks);
 }
 function json(response, status, body, extraHeaders = {}) {
-    response.writeHead(status, { "content-type": "application/json", ...extraHeaders });
+    response.writeHead(status, { "content-type": "application/json", "cache-control": "no-store", "x-content-type-options": "nosniff", ...extraHeaders });
     response.end(JSON.stringify(body));
 }
 async function fetchWithTimeout(url, init, timeoutMs, label = "upstream") {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        return await fetch(url, { ...init, signal: controller.signal });
+        const response = await fetch(url, { ...init, redirect: "manual", signal: controller.signal });
+        if (response.status >= 300 && response.status < 400)
+            throw new HttpError(502, `${label} redirect refused`);
+        return response;
     }
     catch (error) {
         if (error instanceof Error && error.name === "AbortError")
@@ -106,13 +116,30 @@ async function fetchWithTimeout(url, init, timeoutMs, label = "upstream") {
         clearTimeout(timer);
     }
 }
+async function readResponseBytes(response, limit = MAX_RESPONSE_BYTES) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > limit)
+        throw new HttpError(502, "upstream response too large");
+    if (!response.body)
+        return Buffer.alloc(0);
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of response.body) {
+        const buffer = Buffer.from(chunk);
+        total += buffer.length;
+        if (total > limit)
+            throw new HttpError(502, "upstream response too large");
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks);
+}
 async function facilitatorPost(entry, path, body) {
     const headers = { "content-type": "application/json" };
     if (entry.facilitatorApiKey) {
         headers["x-api-key"] = entry.facilitatorApiKey;
     }
-    const response = await fetchWithTimeout(new URL(path, entry.facilitatorUrl), { method: "POST", headers, body: JSON.stringify(body) }, FACILITATOR_TIMEOUT_MS, "facilitator");
-    const text = await response.text();
+    const response = await fetchWithTimeout(new URL(path.replace(/^\/+/, ""), `${entry.facilitatorUrl.replace(/\/+$/, "")}/`), { method: "POST", headers, body: JSON.stringify(body) }, FACILITATOR_TIMEOUT_MS, "facilitator");
+    const text = (await readResponseBytes(response, Math.min(MAX_RESPONSE_BYTES, 1_000_000))).toString("utf8");
     let data = {};
     try {
         data = text ? JSON.parse(text) : {};
@@ -173,19 +200,19 @@ function isVerifySuccess(verify) {
     return verify?.valid === true || verify?.isValid === true;
 }
 function isSettleSuccess(settle) {
-    if (settle?.success === false || settle?.settled === false)
-        return false;
-    return (settle?.success === true ||
-        settle?.settled === true ||
-        (typeof settle?.transaction === "string" && settle.transaction.length > 0) ||
-        (typeof settle?.txHash === "string" && settle.txHash.length > 0));
+    return settle?.success === true && typeof settle?.transaction === "string" && settle.transaction.length > 0 && typeof settle?.network === "string" && settle.network.length > 0;
 }
 function isAdminAllowed(request) {
     const token = process.env.X402_GATEWAY_ADMIN_TOKEN;
     if (!token)
         return process.env.X402_GATEWAY_ADMIN_ALLOW_PUBLIC === "true";
     const auth = request.headers.authorization ?? "";
-    return auth === `Bearer ${token}`;
+    const expected = Buffer.from(`Bearer ${token}`);
+    const actual = Buffer.from(auth);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function clientAddress(request) {
+    return request.socket.remoteAddress ?? "unknown";
 }
 function requestParams(url, body, request) {
     const params = {};
@@ -212,11 +239,12 @@ function requestParams(url, body, request) {
 }
 function upstreamHeaders(request, entry) {
     const headersOut = new Headers();
+    const connectionHeaders = new Set(String(request.headers.connection ?? "").split(",").map(value => value.trim().toLowerCase()).filter(Boolean));
     for (const [key, value] of Object.entries(request.headers)) {
         if (!value)
             continue;
         const lower = key.toLowerCase();
-        if (STRIP_REQUEST_HEADERS.has(lower))
+        if (STRIP_REQUEST_HEADERS.has(lower) || connectionHeaders.has(lower))
             continue;
         headersOut.set(key, Array.isArray(value) ? value.join(",") : value);
     }
@@ -231,7 +259,14 @@ function upstreamHeaders(request, entry) {
 }
 function upstreamUrl(entry, request, routePath) {
     const sourceUrl = new URL(request.url ?? "/", "http://local");
-    const upstream = new URL(routePath + (sourceUrl.search || ""), entry.config.forward_url);
+    if (!routePath.startsWith("/") || routePath.startsWith("//") || routePath.includes("\\") || routePath.includes("\0") || /%(?:2f|5c)/i.test(routePath))
+        throw new HttpError(400, "invalid provider path");
+    const base = new URL(entry.config.forward_url);
+    const upstream = new URL(base);
+    upstream.pathname = routePath;
+    upstream.search = sourceUrl.search;
+    if (upstream.origin !== base.origin)
+        throw new HttpError(400, "invalid provider path");
     const auth = entry.config.routing?.auth;
     const value = auth?.value ?? (auth?.value_from_env ? process.env[auth.value_from_env] : undefined);
     if (auth?.method === "query_param" && value) {
@@ -263,14 +298,24 @@ async function forward(metrics, entry, request, response, routePath, body, payme
     });
     if (paymentResponse)
         responseHeaders[headers.response] = encodeResponse(paymentResponse);
-    const responseBody = Buffer.from(await upstreamResponse.arrayBuffer());
+    let responseBody;
+    try {
+        responseBody = await readResponseBytes(upstreamResponse);
+    }
+    catch (error) {
+        metrics.upstreamFailures += 1;
+        throw error;
+    }
     response.writeHead(upstreamResponse.status, responseHeaders);
     response.end(responseBody);
 }
 export function createGatewayServer(providers) {
     const publicBaseUrl = configuredPublicBaseUrl();
     const metrics = createMetrics();
-    return http.createServer(async (request, response) => {
+    const rateLimits = new Map();
+    let activeRequests = 0;
+    const server = http.createServer(async (request, response) => {
+        let countedActive = false;
         try {
             metrics.requests += 1;
             const url = new URL(request.url ?? "/", "http://local");
@@ -316,6 +361,7 @@ export function createGatewayServer(providers) {
                     `x402_gateway_verify_failures_total ${metrics.verifyFailures}`,
                     `x402_gateway_settle_failures_total ${metrics.settleFailures}`,
                     `x402_gateway_upstream_failures_total ${metrics.upstreamFailures}`,
+                    `x402_gateway_rejected_requests_total ${metrics.rejectedRequests}`,
                     "",
                 ].join("\n"));
                 return;
@@ -336,8 +382,30 @@ export function createGatewayServer(providers) {
                 json(response, 404, { error: "endpoint not found" });
                 return;
             }
+            const now = Date.now();
+            const address = clientAddress(request);
+            let rate = rateLimits.get(address);
+            if (!rate || rate.resetAt <= now) {
+                rate = { count: 0, resetAt: now + 60_000 };
+                rateLimits.set(address, rate);
+            }
+            rate.count += 1;
+            if (rate.count > RATE_LIMIT_PER_MINUTE) {
+                metrics.rejectedRequests += 1;
+                const retryAfter = Math.max(1, Math.ceil((rate.resetAt - now) / 1000));
+                throw new HttpError(429, "gateway rate limited", undefined, { "retry-after": String(retryAfter) });
+            }
+            if (activeRequests >= MAX_CONCURRENT_REQUESTS) {
+                metrics.rejectedRequests += 1;
+                throw new HttpError(503, "gateway is busy", undefined, { "retry-after": "1" });
+            }
+            activeRequests += 1;
+            countedActive = true;
             const body = await readBody(request);
-            const requirements = paymentRequirements(entry.config, priceUsd(endpoint, requestParams(url, body, request)));
+            const price = priceUsd(endpoint, requestParams(url, body, request));
+            const requirements = paymentRequirements(entry.config, price);
+            if (price > 0 && !requirements.length)
+                throw new HttpError(500, "paid endpoint has no payment requirements");
             if (!requirements.length) {
                 await forward(metrics, entry, request, response, routePath, body);
                 return;
@@ -416,5 +484,14 @@ export function createGatewayServer(providers) {
             console.error(error);
             json(response, 500, { error: "internal server error" });
         }
+        finally {
+            if (countedActive)
+                activeRequests -= 1;
+        }
     });
+    server.requestTimeout = UPSTREAM_TIMEOUT_MS + FACILITATOR_TIMEOUT_MS * 2 + 5_000;
+    server.headersTimeout = Math.min(server.requestTimeout, 60_000);
+    server.keepAliveTimeout = 5_000;
+    server.maxConnections = MAX_CONCURRENT_REQUESTS * 2;
+    return server;
 }

package/dist/tokens.js

@@ -110,8 +110,8 @@ export function assertRawAmount(value, name = "raw amount") {
     return value.replace(/^0+(?=\d)/, "");
 }
 export function toSmallestUnit(amount, decimals) {
-    if (!Number.isInteger(decimals) || decimals < 0)
-        throw new Error("token decimals must be a non-negative integer");
+    if (!Number.isInteger(decimals) || decimals < 0 || decimals > 255)
+        throw new Error("token decimals must be an integer between 0 and 255");
     if (!/^\d+(\.\d+)?$/.test(amount))
         throw new Error("amount must be a non-negative decimal string");
     const [whole, fraction = ""] = amount.split(".");

package/dist/x402.js

@@ -106,7 +106,7 @@ function evmRpcUrl(network, explicit) {
         (chainId === "56" ? "https://bsc-dataseed.binance.org" : undefined) ||
         (chainId === "97" ? "https://data-seed-prebsc-1-s1.binance.org:8545" : undefined));
 }
-async function createTronWallet(privateKey) {
+async function createTronWallet(privateKey, maxGasfreeFeeRaw) {
     const rawKey = privateKey.replace(/^0x/, "");
     const tronWeb = new TronWeb({ fullHost: "https://api.trongrid.io" });
     const address = TronWeb.address.fromPrivateKey(rawKey);
@@ -115,6 +115,12 @@ async function createTronWallet(privateKey) {
     return {
         getAddress: () => address,
         async signTypedData(args) {
+            if (maxGasfreeFeeRaw !== undefined && args?.primaryType === "PermitTransfer") {
+                const maxFee = BigInt(args?.message?.maxFee ?? -1);
+                if (maxFee < 0n || maxFee > BigInt(maxGasfreeFeeRaw)) {
+                    throw new Error(`final GasFree maxFee ${maxFee} exceeds --max-gasfree-fee limit ${maxGasfreeFeeRaw}`);
+                }
+            }
             const signature = await signTronTypedData(tronWeb, args, rawKey);
             return signature.startsWith("0x") ? signature : `0x${signature}`;
         },
@@ -149,7 +155,7 @@ export async function createPaymentPayload(args) {
     }
     if (selected.network.startsWith("tron:")) {
         const privateKey = privateKeyFrom(["TRON_PRIVATE_KEY", "AGENT_WALLET_PRIVATE_KEY", "PRIVATE_KEY"], args.privateKey, ["tron_client", "payer", "default"]);
-        const wallet = await createTronWallet(privateKey);
+        const wallet = await createTronWallet(privateKey, selected.scheme === "exact_gasfree" ? args.maxGasfreeFeeRaw : undefined);
         const signer = await createClientTronSigner(wallet, {
             network: selected.network,
             rpcUrl: args.rpcUrl || process.env.TRON_RPC_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bankofai/x402-cli",
-  "version": "1.0.1-beta.7",
+  "version": "1.0.1-beta.8",
   "type": "module",
   "files": [
     "dist"
@@ -13,6 +13,7 @@
     "bundle:gateway": "node scripts/bundle-gateway.mjs",
     "prepack": "npm run build && npm run bundle:gateway",
     "test": "npm run build && node --test tests/*.test.mjs",
+    "test:package": "node scripts/test-package.mjs",
     "start": "node dist/cli.js",
     "dev": "tsx src/cli.ts"
   },
@@ -22,7 +23,7 @@
   "dependencies": {
     "@bankofai/x402-core": "1.0.1",
     "@bankofai/x402-evm": "1.0.1",
-    "@bankofai/x402-gateway": "1.0.1-beta.6",
+    "@bankofai/x402-gateway": "1.0.1-beta.7",
     "@bankofai/x402-tron": "1.0.1",
     "tronweb": "6.4.0",
     "viem": "^2.55.0",