@bolloon/bolloon-agent 0.4.31 → 0.4.33

package/dist/agents/x402/paid-info-store.js

@@ -244,6 +244,42 @@ function makeTracker(onEvent) {
     return async (e) => { if (onEvent)
         await onEvent(e).catch(() => null); };
 }
+/**
+ * ★ F5 修复点。
+ * 老代码: `chainSettled = !!txHash` —— 拿到 txHash 就宣称链上已验证 (从不读 receipt/事件/确认数)。
+ * 新逻辑:
+ *   · 没有 txHash              → `not_attempted`, chainSettled=false (没发过链上交易)
+ *   · 读不到 RPC / receipt     → `unknown`, chainSettled=false (不确定 ≠ 没付)
+ *   · receipt.status == 0      → `reverted`, chainSettled=false
+ *   · 确认数 < 门槛            → `pending`, chainSettled=false
+ *   · 事件(taskKey/resultHash)对不上 → `event_mismatch`, chainSettled=false
+ *   · 全过                     → `confirmed`/`finalized`, chainSettled=true
+ * 验证器本身抛错也**不会**炸付款路径: 一律降级成 `unknown` + chainSettled=false (fail-closed)。
+ */
+export async function verifyPaymentOnChain(args) {
+    const gate = args.chainSettlement?.gate || 'confirmed';
+    const txHash = String(args.txHash || '');
+    if (!txHash) {
+        return {
+            chainSettled: false, status: 'not_attempted',
+            reason: 'facilitator 说成功但没给 txHash: 没有链上交易可查, 不能认定链上结算完成',
+            confirmationsRequired: 0, requiredGate: gate, rpcAvailable: true, checkedAt: Date.now(), evidence: {},
+        };
+    }
+    try {
+        const verifier = args.chainSettlement?.verifier
+            ?? (await import('../chain/chain-settlement.js')).createDefaultChainSettlementVerifier({ gate });
+        return await verifier({ txHash, expect: args.chainSettlement?.expect, gate, recorded: args.chainSettlement?.recorded });
+    }
+    catch (e) {
+        return {
+            chainSettled: false, status: 'unknown',
+            reason: `链上验证器抛错 → 不能判已结算: ${String(e?.message || e).slice(0, 200)}`,
+            txHash, confirmationsRequired: 0, requiredGate: gate, rpcAvailable: false,
+            checkedAt: Date.now(), evidence: { verifierError: String(e?.message || e).slice(0, 200) },
+        };
+    }
+}
 export async function buyInfo(params) {
     const { verifyEnvelope } = await import('./paid-info-protocol.js');
     const doFetch = params.fetchImpl ?? fetch;
@@ -299,26 +335,59 @@ export async function buyInfo(params) {
         const text = await retry.text();
         const parsed = safeJson(text);
         const receipt = retry.headers.get('x-payment-response') || parsed?.payment?.receipt || '';
+        // ★ 链上事实需要 txHash: facilitator 说成功但没有 txHash → 不能标 chainSettled (真跑抓到过这类"假结算")
+        const txHash = parsed?.payment?.txHash || retry.headers.get('x-payment-txhash') || parsed?.txHash || '';
         if (retry.status < 200 || retry.status >= 300) {
             // 付款这一步已经发出去了 (可能已上链), 只是拿资源失败 → 绝不许当"没付过钱"
+            // ★ F5: 有 txHash 就去链上真查一遍, 而不是"有 txHash 就算结算"
+            const v = await verifyPaymentOnChain({ txHash, chainSettlement: params.chainSettlement });
             return {
                 ok: false, status: retry.status,
-                payment: { mode: 'facilitator', receipt: receipt || undefined, attempted: true, settled: true, settlementUncertain: !receipt },
+                payment: {
+                    mode: 'facilitator', receipt: receipt || undefined, attempted: true, settled: true,
+                    settlementUncertain: !receipt && !v.chainSettled,
+                    chainSettled: v.chainSettled, chainSettlementStatus: v.status, chainSettlementReason: v.reason,
+                    confirmations: v.confirmations, confirmationsRequired: v.confirmationsRequired, rpcAvailable: v.rpcAvailable,
+                    ...(txHash ? { txHash } : {}),
+                },
                 error: `付款后重试失败 ${retry.status}: ${text.slice(0, 200)}`,
             };
         }
         mode = 'facilitator';
-        // ★ 链上事实需要 txHash: facilitator 说成功但没有 txHash → 不能标 chainSettled (真跑抓到过这类"假结算")
-        const txHash = parsed?.payment?.txHash || retry.headers.get('x-payment-txhash') || parsed?.txHash || '';
+        // ★ F5 修复: 拿到 txHash ≠ 链上已验证。真验证 = receipt(status==1) + 确认数 + 事件(taskKey/resultHash) + 合约 escrow 状态。
+        const verdict = await verifyPaymentOnChain({ txHash, chainSettlement: params.chainSettlement });
         await trackEvent({
             kind: 'settled',
-            detail: `mode=facilitator receipt=${receipt.slice(0, 24)}… txHash=${txHash ? `${String(txHash).slice(0, 16)}…` : '(缺失: 不能认定链上结算完成)'}`,
-            patch: { paymentMode: 'facilitator', paymentReceipt: receipt, chainSettled: !!txHash, ...(txHash ? { txHash: String(txHash) } : {}) },
+            detail: `mode=facilitator receipt=${receipt.slice(0, 24)}… txHash=${txHash ? `${String(txHash).slice(0, 16)}…` : '(缺失: 不能认定链上结算完成)'} 链上判定=${verdict.status}` +
+                (verdict.confirmations != null ? ` 确认数=${verdict.confirmations}/${verdict.confirmationsRequired}` : ''),
+            patch: {
+                paymentMode: 'facilitator', paymentReceipt: receipt,
+                chainSettled: verdict.chainSettled,
+                chainSettlementStatus: verdict.status,
+                chainSettlementReason: verdict.reason,
+                ...(verdict.confirmations != null ? { chainConfirmations: verdict.confirmations } : {}),
+                ...(verdict.rpcAvailable ? {} : { chainRpcAvailable: false }),
+                ...(txHash ? { txHash: String(txHash) } : {}),
+            },
         });
         const report = parsed?.proof ? await verifyEnvelope(parsed, { resolveDid: params.resolveDid, expectItemId: params.expectItemId }) : undefined;
         if (report)
             await trackEvent({ kind: 'delivered', detail: `trust=${report.trust}`, patch: { verificationTrust: report.trust, contentHash: parsed?.contentHash, protocolVerified: report.trust === 'verified' } });
-        return { ok: true, status: retry.status, envelope: parsed, verify: report, payment: { mode, receipt }, metadata, raw: text };
+        return {
+            ok: true, status: retry.status, envelope: parsed, verify: report, metadata, raw: text,
+            payment: {
+                mode, receipt,
+                ...(txHash ? { txHash } : {}),
+                attempted: true, settled: true,
+                settlementUncertain: verdict.status === 'unknown' || verdict.status === 'config_unavailable' || !verdict.rpcAvailable,
+                chainSettled: verdict.chainSettled,
+                chainSettlementStatus: verdict.status,
+                chainSettlementReason: verdict.reason,
+                confirmations: verdict.confirmations,
+                confirmationsRequired: verdict.confirmationsRequired,
+                rpcAvailable: verdict.rpcAvailable,
+            },
+        };
     }
     if (!params.allowLocalDev) {
         return { ok: false, status: 402, error: '需要钱包私钥才能支付 (未提供 privateKey; 本机联调请显式 allowLocalDev)' };