@dexterai/x402 1.8.1 → 1.9.0

package/dist/server/index.cjs

@@ -193,12 +193,12 @@ var FacilitatorClient = class {
     const kind = supported.kinds.find(
       (k) => k.x402Version === 2 && k.scheme === "exact" && k.network === network
     );
-    if (!kind?.extra?.feePayer) {
+    if (!kind) {
       throw new Error(
-        `Facilitator does not support network "${network}" with scheme "exact", or feePayer not provided`
+        `Facilitator does not support network "${network}" with scheme "exact"`
       );
     }
-    return kind.extra.feePayer;
+    return kind.extra?.feePayer;
   }
   /**
    * Get extra data for a network (feePayer, decimals, EIP-712 data, etc.)
@@ -748,7 +748,7 @@ if (btn) {
       if (!accept) throw new Error('No payment method available');
 
       const payTo = new PublicKey(accept.payTo);
-      const amount = BigInt(accept.amount || accept.maxAmountRequired);
+      const amount = BigInt(accept.amount ?? accept.maxAmountRequired);
       const mintPubkey = new PublicKey(accept.asset);
       const feePayer = accept.extra?.feePayer ? new PublicKey(accept.extra.feePayer) : provider.publicKey;
       const userPubkey = provider.publicKey;
@@ -855,7 +855,7 @@ function generatePaywallHtml(paymentRequiredHeader, requestUrl, method, config,
     const decoded = JSON.parse(Buffer.from(paymentRequiredHeader, "base64").toString());
     const accept = decoded.accepts?.[0];
     if (accept) {
-      const amount = accept.amount || accept.maxAmountRequired || "0";
+      const amount = accept.amount ?? accept.maxAmountRequired ?? "0";
       const decimals = accept.extra?.decimals || 6;
       price = (Number(amount) / Math.pow(10, decimals)).toFixed(decimals > 4 ? 4 : 2);
       network = accept.network || "";
@@ -1200,14 +1200,8 @@ function x402AccessPass(config) {
 }
 
 // src/server/dynamic-pricing.ts
-function simpleHash(str) {
-  let hash = 2166136261;
-  for (let i = 0; i < str.length; i++) {
-    hash ^= str.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
-}
+var import_crypto2 = require("crypto");
+var QUOTE_MAX_AGE_SECONDS = 300;
 function createDynamicPricing(config) {
   const fullConfig = {
     unitSize: config.unitSize,
@@ -1222,7 +1216,8 @@ function createDynamicPricing(config) {
   if (ratePerUnit <= 0) throw new Error("ratePerUnit must be positive");
   if (minUsd < 0) throw new Error("minUsd cannot be negative");
   if (maxUsd < minUsd) throw new Error("maxUsd must be >= minUsd");
-  function buildHashInput(input) {
+  const hmacSecret = (0, import_crypto2.randomBytes)(32);
+  function signQuote(input, timestamp) {
     const configStr = JSON.stringify({
       unitSize,
       ratePerUnit,
@@ -1230,7 +1225,8 @@ function createDynamicPricing(config) {
       maxUsd: maxUsd === Infinity ? "none" : maxUsd,
       roundingMode
     });
-    return `${input}|${configStr}`;
+    const data = `${input}|${configStr}|${timestamp}`;
+    return (0, import_crypto2.createHmac)("sha256", hmacSecret).update(data).digest("hex").slice(0, 16);
   }
   function calculate(input) {
     const inputLength = input.length;
@@ -1255,7 +1251,9 @@ function createDynamicPricing(config) {
     usdAmount = Math.min(maxUsd, usdAmount);
     const multiplier = Math.pow(10, decimals);
     const amountAtomic = Math.floor(usdAmount * multiplier).toString();
-    const quoteHash = simpleHash(buildHashInput(input));
+    const timestamp = Math.floor(Date.now() / 1e3);
+    const mac = signQuote(input, timestamp);
+    const quoteHash = `${timestamp}.${mac}`;
     return {
       amountAtomic,
       usdAmount,
@@ -1266,8 +1264,20 @@ function createDynamicPricing(config) {
   }
   function validateQuote(input, quoteHash) {
     if (!quoteHash) return false;
-    const expectedHash = simpleHash(buildHashInput(input));
-    return expectedHash === quoteHash;
+    const dotIndex = quoteHash.indexOf(".");
+    if (dotIndex === -1) return false;
+    const timestamp = parseInt(quoteHash.slice(0, dotIndex), 10);
+    const mac = quoteHash.slice(dotIndex + 1);
+    if (isNaN(timestamp) || !mac) return false;
+    const age = Math.floor(Date.now() / 1e3) - timestamp;
+    if (age < 0 || age > QUOTE_MAX_AGE_SECONDS) return false;
+    const expectedMac = signQuote(input, timestamp);
+    if (mac.length !== expectedMac.length) return false;
+    let mismatch = 0;
+    for (let i = 0; i < mac.length; i++) {
+      mismatch |= mac.charCodeAt(i) ^ expectedMac.charCodeAt(i);
+    }
+    return mismatch === 0;
   }
   return {
     calculate,
@@ -1282,7 +1292,7 @@ function formatPricing(config) {
 }
 
 // src/server/token-pricing.ts
-var import_crypto2 = require("crypto");
+var import_crypto3 = require("crypto");
 var import_tiktoken = require("tiktoken");
 
 // src/server/model-registry.ts
@@ -1880,7 +1890,7 @@ function countTokens(text, model = DEFAULT_MODEL) {
 }
 function generateQuoteHash(prompt, model, rate, tokens) {
   const configString = JSON.stringify({ model, rate, tokens });
-  return (0, import_crypto2.createHash)("sha256").update(prompt + configString).digest("hex").slice(0, 16);
+  return (0, import_crypto3.createHash)("sha256").update(prompt + configString).digest("hex").slice(0, 16);
 }
 function createTokenPricing(config = {}) {
   const model = config.model ?? DEFAULT_MODEL;