@dexterai/x402 1.8.2 → 1.9.0

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { P as PaymentAccept, V as VerifyResponse, S as SettleResponse, c as PayToProvider, d as PaymentRequired } from '../types-DYLi7SuF.cjs';
-export { g as AccessPassClaims, A as AccessPassClientConfig, b as AccessPassInfo, a as AccessPassTier, B as BASE_MAINNET_NETWORK, D as DEXTER_FACILITATOR_URL, e as PayToContext, f as PayToProviderDefaults, h as SOLANA_MAINNET_NETWORK, i as USDC_BASE, U as USDC_MINT } from '../types-DYLi7SuF.cjs';
+import { P as PaymentAccept, V as VerifyResponse, S as SettleResponse, c as PayToProvider, d as PaymentRequired } from '../types-BQvaF8lB.cjs';
+export { g as AccessPassClaims, A as AccessPassClientConfig, b as AccessPassInfo, a as AccessPassTier, B as BASE_MAINNET_NETWORK, D as DEXTER_FACILITATOR_URL, e as PayToContext, f as PayToProviderDefaults, h as SOLANA_MAINNET_NETWORK, i as USDC_BASE, U as USDC_MINT } from '../types-BQvaF8lB.cjs';
 import { Request, RequestHandler } from 'express';
 
 /**

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PaymentAccept, V as VerifyResponse, S as SettleResponse, c as PayToProvider, d as PaymentRequired } from '../types-DYLi7SuF.js';
-export { g as AccessPassClaims, A as AccessPassClientConfig, b as AccessPassInfo, a as AccessPassTier, B as BASE_MAINNET_NETWORK, D as DEXTER_FACILITATOR_URL, e as PayToContext, f as PayToProviderDefaults, h as SOLANA_MAINNET_NETWORK, i as USDC_BASE, U as USDC_MINT } from '../types-DYLi7SuF.js';
+import { P as PaymentAccept, V as VerifyResponse, S as SettleResponse, c as PayToProvider, d as PaymentRequired } from '../types-BQvaF8lB.js';
+export { g as AccessPassClaims, A as AccessPassClientConfig, b as AccessPassInfo, a as AccessPassTier, B as BASE_MAINNET_NETWORK, D as DEXTER_FACILITATOR_URL, e as PayToContext, f as PayToProviderDefaults, h as SOLANA_MAINNET_NETWORK, i as USDC_BASE, U as USDC_MINT } from '../types-BQvaF8lB.js';
 import { Request, RequestHandler } from 'express';
 
 /**

package/dist/server/index.js

@@ -681,7 +681,7 @@ if (btn) {
       if (!accept) throw new Error('No payment method available');
 
       const payTo = new PublicKey(accept.payTo);
-      const amount = BigInt(accept.amount || accept.maxAmountRequired);
+      const amount = BigInt(accept.amount ?? accept.maxAmountRequired);
       const mintPubkey = new PublicKey(accept.asset);
       const feePayer = accept.extra?.feePayer ? new PublicKey(accept.extra.feePayer) : provider.publicKey;
       const userPubkey = provider.publicKey;
@@ -788,7 +788,7 @@ function generatePaywallHtml(paymentRequiredHeader, requestUrl, method, config,
     const decoded = JSON.parse(Buffer.from(paymentRequiredHeader, "base64").toString());
     const accept = decoded.accepts?.[0];
     if (accept) {
-      const amount = accept.amount || accept.maxAmountRequired || "0";
+      const amount = accept.amount ?? accept.maxAmountRequired ?? "0";
       const decimals = accept.extra?.decimals || 6;
       price = (Number(amount) / Math.pow(10, decimals)).toFixed(decimals > 4 ? 4 : 2);
       network = accept.network || "";
@@ -1133,14 +1133,8 @@ function x402AccessPass(config) {
 }
 
 // src/server/dynamic-pricing.ts
-function simpleHash(str) {
-  let hash = 2166136261;
-  for (let i = 0; i < str.length; i++) {
-    hash ^= str.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
-}
+import { createHmac, randomBytes } from "crypto";
+var QUOTE_MAX_AGE_SECONDS = 300;
 function createDynamicPricing(config) {
   const fullConfig = {
     unitSize: config.unitSize,
@@ -1155,7 +1149,8 @@ function createDynamicPricing(config) {
   if (ratePerUnit <= 0) throw new Error("ratePerUnit must be positive");
   if (minUsd < 0) throw new Error("minUsd cannot be negative");
   if (maxUsd < minUsd) throw new Error("maxUsd must be >= minUsd");
-  function buildHashInput(input) {
+  const hmacSecret = randomBytes(32);
+  function signQuote(input, timestamp) {
     const configStr = JSON.stringify({
       unitSize,
       ratePerUnit,
@@ -1163,7 +1158,8 @@ function createDynamicPricing(config) {
       maxUsd: maxUsd === Infinity ? "none" : maxUsd,
       roundingMode
     });
-    return `${input}|${configStr}`;
+    const data = `${input}|${configStr}|${timestamp}`;
+    return createHmac("sha256", hmacSecret).update(data).digest("hex").slice(0, 16);
   }
   function calculate(input) {
     const inputLength = input.length;
@@ -1188,7 +1184,9 @@ function createDynamicPricing(config) {
     usdAmount = Math.min(maxUsd, usdAmount);
     const multiplier = Math.pow(10, decimals);
     const amountAtomic = Math.floor(usdAmount * multiplier).toString();
-    const quoteHash = simpleHash(buildHashInput(input));
+    const timestamp = Math.floor(Date.now() / 1e3);
+    const mac = signQuote(input, timestamp);
+    const quoteHash = `${timestamp}.${mac}`;
     return {
       amountAtomic,
       usdAmount,
@@ -1199,8 +1197,20 @@ function createDynamicPricing(config) {
   }
   function validateQuote(input, quoteHash) {
     if (!quoteHash) return false;
-    const expectedHash = simpleHash(buildHashInput(input));
-    return expectedHash === quoteHash;
+    const dotIndex = quoteHash.indexOf(".");
+    if (dotIndex === -1) return false;
+    const timestamp = parseInt(quoteHash.slice(0, dotIndex), 10);
+    const mac = quoteHash.slice(dotIndex + 1);
+    if (isNaN(timestamp) || !mac) return false;
+    const age = Math.floor(Date.now() / 1e3) - timestamp;
+    if (age < 0 || age > QUOTE_MAX_AGE_SECONDS) return false;
+    const expectedMac = signQuote(input, timestamp);
+    if (mac.length !== expectedMac.length) return false;
+    let mismatch = 0;
+    for (let i = 0; i < mac.length; i++) {
+      mismatch |= mac.charCodeAt(i) ^ expectedMac.charCodeAt(i);
+    }
+    return mismatch === 0;
   }
   return {
     calculate,