@dexterai/x402 1.8.2 → 1.9.1

package/dist/server/index.cjs

@@ -37,6 +37,7 @@ __export(server_exports, {
   MODEL_PRICING_MAP: () => MODEL_PRICING_MAP,
   MODEL_REGISTRY: () => MODEL_REGISTRY,
   SOLANA_MAINNET_NETWORK: () => SOLANA_MAINNET_NETWORK,
+  SPONSORED_ACCESS_EXTENSION_KEY: () => import_x402_ads_types.SPONSORED_ACCESS_EXTENSION_KEY,
   USDC_BASE: () => USDC_BASE,
   USDC_MINT: () => USDC_MINT,
   countTokens: () => countTokens,
@@ -577,9 +578,19 @@ function x402Middleware(config) {
       res.setHeader("PAYMENT-RESPONSE", encodeBase64Json(paymentResponseData));
       if (config.sponsoredAccess && settleResult.extensions?.["sponsored-access"]) {
         const extData = settleResult.extensions["sponsored-access"];
-        const recs = extData?.info?.recommendations;
+        const recs = extData?.info?.recommendations ?? extData?.recommendations;
         if (recs && recs.length > 0) {
           log("Injecting sponsored-access recommendations into response");
+          if (typeof config.sponsoredAccess === "object" && config.sponsoredAccess.onMatch) {
+            try {
+              config.sponsoredAccess.onMatch(recs, {
+                transaction: settleResult.transaction,
+                network: settledNetwork,
+                payer: verifyResult.payer ?? ""
+              });
+            } catch {
+            }
+          }
           const originalJson = res.json.bind(res);
           res.json = function patchedJson(body) {
             if (typeof config.sponsoredAccess === "object" && config.sponsoredAccess.inject) {
@@ -748,7 +759,7 @@ if (btn) {
       if (!accept) throw new Error('No payment method available');
 
       const payTo = new PublicKey(accept.payTo);
-      const amount = BigInt(accept.amount || accept.maxAmountRequired);
+      const amount = BigInt(accept.amount ?? accept.maxAmountRequired);
       const mintPubkey = new PublicKey(accept.asset);
       const feePayer = accept.extra?.feePayer ? new PublicKey(accept.extra.feePayer) : provider.publicKey;
       const userPubkey = provider.publicKey;
@@ -855,7 +866,7 @@ function generatePaywallHtml(paymentRequiredHeader, requestUrl, method, config,
     const decoded = JSON.parse(Buffer.from(paymentRequiredHeader, "base64").toString());
     const accept = decoded.accepts?.[0];
     if (accept) {
-      const amount = accept.amount || accept.maxAmountRequired || "0";
+      const amount = accept.amount ?? accept.maxAmountRequired ?? "0";
       const decimals = accept.extra?.decimals || 6;
       price = (Number(amount) / Math.pow(10, decimals)).toFixed(decimals > 4 ? 4 : 2);
       network = accept.network || "";
@@ -1200,14 +1211,8 @@ function x402AccessPass(config) {
 }
 
 // src/server/dynamic-pricing.ts
-function simpleHash(str) {
-  let hash = 2166136261;
-  for (let i = 0; i < str.length; i++) {
-    hash ^= str.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
-}
+var import_crypto2 = require("crypto");
+var QUOTE_MAX_AGE_SECONDS = 300;
 function createDynamicPricing(config) {
   const fullConfig = {
     unitSize: config.unitSize,
@@ -1222,7 +1227,8 @@ function createDynamicPricing(config) {
   if (ratePerUnit <= 0) throw new Error("ratePerUnit must be positive");
   if (minUsd < 0) throw new Error("minUsd cannot be negative");
   if (maxUsd < minUsd) throw new Error("maxUsd must be >= minUsd");
-  function buildHashInput(input) {
+  const hmacSecret = (0, import_crypto2.randomBytes)(32);
+  function signQuote(input, timestamp) {
     const configStr = JSON.stringify({
       unitSize,
       ratePerUnit,
@@ -1230,7 +1236,8 @@ function createDynamicPricing(config) {
       maxUsd: maxUsd === Infinity ? "none" : maxUsd,
       roundingMode
     });
-    return `${input}|${configStr}`;
+    const data = `${input}|${configStr}|${timestamp}`;
+    return (0, import_crypto2.createHmac)("sha256", hmacSecret).update(data).digest("hex").slice(0, 16);
   }
   function calculate(input) {
     const inputLength = input.length;
@@ -1255,7 +1262,9 @@ function createDynamicPricing(config) {
     usdAmount = Math.min(maxUsd, usdAmount);
     const multiplier = Math.pow(10, decimals);
     const amountAtomic = Math.floor(usdAmount * multiplier).toString();
-    const quoteHash = simpleHash(buildHashInput(input));
+    const timestamp = Math.floor(Date.now() / 1e3);
+    const mac = signQuote(input, timestamp);
+    const quoteHash = `${timestamp}.${mac}`;
     return {
       amountAtomic,
       usdAmount,
@@ -1266,8 +1275,20 @@ function createDynamicPricing(config) {
   }
   function validateQuote(input, quoteHash) {
     if (!quoteHash) return false;
-    const expectedHash = simpleHash(buildHashInput(input));
-    return expectedHash === quoteHash;
+    const dotIndex = quoteHash.indexOf(".");
+    if (dotIndex === -1) return false;
+    const timestamp = parseInt(quoteHash.slice(0, dotIndex), 10);
+    const mac = quoteHash.slice(dotIndex + 1);
+    if (isNaN(timestamp) || !mac) return false;
+    const age = Math.floor(Date.now() / 1e3) - timestamp;
+    if (age < 0 || age > QUOTE_MAX_AGE_SECONDS) return false;
+    const expectedMac = signQuote(input, timestamp);
+    if (mac.length !== expectedMac.length) return false;
+    let mismatch = 0;
+    for (let i = 0; i < mac.length; i++) {
+      mismatch |= mac.charCodeAt(i) ^ expectedMac.charCodeAt(i);
+    }
+    return mismatch === 0;
   }
   return {
     calculate,
@@ -1282,7 +1303,7 @@ function formatPricing(config) {
 }
 
 // src/server/token-pricing.ts
-var import_crypto2 = require("crypto");
+var import_crypto3 = require("crypto");
 var import_tiktoken = require("tiktoken");
 
 // src/server/model-registry.ts
@@ -1880,7 +1901,7 @@ function countTokens(text, model = DEFAULT_MODEL) {
 }
 function generateQuoteHash(prompt, model, rate, tokens) {
   const configString = JSON.stringify({ model, rate, tokens });
-  return (0, import_crypto2.createHash)("sha256").update(prompt + configString).digest("hex").slice(0, 16);
+  return (0, import_crypto3.createHash)("sha256").update(prompt + configString).digest("hex").slice(0, 16);
 }
 function createTokenPricing(config = {}) {
   const model = config.model ?? DEFAULT_MODEL;
@@ -2060,6 +2081,9 @@ function stripePayTo(secretKeyOrConfig) {
   provider._stripeNetwork = caip2Network;
   return provider;
 }
+
+// src/server/index.ts
+var import_x402_ads_types = require("@dexterai/x402-ads-types");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BASE_MAINNET_NETWORK,
@@ -2069,6 +2093,7 @@ function stripePayTo(secretKeyOrConfig) {
   MODEL_PRICING_MAP,
   MODEL_REGISTRY,
   SOLANA_MAINNET_NETWORK,
+  SPONSORED_ACCESS_EXTENSION_KEY,
   USDC_BASE,
   USDC_MINT,
   countTokens,