@keelcodes/x402-gate 0.1.0 → 0.1.1

package/dist/index.js

@@ -59,10 +59,13 @@ function buildAccepts(opts, amount) {
             const target = a.payTo ?? opts.payTo;
             if (!target)
                 throw new Error('x402 gate: payTo is required (top-level or per accept)');
+            const priced = a.amount ?? amount;
+            if (!priced)
+                throw new Error('x402 gate: every accept needs an `amount` (or a top-level amount)');
             const base = {
                 scheme: 'exact',
                 network: a.network,
-                amount: a.amount ?? amount,
+                amount: priced,
                 asset: a.asset,
                 payTo: target,
                 maxTimeoutSeconds: a.maxTimeoutSeconds ?? 300,
@@ -206,6 +209,15 @@ function hasPlatformCredential(req, extra) {
         return typeof v === 'string' && v.trim().length > 0;
     });
 }
+/**
+ * 本次调用的价格（最小单位）。
+ * 优先级：`amountFor(path)` > 顶层 `amount` > 第一个带价格的 accept。
+ * 只配 `accepts`（多币种）而不写顶层 `amount` 是文档里的标准用法，必须从 accept 取价，
+ * 否则 `amount` 为 undefined 会命中下面的「不收费」分支，等于整站免费。
+ */
+function resolveAmount(opts) {
+    return opts.amount ?? opts.accepts?.find((a) => a.amount)?.amount;
+}
 /**
  * 网关核心：返回「放行」或「402 挑战」，与框架无关。
  * 结算失败一律 402（携带原因），避免把上游错误变成 500。
@@ -216,9 +228,13 @@ async function authorizeX402(opts, req) {
         return { action: 'pass' };
     if (hasPlatformCredential(req, opts.passthroughHeaders ?? []))
         return { action: 'pass' };
-    const amount = opts.amountFor ? opts.amountFor(req.path) : opts.amount;
-    if (!amount)
+    const amount = opts.amountFor ? opts.amountFor(req.path) : resolveAmount(opts);
+    // `amountFor` 返回 null = 该路径明确免费；但「压根没配价格」必须报错，
+    // 不能静默放行（否则漏配一个 amount 就等于整站免费）。
+    if (amount === null)
         return { action: 'pass' };
+    if (!amount)
+        throw new Error('x402 gate: no price configured (set `amount` or a priced accept)');
     const signature = paymentSignature(req);
     // 免费额度：只对「本来要收费、且没带付款凭证」的请求计数；已付款的正常走结算。
     if (opts.freeQuota && !signature) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keelcodes/x402-gate",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Keel x402 v2 resource gate — Express / Fetch / Next.js adapters (no keys, no chain access)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",