@m2msentinel/sdk 1.1.2 → 1.2.0

package/README.md

@@ -40,13 +40,13 @@ Autonomous agents handling value must never rely on a single oracle or heuristic
 npm install @m2msentinel/sdk
 
 # Or unscoped package
-npm install m2m-sentinel-sdk@1.1.2
+npm install m2m-sentinel-sdk@1.2.0
 ```
 
 ### Python (PyPI)
 
 ```bash
-pip install m2m-sentinel==1.1.2
+pip install m2m-sentinel==1.2.0
 ```
 
 ### MCP Server (Model Context Protocol)

package/agent_adapter.js

@@ -67,7 +67,7 @@ class M2MSentinelActionProvider {
 
     const headers = {
       Accept: 'application/json',
-      'User-Agent': 'M2MSentinel-AgentKit/1.1.2',
+      'User-Agent': 'M2MSentinel-AgentKit/1.2.0',
       ...options.headers
     };
     if (this.apiKey && !headers['x-api-key']) {

package/mcp_server.js

@@ -8,7 +8,7 @@ const readline = require('readline');
 let BASE_URL = process.env.M2M_SENTINEL_BASE_URL || 'https://api.m2msentinel.com';
 let API_KEY = process.env.M2M_SENTINEL_API_KEY || '';
 const TIMEOUT_MS = Number(process.env.M2M_SENTINEL_TIMEOUT_MS || 30000);
-const VERSION = '1.1.2';
+const VERSION = '1.2.0';
 
 const TOOLS = [
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m2msentinel/sdk",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "mcpName": "io.github.m2m-sentinel/m2m-sentinel-sdk",
   "publishConfig": {
     "access": "public"

package/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "m2m-sentinel-sdk",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "Source-distributed TypeScript client for M2M Sentinel Base capability intelligence API",
   "main": "index.ts",
   "types": "index.ts",

package/typescript/x402.ts

@@ -23,11 +23,40 @@ export interface X402PaymentChallenge {
   recipient?: string;
   amountUnits?: string;
   maxAmountRequired?: string;
+  /** x402 v2 nests the offer here. Its presence selects the v2 envelope. */
+  accepts?: any[];
+  resource?: any;
+  asset?: string;
+  network?: string;
+  extra?: { name?: string; version?: string };
+  maxTimeoutSeconds?: number;
   amount?: string;
   price?: string;
   [key: string]: any;
 }
 
+/** The canonical x402 v2 payment payload. */
+export interface X402SignedAuthorizationV2 {
+  x402Version: 2;
+  resource?: any;
+  /** The chosen offer echoed back verbatim. The server deep-equality matches
+   *  this against its own requirements to learn which offer is being paid. */
+  accepted: any;
+  payload: {
+    authorization: {
+      from: string;
+      to: string;
+      value: string;
+      validAfter: string;
+      validBefore: string;
+      nonce: string;
+    };
+    signature: string;
+  };
+}
+
+export type X402SignedPayload = X402SignedAuthorization | X402SignedAuthorizationV2;
+
 export interface X402SignedAuthorization {
   x402Version: number;
   scheme: string;
@@ -91,7 +120,7 @@ export class X402SignerClient {
     this.maxAmountUnits = parsePriceToUnits(this.maxPriceUsd, 6);
   }
 
-  async signPaymentAuthorization(challenge: X402PaymentChallenge = {}): Promise<X402SignedAuthorization> {
+  async signPaymentAuthorization(challenge: X402PaymentChallenge = {}): Promise<X402SignedPayload> {
     if (!this.wallet) {
       throw new Error('Signer wallet is required to sign x402 payment authorization');
     }
@@ -101,33 +130,67 @@ export class X402SignerClient {
     const tokenContract = BASE_USDC_CONTRACT; // Base USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)
     const payTo = EXPECTED_PAYOUT_RECIPIENT; // M2M Sentinel Payout (0x6d6c398390cfb88f1cd42715b84906a0bd6652aa)
 
+    // x402 v2 nests the offer under `accepts` and is identified by its presence.
+    // Reading only the flat shape made every guard below miss silently: they
+    // compared undefined and passed, and the amount fell back to a hardcoded
+    // default, signing for less than the server demanded.
+    const isV2 = Array.isArray(challenge.accepts) && challenge.accepts.length > 0;
+    const offer: any = isV2 ? challenge.accepts![0] : challenge;
+
+    const offeredChainId = typeof offer.network === 'string' && offer.network.startsWith('eip155:')
+      ? Number(offer.network.slice('eip155:'.length))
+      : (offer.chainId || challenge.chainId);
+    // v2 carries the address in `asset`; the flat shape carries a symbol there
+    // and the address in `assetContract`. Compare addresses to addresses only.
+    const offeredAsset = [offer.assetContract, challenge.assetContract, offer.asset, challenge.asset]
+      .find((value: any) => typeof value === 'string' && /^0x[0-9a-fA-F]{40}$/.test(value)) || null;
+    const offeredPayTo = offer.payTo || offer.recipient || challenge.payTo;
+    const offeredTokenName = (offer.extra && offer.extra.name) || challenge.tokenName;
+    const offeredTokenVersion = (offer.extra && offer.extra.version) || challenge.tokenVersion;
+
     // 2. STRICT CHALLENGE INTEGRITY CHECKS (Refuse if challenge alters network, asset, or recipient)
-    if (challenge.chainId && Number(challenge.chainId) !== BASE_CHAIN_ID) {
-      throw new Error(`[x402 Security Policy] Refusing to sign on unverified network chainId: ${challenge.chainId}. Autonomous signer strictly requires Base Mainnet (8453).`);
+    if (offeredChainId && Number(offeredChainId) !== BASE_CHAIN_ID) {
+      throw new Error(`[x402 Security Policy] Refusing to sign on unverified network chainId: ${offeredChainId}. Autonomous signer strictly requires Base Mainnet (8453).`);
     }
-    if (challenge.assetContract && challenge.assetContract.toLowerCase() !== BASE_USDC_CONTRACT.toLowerCase()) {
-      throw new Error(`[x402 Security Policy] Refusing to sign for unapproved asset: ${challenge.assetContract}. Autonomous signer strictly requires Base USDC (${BASE_USDC_CONTRACT}).`);
+    if (offeredAsset && offeredAsset.toLowerCase() !== BASE_USDC_CONTRACT.toLowerCase()) {
+      throw new Error(`[x402 Security Policy] Refusing to sign for unapproved asset: ${offeredAsset}. Autonomous signer strictly requires Base USDC (${BASE_USDC_CONTRACT}).`);
     }
-    if (challenge.payTo && challenge.payTo.toLowerCase() !== EXPECTED_PAYOUT_RECIPIENT.toLowerCase()) {
-      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected recipient: ${challenge.payTo}. Autonomous signer strictly requires ${EXPECTED_PAYOUT_RECIPIENT}.`);
+    if (offeredPayTo && offeredPayTo.toLowerCase() !== EXPECTED_PAYOUT_RECIPIENT.toLowerCase()) {
+      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected recipient: ${offeredPayTo}. Autonomous signer strictly requires ${EXPECTED_PAYOUT_RECIPIENT}.`);
     }
-    if (challenge.tokenName && challenge.tokenName !== 'USD Coin') {
-      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected tokenName: ${challenge.tokenName}. Expected USD Coin.`);
+    if (offeredTokenName && offeredTokenName !== 'USD Coin') {
+      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected tokenName: ${offeredTokenName}. Expected USD Coin.`);
     }
-    if (challenge.tokenVersion && challenge.tokenVersion !== '2') {
-      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected tokenVersion: ${challenge.tokenVersion}. Expected 2.`);
+    if (offeredTokenVersion && offeredTokenVersion !== '2') {
+      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected tokenVersion: ${offeredTokenVersion}. Expected 2.`);
     }
 
     // 3. STRICT LOCAL PRICE CEILING CHECK
-    const requestedAmountUnits = challenge.maxAmountRequired || challenge.amountUnits || parsePriceToUnits(challenge.amount || challenge.price || '$0.005', 6).toString();
+    // Never invent a price. A guessed amount produces an authorization the
+    // server refuses, which is indistinguishable from a rejected payment.
+    const rawAmount = offer.amount ?? offer.maxAmountRequired ??
+      challenge.maxAmountRequired ?? challenge.amountUnits ?? challenge.amount ?? challenge.price;
+    let requestedAmountUnits: string | null = null;
+    if (typeof rawAmount === 'number' && Number.isInteger(rawAmount) && rawAmount > 0) {
+      requestedAmountUnits = String(rawAmount);
+    } else if (typeof rawAmount === 'string' && /^[0-9]+$/.test(rawAmount.trim())) {
+      requestedAmountUnits = rawAmount.trim();
+    } else if (typeof rawAmount === 'string' && /[$.]/.test(rawAmount)) {
+      requestedAmountUnits = parsePriceToUnits(rawAmount, 6).toString();
+    }
+    if (!requestedAmountUnits || !/^[0-9]+$/.test(requestedAmountUnits) || BigInt(requestedAmountUnits) <= BigInt(0)) {
+      throw new Error('[x402] The challenge carried no readable amount. Refusing to guess a price.');
+    }
     if (BigInt(requestedAmountUnits) > this.maxAmountUnits) {
       throw new Error(`[x402 Security Policy] Requested amount (${requestedAmountUnits} units) exceeds local client authorized price ceiling (${this.maxAmountUnits.toString()} units / $${this.maxPriceUsd}).`);
     }
     const amountUnits = requestedAmountUnits;
 
     const now = Math.floor(Date.now() / 1000);
-    const validAfter = now - 60;
-    const validBefore = now + 3600;
+    // v2 servers bound the window with `maxTimeoutSeconds`; a longer window
+    // than advertised is not more permissive, just outside what settles.
+    const validAfter: any = isV2 ? '0' : now - 60;
+    const validBefore: any = isV2 ? String(now + (Number(offer.maxTimeoutSeconds) || 120)) : now + 3600;
     
     // Generate 32-byte hex nonce
     let nonce = '0x';
@@ -199,6 +262,30 @@ export class X402SignerClient {
       ? signature 
       : '0x' + r.slice(2) + s.slice(2) + v.toString(16).padStart(2, '0');
 
+    if (isV2) {
+      // The canonical v2 envelope. Omitting `accepted` does not read as "no
+      // payment": it crashes the server's offer matcher, which then answers 402
+      // with an opaque body. There is deliberately no top-level scheme/network
+      // in v2 -- both live inside `accepted`.
+      return {
+        x402Version: 2,
+        resource: challenge.resource,
+        accepted: offer,
+        payload: {
+          authorization: {
+            from: fromAddress,
+            to: payTo,
+            value: amountUnits.toString(),
+            validAfter: String(validAfter),
+            validBefore: String(validBefore),
+            nonce
+          },
+          signature: flatSignature
+        }
+      };
+    }
+
+    // Legacy flat envelope, for servers that do not advertise `accepts`.
     return {
       x402Version: 2,
       scheme: 'eip3009',
@@ -222,7 +309,7 @@ export class X402SignerClient {
 
   async fetchWithAutoPayment(path: string, options: any = {}): Promise<any> {
     const url = path.startsWith('http') ? path : `${this.baseUrl}/${path.replace(/^\/+/, '')}`;
-    const headers = { 'Accept': 'application/json', 'User-Agent': '@m2msentinel/sdk-ts/1.1.2', ...(options.headers || {}) };
+    const headers = { 'Accept': 'application/json', 'User-Agent': '@m2msentinel/sdk-ts/1.2.0', ...(options.headers || {}) };
 
     let res = await fetch(url, { method: options.method || 'GET', headers, body: options.body });
     if (res.status !== 402) {
@@ -235,7 +322,9 @@ export class X402SignerClient {
     if (!challenge) {
       try {
         const bodyJson = await res.clone().json();
-        challenge = bodyJson.accepts?.[0] || bodyJson.paymentRequired;
+        // Pass the whole PaymentRequired, not just accepts[0]: the signer
+        // needs `resource` and must echo the offer back as `accepted`.
+        challenge = bodyJson.accepts ? bodyJson : bodyJson.paymentRequired;
       } catch {
         // Body was not JSON
       }

package/x402_signer.js

@@ -61,33 +61,69 @@ class X402SignerClient {
     const tokenContract = BASE_USDC_CONTRACT; // Base USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)
     const payTo = EXPECTED_PAYOUT_RECIPIENT; // M2M Sentinel Payout (0x6d6c398390cfb88f1cd42715b84906a0bd6652aa)
 
+    // x402 v2 nests the offer under `accepts` and is identified by its presence.
+    // Reading only the flat shape made every check below miss silently: the
+    // guards passed vacuously because the fields they read were undefined, and
+    // the amount fell back to a hardcoded default, signing for less than the
+    // server demanded. Read the offer first, keep the flat shape as fallback.
+    const isV2 = Array.isArray(challenge.accepts) && challenge.accepts.length > 0;
+    const offer = isV2 ? challenge.accepts[0] : challenge;
+
+    const offeredChainId = typeof offer.network === 'string' && offer.network.startsWith('eip155:')
+      ? Number(offer.network.slice('eip155:'.length))
+      : (offer.chainId || challenge.chainId);
+    // v2 carries the address in `asset`; the flat shape carries a symbol there
+    // and the address in `assetContract`. Compare addresses to addresses only.
+    const offeredAsset = [offer.assetContract, challenge.assetContract, offer.asset, challenge.asset]
+      .find((value) => typeof value === 'string' && /^0x[0-9a-fA-F]{40}$/.test(value)) || null;
+    const offeredPayTo = offer.payTo || offer.recipient || challenge.payTo;
+    const offeredTokenName = (offer.extra && offer.extra.name) || challenge.tokenName;
+    const offeredTokenVersion = (offer.extra && offer.extra.version) || challenge.tokenVersion;
+
     // 2. STRICT CHALLENGE INTEGRITY CHECKS (Refuse if challenge alters network, asset, or recipient)
-    if (challenge.chainId && Number(challenge.chainId) !== BASE_CHAIN_ID) {
-      throw new Error(`[x402 Security Policy] Refusing to sign on unverified network chainId: ${challenge.chainId}. Autonomous signer strictly requires Base Mainnet (8453).`);
+    if (offeredChainId && Number(offeredChainId) !== BASE_CHAIN_ID) {
+      throw new Error(`[x402 Security Policy] Refusing to sign on unverified network chainId: ${offeredChainId}. Autonomous signer strictly requires Base Mainnet (8453).`);
     }
-    if (challenge.assetContract && challenge.assetContract.toLowerCase() !== BASE_USDC_CONTRACT.toLowerCase()) {
-      throw new Error(`[x402 Security Policy] Refusing to sign for unapproved asset: ${challenge.assetContract}. Autonomous signer strictly requires Base USDC (${BASE_USDC_CONTRACT}).`);
+    if (offeredAsset && offeredAsset.toLowerCase() !== BASE_USDC_CONTRACT.toLowerCase()) {
+      throw new Error(`[x402 Security Policy] Refusing to sign for unapproved asset: ${offeredAsset}. Autonomous signer strictly requires Base USDC (${BASE_USDC_CONTRACT}).`);
     }
-    if (challenge.payTo && challenge.payTo.toLowerCase() !== EXPECTED_PAYOUT_RECIPIENT.toLowerCase()) {
-      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected recipient: ${challenge.payTo}. Autonomous signer strictly requires ${EXPECTED_PAYOUT_RECIPIENT}.`);
+    if (offeredPayTo && offeredPayTo.toLowerCase() !== EXPECTED_PAYOUT_RECIPIENT.toLowerCase()) {
+      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected recipient: ${offeredPayTo}. Autonomous signer strictly requires ${EXPECTED_PAYOUT_RECIPIENT}.`);
     }
-    if (challenge.tokenName && challenge.tokenName !== EIP712_TOKEN_NAME) {
-      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected tokenName: ${challenge.tokenName}. Expected ${EIP712_TOKEN_NAME}.`);
+    if (offeredTokenName && offeredTokenName !== EIP712_TOKEN_NAME) {
+      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected tokenName: ${offeredTokenName}. Expected ${EIP712_TOKEN_NAME}.`);
     }
-    if (challenge.tokenVersion && challenge.tokenVersion !== EIP712_TOKEN_VERSION) {
-      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected tokenVersion: ${challenge.tokenVersion}. Expected ${EIP712_TOKEN_VERSION}.`);
+    if (offeredTokenVersion && offeredTokenVersion !== EIP712_TOKEN_VERSION) {
+      throw new Error(`[x402 Security Policy] Refusing to sign for unexpected tokenVersion: ${offeredTokenVersion}. Expected ${EIP712_TOKEN_VERSION}.`);
     }
 
     // 3. STRICT LOCAL PRICE CEILING CHECK
-    const requestedAmountUnits = challenge.maxAmountRequired || challenge.amountUnits || parsePriceToUnits(challenge.amount || challenge.price || '$0.005', 6).toString();
+    // Never invent a price. A guessed amount produces an authorization the
+    // server refuses, which is indistinguishable from a rejected payment.
+    // v2 states base units ("20000"); the flat shape states a price ("$0.005").
+    const rawAmount = offer.amount ?? offer.maxAmountRequired ??
+      challenge.maxAmountRequired ?? challenge.amountUnits ?? challenge.amount ?? challenge.price;
+    let requestedAmountUnits = null;
+    if (typeof rawAmount === 'number' && Number.isInteger(rawAmount) && rawAmount > 0) {
+      requestedAmountUnits = String(rawAmount);
+    } else if (typeof rawAmount === 'string' && /^\d+$/.test(rawAmount.trim())) {
+      requestedAmountUnits = rawAmount.trim();
+    } else if (typeof rawAmount === 'string' && /[$.]/.test(rawAmount)) {
+      requestedAmountUnits = parsePriceToUnits(rawAmount, 6).toString();
+    }
+    if (!requestedAmountUnits || !/^\d+$/.test(requestedAmountUnits) || BigInt(requestedAmountUnits) <= 0n) {
+      throw new Error('[x402] The challenge carried no readable amount. Refusing to guess a price.');
+    }
     if (BigInt(requestedAmountUnits) > this.maxAmountUnits) {
       throw new Error(`[x402 Security Policy] Requested amount (${requestedAmountUnits} units) exceeds local client authorized price ceiling (${this.maxAmountUnits.toString()} units / $${this.maxPriceUsd}).`);
     }
     const amountUnits = requestedAmountUnits;
 
     const now = Math.floor(Date.now() / 1000);
-    const validAfter = now - 60;
-    const validBefore = now + 3600;
+    // v2 servers bound the window with `maxTimeoutSeconds`; a longer window
+    // than advertised is not more permissive, just outside what settles.
+    const validAfter = isV2 ? '0' : now - 60;
+    const validBefore = isV2 ? String(now + (Number(offer.maxTimeoutSeconds) || 120)) : now + 3600;
     const nonce = '0x' + crypto.randomBytes(32).toString('hex');
 
     const domain = {
@@ -141,6 +177,33 @@ class X402SignerClient {
       v = signature.v;
     }
 
+    if (isV2) {
+      // The canonical v2 envelope. `accepted` is the offer echoed back verbatim:
+      // the server deep-equality matches it against its own requirements to learn
+      // which offer is being paid. Omitting it does not read as "no payment" --
+      // it crashes the server's matcher, which then answers 402 with an opaque
+      // body. Reconstructing the offer fails the same way, so it is passed
+      // through untouched. Note there is no top-level scheme/network in v2:
+      // both live inside `accepted`.
+      return {
+        x402Version: 2,
+        resource: challenge.resource,
+        accepted: offer,
+        payload: {
+          authorization: {
+            from: message.from,
+            to: message.to,
+            value: message.value,
+            validAfter: message.validAfter,
+            validBefore: message.validBefore,
+            nonce: message.nonce
+          },
+          signature: typeof signature === 'string' ? signature : `0x${r.slice(2)}${s.slice(2)}${v.toString(16)}`
+        }
+      };
+    }
+
+    // Legacy flat envelope, for servers that do not advertise `accepts`.
     return {
       x402Version: 2,
       scheme: 'eip3009',
@@ -202,7 +265,7 @@ class X402SignerClient {
         path: url.pathname + url.search,
         method: options.method || 'GET',
         headers: {
-          'User-Agent': 'M2M-Sentinel-X402Signer/1.1.2',
+          'User-Agent': 'M2M-Sentinel-X402Signer/1.2.0',
           'Accept': 'application/json',
           ...(options.headers || {})
         },