@paynodelabs/sdk-js 2.0.1 → 2.1.1

package/README.md

@@ -33,7 +33,7 @@ async function main() {
 main();
 ```
 
-### Key Features (v2.0)
+### Key Features (v2.1)
 - **Zero-Wait Checkout**: API response speed drops from 5 seconds to **under 50ms** by using local signatures instead of waiting for on-chain inclusion.
 - **Double-Spend Protection**: 
   - **L1 (Memory)**: High-speed local replay protection via `IdempotencyStore`.

package/dist/client.d.ts

@@ -7,6 +7,7 @@ export declare class PayNodeAgentClient {
     private provider;
     private rpcUrls;
     private maxRetries;
+    private nonceLock;
     private ERC20_ABI;
     private ROUTER_ABI;
     constructor(privateKey: string, rpcUrls?: string | string[], maxRetries?: number);
@@ -15,12 +16,13 @@ export declare class PayNodeAgentClient {
     private _handleX402V2;
     signTransferWithAuthorization(tokenAddr: string, to: string, amount: bigint, validAfter: number, validBefore: number, nonce: string, extra?: Record<string, any>): Promise<ExactEVMPayload>;
     pay(contractAddr: string, tokenAddr: string, merchantAddr: string, amount: bigint, orderId: string): Promise<string>;
-    payWithPermit(contractAddr: string, tokenAddr: string, merchantAddr: string, amount: bigint, orderId: string): Promise<string>;
-    signPermit(tokenAddr: string, spenderAddr: string, amount: bigint, deadlineSeconds?: number): Promise<{
+    payWithPermit(contractAddr: string, tokenAddr: string, merchantAddr: string, amount: bigint, orderId: string, version?: string): Promise<string>;
+    signPermit(tokenAddr: string, spenderAddr: string, amount: bigint, deadlineSeconds?: number, version?: string): Promise<{
         deadline: number;
         v: 27 | 28;
         r: string;
         s: string;
     }>;
+    private _lockNonce;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAID,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAS;IAE3B,OAAO,CAAC,SAAS,CAMf;IAEF,OAAO,CAAC,UAAU,CAGhB;gBAEU,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,GAAG,MAAM,EAAkB,EAAE,UAAU,GAAE,MAAU;YAepF,eAAe;IAgCvB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;YAiDjE,aAAa;IAqFrB,6BAA6B,CACjC,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC9B,OAAO,CAAC,eAAe,CAAC;IA6CrB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAepH,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwB9H,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAE,MAAa;;;;;;CAwCxG"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAID,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAoC;IAErD,OAAO,CAAC,SAAS,CAMf;IAEF,OAAO,CAAC,UAAU,CAAsB;gBAE5B,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,GAAG,MAAM,EAAkB,EAAE,UAAU,GAAE,MAAU;YAepF,eAAe;IAgCvB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;YAoDjE,aAAa;IAuGrB,6BAA6B,CACjC,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC9B,OAAO,CAAC,eAAe,CAAC;IA6CrB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqBpH,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,MAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BrJ,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAE,MAAa,EAAE,OAAO,GAAE,MAAY;;;;;;YAyChH,UAAU;CAYzB"}

package/dist/client.js

@@ -10,6 +10,7 @@ class PayNodeAgentClient {
     provider;
     rpcUrls;
     maxRetries;
+    nonceLock = Promise.resolve();
     ERC20_ABI = [
         "function approve(address spender, uint256 value) public returns (bool)",
         "function allowance(address owner, address spender) public view returns (uint256)",
@@ -17,10 +18,7 @@ class PayNodeAgentClient {
         "function name() view returns (string)",
         "function nonces(address owner) view returns (uint256)"
     ];
-    ROUTER_ABI = [
-        "function pay(address token, address merchant, uint256 amount, bytes32 orderId) public",
-        "function payWithPermit(address payer, address token, address merchant, uint256 amount, bytes32 orderId, uint256 deadline, uint8 v, bytes32 r, bytes32 s) public"
-    ];
+    ROUTER_ABI = constants_1.PAYNODE_ROUTER_ABI;
     constructor(privateKey, rpcUrls = constants_1.BASE_RPC_URLS, maxRetries = 3) {
         this.rpcUrls = Array.isArray(rpcUrls) ? rpcUrls : [rpcUrls];
         this.maxRetries = maxRetries;
@@ -38,7 +36,7 @@ class PayNodeAgentClient {
         for (let attempt = 0; attempt < this.maxRetries; attempt++) {
             try {
                 const response = await fetch(url, options);
-                if (!RETRYABLE_STATUS_CODES.has(response.status)) {
+                if (!response || !RETRYABLE_STATUS_CODES.has(response.status)) {
                     return response;
                 }
                 if (attempt < this.maxRetries - 1) {
@@ -82,7 +80,10 @@ class PayNodeAgentClient {
                 }
                 else if (b64Required) {
                     try {
-                        body = JSON.parse(Buffer.from(b64Required, 'base64').toString());
+                        const decoded = typeof globalThis.Buffer !== 'undefined'
+                            ? globalThis.Buffer.from(b64Required, 'base64').toString()
+                            : atob(b64Required);
+                        body = JSON.parse(decoded);
                     }
                     catch (e) {
                         console.debug('⚠️ [PayNode-JS] Failed to parse X-402-Required header:', e);
@@ -112,7 +113,12 @@ class PayNodeAgentClient {
         // Select suitable requirement
         const requirement = requirements.accepts.find((req) => req.network === caip2ChainId);
         if (!requirement) {
-            throw new errors_1.PayNodeException(errors_1.ErrorCode.InternalError, `No compatible payment requirement found for network ${caip2ChainId}`);
+            throw new errors_1.PayNodeException(errors_1.ErrorCode.TransactionFailed, `No compatible payment requirement found for network ${caip2ChainId}`);
+        }
+        // 🛡️ Token Whitelist Check (Case-insensitive)
+        const chainTokens = constants_1.ACCEPTED_TOKENS[chainId]?.map(t => t.toLowerCase());
+        if (chainTokens && !chainTokens.includes(requirement.asset.toLowerCase())) {
+            throw new errors_1.PayNodeException(errors_1.ErrorCode.TokenNotAccepted, `Token ${requirement.asset} is not in the whitelist for chain ${chainId}`);
         }
         const orderId = requirement.orderId || requirements.orderId || url;
         // Dust limit check
@@ -144,10 +150,16 @@ class PayNodeAgentClient {
             const allowance = await tokenContract.allowance(this.wallet.address, routerAddr);
             let txHash;
             if (allowance >= amount) {
-                txHash = await this.pay(routerAddr, requirement.asset, requirement.payTo, amount, orderId);
+                try {
+                    txHash = await this.pay(routerAddr, requirement.asset, requirement.payTo, amount, orderId);
+                }
+                catch (e) {
+                    console.warn(`⚠️ [PayNode-JS] Direct pay failed (possibly allowance race), falling back to permit:`, e);
+                    txHash = await this.payWithPermit(routerAddr, requirement.asset, requirement.payTo, amount, orderId, requirement.extra?.version || '2');
+                }
             }
             else {
-                txHash = await this.payWithPermit(routerAddr, requirement.asset, requirement.payTo, amount, orderId);
+                txHash = await this.payWithPermit(routerAddr, requirement.asset, requirement.payTo, amount, orderId, requirement.extra?.version || '2');
             }
             payload = {
                 version: "3.1",
@@ -156,7 +168,10 @@ class PayNodeAgentClient {
                 payload: { txHash }
             };
         }
-        const b64Payload = Buffer.from(JSON.stringify(payload)).toString('base64');
+        const json = JSON.stringify(payload);
+        const b64Payload = typeof globalThis.Buffer !== 'undefined'
+            ? globalThis.Buffer.from(json).toString('base64')
+            : btoa(json);
         const retryOptions = {
             ...options,
             headers: {
@@ -166,7 +181,11 @@ class PayNodeAgentClient {
                 'X-402-Order-Id': orderId
             }
         };
-        return await this._fetchWithRetry(url, retryOptions);
+        const retryResponse = await this._fetchWithRetry(url, retryOptions);
+        if (retryResponse.status === 402) {
+            throw new errors_1.PayNodeException(errors_1.ErrorCode.TransactionFailed, "Still 402 after payment attempt. The server may have rejected the payment or authorization.");
+        }
+        return retryResponse;
     }
     async signTransferWithAuthorization(tokenAddr, to, amount, validAfter, validBefore, nonce, extra = {}) {
         const network = await this.provider.getNetwork();
@@ -208,28 +227,42 @@ class PayNodeAgentClient {
         };
     }
     async pay(contractAddr, tokenAddr, merchantAddr, amount, orderId) {
-        const router = new ethers_1.ethers.Contract(contractAddr, this.ROUTER_ABI, this.wallet);
-        const orderIdBytes = ethers_1.ethers.id(orderId);
-        const feeData = await this.provider.getFeeData();
-        const gasPrice = (feeData.gasPrice * 120n) / 100n;
-        const tx = await router.pay(tokenAddr, merchantAddr, amount, orderIdBytes, {
-            gasPrice,
-            gasLimit: 200000
-        });
-        const receipt = await tx.wait();
-        return receipt.hash;
+        const unlock = await this._lockNonce();
+        try {
+            const router = new ethers_1.ethers.Contract(contractAddr, this.ROUTER_ABI, this.wallet);
+            // convention: we hash the raw orderId string to bytes32 internally
+            const orderIdBytes = ethers_1.ethers.id(orderId);
+            const feeData = await this.provider.getFeeData();
+            const gasPrice = (feeData.gasPrice * 120n) / 100n;
+            const tx = await router.pay(tokenAddr, merchantAddr, amount, orderIdBytes, {
+                gasPrice,
+                gasLimit: 200000
+            });
+            const receipt = await tx.wait();
+            return receipt.hash;
+        }
+        finally {
+            unlock();
+        }
     }
-    async payWithPermit(contractAddr, tokenAddr, merchantAddr, amount, orderId) {
-        const sig = await this.signPermit(tokenAddr, contractAddr, amount);
-        const router = new ethers_1.ethers.Contract(contractAddr, this.ROUTER_ABI, this.wallet);
-        const orderIdBytes = ethers_1.ethers.id(orderId);
-        const feeData = await this.provider.getFeeData();
-        const gasPrice = (feeData.gasPrice * 120n) / 100n;
-        const tx = await router.payWithPermit(this.wallet.address, tokenAddr, merchantAddr, amount, orderIdBytes, sig.deadline, sig.v, sig.r, sig.s, { gasPrice, gasLimit: 300000 });
-        const receipt = await tx.wait();
-        return receipt.hash;
+    async payWithPermit(contractAddr, tokenAddr, merchantAddr, amount, orderId, version = '2') {
+        const unlock = await this._lockNonce();
+        try {
+            const sig = await this.signPermit(tokenAddr, contractAddr, amount, 3600, version);
+            const router = new ethers_1.ethers.Contract(contractAddr, this.ROUTER_ABI, this.wallet);
+            // convention: we hash the raw orderId string to bytes32 internally
+            const orderIdBytes = ethers_1.ethers.id(orderId);
+            const feeData = await this.provider.getFeeData();
+            const gasPrice = (feeData.gasPrice * 120n) / 100n;
+            const tx = await router.payWithPermit(this.wallet.address, tokenAddr, merchantAddr, amount, orderIdBytes, sig.deadline, sig.v, sig.r, sig.s, { gasPrice, gasLimit: 300000 });
+            const receipt = await tx.wait();
+            return receipt.hash;
+        }
+        finally {
+            unlock();
+        }
     }
-    async signPermit(tokenAddr, spenderAddr, amount, deadlineSeconds = 3600) {
+    async signPermit(tokenAddr, spenderAddr, amount, deadlineSeconds = 3600, version = '2') {
         const deadline = Math.floor(Date.now() / 1000) + deadlineSeconds;
         const token = new ethers_1.ethers.Contract(tokenAddr, this.ERC20_ABI, this.wallet);
         const [name, nonce, network] = await Promise.all([
@@ -239,7 +272,7 @@ class PayNodeAgentClient {
         ]);
         const domain = {
             name,
-            version: '1',
+            version,
             chainId: Number(network.chainId),
             verifyingContract: tokenAddr
         };
@@ -263,5 +296,15 @@ class PayNodeAgentClient {
         const { v, r, s } = ethers_1.ethers.Signature.from(signature);
         return { deadline, v, r, s };
     }
+    async _lockNonce() {
+        let resolver;
+        const nextLock = new Promise((resolve) => {
+            resolver = resolve;
+        });
+        const currentLock = this.nonceLock;
+        this.nonceLock = nextLock;
+        await currentLock;
+        return resolver;
+    }
 }
 exports.PayNodeAgentClient = PayNodeAgentClient;

package/dist/constants.d.ts

@@ -2,11 +2,12 @@
 export declare const PAYNODE_ROUTER_ADDRESS = "0x4A73696ccF76E7381b044cB95127B3784369Ed63";
 export declare const PAYNODE_ROUTER_ADDRESS_SANDBOX = "0x24cD8b68aaC209217ff5a6ef1Bf55a59f2c8Ca6F";
 export declare const BASE_USDC_ADDRESS = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
-export declare const BASE_USDC_ADDRESS_SANDBOX = "0x109AEddD656Ed2761d1e210E179329105039c784";
+export declare const BASE_USDC_ADDRESS_SANDBOX = "0x65c088EfBDB0E03185Dbe8e258Ad0cf4Ab7946b0";
 export declare const PROTOCOL_TREASURY = "0x598bF63F5449876efafa7b36b77Deb2070621C0E";
 export declare const PROTOCOL_FEE_BPS = 100;
 export declare const MIN_PAYMENT_AMOUNT: bigint;
 export declare const BASE_RPC_URLS: string[];
 export declare const BASE_RPC_URLS_SANDBOX: string[];
 export declare const ACCEPTED_TOKENS: Record<number, string[]>;
+export declare const PAYNODE_ROUTER_ABI: string[];
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,+CAA+C,CAAC;AACnF,eAAO,MAAM,8BAA8B,+CAA+C,CAAC;AAC3F,eAAO,MAAM,iBAAiB,+CAA+C,CAAC;AAC9E,eAAO,MAAM,yBAAyB,+CAA+C,CAAC;AACtF,eAAO,MAAM,iBAAiB,+CAA+C,CAAC;AAC9E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,kBAAkB,QAAe,CAAC;AAE/C,eAAO,MAAM,aAAa,UAAmF,CAAC;AAC9G,eAAO,MAAM,qBAAqB,UAA0E,CAAC;AAE7G,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAGpD,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,+CAA+C,CAAC;AACnF,eAAO,MAAM,8BAA8B,+CAA+C,CAAC;AAC3F,eAAO,MAAM,iBAAiB,+CAA+C,CAAC;AAC9E,eAAO,MAAM,yBAAyB,+CAA+C,CAAC;AACtF,eAAO,MAAM,iBAAiB,+CAA+C,CAAC;AAC9E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,kBAAkB,QAAe,CAAC;AAE/C,eAAO,MAAM,aAAa,UAAmF,CAAC;AAC9G,eAAO,MAAM,qBAAqB,UAA0E,CAAC;AAE7G,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAGpD,CAAC;AACF,eAAO,MAAM,kBAAkB,UAAqsC,CAAC"}

package/dist/constants.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACCEPTED_TOKENS = exports.BASE_RPC_URLS_SANDBOX = exports.BASE_RPC_URLS = exports.MIN_PAYMENT_AMOUNT = exports.PROTOCOL_FEE_BPS = exports.PROTOCOL_TREASURY = exports.BASE_USDC_ADDRESS_SANDBOX = exports.BASE_USDC_ADDRESS = exports.PAYNODE_ROUTER_ADDRESS_SANDBOX = exports.PAYNODE_ROUTER_ADDRESS = void 0;
+exports.PAYNODE_ROUTER_ABI = exports.ACCEPTED_TOKENS = exports.BASE_RPC_URLS_SANDBOX = exports.BASE_RPC_URLS = exports.MIN_PAYMENT_AMOUNT = exports.PROTOCOL_FEE_BPS = exports.PROTOCOL_TREASURY = exports.BASE_USDC_ADDRESS_SANDBOX = exports.BASE_USDC_ADDRESS = exports.PAYNODE_ROUTER_ADDRESS_SANDBOX = exports.PAYNODE_ROUTER_ADDRESS = void 0;
 /** Generated by scripts/sync-config.py */
 exports.PAYNODE_ROUTER_ADDRESS = "0x4A73696ccF76E7381b044cB95127B3784369Ed63";
 exports.PAYNODE_ROUTER_ADDRESS_SANDBOX = "0x24cD8b68aaC209217ff5a6ef1Bf55a59f2c8Ca6F";
 exports.BASE_USDC_ADDRESS = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
-exports.BASE_USDC_ADDRESS_SANDBOX = "0x109AEddD656Ed2761d1e210E179329105039c784";
+exports.BASE_USDC_ADDRESS_SANDBOX = "0x65c088EfBDB0E03185Dbe8e258Ad0cf4Ab7946b0";
 exports.PROTOCOL_TREASURY = "0x598bF63F5449876efafa7b36b77Deb2070621C0E";
 exports.PROTOCOL_FEE_BPS = 100;
 exports.MIN_PAYMENT_AMOUNT = BigInt(1000);
@@ -13,5 +13,6 @@ exports.BASE_RPC_URLS = ["https://mainnet.base.org", "https://base.meowrpc.com",
 exports.BASE_RPC_URLS_SANDBOX = ["https://sepolia.base.org", "https://base-sepolia-rpc.publicnode.com"];
 exports.ACCEPTED_TOKENS = {
     8453: ["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"],
-    84532: ["0x109AEddD656Ed2761d1e210E179329105039c784"]
+    84532: ["0x65c088EfBDB0E03185Dbe8e258Ad0cf4Ab7946b0"]
 };
+exports.PAYNODE_ROUTER_ABI = ["function MAX_BPS() public", "function MIN_PAYMENT_AMOUNT() public", "function PROTOCOL_FEE_BPS() public", "function acceptOwnership() public", "function owner() public", "function pause() public", "function paused() public", "function pay(address token, address merchant, uint256 amount, bytes32 orderId) public", "function payWithPermit(address payer, address token, address merchant, uint256 amount, bytes32 orderId, uint256 deadline, uint8 v, bytes32 r, bytes32 s) public", "function pendingOwner() public", "function protocolTreasury() public", "function renounceOwnership() public", "function transferOwnership(address newOwner) public", "function unpause() public", "function updateTreasury(address _newTreasury) public", "event OwnershipTransferStarted(address indexed previousOwner, address indexed newOwner)", "event OwnershipTransferred(address indexed previousOwner, address indexed newOwner)", "event Paused(address account)", "event PaymentReceived(bytes32 indexed orderId, address indexed merchant, address indexed payer, address token, uint256 amount, uint256 fee, uint256 chainId)", "event TreasuryUpdated(address indexed oldTreasury, address indexed newTreasury)", "event Unpaused(address account)"];

package/dist/middleware/x402.d.ts

@@ -15,6 +15,4 @@ export interface PayNodeMiddlewareOptions {
     maxTimeoutSeconds?: number;
 }
 export declare const x402Gate: (options: PayNodeMiddlewareOptions) => (req: Request | any, res: Response | any, next: NextFunction) => Promise<any>;
-/** @deprecated Use x402Gate instead. */
-export declare const x402_gate: (options: PayNodeMiddlewareOptions) => (req: Request | any, res: Response | any, next: NextFunction) => Promise<any>;
 //# sourceMappingURL=x402.d.ts.map

package/dist/middleware/x402.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x402.d.ts","sourceRoot":"","sources":["../../src/middleware/x402.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAcxD,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,KAAK,MAAM,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,QAAQ,GAAI,SAAS,wBAAwB,MAwB1C,KAAK,OAAO,GAAG,GAAG,EAAE,KAAK,QAAQ,GAAG,GAAG,EAAE,MAAM,YAAY,iBA6F1E,CAAC;AAEF,wCAAwC;AACxC,eAAO,MAAM,SAAS,YAxHY,wBAAwB,MAwB1C,KAAK,OAAO,GAAG,GAAG,EAAE,KAAK,QAAQ,GAAG,GAAG,EAAE,MAAM,YAAY,iBAgG1C,CAAC"}
+{"version":3,"file":"x402.d.ts","sourceRoot":"","sources":["../../src/middleware/x402.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAcxD,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,KAAK,MAAM,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,QAAQ,GAAI,SAAS,wBAAwB,MA6B1C,KAAK,OAAO,GAAG,GAAG,EAAE,KAAK,QAAQ,GAAG,GAAG,EAAE,MAAM,YAAY,iBA8F1E,CAAC"}

package/dist/middleware/x402.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.x402_gate = exports.x402Gate = void 0;
+exports.x402Gate = void 0;
 const errors_1 = require("../errors");
 const verifier_1 = require("../utils/verifier");
 const ethers_1 = require("ethers");
@@ -23,7 +23,12 @@ const x402Gate = (options) => {
         rawAmount = (0, ethers_1.parseUnits)(options.price, decimals);
     }
     catch (e) {
-        rawAmount = BigInt(Math.floor(parseFloat(options.price) * (10 ** decimals)));
+        // Robust fallback for non-standard number strings (avoiding floating point math)
+        const parts = options.price.split('.');
+        const integerPart = parts[0] || '0';
+        let fractionPart = parts[1] || '0';
+        fractionPart = fractionPart.slice(0, decimals).padEnd(decimals, '0');
+        rawAmount = BigInt(integerPart + fractionPart);
     }
     const defaultOrderIdGen = (req) => `agent_js_${Date.now()}`;
     return async (req, res, next) => {
@@ -56,7 +61,7 @@ const x402Gate = (options) => {
                 tokenAddress: tokenAddress,
                 amount: rawAmount.toString(),
                 orderId: orderId
-            }, unifiedPayload.type === 'eip3009' ? unifiedPayload.payload?.extra : {});
+            }, unifiedPayload.type === 'eip3009' ? { name: currency, version: "2" } : {});
             if (result.isValid) {
                 req.paynode = { unifiedPayload, orderId };
                 return next();
@@ -107,10 +112,9 @@ const x402Gate = (options) => {
         const b64Required = Buffer.from(JSON.stringify(v2Response)).toString('base64');
         if (res.set) {
             res.set('X-402-Required', b64Required);
+            res.set('X-402-Order-Id', orderId);
         }
         return res.status(402).json(v2Response);
     };
 };
 exports.x402Gate = x402Gate;
-/** @deprecated Use x402Gate instead. */
-exports.x402_gate = exports.x402Gate;

package/dist/utils/idempotency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/utils/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElE;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,gBAAgB;IAC7D,OAAO,CAAC,KAAK,CAAkC;;IAOzC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,OAAO,CAAC,OAAO;CAQhB;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,gBAAgB;IAC5D,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAS;gBAEX,WAAW,EAAE,KAAK,EAAE,MAAM,GAAE,MAAsB;IAKxD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMjE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI5C"}
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/utils/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElE;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,gBAAgB;IAC7D,OAAO,CAAC,KAAK,CAAkC;;IAUzC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,OAAO,CAAC,OAAO;CAQhB;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,gBAAgB;IAC5D,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAS;gBAEX,WAAW,EAAE,KAAK,EAAE,MAAM,GAAE,MAAsB;IAKxD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMjE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI5C"}

package/dist/utils/idempotency.js

@@ -10,7 +10,10 @@ class MemoryIdempotencyStore {
     cache = new Map();
     constructor() {
         // Basic cleanup interval
-        setInterval(() => this.cleanup(), 60000);
+        const interval = setInterval(() => this.cleanup(), 60000);
+        if (interval.unref) {
+            interval.unref();
+        }
     }
     async checkAndSet(txHash, ttlSeconds) {
         const now = Math.floor(Date.now() / 1000);

package/dist/utils/verifier.d.ts

@@ -20,7 +20,7 @@ export declare class PayNodeVerifier {
     private contractAddress;
     private chainId?;
     private store?;
-    private acceptedTokens?;
+    private acceptedTokens;
     constructor(config: PayNodeVerifierConfig);
     private static ROUTER_ABI;
     verify(unifiedPayload: UnifiedPaymentPayload, expected: ExpectedPayment, extra?: any): Promise<{

package/dist/utils/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/utils/verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAA0B,MAAM,eAAe,CAAC;AAEzE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEvE,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oGAAoG;IACpG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,KAAK,CAAC,CAAmB;IACjC,OAAO,CAAC,cAAc,CAAC,CAAc;gBAEzB,MAAM,EAAE,qBAAqB;IAmCzC,OAAO,CAAC,MAAM,CAAC,UAAU,CAEvB;IAEI,MAAM,CACV,cAAc,EAAE,qBAAqB,EACrC,QAAQ,EAAE,eAAe,EACzB,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAkCpD,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAiDlH;;;OAGG;IACG,+BAA+B,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;KACjC,EACD,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC9B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;CA6F3D"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/utils/verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAA0B,MAAM,eAAe,CAAC;AAEzE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEvE,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oGAAoG;IACpG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,KAAK,CAAC,CAAmB;IACjC,OAAO,CAAC,cAAc,CAAc;gBAExB,MAAM,EAAE,qBAAqB;IAyCzC,OAAO,CAAC,MAAM,CAAC,UAAU,CAEvB;IAEI,MAAM,CACV,cAAc,EAAE,qBAAqB,EACrC,QAAQ,EAAE,eAAe,EACzB,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;IA8BpD,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;IA0ElH;;;OAGG;IACG,+BAA+B,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;KACjC,EACD,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC9B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;CA0G3D"}

package/dist/utils/verifier.js

@@ -40,9 +40,10 @@ class PayNodeVerifier {
         else if (config.chainId) {
             tokenList = constants_1.ACCEPTED_TOKENS[config.chainId];
         }
-        if (tokenList && tokenList.length > 0) {
-            this.acceptedTokens = new Set(tokenList.map(t => t.toLowerCase()));
+        if (!tokenList || tokenList.length === 0) {
+            throw new errors_1.PayNodeException(errors_1.ErrorCode.InternalError, "Verifier requires either a valid chainId or acceptedTokens to initialize its whitelist");
         }
+        this.acceptedTokens = new Set(tokenList.map(t => t.toLowerCase()));
     }
     static ROUTER_ABI = [
         "event PaymentReceived(bytes32 indexed orderId, address indexed merchant, address indexed payer, address token, uint256 amount, uint256 fee, uint256 chainId)"
@@ -51,12 +52,8 @@ class PayNodeVerifier {
         try {
             const { type, payload, orderId } = unifiedPayload;
             if (type === 'eip3009') {
-                const tokenAddr = expected.tokenAddress;
-                if (!tokenAddr) {
-                    return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.TokenNotAccepted, "tokenAddress is required for eip3009 verification") };
-                }
                 const actualPayload = payload;
-                return await this.verifyTransferWithAuthorization(tokenAddr, actualPayload, {
+                return await this.verifyTransferWithAuthorization(expected.tokenAddress, actualPayload, {
                     to: expected.merchantAddress,
                     value: expected.amount
                 }, extra);
@@ -85,24 +82,43 @@ class PayNodeVerifier {
     }
     async verifyOnchainPayment(txHash, expected) {
         try {
+            // 1. Security Checks
+            if (BigInt(expected.amount) < constants_1.MIN_PAYMENT_AMOUNT) {
+                return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.AmountTooLow) };
+            }
+            if (!this.acceptedTokens.has(expected.tokenAddress.toLowerCase())) {
+                return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.TokenNotAccepted) };
+            }
             const receipt = await this.provider.getTransactionReceipt(txHash);
             if (!receipt || receipt.status === 0) {
                 return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.TransactionNotFound) };
             }
             const router = new ethers_1.ethers.Interface(PayNodeVerifier.ROUTER_ABI);
+            // convention: we hash the raw orderId string to bytes32 internally
             const targetOrderId = ethers_1.ethers.id(expected.orderId);
             let validEventFound = false;
+            let routerInteracted = false;
+            let orderIdMismatchFound = false;
             for (const log of receipt.logs) {
                 try {
+                    if (log.address.toLowerCase() !== this.contractAddress.toLowerCase())
+                        continue;
+                    routerInteracted = true;
                     const parsed = router.parseLog(log);
                     if (parsed && parsed.name === 'PaymentReceived') {
                         const { merchant, token, amount, orderId } = parsed.args;
-                        if (merchant.toLowerCase() === expected.merchantAddress.toLowerCase() &&
-                            token.toLowerCase() === expected.tokenAddress.toLowerCase() &&
-                            BigInt(amount) >= BigInt(expected.amount) &&
-                            orderId === targetOrderId) {
-                            validEventFound = true;
-                            break;
+                        const isMerchantMatch = merchant.toLowerCase() === expected.merchantAddress.toLowerCase();
+                        const isTokenMatch = token.toLowerCase() === expected.tokenAddress.toLowerCase();
+                        const isAmountMatch = BigInt(amount) >= BigInt(expected.amount);
+                        const isOrderMatch = orderId === targetOrderId;
+                        if (isMerchantMatch && isTokenMatch && isAmountMatch) {
+                            if (isOrderMatch) {
+                                validEventFound = true;
+                                break;
+                            }
+                            else {
+                                orderIdMismatchFound = true;
+                            }
                         }
                     }
                 }
@@ -110,7 +126,13 @@ class PayNodeVerifier {
                     // Skip
                 }
             }
+            if (!routerInteracted) {
+                return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.WrongContract, "Transaction did not interact with the configured PayNodeRouter contract") };
+            }
             if (!validEventFound) {
+                if (orderIdMismatchFound) {
+                    return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.OrderMismatch, "Payment log found but orderId does not match") };
+                }
                 return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.InvalidReceipt, "No matching PaymentReceived event found") };
             }
             if (this.store) {
@@ -130,12 +152,21 @@ class PayNodeVerifier {
      * 耗时: < 50ms (仅需一次 RPC Read)
      */
     async verifyTransferWithAuthorization(tokenAddr, payload, expected, extra = {}) {
+        let isLocked = false;
+        const { signature, authorization } = payload;
+        const nonce = authorization?.nonce;
         try {
-            const { signature, authorization } = payload;
-            const { from, to, value, validAfter, validBefore, nonce } = authorization;
+            // 1. Security Checks
+            if (BigInt(expected.value) < constants_1.MIN_PAYMENT_AMOUNT) {
+                return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.AmountTooLow) };
+            }
+            if (!this.acceptedTokens.has(tokenAddr.toLowerCase())) {
+                return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.TokenNotAccepted) };
+            }
+            const { from, to, value, validAfter, validBefore } = authorization;
             const expectedValue = BigInt(expected.value);
             const payloadValue = BigInt(value);
-            // 1. 基础字段与金额校验 (防粉尘攻击)
+            // 2. 基础字段与金额校验 (防粉尘攻击)
             if (to.toLowerCase() !== expected.to.toLowerCase()) {
                 return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.InvalidReceipt, "Recipient mismatch") };
             }
@@ -176,8 +207,9 @@ class PayNodeVerifier {
             if (this.store) {
                 const isNew = await this.store.checkAndSet(nonce, 86400); // 锁定 24 小时
                 if (!isNew) {
-                    return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.DuplicateTransaction, "Nonce already used in local memory") };
+                    return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.DuplicateTransaction, "Nonce already used or transaction already consumed") };
                 }
+                isLocked = true;
             }
             // ================= 核心补全：RPC 状态只读校验 (<50ms) =================
             const tokenContract = new ethers_1.ethers.Contract(tokenAddr, [
@@ -193,14 +225,13 @@ class PayNodeVerifier {
             ]);
             // 5. 校验真实余额 (防止空钱包签署有效签名)
             if (BigInt(balance) < payloadValue) {
-                // 如果验签失败，释放内存锁
-                if (this.store)
+                if (isLocked && this.store)
                     await this.store.delete(nonce);
                 return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.InvalidReceipt, "Insufficient token balance") };
             }
             // 6. 校验链上 Nonce 状态 (防止该签名已被打包结算)
             if (isNonceUsedOnChain) {
-                if (this.store)
+                if (isLocked && this.store)
                     await this.store.delete(nonce);
                 return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.DuplicateTransaction, "Nonce already consumed on-chain") };
             }
@@ -208,6 +239,10 @@ class PayNodeVerifier {
             return { isValid: true };
         }
         catch (e) {
+            if (isLocked && this.store)
+                await this.store.delete(nonce);
+            if (e instanceof errors_1.PayNodeException)
+                return { isValid: false, error: e };
             return { isValid: false, error: new errors_1.PayNodeException(errors_1.ErrorCode.InternalError, e.message) };
         }
     }

package/dist/utils/webhook.d.ts

@@ -8,7 +8,7 @@ export interface WebhookConfig {
     contractAddress?: string;
     /** The merchant's webhook endpoint URL */
     webhookUrl: string;
-    /** Secret key for HMAC-SHA256 signature (header: x-paynode-signature) */
+    /** Secret key for HMAC-SHA256 signature (header: X-402-Signature) */
     webhookSecret: string;
     /** Optional: chain ID for payload enrichment */
     chainId?: number;
@@ -50,7 +50,7 @@ export interface PaymentEvent {
  * ```ts
  * const notifier = new PayNodeWebhookNotifier({
  *   rpcUrl: 'https://mainnet.base.org',
- *   contractAddress: '0x92e20164FC457a2aC35f53D06268168e6352b200',
+ *   contractAddress: '0x4A73696ccF76E7381b044cB95127B3784369Ed63',
  *   webhookUrl: 'https://myshop.com/api/paynode-webhook',
  *   webhookSecret: 'whsec_mysecretkey123',
  * });

package/dist/utils/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/utils/webhook.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uDAAuD;IACvD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACtD,0DAA0D;IAC1D,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,KAAK,CAAY;IACzB,OAAO,CAAC,MAAM,CAAoG;IAClH,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,YAAY,CAAkB;gBAE1B,MAAM,EAAE,aAAa;IAgBjC;;;OAGG;IACG,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9C;;OAEG;IACH,IAAI,IAAI,IAAI;YAQE,IAAI;IAgClB,OAAO,CAAC,UAAU;IAmBlB;;OAEG;YACW,OAAO;CA8CtB"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/utils/webhook.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uDAAuD;IACvD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACtD,0DAA0D;IAC1D,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,KAAK,CAAY;IACzB,OAAO,CAAC,MAAM,CAAoG;IAClH,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,YAAY,CAAkB;gBAE1B,MAAM,EAAE,aAAa;IAgBjC;;;OAGG;IACG,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9C;;OAEG;IACH,IAAI,IAAI,IAAI;YAQE,IAAI;IAgClB,OAAO,CAAC,UAAU;IAmBlB;;OAEG;YACW,OAAO;CA8CtB"}

package/dist/utils/webhook.js

@@ -54,7 +54,7 @@ const PAYNODE_ABI = [
  * ```ts
  * const notifier = new PayNodeWebhookNotifier({
  *   rpcUrl: 'https://mainnet.base.org',
- *   contractAddress: '0x92e20164FC457a2aC35f53D06268168e6352b200',
+ *   contractAddress: '0x4A73696ccF76E7381b044cB95127B3784369Ed63',
  *   webhookUrl: 'https://myshop.com/api/paynode-webhook',
  *   webhookSecret: 'whsec_mysecretkey123',
  * });
@@ -169,9 +169,9 @@ class PayNodeWebhookNotifier {
             .digest('hex');
         const headers = {
             'Content-Type': 'application/json',
-            'x-paynode-signature': `sha256=${signature}`,
-            'x-paynode-event': 'payment.received',
-            'x-paynode-delivery-id': `${event.txHash}-${attempt}`,
+            'X-402-Signature': `sha256=${signature}`,
+            'X-402-Event': 'payment.received',
+            'X-402-Delivery-Id': `${event.txHash}-${attempt}`,
             ...(this.config.customHeaders || {})
         };
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paynodelabs/sdk-js",
-  "version": "2.0.1",
+  "version": "2.1.1",
   "description": "The official JavaScript/TypeScript SDK for PayNode x402 protocol on Base L2.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -39,5 +39,8 @@
     "ts-jest": "^29.1.4",
     "ts-node": "^10.9.2",
     "typescript": "^5.4.5"
+  },
+  "overrides": {
+    "brace-expansion": "^5.0.5"
   }
-}
+}