@supercuts-walrus/backend 0.1.0 → 0.1.1

package/dist/x402-resource-service.js

@@ -67,8 +67,10 @@ export class X402ResourceService {
     challenge(artifact) {
         // The live Sui exact facilitator requires the x402 nonce to be exactly
         // 32 random bytes (hex encoded), not merely an application nonce.
-        const requirements = this.requirements(artifact), nonce = this.#ledger.challenge(artifact.requestId, requirementsHash(requirements), () => randomBytes(32).toString("hex"));
-        requirements.extra = { ...requirements.extra, nonce };
+        const requirements = this.requirements(artifact), baseHash = requirementsHash(requirements), nonce = this.#ledger.challenge(artifact.requestId, baseHash, () => randomBytes(32).toString("hex"));
+        const stored = this.#ledger.getChallenge(artifact.requestId, baseHash) ?? fail("X402_CHALLENGE_MISSING", "resource challenge was not persisted");
+        const expiresAt = stored.createdAt + requirements.maxTimeoutSeconds * 1_000;
+        requirements.extra = { ...requirements.extra, nonce, expiresAt };
         // The nonce changes the signed requirement set and is persisted per request.
         const finalHash = requirementsHash(requirements);
         return { x402Version: 2, resource: { url: this.resourceUrl(artifact.requestId), description: "Supercuts seller capability artifact", mimeType: "application/json" }, accepts: [{ ...requirements, extra: { ...requirements.extra, requirementsHash: finalHash } }] };
@@ -96,10 +98,10 @@ export class X402ResourceService {
             const offered = payload.accepted;
             if (!offered || requirementsHash(offered) !== requirementsHash(requirements))
                 fail("X402_REQUIREMENTS_MISMATCH", "payment payload changed the challenged requirements");
-            const extra = requirements.extra, nonce = String(extra.nonce ?? ""), declaredHash = String(extra.requirementsHash ?? "");
-            const unsignedRequirements = { ...requirements, extra: { requestId: extra.requestId, operationId: extra.operationId, nonce } };
-            if (declaredHash !== requirementsHash(unsignedRequirements))
-                fail("X402_REQUIREMENTS_MISMATCH", "challenge requirements hash is invalid");
+            const extra = requirements.extra, nonce = String(extra.nonce ?? ""), declaredHash = String(extra.requirementsHash ?? ""), expiresAt = Number(extra.expiresAt);
+            const unsignedRequirements = { ...requirements, extra: { requestId: extra.requestId, operationId: extra.operationId, nonce, expiresAt } };
+            if (!Number.isSafeInteger(expiresAt) || expiresAt !== stored.createdAt + requirements.maxTimeoutSeconds * 1_000 || declaredHash !== requirementsHash(unsignedRequirements))
+                fail("X402_REQUIREMENTS_MISMATCH", "challenge requirements hash or expiry is invalid");
             verifyBinding(binding, artifact.requestId, nonce, unsignedRequirements, binding.transactionDigest);
             const { payerSignature: _signature, ...unsignedBinding } = binding;
             if (!(await isValidPersonalMessageSignature(paymentBindingBytes(unsignedBinding), binding.payerSignature, { address: binding.payer })))
@@ -133,20 +135,37 @@ export class X402ResourceService {
     createServer() { return createServer((request, response) => void this.handle(request, response)); }
     async facilitator(path, body) {
         const endpoint = new URL(path, `${this.#facilitator.toString().replace(/\/$/, "")}/`);
-        const response = await this.http(endpoint, { method: "POST", headers: { "content-type": "application/json", "x-supercuts-facilitator-key": this.config.facilitatorKey }, body: JSON.stringify(body), signal: AbortSignal.timeout(60_000) });
-        let value;
-        try {
-            value = await response.json();
-        }
-        catch (error) {
-            return fail("X402_FACILITATOR_INVALID", "facilitator returned invalid JSON", error);
-        }
-        if (!response.ok || !value || typeof value !== "object" || Array.isArray(value)) {
+        const delays = this.config.facilitatorRetryDelaysMs ?? [0, 2_000, 5_000, 10_000];
+        let lastCause;
+        for (const delay of delays) {
+            if (delay > 0)
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            let response;
+            try {
+                response = await this.http(endpoint, { method: "POST", headers: { "content-type": "application/json", "x-supercuts-facilitator-key": this.config.facilitatorKey }, body: JSON.stringify(body), signal: AbortSignal.timeout(60_000) });
+            }
+            catch (error) {
+                lastCause = error;
+                continue;
+            }
+            const raw = Buffer.from(await response.arrayBuffer());
+            let value;
+            try {
+                value = JSON.parse(raw.toString("utf8"));
+            }
+            catch (error) {
+                lastCause = error;
+                continue;
+            }
+            if (response.ok && value && typeof value === "object" && !Array.isArray(value))
+                return value;
             const message = value && typeof value === "object" && !Array.isArray(value) && typeof value.message === "string"
                 ? `: ${value.message}` : "";
-            fail("X402_FACILITATOR_INVALID", `facilitator ${path} failed with ${response.status}${message}`);
+            if (response.status < 500)
+                fail("X402_FACILITATOR_INVALID", `facilitator ${path} failed with ${response.status}${message}`);
+            lastCause = new Error(`facilitator ${path} returned ${response.status}${message}`);
         }
-        return value;
+        return fail("X402_FACILITATOR_UNAVAILABLE", `facilitator ${path} remained unavailable after bounded retries`, lastCause);
     }
     send(response, status, body, headers = {}) { response.writeHead(status, { "content-length": String(body.length), ...headers }); response.end(body); }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supercuts-walrus/backend",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": false,
   "type": "module",
   "exports": {