insumer-verify 1.2.0 → 1.3.0

package/README.md

@@ -99,12 +99,47 @@ The attestation response you're verifying looks like this:
     "sig": "MEUCIQD...(base64 ECDSA signature)...",
     "kid": "insumer-attest-v1"
   },
-  "meta": { "version": "1.0", "creditsCharged": 1, "creditsRemaining": 99 }
+  "meta": { "version": "1.0", "timestamp": "2026-02-28T12:34:57.000Z", "creditsCharged": 1, "creditsRemaining": 99 }
 }
 ```
 
 No balances. No amounts. Just a signed true/false per condition.
 
+### Handling `rpc_failure` errors
+
+If the API cannot reach one or more data sources (RPC nodes, Helius, XRPL, Covalent) after retries, it returns `ok: false` with error code `rpc_failure` instead of issuing an attestation. **No signature, no JWT, no credits charged.** This is a retryable error — retry the same request after a short delay (2-5 seconds).
+
+```json
+{
+  "ok": false,
+  "error": {
+    "code": "rpc_failure",
+    "message": "Unable to verify all conditions — data source unavailable after retries",
+    "failedConditions": [
+      { "source": "rpcBalanceOf", "chainId": "43114", "message": "Timeout" }
+    ]
+  },
+  "meta": { "version": "1.0", "timestamp": "..." }
+}
+```
+
+**Important:** `rpc_failure` is NOT a verification failure. It means the API could not check the condition at all. Do not treat it as `pass: false`. Check for `ok: false` with `error.code === "rpc_failure"` and retry:
+
+```typescript
+const res = await fetch("https://api.insumermodel.com/v1/attest", { ... });
+const data = await res.json();
+
+if (!data.ok && data.error?.code === "rpc_failure") {
+  // Retryable — data source temporarily unavailable
+  // Wait 2-5 seconds and retry the same request
+  console.log("RPC failure, retrying...", data.error.failedConditions);
+  return;
+}
+
+// Only verify if we got an actual attestation
+const result = await verifyAttestation(data, { maxAge: 120 });
+```
+
 ### Browser
 
 ```html

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insumer-verify",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Client-side verifier for InsumerAPI attestations. ECDSA P-256 signatures, condition hashes, block freshness, expiry. Zero dependencies. Used by DJD Agent Score (Coinbase x402).",
   "type": "module",
   "main": "build/index.js",