mppx 0.8.3 → 0.8.5

package/dist/cli/validate/challenge.js

@@ -0,0 +1,211 @@
+import * as Challenge from '../../Challenge.js';
+import * as Constants from '../../Constants.js';
+import { chainId as tempoChainIds } from '../../tempo/internal/defaults.js';
+import { pc } from '../utils.js';
+import { extractRequestBodyFromDiscovery } from './discovery.js';
+import { buildUrl, check, fail, fetchWithTimeout, isValidAddress, isValidIntegerAmount, skip, warn, } from './helpers.js';
+function detectTestnet(challenge) {
+    const request = challenge.request;
+    const methodDetails = request.methodDetails;
+    if (typeof methodDetails?.chainId === 'number') {
+        return methodDetails.chainId !== tempoChainIds.mainnet;
+    }
+    return false;
+}
+export async function validateChallenge(baseUrl, endpoint, verbose, options) {
+    const results = [];
+    const url = buildUrl(baseUrl, endpoint, options?.query);
+    const fetchHeaders = {};
+    let fetchBody;
+    // Make bare unauthenticated request first (no body)
+    let response;
+    try {
+        response = await fetchWithTimeout(url, { method: endpoint.method });
+    }
+    catch (error) {
+        results.push(fail('Request failed', error.message));
+        return { results };
+    }
+    // If we got 400, retry with body (explicit --body or auto-generated from schema)
+    if (response.status === 400) {
+        const bodyToTry = options?.body ??
+            (options?.discoveryDoc
+                ? extractRequestBodyFromDiscovery(options.discoveryDoc, endpoint)
+                : undefined);
+        if (bodyToTry) {
+            if (verbose)
+                console.log(pc.dim(`  Retrying with body: ${bodyToTry}`));
+            fetchBody = bodyToTry;
+            fetchHeaders['content-type'] = 'application/json';
+            try {
+                response = await fetchWithTimeout(url, {
+                    method: endpoint.method,
+                    headers: fetchHeaders,
+                    body: fetchBody,
+                });
+            }
+            catch (error) {
+                results.push(fail('Request failed', error.message));
+                return { results };
+            }
+        }
+    }
+    // Check 402
+    if (response.status !== 402) {
+        if (response.status === 200) {
+            results.push(skip('Returns 402 without credentials', 'Got 200 (endpoint may not require payment in all cases)'));
+        }
+        else if (response.status === 401 || response.status === 403) {
+            results.push(skip('Returns 402 without credentials', `Got ${response.status} (endpoint requires auth before payment gate)`));
+        }
+        else {
+            results.push(fail('Returns 402 without credentials', `Got ${response.status} instead`, response.status === 400
+                ? 'Server requires a valid request body before returning 402. Add a requestBody schema with examples to your OpenAPI doc, or use --body.'
+                : 'Endpoints that require payment must return HTTP 402 with a WWW-Authenticate: Payment header when no valid credential is provided.'));
+        }
+        return { results };
+    }
+    results.push(check('Returns 402 without credentials'));
+    // Check WWW-Authenticate header
+    const wwwAuth = response.headers.get(Constants.Headers.wwwAuthenticate);
+    if (!wwwAuth) {
+        results.push(skip('Not an MPP endpoint', 'No WWW-Authenticate header (may be x402 or other protocol)'));
+        return { results };
+    }
+    if (!wwwAuth.startsWith(`${Constants.Schemes.payment} `)) {
+        results.push(skip('Not an MPP endpoint', `WWW-Authenticate scheme is not Payment`));
+        return { results };
+    }
+    results.push(check('WWW-Authenticate header present', 'Payment scheme'));
+    // Parse challenge
+    let challenge;
+    try {
+        challenge = Challenge.fromResponse(response);
+    }
+    catch (error) {
+        results.push(fail('Challenge parseable', error.message));
+        return { results };
+    }
+    results.push(check('Challenge parseable', `${challenge.method}/${challenge.intent}`));
+    // Validate required fields
+    if (!challenge.id)
+        results.push(fail('Challenge has id', undefined, 'Every challenge must include a unique id field. Generate a random string or hash per challenge.'));
+    else
+        results.push(check('Challenge has id'));
+    if (!challenge.realm)
+        results.push(fail('Challenge has realm', undefined, "Set realm to your server's hostname. It tells clients who they are paying."));
+    else
+        results.push(check('Challenge has realm'));
+    if (!challenge.method)
+        results.push(fail('Challenge has method', undefined, 'Set method to the payment method (e.g. "tempo", "stripe").'));
+    if (!challenge.intent)
+        results.push(fail('Challenge has intent', undefined, 'Set intent to the payment type (e.g. "charge", "session").'));
+    // Semantic checks
+    if (challenge.expires) {
+        const expiresDate = new Date(challenge.expires);
+        const now = new Date();
+        if (expiresDate <= now) {
+            results.push(fail('Challenge expires in the future', `Expired at ${challenge.expires}`, 'The expires timestamp must be in the future when the challenge is issued. Use a 5-10 minute window from the current time.'));
+        }
+        else {
+            const diffMs = expiresDate.getTime() - now.getTime();
+            const diffMin = Math.round(diffMs / 60000);
+            results.push(check('Challenge expires in the future', `${diffMin}m from now`));
+        }
+    }
+    else {
+        results.push(warn('Challenge has expiration', 'No expires field set', 'Add an expires field (ISO 8601 datetime) to prevent replay attacks. Recommended: 5 minutes from issuance.'));
+    }
+    // Realm check (allow subdomain matches)
+    try {
+        const serverHost = new URL(baseUrl).hostname;
+        const realm = challenge.realm ?? '';
+        const matches = serverHost === realm || serverHost.endsWith(`.${realm}`);
+        if (matches) {
+            results.push(check('Realm matches server hostname'));
+        }
+        else {
+            results.push(warn('Realm matches server hostname', `realm="${realm}" vs host="${serverHost}"`, 'Set the realm to your production hostname (or base domain) in the challenge. Clients use realm to verify they are paying the right server.'));
+        }
+    }
+    catch { }
+    // Method-specific validation
+    const request = challenge.request;
+    if (challenge.method === Constants.Methods.tempo) {
+        if (isValidAddress(request.recipient)) {
+            results.push(check('Valid recipient address'));
+        }
+        else {
+            results.push(fail('Valid recipient address', `Got: ${String(request.recipient)}`, 'Set request.recipient to a valid 0x-prefixed 40-hex-char address. This is where payment will be sent.'));
+        }
+        if (isValidAddress(request.currency)) {
+            const isTestnet = detectTestnet(challenge);
+            const network = isTestnet ? 'testnet' : 'mainnet';
+            results.push(check('Valid currency address', `${network}`));
+        }
+        else {
+            results.push(fail('Valid currency address', `Got: ${String(request.currency)}`, 'Set request.currency to a valid token address. Common: "0x20c0000000000000000000000000000000000000" (PathUSD).'));
+        }
+        if (isValidIntegerAmount(request.amount)) {
+            results.push(check('Amount is valid integer string'));
+        }
+        else if (request.amount === undefined || request.amount === null) {
+            results.push(warn('Amount is valid integer string', 'No amount (dynamic pricing?)', 'Set request.amount to a string of digits in the token\'s smallest unit (e.g. "10000" = $0.01 for 6-decimal tokens).'));
+        }
+        else {
+            results.push(fail('Amount is valid integer string', `Got: ${String(request.amount)}`, 'request.amount must be a string of digits (no decimals, no prefix). Example: "10000" for $0.01 with 6-decimal tokens.'));
+        }
+    }
+    else if (challenge.method === Constants.Methods.stripe) {
+        if (request.amount !== undefined) {
+            results.push(check('Stripe challenge has amount'));
+        }
+        else {
+            results.push(warn('Stripe challenge has amount', 'No amount field'));
+        }
+    }
+    if (verbose) {
+        console.log(pc.dim(`    Challenge: ${JSON.stringify(challenge, null, 2)}`));
+    }
+    return { results, resolvedBody: fetchBody };
+}
+export async function validateErrorHandling(baseUrl, endpoint, options) {
+    const results = [];
+    const url = buildUrl(baseUrl, endpoint, options?.query);
+    const fetchHeaders = {
+        [Constants.Headers.authorization]: `${Constants.Schemes.payment} dGhpcyBpcyBnYXJiYWdl`,
+    };
+    let fetchBody;
+    if (options?.body) {
+        fetchBody = options.body;
+        fetchHeaders['content-type'] = 'application/json';
+    }
+    try {
+        const response = await fetchWithTimeout(url, {
+            method: endpoint.method,
+            headers: fetchHeaders,
+            body: fetchBody ?? null,
+        });
+        if (response.status === 402) {
+            results.push(check('Malformed credential returns 402', 'not 500'));
+            const wwwAuth = response.headers.get(Constants.Headers.wwwAuthenticate);
+            if (wwwAuth?.startsWith(`${Constants.Schemes.payment} `)) {
+                results.push(check('Error response includes fresh challenge'));
+            }
+            else {
+                results.push(warn('Error response includes fresh challenge', 'No WWW-Authenticate header', 'When rejecting an invalid credential, respond with 402 and include a fresh WWW-Authenticate: Payment challenge so the client can retry.'));
+            }
+        }
+        else if (response.status >= 500) {
+            results.push(fail('Malformed credential returns 402', `Got ${response.status} (server error)`, 'When the Authorization header contains an invalid credential, respond with 402 (not 500). Catch credential validation errors and return a fresh challenge.'));
+        }
+        else {
+            results.push(warn('Malformed credential returns 402', `Got ${response.status}`, `When the Authorization header contains an invalid Payment credential, respond with 402 and a fresh WWW-Authenticate challenge. Returning ${response.status} prevents the client from retrying with a valid payment.`));
+        }
+    }
+    catch (error) {
+        results.push(fail('Error handling test', error.message));
+    }
+    return results;
+}
+//# sourceMappingURL=challenge.js.map

package/dist/cli/validate/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../../src/cli/validate/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,EACL,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,IAAI,EACJ,IAAI,GACL,MAAM,cAAc,CAAA;AAErB,SAAS,aAAa,CAAC,SAA8B;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAkC,CAAA;IAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAoD,CAAA;IAClF,IAAI,OAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,aAAa,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO,CAAA;IACxD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,QAAsB,EACtB,OAAgB,EAChB,OAIC;IAED,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,YAAY,GAA2B,EAAE,CAAA;IAC/C,IAAI,SAA6B,CAAA;IAEjC,oDAAoD;IACpD,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9D,OAAO,EAAE,OAAO,EAAE,CAAA;IACpB,CAAC;IAED,iFAAiF;IACjF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,SAAS,GACb,OAAO,EAAE,IAAI;YACb,CAAC,OAAO,EAAE,YAAY;gBACpB,CAAC,CAAC,+BAA+B,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC;gBACjE,CAAC,CAAC,SAAS,CAAC,CAAA;QAChB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAC,CAAA;YACtE,SAAS,GAAG,SAAS,CAAA;YACrB,YAAY,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;YACjD,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;oBACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,OAAO,EAAE,YAAY;oBACrB,IAAI,EAAE,SAAS;iBAChB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC9D,OAAO,EAAE,OAAO,EAAE,CAAA;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,YAAY;IACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,IAAI,CACF,iCAAiC,EACjC,yDAAyD,CAC1D,CACF,CAAA;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,CACV,IAAI,CACF,iCAAiC,EACjC,OAAO,QAAQ,CAAC,MAAM,+CAA+C,CACtE,CACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,IAAI,CACF,iCAAiC,EACjC,OAAO,QAAQ,CAAC,MAAM,UAAU,EAChC,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACrB,CAAC,CAAC,uIAAuI;gBACzI,CAAC,CAAC,mIAAmI,CACxI,CACF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAA;IACpB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAA;IAEtD,gCAAgC;IAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,qBAAqB,EAAE,4DAA4D,CAAC,CAC1F,CAAA;QACD,OAAO,EAAE,OAAO,EAAE,CAAA;IACpB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC,CAAA;QACnF,OAAO,EAAE,OAAO,EAAE,CAAA;IACpB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE,gBAAgB,CAAC,CAAC,CAAA;IAExE,kBAAkB;IAClB,IAAI,SAA8B,CAAA;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QACnE,OAAO,EAAE,OAAO,EAAE,CAAA;IACpB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAErF,2BAA2B;IAC3B,IAAI,CAAC,SAAS,CAAC,EAAE;QACf,OAAO,CAAC,IAAI,CACV,IAAI,CACF,kBAAkB,EAClB,SAAS,EACT,iGAAiG,CAClG,CACF,CAAA;;QACE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAE5C,IAAI,CAAC,SAAS,CAAC,KAAK;QAClB,OAAO,CAAC,IAAI,CACV,IAAI,CACF,qBAAqB,EACrB,SAAS,EACT,4EAA4E,CAC7E,CACF,CAAA;;QACE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/C,IAAI,CAAC,SAAS,CAAC,MAAM;QACnB,OAAO,CAAC,IAAI,CACV,IAAI,CACF,sBAAsB,EACtB,SAAS,EACT,4DAA4D,CAC7D,CACF,CAAA;IACH,IAAI,CAAC,SAAS,CAAC,MAAM;QACnB,OAAO,CAAC,IAAI,CACV,IAAI,CACF,sBAAsB,EACtB,SAAS,EACT,4DAA4D,CAC7D,CACF,CAAA;IAEH,kBAAkB;IAClB,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CACV,IAAI,CACF,iCAAiC,EACjC,cAAc,SAAS,CAAC,OAAO,EAAE,EACjC,2HAA2H,CAC5H,CACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;YACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAA;YAC1C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,OAAO,YAAY,CAAC,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CACV,IAAI,CACF,0BAA0B,EAC1B,sBAAsB,EACtB,2GAA2G,CAC5G,CACF,CAAA;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAA;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE,CAAA;QACnC,MAAM,OAAO,GAAG,UAAU,KAAK,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;QACxE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAA;QACtD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,IAAI,CACF,+BAA+B,EAC/B,UAAU,KAAK,cAAc,UAAU,GAAG,EAC1C,4IAA4I,CAC7I,CACF,CAAA;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,6BAA6B;IAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,OAAkC,CAAA;IAC5D,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACjD,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,IAAI,CACF,yBAAyB,EACzB,QAAQ,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EACnC,uGAAuG,CACxG,CACF,CAAA;QACH,CAAC;QAED,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAA;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,IAAI,CACF,wBAAwB,EACxB,QAAQ,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAClC,gHAAgH,CACjH,CACF,CAAA;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAA;QACvD,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CACV,IAAI,CACF,gCAAgC,EAChC,8BAA8B,EAC9B,qHAAqH,CACtH,CACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,IAAI,CACF,gCAAgC,EAChC,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAChC,uHAAuH,CACxH,CACF,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,QAAsB,EACtB,OAAqE;IAErE,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,YAAY,GAA2B;QAC3C,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,uBAAuB;KACvF,CAAA;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,SAAS,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,YAAY,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;IACnD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,SAAS,IAAI,IAAI;SACxB,CAAC,CAAA;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kCAAkC,EAAE,SAAS,CAAC,CAAC,CAAA;YAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACvE,IAAI,OAAO,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAA;YAChE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,IAAI,CACF,yCAAyC,EACzC,4BAA4B,EAC5B,yIAAyI,CAC1I,CACF,CAAA;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CACV,IAAI,CACF,kCAAkC,EAClC,OAAO,QAAQ,CAAC,MAAM,iBAAiB,EACvC,4JAA4J,CAC7J,CACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,IAAI,CACF,kCAAkC,EAClC,OAAO,QAAQ,CAAC,MAAM,EAAE,EACxB,4IAA4I,QAAQ,CAAC,MAAM,0DAA0D,CACtN,CACF,CAAA;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IACrE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/cli/validate/discovery.d.ts

@@ -0,0 +1,10 @@
+import type { EndpointSpec } from './helpers.js';
+export declare function fetchDiscoveryDoc(baseUrl: string): Promise<{
+    doc: unknown;
+    raw: string;
+} | {
+    error: string;
+}>;
+export declare function extractEndpointsFromDiscovery(doc: Record<string, unknown>): EndpointSpec[];
+export declare function extractRequestBodyFromDiscovery(doc: Record<string, unknown>, endpoint: EndpointSpec): string | undefined;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/cli/validate/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/cli/validate/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGhD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAc5D;AAKD,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CA0B1F;AA2CD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,QAAQ,EAAE,YAAY,GACrB,MAAM,GAAG,SAAS,CAuBpB"}

package/dist/cli/validate/discovery.js

@@ -0,0 +1,128 @@
+import { fetchWithTimeout, HTTP_METHODS } from './helpers.js';
+export async function fetchDiscoveryDoc(baseUrl) {
+    const url = new URL('/openapi.json', baseUrl).href;
+    try {
+        const response = await fetchWithTimeout(url, {});
+        if (!response.ok)
+            return { error: `HTTP ${response.status}` };
+        const raw = await response.text();
+        const doc = JSON.parse(raw);
+        return { doc, raw };
+    }
+    catch (error) {
+        if (error instanceof DOMException && error.name === 'AbortError')
+            return { error: 'Request timed out after 15s' };
+        if (error instanceof SyntaxError)
+            return { error: 'Invalid JSON' };
+        return { error: error.message };
+    }
+}
+// Extracts testable endpoints from an OpenAPI doc. Prefers endpoints with
+// explicit x-payment-info (the server declares them as paid). Falls back to
+// endpoints that list a 402 response (weaker signal, but still worth testing).
+export function extractEndpointsFromDiscovery(doc) {
+    const withPaymentInfo = [];
+    const with402Response = [];
+    const paths = doc.paths;
+    if (!paths)
+        return [];
+    for (const [pathKey, pathItem] of Object.entries(paths)) {
+        for (const [method, operation] of Object.entries(pathItem)) {
+            if (!HTTP_METHODS.has(method))
+                continue;
+            if (!operation || typeof operation !== 'object' || Array.isArray(operation))
+                continue;
+            const op = operation;
+            if (op['x-payment-info']) {
+                const payInfo = op['x-payment-info'];
+                withPaymentInfo.push({
+                    method: method.toUpperCase(),
+                    path: pathKey,
+                    amount: payInfo.amount,
+                });
+            }
+            else {
+                const responses = op.responses;
+                if (responses && '402' in responses) {
+                    with402Response.push({ method: method.toUpperCase(), path: pathKey });
+                }
+            }
+        }
+    }
+    return withPaymentInfo.length > 0 ? withPaymentInfo : with402Response;
+}
+// Recursively generates a minimal valid value from a JSON Schema definition.
+// Fills only required fields, preferring const > example > default > synthetic.
+function generateValueFromSchema(schema) {
+    if (schema.const !== undefined)
+        return schema.const;
+    if (schema.example !== undefined)
+        return schema.example;
+    if (schema.default !== undefined)
+        return schema.default;
+    switch (schema.type) {
+        case 'string': {
+            if (schema.format === 'email')
+                return 'test@example.com';
+            if (schema.format === 'uuid')
+                return '00000000-0000-0000-0000-000000000000';
+            if (schema.format === 'uri' || schema.format === 'url')
+                return 'https://example.com';
+            if (schema.enum && Array.isArray(schema.enum))
+                return schema.enum[0];
+            return 'test';
+        }
+        case 'number':
+        case 'integer':
+            return schema.minimum ?? 1;
+        case 'boolean':
+            return true;
+        case 'array':
+            return [];
+        case 'object': {
+            const properties = schema.properties;
+            if (!properties)
+                return {};
+            const required = schema.required || [];
+            const obj = {};
+            for (const key of required) {
+                const prop = properties[key];
+                if (prop)
+                    obj[key] = generateValueFromSchema(prop);
+            }
+            return obj;
+        }
+        default:
+            return null;
+    }
+}
+// Looks up the requestBody schema for an endpoint in the OpenAPI doc and
+// returns a JSON string suitable for the request. Uses the doc's example
+// if one exists, otherwise generates a minimal body from the schema.
+export function extractRequestBodyFromDiscovery(doc, endpoint) {
+    const paths = doc.paths;
+    if (!paths)
+        return undefined;
+    const pathItem = paths[endpoint.path];
+    if (!pathItem)
+        return undefined;
+    const op = pathItem[endpoint.method.toLowerCase()];
+    if (!op?.requestBody)
+        return undefined;
+    const rb = op.requestBody;
+    const content = rb.content;
+    const jsonContent = content?.['application/json'];
+    if (!jsonContent)
+        return undefined;
+    if (jsonContent.example)
+        return JSON.stringify(jsonContent.example);
+    const schema = jsonContent.schema;
+    if (!schema || schema.type !== 'object')
+        return undefined;
+    const result = generateValueFromSchema(schema);
+    if (result && typeof result === 'object' && Object.keys(result).length > 0) {
+        return JSON.stringify(result);
+    }
+    return undefined;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/cli/validate/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/cli/validate/discovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE7D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe;IAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAA;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;QAC7D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAC9D,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAA;QACjD,IAAI,KAAK,YAAY,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;QAClE,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAA;IAC5C,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,UAAU,6BAA6B,CAAC,GAA4B;IACxE,MAAM,eAAe,GAAmB,EAAE,CAAA;IAC1C,MAAM,eAAe,GAAmB,EAAE,CAAA;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAA4D,CAAA;IAC9E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAQ;YACvC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,SAAQ;YACrF,MAAM,EAAE,GAAG,SAAoC,CAAA;YAC/C,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,EAAE,CAAC,gBAAgB,CAA4B,CAAA;gBAC/D,eAAe,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,OAAO,CAAC,MAA4B;iBAC7C,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,EAAE,CAAC,SAAgD,CAAA;gBACrE,IAAI,SAAS,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;oBACpC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAA;AACvE,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IACnD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,OAAO,CAAA;IACvD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,OAAO,CAAA;IAEvD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,kBAAkB,CAAA;YACxD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,sCAAsC,CAAA;YAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,qBAAqB,CAAA;YACpF,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACpE,OAAO,MAAM,CAAA;QACf,CAAC;QACD,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,CAAA;QAC5B,KAAK,SAAS;YACZ,OAAO,IAAI,CAAA;QACb,KAAK,OAAO;YACV,OAAO,EAAE,CAAA;QACX,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,UAAU,GAAG,MAAM,CAAC,UAAiE,CAAA;YAC3F,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,CAAA;YAC1B,MAAM,QAAQ,GAAI,MAAM,CAAC,QAAqB,IAAI,EAAE,CAAA;YACpD,MAAM,GAAG,GAA4B,EAAE,CAAA;YACvC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC5B,IAAI,IAAI;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;YACpD,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;QACD;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,MAAM,UAAU,+BAA+B,CAC7C,GAA4B,EAC5B,QAAsB;IAEtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAA4D,CAAA;IAC9E,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAwC,CAAA;IACzF,IAAI,CAAC,EAAE,EAAE,WAAW;QAAE,OAAO,SAAS,CAAA;IAEtC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAsC,CAAA;IACpD,MAAM,OAAO,GAAG,EAAE,CAAC,OAA8C,CAAA;IACjE,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC,kBAAkB,CAAwC,CAAA;IACxF,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAA;IAElC,IAAI,WAAW,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IAEnE,MAAM,MAAM,GAAG,WAAW,CAAC,MAA6C,CAAA;IACxE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAEzD,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/cli/validate/helpers.d.ts

@@ -0,0 +1,33 @@
+export type CheckResult = {
+    label: string;
+    detail?: string | undefined;
+    hint?: string | undefined;
+    severity: 'pass' | 'fail' | 'warn' | 'skip';
+};
+export type EndpointSpec = {
+    method: string;
+    path: string;
+    amount?: string | undefined;
+};
+export declare function check(label: string, detail?: string): CheckResult;
+export declare function fail(label: string, detail?: string, hint?: string): CheckResult;
+export declare function warn(label: string, detail?: string, hint?: string): CheckResult;
+export declare function skip(label: string, detail?: string, hint?: string): CheckResult;
+export declare function printCheck(result: CheckResult): void;
+export declare function printSection(title: string): void;
+export type Counts = {
+    passed: number;
+    failed: number;
+    warnings: number;
+    skipped: number;
+};
+export declare function printResults(results: CheckResult[], counts: Counts): void;
+export declare function fetchWithTimeout(url: string, init: RequestInit, timeoutMs?: number): Promise<Response>;
+export declare function buildUrl(baseUrl: string, endpoint: EndpointSpec, query?: string[]): string;
+export declare function formatBytes(bytes: number): string;
+export declare const HTTP_METHODS: Set<string>;
+export declare function isValidAddress(addr: unknown): boolean;
+export declare function isValidIntegerAmount(amount: unknown): boolean;
+export declare function parseEndpointArg(input: string): EndpointSpec | null;
+export declare function resolveBodyForEndpoint(rawBody: string | undefined, endpointPath: string): string | undefined;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/cli/validate/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/cli/validate/helpers.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CAC5C,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5B,CAAA;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,CAEjE;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAK/E;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAK/E;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAI/E;AASD,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,QAO7C;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,QAEzC;AAED,MAAM,MAAM,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1F,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,QAQlE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,SAAS,SAAS,GACjB,OAAO,CAAC,QAAQ,CAAC,CAQnB;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAW1F;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjD;AAED,eAAO,MAAM,YAAY,aASvB,CAAA;AAEF,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CASnE;AAID,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAcpB"}

package/dist/cli/validate/helpers.js

@@ -0,0 +1,136 @@
+import { pc } from '../utils.js';
+export function check(label, detail) {
+    return detail ? { label, detail, severity: 'pass' } : { label, severity: 'pass' };
+}
+export function fail(label, detail, hint) {
+    const r = { label, severity: 'fail' };
+    if (detail)
+        r.detail = detail;
+    if (hint)
+        r.hint = hint;
+    return r;
+}
+export function warn(label, detail, hint) {
+    const r = { label, severity: 'warn' };
+    if (detail)
+        r.detail = detail;
+    if (hint)
+        r.hint = hint;
+    return r;
+}
+export function skip(label, detail, hint) {
+    const r = detail ? { label, detail, severity: 'skip' } : { label, severity: 'skip' };
+    if (hint)
+        r.hint = hint;
+    return r;
+}
+const SEVERITY_ICONS = {
+    pass: pc.green('✓'),
+    fail: pc.red('✗'),
+    warn: pc.yellow('⚠'),
+    skip: pc.dim('○'),
+};
+export function printCheck(result) {
+    const icon = SEVERITY_ICONS[result.severity];
+    const text = result.detail ? `${result.label} (${result.detail})` : result.label;
+    console.log(`  ${icon} ${text}`);
+    if (result.hint && result.severity !== 'pass') {
+        console.log(pc.dim(`    → ${result.hint}`));
+    }
+}
+export function printSection(title) {
+    console.log(`\n${pc.bold(title)}`);
+}
+export function printResults(results, counts) {
+    for (const result of results) {
+        printCheck(result);
+        if (result.severity === 'pass')
+            counts.passed++;
+        else if (result.severity === 'fail')
+            counts.failed++;
+        else if (result.severity === 'warn')
+            counts.warnings++;
+        else if (result.severity === 'skip')
+            counts.skipped++;
+    }
+}
+export async function fetchWithTimeout(url, init, timeoutMs = 15_000) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export function buildUrl(baseUrl, endpoint, query) {
+    let url = new URL(endpoint.path, baseUrl).href;
+    if (query) {
+        const u = new URL(url);
+        for (const q of query) {
+            const [key, ...rest] = q.split('=');
+            if (key)
+                u.searchParams.set(key, rest.join('='));
+        }
+        url = u.href;
+    }
+    return url;
+}
+export function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes}B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)}KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+}
+export const HTTP_METHODS = new Set([
+    'get',
+    'post',
+    'put',
+    'patch',
+    'delete',
+    'head',
+    'options',
+    'trace',
+]);
+export function isValidAddress(addr) {
+    return typeof addr === 'string' && /^0x[0-9a-fA-F]{40}$/.test(addr);
+}
+export function isValidIntegerAmount(amount) {
+    return typeof amount === 'string' && /^(0|[1-9][0-9]*)$/.test(amount);
+}
+export function parseEndpointArg(input) {
+    const sep = input.indexOf(':');
+    if (sep < 1)
+        return null;
+    const method = input.slice(0, sep).toLowerCase();
+    if (!HTTP_METHODS.has(method))
+        return null;
+    const path = input.slice(sep + 1);
+    if (!path)
+        return null;
+    const normalizedPath = path.startsWith('/') ? path : '/' + path;
+    return { method: method.toUpperCase(), path: normalizedPath };
+}
+// Resolves --body input: if JSON with all keys starting with /, it's a
+// per-path mapping. Otherwise it's a global body for all endpoints.
+export function resolveBodyForEndpoint(rawBody, endpointPath) {
+    if (!rawBody)
+        return undefined;
+    try {
+        const parsed = JSON.parse(rawBody);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            const keys = Object.keys(parsed);
+            if (keys.length > 0 && keys.every((k) => k.startsWith('/'))) {
+                const value = parsed[endpointPath];
+                if (value === undefined)
+                    return undefined;
+                return typeof value === 'string' ? value : JSON.stringify(value);
+            }
+        }
+    }
+    catch { }
+    return rawBody;
+}
+//# sourceMappingURL=helpers.js.map

package/dist/cli/validate/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/cli/validate/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAehC,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,MAAe;IAClD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AACnF,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,MAAe,EAAE,IAAa;IAChE,MAAM,CAAC,GAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClD,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAA;IAC7B,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,MAAe,EAAE,IAAa;IAChE,MAAM,CAAC,GAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClD,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAA;IAC7B,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,MAAe,EAAE,IAAa;IAChE,MAAM,CAAC,GAAgB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IACjG,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;IACnB,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACjB,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;IACpB,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACT,CAAA;AAEV,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAA;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IAChC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACpC,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,OAAsB,EAAE,MAAc;IACjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAAE,MAAM,CAAC,MAAM,EAAE,CAAA;aAC1C,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAAE,MAAM,CAAC,MAAM,EAAE,CAAA;aAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAA;aACjD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAAE,MAAM,CAAC,OAAO,EAAE,CAAA;IACvD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,IAAiB,EACjB,SAAS,GAAG,MAAM;IAElB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;IAC/D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IACjE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,QAAsB,EAAE,KAAgB;IAChF,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAA;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,GAAG;gBAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,CAAC;QACD,GAAG,GAAG,CAAC,CAAC,IAAI,CAAA;IACd,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,GAAG,CAAA;IACpC,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAChE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAChD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAA;IAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;AAC/D,CAAC;AAED,uEAAuE;AACvE,oEAAoE;AACpE,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,YAAoB;IAEpB,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAChC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;gBAClC,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/cli/validate/index.d.ts

@@ -0,0 +1,17 @@
+import { Cli } from 'incur';
+declare const validate: Cli.Cli<{
+    [x: string]: {
+        args: {
+            url: string;
+        };
+        options: {
+            verbose: number;
+            yes: boolean;
+            endpoint?: string | undefined;
+            body?: string | undefined;
+            query?: string[] | undefined;
+        };
+    };
+}, undefined, undefined, undefined>;
+export default validate;
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/validate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/validate/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAK,MAAM,OAAO,CAAA;AAuB9B,QAAA,MAAM,QAAQ;;;;;;;;;;;;;mCA4CZ,CAAA;AAEF,eAAe,QAAQ,CAAA"}