openpay-x402-sdk 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.8.1
+
+- Fix `openpay-x402-sdk/delivery` on Cloudflare Workers: the JWKS fetch called a
+  detached `fetch`, which Workers reject with "Illegal invocation", so every ticket
+  failed with `keys_unavailable`. Verified on a real Worker deployment (2026-09-10).
+- Templates: send `Content-Disposition: attachment; filename="<object key>"` only on
+  successful file responses. An error response carrying `attachment` made Chrome
+  show ERR_INVALID_RESPONSE instead of the JSON body.
+
 ## 0.8.0
 
 - Add the typed `openpay-x402-sdk/delivery` Web-API-only subpath: strict Ed25519

package/README.md

@@ -171,7 +171,7 @@ and is never transmitted.
 
 ## 利用ライセンス (License NFT)
 
-SDK 0.7.1 (workspace update; not yet published) resolves the NFT definition from
+SDK 0.7.1 resolves the NFT definition from
 one product ID. Set only `LICENSE_PRODUCT_ID` and `LICENSE_SESSION_SECRET` on
 your server. The secret must contain at least 32 random bytes of key material
 (for example 32 random bytes encoded as hex). Replace the service URLs below
@@ -376,8 +376,7 @@ consumer types.
 
 ## 保護配布 (Delivery ticket)
 
-SDK 0.8.0 is an **initial generation** workspace release, not yet published or
-production-adopted. OpenPay signs a 60-second bearer ticket after checking
+SDK 0.8.0 adds delivery-ticket verification. OpenPay signs a 60-second bearer ticket after checking
 entitlement. Sellers verify it with the public JWKS; no secret is shared with
 OpenPay. The token is signed, not encrypted, and its claims are readable.
 Possession authorizes admission during its lifetime; it is access control, not
@@ -468,7 +467,7 @@ issuance does not revoke an attacker's signing ability or recall downloaded byte
 | Node 20.19+ | Global WebCrypto with standard Ed25519; package engine remains Node >=20. |
 | Node 22.13+ | Same Web API entry point. |
 | Node 24 | Same Web API entry point. |
-| Cloudflare Workers | Standard `Ed25519`, no `nodejs_compat`; run a real deployment smoke on the template's pinned compatibility date. |
+| Cloudflare Workers | Standard `Ed25519`, no `nodejs_compat`. Verified end-to-end on a real Worker + private R2 deployment with SDK 0.8.1 (2026-09-10); re-run the smoke when you change the compatibility date. |
 
 `ready()` detects missing Ed25519 support as `unsupported_crypto`; there is no
 algorithm downgrade. The matrix is a release target, not proof that every runtime

package/examples/cloudflare-r2-delivery-gate/worker.mjs

@@ -3,8 +3,16 @@ import { createDeliveryGate } from 'openpay-x402-sdk/delivery';
 const PRIVATE_HEADERS = {
   'Cache-Control': 'private, no-store',
   'Referrer-Policy': 'no-referrer',
-  'Content-Disposition': 'attachment',
 };
+// Only successful file responses are downloads. An error response carrying
+// Content-Disposition: attachment makes Chrome show ERR_INVALID_RESPONSE instead of
+// the JSON body (observed on 2026-09-10). The filename comes from the trusted object
+// key, reduced to a safe ASCII token so no header injection is possible.
+function attachment(key) {
+  const base = key.split('/').pop() ?? '';
+  const name = base.replace(/[^A-Za-z0-9._-]/g, '_').replace(/^\.+/, '').slice(0, 100) || 'download';
+  return `attachment; filename="${name}"`;
+}
 const instances = new WeakMap();
 
 async function startup(env) {
@@ -56,7 +64,7 @@ const worker = {
       // This small template ignores Range/conditional headers and serves a full
       // 200 (HEAD returns metadata). Every such request still requires a ticket.
       return new Response(request.method === 'HEAD' ? null : file.body, {
-        headers: { ...PRIVATE_HEADERS, 'Content-Type': 'application/octet-stream', 'Content-Length': String(file.size) },
+        headers: { ...PRIVATE_HEADERS, 'Content-Disposition': attachment(key), 'Content-Type': 'application/octet-stream', 'Content-Length': String(file.size) },
       });
     } catch {
       // Do not expose request URLs, tickets, R2 keys or upstream exceptions.

package/examples/node-delivery-gate.mjs

@@ -2,8 +2,11 @@ import { createServer } from 'node:http';
 import { pathToFileURL } from 'node:url';
 import { createDeliveryGate } from 'openpay-x402-sdk/delivery';
 
+// No Content-Disposition here: the redirect target (your presigned URL) decides the
+// download name, and an error response carrying "attachment" makes Chrome show
+// ERR_INVALID_RESPONSE instead of the JSON body.
 const PRIVATE_HEADERS = {
-  'Cache-Control': 'private, no-store', 'Referrer-Policy': 'no-referrer', 'Content-Disposition': 'attachment',
+  'Cache-Control': 'private, no-store', 'Referrer-Policy': 'no-referrer',
 };
 
 async function presignObject({ key, method, expiresAt, expiresInSeconds }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpay-x402-sdk",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Guarded Node.js buyer SDK for OpenPay x402 JPYC resources",
   "type": "module",
   "main": "./src/index.mjs",

package/src/delivery.mjs

@@ -192,7 +192,9 @@ async function refresh(cache, config) {
     });
     try {
       const { keys, age } = await Promise.race([
-        (async () => readKeysResponse(await config.fetchImpl(`${config.origin}/.well-known/openpay-delivery-keys.json`, {
+        // Call with `this` = globalThis: Cloudflare Workers reject a detached `fetch`
+        // ("Illegal invocation") — observed on a real Worker on 2026-09-10; Node does not.
+        (async () => readKeysResponse(await config.fetchImpl.call(globalThis, `${config.origin}/.well-known/openpay-delivery-keys.json`, {
           method: 'GET', redirect: 'manual', signal: controller.signal, headers: { accept: 'application/json' },
         }), config))(), timeout,
       ]);