uvd-x402-sdk 2.78.0 → 2.80.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +107 -0
- package/dist/backend/index.d.mts +179 -21
- package/dist/backend/index.d.ts +179 -21
- package/dist/backend/index.js +133 -31
- package/dist/backend/index.js.map +1 -1
- package/dist/backend/index.mjs +131 -32
- package/dist/backend/index.mjs.map +1 -1
- package/dist/index.d.mts +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.js +102 -22
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +100 -23
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
- package/src/backend/facilitator-error.ts +201 -11
- package/src/backend/index.ts +201 -44
- package/src/index.ts +6 -0
package/README.md
CHANGED
|
@@ -877,6 +877,8 @@ try {
|
|
|
877
877
|
|---|---|---|
|
|
878
878
|
| **402** | the payment was **rejected** | sign a **new** authorization |
|
|
879
879
|
| **503** | **no verdict was reached** | resend the **same** credential |
|
|
880
|
+
| **502** `upstream_rpc_unavailable` | the node never answered; nothing was broadcast | resend the **same** credential |
|
|
881
|
+
| **502** `settlement_unconfirmed` | broadcast, **and it may be mined** | **send nothing** — look up the hash |
|
|
880
882
|
|
|
881
883
|
Charging a `503` as a `402` makes the buyer sign and broadcast a second payment
|
|
882
884
|
for money that was never refused — and the first authorization is still
|
|
@@ -893,6 +895,11 @@ if (!result.success) {
|
|
|
893
895
|
// result.reason -> 'holder_unknown' | 'forward_failed' | ...
|
|
894
896
|
// result.retryAfterSeconds -> already clamped, never an hour
|
|
895
897
|
// result.safeToReplay -> true only if the facilitator proved nothing ran
|
|
898
|
+
} else if (isSettlementUnconfirmed(result)) {
|
|
899
|
+
// NOT a refusal: the transfer was broadcast and may already be mined.
|
|
900
|
+
// Reconcile — never re-send.
|
|
901
|
+
// result.transaction -> the hash, in that chain's own encoding
|
|
902
|
+
// result.paymentId -> the same id a successful settle would have printed
|
|
896
903
|
} else {
|
|
897
904
|
// A real refusal. result.errorReason says why.
|
|
898
905
|
}
|
|
@@ -935,12 +942,68 @@ new FacilitatorClient({ retries: 0 }); // never replay; default is 2 extra att
|
|
|
935
942
|
misconfigured facilitator answering `Retry-After: 3600` would otherwise hang the
|
|
936
943
|
request for an hour.
|
|
937
944
|
|
|
945
|
+
### The two `502`s mean opposite things — branch on the body, not the status
|
|
946
|
+
|
|
947
|
+
`POST /settle` answers `502` for two situations that call for opposite moves:
|
|
948
|
+
|
|
949
|
+
| body `error` | `Retry-After` | did the money move? | retry? |
|
|
950
|
+
|---|---|---|---|
|
|
951
|
+
| `upstream_rpc_unavailable` | `30` | no, nothing was broadcast | **yes** |
|
|
952
|
+
| `settlement_unconfirmed` | **absent** | **maybe — it may be mined** | **never** |
|
|
953
|
+
|
|
954
|
+
`settlement_unconfirmed` is emitted when the transaction went out and no receipt
|
|
955
|
+
ever came back. Retrying it re-signs a **new** authorization with a **fresh
|
|
956
|
+
nonce**, which the chain accepts as a second, perfectly valid payment for the
|
|
957
|
+
same purchase — the buyer pays twice, in exactly the case the facilitator emits
|
|
958
|
+
this error to prevent. `authorizationState` does not stop it: the second
|
|
959
|
+
authorization is genuinely new.
|
|
960
|
+
|
|
961
|
+
So the status alone cannot decide. This SDK reads the body:
|
|
962
|
+
|
|
963
|
+
```typescript
|
|
964
|
+
import { isSettlementUnconfirmed, SETTLEMENT_UNCONFIRMED } from 'uvd-x402-sdk';
|
|
965
|
+
|
|
966
|
+
const result = await client.settle(payment, requirements);
|
|
967
|
+
|
|
968
|
+
if (!result.success && isSettlementUnconfirmed(result)) {
|
|
969
|
+
// result.retryable -> false. Do not resend, and do not ask for a signature.
|
|
970
|
+
// result.transaction -> what to look up on chain
|
|
971
|
+
// result.paymentId -> matches the id a successful settle prints, so a
|
|
972
|
+
// payment later found confirmed reconciles cleanly
|
|
973
|
+
await reconcileOnChain(result.transaction);
|
|
974
|
+
}
|
|
975
|
+
```
|
|
976
|
+
|
|
977
|
+
`result.transaction` is **not always `0x`-prefixed** — Algorand prints base32 and
|
|
978
|
+
Solana base58. Pass it through verbatim; reformatting it makes it unpasteable in
|
|
979
|
+
an explorer, and pasting it is the entire remedy on offer.
|
|
980
|
+
|
|
981
|
+
The same reading applies to `Erc8004LookupError` (`POST /register` goes through
|
|
982
|
+
the same EVM path, so a mint can come back unconfirmed too) and to every gasless
|
|
983
|
+
escrow call. An explicit `retryable: false` in a facilitator body always wins
|
|
984
|
+
over the status — but only ever **downgrades**: a body claiming `retryable: true`
|
|
985
|
+
on a `402` will not make this SDK resend a genuinely refused credential.
|
|
986
|
+
|
|
987
|
+
Three independent signals stop a retry, because the cost of missing one is a
|
|
988
|
+
second payment: the explicit `retryable: false`, the named
|
|
989
|
+
`settlement_unconfirmed`, and — the general rule — **any 5xx body carrying a
|
|
990
|
+
transaction hash at all**, under any of `transaction`, `transaction.hash`,
|
|
991
|
+
`txHash`, `tx_hash` or `transaction_hash`. A hash in a *failure* means the
|
|
992
|
+
facilitator got as far as broadcasting, whatever it called the error, so that
|
|
993
|
+
last rule holds for codes that do not exist yet. It is the Python SDK's
|
|
994
|
+
anti-double-settle guard, adopted here.
|
|
995
|
+
|
|
938
996
|
### Middleware
|
|
939
997
|
|
|
940
998
|
`createPaymentMiddleware` and `createHonoMiddleware` answer **503 with a
|
|
941
999
|
`Retry-After` header** — not `402`, not `500` — whenever the facilitator reached
|
|
942
1000
|
no verdict, and keep answering `402` for genuine rejections.
|
|
943
1001
|
|
|
1002
|
+
An unconfirmed settlement is the one 5xx that goes out as **`500`, with no
|
|
1003
|
+
`Retry-After`**: "stop" is the correct instruction when the transfer may already
|
|
1004
|
+
be mining. The body carries `transaction`, `paymentId` and `retryable: false`, so
|
|
1005
|
+
the buyer's client can reconcile instead of paying again.
|
|
1006
|
+
|
|
944
1007
|
## ERC-8004 Trustless Agents
|
|
945
1008
|
|
|
946
1009
|
Build verifiable on-chain reputation for AI agents and services. Supports **21 networks** (19 EVM + 2 Solana).
|
|
@@ -1351,6 +1414,50 @@ const body = buildVerifyRequestV2(
|
|
|
1351
1414
|
> error that names no field. If you see it, check the envelope shape first, not
|
|
1352
1415
|
> the fields inside it.
|
|
1353
1416
|
|
|
1417
|
+
### The top-level `x402Version` names the ENVELOPE
|
|
1418
|
+
|
|
1419
|
+
`VerifyRequest.x402Version` is typed `1`, not `1 | 2`: it says which of the two
|
|
1420
|
+
shapes above the body has, and `VerifyRequest` **is** the v1 shape. The payer's
|
|
1421
|
+
own version stays where the payer put it, in `paymentPayload.x402Version`, and
|
|
1422
|
+
the SDK never rewrites it.
|
|
1423
|
+
|
|
1424
|
+
```typescript
|
|
1425
|
+
// A buyer that declares v2 while carrying plain network names — legal, and what
|
|
1426
|
+
// a 402 advertising CAIP-2 invites.
|
|
1427
|
+
const body = buildVerifyRequest({ x402Version: 2, scheme: 'exact', network: 'base', payload }, reqs);
|
|
1428
|
+
|
|
1429
|
+
body.x402Version; // 1 — the envelope is v1
|
|
1430
|
+
body.paymentPayload.x402Version; // 2 — the payer's marker, untouched
|
|
1431
|
+
```
|
|
1432
|
+
|
|
1433
|
+
`resolveEnvelopeVersion` (and therefore the `'auto'` default) accepts a **v2
|
|
1434
|
+
payload** as well as a v1 header. A v2 payload has no top-level `network` at all
|
|
1435
|
+
— v2 moved the chain id into `accepted` — so `auto` reads it from there. Before
|
|
1436
|
+
**2.79.0** it read only the top level and threw
|
|
1437
|
+
`Cannot read properties of undefined` on exactly that shape, which is why
|
|
1438
|
+
integrators were pinning `x402Version` instead of using the default.
|
|
1439
|
+
|
|
1440
|
+
A network with **no CAIP-2 form** cannot travel in a v2 body at all, so pinning
|
|
1441
|
+
version 2 on one throws instead of building it — `xrpl-mainnet` is the case: its
|
|
1442
|
+
v1 string *is* its network id. `auto` leaves those on v1, where they work, so
|
|
1443
|
+
you only reach the throw by pinning. It names the network and the escape, which
|
|
1444
|
+
the facilitator's `400` (`data did not match any variant of untagged enum`) does
|
|
1445
|
+
not.
|
|
1446
|
+
|
|
1447
|
+
Until **2.79.0** the top level inherited `paymentHeader.x402Version`, so that
|
|
1448
|
+
call emitted a body declaring `2` around a `paymentRequirements` — a v1 shape.
|
|
1449
|
+
It was served correctly then and it is served correctly now: the facilitator's
|
|
1450
|
+
envelope enum is untagged and matches on shape. But the facilitator already
|
|
1451
|
+
reads that marker for one thing — choosing the hint in its `400`:
|
|
1452
|
+
|
|
1453
|
+
> `This body declares `x402Version: 2`. x402 v2 is a JSON object with
|
|
1454
|
+
> `paymentPayload`, `resource` and `accepted`…`
|
|
1455
|
+
|
|
1456
|
+
So the first time such a body failed for an unrelated reason, the diagnosis sent
|
|
1457
|
+
you to fix the wrong shape. If you were constructing a `VerifyRequest` by hand
|
|
1458
|
+
with a `1 | 2` variable, that no longer type-checks — write `1`, or use
|
|
1459
|
+
`buildVerifyRequestForVersion` and let it pick.
|
|
1460
|
+
|
|
1354
1461
|
## Metrics and history (`getStats` / `getTransactions`)
|
|
1355
1462
|
|
|
1356
1463
|
```typescript
|
package/dist/backend/index.d.mts
CHANGED
|
@@ -45,8 +45,34 @@ import { Q as X402Version, x as X402Header, G as X402PayloadData } from '../inde
|
|
|
45
45
|
* sequence that once minted five duplicate agents — reconcile with
|
|
46
46
|
* `GET /identity/{network}/owner/{recipient}` or `getRegisterStatus` instead.
|
|
47
47
|
*
|
|
48
|
+
* # The two `502`s of `/settle`, which mean opposite things
|
|
49
|
+
*
|
|
50
|
+
* | body `error` | `Retry-After` | did the money move? | retry? |
|
|
51
|
+
* |----------------------------|---------------|---------------------|-----------|
|
|
52
|
+
* | `upstream_rpc_unavailable` | `30` | no, never broadcast | **yes** |
|
|
53
|
+
* | `settlement_unconfirmed` | **absent** | **maybe — mined?** | **NEVER** |
|
|
54
|
+
*
|
|
55
|
+
* `settlement_unconfirmed` is answered after the transaction was broadcast and
|
|
56
|
+
* no receipt ever arrived, so it MAY be mined. Retrying re-signs a new
|
|
57
|
+
* authorization with a fresh nonce, which the chain accepts as a second,
|
|
58
|
+
* perfectly valid payment for the same purchase — the buyer pays twice, in
|
|
59
|
+
* exactly the case the facilitator emits it to prevent. The `transaction` hash
|
|
60
|
+
* and `paymentId` travel in the body so the caller can LOOK AT THE CHAIN; they
|
|
61
|
+
* are not an invitation to send it again.
|
|
62
|
+
*
|
|
63
|
+
* The status cannot tell the two apart, which is why this file used to get it
|
|
64
|
+
* wrong: every `502` was retryable, and until `settlement_unconfirmed` existed
|
|
65
|
+
* that was correct. **Branch on the body.**
|
|
66
|
+
*
|
|
67
|
+
* The general form of that rule — **a 5xx whose body carries a transaction hash
|
|
68
|
+
* was broadcast, whatever the error is called** — is adopted from the Python
|
|
69
|
+
* SDK, which has carried it as its anti-double-settle guard
|
|
70
|
+
* (`uvd_x402_sdk/client.py`, `_is_retryable_settle_error`) while this one had
|
|
71
|
+
* only the status to go on.
|
|
72
|
+
*
|
|
48
73
|
* Source of the shape: x402-rs `src/handlers.rs` `writer_lease_unavailable()`
|
|
49
|
-
* and `require_writer_lease()
|
|
74
|
+
* and `require_writer_lease()`; `SettlementUnconfirmedResponse` in
|
|
75
|
+
* `src/types.rs`, built in the `IntoResponse` of `FacilitatorLocalError`.
|
|
50
76
|
*/
|
|
51
77
|
/**
|
|
52
78
|
* A `reason` the facilitator attaches to a writer-lease 503.
|
|
@@ -72,6 +98,13 @@ declare const REPLAYABLE_LEASE_REASONS: readonly WriterLeaseReason[];
|
|
|
72
98
|
* automatically. Resolve it by reading state, not by re-POSTing.
|
|
73
99
|
*/
|
|
74
100
|
declare const AMBIGUOUS_LEASE_REASONS: readonly WriterLeaseReason[];
|
|
101
|
+
/**
|
|
102
|
+
* The facilitator's `error` code for a settle it broadcast and could not confirm.
|
|
103
|
+
*
|
|
104
|
+
* The transaction may be mined. This is the one upstream failure that must
|
|
105
|
+
* never be retried; reconcile with `transaction` / `paymentId` instead.
|
|
106
|
+
*/
|
|
107
|
+
declare const SETTLEMENT_UNCONFIRMED = "settlement_unconfirmed";
|
|
75
108
|
/**
|
|
76
109
|
* Ceiling, in seconds, on how long an automatic retry will wait.
|
|
77
110
|
*
|
|
@@ -98,6 +131,24 @@ interface FacilitatorErrorInfo {
|
|
|
98
131
|
status: number;
|
|
99
132
|
/** The facilitator's own `reason`, when the body carried one. */
|
|
100
133
|
reason?: string;
|
|
134
|
+
/**
|
|
135
|
+
* The facilitator's machine-readable `error` code, verbatim.
|
|
136
|
+
*
|
|
137
|
+
* Some codes carry a `(ref: <uuid>)` suffix, so compare with care —
|
|
138
|
+
* {@link SETTLEMENT_UNCONFIRMED} is emitted bare. Branch on this rather than
|
|
139
|
+
* on the status: `/settle` has two `502`s that mean opposite things.
|
|
140
|
+
*/
|
|
141
|
+
errorCode?: string;
|
|
142
|
+
/**
|
|
143
|
+
* The hash of a transaction that WAS broadcast, in that chain's own encoding.
|
|
144
|
+
*
|
|
145
|
+
* Present on {@link SETTLEMENT_UNCONFIRMED}. Not always `0x`-prefixed:
|
|
146
|
+
* Algorand prints base32 and Solana base58, and reformatting it makes it
|
|
147
|
+
* unpasteable in an explorer — which is the entire remedy on offer.
|
|
148
|
+
*/
|
|
149
|
+
transaction?: string;
|
|
150
|
+
/** `keccak256(caip2 ‖ txHash)`, the same id a successful settle would print. */
|
|
151
|
+
paymentId?: string;
|
|
101
152
|
/**
|
|
102
153
|
* Seconds to wait before retrying, already clamped to
|
|
103
154
|
* {@link MAX_RETRY_AFTER_SECONDS}. Absent when the answer is not retryable.
|
|
@@ -126,6 +177,15 @@ interface FacilitatorFailureFields {
|
|
|
126
177
|
status?: number;
|
|
127
178
|
/** The facilitator's `reason` for the refusal (see {@link WriterLeaseReason}). */
|
|
128
179
|
reason?: string;
|
|
180
|
+
/** The facilitator's machine-readable `error` code (see {@link FacilitatorErrorInfo.errorCode}). */
|
|
181
|
+
errorCode?: string;
|
|
182
|
+
/**
|
|
183
|
+
* A transaction that WAS broadcast and could not be confirmed. Look it up on
|
|
184
|
+
* chain; do NOT send the payment again. See {@link SETTLEMENT_UNCONFIRMED}.
|
|
185
|
+
*/
|
|
186
|
+
transaction?: string;
|
|
187
|
+
/** The payment id for that transaction, identical to the one a settle prints. */
|
|
188
|
+
paymentId?: string;
|
|
129
189
|
/** True when the same request may be sent again without re-signing anything. */
|
|
130
190
|
retryable?: boolean;
|
|
131
191
|
/** Seconds to wait before retrying, clamped to {@link MAX_RETRY_AFTER_SECONDS}. */
|
|
@@ -149,6 +209,41 @@ declare function parseRetryAfterSeconds(response: {
|
|
|
149
209
|
get?: (name: string) => string | null;
|
|
150
210
|
};
|
|
151
211
|
}): number | undefined;
|
|
212
|
+
/** Everything this SDK reads out of a facilitator error body. */
|
|
213
|
+
interface ParsedFacilitatorErrorBody {
|
|
214
|
+
/** The `error` code, verbatim. */
|
|
215
|
+
errorCode?: string;
|
|
216
|
+
/** The writer-lease `reason`. */
|
|
217
|
+
reason?: string;
|
|
218
|
+
/** A broadcast transaction hash, in its own chain's encoding. */
|
|
219
|
+
transaction?: string;
|
|
220
|
+
/** The payment id for that hash. */
|
|
221
|
+
paymentId?: string;
|
|
222
|
+
/**
|
|
223
|
+
* The facilitator's OWN retry verdict, when it stated one.
|
|
224
|
+
*
|
|
225
|
+
* `undefined` on every body that does not carry the field — which is most of
|
|
226
|
+
* them, so absence means "the facilitator did not say", never "no".
|
|
227
|
+
*/
|
|
228
|
+
retryable?: boolean;
|
|
229
|
+
}
|
|
230
|
+
/**
|
|
231
|
+
* Read a JSON error body, tolerating anything that is not one.
|
|
232
|
+
*
|
|
233
|
+
* Exported so {@link FacilitatorErrorInfo} and `Erc8004LookupError` read the
|
|
234
|
+
* SAME fields the same way. Two subtly different parses of the same body is how
|
|
235
|
+
* one code path stops honouring a `retryable: false` the other one honours.
|
|
236
|
+
*/
|
|
237
|
+
declare function parseFacilitatorErrorBody(body: string): ParsedFacilitatorErrorBody;
|
|
238
|
+
/**
|
|
239
|
+
* This refusal reports a transaction that may already be mined.
|
|
240
|
+
*
|
|
241
|
+
* The caller's move is to look up `transaction` / `paymentId` on chain. Sending
|
|
242
|
+
* the payment again is the double-charge.
|
|
243
|
+
*/
|
|
244
|
+
declare function isSettlementUnconfirmed(failure: {
|
|
245
|
+
errorCode?: string;
|
|
246
|
+
}): boolean;
|
|
152
247
|
/**
|
|
153
248
|
* Turn a non-2xx facilitator response into {@link FacilitatorErrorInfo}.
|
|
154
249
|
*
|
|
@@ -234,18 +329,30 @@ interface PaymentRequirements {
|
|
|
234
329
|
extra?: unknown;
|
|
235
330
|
}
|
|
236
331
|
/**
|
|
237
|
-
* Verify request body for the facilitator /verify endpoint
|
|
332
|
+
* Verify request body for the facilitator /verify endpoint -- the **v1**
|
|
333
|
+
* envelope. {@link VerifyRequestV2} is the other one.
|
|
238
334
|
*/
|
|
239
335
|
interface VerifyRequest {
|
|
240
|
-
|
|
336
|
+
/**
|
|
337
|
+
* Always `1`: this marker names the ENVELOPE, and this envelope is v1.
|
|
338
|
+
*
|
|
339
|
+
* Narrowed from `X402Version` on 2026-09-04. A `VerifyRequest` carrying `2`
|
|
340
|
+
* was always an uninhabitable value -- a body declaring v2 while shaped as
|
|
341
|
+
* v1 -- and typing it as `1 | 2` is what let the payer's marker be copied in
|
|
342
|
+
* here. The payer's version lives in `paymentPayload.x402Version`, which is
|
|
343
|
+
* still the full union.
|
|
344
|
+
*/
|
|
345
|
+
x402Version: 1;
|
|
241
346
|
paymentPayload: X402Header;
|
|
242
347
|
paymentRequirements: PaymentRequirements;
|
|
243
348
|
}
|
|
244
349
|
/**
|
|
245
|
-
* Settle request body for the facilitator /settle endpoint
|
|
350
|
+
* Settle request body for the facilitator /settle endpoint -- the **v1**
|
|
351
|
+
* envelope. {@link SettleRequestV2} is the other one.
|
|
246
352
|
*/
|
|
247
353
|
interface SettleRequest {
|
|
248
|
-
x402Version
|
|
354
|
+
/** Always `1` -- see {@link VerifyRequest.x402Version}. */
|
|
355
|
+
x402Version: 1;
|
|
249
356
|
paymentPayload: X402Header;
|
|
250
357
|
paymentRequirements: PaymentRequirements;
|
|
251
358
|
}
|
|
@@ -551,6 +658,14 @@ declare function toResourceInfoV2(requirements: PaymentRequirements): ResourceIn
|
|
|
551
658
|
* `extra` is carried through when present -- it is where the EIP-712 domain
|
|
552
659
|
* `name`/`version` live for tokens the facilitator does not know by address, so
|
|
553
660
|
* dropping it breaks EURC and the bridged USDCs.
|
|
661
|
+
*
|
|
662
|
+
* @throws If `requirements.network` has NO CAIP-2 form. `chainToCAIP2` answers
|
|
663
|
+
* with the name unchanged when it does not know a chain, and XRPL maps to
|
|
664
|
+
* itself on purpose -- its v1 string IS its network id. Passing that through
|
|
665
|
+
* would put a plain name inside a v2 body, which is a measured 400 (the same
|
|
666
|
+
* `no variant matched` that names no field). Only reachable by PINNING version
|
|
667
|
+
* 2 on such a network; `auto` leaves them on v1, where they work. Failing here
|
|
668
|
+
* names the network and the fix, which a 400 from the facilitator does not.
|
|
554
669
|
*/
|
|
555
670
|
declare function toPaymentRequirementsV2(requirements: PaymentRequirements): PaymentRequirementsV2;
|
|
556
671
|
/**
|
|
@@ -561,24 +676,48 @@ declare function toPaymentRequirementsV2(requirements: PaymentRequirements): Pay
|
|
|
561
676
|
*
|
|
562
677
|
* **Auto keys off CAIP-2, NOT off `paymentHeader.x402Version`,** and that is a
|
|
563
678
|
* measured decision rather than a stylistic one. The facilitator's envelope enum
|
|
564
|
-
* is untagged: it matches on SHAPE and ignores the version marker.
|
|
565
|
-
*
|
|
679
|
+
* is untagged: it matches on SHAPE and ignores the version marker.
|
|
680
|
+
*
|
|
681
|
+
* Re-measured against `https://facilitator.ultravioletadao.xyz/verify` on
|
|
682
|
+
* **2026-09-04** with a fabricated signature. The signature never verifies, so
|
|
683
|
+
* every row is an HTTP 400 and the STATUS discriminates nothing -- what does is
|
|
684
|
+
* the error code. `invalid_request_body` means the facilitator could not
|
|
685
|
+
* deserialize the body; `contract_call_failed` means it read the body, resolved
|
|
686
|
+
* the chain and got as far as the on-chain call, i.e. the envelope was fine.
|
|
566
687
|
*
|
|
567
688
|
* | payload network | requirements network | v1 envelope today |
|
|
568
689
|
* |-----------------|----------------------|-------------------|
|
|
569
|
-
* | `base` | `base` |
|
|
570
|
-
* | `base` (header says `x402Version: 2`) | `base` |
|
|
571
|
-
* | `eip155:8453` | `base` |
|
|
572
|
-
* | `base` | `eip155:8453` |
|
|
573
|
-
* | `eip155:8453` | `eip155:8453` |
|
|
574
|
-
*
|
|
575
|
-
*
|
|
576
|
-
*
|
|
577
|
-
*
|
|
578
|
-
*
|
|
579
|
-
* cannot regress anyone
|
|
580
|
-
|
|
581
|
-
|
|
690
|
+
* | `base` | `base` | understood |
|
|
691
|
+
* | `base` (header says `x402Version: 2`) | `base` | understood |
|
|
692
|
+
* | `eip155:8453` | `base` | understood |
|
|
693
|
+
* | `base` | `eip155:8453` | understood |
|
|
694
|
+
* | `eip155:8453` | `eip155:8453` | understood |
|
|
695
|
+
*
|
|
696
|
+
* **The last three rows used to be a hard 400** (`unknown variant
|
|
697
|
+
* \`eip155:8453\``) when this function was written on 2026-09-03. The
|
|
698
|
+
* facilitator has since taught the v1 envelope to read CAIP-2, so the original
|
|
699
|
+
* argument for this rule -- "every CAIP-2 combination is already a 400, so
|
|
700
|
+
* upgrading them cannot regress anyone" -- **is no longer true**. The rule is
|
|
701
|
+
* unchanged; three other reasons hold it up:
|
|
702
|
+
*
|
|
703
|
+
* 1. A CAIP-2 network on the wire means the 402 that produced it advertised v2.
|
|
704
|
+
* Answering in v2 is speaking the protocol the seller announced.
|
|
705
|
+
* 2. v2-with-CAIP-2 is the only shape BOTH generations of the facilitator
|
|
706
|
+
* accept. v1-with-CAIP-2 is a hard 400 on any build older than 2026-09-04,
|
|
707
|
+
* so choosing v1 there is what breaks against a self-hosted or pinned one.
|
|
708
|
+
* 3. The Python SDK resolves the identical rule, so the same wire produces the
|
|
709
|
+
* same body in both SDKs -- pinned by phase 6 of `npm run test:xlang`.
|
|
710
|
+
*
|
|
711
|
+
* And the marker still decides nothing: row 2 above is served correctly today,
|
|
712
|
+
* so upgrading on the strength of it would change a call that works.
|
|
713
|
+
*
|
|
714
|
+
* The negative half of that measurement, without which "understood" proves
|
|
715
|
+
* nothing -- the same run, bodies broken on purpose, all three
|
|
716
|
+
* `invalid_request_body`: a v2 body carrying a plain network name, one with
|
|
717
|
+
* `resource` as a bare string, and one with `accepted` removed. A well-formed
|
|
718
|
+
* v2 body with CAIP-2 reached `contract_call_failed` like the rows above.
|
|
719
|
+
*/
|
|
720
|
+
declare function resolveEnvelopeVersion(paymentHeader: X402Header | PaymentPayloadV2, requirements: PaymentRequirements, requested?: X402Version | 'auto'): X402Version;
|
|
582
721
|
/**
|
|
583
722
|
* Build a `/verify` body in whichever envelope `version` names.
|
|
584
723
|
*
|
|
@@ -2074,6 +2213,13 @@ declare class Erc8004LookupError extends Error {
|
|
|
2074
2213
|
* `502` and `504` join `503` and `429` here: a gateway that answered on the
|
|
2075
2214
|
* facilitator's behalf is exactly as silent about the agent's existence, and
|
|
2076
2215
|
* reading either as absence has the same consequence -- a duplicate mint.
|
|
2216
|
+
*
|
|
2217
|
+
* **Except when the body says otherwise.** `POST /register` goes through the
|
|
2218
|
+
* same EVM `send_transaction_from` as a settle, so it can answer
|
|
2219
|
+
* `settlement_unconfirmed`: the mint was broadcast and may be mined. That is
|
|
2220
|
+
* a `502` where retrying is precisely the thing that mints the duplicate this
|
|
2221
|
+
* class exists to prevent, so an explicit `retryable: false` wins over the
|
|
2222
|
+
* status. See {@link SETTLEMENT_UNCONFIRMED}.
|
|
2077
2223
|
*/
|
|
2078
2224
|
get retryable(): boolean;
|
|
2079
2225
|
/**
|
|
@@ -2083,6 +2229,18 @@ declare class Erc8004LookupError extends Error {
|
|
|
2083
2229
|
* request may be re-sent; see {@link isReplayableLeaseReason}.
|
|
2084
2230
|
*/
|
|
2085
2231
|
get reason(): string | undefined;
|
|
2232
|
+
/** The facilitator's machine-readable `error` code, when the body carried one. */
|
|
2233
|
+
get errorCode(): string | undefined;
|
|
2234
|
+
/**
|
|
2235
|
+
* A transaction that WAS broadcast and could not be confirmed.
|
|
2236
|
+
*
|
|
2237
|
+
* Present on `settlement_unconfirmed`. This is what to do INSTEAD of
|
|
2238
|
+
* retrying: look it up on chain. An error that carries "do not retry" and no
|
|
2239
|
+
* hash leaves the caller with nothing to act on.
|
|
2240
|
+
*/
|
|
2241
|
+
get transaction(): string | undefined;
|
|
2242
|
+
/** The payment id for {@link transaction}, identical to a successful settle's. */
|
|
2243
|
+
get paymentId(): string | undefined;
|
|
2086
2244
|
/**
|
|
2087
2245
|
* The facilitator NAMED a reason proving it executed nothing.
|
|
2088
2246
|
*
|
|
@@ -3217,4 +3375,4 @@ declare class AdvancedEscrowClient {
|
|
|
3217
3375
|
private sendViaAdapter;
|
|
3218
3376
|
}
|
|
3219
3377
|
|
|
3220
|
-
export { AMBIGUOUS_LEASE_REASONS, type AdvancedAuthorizationResult, AdvancedEscrowClient, type AdvancedEscrowClientOptions, type AdvancedEscrowContracts, type AdvancedEscrowTaskTier, type AdvancedPaymentInfo, type AdvancedTransactionResult, type AgentId, type AgentIdentity, type AgentRegistration, type AgentRegistrationFile, type AgentService, type AtomStats, BASE_MAINNET_CONTRACTS, BazaarClient, type BazaarClientOptions, type BazaarDiscoverOptions, type BazaarDiscoverResponse, type BazaarRegisterOptions, type BazaarResource, type CreateEscrowOptions, DEFAULT_FACILITATOR_RETRIES, DEFAULT_RETRY_AFTER_SECONDS, DEPOSIT_LIMIT_USDC, type DiscoveryAccepts, type DiscoveryCuration, type DiscoveryHealth, type DiscoveryHealthStatus, type DiscoveryListOptions, type DiscoveryPagination, type DiscoveryRegisterOptions, type DiscoveryResource, type DiscoveryResponse, type DiscoverySource, type DiscoveryStats, type DiscoveryTier, type Dispute, type DisputeOutcome, ERC8004_CONTRACTS, ERC8004_EXTENSION_ID, ESCROW_CONTRACTS, ESCROW_TIMEOUT_MS, Erc8004Client, type Erc8004ClientOptions, Erc8004LookupError, type Erc8004Network, EscrowClient, type EscrowClientOptions, type EscrowPayment, type EscrowStateResponse, type EscrowStatus, FacilitatorClient, type FacilitatorClientOptions, type FacilitatorErrorInfo, type FacilitatorFailureFields, type FacilitatorFetchOptions, type FeedbackEntry, type FeedbackParams, type FeedbackRequest, type FeedbackResponse, HEALTH_FILTERS, type HonoMiddlewareOptions, type IdentityByOwnerResponse, type IdentityMetadataResponse, type IdentityTotalSupplyResponse, MAX_RETRY_AFTER_SECONDS, MAX_SEARCH_LEN, type MetadataEntryParam, OPERATOR_ABI, OPERATOR_ABI_CREATE3, PAYMENT_INFO_TYPEHASH, type PaymentAcceptance, type PaymentMiddlewareOptions, type PaymentPayloadV2, type PaymentRequirementResolver, type PaymentRequirements, type PaymentRequirementsOptions, type PaymentRequirementsV2, type PrepareRelayFeedbackRequest, type PrepareRelayFeedbackResponse, type PrepareRelayResponseRequest, type ProofOfPayment, RELAYED_FEEDBACK_NETWORKS, REPLAYABLE_LEASE_REASONS, type RefundRequest, type RefundStatus, type RegisterAgentRequest, type RegisterAgentResponse, type RegisterJobResponse, type RegisterJobStatus, RegistrationPendingError, type RelayAuthorizationParams, type ReputationResponse, type ReputationSummary, type RequestRefundOptions, type ResourceInfoV2, type SettleRequest, type SettleRequestV2, type SettleResponse, type SettleResponseWithProof, type SubmitRelayFeedbackRequest, type SubmitRelayResponseRequest, TIER_FILTERS, TIER_TIMINGS, USDC_DOMAIN_NAME, type VerifiedPaymentState, type VerifyRequest, type VerifyRequestV2, type VerifyResponse, WRITER_LEASE_REASONS, type WriterLeaseReason, X402_CORS_HEADERS, X402_HEADER_NAMES, ZERO_ADDRESS, buildErc8004PaymentRequirements, buildPaymentRequirements, buildSettleRequest, buildSettleRequestForVersion, buildSettleRequestV2, buildVerifyRequest, buildVerifyRequestForVersion, buildVerifyRequestV2, canRefundEscrow, canReleaseEscrow, carryFailureFields, create402Response, createHonoMiddleware, createPaymentMiddleware, epochToDate, escrowTimeRemaining, extractPaymentFromHeaders, facilitatorFetch, getCorsHeaders, getEscrowContractsByChainId, getEscrowSupportedChainIds, isAlive, isAmbiguousLeaseReason, isEscrowExpired, isEscrowSupportedOnChain, isRegisterJobTerminal, isReplayableLeaseReason, parsePaymentHeader, parseRetryAfterSeconds, readFacilitatorError, resolveEnvelopeVersion, supportsRelayedFeedback, toPaymentRequirementsV2, toResourceInfoV2, wireNetwork };
|
|
3378
|
+
export { AMBIGUOUS_LEASE_REASONS, type AdvancedAuthorizationResult, AdvancedEscrowClient, type AdvancedEscrowClientOptions, type AdvancedEscrowContracts, type AdvancedEscrowTaskTier, type AdvancedPaymentInfo, type AdvancedTransactionResult, type AgentId, type AgentIdentity, type AgentRegistration, type AgentRegistrationFile, type AgentService, type AtomStats, BASE_MAINNET_CONTRACTS, BazaarClient, type BazaarClientOptions, type BazaarDiscoverOptions, type BazaarDiscoverResponse, type BazaarRegisterOptions, type BazaarResource, type CreateEscrowOptions, DEFAULT_FACILITATOR_RETRIES, DEFAULT_RETRY_AFTER_SECONDS, DEPOSIT_LIMIT_USDC, type DiscoveryAccepts, type DiscoveryCuration, type DiscoveryHealth, type DiscoveryHealthStatus, type DiscoveryListOptions, type DiscoveryPagination, type DiscoveryRegisterOptions, type DiscoveryResource, type DiscoveryResponse, type DiscoverySource, type DiscoveryStats, type DiscoveryTier, type Dispute, type DisputeOutcome, ERC8004_CONTRACTS, ERC8004_EXTENSION_ID, ESCROW_CONTRACTS, ESCROW_TIMEOUT_MS, Erc8004Client, type Erc8004ClientOptions, Erc8004LookupError, type Erc8004Network, EscrowClient, type EscrowClientOptions, type EscrowPayment, type EscrowStateResponse, type EscrowStatus, FacilitatorClient, type FacilitatorClientOptions, type FacilitatorErrorInfo, type FacilitatorFailureFields, type FacilitatorFetchOptions, type FeedbackEntry, type FeedbackParams, type FeedbackRequest, type FeedbackResponse, HEALTH_FILTERS, type HonoMiddlewareOptions, type IdentityByOwnerResponse, type IdentityMetadataResponse, type IdentityTotalSupplyResponse, MAX_RETRY_AFTER_SECONDS, MAX_SEARCH_LEN, type MetadataEntryParam, OPERATOR_ABI, OPERATOR_ABI_CREATE3, PAYMENT_INFO_TYPEHASH, type ParsedFacilitatorErrorBody, type PaymentAcceptance, type PaymentMiddlewareOptions, type PaymentPayloadV2, type PaymentRequirementResolver, type PaymentRequirements, type PaymentRequirementsOptions, type PaymentRequirementsV2, type PrepareRelayFeedbackRequest, type PrepareRelayFeedbackResponse, type PrepareRelayResponseRequest, type ProofOfPayment, RELAYED_FEEDBACK_NETWORKS, REPLAYABLE_LEASE_REASONS, type RefundRequest, type RefundStatus, type RegisterAgentRequest, type RegisterAgentResponse, type RegisterJobResponse, type RegisterJobStatus, RegistrationPendingError, type RelayAuthorizationParams, type ReputationResponse, type ReputationSummary, type RequestRefundOptions, type ResourceInfoV2, SETTLEMENT_UNCONFIRMED, type SettleRequest, type SettleRequestV2, type SettleResponse, type SettleResponseWithProof, type SubmitRelayFeedbackRequest, type SubmitRelayResponseRequest, TIER_FILTERS, TIER_TIMINGS, USDC_DOMAIN_NAME, type VerifiedPaymentState, type VerifyRequest, type VerifyRequestV2, type VerifyResponse, WRITER_LEASE_REASONS, type WriterLeaseReason, X402_CORS_HEADERS, X402_HEADER_NAMES, ZERO_ADDRESS, buildErc8004PaymentRequirements, buildPaymentRequirements, buildSettleRequest, buildSettleRequestForVersion, buildSettleRequestV2, buildVerifyRequest, buildVerifyRequestForVersion, buildVerifyRequestV2, canRefundEscrow, canReleaseEscrow, carryFailureFields, create402Response, createHonoMiddleware, createPaymentMiddleware, epochToDate, escrowTimeRemaining, extractPaymentFromHeaders, facilitatorFetch, getCorsHeaders, getEscrowContractsByChainId, getEscrowSupportedChainIds, isAlive, isAmbiguousLeaseReason, isEscrowExpired, isEscrowSupportedOnChain, isRegisterJobTerminal, isReplayableLeaseReason, isSettlementUnconfirmed, parseFacilitatorErrorBody, parsePaymentHeader, parseRetryAfterSeconds, readFacilitatorError, resolveEnvelopeVersion, supportsRelayedFeedback, toPaymentRequirementsV2, toResourceInfoV2, wireNetwork };
|