x402-safe-fetch 0.3.0 → 0.3.1

package/README.md

@@ -2,7 +2,7 @@
 
 A `fetch` for AI agents that checks an unknown x402 endpoint before paying it.
 
-A free endpoint is answered as is. For a paid one (HTTP 402), your agent first pays **$0.001** for an [x402 Doctor](https://x402-doctor.onrender.com) preflight and acts on it:
+A free endpoint is answered as is. For a paid one (HTTP 402), your agent first pays **$0.001** for an [x402 Doctor](https://x402-doctor.fizzl.eu) preflight and acts on it:
 
 | Preflight | What `safeFetch` does |
 |---|---|
@@ -35,7 +35,7 @@ const safeFetch = createSafeFetch({
 });
 
 try {
-  const res = await safeFetch("https://ichimoku-signal.onrender.com/signal/BTC-USDT");
+  const res = await safeFetch("https://ichimoku-signal.fizzl.eu/signal/BTC-USDT");
   console.log(await res.json());
 } catch (err) {
   if (err instanceof SafePayError) console.log(err.code, err.message, err.preflight?.reasons);

package/index.d.ts

@@ -5,7 +5,7 @@ export declare const PREFLIGHT_CAP: string;
 export declare const BASE: "eip155:8453";
 export declare const SOLANA: "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
 
-/** The x402 Doctor preflight: see https://x402-doctor.onrender.com/openapi.json */
+/** The x402 Doctor preflight: see https://x402-doctor.fizzl.eu/openapi.json */
 export interface Preflight {
   verdict: "go" | "caution" | "no_go";
   summary?: string;

package/index.js

@@ -21,7 +21,7 @@ import { verifyReceipt, DOCTOR_SIGNERS, AUTHORITY } from "./receipt.js";
 
 export { verifyReceipt, recoverSigner, canonicalJson, inputHash, certMessage, DOCTOR_SIGNERS, AUTHORITY } from "./receipt.js";
 
-export const DOCTOR_URL = "https://x402-doctor.onrender.com";
+export const DOCTOR_URL = "https://x402-doctor.fizzl.eu";
 export const PREFLIGHT_CAP = "$0.002"; // the preflight costs $0.001; never more than twice that
 export const BASE = "eip155:8453";
 export const SOLANA = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-safe-fetch",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "A fetch for AI agents that checks an unknown x402 endpoint ($0.001 x402 Doctor preflight) before paying it, and never pays above your budget.",
   "type": "module",
   "exports": {

package/receipt.js

@@ -4,15 +4,17 @@
 // README). safe-fetch checks that receipt before acting on a preflight, so a
 // tampered or forged "go" never leads to a payment.
 //
-// Canonical JSON: keys sorted at every level, no whitespace, non-ASCII as
-// \uXXXX (the same bytes as Python's json.dumps(sort_keys=True,
-// separators=(",", ":"), ensure_ascii=True)).
+// Canonical JSON (profile js-json-stringify-sorted-utf16-ascii-v1): keys
+// sorted by UTF-16 code units at every level, no whitespace, every code unit
+// from U+007F up as lowercase \uXXXX, numbers as JSON.stringify writes them,
+// UTF-8 bytes. Python's json.dumps matches only for ASCII keys and integers; a
+// Python equivalent: github.com/Fizzl13/presign-guard/blob/main/examples/canonical.py
 
 import { createHash } from "node:crypto";
 import { secp256k1 } from "@noble/curves/secp256k1";
 import { keccak_256 } from "@noble/hashes/sha3";
 
-// Doctor's published signers (https://x402-doctor.onrender.com/.well-known/x402-doctor-signer.json).
+// Doctor's published signers (https://x402-doctor.fizzl.eu/.well-known/x402-doctor-signer.json).
 // Pinned here on purpose: a signer list fetched from the same server would not
 // protect against that server being compromised.
 export const DOCTOR_SIGNERS = ["0xAaE66eF9Ee234397df33901568c8FBc36d43277d"];