x402-surface-check 0.2.11 → 0.2.12

package/README.md

@@ -15,6 +15,7 @@ npx --yes x402-surface-check --endpoint --method POST https://x402.rpc.ankr.com/
 ## What It Checks
 
 - Manifest endpoint discovery from `items[]`, `endpoints[]`, `x402Endpoints`, category arrays, resource strings, and OpenAPI paths
+- Linked discovery documents via `discovery_url`, `discoveryUrl`, `resources_url`, or `resourcesUrl`
 - No-payment HTTP 402 challenge shape
 - x402 v1 and v2 price fields, including `accepts[]` and `schemes[]` challenge arrays
 - MPP `WWW-Authenticate: Payment` and x402 V2 `WWW-Authenticate: X402 requirements=...` challenges
@@ -39,6 +40,7 @@ Recent public no-payment checks have found and verified real launch fixes:
 - Spraay: resource echo and browser payment-header behavior verified clean. https://github.com/solana-foundation/pay-skills/pull/60#issuecomment-4455519760
 - UZPROOF: schemes-style Solana x402 challenge and browser payment-header behavior verified clean. https://github.com/solana-foundation/pay-skills/pull/28#issuecomment-4455613892
 - HYRE Agent: OpenAPI-declared prices found 10x below live 402 challenge prices. https://github.com/solana-foundation/pay-skills/pull/19#issuecomment-4455641258
+- anchor-x402: multi-rail x402 challenges verified, with browser preflight blockers isolated before merge. https://github.com/solana-foundation/pay-skills/pull/47#issuecomment-4455678163
 - Agent Trust Bench: live discovery URL and browser-compatibility notes for adversarial agent-payment resources. https://github.com/solana-foundation/pay-skills/pull/23#issuecomment-4455484414
 
 Field notes and browser version: https://tateprograms.com/x402-surface-check.html

package/bin/x402-surface-check.mjs

@@ -132,6 +132,15 @@ function endpointUrl(rawPath, baseUrl, sourceUrl) {
   return new URL(value, base).toString()
 }
 
+function linkedDiscoveryUrl(document, sourceUrl) {
+  const rawUrl = document?.discovery_url
+    ?? document?.discoveryUrl
+    ?? document?.resources_url
+    ?? document?.resourcesUrl
+  if (typeof rawUrl !== 'string' || !rawUrl.trim()) return ''
+  return endpointUrl(rawUrl, documentBaseUrl(document, sourceUrl), sourceUrl)
+}
+
 function operationExpectedPrice(operation) {
   const price = operation?.['x-payment-info']?.price
     ?? operation?.['x-payment']?.price
@@ -620,6 +629,7 @@ function formatMarkdown(report) {
   return [
     '# x402 Public Surface Check',
     '',
+    ...(report.sourceDocument ? [`Source: ${report.sourceDocument.url}`] : []),
     `Document: ${report.document.url}`,
     `Checked: ${report.checkedAt}`,
     'Scope: manifest/OpenAPI parsing, no-payment endpoint probes, and browser-style CORS preflight. No payment headers or paid calls.',
@@ -656,7 +666,8 @@ function formatMarkdown(report) {
 }
 
 async function runCheck(options) {
-  const document = options.endpoint
+  let sourceDocument = null
+  let document = options.endpoint
     ? {
         status: 200,
         ok: true,
@@ -665,9 +676,25 @@ async function runCheck(options) {
         body: { text: '{}', json: {} },
       }
     : await fetchDocument(options.url)
-  const entries = options.endpoint
+  let entries = options.endpoint
     ? [{ name: new URL(options.url).pathname.split('/').filter(Boolean).at(-1) ?? options.url, url: options.url, method: options.method || 'POST' }]
     : (document.body.json ? endpointEntries(document.body.json, document.url, options.limit) : [])
+
+  if (!options.endpoint && entries.length === 0 && document.body.json) {
+    const discoveryUrl = linkedDiscoveryUrl(document.body.json, document.url)
+    if (discoveryUrl) {
+      const followedDocument = await fetchDocument(discoveryUrl)
+      const followedEntries = followedDocument.body.json
+        ? endpointEntries(followedDocument.body.json, followedDocument.url, options.limit)
+        : []
+      if (followedEntries.length > 0) {
+        sourceDocument = document
+        document = followedDocument
+        entries = followedEntries
+      }
+    }
+  }
+
   const origin = options.origin ?? new URL(document.url).origin
   const challenges = []
   const preflights = []
@@ -686,6 +713,7 @@ async function runCheck(options) {
     origin,
     challenges,
     preflights,
+    sourceDocument,
   }
   report.findings = findingList(document, challenges, preflights, entries)
   return report

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {