x402-surface-check 0.2.20 → 0.2.21

package/README.md

@@ -32,6 +32,7 @@ npx --yes x402-surface-check --endpoint --method POST --body '{"prompt":"price C
 - Browser CORS allowance for the requesting origin and `X-PAYMENT`, including the actual 402 challenge response
 - Cache-Control posture on no-payment challenge responses, with warnings for explicitly cacheable payment gates
 - Grouped finding summaries for repeated route-wide issues, so large manifests keep the patch order readable
+- Contextual reference guides for CORS, cache policy, Worker gates, resource echo, validation/auth ordering, and launch controls
 - Over-broad public method surfaces
 - Auth, validation, and free/trial responses that appear before a payment challenge, without piling on missing-field findings when no challenge was actually returned
 - Operational health/status endpoints, without treating expected free health checks as paid-route failures

package/bin/x402-surface-check.mjs

@@ -867,6 +867,29 @@ function groupedFindingSummary(findings) {
     .map(([label, count]) => `- ${count} endpoints: ${label}`)
 }
 
+function referenceGuides(findings) {
+  const guides = []
+  const add = (label, url) => {
+    if (!guides.some(guide => guide.url === url)) guides.push({ label, url })
+  }
+  const text = findings.join('\n')
+  if (/CORS|402 challenge response does not allow the requesting origin|X-PAYMENT/i.test(text)) {
+    add('x402 CORS Fix', 'https://tateprograms.com/x402-cors-fix.html')
+    add('Cloudflare x402 Worker Starter', 'https://tateprograms.com/cloudflare-x402-worker.html')
+  }
+  if (/cacheable|Cache-Control|cache policy|shared caches/i.test(text)) {
+    add('Cloudflare x402 Worker Starter', 'https://tateprograms.com/cloudflare-x402-worker.html')
+    add('x402 Attack Map 2026', 'https://tateprograms.com/x402-attack-map-2026.html')
+  }
+  if (/validation HTTP \d+ before a payment challenge|auth HTTP \d+ before a payment challenge|replay|idempotency/i.test(text)) {
+    add('x402 Launch Checklist', 'https://tateprograms.com/x402-launch-checklist.html')
+  }
+  if (/resource URL|resource echo|accepts\[0\]\.extra\.resource/i.test(text)) {
+    add('x402 Surface Check notes', 'https://tateprograms.com/x402-surface-check.html')
+  }
+  return guides.map(guide => `- ${guide.label}: ${guide.url}`)
+}
+
 function formatMarkdown(report) {
   const document = report.document.body.json ?? {}
   const challengeRows = report.challenges.map(result => {
@@ -880,6 +903,7 @@ function formatMarkdown(report) {
     return `| ${result.name} | ${result.method ?? 'POST'} | ${result.status} | ${cachePolicy(result.headers) || '-'} |`
   })
   const findingSummary = groupedFindingSummary(report.findings)
+  const guides = referenceGuides(report.findings)
 
   return [
     '# x402 Public Surface Check',
@@ -929,6 +953,12 @@ function formatMarkdown(report) {
     '',
     ...(report.findings.length ? report.findings.map(item => `- ${item}`) : ['- No obvious launch-readiness findings from the public no-payment probes.']),
     '',
+    ...(guides.length ? [
+      '## Reference Guides',
+      '',
+      ...guides,
+      '',
+    ] : []),
   ].join('\n')
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {