x402-surface-check 0.2.36 → 0.2.37

package/README.md

@@ -30,6 +30,7 @@ npx --yes x402-surface-check --strict-proof https://api.example.com/openapi.json
 - No-payment HTTP 402 challenge shape
 - x402 v1 and v2 price fields, including `accepts[]` and `schemes[]` challenge arrays
 - MPP `WWW-Authenticate: Payment` and x402 V2 `WWW-Authenticate: X402 requirements=...` challenges
+- x402 challenges nested inside framework error wrappers such as FastAPI-style `{"detail": {...}}`
 - MPP descriptor-only 402s that advertise discovery headers but do not return a machine-readable payment retry challenge
 - Atomic-unit `amount` / `maxAmountRequired` fields, plus legacy decimal `amount` + `token` x402 v1 challenges
 - `asset` or token metadata, `network`, and `payTo`

package/bin/x402-surface-check.mjs

@@ -648,6 +648,29 @@ function parseX402Authenticate(value) {
   }
 }
 
+function bodyChallengeJson(value) {
+  if (!value || typeof value !== 'object') return null
+  if (Array.isArray(value.accepts) || Array.isArray(value.schemes)) return value
+
+  const candidates = [
+    value.detail,
+    value.error,
+    value.payment,
+    value.paymentRequired,
+    value.payment_required,
+    value.challenge,
+    value.x402,
+  ]
+
+  for (const candidate of candidates) {
+    if (!candidate || typeof candidate !== 'object') continue
+    const nested = bodyChallengeJson(candidate)
+    if (nested) return nested
+  }
+
+  return null
+}
+
 async function fetchDocument(url) {
   const response = await fetch(url, {
     headers: {
@@ -750,7 +773,11 @@ async function probeEndpoint(entry, origin) {
   const authenticateChallenge = parsePaymentAuthenticate(response.headers.get('www-authenticate'))
     ?? parseX402Authenticate(response.headers.get('www-authenticate'))
 
-  const bodyHasChallenge = Array.isArray(body.json?.accepts) || Array.isArray(body.json?.schemes)
+  const bodyChallenge = bodyChallengeJson(body.json)
+  const bodyHasChallenge = Boolean(bodyChallenge)
+  if (bodyChallenge && body.json !== bodyChallenge) {
+    body.json = bodyChallenge
+  }
   if (!bodyHasChallenge) {
     if (headerChallenge && typeof headerChallenge === 'object') {
       body.json = headerChallenge

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {