x402-surface-check 0.2.40 → 0.2.42

package/README.md

@@ -38,7 +38,7 @@ npx --yes x402-surface-check --strict-proof https://api.example.com/openapi.json
 - Placeholder recipients such as zero addresses and Solana system-program values
 - Testnet or staging rails such as Base Sepolia and Solana devnet
 - HTTPS resource URLs and stable resource metadata
-- Resource binding across top-level `resource.url` and every accept leg, including localhost/private-development resource URLs that should not ship in production
+- Resource binding across top-level `resource.url`; legacy/v1 accept-leg resource echoes; and localhost/private-development resource URLs that should not ship in production
 - Timeout/expiry metadata on challenges, so payment capabilities have an explicit bounded freshness window
 - Payment-metadata privacy checks for sensitive resource query context, email/SSN/token-like values, prompt/private-context strings, and credential-like URLs in body or header-carried challenges
 - Browser CORS allowance for the requesting origin, common x402/MPP retry headers, and exposed challenge/session headers on the actual 402 response

package/bin/x402-surface-check.mjs

@@ -993,6 +993,10 @@ function challengeResourceValue(challenge) {
     ?? ''
 }
 
+function isX402V2Challenge(challenge) {
+  return Number(challenge?.x402Version) === 2
+}
+
 function hasFreshnessMetadata(challenge, accept) {
   return [
     challenge?.expires,
@@ -1016,8 +1020,9 @@ function usesDecimalAmount(accept, result) {
   const amount = String(rawAmount)
   if (amount.includes('.')) return true
   if (accept.maxAmountRequired !== undefined || accept.maxAmount !== undefined) return false
+  if (accept.asset) return false
   if (!accept.asset && (accept.token || result.headers?.['x-payment-token'])) return true
-  return result.headers?.['x-payment-amount'] === amount
+  return false
 }
 
 function challengePrice(accept, result) {
@@ -1404,7 +1409,7 @@ function findingList(documentResult, challengeResults, preflightResults, entries
     if (!topResource && populatedAcceptResources.length === 0) {
       findings.push(`P2 - ${result.name} challenge does not expose a signed/intended resource URL at the top level or in any accept leg.`)
     }
-    else if (accepts.length > 0 && populatedAcceptResources.length < accepts.length) {
+    else if (!isX402V2Challenge(result.body.json) && accepts.length > 0 && populatedAcceptResources.length < accepts.length) {
       findings.push(`P2 - ${result.name} challenge does not repeat the resource URL in every accept leg for spend-map and replay binding.`)
     }
     if (topResource && populatedAcceptResources.some(resource => resource !== topResource)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {