x402-surface-check 0.2.8 → 0.2.10

package/README.md

@@ -16,10 +16,11 @@ npx --yes x402-surface-check --endpoint --method POST https://x402.rpc.ankr.com/
 
 - Manifest endpoint discovery from `items[]`, `endpoints[]`, `x402Endpoints`, category arrays, resource strings, and OpenAPI paths
 - No-payment HTTP 402 challenge shape
-- x402 v1 and v2 price fields
+- x402 v1 and v2 price fields, including `accepts[]` and `schemes[]` challenge arrays
 - MPP `WWW-Authenticate: Payment` and x402 V2 `WWW-Authenticate: X402 requirements=...` challenges
 - Atomic-unit `amount` / `maxAmountRequired` fields, plus legacy decimal `amount` + `token` x402 v1 challenges
 - `asset` or token metadata, `network`, and `payTo`
+- OpenAPI-declared `x-payment-info.price.amount` drift versus the live 402 challenge price
 - Placeholder recipients such as zero addresses and Solana system-program values
 - Testnet or staging rails such as Base Sepolia and Solana devnet
 - HTTPS resource URLs and stable resource metadata

package/bin/x402-surface-check.mjs

@@ -98,6 +98,11 @@ function moneyFromDecimal(amount) {
   })}`
 }
 
+function numberFromDecimal(amount) {
+  const numeric = Number(amount)
+  return Number.isFinite(numeric) ? numeric : null
+}
+
 function uniqueEntries(entries, limit) {
   const seen = new Set()
   return entries
@@ -127,6 +132,15 @@ function endpointUrl(rawPath, baseUrl, sourceUrl) {
   return new URL(value, base).toString()
 }
 
+function operationExpectedPrice(operation) {
+  const price = operation?.['x-payment-info']?.price
+    ?? operation?.['x-payment']?.price
+    ?? operation?.payment?.price
+  const amount = price?.amount ?? price?.amountUsd ?? price?.usd
+  const numeric = numberFromDecimal(amount)
+  return numeric === null ? null : numeric
+}
+
 function endpointEntries(document, sourceUrl, limit) {
   const entries = []
   const baseUrl = documentBaseUrl(document, sourceUrl)
@@ -189,6 +203,7 @@ function endpointEntries(document, sourceUrl, limit) {
           name: operation.operationId ?? `${method.toUpperCase()} ${path}`,
           url,
           method: method.toUpperCase(),
+          expectedPriceUsd: operationExpectedPrice(operation),
         })
       }
     }
@@ -332,8 +347,9 @@ async function probeEndpoint(entry) {
   const authenticateChallenge = parsePaymentAuthenticate(response.headers.get('www-authenticate'))
     ?? parseX402Authenticate(response.headers.get('www-authenticate'))
 
-  if (!body.json?.accepts?.length) {
-    if (headerChallenge) {
+  const bodyHasChallenge = Array.isArray(body.json?.accepts) || Array.isArray(body.json?.schemes)
+  if (!bodyHasChallenge) {
+    if (headerChallenge && typeof headerChallenge === 'object') {
       body.json = headerChallenge
     }
     else if (authenticateChallenge) {
@@ -400,7 +416,9 @@ function capabilityList(value) {
 }
 
 function challengeAccepts(result) {
-  return Array.isArray(result.body.json?.accepts) ? result.body.json.accepts : []
+  if (Array.isArray(result.body.json?.accepts)) return result.body.json.accepts
+  if (Array.isArray(result.body.json?.schemes)) return result.body.json.schemes
+  return []
 }
 
 function acceptAmountValue(accept) {
@@ -418,10 +436,11 @@ function acceptDecimals(accept) {
 }
 
 function usesDecimalAmount(accept, result) {
-  if (accept.maxAmountRequired !== undefined || accept.maxAmount !== undefined) return false
-  if (accept.amount === undefined || accept.amount === null || accept.amount === '') return false
-  const amount = String(accept.amount)
+  const rawAmount = acceptAmountValue(accept)
+  if (rawAmount === undefined || rawAmount === null || rawAmount === '') return false
+  const amount = String(rawAmount)
   if (amount.includes('.')) return true
+  if (accept.maxAmountRequired !== undefined || accept.maxAmount !== undefined) return false
   if (!accept.asset && (accept.token || result.headers?.['x-payment-token'])) return true
   return result.headers?.['x-payment-amount'] === amount
 }
@@ -433,6 +452,14 @@ function challengePrice(accept, result) {
     : moneyFromAtomic(amount, acceptDecimals(accept))
 }
 
+function challengePriceUsd(accept, result) {
+  const amount = acceptAmountValue(accept)
+  if (usesDecimalAmount(accept, result)) return numberFromDecimal(amount)
+  const numeric = Number(amount)
+  if (!Number.isFinite(numeric)) return null
+  return numeric / (10 ** acceptDecimals(accept))
+}
+
 function hasPaymentChallenge(result) {
   const challenge = result.body.json
   return challengeAccepts(result).length > 0 || Boolean(challenge?.resource || challenge?.payment || result.headers?.['www-authenticate'])
@@ -440,7 +467,7 @@ function hasPaymentChallenge(result) {
 
 function challengeSummary(result) {
   const challenge = result.body.json
-  const firstAccept = challenge?.accepts?.[0] ?? {}
+  const firstAccept = challengeAccepts(result)[0] ?? {}
   const hasChallenge = hasPaymentChallenge(result)
   const amount = acceptAmountValue(firstAccept)
   const resourceUrl = challenge?.resource?.url ?? firstAccept.resource ?? ''
@@ -453,6 +480,8 @@ function challengeSummary(result) {
     network: firstAccept.network ?? '',
     amount,
     price: hasChallenge ? challengePrice(firstAccept, result) : '',
+    priceUsd: hasChallenge ? challengePriceUsd(firstAccept, result) : null,
+    expectedPriceUsd: typeof result.expectedPriceUsd === 'number' ? result.expectedPriceUsd : null,
     payTo: firstAccept.payTo ?? '',
     asset: acceptAssetValue(firstAccept),
     timeout: firstAccept.maxTimeoutSeconds ?? '',
@@ -520,6 +549,12 @@ function findingList(documentResult, challengeResults, preflightResults, entries
     if (!summary.amount || !summary.payTo || !summary.asset) {
       findings.push(`P1 - ${result.name} challenge is missing amount/maxAmountRequired, payTo, or asset metadata.`)
     }
+    if (summary.expectedPriceUsd !== null && summary.priceUsd !== null) {
+      const delta = Math.abs(summary.expectedPriceUsd - summary.priceUsd)
+      if (delta > 0.000001) {
+        findings.push(`P1 - ${result.name} documented price ${moneyFromDecimal(summary.expectedPriceUsd)} does not match live 402 challenge price ${moneyFromDecimal(summary.priceUsd)}.`)
+      }
+    }
     for (const accept of challengeAccepts(result)) {
       if (looksLikePlaceholderPayTo(accept.payTo)) {
         findings.push(`P1 - ${result.name} challenge advertises placeholder-looking payTo ${accept.payTo}; production listings should not ask agents to pay placeholder recipients.`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {