Recognize x402 extra expiry metadata

Author: TateLyman

bin/x402-surface-check.mjs

@@ -1010,6 +1010,7 @@ function hasFreshnessMetadata(challenge, accept) {
     accept?.expiresAt,
     accept?.validBefore,
     accept?.extra?.expires,
+    accept?.extra?.expiresAt,
     accept?.extra?.validBefore,
   ].some(value => value !== undefined && value !== null && value !== '')
 }

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.42",
+  "version": "0.2.43",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {

package.json

@@ -734,6 +734,27 @@ data: ${JSON.stringify({
     return
   }
 
+  if (request.url === '/extra-expires-at') {
+    response.statusCode = 402
+    response.setHeader('content-type', 'application/json')
+    response.setHeader('access-control-allow-origin', '*')
+    response.end(JSON.stringify({
+      x402Version: 2,
+      error: 'Payment required',
+      resource: { url: `${serverUrl}/extra-expires-at` },
+      accepts: [{
+        scheme: 'exact',
+        network: 'eip155:8453',
+        amount: '10000',
+        asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+        payTo: '0x549c82e6bfc54bdae9a2073744cbc2af5d1fc6d1',
+        resource: `${serverUrl}/extra-expires-at`,
+        extra: { expiresAt: Date.now() + 60000 },
+      }],
+    }))
+    return
+  }
+
   if (request.url?.startsWith('/route-paid')) {
     response.statusCode = 402
     response.setHeader('content-type', 'application/json')
@@ -1692,6 +1713,17 @@ try {
   assert.doesNotMatch(legacy.stdout, /challenge is missing amount/)
   assert.doesNotMatch(legacy.stdout, /did not expose Cache-Control/)
 
+  const extraExpiresAt = await execFileAsync('node', [
+    'bin/x402-surface-check.mjs',
+    '--endpoint',
+    '--method',
+    'GET',
+    `${serverUrl}/extra-expires-at`,
+  ], { cwd: new URL('..', import.meta.url) })
+
+  assert.match(extraExpiresAt.stdout, /extra-expires-at/)
+  assert.doesNotMatch(extraExpiresAt.stdout, /does not expose timeout\/expiry metadata/)
+
   const strictCache = await execFileAsync('node', [
     'bin/x402-surface-check.mjs',
     '--endpoint',