Parse raw resource URL strings

Author: TateLyman

README.md

@@ -15,7 +15,7 @@ npx --yes x402-surface-check --endpoint --method POST --body '{"prompt":"price C
 
 ## What It Checks
 
-- Manifest endpoint discovery from `items[]`, `endpoints[]`, `resources[]`, `x402Endpoints`, category arrays, resource strings, and OpenAPI paths
+- Manifest endpoint discovery from `items[]`, `endpoints[]`, `resources[]`, `x402Endpoints`, category arrays, raw resource URL strings, method-prefixed resource strings, and OpenAPI paths
 - Linked discovery documents via `discovery_url`, `discoveryUrl`, `resources_url`, `resourcesUrl`, or manifest-level OpenAPI links
 - OpenAPI `servers[]` base-path preservation, so `/paths` are probed through the documented gateway rather than the domain root
 - OpenAPI query/path examples, JSON request-body examples, nested request schemas, local `$ref` request schemas, and explicit direct-endpoint bodies for safer no-payment probes

bin/x402-surface-check.mjs

@@ -394,8 +394,8 @@ function endpointEntries(document, sourceUrl, limit) {
   for (const resource of document.resources ?? []) {
     if (typeof resource === 'string') {
       const match = resource.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)/i)
-      if (!match) continue
-      const [, method, rawPath] = match
+      const method = match?.[1] ?? 'GET'
+      const rawPath = match?.[2] ?? resource
       const url = rawPath.startsWith('http')
         ? rawPath
         : new URL(rawPath, document.baseUrl ?? sourceUrl).toString()

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {

package.json

@@ -309,7 +309,7 @@ const server = createServer((request, response) => {
           asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
           payTo: '0x549c82e6bfc54bdae9a2073744cbc2af5d1fc6d1',
         }],
-      }],
+      }, `${serverUrl}/api/raw-resource`],
     }))
     return
   }
@@ -395,6 +395,26 @@ const server = createServer((request, response) => {
     return
   }
 
+  if (request.url === '/api/raw-resource') {
+    response.statusCode = 402
+    response.setHeader('content-type', 'application/json')
+    response.setHeader('access-control-allow-origin', '*')
+    response.end(JSON.stringify({
+      x402Version: 2,
+      error: 'Payment required',
+      accepts: [{
+        scheme: 'exact',
+        network: 'eip155:8453',
+        amount: '30000',
+        asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+        payTo: '0x549c82e6bfc54bdae9a2073744cbc2af5d1fc6d1',
+        resource: `${serverUrl}/api/raw-resource`,
+        maxTimeoutSeconds: 60,
+      }],
+    }))
+    return
+  }
+
   if (request.url === '/gateway/pay/v1/protected') {
     response.statusCode = 402
     response.setHeader('content-type', 'application/json')
@@ -864,7 +884,9 @@ try {
   ], { cwd: new URL('..', import.meta.url) })
 
   assert.match(resourceManifest.stdout, /premium\/routing/)
+  assert.match(resourceManifest.stdout, /raw-resource/)
   assert.match(resourceManifest.stdout, /\$0\.02/)
+  assert.match(resourceManifest.stdout, /\$0\.03/)
   assert.match(resourceManifest.stdout, /eip155:8453/)
   assert.doesNotMatch(resourceManifest.stdout, /Document does not expose/)