Support x402 resource catalogs

Author: TateLyman

README.md

@@ -14,7 +14,7 @@ npx --yes x402-surface-check --endpoint --method POST https://x402.rpc.ankr.com/
 
 ## What It Checks
 
-- Manifest endpoint discovery from `items[]`, `endpoints[]`, `x402Endpoints`, category arrays, resource strings, and OpenAPI paths
+- Manifest endpoint discovery from `items[]`, `endpoints[]`, `resources[]`, `x402Endpoints`, category arrays, resource strings, and OpenAPI paths
 - Linked discovery documents via `discovery_url`, `discoveryUrl`, `resources_url`, `resourcesUrl`, or manifest-level OpenAPI links
 - OpenAPI query/path examples and JSON request-body examples for safer no-payment probes
 - No-payment HTTP 402 challenge shape
@@ -26,7 +26,7 @@ npx --yes x402-surface-check --endpoint --method POST https://x402.rpc.ankr.com/
 - Placeholder recipients such as zero addresses and Solana system-program values
 - Testnet or staging rails such as Base Sepolia and Solana devnet
 - HTTPS resource URLs and stable resource metadata
-- Browser CORS allowance for `X-PAYMENT`
+- Browser CORS allowance for the requesting origin and `X-PAYMENT`
 - Over-broad public method surfaces
 - Auth, validation, and free/trial responses that appear before a payment challenge, without piling on missing-field findings when no challenge was actually returned
 - Operational health/status endpoints, without treating expected free health checks as paid-route failures
@@ -44,6 +44,7 @@ Recent public no-payment checks have found and verified real launch fixes:
 - anchor-x402: multi-rail x402 challenges verified, with browser preflight blockers isolated before merge. https://github.com/solana-foundation/pay-skills/pull/47#issuecomment-4455678163
 - Agent Trust Bench: linked discovery URL and browser-compatibility notes verified clean for adversarial agent-payment resources. https://github.com/solana-foundation/pay-skills/pull/23#issuecomment-4455722170
 - Solrouter: private LLM inference route verified with HTTPS resource-binding and price-alignment notes. https://github.com/solana-foundation/pay-skills/pull/39#issuecomment-4455800060
+- Tetrac: Solana market-data payment gates verified, with browser payment-header preflight blocker isolated. https://github.com/solana-foundation/pay-skills/pull/32#issuecomment-4455923744
 
 Field notes and browser version: https://tateprograms.com/x402-surface-check.html
 

bin/x402-surface-check.mjs

@@ -294,17 +294,32 @@ function endpointEntries(document, sourceUrl, limit) {
   }
 
   for (const resource of document.resources ?? []) {
-    if (typeof resource !== 'string') continue
-    const match = resource.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)/i)
-    if (!match) continue
-    const [, method, rawPath] = match
-    const url = rawPath.startsWith('http')
-      ? rawPath
-      : new URL(rawPath, document.baseUrl ?? sourceUrl).toString()
+    if (typeof resource === 'string') {
+      const match = resource.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)/i)
+      if (!match) continue
+      const [, method, rawPath] = match
+      const url = rawPath.startsWith('http')
+        ? rawPath
+        : new URL(rawPath, document.baseUrl ?? sourceUrl).toString()
+      entries.push({
+        name: rawPath.split('/').filter(Boolean).at(-1) ?? rawPath,
+        url,
+        method: method.toUpperCase(),
+      })
+      continue
+    }
+
+    if (!resource || typeof resource !== 'object') continue
+    const rawPath = resource.url ?? resource.endpoint ?? resource.resource ?? resource.path
+    if (!rawPath) continue
     entries.push({
-      name: rawPath.split('/').filter(Boolean).at(-1) ?? rawPath,
-      url,
-      method: method.toUpperCase(),
+      name: resource.id
+        ?? resource.name
+        ?? resource.title
+        ?? String(resource.path ?? rawPath).split('/').filter(Boolean).at(-1)
+        ?? String(rawPath),
+      url: endpointUrl(rawPath, baseUrl, sourceUrl),
+      method: String(resource.method ?? 'GET').toUpperCase(),
     })
   }
 
@@ -669,6 +684,10 @@ function findingList(documentResult, challengeResults, preflightResults, entries
   for (const result of preflightResults) {
     const challengeResult = challengesByEntry.get(entryKey(result))
     if (!challengeResult || !hasPaymentChallenge(challengeResult)) continue
+    const allowedOrigin = result.headers['access-control-allow-origin'] ?? ''
+    if (!allowedOrigin) {
+      findings.push(`P1 - ${result.name} CORS preflight does not allow the requesting origin; observed allow-origin: none.`)
+    }
     const allowed = result.headers['access-control-allow-headers'] ?? ''
     if (allowed !== '*' && !/x-payment/i.test(allowed)) {
       const observed = result.status >= 400

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {

package.json

@@ -6,6 +6,14 @@ import { strict as assert } from 'node:assert'
 const execFileAsync = promisify(execFile)
 
 const server = createServer((request, response) => {
+  if (request.method === 'OPTIONS' && request.url === '/no-origin') {
+    response.statusCode = 204
+    response.setHeader('access-control-allow-headers', 'content-type,x-payment')
+    response.setHeader('access-control-allow-methods', 'GET, OPTIONS')
+    response.end()
+    return
+  }
+
   if (request.method === 'OPTIONS') {
     response.statusCode = 204
     response.setHeader('access-control-allow-origin', '*')
@@ -154,6 +162,27 @@ const server = createServer((request, response) => {
     return
   }
 
+  if (request.url === '/resources.json') {
+    response.setHeader('content-type', 'application/json')
+    response.end(JSON.stringify({
+      x402Version: 2,
+      resources: [{
+        path: '/api/premium/routing',
+        url: `${serverUrl}/api/premium/routing`,
+        method: 'GET',
+        description: 'Premium routing resource object',
+        accepts: [{
+          scheme: 'exact',
+          network: 'eip155:8453',
+          amount: '20000',
+          asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+          payTo: '0x549c82e6bfc54bdae9a2073744cbc2af5d1fc6d1',
+        }],
+      }],
+    }))
+    return
+  }
+
   if (request.url === '/openapi-link.json') {
     response.setHeader('content-type', 'application/json')
     response.end(JSON.stringify({
@@ -335,6 +364,24 @@ const server = createServer((request, response) => {
     return
   }
 
+  if (request.url === '/no-origin') {
+    response.statusCode = 402
+    response.setHeader('content-type', 'application/json')
+    response.end(JSON.stringify({
+      x402Version: 2,
+      error: 'Payment required',
+      resource: { url: `${serverUrl}/no-origin` },
+      accepts: [{
+        scheme: 'exact',
+        network: 'eip155:8453',
+        amount: '20000',
+        asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+        payTo: '0x549c82e6bfc54bdae9a2073744cbc2af5d1fc6d1',
+      }],
+    }))
+    return
+  }
+
   if (request.url === '/legacy/v1') {
     response.statusCode = 402
     response.setHeader('content-type', 'application/json')
@@ -473,6 +520,18 @@ try {
   assert.match(itemsManifest.stdout, /Fixture Facilitator \/ https:\/\/facilitator\.example \/ US/)
   assert.doesNotMatch(itemsManifest.stdout, /\[object Object\]/)
 
+  const resourceManifest = await execFileAsync('node', [
+    'bin/x402-surface-check.mjs',
+    `${serverUrl}/resources.json`,
+    '--origin',
+    'https://example.com',
+  ], { cwd: new URL('..', import.meta.url) })
+
+  assert.match(resourceManifest.stdout, /premium\/routing/)
+  assert.match(resourceManifest.stdout, /\$0\.02/)
+  assert.match(resourceManifest.stdout, /eip155:8453/)
+  assert.doesNotMatch(resourceManifest.stdout, /Document does not expose/)
+
   const linkedDiscovery = await execFileAsync('node', [
     'bin/x402-surface-check.mjs',
     `${serverUrl}/well-known.json`,
@@ -549,6 +608,18 @@ try {
   assert.doesNotMatch(schemes.stdout, /\$0\.000/)
   assert.doesNotMatch(schemes.stdout, /challenge is missing amount/)
 
+  const noOrigin = await execFileAsync('node', [
+    'bin/x402-surface-check.mjs',
+    '--endpoint',
+    '--method',
+    'GET',
+    `${serverUrl}/no-origin`,
+    '--origin',
+    'https://example.com',
+  ], { cwd: new URL('..', import.meta.url) })
+
+  assert.match(noOrigin.stdout, /CORS preflight does not allow the requesting origin/)
+
   const needsParam = await execFileAsync('node', [
     'bin/x402-surface-check.mjs',
     '--endpoint',