mirror of
https://github.com/affaan-m/ECC.git
synced 2026-11-08 00:55:55 +00:00
Christopher FerjoandClaude Opus 5.5
46baaeddf0
Claim from the verified payload and matched requirements in the resource server's onAfterVerify hook, so a forged header can no longer reserve a legitimate payment's key, and an invalid payment takes no claim. Fail closed on a store error or timeout by returning an abort (a throwing hook is skipped and would run the handler unguarded); document fail-open as an explicit, idempotent-only choice. Cover Permit2 (BigInt nonce) and keep claims until validBefore/deadline. The test now drives the real @x402/express middleware with payments signed by the real @x402/evm client and a stand-in facilitator that checks EIP-3009 signatures with viem, so verification, the hook, the handler and settlement run in their real order. Adds exact-pinned, test-only devDependencies and refreshes the registry digest. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>