fix(x402): align exact default timeout with official SDK + prove V2 compliance - #39
Merged
Conversation
…ove V2 compliance
Close the last divergence the parity guard flagged: the EVM `exact` scheme
defaulted maxTimeoutSeconds to 120s while the official x402 SDK — and this
package's own `upto` path — use 3600s. Bring exact into line (python + TS).
- signing/evm.py + evm.ts: exact default 120 -> 3600
- parity test now asserts the 3600s default matches the official SDK
- READMEs: add a 'Standards compliance (x402 v2)' section documenting the
PAYMENT-SIGNATURE header, the {x402Version:2, accepted, payload} envelope,
CAIP-2 networks, validAfter=0/validBefore=3600, and the CI parity guard
In practice the default is unreachable against our server (the 402 always sends
maxTimeoutSeconds=3600), and a longer validBefore is not a security concern
(validAfter=0 already, random single-use nonce, facilitator settles once) —
this is purely spec alignment. python 23 + typescript 14 tests pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the last divergence the parity guard (#38) flagged and documents V2 compliance in the READMEs.
exactdefaultmaxTimeoutSeconds120 → 3600, matching the official x402 SDK and this package's ownuptopath (which already used 3600).PAYMENT-SIGNATUREheader,{x402Version:2, accepted, payload}envelope, CAIP-2 networks,validAfter=0/validBefore=3600, and the CI parity guard. The existing verified on-chain settlement tables already prove it works live.Safety
maxTimeoutSeconds=3600(X402_MAX_TIMEOUT_SECONDS).validBeforeis not a security concern:validAfter=0already, the nonce is random + single-use (EIP-3009authorizationState), the facilitator settles once to a fixedpayTo. No theft/double-spend vector.Verification
python 23 passed, typescript 14 passed (incl. the SDK signature-recovery parity test and the repo's no-legacy-header guard). ruff clean.
🤖 对抗评审
独立 reviewer 逐条查了这条改动（live 签名库）：
VERDICT: CLEAN（仅一个 cosmetic 双空行，已修）
🤖 Generated with Claude Code