Skip to content

Add signed x402 paid-action example endpoint and tests#308

Merged
GsCommand merged 1 commit into
mainfrom
codex/build-signed-x402-paid-action-endpoint
May 23, 2026
Merged

Add signed x402 paid-action example endpoint and tests#308
GsCommand merged 1 commit into
mainfrom
codex/build-signed-x402-paid-action-endpoint

Conversation

@GsCommand
Copy link
Copy Markdown
Contributor

Motivation

  • Provide a server-side example that demonstrates the correct trust boundary between x402 payment acceptance and CommandLayer execution attestation.
  • Show how to capture a paid-action request, execute a deterministic local action, and produce a CLAS-style signed receipt without performing real x402 settlement.

Description

  • Add POST /api/examples/x402-paid-action implemented in api/examples/x402-paid-action.js with strict method/body validation and explicit JSON error statuses.
  • Validate x402 payment envelope (payment.protocol === 'x402', payment.status === 'accepted', and payment.payment_id), support only action === 'summarize.text', and enforce input length limits.
  • Execute a deterministic local summary via buildDeterministicSummary, deduplicate by request_id::payment_id using an in-memory seenReceipts map, and return the same receipt for duplicates.
  • Sign CLAS-style receipts by reusing lib/receiptSigning.js (signReceipt, resolveReceiptSigningConfigFromEnv, hasValidSigningConfig) and include metadata.trace and metadata.proof fields; update docs with a short example and trust-boundary reminder in docs/integrations/x402-commandlayer-receipts.md.

Testing

  • Add tests in tests/api-x402-paid-action.test.js covering method checks, malformed body, missing/invalid payment, unsupported action, signing-unavailable behavior, successful signing, duplicate idempotency, and local receipt verification.
  • Run npm test, which passed all tests (87 passed, 0 failed) including the new suite.
  • Verify that returned receipts include metadata.trace and metadata.proof.hash, contain an Ed25519 signature, and verify locally via verifyReceipt with an injected ENS text resolver.

Codex Task

@vercel
Copy link
Copy Markdown

vercel Bot commented May 23, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
commandlayer-commandlayer-org Ready Ready Preview, Comment May 23, 2026 9:17pm
commandlayer-org Ready Ready Preview, Comment May 23, 2026 9:17pm
commandlayer-org111 Ready Ready Preview, Comment May 23, 2026 9:17pm

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant