fix(mcp-x402): API Market review blockers — ids comma bug + fabricated-200-on-failure

[Timwal78]

Summary

API Market's TESTER-plan review rejected the ScriptMasterLabs x402 Data API listing for the 8th time, flagging two specific bugs on /x402/crypto-price:

1. ids=bitcoin,ethereum silently merged into bitcoinethereum (a single invalid id). Root cause: cleanTerm() strips any character outside [a-zA-Z0-9 .-] — including the comma delimiter — and ran on the raw ids string before it was split. Fixed by splitting first, then sanitizing each id individually to [a-z0-9-] (CoinGecko's real id character set, e.g. usd-coin, matic-network).
2. On full upstream failure, returned 200 with a fabricated stub value and kept the payment — the code comment literally said "payment kept". API Market only bills on 2xx responses, and this repo's own AGENT_STANDARDS/SOVEREIGN_DATA_POLICY.md section 4 explicitly prohibits fabricated fallback data and requires 502 on upstream error, no exceptions. Fixed to return 502 and refund the sovereign-rail payment, matching the pattern already used by every other endpoint in this file.

Reviewer also asked for all 82 endpoints to be clean before the 9th submission, so I audited the whole file for the same two bug classes rather than patching only what was flagged:

• Found and fixed the identical fabricated-200-on-failure pattern on 3 more endpoints: /x402/crypto-trending, /x402/llm-chat, and /x402/chat/completions — the latter two fabricated a fake assistant reply (e.g. "ACK: <prompt>") and returned it as a real chat.completion object, which is worse than the price stub since a caller could reasonably act on it as real model output.
• Verified no other endpoint misuses cleanTerm() on a comma/list parameter — checked all 18 other call sites, all single free-text fields (drug names, tickers, UEIs, etc.), no bug.
• Verified every endpoint declaring required input fields actually enforces them at runtime before calling upstream — scanned all 125 scannable routes, one false-positive (delegated validation confirmed present), zero real gaps.
• /x402/firms's 503 is a genuine missing SAM_API_KEY env var on the Render deployment, not a code bug — needs to be set there (free key at sam.gov) separately from this PR.

Not touched: /x402/web-fetch, /x402/domain-enrich, and the CoinCap/Binance intermediate fallback branches in crypto-price/crypto-trending — these return real (if partial) data on degraded paths, not fabricated stubs, so they're a legitimately different and acceptable case.

Test plan

• New tests/unit/crypto-price-ids-parsing.test.ts — 6 tests, including a marker test proving the old implementation actually produced bitcoinethereum from bitcoin,ethereum (the exact failure reported).
• npx vitest run tests/unit — 151/151 pass (145 pre-existing + 6 new), zero regressions.
• npx tsc --noEmit — clean on index.ts (pre-existing unrelated errors in sacred/store.ts/security/zyla.ts untouched by this PR).
• npx eslint src/server/index.ts — 0 errors (17 pre-existing warnings, none on changed lines).
• bash scripts/check-sovereign-data.sh — passes.

🤖 Generated with Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sml-portfolio	Ready	Preview	Aug 3, 2026 8:56pm

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.