@agent-score/commerce 1.2.0 → 1.3.1

package/dist/index.mjs

@@ -249,6 +249,44 @@ function buildAgentMemoryHint() {
 }
 
 // src/signer.ts
+var TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+var TOKEN_2022_PROGRAM = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
+var TRANSFER_CHECKED_DISCRIMINATOR = 12;
+async function extractSolanaSignerFromCredential(credential) {
+  const payload = credential.payload;
+  if (!payload?.transaction || payload.type !== "transaction") return null;
+  const moduleName = "@solana/kit";
+  const kit = await import(moduleName).catch(() => null);
+  if (!kit?.getBase64Codec || !kit.getTransactionDecoder || !kit.getCompiledTransactionMessageDecoder) {
+    return null;
+  }
+  try {
+    const txBytes = kit.getBase64Codec().encode(payload.transaction);
+    const decoded = kit.getTransactionDecoder().decode(txBytes);
+    const message = kit.getCompiledTransactionMessageDecoder().decode(decoded.messageBytes);
+    for (const ix of message.instructions) {
+      const programId = message.staticAccounts[ix.programAddressIndex];
+      if (programId !== TOKEN_PROGRAM && programId !== TOKEN_2022_PROGRAM) continue;
+      const data = ix.data;
+      if (!data || data.length === 0 || data[0] !== TRANSFER_CHECKED_DISCRIMINATOR) continue;
+      const accountIndices = ix.accountIndices ?? [];
+      const authorityIndex = accountIndices[3];
+      if (authorityIndex === void 0) continue;
+      if (authorityIndex >= message.staticAccounts.length) {
+        console.warn(
+          "[gate] Solana TransferChecked authority resolves through an address lookup table; signer-match recovery requires the static-account form. Skipping."
+        );
+        continue;
+      }
+      const authority = message.staticAccounts[authorityIndex];
+      if (authority) return authority;
+    }
+    return null;
+  } catch (err) {
+    console.warn("[gate] Solana credential decode failed:", err instanceof Error ? err.message : err);
+    return null;
+  }
+}
 async function extractPaymentSigner(request, x402PaymentHeader) {
   const authHeader = request.headers.get("authorization");
   if (authHeader) {
@@ -258,8 +296,12 @@ async function extractPaymentSigner(request, x402PaymentHeader) {
       if (mppx?.Credential?.extractPaymentScheme(authHeader)) {
         const credential = mppx.Credential.fromRequest(request);
         const source = credential.source;
-        const match = source?.match(/^did:pkh:eip155:\d+:(0x[0-9a-fA-F]{40})$/);
-        if (match) return { address: match[1].toLowerCase(), network: "evm" };
+        const evmMatch = source?.match(/^did:pkh:eip155:\d+:(0x[0-9a-fA-F]{40})$/);
+        if (evmMatch) return { address: evmMatch[1].toLowerCase(), network: "evm" };
+        const solMatch = source?.match(/^did:pkh:solana:[1-9A-HJ-NP-Za-km-z]{32,44}:([1-9A-HJ-NP-Za-km-z]{32,44})$/);
+        if (solMatch) return { address: solMatch[1], network: "solana" };
+        const solanaFromTx = await extractSolanaSignerFromCredential(credential);
+        if (solanaFromTx) return { address: solanaFromTx, network: "solana" };
       }
     } catch (err) {
       console.warn("[gate] MPP signer extraction failed:", err instanceof Error ? err.message : err);
@@ -269,28 +311,9 @@ async function extractPaymentSigner(request, x402PaymentHeader) {
     try {
       const decoded = atob(x402PaymentHeader);
       const parsed = JSON.parse(decoded);
-      const network = parsed?.accepted?.network ?? "";
-      if (network.startsWith("eip155:")) {
-        const from = parsed?.payload?.authorization?.from;
-        if (typeof from === "string" && /^0x[0-9a-fA-F]{40}$/.test(from)) {
-          return { address: from.toLowerCase(), network: "evm" };
-        }
-      } else if (network.startsWith("solana:")) {
-        const transaction = parsed?.payload?.transaction;
-        if (typeof transaction === "string") {
-          const moduleName = "@x402/svm";
-          const svm = await import(moduleName).catch(() => null);
-          if (svm?.decodeTransactionFromPayload && svm.getTokenPayerFromTransaction) {
-            const tx = svm.decodeTransactionFromPayload({ transaction });
-            const payer = svm.getTokenPayerFromTransaction(tx);
-            if (typeof payer === "string" && payer.length > 0) return { address: payer, network: "solana" };
-          }
-        }
-      } else {
-        const from = parsed?.payload?.authorization?.from;
-        if (typeof from === "string" && /^0x[0-9a-fA-F]{40}$/.test(from)) {
-          return { address: from.toLowerCase(), network: "evm" };
-        }
+      const from = parsed?.payload?.authorization?.from;
+      if (typeof from === "string" && /^0x[0-9a-fA-F]{40}$/.test(from)) {
+        return { address: from.toLowerCase(), network: "evm" };
       }
     } catch (err) {
       console.warn("[gate] x402 signer extraction failed:", err instanceof Error ? err.message : err);