@agent-score/commerce 2.6.1 → 2.6.3

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/@agent-score/commerce.svg)](https://www.npmjs.com/package/@agent-score/commerce)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
-The full merchant-side SDK for [AgentScore](https://www.agentscore.com): agent commerce in one install. Ships identity gating, payment rail helpers, 402 challenge builders, MPP discovery, and Stripe multichain support. Built and maintained by AgentScore; works with any 402/MPP merchant in the ecosystem, AgentScore-gated or not.
+The full merchant-side SDK for [AgentScore](https://www.agentscore.com): agent commerce in one install. Ships identity gating, payment rail helpers, 402 challenge builders, MPP discovery, and Stripe multichain support. Built and maintained by AgentScore; works with any x402/MPP merchant in the ecosystem, AgentScore-gated or not.
 
 ## Install
 
@@ -476,7 +476,7 @@ The `getGateDegradedState` helper is exported by the context-getter adapters (Ho
 
 ## Examples
 
-The [examples/](./examples) directory has 9 runnable single-file Hono apps covering common merchant scenarios; copy-paste templates, not frameworks. See [examples/README.md](./examples/README.md) for the full table.
+The [examples/](./examples) directory has 8 runnable single-file Hono apps covering common merchant scenarios; copy-paste templates, not frameworks. See [examples/README.md](./examples/README.md) for the full table.
 
 ## Vendor profile examples
 

package/dist/core.js

@@ -227,7 +227,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/core.mjs

@@ -209,7 +209,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/express.js

@@ -920,7 +920,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/express.mjs

@@ -892,7 +892,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/fastify.js

@@ -921,7 +921,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/fastify.mjs

@@ -892,7 +892,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/hono.js

@@ -901,7 +901,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/hono.mjs

@@ -873,7 +873,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/nextjs.js

@@ -922,7 +922,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/nextjs.mjs

@@ -897,7 +897,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/web.js

@@ -898,7 +898,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/web.mjs

@@ -873,7 +873,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/index.js

@@ -5535,9 +5535,9 @@ function stringifyPrimitive(value) {
     return `"${value}"`;
   return `${value}`;
 }
-function optionalKeys(shape) {
-  return Object.keys(shape).filter((k) => {
-    return shape[k]._zod.optin === "optional" && shape[k]._zod.optout === "optional";
+function optionalKeys(shape2) {
+  return Object.keys(shape2).filter((k) => {
+    return shape2[k]._zod.optin === "optional" && shape2[k]._zod.optout === "optional";
   });
 }
 function pick(schema, mask) {
@@ -5590,15 +5590,15 @@ function omit(schema, mask) {
   });
   return clone(schema, def);
 }
-function extend(schema, shape) {
-  if (!isPlainObject(shape)) {
+function extend(schema, shape2) {
+  if (!isPlainObject(shape2)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
   const checks = schema._zod.def.checks;
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
     const existingShape = schema._zod.def.shape;
-    for (const key in shape) {
+    for (const key in shape2) {
       if (Object.getOwnPropertyDescriptor(existingShape, key) !== void 0) {
         throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.");
       }
@@ -5606,20 +5606,20 @@ function extend(schema, shape) {
   }
   const def = mergeDefs(schema._zod.def, {
     get shape() {
-      const _shape = { ...schema._zod.def.shape, ...shape };
+      const _shape = { ...schema._zod.def.shape, ...shape2 };
       assignProp(this, "shape", _shape);
       return _shape;
     }
   });
   return clone(schema, def);
 }
-function safeExtend(schema, shape) {
-  if (!isPlainObject(shape)) {
+function safeExtend(schema, shape2) {
+  if (!isPlainObject(shape2)) {
     throw new Error("Invalid input to safeExtend: expected a plain object");
   }
   const def = mergeDefs(schema._zod.def, {
     get shape() {
-      const _shape = { ...schema._zod.def.shape, ...shape };
+      const _shape = { ...schema._zod.def.shape, ...shape2 };
       assignProp(this, "shape", _shape);
       return _shape;
     }
@@ -5653,7 +5653,7 @@ function partial(Class2, schema, mask) {
   const def = mergeDefs(schema._zod.def, {
     get shape() {
       const oldShape = schema._zod.def.shape;
-      const shape = { ...oldShape };
+      const shape2 = { ...oldShape };
       if (mask) {
         for (const key in mask) {
           if (!(key in oldShape)) {
@@ -5661,21 +5661,21 @@ function partial(Class2, schema, mask) {
           }
           if (!mask[key])
             continue;
-          shape[key] = Class2 ? new Class2({
+          shape2[key] = Class2 ? new Class2({
             type: "optional",
             innerType: oldShape[key]
           }) : oldShape[key];
         }
       } else {
         for (const key in oldShape) {
-          shape[key] = Class2 ? new Class2({
+          shape2[key] = Class2 ? new Class2({
             type: "optional",
             innerType: oldShape[key]
           }) : oldShape[key];
         }
       }
-      assignProp(this, "shape", shape);
-      return shape;
+      assignProp(this, "shape", shape2);
+      return shape2;
     },
     checks: []
   });
@@ -5685,29 +5685,29 @@ function required(Class2, schema, mask) {
   const def = mergeDefs(schema._zod.def, {
     get shape() {
       const oldShape = schema._zod.def.shape;
-      const shape = { ...oldShape };
+      const shape2 = { ...oldShape };
       if (mask) {
         for (const key in mask) {
-          if (!(key in shape)) {
+          if (!(key in shape2)) {
             throw new Error(`Unrecognized key: "${key}"`);
           }
           if (!mask[key])
             continue;
-          shape[key] = new Class2({
+          shape2[key] = new Class2({
             type: "nonoptional",
             innerType: oldShape[key]
           });
         }
       } else {
         for (const key in oldShape) {
-          shape[key] = new Class2({
+          shape2[key] = new Class2({
             type: "nonoptional",
             innerType: oldShape[key]
           });
         }
       }
-      assignProp(this, "shape", shape);
-      return shape;
+      assignProp(this, "shape", shape2);
+      return shape2;
     }
   });
   return clone(schema, def);
@@ -8002,10 +8002,10 @@ var init_schemas = __esm({
       }
       const _normalized = cached(() => normalizeDef(def));
       defineLazy(inst._zod, "propValues", () => {
-        const shape = def.shape;
+        const shape2 = def.shape;
         const propValues = {};
-        for (const key in shape) {
-          const field = shape[key]._zod;
+        for (const key in shape2) {
+          const field = shape2[key]._zod;
           if (field.values) {
             propValues[key] ?? (propValues[key] = /* @__PURE__ */ new Set());
             for (const v of field.values)
@@ -8031,9 +8031,9 @@ var init_schemas = __esm({
         }
         payload.value = {};
         const proms = [];
-        const shape = value.shape;
+        const shape2 = value.shape;
         for (const key of value.keys) {
-          const el = shape[key];
+          const el = shape2[key];
           const isOptionalIn = el._zod.optin === "optional";
           const isOptionalOut = el._zod.optout === "optional";
           const r = el._zod.run({ value: input[key], issues: [] }, ctx);
@@ -8053,7 +8053,7 @@ var init_schemas = __esm({
       $ZodObject.init(inst, def);
       const superParse = inst._zod.parse;
       const _normalized = cached(() => normalizeDef(def));
-      const generateFastpass = (shape) => {
+      const generateFastpass = (shape2) => {
         const doc = new Doc(["shape", "payload", "ctx"]);
         const normalized = _normalized.value;
         const parseStr = (key) => {
@@ -8070,7 +8070,7 @@ var init_schemas = __esm({
         for (const key of normalized.keys) {
           const id = ids[key];
           const k = esc(key);
-          const schema = shape[key];
+          const schema = shape2[key];
           const isOptionalIn = schema?._zod?.optin === "optional";
           const isOptionalOut = schema?._zod?.optout === "optional";
           doc.write(`const ${id} = ${parseStr(key)};`);
@@ -8144,7 +8144,7 @@ var init_schemas = __esm({
         doc.write(`payload.value = newResult;`);
         doc.write(`return payload;`);
         const fn = doc.compile();
-        return (payload, ctx) => fn(shape, payload, ctx);
+        return (payload, ctx) => fn(shape2, payload, ctx);
       };
       let fastpass;
       const isObject3 = isObject;
@@ -17202,14 +17202,14 @@ var init_json_schema_processors = __esm({
       const def = schema._zod.def;
       json2.type = "object";
       json2.properties = {};
-      const shape = def.shape;
-      for (const key in shape) {
-        json2.properties[key] = process2(shape[key], ctx, {
+      const shape2 = def.shape;
+      for (const key in shape2) {
+        json2.properties[key] = process2(shape2[key], ctx, {
           ...params,
           path: [...params.path, "properties", key]
         });
       }
-      const allKeys = new Set(Object.keys(shape));
+      const allKeys = new Set(Object.keys(shape2));
       const requiredKeys = new Set([...allKeys].filter((key) => {
         const v = def.shape[key]._zod;
         if (ctx.io === "input") {
@@ -18070,47 +18070,47 @@ function array(element, params) {
 }
 // @__NO_SIDE_EFFECTS__
 function keyof(schema) {
-  const shape = schema._zod.def.shape;
-  return /* @__PURE__ */ _enum2(Object.keys(shape));
+  const shape2 = schema._zod.def.shape;
+  return /* @__PURE__ */ _enum2(Object.keys(shape2));
 }
 // @__NO_SIDE_EFFECTS__
-function object(shape, params) {
+function object(shape2, params) {
   const def = {
     type: "object",
-    shape: shape ?? {},
+    shape: shape2 ?? {},
     ...normalizeParams(params)
   };
   return new ZodMiniObject(def);
 }
 // @__NO_SIDE_EFFECTS__
-function strictObject(shape, params) {
+function strictObject(shape2, params) {
   return new ZodMiniObject({
     type: "object",
-    shape,
+    shape: shape2,
     catchall: /* @__PURE__ */ never(),
     ...normalizeParams(params)
   });
 }
 // @__NO_SIDE_EFFECTS__
-function looseObject(shape, params) {
+function looseObject(shape2, params) {
   return new ZodMiniObject({
     type: "object",
-    shape,
+    shape: shape2,
     catchall: /* @__PURE__ */ unknown(),
     ...normalizeParams(params)
   });
 }
 // @__NO_SIDE_EFFECTS__
-function extend2(schema, shape) {
-  return extend(schema, shape);
+function extend2(schema, shape2) {
+  return extend(schema, shape2);
 }
 // @__NO_SIDE_EFFECTS__
-function safeExtend2(schema, shape) {
-  return safeExtend(schema, shape);
+function safeExtend2(schema, shape2) {
+  return safeExtend(schema, shape2);
 }
 // @__NO_SIDE_EFFECTS__
-function merge2(schema, shape) {
-  return extend(schema, shape);
+function merge2(schema, shape2) {
+  return extend(schema, shape2);
 }
 // @__NO_SIDE_EFFECTS__
 function pick2(schema, mask) {
@@ -20148,7 +20148,7 @@ var version3;
 var init_version2 = __esm({
   "node_modules/viem/_esm/errors/version.js"() {
     "use strict";
-    version3 = "2.54.4";
+    version3 = "2.54.6";
   }
 });
 
@@ -21143,14 +21143,14 @@ function fromResponse2(response) {
     throw new Error(`Missing ${Headers2.paymentReceipt} header.`);
   return deserialize4(header);
 }
-var Schema2;
+var shape, BaseSchema, Schema2;
 var init_Receipt = __esm({
   "node_modules/mppx/dist/Receipt.js"() {
     "use strict";
     init_esm2();
     init_Constants();
     init_zod();
-    Schema2 = object({
+    shape = {
       /** Payment method used (e.g., "tempo", "stripe"). */
       method: string2(),
       /** Method-specific reference (e.g., transaction hash). */
@@ -21163,7 +21163,9 @@ var init_Receipt = __esm({
       status: literal("success"),
       /** RFC 3339 settlement timestamp. */
       timestamp: datetime3()
-    });
+    };
+    BaseSchema = object(shape);
+    Schema2 = looseObject(shape);
   }
 });
 
@@ -22662,7 +22664,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.1"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -26068,21 +26070,33 @@ var Checkout = class {
     if (ctx.pricing.amountUsd !== 0) return null;
     const headers = normalizeHeadersToLowercase(ctx.request.headers);
     let zero;
+    let railKey;
     if (rail === "x402-base") {
-      const x402Header = headers["payment-signature"] ?? headers["x-payment"];
-      let payload = null;
-      if (typeof x402Header === "string" && x402Header.length > 0) {
-        try {
-          payload = JSON.parse(atob(x402Header));
-        } catch {
-          payload = null;
-        }
+      const fakeRequest = new Request(ctx.request.url, {
+        method: ctx.request.method,
+        headers: ctx.request.headers
+      });
+      const verified = await verifyX402Request({
+        request: fakeRequest,
+        isCachedAddress: (addr) => this.asyncIsCachedAddress(addr, ctx),
+        acceptedNetwork: this.x402BaseNetwork ?? ""
+      });
+      if (!verified.ok) {
+        return {
+          status: verified.status,
+          body: verified.body,
+          headers: {},
+          referenceId: ctx.referenceId,
+          settled: false,
+          settlePhase: "verify_failed"
+        };
       }
-      zero = zeroAmountCarveOut({ rail, payload });
+      zero = zeroAmountCarveOut({ rail, payload: verified.payload });
+      railKey = this.x402RailKey();
     } else {
       zero = zeroAmountCarveOut({ rail, authorizationHeader: headers["authorization"] });
+      railKey = (zero.signerNetwork !== null ? this.railsKeyForMppxMethod(zero.signerNetwork === "solana" ? "solana" : "tempo") : void 0) ?? this.mppRailKey();
     }
-    const railKey = rail === "x402-base" ? this.x402RailKey() : this.mppRailKey();
     const outcome = {
       rail: rail === "x402-base" ? "x402" : "mpp",
       paymentResponseHeader: null,