@agent-score/commerce 2.6.2 → 2.6.4

package/dist/{checkout-C4RD7M0Z.d.ts → checkout-B-Z5_EQP.d.ts}

@@ -815,6 +815,7 @@ declare class Checkout {
      *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
     private readonly x402StaticRecipients;
     readonly zeroSettleCarveOut: boolean;
+    readonly credentialPreCheck: boolean;
     readonly gate: CheckoutGateConfig | undefined;
     readonly discoveryExtensions: Record<string, unknown> | undefined;
     readonly resourceInfo: {
@@ -882,6 +883,14 @@ declare class Checkout {
          *  resolves to $0. Goods merchants offering free redemption codes set this
          *  to `true` so the credential parses without an on-chain settle. */
         zeroSettleCarveOut?: boolean;
+        /** Reject payment credentials that fail the cheap wire-shape check (not
+         *  base64 JSON, not a token-shaped value) BEFORE any merchant hook runs,
+         *  so junk headers never trigger `preValidate` / pricing / recipient
+         *  minting / the gate's assess call. Shape only — signature and payTo
+         *  verification stay on the settle path. Default `true`; set `false` for
+         *  custom `composeMppx` implementations that accept non-standard
+         *  credential encodings. */
+        credentialPreCheck?: boolean;
         /** Per-request gate config. When set, the gate runs after `preValidate`
          *  populates `ctx.state` and before pricing/settle. Denials short-circuit
          *  with the gate's body verbatim. */

package/dist/{checkout-CzB9f_jf.d.mts → checkout-BtdHSF_w.d.mts}

@@ -815,6 +815,7 @@ declare class Checkout {
      *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
     private readonly x402StaticRecipients;
     readonly zeroSettleCarveOut: boolean;
+    readonly credentialPreCheck: boolean;
     readonly gate: CheckoutGateConfig | undefined;
     readonly discoveryExtensions: Record<string, unknown> | undefined;
     readonly resourceInfo: {
@@ -882,6 +883,14 @@ declare class Checkout {
          *  resolves to $0. Goods merchants offering free redemption codes set this
          *  to `true` so the credential parses without an on-chain settle. */
         zeroSettleCarveOut?: boolean;
+        /** Reject payment credentials that fail the cheap wire-shape check (not
+         *  base64 JSON, not a token-shaped value) BEFORE any merchant hook runs,
+         *  so junk headers never trigger `preValidate` / pricing / recipient
+         *  minting / the gate's assess call. Shape only — signature and payTo
+         *  verification stay on the settle path. Default `true`; set `false` for
+         *  custom `composeMppx` implementations that accept non-standard
+         *  credential encodings. */
+        credentialPreCheck?: boolean;
         /** Per-request gate config. When set, the gate runs after `preValidate`
          *  populates `ctx.state` and before pricing/settle. Denials short-circuit
          *  with the gate's body verbatim. */

package/dist/core.js

@@ -227,7 +227,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.2"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.4"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/core.mjs

@@ -209,7 +209,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.2"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.4"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/discovery/index.d.mts

@@ -1,6 +1,6 @@
 import { R as RailKey, C as CompatibleClients } from '../pricing-KHDqMLd7.mjs';
 export { g as compatibleClientsByRails } from '../pricing-KHDqMLd7.mjs';
-import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-CzB9f_jf.mjs';
+import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-BtdHSF_w.mjs';
 import '../rail_spec-BFZmW9RN.mjs';
 import '../core.mjs';
 import '@agent-score/sdk';

package/dist/discovery/index.d.ts

@@ -1,6 +1,6 @@
 import { R as RailKey, C as CompatibleClients } from '../pricing-CytRwhC2.js';
 export { g as compatibleClientsByRails } from '../pricing-CytRwhC2.js';
-import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-C4RD7M0Z.js';
+import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-B-Z5_EQP.js';
 import '../rail_spec-BFZmW9RN.js';
 import '../core.js';
 import '@agent-score/sdk';

package/dist/identity/express.js

@@ -920,7 +920,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.2"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.4"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();