@agent-score/commerce 2.6.2 → 2.6.4

package/dist/index.mjs

@@ -22574,7 +22574,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.2"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.4"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -23201,6 +23201,39 @@ function hasMppxHeader(input) {
   const headers = asHeaders(input);
   return Boolean(readHeader(headers, "authorization")?.startsWith("Payment "));
 }
+var JWT_SHAPE_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function decodesToJsonObject(token) {
+  try {
+    const parsed = JSON.parse(Buffer.from(token, "base64").toString("utf8"));
+    return typeof parsed === "object" && parsed !== null;
+  } catch {
+    return false;
+  }
+}
+function malformedPaymentCredential(input) {
+  const headers = asHeaders(input);
+  const x402Token = readHeader(headers, "payment-signature") ?? readHeader(headers, "x-payment");
+  if (x402Token !== null && x402Token.length > 0) {
+    if (!decodesToJsonObject(x402Token)) {
+      return {
+        channel: "x402",
+        message: "X-Payment header is not decodable base64 JSON."
+      };
+    }
+    return null;
+  }
+  const auth = readHeader(headers, "authorization");
+  if (auth !== null && auth.startsWith("Payment ")) {
+    const token = auth.slice("Payment ".length).trim();
+    if (token.length === 0 || !decodesToJsonObject(token) && !JWT_SHAPE_RE.test(token)) {
+      return {
+        channel: "mpp",
+        message: "Authorization: Payment credential is neither base64-encoded JSON nor a token-shaped value."
+      };
+    }
+  }
+  return null;
+}
 
 // src/identity/tokens.ts
 function hashOperatorToken(plaintext) {
@@ -25440,6 +25473,7 @@ var Checkout = class {
    *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
   x402StaticRecipients;
   zeroSettleCarveOut;
+  credentialPreCheck;
   gate;
   discoveryExtensions;
   resourceInfo;
@@ -25521,6 +25555,7 @@ var Checkout = class {
     this.isCachedAddress = opts.isCachedAddress;
     this.x402StaticRecipients = collectStaticX402Recipients(opts.rails);
     this.zeroSettleCarveOut = opts.zeroSettleCarveOut ?? false;
+    this.credentialPreCheck = opts.credentialPreCheck ?? true;
     this.gate = opts.gate;
     this.discoveryExtensions = opts.discoveryExtensions;
     this.resourceInfo = opts.resourceInfo;
@@ -25658,6 +25693,27 @@ var Checkout = class {
         };
       }
     }
+    if (this.credentialPreCheck) {
+      const malformed = malformedPaymentCredential(request.headers);
+      const enforced = malformed !== null && (malformed.channel === "x402" ? this.x402ServerAvailable() && this.x402BaseNetwork !== null : this.composeMppx !== void 0);
+      if (enforced) {
+        return {
+          status: 400,
+          body: buildValidationError({
+            code: "payment_proof_invalid",
+            message: malformed.message,
+            nextSteps: {
+              action: "regenerate_payment_credential",
+              user_message: "The payment credential could not be decoded. Rebuild it from a fresh 402 challenge and retry."
+            }
+          }),
+          headers: {},
+          referenceId: ctx.referenceId,
+          settled: false,
+          settlePhase: "credential_malformed"
+        };
+      }
+    }
     if (this.preValidate !== void 0) {
       try {
         const state = await this.preValidate(ctx);
@@ -25980,21 +26036,34 @@ var Checkout = class {
     if (ctx.pricing.amountUsd !== 0) return null;
     const headers = normalizeHeadersToLowercase(ctx.request.headers);
     let zero;
+    let railKey;
     if (rail === "x402-base") {
-      const x402Header = headers["payment-signature"] ?? headers["x-payment"];
-      let payload = null;
-      if (typeof x402Header === "string" && x402Header.length > 0) {
-        try {
-          payload = JSON.parse(atob(x402Header));
-        } catch {
-          payload = null;
-        }
+      const fakeRequest = new Request(ctx.request.url, {
+        method: ctx.request.method,
+        headers: ctx.request.headers
+      });
+      const verified = await verifyX402Request({
+        request: fakeRequest,
+        isCachedAddress: (addr) => this.asyncIsCachedAddress(addr, ctx),
+        acceptedNetwork: this.x402BaseNetwork ?? ""
+      });
+      if (!verified.ok) {
+        return {
+          status: verified.status,
+          body: verified.body,
+          headers: {},
+          referenceId: ctx.referenceId,
+          settled: false,
+          settlePhase: "verify_failed"
+        };
       }
-      zero = zeroAmountCarveOut({ rail, payload });
+      zero = zeroAmountCarveOut({ rail, payload: verified.payload });
+      railKey = this.x402RailKey();
     } else {
       zero = zeroAmountCarveOut({ rail, authorizationHeader: headers["authorization"] });
+      if (zero.signerNetwork !== "solana") return null;
+      railKey = this.railsKeyForMppxMethod("solana") ?? this.mppRailKey();
     }
-    const railKey = rail === "x402-base" ? this.x402RailKey() : this.mppRailKey();
     const outcome = {
       rail: rail === "x402-base" ? "x402" : "mpp",
       paymentResponseHeader: null,
@@ -26790,11 +26859,11 @@ function canonicalize2(value) {
   }
   return value;
 }
-function createQuoteCache(opts = {}) {
+function createResultCache(opts = {}) {
   const ttlMs = opts.ttlMs ?? 5 * 6e4;
-  const keyPrefix = opts.keyPrefix ?? "quote:";
+  const keyPrefix = opts.keyPrefix ?? "result:";
   const memMap = /* @__PURE__ */ new Map();
-  const getRedis = memoizedRedis({ url: opts.redisUrl, label: "quote-cache" });
+  const getRedis = memoizedRedis({ url: opts.redisUrl, label: "result-cache" });
   const evictExpired = () => {
     const now = Date.now();
     for (const [k, v] of memMap.entries()) {
@@ -26821,17 +26890,16 @@ function createQuoteCache(opts = {}) {
       const entry = memMap.get(key);
       return entry ? entry.entry : null;
     },
-    async write(key, body, priceCents, recipients = {}) {
-      const cached2 = { body, priceCents, recipients };
+    async write(key, value) {
       const r = await getRedis();
       if (r) {
         try {
-          await r.set(`${keyPrefix}${key}`, JSON.stringify(cached2), "PX", ttlMs);
+          await r.set(`${keyPrefix}${key}`, JSON.stringify(value), "PX", ttlMs);
           return;
         } catch {
         }
       }
-      memMap.set(key, { entry: cached2, expiresAt: Date.now() + ttlMs });
+      memMap.set(key, { entry: value, expiresAt: Date.now() + ttlMs });
     },
     async clear() {
       memMap.clear();
@@ -26845,6 +26913,17 @@ function createQuoteCache(opts = {}) {
     }
   };
 }
+function createQuoteCache(opts = {}) {
+  const cache = createResultCache({ ...opts, keyPrefix: opts.keyPrefix ?? "quote:" });
+  return {
+    bodyHashKey: cache.bodyHashKey,
+    read: cache.read,
+    async write(key, body, priceCents, recipients = {}) {
+      await cache.write(key, { body, priceCents, recipients });
+    },
+    clear: cache.clear
+  };
+}
 
 // src/checkout_compute_first.ts
 var DEFAULT_TTL_MS = 5 * 6e4;
@@ -27361,6 +27440,7 @@ export {
   computeFirstCheckout,
   createDefaultOnDenied,
   createQuoteCache,
+  createResultCache,
   defaultReadOnlyOnDenied,
   denialReasonStatus,
   denialReasonToBody,
@@ -27385,6 +27465,7 @@ export {
   loadSolanaFeePayer,
   loadUCPSigningKeyFromEnv,
   makeMppxComposeHook,
+  malformedPaymentCredential,
   mppPaymentHandler,
   normalizeAddress,
   pricingResult,