@agent-score/commerce 2.6.3 → 2.6.4

package/dist/payment/index.mjs

@@ -1350,6 +1350,39 @@ function hasMppxHeader(input) {
   const headers = asHeaders(input);
   return Boolean(readHeader(headers, "authorization")?.startsWith("Payment "));
 }
+var JWT_SHAPE_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function decodesToJsonObject(token) {
+  try {
+    const parsed = JSON.parse(Buffer.from(token, "base64").toString("utf8"));
+    return typeof parsed === "object" && parsed !== null;
+  } catch {
+    return false;
+  }
+}
+function malformedPaymentCredential(input) {
+  const headers = asHeaders(input);
+  const x402Token = readHeader(headers, "payment-signature") ?? readHeader(headers, "x-payment");
+  if (x402Token !== null && x402Token.length > 0) {
+    if (!decodesToJsonObject(x402Token)) {
+      return {
+        channel: "x402",
+        message: "X-Payment header is not decodable base64 JSON."
+      };
+    }
+    return null;
+  }
+  const auth = readHeader(headers, "authorization");
+  if (auth !== null && auth.startsWith("Payment ")) {
+    const token = auth.slice("Payment ".length).trim();
+    if (token.length === 0 || !decodesToJsonObject(token) && !JWT_SHAPE_RE.test(token)) {
+      return {
+        channel: "mpp",
+        message: "Authorization: Payment credential is neither base64-encoded JSON nor a token-shaped value."
+      };
+    }
+  }
+  return null;
+}
 
 // src/payment/network_kind.ts
 function readNetwork(input) {
@@ -1400,6 +1433,7 @@ export {
   lazyX402Server,
   loadSolanaFeePayer,
   lookupRail,
+  malformedPaymentCredential,
   mppxChallengeHeaders,
   networkFamily,
   networks,