@agent-score/commerce 2.6.3 → 2.6.5

package/dist/index.mjs

@@ -22574,7 +22574,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.6.3"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.5"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -23201,6 +23201,39 @@ function hasMppxHeader(input) {
   const headers = asHeaders(input);
   return Boolean(readHeader(headers, "authorization")?.startsWith("Payment "));
 }
+var JWT_SHAPE_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function decodesToJsonObject(token) {
+  try {
+    const parsed = JSON.parse(Buffer.from(token, "base64").toString("utf8"));
+    return typeof parsed === "object" && parsed !== null;
+  } catch {
+    return false;
+  }
+}
+function malformedPaymentCredential(input) {
+  const headers = asHeaders(input);
+  const x402Token = readHeader(headers, "payment-signature") ?? readHeader(headers, "x-payment");
+  if (x402Token !== null && x402Token.length > 0) {
+    if (!decodesToJsonObject(x402Token)) {
+      return {
+        channel: "x402",
+        message: "X-Payment header is not decodable base64 JSON."
+      };
+    }
+    return null;
+  }
+  const auth = readHeader(headers, "authorization");
+  if (auth !== null && auth.startsWith("Payment ")) {
+    const token = auth.slice("Payment ".length).trim();
+    if (token.length === 0 || !decodesToJsonObject(token) && !JWT_SHAPE_RE.test(token)) {
+      return {
+        channel: "mpp",
+        message: "Authorization: Payment credential is neither base64-encoded JSON nor a token-shaped value."
+      };
+    }
+  }
+  return null;
+}
 
 // src/identity/tokens.ts
 function hashOperatorToken(plaintext) {
@@ -25188,6 +25221,22 @@ function x402SignerFromPayload(payload) {
     txHash: null
   };
 }
+function mppCredentialPayloadType(authorizationHeader) {
+  if (typeof authorizationHeader !== "string") return null;
+  if (!authorizationHeader.toLowerCase().startsWith("payment ")) return null;
+  const token = authorizationHeader.slice("payment ".length).trim();
+  if (!token) return null;
+  try {
+    const credential = JSON.parse(atob(token));
+    if (!credential || typeof credential !== "object") return null;
+    const payload = credential.payload;
+    if (!payload || typeof payload !== "object") return null;
+    const type = payload.type;
+    return typeof type === "string" ? type : null;
+  } catch {
+    return null;
+  }
+}
 function mppSignerFromAuth(authorizationHeader) {
   if (typeof authorizationHeader !== "string") return NULL_RESULT;
   if (!authorizationHeader.toLowerCase().startsWith("payment ")) return NULL_RESULT;
@@ -25440,6 +25489,7 @@ var Checkout = class {
    *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
   x402StaticRecipients;
   zeroSettleCarveOut;
+  credentialPreCheck;
   gate;
   discoveryExtensions;
   resourceInfo;
@@ -25521,6 +25571,7 @@ var Checkout = class {
     this.isCachedAddress = opts.isCachedAddress;
     this.x402StaticRecipients = collectStaticX402Recipients(opts.rails);
     this.zeroSettleCarveOut = opts.zeroSettleCarveOut ?? false;
+    this.credentialPreCheck = opts.credentialPreCheck ?? true;
     this.gate = opts.gate;
     this.discoveryExtensions = opts.discoveryExtensions;
     this.resourceInfo = opts.resourceInfo;
@@ -25658,6 +25709,27 @@ var Checkout = class {
         };
       }
     }
+    if (this.credentialPreCheck) {
+      const malformed = malformedPaymentCredential(request.headers);
+      const enforced = malformed !== null && (malformed.channel === "x402" ? this.x402ServerAvailable() && this.x402BaseNetwork !== null : this.composeMppx !== void 0);
+      if (enforced) {
+        return {
+          status: 400,
+          body: buildValidationError({
+            code: "payment_proof_invalid",
+            message: malformed.message,
+            nextSteps: {
+              action: "regenerate_payment_credential",
+              user_message: "The payment credential could not be decoded. Rebuild it from a fresh 402 challenge and retry."
+            }
+          }),
+          headers: {},
+          referenceId: ctx.referenceId,
+          settled: false,
+          settlePhase: "credential_malformed"
+        };
+      }
+    }
     if (this.preValidate !== void 0) {
       try {
         const state = await this.preValidate(ctx);
@@ -26004,7 +26076,11 @@ var Checkout = class {
       zero = zeroAmountCarveOut({ rail, payload: verified.payload });
       railKey = this.x402RailKey();
     } else {
-      zero = zeroAmountCarveOut({ rail, authorizationHeader: headers["authorization"] });
+      const authHeader = headers["authorization"] ?? null;
+      if (mppCredentialPayloadType(authHeader) === "proof") return null;
+      const inline = zeroAmountCarveOut({ rail, authorizationHeader: authHeader });
+      const extracted = await extractPaymentSignerFromAuth(authHeader);
+      zero = extracted !== null ? { signerAddress: extracted.address, signerNetwork: extracted.network, txHash: null } : inline;
       railKey = (zero.signerNetwork !== null ? this.railsKeyForMppxMethod(zero.signerNetwork === "solana" ? "solana" : "tempo") : void 0) ?? this.mppRailKey();
     }
     const outcome = {
@@ -26802,11 +26878,11 @@ function canonicalize2(value) {
   }
   return value;
 }
-function createQuoteCache(opts = {}) {
+function createResultCache(opts = {}) {
   const ttlMs = opts.ttlMs ?? 5 * 6e4;
-  const keyPrefix = opts.keyPrefix ?? "quote:";
+  const keyPrefix = opts.keyPrefix ?? "result:";
   const memMap = /* @__PURE__ */ new Map();
-  const getRedis = memoizedRedis({ url: opts.redisUrl, label: "quote-cache" });
+  const getRedis = memoizedRedis({ url: opts.redisUrl, label: "result-cache" });
   const evictExpired = () => {
     const now = Date.now();
     for (const [k, v] of memMap.entries()) {
@@ -26833,17 +26909,16 @@ function createQuoteCache(opts = {}) {
       const entry = memMap.get(key);
       return entry ? entry.entry : null;
     },
-    async write(key, body, priceCents, recipients = {}) {
-      const cached2 = { body, priceCents, recipients };
+    async write(key, value) {
       const r = await getRedis();
       if (r) {
         try {
-          await r.set(`${keyPrefix}${key}`, JSON.stringify(cached2), "PX", ttlMs);
+          await r.set(`${keyPrefix}${key}`, JSON.stringify(value), "PX", ttlMs);
           return;
         } catch {
         }
       }
-      memMap.set(key, { entry: cached2, expiresAt: Date.now() + ttlMs });
+      memMap.set(key, { entry: value, expiresAt: Date.now() + ttlMs });
     },
     async clear() {
       memMap.clear();
@@ -26857,6 +26932,17 @@ function createQuoteCache(opts = {}) {
     }
   };
 }
+function createQuoteCache(opts = {}) {
+  const cache = createResultCache({ ...opts, keyPrefix: opts.keyPrefix ?? "quote:" });
+  return {
+    bodyHashKey: cache.bodyHashKey,
+    read: cache.read,
+    async write(key, body, priceCents, recipients = {}) {
+      await cache.write(key, { body, priceCents, recipients });
+    },
+    clear: cache.clear
+  };
+}
 
 // src/checkout_compute_first.ts
 var DEFAULT_TTL_MS = 5 * 6e4;
@@ -27373,6 +27459,7 @@ export {
   computeFirstCheckout,
   createDefaultOnDenied,
   createQuoteCache,
+  createResultCache,
   defaultReadOnlyOnDenied,
   denialReasonStatus,
   denialReasonToBody,
@@ -27397,6 +27484,7 @@ export {
   loadSolanaFeePayer,
   loadUCPSigningKeyFromEnv,
   makeMppxComposeHook,
+  malformedPaymentCredential,
   mppPaymentHandler,
   normalizeAddress,
   pricingResult,