@agent-score/commerce 2.6.3 → 2.6.5

package/dist/{network_kind-BIJM2peR.d.ts → network_kind-BmbWKNud.d.ts}

@@ -34,6 +34,28 @@ declare function hasX402Header(input: Request | HeadersLike): boolean;
 /** True when the request carries an mppx payment credential
  *  (`Authorization: Payment <jwt>`). Use to dispatch to the MPP settle path. */
 declare function hasMppxHeader(input: Request | HeadersLike): boolean;
+interface MalformedPaymentCredential {
+    /** Which credential channel carried the malformed value. */
+    channel: 'x402' | 'mpp';
+    message: string;
+}
+/**
+ * Wire-shape gate for payment credentials, cheap enough to run before any
+ * merchant hook. A request whose payment header cannot possibly be a
+ * credential (not base64/base64url JSON, not a JWT-shaped token) is rejected
+ * up front, so junk headers never trigger per-request hooks (`preValidate`,
+ * pricing, recipient minting) or the identity-gate API call.
+ *
+ * This is deliberately a SHAPE check only. Signature verification, payTo
+ * binding, and challenge validation stay where they are (the x402 validator
+ * and the mppx settle path) — those need per-request state the hooks produce.
+ * A well-formed-but-invalid credential still reaches the real validators and
+ * fails there.
+ *
+ * Returns `null` when every present credential channel is plausibly shaped
+ * (or no payment header is present).
+ */
+declare function malformedPaymentCredential(input: Request | HeadersLike): MalformedPaymentCredential | null;
 
 /**
  * USD ↔ atomic-unit conversion for token amounts.
@@ -209,4 +231,4 @@ declare function isEvmNetwork(input: NetworkLike): boolean;
  *  network spec — this helper treats it as false. */
 declare function isSolanaNetwork(input: NetworkLike): boolean;
 
-export { type BuildDefaultCheckoutRailsOptions as B, type HeadersLike as H, type BuildMppxComposeRailsOptions as a, asHeaders as b, buildDefaultCheckoutRails as c, buildMppxComposeRails as d, hasPaymentHeader as e, formatUsdCents as f, hasX402Header as g, hasMppxHeader as h, isEvmNetwork as i, isSolanaNetwork as j, loadSolanaFeePayer as l, readHeader as r, usdToAtomic as u };
+export { type BuildDefaultCheckoutRailsOptions as B, type HeadersLike as H, type MalformedPaymentCredential as M, type BuildMppxComposeRailsOptions as a, asHeaders as b, buildDefaultCheckoutRails as c, buildMppxComposeRails as d, hasPaymentHeader as e, formatUsdCents as f, hasX402Header as g, hasMppxHeader as h, isEvmNetwork as i, isSolanaNetwork as j, loadSolanaFeePayer as l, malformedPaymentCredential as m, readHeader as r, usdToAtomic as u };

package/dist/{network_kind-C0EMkdzz.d.mts → network_kind-D2xpo2Fj.d.mts}

@@ -34,6 +34,28 @@ declare function hasX402Header(input: Request | HeadersLike): boolean;
 /** True when the request carries an mppx payment credential
  *  (`Authorization: Payment <jwt>`). Use to dispatch to the MPP settle path. */
 declare function hasMppxHeader(input: Request | HeadersLike): boolean;
+interface MalformedPaymentCredential {
+    /** Which credential channel carried the malformed value. */
+    channel: 'x402' | 'mpp';
+    message: string;
+}
+/**
+ * Wire-shape gate for payment credentials, cheap enough to run before any
+ * merchant hook. A request whose payment header cannot possibly be a
+ * credential (not base64/base64url JSON, not a JWT-shaped token) is rejected
+ * up front, so junk headers never trigger per-request hooks (`preValidate`,
+ * pricing, recipient minting) or the identity-gate API call.
+ *
+ * This is deliberately a SHAPE check only. Signature verification, payTo
+ * binding, and challenge validation stay where they are (the x402 validator
+ * and the mppx settle path) — those need per-request state the hooks produce.
+ * A well-formed-but-invalid credential still reaches the real validators and
+ * fails there.
+ *
+ * Returns `null` when every present credential channel is plausibly shaped
+ * (or no payment header is present).
+ */
+declare function malformedPaymentCredential(input: Request | HeadersLike): MalformedPaymentCredential | null;
 
 /**
  * USD ↔ atomic-unit conversion for token amounts.
@@ -209,4 +231,4 @@ declare function isEvmNetwork(input: NetworkLike): boolean;
  *  network spec — this helper treats it as false. */
 declare function isSolanaNetwork(input: NetworkLike): boolean;
 
-export { type BuildDefaultCheckoutRailsOptions as B, type HeadersLike as H, type BuildMppxComposeRailsOptions as a, asHeaders as b, buildDefaultCheckoutRails as c, buildMppxComposeRails as d, hasPaymentHeader as e, formatUsdCents as f, hasX402Header as g, hasMppxHeader as h, isEvmNetwork as i, isSolanaNetwork as j, loadSolanaFeePayer as l, readHeader as r, usdToAtomic as u };
+export { type BuildDefaultCheckoutRailsOptions as B, type HeadersLike as H, type MalformedPaymentCredential as M, type BuildMppxComposeRailsOptions as a, asHeaders as b, buildDefaultCheckoutRails as c, buildMppxComposeRails as d, hasPaymentHeader as e, formatUsdCents as f, hasX402Header as g, hasMppxHeader as h, isEvmNetwork as i, isSolanaNetwork as j, loadSolanaFeePayer as l, malformedPaymentCredential as m, readHeader as r, usdToAtomic as u };

package/dist/payment/index.d.mts

@@ -5,7 +5,7 @@ export { B as BuildX402AcceptsForOptions, C as CreateX402ServerOptions, X as X40
 export { a as aliasAmountFields, p as paymentRequiredHeader, w as wwwAuthenticateHeader } from '../wwwauthenticate-Dgm-_af9.mjs';
 import { S as SignerNetwork } from '../signer-3FAit11j.mjs';
 export { P as PaymentSigner, e as extractPaymentSigner, a as extractPaymentSignerFromAuth, b as extractSignerForPrecheck, r as readX402PaymentHeader } from '../signer-3FAit11j.mjs';
-export { B as BuildDefaultCheckoutRailsOptions, a as BuildMppxComposeRailsOptions, H as HeadersLike, b as asHeaders, c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer, r as readHeader, u as usdToAtomic } from '../network_kind-C0EMkdzz.mjs';
+export { B as BuildDefaultCheckoutRailsOptions, a as BuildMppxComposeRailsOptions, H as HeadersLike, M as MalformedPaymentCredential, b as asHeaders, c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer, m as malformedPaymentCredential, r as readHeader, u as usdToAtomic } from '../network_kind-D2xpo2Fj.mjs';
 
 /**
  * Build the base64-encoded `request` blob for an MPP Payment directive (per the
@@ -786,25 +786,39 @@ declare function settlementOverrideHeader(overrides: SettlementOverrides): {
 };
 
 /**
- * Zero-amount carve-out: skip upstream verify+settle for $0 orders.
- *
- * CDP rejects EIP-3009 `transferWithAuthorization` with `value=0` as
- * `invalid_payload`; `mppx`'s tempo intents accept only `hash` and
- * `transaction` payload types (rejecting the `proof` payload that gets
- * emitted for $0 settles). Both upstream verify+settle paths fail when the
- * authorized amount is zero, so merchants that drop the settle to $0 in a
- * redemption-code flow need a way to skip verify+settle entirely while
- * still recovering the signer for wallet-capture attribution.
- *
- * `zeroAmountCarveOut` is that path: parse the credential, lift the
- * signer, return `{ signerAddress, signerNetwork, txHash: null }`. Identity
- * is still authenticated by the merchant's gate above; the redemption code
- * is single-use; nothing on-chain to verify.
- *
- * The MPP path uses inline base64+JSON parsing (no `mppx` dependency at
- * runtime) so the zero-settle path stays dependency-free. The full
- * `extractPaymentSigner` path is still mppx-backed for production traffic
- * where the credential is a real mppx-shaped object.
+ * Zero-amount carve-out: skip upstream verify+settle for $0 orders on the
+ * rails that cannot settle $0 upstream.
+ *
+ * Scope (which rail takes the carve-out is decided in `Checkout.handleZeroSettle`):
+ *
+ * - **x402 Base**: CDP rejects EIP-3009 `transferWithAuthorization` with
+ *   `value=0` as `invalid_payload`, so $0 x402 orders take the carve-out. The
+ *   credential is still run through `verifyX402Request` (signature shape +
+ *   payTo binding) before the carve-out is honored.
+ * - **MPP `proof` credentials**: NOT carved out. mppx >= 0.8 settles
+ *   zero-amount challenges natively via the wallet-bound EIP-712 proof
+ *   credential (full verification, access-key authorization, replay
+ *   protection). An agent that saw a $0 challenge signs a `proof`, so those
+ *   delegate to the normal MPP settle path.
+ * - **Every other MPP credential at $0** (`hash` / `transaction` payloads,
+ *   token-style credentials, Solana): carved out. These arise when the agent
+ *   signed against a NONZERO quote that the merchant re-priced to $0 at
+ *   settle (no-match / full-discount flows — the authorization is simply
+ *   never exercised), or on rails with no upstream $0 contract
+ *   (`@solana/mpp` has no proof-credential surface). Upstream would reject
+ *   all of them at $0, so the carve-out lifts the signer for wallet-capture
+ *   attribution only; that signer block is UNAUTHENTICATED (parse-only) and
+ *   must not be trusted beyond attribution hints. Identity is still
+ *   authenticated by the merchant's gate above; nothing settles on-chain.
+ *
+ * `zeroAmountCarveOut` parses the credential, lifts the signer, and returns
+ * `{ signerAddress, signerNetwork, txHash: null }`. The MPP path uses inline
+ * base64+JSON parsing (no `mppx` dependency at runtime) so this module stays
+ * dependency-free. `mppCredentialPayloadType` is the router `handleZeroSettle`
+ * uses to decide delegation (`proof`) vs carve-out (everything else); signer
+ * recovery itself prefers the full `extractPaymentSigner` (which also decodes
+ * source-less Solana credentials from the signed transaction) with this
+ * module's inline parse as the dependency-free backstop.
  */
 
 type ZeroSettleRail = 'x402-base' | 'tempo' | 'solana';
@@ -838,6 +852,13 @@ declare function zeroAmountCarveOut({ rail, payload, authorizationHeader, }: {
      *  header value. Reads the `did:pkh:*` source DID. */
     authorizationHeader?: string | null;
 }): ZeroSettleResult;
+/**
+ * Read the MPP credential's `payload.type` (`'proof'` / `'hash'` /
+ * `'transaction'`) from an `Authorization: Payment <base64>` header without
+ * any `mppx` dependency. Returns `null` for token-style values (JWTs),
+ * unparseable headers, or credentials without a typed payload.
+ */
+declare function mppCredentialPayloadType(authorizationHeader: string | null | undefined): string | null;
 
 /**
  * Lazy-init helpers for x402 + mppx servers.
@@ -880,4 +901,4 @@ declare function lazyMppxServer(opts: {
     secretKey: string;
 }): () => Promise<unknown>;
 
-export { type ClassifiedX402Error, type MppxComposeResult, type MppxRailSpec, type NetworkFamily, type PaymentHeadersRail, type PaymentHeadersResult, type ProcessX402SettleFailure, type ProcessX402SettleResult, type ProcessX402SettleSuccess, type RailDefinition, type RailName, SETTLEMENT_OVERRIDES_HEADER, type SettlementHandlers, type SettlementOverrides, type SettlementPayloadLike, SignerNetwork, SolanaMppRailSpec, StripeRailSpec, TempoRailSpec, TempoSessionRailSpec, USDC, type VerifyX402RequestResult, X402BaseRailSpec, X402Server, type X402ServerLike, X402_SUPPORTED_BASE_NETWORKS, type ZeroSettleRail, type ZeroSettleResult, buildIdempotencyKey, buildPaymentDirective, buildPaymentHeaders, buildPaymentRequestBlob, classifyOrchestrationError, classifyX402SettleResult, composeMppxRequest, createMppxServer, detectRailFromHeaders, dispatchSettlementByNetwork, lazyMppxServer, lazyX402Server, lookupRail, mppxChallengeHeaders, networkFamily, networks, paymentDirective, processX402Settle, rails, registerX402SchemesV1V2, runWithMppxFailureCapture, settlementOverrideHeader, validateX402NetworkConfig, verifyX402Request, wrapSolanaChargeWithFinalizedBlockhash, zeroAmountCarveOut };
+export { type ClassifiedX402Error, type MppxComposeResult, type MppxRailSpec, type NetworkFamily, type PaymentHeadersRail, type PaymentHeadersResult, type ProcessX402SettleFailure, type ProcessX402SettleResult, type ProcessX402SettleSuccess, type RailDefinition, type RailName, SETTLEMENT_OVERRIDES_HEADER, type SettlementHandlers, type SettlementOverrides, type SettlementPayloadLike, SignerNetwork, SolanaMppRailSpec, StripeRailSpec, TempoRailSpec, TempoSessionRailSpec, USDC, type VerifyX402RequestResult, X402BaseRailSpec, X402Server, type X402ServerLike, X402_SUPPORTED_BASE_NETWORKS, type ZeroSettleRail, type ZeroSettleResult, buildIdempotencyKey, buildPaymentDirective, buildPaymentHeaders, buildPaymentRequestBlob, classifyOrchestrationError, classifyX402SettleResult, composeMppxRequest, createMppxServer, detectRailFromHeaders, dispatchSettlementByNetwork, lazyMppxServer, lazyX402Server, lookupRail, mppCredentialPayloadType, mppxChallengeHeaders, networkFamily, networks, paymentDirective, processX402Settle, rails, registerX402SchemesV1V2, runWithMppxFailureCapture, settlementOverrideHeader, validateX402NetworkConfig, verifyX402Request, wrapSolanaChargeWithFinalizedBlockhash, zeroAmountCarveOut };

package/dist/payment/index.d.ts

@@ -5,7 +5,7 @@ export { B as BuildX402AcceptsForOptions, C as CreateX402ServerOptions, X as X40
 export { a as aliasAmountFields, p as paymentRequiredHeader, w as wwwAuthenticateHeader } from '../wwwauthenticate-Dgm-_af9.js';
 import { S as SignerNetwork } from '../signer-3FAit11j.js';
 export { P as PaymentSigner, e as extractPaymentSigner, a as extractPaymentSignerFromAuth, b as extractSignerForPrecheck, r as readX402PaymentHeader } from '../signer-3FAit11j.js';
-export { B as BuildDefaultCheckoutRailsOptions, a as BuildMppxComposeRailsOptions, H as HeadersLike, b as asHeaders, c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer, r as readHeader, u as usdToAtomic } from '../network_kind-BIJM2peR.js';
+export { B as BuildDefaultCheckoutRailsOptions, a as BuildMppxComposeRailsOptions, H as HeadersLike, M as MalformedPaymentCredential, b as asHeaders, c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer, m as malformedPaymentCredential, r as readHeader, u as usdToAtomic } from '../network_kind-BmbWKNud.js';
 
 /**
  * Build the base64-encoded `request` blob for an MPP Payment directive (per the
@@ -786,25 +786,39 @@ declare function settlementOverrideHeader(overrides: SettlementOverrides): {
 };
 
 /**
- * Zero-amount carve-out: skip upstream verify+settle for $0 orders.
- *
- * CDP rejects EIP-3009 `transferWithAuthorization` with `value=0` as
- * `invalid_payload`; `mppx`'s tempo intents accept only `hash` and
- * `transaction` payload types (rejecting the `proof` payload that gets
- * emitted for $0 settles). Both upstream verify+settle paths fail when the
- * authorized amount is zero, so merchants that drop the settle to $0 in a
- * redemption-code flow need a way to skip verify+settle entirely while
- * still recovering the signer for wallet-capture attribution.
- *
- * `zeroAmountCarveOut` is that path: parse the credential, lift the
- * signer, return `{ signerAddress, signerNetwork, txHash: null }`. Identity
- * is still authenticated by the merchant's gate above; the redemption code
- * is single-use; nothing on-chain to verify.
- *
- * The MPP path uses inline base64+JSON parsing (no `mppx` dependency at
- * runtime) so the zero-settle path stays dependency-free. The full
- * `extractPaymentSigner` path is still mppx-backed for production traffic
- * where the credential is a real mppx-shaped object.
+ * Zero-amount carve-out: skip upstream verify+settle for $0 orders on the
+ * rails that cannot settle $0 upstream.
+ *
+ * Scope (which rail takes the carve-out is decided in `Checkout.handleZeroSettle`):
+ *
+ * - **x402 Base**: CDP rejects EIP-3009 `transferWithAuthorization` with
+ *   `value=0` as `invalid_payload`, so $0 x402 orders take the carve-out. The
+ *   credential is still run through `verifyX402Request` (signature shape +
+ *   payTo binding) before the carve-out is honored.
+ * - **MPP `proof` credentials**: NOT carved out. mppx >= 0.8 settles
+ *   zero-amount challenges natively via the wallet-bound EIP-712 proof
+ *   credential (full verification, access-key authorization, replay
+ *   protection). An agent that saw a $0 challenge signs a `proof`, so those
+ *   delegate to the normal MPP settle path.
+ * - **Every other MPP credential at $0** (`hash` / `transaction` payloads,
+ *   token-style credentials, Solana): carved out. These arise when the agent
+ *   signed against a NONZERO quote that the merchant re-priced to $0 at
+ *   settle (no-match / full-discount flows — the authorization is simply
+ *   never exercised), or on rails with no upstream $0 contract
+ *   (`@solana/mpp` has no proof-credential surface). Upstream would reject
+ *   all of them at $0, so the carve-out lifts the signer for wallet-capture
+ *   attribution only; that signer block is UNAUTHENTICATED (parse-only) and
+ *   must not be trusted beyond attribution hints. Identity is still
+ *   authenticated by the merchant's gate above; nothing settles on-chain.
+ *
+ * `zeroAmountCarveOut` parses the credential, lifts the signer, and returns
+ * `{ signerAddress, signerNetwork, txHash: null }`. The MPP path uses inline
+ * base64+JSON parsing (no `mppx` dependency at runtime) so this module stays
+ * dependency-free. `mppCredentialPayloadType` is the router `handleZeroSettle`
+ * uses to decide delegation (`proof`) vs carve-out (everything else); signer
+ * recovery itself prefers the full `extractPaymentSigner` (which also decodes
+ * source-less Solana credentials from the signed transaction) with this
+ * module's inline parse as the dependency-free backstop.
  */
 
 type ZeroSettleRail = 'x402-base' | 'tempo' | 'solana';
@@ -838,6 +852,13 @@ declare function zeroAmountCarveOut({ rail, payload, authorizationHeader, }: {
      *  header value. Reads the `did:pkh:*` source DID. */
     authorizationHeader?: string | null;
 }): ZeroSettleResult;
+/**
+ * Read the MPP credential's `payload.type` (`'proof'` / `'hash'` /
+ * `'transaction'`) from an `Authorization: Payment <base64>` header without
+ * any `mppx` dependency. Returns `null` for token-style values (JWTs),
+ * unparseable headers, or credentials without a typed payload.
+ */
+declare function mppCredentialPayloadType(authorizationHeader: string | null | undefined): string | null;
 
 /**
  * Lazy-init helpers for x402 + mppx servers.
@@ -880,4 +901,4 @@ declare function lazyMppxServer(opts: {
     secretKey: string;
 }): () => Promise<unknown>;
 
-export { type ClassifiedX402Error, type MppxComposeResult, type MppxRailSpec, type NetworkFamily, type PaymentHeadersRail, type PaymentHeadersResult, type ProcessX402SettleFailure, type ProcessX402SettleResult, type ProcessX402SettleSuccess, type RailDefinition, type RailName, SETTLEMENT_OVERRIDES_HEADER, type SettlementHandlers, type SettlementOverrides, type SettlementPayloadLike, SignerNetwork, SolanaMppRailSpec, StripeRailSpec, TempoRailSpec, TempoSessionRailSpec, USDC, type VerifyX402RequestResult, X402BaseRailSpec, X402Server, type X402ServerLike, X402_SUPPORTED_BASE_NETWORKS, type ZeroSettleRail, type ZeroSettleResult, buildIdempotencyKey, buildPaymentDirective, buildPaymentHeaders, buildPaymentRequestBlob, classifyOrchestrationError, classifyX402SettleResult, composeMppxRequest, createMppxServer, detectRailFromHeaders, dispatchSettlementByNetwork, lazyMppxServer, lazyX402Server, lookupRail, mppxChallengeHeaders, networkFamily, networks, paymentDirective, processX402Settle, rails, registerX402SchemesV1V2, runWithMppxFailureCapture, settlementOverrideHeader, validateX402NetworkConfig, verifyX402Request, wrapSolanaChargeWithFinalizedBlockhash, zeroAmountCarveOut };
+export { type ClassifiedX402Error, type MppxComposeResult, type MppxRailSpec, type NetworkFamily, type PaymentHeadersRail, type PaymentHeadersResult, type ProcessX402SettleFailure, type ProcessX402SettleResult, type ProcessX402SettleSuccess, type RailDefinition, type RailName, SETTLEMENT_OVERRIDES_HEADER, type SettlementHandlers, type SettlementOverrides, type SettlementPayloadLike, SignerNetwork, SolanaMppRailSpec, StripeRailSpec, TempoRailSpec, TempoSessionRailSpec, USDC, type VerifyX402RequestResult, X402BaseRailSpec, X402Server, type X402ServerLike, X402_SUPPORTED_BASE_NETWORKS, type ZeroSettleRail, type ZeroSettleResult, buildIdempotencyKey, buildPaymentDirective, buildPaymentHeaders, buildPaymentRequestBlob, classifyOrchestrationError, classifyX402SettleResult, composeMppxRequest, createMppxServer, detectRailFromHeaders, dispatchSettlementByNetwork, lazyMppxServer, lazyX402Server, lookupRail, mppCredentialPayloadType, mppxChallengeHeaders, networkFamily, networks, paymentDirective, processX402Settle, rails, registerX402SchemesV1V2, runWithMppxFailureCapture, settlementOverrideHeader, validateX402NetworkConfig, verifyX402Request, wrapSolanaChargeWithFinalizedBlockhash, zeroAmountCarveOut };

package/dist/payment/index.js

@@ -53,6 +53,8 @@ __export(payment_exports, {
   lazyX402Server: () => lazyX402Server,
   loadSolanaFeePayer: () => loadSolanaFeePayer,
   lookupRail: () => lookupRail,
+  malformedPaymentCredential: () => malformedPaymentCredential,
+  mppCredentialPayloadType: () => mppCredentialPayloadType,
   mppxChallengeHeaders: () => mppxChallengeHeaders,
   networkFamily: () => networkFamily,
   networks: () => networks,
@@ -1219,6 +1221,22 @@ function x402SignerFromPayload(payload) {
     txHash: null
   };
 }
+function mppCredentialPayloadType(authorizationHeader) {
+  if (typeof authorizationHeader !== "string") return null;
+  if (!authorizationHeader.toLowerCase().startsWith("payment ")) return null;
+  const token = authorizationHeader.slice("payment ".length).trim();
+  if (!token) return null;
+  try {
+    const credential = JSON.parse(atob(token));
+    if (!credential || typeof credential !== "object") return null;
+    const payload = credential.payload;
+    if (!payload || typeof payload !== "object") return null;
+    const type = payload.type;
+    return typeof type === "string" ? type : null;
+  } catch {
+    return null;
+  }
+}
 function mppSignerFromAuth(authorizationHeader) {
   if (typeof authorizationHeader !== "string") return NULL_RESULT;
   if (!authorizationHeader.toLowerCase().startsWith("payment ")) return NULL_RESULT;
@@ -1427,6 +1445,39 @@ function hasMppxHeader(input) {
   const headers = asHeaders(input);
   return Boolean(readHeader(headers, "authorization")?.startsWith("Payment "));
 }
+var JWT_SHAPE_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function decodesToJsonObject(token) {
+  try {
+    const parsed = JSON.parse(Buffer.from(token, "base64").toString("utf8"));
+    return typeof parsed === "object" && parsed !== null;
+  } catch {
+    return false;
+  }
+}
+function malformedPaymentCredential(input) {
+  const headers = asHeaders(input);
+  const x402Token = readHeader(headers, "payment-signature") ?? readHeader(headers, "x-payment");
+  if (x402Token !== null && x402Token.length > 0) {
+    if (!decodesToJsonObject(x402Token)) {
+      return {
+        channel: "x402",
+        message: "X-Payment header is not decodable base64 JSON."
+      };
+    }
+    return null;
+  }
+  const auth = readHeader(headers, "authorization");
+  if (auth !== null && auth.startsWith("Payment ")) {
+    const token = auth.slice("Payment ".length).trim();
+    if (token.length === 0 || !decodesToJsonObject(token) && !JWT_SHAPE_RE.test(token)) {
+      return {
+        channel: "mpp",
+        message: "Authorization: Payment credential is neither base64-encoded JSON nor a token-shaped value."
+      };
+    }
+  }
+  return null;
+}
 
 // src/payment/network_kind.ts
 function readNetwork(input) {
@@ -1478,6 +1529,8 @@ function isSolanaNetwork(input) {
   lazyX402Server,
   loadSolanaFeePayer,
   lookupRail,
+  malformedPaymentCredential,
+  mppCredentialPayloadType,
   mppxChallengeHeaders,
   networkFamily,
   networks,