@agent-score/commerce 2.7.0 → 2.7.1

package/dist/{checkout-Wc7NUHxZ.d.mts → checkout-DKq9gV3G.d.mts}

@@ -979,19 +979,20 @@ declare class Checkout {
     private asyncIsCachedAddress;
     private handleX402;
     private handleMppx;
-    /** Emit a fresh 402 challenge: compute pricing, mint per-order recipients,
-     *  ask the (optional) MPP compose hook for a fresh WWW-Authenticate, and
-     *  build the rich 402 body. This is the discovery leg, factored out so the
-     *  malformed-credential path can reuse it verbatim. Idempotent on already
-     *  computed pricing / resolved recipients, so the normal discovery leg (which
-     *  primes both) pays nothing extra. */
+    /** Emit the discovery-leg 402: pricing (idempotent), mint per-order
+     *  recipients, ask the optional MPP compose hook for a fresh WWW-Authenticate,
+     *  and build the rich 402 body. preValidate + pricing already ran in the main
+     *  flow before this is reached, so it primes nothing twice. */
     private emitFreshChallenge;
-    /** Return a copy of `ctx` with every payment-credential header removed, so
-     *  downstream recipient minting and MPP compose take their discovery
-     *  (fresh-mint, fresh-challenge) path instead of trying to bind the inbound
-     *  credential. Used to turn a malformed-credential request into a clean 402
-     *  re-challenge. Pricing / recipients are reset so they mint fresh. */
-    private discoveryView;
+    /** Return a copy of the request with every payment-credential header removed,
+     *  so re-entering handle() treats it as a discovery (no-credential) request:
+     *  preValidate + pricing + minting + compose all run their fresh path, and the
+     *  gate/assess and settle are skipped. Turns a malformed-credential request
+     *  into a clean 402 re-challenge. The raw request is left intact (its body may
+     *  already be consumed); MPP compose reads it only best-effort under a
+     *  try/catch, while the stripped headers are what the credential-shape check,
+     *  gate dispatch, and recipient minting read. */
+    private stripPaymentHeaders;
     private emit402;
     private buildSuccess;
 }

package/dist/{checkout-CIH1UcKZ.d.ts → checkout-DW7GgRrl.d.ts}

@@ -979,19 +979,20 @@ declare class Checkout {
     private asyncIsCachedAddress;
     private handleX402;
     private handleMppx;
-    /** Emit a fresh 402 challenge: compute pricing, mint per-order recipients,
-     *  ask the (optional) MPP compose hook for a fresh WWW-Authenticate, and
-     *  build the rich 402 body. This is the discovery leg, factored out so the
-     *  malformed-credential path can reuse it verbatim. Idempotent on already
-     *  computed pricing / resolved recipients, so the normal discovery leg (which
-     *  primes both) pays nothing extra. */
+    /** Emit the discovery-leg 402: pricing (idempotent), mint per-order
+     *  recipients, ask the optional MPP compose hook for a fresh WWW-Authenticate,
+     *  and build the rich 402 body. preValidate + pricing already ran in the main
+     *  flow before this is reached, so it primes nothing twice. */
     private emitFreshChallenge;
-    /** Return a copy of `ctx` with every payment-credential header removed, so
-     *  downstream recipient minting and MPP compose take their discovery
-     *  (fresh-mint, fresh-challenge) path instead of trying to bind the inbound
-     *  credential. Used to turn a malformed-credential request into a clean 402
-     *  re-challenge. Pricing / recipients are reset so they mint fresh. */
-    private discoveryView;
+    /** Return a copy of the request with every payment-credential header removed,
+     *  so re-entering handle() treats it as a discovery (no-credential) request:
+     *  preValidate + pricing + minting + compose all run their fresh path, and the
+     *  gate/assess and settle are skipped. Turns a malformed-credential request
+     *  into a clean 402 re-challenge. The raw request is left intact (its body may
+     *  already be consumed); MPP compose reads it only best-effort under a
+     *  try/catch, while the stripped headers are what the credential-shape check,
+     *  gate dispatch, and recipient minting read. */
+    private stripPaymentHeaders;
     private emit402;
     private buildSuccess;
 }

package/dist/core.js

@@ -227,7 +227,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/core.mjs

@@ -209,7 +209,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/discovery/index.d.mts

@@ -1,6 +1,6 @@
 import { R as RailKey, C as CompatibleClients } from '../pricing-sfv3CPiY.mjs';
 export { g as compatibleClientsByRails } from '../pricing-sfv3CPiY.mjs';
-import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-Wc7NUHxZ.mjs';
+import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-DKq9gV3G.mjs';
 import '../rail_spec-DGdb4Gnd.mjs';
 import '../core.mjs';
 import '@agent-score/sdk';

package/dist/discovery/index.d.ts

@@ -1,6 +1,6 @@
 import { R as RailKey, C as CompatibleClients } from '../pricing-Dx3F1VAv.js';
 export { g as compatibleClientsByRails } from '../pricing-Dx3F1VAv.js';
-import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-CIH1UcKZ.js';
+import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-DW7GgRrl.js';
 import '../rail_spec-DGdb4Gnd.js';
 import '../core.js';
 import '@agent-score/sdk';

package/dist/identity/express.js

@@ -920,7 +920,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/express.mjs

@@ -892,7 +892,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/fastify.js

@@ -921,7 +921,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/fastify.mjs

@@ -892,7 +892,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/hono.js

@@ -901,7 +901,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/hono.mjs

@@ -873,7 +873,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/nextjs.js

@@ -922,7 +922,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/nextjs.mjs

@@ -897,7 +897,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/web.js

@@ -898,7 +898,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/web.mjs

@@ -873,7 +873,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/index.d.mts

@@ -1,8 +1,8 @@
 import { VerifyWalletSignerResult, DenialReason } from './core.mjs';
 export { AccountVerification, AgentIdentity, AgentMemoryHint, AgentScoreCore, AssessResult, CreateSessionOnMissing, DenialCode, EvaluateOutcome, OperatorVerification, PolicyCheck, PolicyResult, SignerVerdict, buildAgentMemoryHint } from './core.mjs';
 export { P as PaymentSigner, S as SignerNetwork, e as extractPaymentSigner, a as extractPaymentSignerFromAuth, b as extractSignerForPrecheck, r as readX402PaymentHeader } from './signer-3FAit11j.mjs';
-import { q as UCPSigningKey, n as UCPProfile } from './checkout-Wc7NUHxZ.mjs';
-export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-Wc7NUHxZ.mjs';
+import { q as UCPSigningKey, n as UCPProfile } from './checkout-DKq9gV3G.mjs';
+export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-DKq9gV3G.mjs';
 export { EnforcementMode, GateResult, IdentityStatus, PolicyBlock, buildGateFromPolicy, runGateWithEnforcement, shippingCountryAllowed, shippingStateAllowed, validateShippingAgainstPolicy } from './identity/policy.mjs';
 import { H as HeadersLike } from './network_kind-CLdLbqU5.mjs';
 export { M as MalformedPaymentCredential, c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer, m as malformedPaymentCredential } from './network_kind-CLdLbqU5.mjs';

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { VerifyWalletSignerResult, DenialReason } from './core.js';
 export { AccountVerification, AgentIdentity, AgentMemoryHint, AgentScoreCore, AssessResult, CreateSessionOnMissing, DenialCode, EvaluateOutcome, OperatorVerification, PolicyCheck, PolicyResult, SignerVerdict, buildAgentMemoryHint } from './core.js';
 export { P as PaymentSigner, S as SignerNetwork, e as extractPaymentSigner, a as extractPaymentSignerFromAuth, b as extractSignerForPrecheck, r as readX402PaymentHeader } from './signer-3FAit11j.js';
-import { q as UCPSigningKey, n as UCPProfile } from './checkout-CIH1UcKZ.js';
-export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-CIH1UcKZ.js';
+import { q as UCPSigningKey, n as UCPProfile } from './checkout-DW7GgRrl.js';
+export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-DW7GgRrl.js';
 export { EnforcementMode, GateResult, IdentityStatus, PolicyBlock, buildGateFromPolicy, runGateWithEnforcement, shippingCountryAllowed, shippingStateAllowed, validateShippingAgainstPolicy } from './identity/policy.js';
 import { H as HeadersLike } from './network_kind-toxNABqw.js';
 export { M as MalformedPaymentCredential, c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer, m as malformedPaymentCredential } from './network_kind-toxNABqw.js';

package/dist/index.js

@@ -22666,7 +22666,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -25803,7 +25803,7 @@ var Checkout = class {
       const malformed = malformedPaymentCredential(request.headers);
       const enforced = malformed !== null && (malformed.channel === "x402" ? this.x402ServerAvailable() && this.x402BaseNetwork !== null : this.composeMppx !== void 0);
       if (enforced) {
-        const result = await this.emitFreshChallenge(this.discoveryView(ctx));
+        const result = await this.handle(this.stripPaymentHeaders(request));
         return { ...result, settlePhase: "credential_malformed" };
       }
     }
@@ -26322,12 +26322,10 @@ var Checkout = class {
       settlePhase: "verify_failed"
     };
   }
-  /** Emit a fresh 402 challenge: compute pricing, mint per-order recipients,
-   *  ask the (optional) MPP compose hook for a fresh WWW-Authenticate, and
-   *  build the rich 402 body. This is the discovery leg, factored out so the
-   *  malformed-credential path can reuse it verbatim. Idempotent on already
-   *  computed pricing / resolved recipients, so the normal discovery leg (which
-   *  primes both) pays nothing extra. */
+  /** Emit the discovery-leg 402: pricing (idempotent), mint per-order
+   *  recipients, ask the optional MPP compose hook for a fresh WWW-Authenticate,
+   *  and build the rich 402 body. preValidate + pricing already ran in the main
+   *  flow before this is reached, so it primes nothing twice. */
   async emitFreshChallenge(ctx) {
     if (ctx.pricing === null) ctx.pricing = await this.computePricing(ctx);
     await this.resolveRecipientsForCtx(ctx);
@@ -26341,25 +26339,23 @@ var Checkout = class {
     }
     return await this.emit402(ctx, mppxHeaders);
   }
-  /** Return a copy of `ctx` with every payment-credential header removed, so
-   *  downstream recipient minting and MPP compose take their discovery
-   *  (fresh-mint, fresh-challenge) path instead of trying to bind the inbound
-   *  credential. Used to turn a malformed-credential request into a clean 402
-   *  re-challenge. Pricing / recipients are reset so they mint fresh. */
-  discoveryView(ctx) {
+  /** Return a copy of the request with every payment-credential header removed,
+   *  so re-entering handle() treats it as a discovery (no-credential) request:
+   *  preValidate + pricing + minting + compose all run their fresh path, and the
+   *  gate/assess and settle are skipped. Turns a malformed-credential request
+   *  into a clean 402 re-challenge. The raw request is left intact (its body may
+   *  already be consumed); MPP compose reads it only best-effort under a
+   *  try/catch, while the stripped headers are what the credential-shape check,
+   *  gate dispatch, and recipient minting read. */
+  stripPaymentHeaders(request) {
     const headers = {};
-    for (const [k, v] of Object.entries(ctx.request.headers)) {
+    for (const [k, v] of Object.entries(request.headers)) {
       const lk = k.toLowerCase();
       if (lk === "payment-signature" || lk === "x-payment") continue;
       if (lk === "authorization" && v.startsWith("Payment ")) continue;
       headers[k] = v;
     }
-    return {
-      ...ctx,
-      request: { ...ctx.request, headers },
-      pricing: null,
-      recipients: {}
-    };
+    return { ...request, headers };
   }
   async emit402(ctx, mppxHeaders = {}) {
     if (ctx.pricing === null) {