@agent-score/commerce 2.7.0 → 2.7.1

package/dist/index.mjs

@@ -22574,7 +22574,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.1"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -25711,7 +25711,7 @@ var Checkout = class {
       const malformed = malformedPaymentCredential(request.headers);
       const enforced = malformed !== null && (malformed.channel === "x402" ? this.x402ServerAvailable() && this.x402BaseNetwork !== null : this.composeMppx !== void 0);
       if (enforced) {
-        const result = await this.emitFreshChallenge(this.discoveryView(ctx));
+        const result = await this.handle(this.stripPaymentHeaders(request));
         return { ...result, settlePhase: "credential_malformed" };
       }
     }
@@ -26230,12 +26230,10 @@ var Checkout = class {
       settlePhase: "verify_failed"
     };
   }
-  /** Emit a fresh 402 challenge: compute pricing, mint per-order recipients,
-   *  ask the (optional) MPP compose hook for a fresh WWW-Authenticate, and
-   *  build the rich 402 body. This is the discovery leg, factored out so the
-   *  malformed-credential path can reuse it verbatim. Idempotent on already
-   *  computed pricing / resolved recipients, so the normal discovery leg (which
-   *  primes both) pays nothing extra. */
+  /** Emit the discovery-leg 402: pricing (idempotent), mint per-order
+   *  recipients, ask the optional MPP compose hook for a fresh WWW-Authenticate,
+   *  and build the rich 402 body. preValidate + pricing already ran in the main
+   *  flow before this is reached, so it primes nothing twice. */
   async emitFreshChallenge(ctx) {
     if (ctx.pricing === null) ctx.pricing = await this.computePricing(ctx);
     await this.resolveRecipientsForCtx(ctx);
@@ -26249,25 +26247,23 @@ var Checkout = class {
     }
     return await this.emit402(ctx, mppxHeaders);
   }
-  /** Return a copy of `ctx` with every payment-credential header removed, so
-   *  downstream recipient minting and MPP compose take their discovery
-   *  (fresh-mint, fresh-challenge) path instead of trying to bind the inbound
-   *  credential. Used to turn a malformed-credential request into a clean 402
-   *  re-challenge. Pricing / recipients are reset so they mint fresh. */
-  discoveryView(ctx) {
+  /** Return a copy of the request with every payment-credential header removed,
+   *  so re-entering handle() treats it as a discovery (no-credential) request:
+   *  preValidate + pricing + minting + compose all run their fresh path, and the
+   *  gate/assess and settle are skipped. Turns a malformed-credential request
+   *  into a clean 402 re-challenge. The raw request is left intact (its body may
+   *  already be consumed); MPP compose reads it only best-effort under a
+   *  try/catch, while the stripped headers are what the credential-shape check,
+   *  gate dispatch, and recipient minting read. */
+  stripPaymentHeaders(request) {
     const headers = {};
-    for (const [k, v] of Object.entries(ctx.request.headers)) {
+    for (const [k, v] of Object.entries(request.headers)) {
       const lk = k.toLowerCase();
       if (lk === "payment-signature" || lk === "x-payment") continue;
       if (lk === "authorization" && v.startsWith("Payment ")) continue;
       headers[k] = v;
     }
-    return {
-      ...ctx,
-      request: { ...ctx.request, headers },
-      pricing: null,
-      recipients: {}
-    };
+    return { ...request, headers };
   }
   async emit402(ctx, mppxHeaders = {}) {
     if (ctx.pricing === null) {