@agent-score/commerce 2.7.0 → 2.7.2

package/dist/{checkout-Wc7NUHxZ.d.mts → checkout-DKq9gV3G.d.mts}

@@ -979,19 +979,20 @@ declare class Checkout {
     private asyncIsCachedAddress;
     private handleX402;
     private handleMppx;
-    /** Emit a fresh 402 challenge: compute pricing, mint per-order recipients,
-     *  ask the (optional) MPP compose hook for a fresh WWW-Authenticate, and
-     *  build the rich 402 body. This is the discovery leg, factored out so the
-     *  malformed-credential path can reuse it verbatim. Idempotent on already
-     *  computed pricing / resolved recipients, so the normal discovery leg (which
-     *  primes both) pays nothing extra. */
+    /** Emit the discovery-leg 402: pricing (idempotent), mint per-order
+     *  recipients, ask the optional MPP compose hook for a fresh WWW-Authenticate,
+     *  and build the rich 402 body. preValidate + pricing already ran in the main
+     *  flow before this is reached, so it primes nothing twice. */
     private emitFreshChallenge;
-    /** Return a copy of `ctx` with every payment-credential header removed, so
-     *  downstream recipient minting and MPP compose take their discovery
-     *  (fresh-mint, fresh-challenge) path instead of trying to bind the inbound
-     *  credential. Used to turn a malformed-credential request into a clean 402
-     *  re-challenge. Pricing / recipients are reset so they mint fresh. */
-    private discoveryView;
+    /** Return a copy of the request with every payment-credential header removed,
+     *  so re-entering handle() treats it as a discovery (no-credential) request:
+     *  preValidate + pricing + minting + compose all run their fresh path, and the
+     *  gate/assess and settle are skipped. Turns a malformed-credential request
+     *  into a clean 402 re-challenge. The raw request is left intact (its body may
+     *  already be consumed); MPP compose reads it only best-effort under a
+     *  try/catch, while the stripped headers are what the credential-shape check,
+     *  gate dispatch, and recipient minting read. */
+    private stripPaymentHeaders;
     private emit402;
     private buildSuccess;
 }

package/dist/{checkout-CIH1UcKZ.d.ts → checkout-DW7GgRrl.d.ts}

@@ -979,19 +979,20 @@ declare class Checkout {
     private asyncIsCachedAddress;
     private handleX402;
     private handleMppx;
-    /** Emit a fresh 402 challenge: compute pricing, mint per-order recipients,
-     *  ask the (optional) MPP compose hook for a fresh WWW-Authenticate, and
-     *  build the rich 402 body. This is the discovery leg, factored out so the
-     *  malformed-credential path can reuse it verbatim. Idempotent on already
-     *  computed pricing / resolved recipients, so the normal discovery leg (which
-     *  primes both) pays nothing extra. */
+    /** Emit the discovery-leg 402: pricing (idempotent), mint per-order
+     *  recipients, ask the optional MPP compose hook for a fresh WWW-Authenticate,
+     *  and build the rich 402 body. preValidate + pricing already ran in the main
+     *  flow before this is reached, so it primes nothing twice. */
     private emitFreshChallenge;
-    /** Return a copy of `ctx` with every payment-credential header removed, so
-     *  downstream recipient minting and MPP compose take their discovery
-     *  (fresh-mint, fresh-challenge) path instead of trying to bind the inbound
-     *  credential. Used to turn a malformed-credential request into a clean 402
-     *  re-challenge. Pricing / recipients are reset so they mint fresh. */
-    private discoveryView;
+    /** Return a copy of the request with every payment-credential header removed,
+     *  so re-entering handle() treats it as a discovery (no-credential) request:
+     *  preValidate + pricing + minting + compose all run their fresh path, and the
+     *  gate/assess and settle are skipped. Turns a malformed-credential request
+     *  into a clean 402 re-challenge. The raw request is left intact (its body may
+     *  already be consumed); MPP compose reads it only best-effort under a
+     *  try/catch, while the stripped headers are what the credential-shape check,
+     *  gate dispatch, and recipient minting read. */
+    private stripPaymentHeaders;
     private emit402;
     private buildSuccess;
 }

package/dist/core.js

@@ -227,7 +227,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/core.mjs

@@ -209,7 +209,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/discovery/index.d.mts

@@ -1,6 +1,6 @@
 import { R as RailKey, C as CompatibleClients } from '../pricing-sfv3CPiY.mjs';
 export { g as compatibleClientsByRails } from '../pricing-sfv3CPiY.mjs';
-import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-Wc7NUHxZ.mjs';
+import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-DKq9gV3G.mjs';
 import '../rail_spec-DGdb4Gnd.mjs';
 import '../core.mjs';
 import '@agent-score/sdk';

package/dist/discovery/index.d.ts

@@ -1,6 +1,6 @@
 import { R as RailKey, C as CompatibleClients } from '../pricing-Dx3F1VAv.js';
 export { g as compatibleClientsByRails } from '../pricing-Dx3F1VAv.js';
-import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-CIH1UcKZ.js';
+import { C as Checkout, p as UCPServiceBinding, a as AgentScoreGatePolicy } from '../checkout-DW7GgRrl.js';
 import '../rail_spec-DGdb4Gnd.js';
 import '../core.js';
 import '@agent-score/sdk';

package/dist/identity/express.js

@@ -920,7 +920,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/express.mjs

@@ -892,7 +892,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/fastify.js

@@ -921,7 +921,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/fastify.mjs

@@ -892,7 +892,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/hono.js

@@ -901,7 +901,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/hono.mjs

@@ -873,7 +873,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/nextjs.js

@@ -922,7 +922,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/nextjs.mjs

@@ -897,7 +897,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/web.js

@@ -898,7 +898,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/identity/web.mjs

@@ -873,7 +873,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();

package/dist/index.d.mts

@@ -1,8 +1,8 @@
 import { VerifyWalletSignerResult, DenialReason } from './core.mjs';
 export { AccountVerification, AgentIdentity, AgentMemoryHint, AgentScoreCore, AssessResult, CreateSessionOnMissing, DenialCode, EvaluateOutcome, OperatorVerification, PolicyCheck, PolicyResult, SignerVerdict, buildAgentMemoryHint } from './core.mjs';
 export { P as PaymentSigner, S as SignerNetwork, e as extractPaymentSigner, a as extractPaymentSignerFromAuth, b as extractSignerForPrecheck, r as readX402PaymentHeader } from './signer-3FAit11j.mjs';
-import { q as UCPSigningKey, n as UCPProfile } from './checkout-Wc7NUHxZ.mjs';
-export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-Wc7NUHxZ.mjs';
+import { q as UCPSigningKey, n as UCPProfile } from './checkout-DKq9gV3G.mjs';
+export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-DKq9gV3G.mjs';
 export { EnforcementMode, GateResult, IdentityStatus, PolicyBlock, buildGateFromPolicy, runGateWithEnforcement, shippingCountryAllowed, shippingStateAllowed, validateShippingAgainstPolicy } from './identity/policy.mjs';
 import { H as HeadersLike } from './network_kind-CLdLbqU5.mjs';
 export { M as MalformedPaymentCredential, c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer, m as malformedPaymentCredential } from './network_kind-CLdLbqU5.mjs';

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { VerifyWalletSignerResult, DenialReason } from './core.js';
 export { AccountVerification, AgentIdentity, AgentMemoryHint, AgentScoreCore, AssessResult, CreateSessionOnMissing, DenialCode, EvaluateOutcome, OperatorVerification, PolicyCheck, PolicyResult, SignerVerdict, buildAgentMemoryHint } from './core.js';
 export { P as PaymentSigner, S as SignerNetwork, e as extractPaymentSigner, a as extractPaymentSignerFromAuth, b as extractSignerForPrecheck, r as readX402PaymentHeader } from './signer-3FAit11j.js';
-import { q as UCPSigningKey, n as UCPProfile } from './checkout-CIH1UcKZ.js';
-export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-CIH1UcKZ.js';
+import { q as UCPSigningKey, n as UCPProfile } from './checkout-DW7GgRrl.js';
+export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-DW7GgRrl.js';
 export { EnforcementMode, GateResult, IdentityStatus, PolicyBlock, buildGateFromPolicy, runGateWithEnforcement, shippingCountryAllowed, shippingStateAllowed, validateShippingAgainstPolicy } from './identity/policy.js';
 import { H as HeadersLike } from './network_kind-toxNABqw.js';
 export { M as MalformedPaymentCredential, c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer, m as malformedPaymentCredential } from './network_kind-toxNABqw.js';

package/dist/index.js

@@ -20148,7 +20148,7 @@ var version3;
 var init_version2 = __esm({
   "node_modules/viem/_esm/errors/version.js"() {
     "use strict";
-    version3 = "2.54.6";
+    version3 = "2.55.2";
   }
 });
 
@@ -20704,6 +20704,8 @@ var Assets_exports = {};
 __export(Assets_exports, {
   base: () => base,
   baseSepolia: () => baseSepolia,
+  celo: () => celo,
+  celoSepolia: () => celoSepolia,
   define: () => define,
   fromToken: () => fromToken,
   isAsset: () => isAsset,
@@ -20791,7 +20793,7 @@ function withTokenDefaults(transfer, token) {
     name: token.name
   };
 }
-var knownAsset, base, baseSepolia;
+var knownAsset, base, baseSepolia, celo, celoSepolia;
 var init_Assets = __esm({
   "node_modules/mppx/dist/x402/Assets.js"() {
     "use strict";
@@ -20823,6 +20825,42 @@ var init_Assets = __esm({
         }
       })
     };
+    celo = {
+      USDC: define({
+        address: "0xcebA9300f2b948710d2653dD7B07f33A8B32118C",
+        decimals: 6,
+        network: "eip155:42220",
+        transfer: {
+          // Celo USDC signs with the shorter EIP-712 domain name.
+          name: "USDC",
+          type: "eip3009",
+          version: "2"
+        }
+      }),
+      USDT: define({
+        address: "0x48065fbBE25f71C9282ddf5e1cD6D6A887483D5e",
+        decimals: 6,
+        network: "eip155:42220",
+        transfer: {
+          // Celo USDT signs with domain version "1", unlike Circle's FiatToken "2".
+          name: "Tether USD",
+          type: "eip3009",
+          version: "1"
+        }
+      })
+    };
+    celoSepolia = {
+      USDC: define({
+        address: "0x01C5C0122039549AD1493B8220cABEdD739BC44E",
+        decimals: 6,
+        network: "eip155:11142220",
+        transfer: {
+          name: "USDC",
+          type: "eip3009",
+          version: "2"
+        }
+      })
+    };
   }
 });
 
@@ -20831,6 +20869,8 @@ var Assets_exports2 = {};
 __export(Assets_exports2, {
   base: () => base,
   baseSepolia: () => baseSepolia,
+  celo: () => celo,
+  celoSepolia: () => celoSepolia,
   define: () => define,
   fromToken: () => fromToken,
   isAsset: () => isAsset,
@@ -20852,14 +20892,18 @@ var init_Assets2 = __esm({
 var Chains_exports = {};
 __export(Chains_exports, {
   base: () => base2,
-  baseSepolia: () => baseSepolia2
+  baseSepolia: () => baseSepolia2,
+  celo: () => celo2,
+  celoSepolia: () => celoSepolia2
 });
-var base2, baseSepolia2;
+var base2, baseSepolia2, celo2, celoSepolia2;
 var init_Chains = __esm({
   "node_modules/mppx/dist/evm/Chains.js"() {
     "use strict";
     base2 = 8453;
     baseSepolia2 = 84532;
+    celo2 = 42220;
+    celoSepolia2 = 11142220;
   }
 });
 
@@ -21531,7 +21575,7 @@ var init_Header = __esm({
       if (record2.x402Version !== 2 || !Array.isArray(record2.accepts))
         throw new InvalidJsonHeaderError();
       const resource = ResourceInfoSchema.parse(record2.resource);
-      const extensions = record2.extensions === void 0 ? void 0 : ExtensionsSchema.parse(record2.extensions);
+      const extensions = record2.extensions !== void 0 ? ExtensionsSchema.safeParse(record2.extensions).data : void 0;
       return {
         accepts: record2.accepts,
         ...extensions ? { extensions } : {},
@@ -22666,7 +22710,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -25803,7 +25847,7 @@ var Checkout = class {
       const malformed = malformedPaymentCredential(request.headers);
       const enforced = malformed !== null && (malformed.channel === "x402" ? this.x402ServerAvailable() && this.x402BaseNetwork !== null : this.composeMppx !== void 0);
       if (enforced) {
-        const result = await this.emitFreshChallenge(this.discoveryView(ctx));
+        const result = await this.handle(this.stripPaymentHeaders(request));
         return { ...result, settlePhase: "credential_malformed" };
       }
     }
@@ -26322,12 +26366,10 @@ var Checkout = class {
       settlePhase: "verify_failed"
     };
   }
-  /** Emit a fresh 402 challenge: compute pricing, mint per-order recipients,
-   *  ask the (optional) MPP compose hook for a fresh WWW-Authenticate, and
-   *  build the rich 402 body. This is the discovery leg, factored out so the
-   *  malformed-credential path can reuse it verbatim. Idempotent on already
-   *  computed pricing / resolved recipients, so the normal discovery leg (which
-   *  primes both) pays nothing extra. */
+  /** Emit the discovery-leg 402: pricing (idempotent), mint per-order
+   *  recipients, ask the optional MPP compose hook for a fresh WWW-Authenticate,
+   *  and build the rich 402 body. preValidate + pricing already ran in the main
+   *  flow before this is reached, so it primes nothing twice. */
   async emitFreshChallenge(ctx) {
     if (ctx.pricing === null) ctx.pricing = await this.computePricing(ctx);
     await this.resolveRecipientsForCtx(ctx);
@@ -26341,25 +26383,23 @@ var Checkout = class {
     }
     return await this.emit402(ctx, mppxHeaders);
   }
-  /** Return a copy of `ctx` with every payment-credential header removed, so
-   *  downstream recipient minting and MPP compose take their discovery
-   *  (fresh-mint, fresh-challenge) path instead of trying to bind the inbound
-   *  credential. Used to turn a malformed-credential request into a clean 402
-   *  re-challenge. Pricing / recipients are reset so they mint fresh. */
-  discoveryView(ctx) {
+  /** Return a copy of the request with every payment-credential header removed,
+   *  so re-entering handle() treats it as a discovery (no-credential) request:
+   *  preValidate + pricing + minting + compose all run their fresh path, and the
+   *  gate/assess and settle are skipped. Turns a malformed-credential request
+   *  into a clean 402 re-challenge. The raw request is left intact (its body may
+   *  already be consumed); MPP compose reads it only best-effort under a
+   *  try/catch, while the stripped headers are what the credential-shape check,
+   *  gate dispatch, and recipient minting read. */
+  stripPaymentHeaders(request) {
     const headers = {};
-    for (const [k, v] of Object.entries(ctx.request.headers)) {
+    for (const [k, v] of Object.entries(request.headers)) {
       const lk = k.toLowerCase();
       if (lk === "payment-signature" || lk === "x-payment") continue;
       if (lk === "authorization" && v.startsWith("Payment ")) continue;
       headers[k] = v;
     }
-    return {
-      ...ctx,
-      request: { ...ctx.request, headers },
-      pricing: null,
-      recipients: {}
-    };
+    return { ...request, headers };
   }
   async emit402(ctx, mppxHeaders = {}) {
     if (ctx.pricing === null) {