@agent-score/commerce 2.7.0 → 2.7.2

package/dist/index.mjs

@@ -20146,7 +20146,7 @@ var version3;
 var init_version2 = __esm({
   "node_modules/viem/_esm/errors/version.js"() {
     "use strict";
-    version3 = "2.54.6";
+    version3 = "2.55.2";
   }
 });
 
@@ -20702,6 +20702,8 @@ var Assets_exports = {};
 __export(Assets_exports, {
   base: () => base,
   baseSepolia: () => baseSepolia,
+  celo: () => celo,
+  celoSepolia: () => celoSepolia,
   define: () => define,
   fromToken: () => fromToken,
   isAsset: () => isAsset,
@@ -20789,7 +20791,7 @@ function withTokenDefaults(transfer, token) {
     name: token.name
   };
 }
-var knownAsset, base, baseSepolia;
+var knownAsset, base, baseSepolia, celo, celoSepolia;
 var init_Assets = __esm({
   "node_modules/mppx/dist/x402/Assets.js"() {
     "use strict";
@@ -20821,6 +20823,42 @@ var init_Assets = __esm({
         }
       })
     };
+    celo = {
+      USDC: define({
+        address: "0xcebA9300f2b948710d2653dD7B07f33A8B32118C",
+        decimals: 6,
+        network: "eip155:42220",
+        transfer: {
+          // Celo USDC signs with the shorter EIP-712 domain name.
+          name: "USDC",
+          type: "eip3009",
+          version: "2"
+        }
+      }),
+      USDT: define({
+        address: "0x48065fbBE25f71C9282ddf5e1cD6D6A887483D5e",
+        decimals: 6,
+        network: "eip155:42220",
+        transfer: {
+          // Celo USDT signs with domain version "1", unlike Circle's FiatToken "2".
+          name: "Tether USD",
+          type: "eip3009",
+          version: "1"
+        }
+      })
+    };
+    celoSepolia = {
+      USDC: define({
+        address: "0x01C5C0122039549AD1493B8220cABEdD739BC44E",
+        decimals: 6,
+        network: "eip155:11142220",
+        transfer: {
+          name: "USDC",
+          type: "eip3009",
+          version: "2"
+        }
+      })
+    };
   }
 });
 
@@ -20829,6 +20867,8 @@ var Assets_exports2 = {};
 __export(Assets_exports2, {
   base: () => base,
   baseSepolia: () => baseSepolia,
+  celo: () => celo,
+  celoSepolia: () => celoSepolia,
   define: () => define,
   fromToken: () => fromToken,
   isAsset: () => isAsset,
@@ -20850,14 +20890,18 @@ var init_Assets2 = __esm({
 var Chains_exports = {};
 __export(Chains_exports, {
   base: () => base2,
-  baseSepolia: () => baseSepolia2
+  baseSepolia: () => baseSepolia2,
+  celo: () => celo2,
+  celoSepolia: () => celoSepolia2
 });
-var base2, baseSepolia2;
+var base2, baseSepolia2, celo2, celoSepolia2;
 var init_Chains = __esm({
   "node_modules/mppx/dist/evm/Chains.js"() {
     "use strict";
     base2 = 8453;
     baseSepolia2 = 84532;
+    celo2 = 42220;
+    celoSepolia2 = 11142220;
   }
 });
 
@@ -21529,7 +21573,7 @@ var init_Header = __esm({
       if (record2.x402Version !== 2 || !Array.isArray(record2.accepts))
         throw new InvalidJsonHeaderError();
       const resource = ResourceInfoSchema.parse(record2.resource);
-      const extensions = record2.extensions === void 0 ? void 0 : ExtensionsSchema.parse(record2.extensions);
+      const extensions = record2.extensions !== void 0 ? ExtensionsSchema.safeParse(record2.extensions).data : void 0;
       return {
         accepts: record2.accepts,
         ...extensions ? { extensions } : {},
@@ -22574,7 +22618,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.7.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.7.2"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -25711,7 +25755,7 @@ var Checkout = class {
       const malformed = malformedPaymentCredential(request.headers);
       const enforced = malformed !== null && (malformed.channel === "x402" ? this.x402ServerAvailable() && this.x402BaseNetwork !== null : this.composeMppx !== void 0);
       if (enforced) {
-        const result = await this.emitFreshChallenge(this.discoveryView(ctx));
+        const result = await this.handle(this.stripPaymentHeaders(request));
         return { ...result, settlePhase: "credential_malformed" };
       }
     }
@@ -26230,12 +26274,10 @@ var Checkout = class {
       settlePhase: "verify_failed"
     };
   }
-  /** Emit a fresh 402 challenge: compute pricing, mint per-order recipients,
-   *  ask the (optional) MPP compose hook for a fresh WWW-Authenticate, and
-   *  build the rich 402 body. This is the discovery leg, factored out so the
-   *  malformed-credential path can reuse it verbatim. Idempotent on already
-   *  computed pricing / resolved recipients, so the normal discovery leg (which
-   *  primes both) pays nothing extra. */
+  /** Emit the discovery-leg 402: pricing (idempotent), mint per-order
+   *  recipients, ask the optional MPP compose hook for a fresh WWW-Authenticate,
+   *  and build the rich 402 body. preValidate + pricing already ran in the main
+   *  flow before this is reached, so it primes nothing twice. */
   async emitFreshChallenge(ctx) {
     if (ctx.pricing === null) ctx.pricing = await this.computePricing(ctx);
     await this.resolveRecipientsForCtx(ctx);
@@ -26249,25 +26291,23 @@ var Checkout = class {
     }
     return await this.emit402(ctx, mppxHeaders);
   }
-  /** Return a copy of `ctx` with every payment-credential header removed, so
-   *  downstream recipient minting and MPP compose take their discovery
-   *  (fresh-mint, fresh-challenge) path instead of trying to bind the inbound
-   *  credential. Used to turn a malformed-credential request into a clean 402
-   *  re-challenge. Pricing / recipients are reset so they mint fresh. */
-  discoveryView(ctx) {
+  /** Return a copy of the request with every payment-credential header removed,
+   *  so re-entering handle() treats it as a discovery (no-credential) request:
+   *  preValidate + pricing + minting + compose all run their fresh path, and the
+   *  gate/assess and settle are skipped. Turns a malformed-credential request
+   *  into a clean 402 re-challenge. The raw request is left intact (its body may
+   *  already be consumed); MPP compose reads it only best-effort under a
+   *  try/catch, while the stripped headers are what the credential-shape check,
+   *  gate dispatch, and recipient minting read. */
+  stripPaymentHeaders(request) {
     const headers = {};
-    for (const [k, v] of Object.entries(ctx.request.headers)) {
+    for (const [k, v] of Object.entries(request.headers)) {
       const lk = k.toLowerCase();
       if (lk === "payment-signature" || lk === "x-payment") continue;
       if (lk === "authorization" && v.startsWith("Payment ")) continue;
       headers[k] = v;
     }
-    return {
-      ...ctx,
-      request: { ...ctx.request, headers },
-      pricing: null,
-      recipients: {}
-    };
+    return { ...request, headers };
   }
   async emit402(ctx, mppxHeaders = {}) {
     if (ctx.pricing === null) {