fix(headers): accept method identifiers with digits, colons, underscores, hyphens

[ygd58]

What

parse_www_authenticate rejected any method identifier containing a character other than an ASCII lowercase letter (method_raw.chars().all(|c| c.is_ascii_lowercase())), so canonical identifiers like x402 or tempo-v2 were rejected outright — before challenge selection or payment could even occur. Canonical mppx (Challenge.ts's deserialize validator) accepts the method-name ABNF ^[a-z][a-z0-9:_-]*$: a lowercase letter, followed by any number of lowercase letters, digits, colons, underscores, or hyphens.

Flagged by the cross-SDK audit as AGR-2026-092 — high severity.

Fix

Add is_valid_method_name implementing that exact grammar and use it in place of the letters-only check. The digit-prefix and non-letter-first rejections (an identifier can't start with anything but a lowercase letter) are unchanged — only the previously-blanket "every character must be a-z" requirement is relaxed to the full canonical charset for characters after the first.

A pre-existing test asserted the bug

test_parse_www_authenticate_rejects_invalid_method_name_dash explicitly asserted that "tempo-v2" should be rejected. Per the ABNF above, hyphens are valid after the first character, so this assertion was backwards. Replaced it with test_parse_www_authenticate_accepts_hyphen_in_method_name (same input, corrected expectation) and added test_parse_www_authenticate_accepts_extension_characters_in_method_name covering colons, underscores, digits, and x402 specifically (the identifier named in the issue this fixes). The other three existing method-name tests (digit-prefix, non-letter/invalid-char, mixed-case) were already asserting correct behavior per the ABNF and are unchanged.

Testing

I could not run the test suite in my sandbox: cargo test always builds dev-dependencies (alloy-json-rpc, axum, tower, ...) regardless of --no-default-features, and one of their transitive dependencies (rand_pcg 0.10.2, confirmed even after deleting Cargo.lock and letting it re-resolve) requires Cargo >= 1.85 (edition2024), which I don't have available. I reviewed the change carefully by hand and traced every call site of is_valid_method_name (there's exactly one). Please run cargo test -p mpp headers::tests before merging, happy to fix anything that doesn't match.

Fixes tempoxyz/mpp-tools#218

[brendanjryan]

Superseded by #428, which retains this method-grammar fix, adds serde parity and broader tests, and is covered by tempoxyz/mpp-tools#240. Thank you for identifying this.

[ygd58]

Thanks for the broader fix — closing this in favor of #428.