kiosk-core 0.5.20 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e13d8c20ff22d54f80b08ce121162c575f73cf7159f2a623c9a52dc8afda820a
-  data.tar.gz: 4cd1571a390aad1e782ce844b2d35d7d4bfe2697466ad14b0e1ef3c49cf3cfc7
+  metadata.gz: 2ae058e2f502098d86eaaf73f923777a3a26c15a5a7e639aadf9603fc0127b99
+  data.tar.gz: cd5fa11750a7ee2e47a2392132981f964c7524fbe2b570dea326485785af043b
 SHA512:
-  metadata.gz: 75e6135c30f091b70d05104c8179bcf275b4ec99a8e0e771981c7ab90ae3c6c2de8f180efc9d3d37ba0f16116e302843a6d1a945356cc163f337caabbbfd17b2
-  data.tar.gz: d9e5bbd82971df57550ace1912ef0d499b0066f7a7d325ea6c5e334063c37e132a4731602d5f7096bc101aa164b690acf7558dd83d85816710212f1314aed08f
+  metadata.gz: 4f37b026e62693cbc19c2cdb863d10b1f9a900d7506490bfe7386fb258d645875d59c0506eaeb8970f2f71d81f7aecae88d9058779839120cfb6039e306dfc83
+  data.tar.gz: 40ef0e8d8ae11bd56428d5c49bd7a39ae5042270469c323eedf1ed32cf7319db338108f3c1155a803addea92745cf326038df44fbf6493f0f76beee9ebb23fc9

data/CHANGELOG.md

@@ -12,6 +12,45 @@ already written is edited.
 
 ## [Unreleased]
 
+## [0.6.1] — 2026-10-22
+
+- 2026-10-22: Version 0.6.1, the tree cut that matches skill 0.6.1.
+
+## [0.6.0] — 2026-10-21
+
+- 2026-10-21: Version 0.6.0, the tree cut that matches skill 0.6.0.
+
+## [0.5.27] — 2026-10-21
+
+- 2026-10-21: Version 0.5.27, the tree cut that matches skill 0.5.27.
+
+## [0.5.26] — 2026-10-21
+
+- 2026-10-21: Version 0.5.26, the tree cut that matches skill 0.5.26.
+
+## [0.5.25] — 2026-10-21
+
+- 2026-10-21: Version 0.5.25, the tree cut that matches skill 0.5.25.
+
+## [0.5.24] — 2026-10-21
+
+- 2026-10-21: `PaymentProviders::Base#capture` may answer `network_confirmation_id`, the card network's id of the charge, which the payment receipt names.
+- 2026-10-21: Version 0.5.24, the tree cut that matches skill 0.5.24.
+
+## [0.5.23] — 2026-10-21
+
+- 2026-10-21: `AgentIdentityProviders::Base` states that an identity's claims carry `cnf: { jkt: }`, the key that signs the call's DPoP proof.
+- 2026-10-21: Version 0.5.23, the tree cut that matches skill 0.5.23.
+
+## [0.5.22] — 2026-10-21
+
+- 2026-10-21: `Kiosk::Mandate` holds the two AP2 v0.2 mandates, `CheckoutMandate` and `PaymentMandate`; the payment port captures a checkout mandate.
+- 2026-10-21: Version 0.5.22, the tree cut that matches skill 0.5.22.
+
+## [0.5.21] — 2026-10-21
+
+- 2026-10-21: Version 0.5.21, the tree cut that matches skill 0.5.21.
+
 ## [0.5.20] — 2026-10-20
 
 - 2026-10-20: Version 0.5.20, the tree cut that matches skill 0.5.20.

data/lib/kiosk/agent_identity_providers/base.rb

@@ -6,7 +6,10 @@ module Kiosk
     # (`c.agent_idp`). The engine calls only `verify`: it mints tokens and reads
     # mandate-signing keys through its bundled DefaultAgentIdp. The `agent_id` it
     # returns must be a uuid: every schema column and `kiosk.current_agent_id()`
-    # are typed `uuid`, so map foreign ids.
+    # are typed `uuid`, so map foreign ids. The token comes as
+    # `Authorization: DPoP <token>`, and the identity's `claims` carry
+    # `cnf: { jkt: }`, the thumbprint of the key that must sign the request's
+    # DPoP proof (RFC 9449).
     class Base
       # @return [Kiosk::Identity, nil] nil when the credential is absent or invalid (the caller answers 401)
       def verify(_request)

data/lib/kiosk/mandate.rb

@@ -2,21 +2,21 @@
 
 module Kiosk
   # AP2 (Agent Payments Protocol) mandate value objects.
-  # Each is a JWS the assistant signs; its `iss` must equal the origin's issuer.
+  # Each is a closed AP2 v0.2 mandate: an SD-JWT the assistant signs with its
+  # registered key. `reference` is the base64url SHA-256 of the presented SD-JWT.
   module Mandate
-    IntentMandate = Data.define(
-      :id, :user_id, :agent_id, :issuer, :scope, :cap_amount_cents, :currency,
-      :expires_at, :created_at, :raw_jws
-    )
-
-    CartMandate = Data.define(
-      :id, :intent_mandate_id, :user_id, :agent_id, :issuer, :line_items,
-      :total_amount_cents, :currency, :expires_at, :created_at, :raw_jws
+    # Binds the operator-signed checkout by `checkout_hash`; the line items,
+    # total and currency come from that checkout.
+    CheckoutMandate = Data.define(
+      :reference, :checkout_hash, :user_id, :agent_id, :issuer, :line_items,
+      :total_amount_cents, :currency, :expires_at, :sd_jwt
     )
 
+    # Pays for the checkout whose hash is `transaction_id`. `payment_instrument`
+    # is the instrument id: a PSP payment-method id, or `on_file`.
     PaymentMandate = Data.define(
-      :id, :cart_mandate_id, :user_id, :agent_id, :issuer, :payment_method,
-      :amount_cents, :currency, :expires_at, :created_at, :raw_jws
+      :reference, :transaction_id, :user_id, :agent_id, :issuer, :payment_instrument,
+      :amount_cents, :currency, :expires_at, :sd_jwt
     )
   end
 end

data/lib/kiosk/payment_providers/base.rb

@@ -31,8 +31,11 @@ module Kiosk
                                    'whose setup_required? can answer true'
       end
 
-      # @return [Hash] `psp_reference`, `settled_amount_cents`, `settled_at`
-      def capture(_cart_mandate, payment_method:)
+      # @param checkout_mandate [Kiosk::Mandate::CheckoutMandate] what to charge, and its key
+      # @param payment_method [String, nil] the PSP payment-method id; nil charges the saved card
+      # @return [Hash] `psp_reference`, `settled_amount_cents`, `settled_at`, and
+      #   `network_confirmation_id`: the card network's id of the charge, or nil when the PSP reports none
+      def capture(_checkout_mandate, payment_method:)
         raise NotImplementedError, "#{self.class}#capture must be implemented by the adapter"
       end
 
@@ -44,9 +47,10 @@ module Kiosk
         raise NotImplementedError, "#{self.class}#refund must be implemented by an adapter whose operator refunds"
       end
 
-      # A repeat of a chain whose capture did not complete. The adapter keys its
-      # capture by the cart mandate id, so a second capture cannot charge twice.
-      def resume(cart_mandate, payment_method:) = capture(cart_mandate, payment_method:)
+      # A repeat of a pair of mandates whose capture did not complete. The adapter
+      # keys its capture by the checkout mandate's `reference`, so a second
+      # capture cannot charge twice.
+      def resume(checkout_mandate, payment_method:) = capture(checkout_mandate, payment_method:)
     end
   end
 end

data/lib/kiosk/protocol.rb

@@ -4,11 +4,11 @@ module Kiosk
   # Wire-protocol version and header names.
   module Protocol
     # Before 1.0 every gem and every pinned skill cut carry this exact version (spec §14.1).
-    API_VERSION = '0.5.20'
+    API_VERSION = '0.6.1'
 
     # The oldest skill cut that works with this release: same MAJOR.MINOR as
     # API_VERSION, no newer (spec §3.6). Advisory.
-    MIN_CLIENT = '0.5.20'
+    MIN_CLIENT = '0.6.0'
 
     HEADER_SERVER_VERSION = 'Kiosk-Server-Version'
     HEADER_API_VERSION    = 'Kiosk-API-Version'

data/lib/kiosk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kiosk
-  VERSION = '0.5.20'
+  VERSION = '0.6.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kiosk-core
 version: !ruby/object:Gem::Version
-  version: 0.5.20
+  version: 0.6.1
 platform: ruby
 authors:
 - Phil Pirozhkov