@agent-score/commerce 1.0.3 → 1.2.0

package/dist/challenge/index.js

@@ -28,6 +28,7 @@ __export(challenge_exports, {
   buildIdentityMetadata: () => buildIdentityMetadata,
   buildPricingBlock: () => buildPricingBlock,
   buildValidationError: () => buildValidationError,
+  compatibleClientsByRails: () => compatibleClientsByRails,
   firstEncounterAgentMemory: () => firstEncounterAgentMemory,
   respond402: () => respond402
 });
@@ -193,14 +194,25 @@ function defaultWarnings(howToPay) {
   if (howToPay.x402_base || howToPay.x402_solana) w.push(X402_WARNING);
   return w;
 }
-function defaultCompatibleClients(howToPay) {
+var RAIL_CLIENTS = {
+  tempo_mpp: ["agentscore-pay", "tempo request", "x402-proxy"],
+  x402_base: ["agentscore-pay", "x402-proxy", "purl (omit --network flag)"],
+  x402_solana: ["agentscore-pay"],
+  stripe: ["link-cli"]
+};
+function compatibleClientsByRails(rails) {
   const out = {};
-  if (howToPay.tempo) out.tempo_mpp = ["agentscore-pay", "tempo request", "x402-proxy"];
-  if (howToPay.x402_base) out.x402_base = ["agentscore-pay", "x402-proxy", "purl (omit --network flag)"];
-  if (howToPay.x402_solana) out.x402_solana = ["agentscore-pay"];
-  if (howToPay.stripe) out.stripe = ["link-cli"];
+  for (const r of rails) out[r] = [...RAIL_CLIENTS[r]];
   return Object.keys(out).length === 0 ? void 0 : out;
 }
+function defaultCompatibleClients(howToPay) {
+  const rails = [];
+  if (howToPay.tempo) rails.push("tempo_mpp");
+  if (howToPay.x402_base) rails.push("x402_base");
+  if (howToPay.x402_solana) rails.push("x402_solana");
+  if (howToPay.stripe) rails.push("stripe");
+  return compatibleClientsByRails(rails);
+}
 function buildAgentInstructions(input) {
   const compatibleClients = input.compatibleClients ?? defaultCompatibleClients(input.howToPay);
   return {
@@ -215,6 +227,64 @@ function buildAgentInstructions(input) {
   };
 }
 
+// src/core.ts
+var import_sdk = require("@agent-score/sdk");
+
+// src/_response.ts
+var WALLET_NOT_TRUSTED_INSTRUCTIONS = JSON.stringify({
+  action: "contact_support",
+  steps: [
+    "The wallet's operator failed an UNFIXABLE compliance check (sanctions, age, or jurisdiction). `reasons` lists which: `sanctions_flagged` / `age_insufficient` / `jurisdiction_restricted`. KYC re-verification won't change the outcome \u2014 the policy denial is structural.",
+    "Surface the denial to the user with the merchant's support contact. Do not retry the same merchant request; do not hand the user a verify_url (verification won't fix this code path).",
+    "Fixable compliance reasons (`kyc_required`, `kyc_pending`, `kyc_failed`) do NOT land on this code \u2014 the gate auto-mints a verification session for those and returns `identity_verification_required` with poll endpoints, same shape as `missing_identity`. `jurisdiction_restricted` IS in the unfixable bucket because the API only emits it after KYC is verified (the user's KYC'd country is in the blocked list \u2014 re-doing KYC won't change the country)."
+  ],
+  user_message: "This purchase is denied by the merchant's compliance policy and cannot be resolved by re-verifying. Contact the merchant's support if you believe this is in error."
+});
+var PAYMENT_REQUIRED_INSTRUCTIONS = JSON.stringify({
+  action: "contact_merchant",
+  steps: [
+    "The merchant's AgentScore account does not have the assess endpoint enabled, so agent identity cannot be evaluated. This is a merchant-side configuration gap \u2014 there is no agent-side recovery.",
+    "Contact the merchant (their support channel \u2014 typically listed in /llms.txt or the OpenAPI servers metadata) so they can resolve the configuration on their side."
+  ],
+  user_message: "This merchant's identity gate is misconfigured. Contact the merchant \u2014 there's nothing to fix on the agent side."
+});
+var IDENTITY_VERIFICATION_REQUIRED_FALLBACK_INSTRUCTIONS = JSON.stringify({
+  action: "deliver_verify_url_and_poll",
+  steps: [
+    "Share verify_url with the user \u2014 they complete identity verification on AgentScore.",
+    "If session_id + poll_secret are present in the body, poll poll_url every 5 seconds with header `X-Poll-Secret: <poll_secret>` until status=verified. The poll returns a one-time operator_token.",
+    "Retry the original request with header `X-Operator-Token: <opc_...>`."
+  ],
+  user_message: "Identity verification is required. Visit verify_url, then poll poll_url for the operator token and retry."
+});
+var API_ERROR_INSTRUCTIONS = JSON.stringify({
+  action: "retry_with_backoff",
+  steps: [
+    "Verification is temporarily unavailable. Retry the request after 5\u201330 seconds with exponential backoff.",
+    "This is NOT a compliance denial \u2014 the user does not need to re-verify their identity. Send the same identity headers (X-Wallet-Address or X-Operator-Token) on retry.",
+    "If the request continues to fail after 3+ retries (~60 seconds total), surface the error to the user with the merchant's support contact."
+  ],
+  user_message: "Verification is temporarily unavailable. Please try again in a moment \u2014 this is a transient issue, not a problem with your account."
+});
+var QUOTA_EXCEEDED_INSTRUCTIONS = JSON.stringify({
+  action: "contact_merchant",
+  steps: [
+    "AgentScore identity verification is unavailable for this merchant. This is a merchant-side issue and is NOT recoverable via retry.",
+    "Do not retry: the same 503 will be returned until the merchant resolves the issue on their side.",
+    "Surface to the user with the merchant's support contact. The merchant (not the agent) needs to act."
+  ],
+  user_message: "This merchant's identity verification is temporarily unavailable. Try again later, or contact the merchant directly."
+});
+var TOKEN_EXPIRED_FALLBACK_INSTRUCTIONS = JSON.stringify({
+  action: "deliver_verify_url_and_poll",
+  steps: [
+    "The operator token is expired or revoked. AgentScore auto-mints a fresh verification session \u2014 complete it to receive a new opc_...",
+    "Share verify_url with the user, then poll poll_url every 5 seconds with header `X-Poll-Secret: <poll_secret>` until status=verified. The poll returns a fresh one-time operator_token.",
+    "Retry the original request with header `X-Operator-Token: <new_opc_...>`."
+  ],
+  user_message: "Operator token is expired or revoked. A new verification session has been minted \u2014 visit verify_url to refresh."
+});
+
 // src/core.ts
 var CANONICAL_AGENTSCORE_API = "https://api.agentscore.sh";
 var WALLET_SIGNER_MISMATCH_INSTRUCTIONS = JSON.stringify({
@@ -348,6 +418,7 @@ function buildValidationError(input) {
   buildIdentityMetadata,
   buildPricingBlock,
   buildValidationError,
+  compatibleClientsByRails,
   firstEncounterAgentMemory,
   respond402
 });