@agent-score/commerce 2.3.0 → 2.5.0

package/dist/{checkout-ChyOi7aU.d.ts → checkout-McfNpZJf.d.ts}

@@ -1,5 +1,5 @@
-import { T as TempoRailSpec, S as SolanaMppRailSpec, c as TempoSessionRailSpec, b as StripeRailSpec, X as X402BaseRailSpec } from './rail_spec-B1239jPp.js';
-import { P as PricingBlock, R as RailKey } from './pricing-B3-aKxSz.js';
+import { T as TempoRailSpec, S as SolanaMppRailSpec, c as TempoSessionRailSpec, b as StripeRailSpec, X as X402BaseRailSpec } from './rail_spec-BFZmW9RN.js';
+import { P as PricingBlock, R as RailKey } from './pricing-CytRwhC2.js';
 import { CreateSessionOnMissing, AgentScoreCoreOptions, DenialReason } from './core.js';
 import { a as X402Server } from './x402_server-Ciz2mls2.js';
 
@@ -26,9 +26,8 @@ import { a as X402Server } from './x402_server-Ciz2mls2.js';
 /**
  * Construct a UCPSigningKey from a public JWK dict (e.g. the `publicJWK` returned by
  * `generateUCPSigningKey()`). Validates required fields and rejects symmetric keys that
- * can't publicly verify a JWS in trust-mode UCP. Mirrors python's
- * `UCPSigningKey.from_jwk(public_jwk)` classmethod via the `UCPSigningKey.fromJWK`
- * static-method-style namespace export below.
+ * can't publicly verify a JWS in trust-mode UCP. Exposed as `UCPSigningKey.fromJWK`
+ * via the static-method-style namespace export below.
  */
 declare function ucpSigningKeyFromJWKImpl(jwk: Record<string, unknown>): UCPSigningKey;
 interface UCPSigningKey {
@@ -45,8 +44,8 @@ interface UCPSigningKey {
     /** JWK x / y / n / e / etc. The full key material; passed through verbatim. */
     [k: string]: unknown;
 }
-/** Static-method-style namespace on the `UCPSigningKey` interface — mirrors python's
- *  `UCPSigningKey.from_jwk(jwk)` classmethod. Use as `UCPSigningKey.fromJWK(jwk)`. */
+/** Static-method-style namespace on the `UCPSigningKey` interface.
+ *  Use as `UCPSigningKey.fromJWK(jwk)`. */
 declare const UCPSigningKey: {
     fromJWK: typeof ucpSigningKeyFromJWKImpl;
 };
@@ -175,7 +174,7 @@ interface BuildUCPProfileInput {
      *  attestation lives on the AP2 risk-signal endpoint, not here. */
     agentscore_gate?: AgentScoreGatePolicy;
     /** Optional override for the AgentScore capability schema URL. Field is snake_cased
-     *  for cross-language parity with the Python sibling. */
+     *  to match the on-the-wire UCP profile shape. */
     agentscore_schema_url?: string;
     /** Optional override for the AgentScore capability spec URL. */
     agentscore_spec_url?: string;
@@ -435,9 +434,7 @@ declare function pricingResult(opts: {
  * Per-route discovery-probe config. When passed to {@link Checkout}, any
  * empty-body POST without a payment credential short-circuits with a sample
  * 402 advertising the merchant's payment shape — the canonical pattern x402
- * crawlers (`awal x402 details`, `x402-proxy`, `x402scan`) rely on.
- *
- * Mirrors python's `DiscoveryProbeConfig` dataclass.
+ * crawlers rely on.
  */
 interface DiscoveryProbeConfig {
     realm: string;
@@ -572,9 +569,64 @@ interface CheckoutGateConfig {
      *  DenialReason. Return a `GateDenial` to override the canonical body, or
      *  null to use `denialReasonToBody`. */
     onDenied?: (ctx: CheckoutContext, reason: DenialReason) => GateDenial | null | Promise<GateDenial | null>;
+    /** Accept AIP Agent Identity Tokens (AITs) on this route. When set and a request carries
+     *  an `Agent-Identity` header, the gate verifies the token offline (issuer signature via the
+     *  trusted-issuer JWKS + RFC 9421 proof-of-possession) BEFORE the assess call, then sends the
+     *  raw token to `/v1/assess` as `aip_token` so the same wine/age/sanctions policy evaluates
+     *  against the token's attested identity. A present-but-invalid AIT is a hard deny (the gate
+     *  does NOT fall through to wallet / operator-token). Requests with no `Agent-Identity` header
+     *  use the existing wallet / operator-token path unchanged.
+     *
+     *  Ignored when `runGate` is also set (a custom gate fully owns the flow). Without an `apiKey`,
+     *  a verified AIT is honored offline for identity-only gates, but a gate that declares policy
+     *  fields (KYC / age / sanctions / jurisdiction) without an `apiKey` fails closed
+     *  (`aip_policy_requires_api_key`) since policy can only be evaluated via `/v1/assess`. */
+    aip?: AipGateConfig;
     /** Full escape hatch — replaces the SDK gate flow. */
     runGate?: RunGateFn;
 }
+/** AIP acceptance config for {@link CheckoutGateConfig.aip}. */
+interface AipGateConfig {
+    /** ADDITIONAL external issuers to trust beyond AgentScore's own (e.g. `['https://issuer.example']`),
+     *  matched after canonicalization. AgentScore's canonical issuer
+     *  ({@link AGENTSCORE_CANONICAL_ISSUER}) is ALWAYS trusted and never needs listing — this SDK
+     *  is the AgentScore verifier, so a merchant can't accidentally fail to trust AgentScore AITs.
+     *  Omit/empty to accept only AgentScore-issued AITs. */
+    trustedIssuers?: string[];
+    /** Clock-skew tolerance in seconds for the RFC 9421 signature window (and, as an override,
+     *  the AIT JWT `exp`/`iat`). Defaults to 30s for the signature / 60s for the JWT. */
+    maxSkewSeconds?: number;
+    /** Expected `@authority` (public hostname) the RFC 9421 signature must cover. When set, the
+     *  verifier binds the signature to this value instead of trusting the inbound `Host` header —
+     *  pin it to your real public host (e.g. `'wine.example.com'`) when behind a proxy that does
+     *  not normalize `Host`, to prevent a captured AIT+signature from being replayed to a
+     *  different virtual host on the same origin. */
+    authority?: string;
+    /** Per-issuer compliance policy override, keyed by issuer URL (canonicalized before lookup).
+     *  When a request's AIT is verified and its `iss` matches a key here, that block REPLACES the
+     *  gate's default policy fields (`requireKyc` / `requireSanctionsClear` / `minAge` /
+     *  `allowed/blockedJurisdictions`) for that request — letting a merchant apply different rules
+     *  by issuer (e.g. full compliance for its own AITs, a relaxed set for a partner issuer whose
+     *  tokens carry fewer attested claims). The replacement is whole-policy, not a merge: an issuer
+     *  block of `{ requireKyc: true, minAge: 21 }` evaluates ONLY those two rules for that issuer
+     *  (sanctions / jurisdiction omitted → not enforced for that issuer). Issuers NOT listed here
+     *  use the gate's default policy unchanged. Only the AIT path consults this — wallet /
+     *  operator-token requests are unaffected.
+     *
+     *  This is a deliberate compliance posture per issuer, not a default; an empty/absent map keeps
+     *  every issuer on the gate's default policy. */
+    issuerPolicies?: Record<string, AipIssuerPolicy>;
+}
+/** A per-issuer compliance policy block for {@link AipGateConfig.issuerPolicies}. The same
+ *  compliance fields as the gate, applied (as a whole-policy replacement) only to AITs from the
+ *  matching issuer. */
+interface AipIssuerPolicy {
+    requireKyc?: boolean;
+    requireSanctionsClear?: boolean;
+    minAge?: number;
+    blockedJurisdictions?: string[];
+    allowedJurisdictions?: string[];
+}
 /** Surface passed to `Checkout.onSettled` after a payment lands. */
 interface SettleOutcome {
     /** Protocol family that handled the settle. */
@@ -666,6 +718,18 @@ type IsCachedAddressFn = (address: string) => boolean | Promise<boolean>;
 declare function makeMppxComposeHook(opts: {
     serverGetter: () => Promise<unknown>;
 }): ComposeMppxFn;
+/** Resolve a per-issuer compliance-policy override for a verified AIT's issuer. Both the verified
+ *  `iss` and the map keys are canonicalized (lowercase scheme+host, no default port / trailing
+ *  slash) before comparison so `https://issuer.example` and `https://issuer.example/` resolve the same.
+ *  Returns the matching policy block, or undefined when the issuer is not overridden (→ caller
+ *  falls back to the gate's default policy). */
+/** The effective AIP trusted-issuer list: AgentScore's canonical issuer (ALWAYS trusted) plus any
+ *  external issuers. De-duped after canonicalization. Use this for the `agent_memory` hint and any
+ *  presentation surface (llms.txt / mpp.json / skill.md) that advertises AIP acceptance, so a
+ *  merchant relying solely on AgentScore AITs (no external issuers) still advertises the
+ *  `agent_identity` path. Trust enforcement itself lives in {@link JwksCache}, which merges the
+ *  canonical issuer independently. */
+declare function buildAipTrustedIssuers(externalIssuers?: string[]): string[];
 /**
  * Framework-neutral 4xx envelope (`{ error, next_steps, agent_instructions }`).
  *
@@ -741,6 +805,10 @@ declare class Checkout {
     readonly discoveryExtensions: Record<string, unknown> | undefined;
     readonly discoveryProbe: DiscoveryProbeConfig | undefined;
     private _x402ServerGetter;
+    /** Lazily-built JWKS cache for AIP verification, shared across requests so issuer keys
+     *  are fetched once and cached (per the verifier's hard 24h cap). Built on first AIT. */
+    private aipJwks;
+    private getAipJwks;
     /**
      * True when the merchant has configured an identity-bearing policy flag —
      * `require_kyc`, `require_sanctions_clear` (name screening on the KYC
@@ -958,4 +1026,4 @@ interface MountUcpRoutesOptions {
     jwksPath?: string;
 }
 
-export { AGENTSCORE_UCP_CAPABILITY as A, validationResponseHono as B, Checkout as C, type DiscoveryProbeConfig as D, validationResponseNextjs as E, validationResponseWeb as F, type GateDenial as G, x402PaymentHandler as H, type IsCachedAddressFn as I, type MountUcpRoutesOptions as M, type OnSettledFn as O, type PreValidateFn as P, type RecipientsFn as R, type SettleOutcome as S, type UCPCapabilityBinding as U, type AgentScoreGatePolicy as a, type CheckoutContext as b, type CheckoutGateConfig as c, type CheckoutRailSpec as d, type CheckoutRequest as e, type CheckoutResult as f, type ComposeMppxFn as g, type MppxComposeOutcome as h, type PricingFn as i, type PricingResult as j, type ReferenceIdFn as k, type RunGateFn as l, type UCPPaymentHandlerBinding as m, type UCPProfile as n, type UCPProfileBody as o, type UCPServiceBinding as p, UCPSigningKey as q, buildUCPProfile as r, getIdentityStatus as s, makeMppxComposeHook as t, mppPaymentHandler as u, pricingResult as v, stripeSptPaymentHandler as w, validationEnvelope as x, validationResponseExpress as y, validationResponseFastify as z };
+export { AGENTSCORE_UCP_CAPABILITY as A, validationResponseFastify as B, Checkout as C, type DiscoveryProbeConfig as D, validationResponseHono as E, validationResponseNextjs as F, type GateDenial as G, validationResponseWeb as H, type IsCachedAddressFn as I, x402PaymentHandler as J, type MountUcpRoutesOptions as M, type OnSettledFn as O, type PreValidateFn as P, type RecipientsFn as R, type SettleOutcome as S, type UCPCapabilityBinding as U, type AgentScoreGatePolicy as a, type CheckoutContext as b, type CheckoutGateConfig as c, type CheckoutRailSpec as d, type CheckoutRequest as e, type CheckoutResult as f, type ComposeMppxFn as g, type MppxComposeOutcome as h, type PricingFn as i, type PricingResult as j, type ReferenceIdFn as k, type RunGateFn as l, type UCPPaymentHandlerBinding as m, type UCPProfile as n, type UCPProfileBody as o, type UCPServiceBinding as p, UCPSigningKey as q, buildAipTrustedIssuers as r, buildUCPProfile as s, getIdentityStatus as t, makeMppxComposeHook as u, mppPaymentHandler as v, pricingResult as w, stripeSptPaymentHandler as x, validationEnvelope as y, validationResponseExpress as z };

package/dist/{checkout-Ceo1_rVJ.d.mts → checkout-o17dIxHi.d.mts}

@@ -1,5 +1,5 @@
-import { T as TempoRailSpec, S as SolanaMppRailSpec, c as TempoSessionRailSpec, b as StripeRailSpec, X as X402BaseRailSpec } from './rail_spec-B1239jPp.mjs';
-import { P as PricingBlock, R as RailKey } from './pricing-BReyZiqN.mjs';
+import { T as TempoRailSpec, S as SolanaMppRailSpec, c as TempoSessionRailSpec, b as StripeRailSpec, X as X402BaseRailSpec } from './rail_spec-BFZmW9RN.mjs';
+import { P as PricingBlock, R as RailKey } from './pricing-KHDqMLd7.mjs';
 import { CreateSessionOnMissing, AgentScoreCoreOptions, DenialReason } from './core.mjs';
 import { a as X402Server } from './x402_server-Ciz2mls2.mjs';
 
@@ -26,9 +26,8 @@ import { a as X402Server } from './x402_server-Ciz2mls2.mjs';
 /**
  * Construct a UCPSigningKey from a public JWK dict (e.g. the `publicJWK` returned by
  * `generateUCPSigningKey()`). Validates required fields and rejects symmetric keys that
- * can't publicly verify a JWS in trust-mode UCP. Mirrors python's
- * `UCPSigningKey.from_jwk(public_jwk)` classmethod via the `UCPSigningKey.fromJWK`
- * static-method-style namespace export below.
+ * can't publicly verify a JWS in trust-mode UCP. Exposed as `UCPSigningKey.fromJWK`
+ * via the static-method-style namespace export below.
  */
 declare function ucpSigningKeyFromJWKImpl(jwk: Record<string, unknown>): UCPSigningKey;
 interface UCPSigningKey {
@@ -45,8 +44,8 @@ interface UCPSigningKey {
     /** JWK x / y / n / e / etc. The full key material; passed through verbatim. */
     [k: string]: unknown;
 }
-/** Static-method-style namespace on the `UCPSigningKey` interface — mirrors python's
- *  `UCPSigningKey.from_jwk(jwk)` classmethod. Use as `UCPSigningKey.fromJWK(jwk)`. */
+/** Static-method-style namespace on the `UCPSigningKey` interface.
+ *  Use as `UCPSigningKey.fromJWK(jwk)`. */
 declare const UCPSigningKey: {
     fromJWK: typeof ucpSigningKeyFromJWKImpl;
 };
@@ -175,7 +174,7 @@ interface BuildUCPProfileInput {
      *  attestation lives on the AP2 risk-signal endpoint, not here. */
     agentscore_gate?: AgentScoreGatePolicy;
     /** Optional override for the AgentScore capability schema URL. Field is snake_cased
-     *  for cross-language parity with the Python sibling. */
+     *  to match the on-the-wire UCP profile shape. */
     agentscore_schema_url?: string;
     /** Optional override for the AgentScore capability spec URL. */
     agentscore_spec_url?: string;
@@ -435,9 +434,7 @@ declare function pricingResult(opts: {
  * Per-route discovery-probe config. When passed to {@link Checkout}, any
  * empty-body POST without a payment credential short-circuits with a sample
  * 402 advertising the merchant's payment shape — the canonical pattern x402
- * crawlers (`awal x402 details`, `x402-proxy`, `x402scan`) rely on.
- *
- * Mirrors python's `DiscoveryProbeConfig` dataclass.
+ * crawlers rely on.
  */
 interface DiscoveryProbeConfig {
     realm: string;
@@ -572,9 +569,64 @@ interface CheckoutGateConfig {
      *  DenialReason. Return a `GateDenial` to override the canonical body, or
      *  null to use `denialReasonToBody`. */
     onDenied?: (ctx: CheckoutContext, reason: DenialReason) => GateDenial | null | Promise<GateDenial | null>;
+    /** Accept AIP Agent Identity Tokens (AITs) on this route. When set and a request carries
+     *  an `Agent-Identity` header, the gate verifies the token offline (issuer signature via the
+     *  trusted-issuer JWKS + RFC 9421 proof-of-possession) BEFORE the assess call, then sends the
+     *  raw token to `/v1/assess` as `aip_token` so the same wine/age/sanctions policy evaluates
+     *  against the token's attested identity. A present-but-invalid AIT is a hard deny (the gate
+     *  does NOT fall through to wallet / operator-token). Requests with no `Agent-Identity` header
+     *  use the existing wallet / operator-token path unchanged.
+     *
+     *  Ignored when `runGate` is also set (a custom gate fully owns the flow). Without an `apiKey`,
+     *  a verified AIT is honored offline for identity-only gates, but a gate that declares policy
+     *  fields (KYC / age / sanctions / jurisdiction) without an `apiKey` fails closed
+     *  (`aip_policy_requires_api_key`) since policy can only be evaluated via `/v1/assess`. */
+    aip?: AipGateConfig;
     /** Full escape hatch — replaces the SDK gate flow. */
     runGate?: RunGateFn;
 }
+/** AIP acceptance config for {@link CheckoutGateConfig.aip}. */
+interface AipGateConfig {
+    /** ADDITIONAL external issuers to trust beyond AgentScore's own (e.g. `['https://issuer.example']`),
+     *  matched after canonicalization. AgentScore's canonical issuer
+     *  ({@link AGENTSCORE_CANONICAL_ISSUER}) is ALWAYS trusted and never needs listing — this SDK
+     *  is the AgentScore verifier, so a merchant can't accidentally fail to trust AgentScore AITs.
+     *  Omit/empty to accept only AgentScore-issued AITs. */
+    trustedIssuers?: string[];
+    /** Clock-skew tolerance in seconds for the RFC 9421 signature window (and, as an override,
+     *  the AIT JWT `exp`/`iat`). Defaults to 30s for the signature / 60s for the JWT. */
+    maxSkewSeconds?: number;
+    /** Expected `@authority` (public hostname) the RFC 9421 signature must cover. When set, the
+     *  verifier binds the signature to this value instead of trusting the inbound `Host` header —
+     *  pin it to your real public host (e.g. `'wine.example.com'`) when behind a proxy that does
+     *  not normalize `Host`, to prevent a captured AIT+signature from being replayed to a
+     *  different virtual host on the same origin. */
+    authority?: string;
+    /** Per-issuer compliance policy override, keyed by issuer URL (canonicalized before lookup).
+     *  When a request's AIT is verified and its `iss` matches a key here, that block REPLACES the
+     *  gate's default policy fields (`requireKyc` / `requireSanctionsClear` / `minAge` /
+     *  `allowed/blockedJurisdictions`) for that request — letting a merchant apply different rules
+     *  by issuer (e.g. full compliance for its own AITs, a relaxed set for a partner issuer whose
+     *  tokens carry fewer attested claims). The replacement is whole-policy, not a merge: an issuer
+     *  block of `{ requireKyc: true, minAge: 21 }` evaluates ONLY those two rules for that issuer
+     *  (sanctions / jurisdiction omitted → not enforced for that issuer). Issuers NOT listed here
+     *  use the gate's default policy unchanged. Only the AIT path consults this — wallet /
+     *  operator-token requests are unaffected.
+     *
+     *  This is a deliberate compliance posture per issuer, not a default; an empty/absent map keeps
+     *  every issuer on the gate's default policy. */
+    issuerPolicies?: Record<string, AipIssuerPolicy>;
+}
+/** A per-issuer compliance policy block for {@link AipGateConfig.issuerPolicies}. The same
+ *  compliance fields as the gate, applied (as a whole-policy replacement) only to AITs from the
+ *  matching issuer. */
+interface AipIssuerPolicy {
+    requireKyc?: boolean;
+    requireSanctionsClear?: boolean;
+    minAge?: number;
+    blockedJurisdictions?: string[];
+    allowedJurisdictions?: string[];
+}
 /** Surface passed to `Checkout.onSettled` after a payment lands. */
 interface SettleOutcome {
     /** Protocol family that handled the settle. */
@@ -666,6 +718,18 @@ type IsCachedAddressFn = (address: string) => boolean | Promise<boolean>;
 declare function makeMppxComposeHook(opts: {
     serverGetter: () => Promise<unknown>;
 }): ComposeMppxFn;
+/** Resolve a per-issuer compliance-policy override for a verified AIT's issuer. Both the verified
+ *  `iss` and the map keys are canonicalized (lowercase scheme+host, no default port / trailing
+ *  slash) before comparison so `https://issuer.example` and `https://issuer.example/` resolve the same.
+ *  Returns the matching policy block, or undefined when the issuer is not overridden (→ caller
+ *  falls back to the gate's default policy). */
+/** The effective AIP trusted-issuer list: AgentScore's canonical issuer (ALWAYS trusted) plus any
+ *  external issuers. De-duped after canonicalization. Use this for the `agent_memory` hint and any
+ *  presentation surface (llms.txt / mpp.json / skill.md) that advertises AIP acceptance, so a
+ *  merchant relying solely on AgentScore AITs (no external issuers) still advertises the
+ *  `agent_identity` path. Trust enforcement itself lives in {@link JwksCache}, which merges the
+ *  canonical issuer independently. */
+declare function buildAipTrustedIssuers(externalIssuers?: string[]): string[];
 /**
  * Framework-neutral 4xx envelope (`{ error, next_steps, agent_instructions }`).
  *
@@ -741,6 +805,10 @@ declare class Checkout {
     readonly discoveryExtensions: Record<string, unknown> | undefined;
     readonly discoveryProbe: DiscoveryProbeConfig | undefined;
     private _x402ServerGetter;
+    /** Lazily-built JWKS cache for AIP verification, shared across requests so issuer keys
+     *  are fetched once and cached (per the verifier's hard 24h cap). Built on first AIT. */
+    private aipJwks;
+    private getAipJwks;
     /**
      * True when the merchant has configured an identity-bearing policy flag —
      * `require_kyc`, `require_sanctions_clear` (name screening on the KYC
@@ -958,4 +1026,4 @@ interface MountUcpRoutesOptions {
     jwksPath?: string;
 }
 
-export { AGENTSCORE_UCP_CAPABILITY as A, validationResponseHono as B, Checkout as C, type DiscoveryProbeConfig as D, validationResponseNextjs as E, validationResponseWeb as F, type GateDenial as G, x402PaymentHandler as H, type IsCachedAddressFn as I, type MountUcpRoutesOptions as M, type OnSettledFn as O, type PreValidateFn as P, type RecipientsFn as R, type SettleOutcome as S, type UCPCapabilityBinding as U, type AgentScoreGatePolicy as a, type CheckoutContext as b, type CheckoutGateConfig as c, type CheckoutRailSpec as d, type CheckoutRequest as e, type CheckoutResult as f, type ComposeMppxFn as g, type MppxComposeOutcome as h, type PricingFn as i, type PricingResult as j, type ReferenceIdFn as k, type RunGateFn as l, type UCPPaymentHandlerBinding as m, type UCPProfile as n, type UCPProfileBody as o, type UCPServiceBinding as p, UCPSigningKey as q, buildUCPProfile as r, getIdentityStatus as s, makeMppxComposeHook as t, mppPaymentHandler as u, pricingResult as v, stripeSptPaymentHandler as w, validationEnvelope as x, validationResponseExpress as y, validationResponseFastify as z };
+export { AGENTSCORE_UCP_CAPABILITY as A, validationResponseFastify as B, Checkout as C, type DiscoveryProbeConfig as D, validationResponseHono as E, validationResponseNextjs as F, type GateDenial as G, validationResponseWeb as H, type IsCachedAddressFn as I, x402PaymentHandler as J, type MountUcpRoutesOptions as M, type OnSettledFn as O, type PreValidateFn as P, type RecipientsFn as R, type SettleOutcome as S, type UCPCapabilityBinding as U, type AgentScoreGatePolicy as a, type CheckoutContext as b, type CheckoutGateConfig as c, type CheckoutRailSpec as d, type CheckoutRequest as e, type CheckoutResult as f, type ComposeMppxFn as g, type MppxComposeOutcome as h, type PricingFn as i, type PricingResult as j, type ReferenceIdFn as k, type RunGateFn as l, type UCPPaymentHandlerBinding as m, type UCPProfile as n, type UCPProfileBody as o, type UCPServiceBinding as p, UCPSigningKey as q, buildAipTrustedIssuers as r, buildUCPProfile as s, getIdentityStatus as t, makeMppxComposeHook as u, mppPaymentHandler as v, pricingResult as w, stripeSptPaymentHandler as x, validationEnvelope as y, validationResponseExpress as z };

package/dist/core.d.mts

@@ -3,6 +3,10 @@ import { P as PaymentSigner } from './signer-3FAit11j.mjs';
 interface AgentIdentity {
     address?: string;
     operatorToken?: string;
+    /** Raw AIP Agent Identity Token (a JWT). When set, the gate has already verified the
+     *  token's RFC 9421 proof-of-possession at the edge; `evaluate` sends it to `/v1/assess`
+     *  as `aip_token` for server-side IdP-signature re-verification + policy enrichment. */
+    aipToken?: string;
 }
 /**
  * Session metadata returned from `POST /v1/sessions`. Surfaced to the `onBeforeSession`
@@ -74,6 +78,11 @@ interface AgentScoreCoreOptions {
     userAgent?: string;
     /** When set and no identity is found, create a verification session instead of denying immediately. */
     createSessionOnMissing?: CreateSessionOnMissing;
+    /** Issuers whose AIP Agent Identity Tokens this gate accepts. When set, the missing-identity
+     *  recovery instructions and the `agent_memory` hint advertise the AIT path so agents holding
+     *  one can present it. Set by Checkout from `gate.aip.trustedIssuers`; the actual AIT
+     *  verification happens at the edge (Checkout) before `evaluate`. */
+    aipTrustedIssuers?: string[];
 }
 type DenialCode = 'wallet_not_trusted' | 'missing_identity' | 'api_error' | 'payment_required' | 'identity_verification_required' | 'wallet_signer_mismatch' | 'wallet_auth_requires_wallet_signing' | 'token_expired' | 'invalid_credential';
 /**
@@ -90,7 +99,12 @@ interface AgentMemoryHint {
     identity_paths: {
         wallet: string;
         operator_token: string;
+        agent_identity?: string;
     };
+    /** Issuers whose AIP Agent Identity Tokens this merchant accepts. Present only when the
+     *  merchant opted into AIP; an agent holding an AIT from one of these can present it via an
+     *  `Agent-Identity` header + RFC 9421 signature instead of bootstrapping a fresh credential. */
+    aip_trusted_issuers?: string[];
     bootstrap: string;
     do_not_persist_in_memory: string[];
     persist_in_credential_store: string[];
@@ -129,16 +143,14 @@ interface DenialReason {
     /** Wallets the claimed operator could sign with (if enumerable). Present when non-empty. */
     linked_wallets?: string[];
 }
-/** Operator verification details from the assess response. Mirrors python's
- *  `OperatorVerification` dataclass. */
+/** Operator verification details from the assess response. */
 interface OperatorVerification {
     level: string;
     operator_type: string | null;
     verified_at: string | null;
 }
 /** Account-level KYC facts that apply to every operator under the same account.
- *  Populated when the API returns account_verification (post-KYC operator).
- *  Mirrors python's account_verification dict shape. */
+ *  Populated when the API returns account_verification (post-KYC operator). */
 interface AccountVerification {
     kyc_level?: string;
     sanctions_clear?: boolean;
@@ -146,14 +158,14 @@ interface AccountVerification {
     jurisdiction?: string;
     verified_at?: string | null;
 }
-/** A single policy check from the assess response. Mirrors python's `PolicyCheck`. */
+/** A single policy check from the assess response. */
 interface PolicyCheck {
     rule: string;
     passed: boolean;
     required?: unknown;
     actual?: unknown;
 }
-/** Policy evaluation result from the assess response. Mirrors python's `PolicyResult`. */
+/** Policy evaluation result from the assess response. */
 interface PolicyResult {
     all_passed: boolean;
     checks: PolicyCheck[];
@@ -171,6 +183,14 @@ interface AssessResult {
     linked_wallets?: string[];
     verify_url?: string;
     policy_result?: PolicyResult | null;
+    /** IdP provenance, present only when `identity_method === 'aip_token'` — which issuer attested
+     *  the identity and the trust level it asserted. Mirrors the SDK's `AssessResponse.aip`. */
+    aip?: {
+        issuer: string;
+        subject: string;
+        trust_level?: 'autonomous' | 'human_present' | 'human_confirmed';
+        agent_provider?: string;
+    };
 }
 /**
  * Reason a failOpen allow short-circuited an evaluate call due to AgentScore-side
@@ -291,7 +311,7 @@ interface AgentScoreCore {
      *  swallows non-fatal errors because capture is informational, not on the critical path. */
     captureWallet(options: CaptureWalletOptions): Promise<void>;
 }
-declare function buildAgentMemoryHint(): AgentMemoryHint;
+declare function buildAgentMemoryHint(aipTrustedIssuers?: string[]): AgentMemoryHint;
 declare function createAgentScoreCore(options: AgentScoreCoreOptions): AgentScoreCore;
 
 export { type AccountVerification, type AgentIdentity, type AgentMemoryHint, type AgentScoreCore, type AgentScoreCoreOptions, type AssessResult, type CreateSessionOnMissing, type DenialCode, type DenialReason, type EvaluateOutcome, type FailOpenInfraReason, type GateQuotaInfo, type OperatorVerification, type PolicyCheck, type PolicyResult, type SessionMetadata, type SignerVerdict, type VerifyWalletSignerResult, buildAgentMemoryHint, createAgentScoreCore };

package/dist/core.d.ts

@@ -3,6 +3,10 @@ import { P as PaymentSigner } from './signer-3FAit11j.js';
 interface AgentIdentity {
     address?: string;
     operatorToken?: string;
+    /** Raw AIP Agent Identity Token (a JWT). When set, the gate has already verified the
+     *  token's RFC 9421 proof-of-possession at the edge; `evaluate` sends it to `/v1/assess`
+     *  as `aip_token` for server-side IdP-signature re-verification + policy enrichment. */
+    aipToken?: string;
 }
 /**
  * Session metadata returned from `POST /v1/sessions`. Surfaced to the `onBeforeSession`
@@ -74,6 +78,11 @@ interface AgentScoreCoreOptions {
     userAgent?: string;
     /** When set and no identity is found, create a verification session instead of denying immediately. */
     createSessionOnMissing?: CreateSessionOnMissing;
+    /** Issuers whose AIP Agent Identity Tokens this gate accepts. When set, the missing-identity
+     *  recovery instructions and the `agent_memory` hint advertise the AIT path so agents holding
+     *  one can present it. Set by Checkout from `gate.aip.trustedIssuers`; the actual AIT
+     *  verification happens at the edge (Checkout) before `evaluate`. */
+    aipTrustedIssuers?: string[];
 }
 type DenialCode = 'wallet_not_trusted' | 'missing_identity' | 'api_error' | 'payment_required' | 'identity_verification_required' | 'wallet_signer_mismatch' | 'wallet_auth_requires_wallet_signing' | 'token_expired' | 'invalid_credential';
 /**
@@ -90,7 +99,12 @@ interface AgentMemoryHint {
     identity_paths: {
         wallet: string;
         operator_token: string;
+        agent_identity?: string;
     };
+    /** Issuers whose AIP Agent Identity Tokens this merchant accepts. Present only when the
+     *  merchant opted into AIP; an agent holding an AIT from one of these can present it via an
+     *  `Agent-Identity` header + RFC 9421 signature instead of bootstrapping a fresh credential. */
+    aip_trusted_issuers?: string[];
     bootstrap: string;
     do_not_persist_in_memory: string[];
     persist_in_credential_store: string[];
@@ -129,16 +143,14 @@ interface DenialReason {
     /** Wallets the claimed operator could sign with (if enumerable). Present when non-empty. */
     linked_wallets?: string[];
 }
-/** Operator verification details from the assess response. Mirrors python's
- *  `OperatorVerification` dataclass. */
+/** Operator verification details from the assess response. */
 interface OperatorVerification {
     level: string;
     operator_type: string | null;
     verified_at: string | null;
 }
 /** Account-level KYC facts that apply to every operator under the same account.
- *  Populated when the API returns account_verification (post-KYC operator).
- *  Mirrors python's account_verification dict shape. */
+ *  Populated when the API returns account_verification (post-KYC operator). */
 interface AccountVerification {
     kyc_level?: string;
     sanctions_clear?: boolean;
@@ -146,14 +158,14 @@ interface AccountVerification {
     jurisdiction?: string;
     verified_at?: string | null;
 }
-/** A single policy check from the assess response. Mirrors python's `PolicyCheck`. */
+/** A single policy check from the assess response. */
 interface PolicyCheck {
     rule: string;
     passed: boolean;
     required?: unknown;
     actual?: unknown;
 }
-/** Policy evaluation result from the assess response. Mirrors python's `PolicyResult`. */
+/** Policy evaluation result from the assess response. */
 interface PolicyResult {
     all_passed: boolean;
     checks: PolicyCheck[];
@@ -171,6 +183,14 @@ interface AssessResult {
     linked_wallets?: string[];
     verify_url?: string;
     policy_result?: PolicyResult | null;
+    /** IdP provenance, present only when `identity_method === 'aip_token'` — which issuer attested
+     *  the identity and the trust level it asserted. Mirrors the SDK's `AssessResponse.aip`. */
+    aip?: {
+        issuer: string;
+        subject: string;
+        trust_level?: 'autonomous' | 'human_present' | 'human_confirmed';
+        agent_provider?: string;
+    };
 }
 /**
  * Reason a failOpen allow short-circuited an evaluate call due to AgentScore-side
@@ -291,7 +311,7 @@ interface AgentScoreCore {
      *  swallows non-fatal errors because capture is informational, not on the critical path. */
     captureWallet(options: CaptureWalletOptions): Promise<void>;
 }
-declare function buildAgentMemoryHint(): AgentMemoryHint;
+declare function buildAgentMemoryHint(aipTrustedIssuers?: string[]): AgentMemoryHint;
 declare function createAgentScoreCore(options: AgentScoreCoreOptions): AgentScoreCore;
 
 export { type AccountVerification, type AgentIdentity, type AgentMemoryHint, type AgentScoreCore, type AgentScoreCoreOptions, type AssessResult, type CreateSessionOnMissing, type DenialCode, type DenialReason, type EvaluateOutcome, type FailOpenInfraReason, type GateQuotaInfo, type OperatorVerification, type PolicyCheck, type PolicyResult, type SessionMetadata, type SignerVerdict, type VerifyWalletSignerResult, buildAgentMemoryHint, createAgentScoreCore };

package/dist/core.js

@@ -24,6 +24,7 @@ __export(core_exports, {
   createAgentScoreCore: () => createAgentScoreCore
 });
 module.exports = __toCommonJS(core_exports);
+var import_node_crypto = require("crypto");
 var import_sdk = require("@agent-score/sdk");
 
 // src/_denial.ts
@@ -184,8 +185,9 @@ var INVALID_CREDENTIAL_INSTRUCTIONS = JSON.stringify({
   ],
   user_message: "The operator_token is not recognized. Use a different stored token, or restart the verification session flow to mint a new one."
 });
-function buildAgentMemoryHint() {
+function buildAgentMemoryHint(aipTrustedIssuers) {
   const api = CANONICAL_AGENTSCORE_API;
+  const acceptsAip = aipTrustedIssuers !== void 0 && aipTrustedIssuers.length > 0;
   return {
     save_for_future_agentscore_gates: true,
     pattern_summary: "AgentScore is a cross-merchant identity substrate for agent commerce. Any endpoint that returns 403 missing_identity / identity_verification_required or 402 challenges referencing AgentScore uses the same identity system. One KYC works across all AgentScore merchants \u2014 no re-verification per site. Save this pattern (and the endpoints below) to persistent memory so future AgentScore encounters skip the cold-start session flow.",
@@ -193,8 +195,12 @@ function buildAgentMemoryHint() {
     identity_check_endpoint: `${api}/v1/credentials`,
     identity_paths: {
       wallet: "If paying from a crypto wallet you have used before on any AgentScore merchant, send `X-Wallet-Address: 0x...`. Shortest path; no token lifecycle to manage.",
-      operator_token: "For any rail (Stripe SPT, card, or a wallet you have not linked yet), send `X-Operator-Token: opc_...`. Reusable across merchants until the token expires."
+      operator_token: "For any rail (Stripe SPT, card, or a wallet you have not linked yet), send `X-Operator-Token: opc_...`. Reusable across merchants until the token expires.",
+      ...acceptsAip && {
+        agent_identity: 'If you hold an AIP Agent Identity Token from a trusted issuer (see aip_trusted_issuers), present it: send the JWT in an `Agent-Identity` header plus an RFC 9421 HTTP Message Signature (Signature-Input + Signature over @method @authority @path agent-identity, tag="agent-identity") signed with the token-bound cnf key. The merchant verifies it and applies its policy \u2014 no separate AgentScore credential needed.'
+      }
     },
+    ...acceptsAip && { aip_trusted_issuers: aipTrustedIssuers },
     bootstrap: "If you have neither a linked wallet nor a valid operator_token, follow the session/verify flow in the per-request `agent_instructions` block. This happens at most once per agent identity \u2014 after first verification, the operator_token and any subsequently used wallet are reusable everywhere.",
     do_not_persist_in_memory: ["operator_token", "poll_secret"],
     persist_in_credential_store: ["operator_token"]
@@ -216,11 +222,12 @@ function createAgentScoreCore(options) {
     baseUrl: rawBaseUrl = "https://api.agentscore.sh",
     chain: gateChain,
     userAgent,
-    createSessionOnMissing
+    createSessionOnMissing,
+    aipTrustedIssuers
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
-  const agentMemoryHint = buildAgentMemoryHint();
-  const defaultUa = `@agent-score/commerce@${"2.3.0"}`;
+  const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
+  const defaultUa = `@agent-score/commerce@${"2.5.0"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -238,6 +245,7 @@ function createAgentScoreCore(options) {
     return s;
   }
   const cache = new TTLCache(cacheSeconds * 1e3);
+  const lastSignerRaw = /* @__PURE__ */ new Map();
   async function tryMintSessionDenial(ctx) {
     if (!createSessionOnMissing) return void 0;
     try {
@@ -295,13 +303,18 @@ function createAgentScoreCore(options) {
     }
   }
   async function evaluate(identity, ctx, signer) {
-    if (!identity || !identity.address && !identity.operatorToken) {
+    if (!identity || !identity.address?.trim() && !identity.operatorToken?.trim() && !identity.aipToken?.trim()) {
       if (failOpen) return { kind: "allow" };
       const sessionReason = await tryMintSessionDenial(ctx);
       if (sessionReason) return { kind: "deny", reason: sessionReason };
+      const acceptsAip = aipTrustedIssuers !== void 0 && aipTrustedIssuers.length > 0;
+      const aipStep = acceptsAip ? [
+        `If you hold an AIP Agent Identity Token from a trusted issuer (${aipTrustedIssuers.join(", ")}): present it \u2014 send the JWT in an Agent-Identity header plus an RFC 9421 HTTP Message Signature (Signature-Input + Signature over @method @authority @path agent-identity, tag="agent-identity") signed with the token-bound cnf key. This satisfies identity in one round trip without an AgentScore credential.`
+      ] : [];
       const missingIdentityInstructions = JSON.stringify({
         action: "probe_identity_then_session",
         steps: [
+          ...aipStep,
           "If you have a wallet AND this merchant accepts a wallet-signing rail (Tempo MPP or x402 \u2014 see openapi.json x-payment-info): send X-Wallet-Address and retry. If the wallet is already linked to an AgentScore operator (via prior SIWE claim or prior captureWallet), this passes in one round trip. If the wallet is unlinked or the account has no KYC, the 403 will include a verify_url \u2014 share it with the user to claim the wallet + complete KYC, then retry.",
           "If step 1 is denied or you already have a stored operator_token (valid + not expired): send X-Operator-Token: opc_... and retry.",
           "If neither applies: retry with NO identity header. Merchants that auto-create verification sessions (most AgentScore merchants do) return verify_url + session_id + poll_secret in the 403 body \u2014 share verify_url with the user, then poll poll_url every 5s with the X-Poll-Secret header until status=verified (the poll returns a one-time operator_token). If the retry returns the same bare 403, this merchant does not support self-service session bootstrapping \u2014 direct the user to https://agentscore.sh/sign-up to create an AgentScore identity and mint an operator_token from their dashboard (https://agentscore.sh/dashboard/verify). The user hands the opc_... to you, and you retry with X-Operator-Token."
@@ -317,7 +330,7 @@ function createAgentScoreCore(options) {
         }
       };
     }
-    const cacheKey = identity.operatorToken?.toLowerCase() ?? (identity.address ? normalizeAddress(identity.address) : "");
+    const cacheKey = identity.aipToken ? `aip:${(0, import_node_crypto.createHash)("sha256").update(identity.aipToken).digest("hex")}` : identity.operatorToken?.toLowerCase() ?? (identity.address ? normalizeAddress(identity.address) : "");
     const cached = cache.get(cacheKey);
     if (cached) {
       if (cached.allow) {
@@ -362,7 +375,7 @@ function createAgentScoreCore(options) {
         // regardless of policy.require_sanctions_clear (which gates the separate NAME screen).
         ...signer && { signer: { address: signer.address, network: signer.network } }
       };
-      const result = identity.address ? await sdk.assess(identity.address, { ...opts, operatorToken: identity.operatorToken }) : await sdk.assess(null, { ...opts, operatorToken: identity.operatorToken });
+      const result = identity.aipToken ? await sdk.assess(null, { ...opts, aipToken: identity.aipToken }) : identity.address ? await sdk.assess(identity.address, { ...opts, operatorToken: identity.operatorToken }) : await sdk.assess(null, { ...opts, operatorToken: identity.operatorToken });
       data = result;
     } catch (err) {
       if (err instanceof import_sdk.PaymentRequiredError) {
@@ -433,6 +446,9 @@ function createAgentScoreCore(options) {
     const decisionReasons = data.decision_reasons ?? [];
     const allow = decision === "allow" || decision == null;
     cache.set(cacheKey, { allow, decision: decision ?? void 0, reasons: decisionReasons, raw: data });
+    if (identity.address !== void 0 && identity.operatorToken === void 0 && identity.aipToken === void 0 && (data.signer_match !== void 0 || data.signer_sanctions !== void 0)) {
+      lastSignerRaw.set(normalizeAddress(identity.address), data);
+    }
     if (allow) {
       const quota = data.quota;
       return {
@@ -497,9 +513,7 @@ function createAgentScoreCore(options) {
   }
   function getSignerVerdict(claimedAddress) {
     const claimedNorm = normalizeAddress(claimedAddress);
-    const cached = cache.get(claimedNorm);
-    if (!cached) return void 0;
-    const raw = cached.raw;
+    const raw = lastSignerRaw.get(claimedNorm) ?? cache.get(claimedNorm)?.raw;
     if (!raw) return void 0;
     const rawMatch = raw.signer_match;
     const rawSanctions = raw.signer_sanctions;