@agent-score/commerce 2.4.0 → 2.5.0

package/dist/identity/express.d.mts

@@ -1,5 +1,7 @@
+import { b as AipGateOptions, r as buildAipErrorBody, V as VerifiedAit } from '../gate-CWP10xPQ.mjs';
 import { AgentScoreCoreOptions, AgentIdentity, DenialReason, CreateSessionOnMissing, AssessResult, FailOpenInfraReason, GateQuotaInfo, SignerVerdict } from '../core.mjs';
 import { Request, Response, NextFunction } from 'express';
+import 'jose';
 import '../signer-3FAit11j.mjs';
 
 interface AgentScoreGateOptions extends Omit<AgentScoreCoreOptions, 'createSessionOnMissing'> {
@@ -60,5 +62,28 @@ declare function getSignerVerdict(req: Request): SignerVerdict | undefined;
  *  unauthenticated and the handler emits a 402 with all rails; settle legs
  *  trigger the full gate. */
 declare function conditionalAgentscoreGate(options: AgentScoreGateOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+interface AipGateExpressOptions extends AipGateOptions {
+    /** Custom denial responder. Defaults to a 401/403 `application/problem+json` body. */
+    onDenied?: (req: Request, res: Response, body: ReturnType<typeof buildAipErrorBody>) => void;
+}
+/**
+ * Express middleware that requires a valid AIT on every request it guards.
+ *
+ * ```ts
+ * import { JwksCache } from '@agent-score/commerce';
+ * import { aipGate, getVerifiedAit } from '@agent-score/commerce/identity/express';
+ *
+ * const jwks = new JwksCache({ trustedIssuers: ['https://issuer.example'] }); // AgentScore always trusted
+ * app.post('/checkout', aipGate({ jwks }), (req, res) => {
+ *   const ait = getVerifiedAit(req)!;
+ *   res.json({ buyer: ait.payload.identity?.email });
+ * });
+ * ```
+ */
+declare function aipGate(options: AipGateExpressOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/** Wrap {@link aipGate} so it only runs when an `Agent-Identity` header is present. */
+declare function conditionalAipGate(options: AipGateExpressOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/** Read the verified AIT attached to an Express request by {@link aipGate}. */
+declare function getVerifiedAit(req: Request): VerifiedAit | undefined;
 
-export { agentscoreGate, captureWallet, conditionalAgentscoreGate, getAgentScoreData, getGateDegradedState, getGateQuotaInfo, getSignerVerdict };
+export { type AipGateExpressOptions, agentscoreGate, aipGate, captureWallet, conditionalAgentscoreGate, conditionalAipGate, getAgentScoreData, getGateDegradedState, getGateQuotaInfo, getSignerVerdict, getVerifiedAit };

package/dist/identity/express.d.ts

@@ -1,5 +1,7 @@
+import { b as AipGateOptions, r as buildAipErrorBody, V as VerifiedAit } from '../gate-CWP10xPQ.js';
 import { AgentScoreCoreOptions, AgentIdentity, DenialReason, CreateSessionOnMissing, AssessResult, FailOpenInfraReason, GateQuotaInfo, SignerVerdict } from '../core.js';
 import { Request, Response, NextFunction } from 'express';
+import 'jose';
 import '../signer-3FAit11j.js';
 
 interface AgentScoreGateOptions extends Omit<AgentScoreCoreOptions, 'createSessionOnMissing'> {
@@ -60,5 +62,28 @@ declare function getSignerVerdict(req: Request): SignerVerdict | undefined;
  *  unauthenticated and the handler emits a 402 with all rails; settle legs
  *  trigger the full gate. */
 declare function conditionalAgentscoreGate(options: AgentScoreGateOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+interface AipGateExpressOptions extends AipGateOptions {
+    /** Custom denial responder. Defaults to a 401/403 `application/problem+json` body. */
+    onDenied?: (req: Request, res: Response, body: ReturnType<typeof buildAipErrorBody>) => void;
+}
+/**
+ * Express middleware that requires a valid AIT on every request it guards.
+ *
+ * ```ts
+ * import { JwksCache } from '@agent-score/commerce';
+ * import { aipGate, getVerifiedAit } from '@agent-score/commerce/identity/express';
+ *
+ * const jwks = new JwksCache({ trustedIssuers: ['https://issuer.example'] }); // AgentScore always trusted
+ * app.post('/checkout', aipGate({ jwks }), (req, res) => {
+ *   const ait = getVerifiedAit(req)!;
+ *   res.json({ buyer: ait.payload.identity?.email });
+ * });
+ * ```
+ */
+declare function aipGate(options: AipGateExpressOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/** Wrap {@link aipGate} so it only runs when an `Agent-Identity` header is present. */
+declare function conditionalAipGate(options: AipGateExpressOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/** Read the verified AIT attached to an Express request by {@link aipGate}. */
+declare function getVerifiedAit(req: Request): VerifiedAit | undefined;
 
-export { agentscoreGate, captureWallet, conditionalAgentscoreGate, getAgentScoreData, getGateDegradedState, getGateQuotaInfo, getSignerVerdict };
+export { type AipGateExpressOptions, agentscoreGate, aipGate, captureWallet, conditionalAgentscoreGate, conditionalAipGate, getAgentScoreData, getGateDegradedState, getGateQuotaInfo, getSignerVerdict, getVerifiedAit };