@agent-score/commerce 2.4.0 → 2.5.0

package/dist/discovery/index.mjs

@@ -363,11 +363,13 @@ function buildWellKnownX402(input) {
 // src/discovery/llms_txt.ts
 function llmsTxtIdentitySection({
   agentscore,
-  compliance
+  compliance,
+  aip
 } = {}) {
   if (!agentscore) {
     return "";
   }
+  const aipBullet = aip ? "\n- **`Agent-Identity: <JWT>` + RFC 9421 signature** \u2014 present an Agent Identity Token (AIP) from a trusted issuer (AgentScore is always trusted). Short-lived and bound to your key; sign the request (`Signature-Input` + `Signature` over `@method @authority @path agent-identity`, tag `agent-identity`) to prove possession. No long-lived token on the wire. Mint one with `agentscore-pay identity-mint` or let `agentscore-pay pay --identity aip` attach it automatically." : "";
   const complianceNote = compliance ? `
 
 Compliance: ${[
@@ -381,7 +383,7 @@ Compliance: ${[
 AgentScore identity is reusable across every AgentScore-gated merchant \u2014 one KYC, no re-verification per site. Pick a header:
 
 - **\`X-Wallet-Address: 0x...\` or base58** \u2014 works on signing rails (Tempo, x402, Solana MPP). The wallet you claim must sign the payment.
-- **\`X-Operator-Token: opc_...\`** \u2014 works on every rail, including Stripe SPT. Reusable across AgentScore merchants until expiry.
+- **\`X-Operator-Token: opc_...\`** \u2014 works on every rail, including Stripe SPT. Reusable across AgentScore merchants until expiry.${aipBullet}
 - **Neither** \u2014 you get a 403 with \`verify_url\`. Complete the session flow once and reuse the resulting \`opc_...\` everywhere.${complianceNote}`;
 }
 function llmsTxtPaymentSection(input) {
@@ -522,6 +524,12 @@ function agentscoreSecuritySchemes() {
       name: "X-Wallet-Address",
       description: "Wallet-path identity (0x... or base58). Only works on rails that carry a wallet signature (Tempo MPP, x402 EIP-3009, x402 SPL Token). The wallet you claim MUST sign the payment."
     },
+    AgentIdentity: {
+      type: "apiKey",
+      in: "header",
+      name: "Agent-Identity",
+      description: "AIP Agent Identity Token path (a JWT from a trusted issuer; AgentScore is always trusted). Opt-in. The token is bound to the agent key via `cnf`; the request MUST also carry an RFC 9421 HTTP Message Signature (`Signature-Input` + `Signature` over `@method @authority @path agent-identity`, tag `agent-identity`) proving possession. A verified AIT is the sole identity and is evaluated against the merchant policy via its attested claims."
+    },
     siwx: siwxSecurityScheme()
   };
 }
@@ -885,14 +893,16 @@ function identitySection(input) {
   if (id.minAge) reqs.push(`age ${id.minAge}+`);
   if (id.allowedJurisdictions?.length) reqs.push(`${id.allowedJurisdictions.join("/")} only`);
   if (id.sanctionsClear) reqs.push("sanctions clear");
-  if (reqs.length === 0) return "";
+  if (reqs.length === 0 && !id.aip) return "";
   const bootstrap = input.identityBootstrapUrl ? `
 
 If you don't have a Passport, fetch \`${input.identityBootstrapUrl}\` and follow the onboarding there first. Bring back the \`opc_...\` operator token in \`X-Operator-Token\` on every gated request.` : "";
+  const reqLine = reqs.length ? `This merchant uses AgentScore identity. Required: ${reqs.join(", ")}.${bootstrap}` : `This merchant uses AgentScore identity.${bootstrap}`;
+  const aipNote = id.aip ? "\n\nThis merchant accepts AIP Agent Identity Tokens. If you hold an AIT from a trusted issuer (AgentScore is always trusted), present the JWT in an `Agent-Identity` header plus an RFC 9421 HTTP Message Signature (`Signature-Input` + `Signature` over `@method @authority @path agent-identity`, tag `agent-identity`) signed with the token-bound cnf key \u2014 it satisfies identity in one round trip, no separate AgentScore credential needed. `agentscore-pay pay --identity aip` does this automatically." : "";
   return [
     "## Identity Prerequisite",
     "",
-    `This merchant uses AgentScore identity. Required: ${reqs.join(", ")}.${bootstrap}`,
+    `${reqLine}${aipNote}`,
     "",
     "Denial bodies carry an `agent_instructions` block describing the recovery action \u2014 read the `action` field and follow it. See the identity-bootstrap skill for the canonical denial-code \u2192 action table."
   ].join("\n");