@agent-score/commerce 2.4.0 → 2.6.0

package/dist/challenge/index.mjs

@@ -279,6 +279,7 @@ function buildAgentInstructions({
 }
 
 // src/core.ts
+import { createHash } from "crypto";
 import {
   AgentScore,
   InvalidCredentialError,
@@ -318,7 +319,7 @@ var IDENTITY_VERIFICATION_REQUIRED_FALLBACK_INSTRUCTIONS = JSON.stringify({
 var API_ERROR_INSTRUCTIONS = JSON.stringify({
   action: "retry_with_backoff",
   steps: [
-    "Verification is temporarily unavailable. Retry the request after 5\u201330 seconds with exponential backoff.",
+    "Verification is temporarily unavailable. Retry the request after 5-30 seconds with exponential backoff.",
     "This is NOT a compliance denial \u2014 the user does not need to re-verify their identity. Send the same identity headers (X-Wallet-Address or X-Operator-Token) on retry.",
     "If the request continues to fail after 3+ retries (~60 seconds total), surface the error to the user with the merchant's support contact."
   ],
@@ -344,7 +345,7 @@ var TOKEN_EXPIRED_FALLBACK_INSTRUCTIONS = JSON.stringify({
 });
 
 // src/core.ts
-var CANONICAL_AGENTSCORE_API = "https://api.agentscore.sh";
+var CANONICAL_AGENTSCORE_API = "https://api.agentscore.com";
 var WALLET_SIGNER_MISMATCH_INSTRUCTIONS = JSON.stringify({
   action: "resign_or_switch_to_operator_token",
   steps: [
@@ -370,17 +371,22 @@ var INVALID_CREDENTIAL_INSTRUCTIONS = JSON.stringify({
   ],
   user_message: "The operator_token is not recognized. Use a different stored token, or restart the verification session flow to mint a new one."
 });
-function buildAgentMemoryHint() {
+function buildAgentMemoryHint(aipTrustedIssuers) {
   const api = CANONICAL_AGENTSCORE_API;
+  const acceptsAip = aipTrustedIssuers !== void 0 && aipTrustedIssuers.length > 0;
   return {
     save_for_future_agentscore_gates: true,
     pattern_summary: "AgentScore is a cross-merchant identity substrate for agent commerce. Any endpoint that returns 403 missing_identity / identity_verification_required or 402 challenges referencing AgentScore uses the same identity system. One KYC works across all AgentScore merchants \u2014 no re-verification per site. Save this pattern (and the endpoints below) to persistent memory so future AgentScore encounters skip the cold-start session flow.",
-    quickstart: "https://docs.agentscore.sh/guides/agent-identity",
+    quickstart: "https://docs.agentscore.com/guides/agent-identity",
     identity_check_endpoint: `${api}/v1/credentials`,
     identity_paths: {
       wallet: "If paying from a crypto wallet you have used before on any AgentScore merchant, send `X-Wallet-Address: 0x...`. Shortest path; no token lifecycle to manage.",
-      operator_token: "For any rail (Stripe SPT, card, or a wallet you have not linked yet), send `X-Operator-Token: opc_...`. Reusable across merchants until the token expires."
+      operator_token: "For any rail (Stripe SPT, card, or a wallet you have not linked yet), send `X-Operator-Token: opc_...`. Reusable across merchants until the token expires.",
+      ...acceptsAip && {
+        agent_identity: 'If you hold an AIP Agent Identity Token from a trusted issuer (see aip_trusted_issuers), present it: send the JWT in an `Agent-Identity` header plus an RFC 9421 HTTP Message Signature (Signature-Input + Signature over @method @authority @path agent-identity, tag="agent-identity") signed with the token-bound cnf key. The merchant verifies it and applies its policy \u2014 no separate AgentScore credential needed.'
+      }
     },
+    ...acceptsAip && { aip_trusted_issuers: aipTrustedIssuers },
     bootstrap: "If you have neither a linked wallet nor a valid operator_token, follow the session/verify flow in the per-request `agent_instructions` block. This happens at most once per agent identity \u2014 after first verification, the operator_token and any subsequently used wallet are reusable everywhere.",
     do_not_persist_in_memory: ["operator_token", "poll_secret"],
     persist_in_credential_store: ["operator_token"]
@@ -389,10 +395,11 @@ function buildAgentMemoryHint() {
 
 // src/challenge/agent_memory.ts
 function firstEncounterAgentMemory({
-  firstEncounter
+  firstEncounter,
+  aipTrustedIssuers
 }) {
   if (!firstEncounter) return void 0;
-  return buildAgentMemoryHint();
+  return buildAgentMemoryHint(aipTrustedIssuers);
 }
 
 // src/challenge/body.ts
@@ -418,6 +425,7 @@ function build402Body({
   if (x402) {
     body.x402Version = x402.version ?? 2;
     body.accepts = x402.accepts;
+    if (x402.resource !== void 0) body.resource = x402.resource;
     if (x402.extensions !== void 0 && Object.keys(x402.extensions).length > 0) {
       body.extensions = x402.extensions;
     }
@@ -479,9 +487,17 @@ function normalizeHeadersToLowercase(headers) {
 function paymentRequiredHeader({
   x402Version,
   accepts,
-  resource
+  resource,
+  extensions
 }) {
-  return Buffer.from(JSON.stringify({ x402Version, accepts, ...resource ? { resource } : {} })).toString("base64");
+  return Buffer.from(
+    JSON.stringify({
+      x402Version,
+      accepts,
+      ...resource ? { resource } : {},
+      ...extensions && Object.keys(extensions).length > 0 ? { extensions } : {}
+    })
+  ).toString("base64");
 }
 
 // src/challenge/respond_402.ts