@agent-score/commerce 2.4.0 → 2.6.0

package/dist/index.d.mts

@@ -1,14 +1,19 @@
 import { VerifyWalletSignerResult, DenialReason } from './core.mjs';
 export { AccountVerification, AgentIdentity, AgentMemoryHint, AgentScoreCore, AssessResult, CreateSessionOnMissing, DenialCode, EvaluateOutcome, OperatorVerification, PolicyCheck, PolicyResult, SignerVerdict, buildAgentMemoryHint } from './core.mjs';
 export { P as PaymentSigner, S as SignerNetwork, e as extractPaymentSigner, a as extractPaymentSignerFromAuth, b as extractSignerForPrecheck, r as readX402PaymentHeader } from './signer-3FAit11j.mjs';
-import { q as UCPSigningKey, n as UCPProfile } from './checkout-Bn7ZKIBD.mjs';
-export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildUCPProfile, s as getIdentityStatus, t as makeMppxComposeHook, u as mppPaymentHandler, v as pricingResult, w as stripeSptPaymentHandler, x as validationEnvelope, y as validationResponseExpress, z as validationResponseFastify, B as validationResponseHono, E as validationResponseNextjs, F as validationResponseWeb, H as x402PaymentHandler } from './checkout-Bn7ZKIBD.mjs';
+import { q as UCPSigningKey, n as UCPProfile } from './checkout-CzB9f_jf.mjs';
+export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-CzB9f_jf.mjs';
 export { EnforcementMode, GateResult, IdentityStatus, PolicyBlock, buildGateFromPolicy, runGateWithEnforcement, shippingCountryAllowed, shippingStateAllowed, validateShippingAgainstPolicy } from './identity/policy.mjs';
 import { H as HeadersLike } from './network_kind-C0EMkdzz.mjs';
 export { c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer } from './network_kind-C0EMkdzz.mjs';
 import { T as TempoRailSpec, X as X402BaseRailSpec, S as SolanaMppRailSpec, b as StripeRailSpec } from './rail_spec-BFZmW9RN.mjs';
 export { c as TempoSessionRailSpec } from './rail_spec-BFZmW9RN.mjs';
 import { Context } from 'hono';
+import { l as VerifyRequestContext } from './gate-GCXy4FHI.mjs';
+export { A as AGENTSCORE_CANONICAL_ISSUER, a as AGENT_IDENTITY_HEADER, b as AipErrorRequirements, c as AipGateEvaluation, d as AipGateOptions, e as AipGateResult, H as HARD_MAX_CACHE_SECONDS, J as JWKS_WELL_KNOWN_PATH, f as JwksCache, g as JwksCacheOptions, h as JwksLookupResult, V as VerifiedAit, i as VerifyAitFailure, j as VerifyAitOptions, k as VerifyAitResult, m as aipErrorCode, n as aipErrorStatus, o as buildAipErrorBody, p as buildAipWeakAuthBody, q as canonicalizeIssuer, r as checkTrustRequirements, s as evaluateAipParts, t as evaluateAipRequest, v as verifyAit, u as verifyAitRequest } from './gate-GCXy4FHI.mjs';
+import { JWK } from 'jose';
+export { A as AitHeader, a as AitPayload, b as AitValidationResult, c as AmrValue, I as IdentityClaim, d as IntentClaim, T as TrustLevel, i as isAitShape, v as validateAitPayload } from './types-D1slMt0H.mjs';
+import '@agent-score/sdk';
 import './pricing-KHDqMLd7.mjs';
 import './x402_server-Ciz2mls2.mjs';
 
@@ -207,6 +212,9 @@ declare function denialReasonToBody(reason: DenialReason): Record<string, unknow
  *  `capabilities.extensions[]` to detect UCP support on the agent card. Pinned
  *  to the 2026-04-08 spec snapshot. */
 declare const UCP_A2A_EXTENSION_URI = "https://ucp.dev/2026-04-08/specification/reference";
+/** Canonical URI for the AIP (Agentic Identity Protocol) A2A agent-card extension — points at the
+ *  issuer-discovery well-known so a reader can resolve the protocol. */
+declare const AIP_A2A_EXTENSION_URI = "https://www.agentscore.com/.well-known/agent-identity";
 /** One transport+URL combination the agent exposes. Lives in `AgentCard.additionalInterfaces[]`
  *  for multi-binding agents; the PRIMARY transport+URL pair lives on `AgentCard.url` +
  *  `AgentCard.preferredTransport`. */
@@ -262,6 +270,17 @@ declare function ucpA2AExtension(capabilities?: Record<string, Array<{
 }>>, options?: {
     required?: boolean;
 }): A2AAgentCardExtension;
+/** Build the AIP entry for an A2A agent card's `capabilities.extensions[]`. Advertises that the
+ *  agent accepts an Agent Identity Token (JWT) in an `Agent-Identity` header plus an RFC 9421
+ *  proof-of-possession signature — so an agent discovering via the agent-card learns it can present
+ *  an AIT (matching what the merchant's mpp.json / llms.txt / skill.md already advertise). Optional
+ *  `requiredTrustLevel` / `requiredAmr` surface a gate's human-presence requirement. */
+declare function aipA2AExtension(opts?: {
+    trustedIssuers?: string[];
+    requiredTrustLevel?: 'autonomous' | 'human_present' | 'human_confirmed';
+    requiredAmr?: string[];
+    required?: boolean;
+}): A2AAgentCardExtension;
 /** Optional capabilities the agent supports. */
 interface A2AAgentCardCapabilities {
     extensions?: A2AAgentCardExtension[];
@@ -562,6 +581,8 @@ declare function loadUCPSigningKeyFromEnv({ envJwkVar, envKidVar, envAlgVar, def
     defaultAlg?: 'EdDSA' | 'ES256';
 }): Promise<GeneratedUCPKey>;
 
+declare const normalizeAddress: (address: string) => string;
+
 /**
  * Operator-token hashing.
  *
@@ -586,9 +607,14 @@ type OwnerScope = {
 /**
  * Pull the canonical owner identity from request headers so caller-scoped
  * lookups never see the plaintext operator token. Reads `X-Wallet-Address` and
- * `X-Operator-Token`; returns the wallet address verbatim and the
+ * `X-Operator-Token`; returns the network-normalized wallet address and the
  * sha256 hash of the token. Either or both may be undefined.
  *
+ * The wallet address is normalized via `normalizeAddress` (EVM lowercased,
+ * Solana base58 preserved) so it matches the stored `orders.wallet_address`
+ * column, which persists the lowercased signer. Without normalization, a
+ * checksummed (EIP-55) `X-Wallet-Address` would miss its own order rows (404).
+ *
  * Use at owner-scoped resource queries (`GET /orders/:id`, `GET /receipts/:id`,
  * ...) so persistence + lookup agree on the hashed column shape and plaintext
  * tokens never leave the request.
@@ -927,4 +953,139 @@ declare function createDefaultOnDenied(opts: CreateDefaultOnDeniedOptions): (rea
  */
 declare function defaultReadOnlyOnDenied(reason: DenialReason): DefaultOnDeniedResult;
 
-export { type A2AAgentCard, type A2AAgentCardCapabilities, type A2AAgentCardExtension, type A2AAgentCardSignature, type A2AAgentInterface, type A2AAgentProvider, type A2AAgentSkill, A2A_DEFAULT_TRANSPORT, A2A_PROTOCOL_VERSION, type CachedQuote, CheckoutValidationError, type ComputeFirstHandler, type ComputeFirstMintContext, type ComputeFirstMppContext, type ComputeFirstOptions, type ComputeFirstRails, type ComputeFirstSettledContext, type ComputeFirstWorkContext, type CreateDefaultOnDeniedOptions, type DefaultOnDeniedResult, DenialReason, FIXABLE_DENIAL_REASONS, type GeneratedUCPKey, type JWKSResponse, type MintedRecipients, type OwnerScope, type QuoteCache, type QuoteCacheOptions, type SignedUCPProfile, SolanaMppRailSpec, StripeRailSpec, type SuccessBodyArgs, TempoRailSpec, UCPProfile, UCPSigningKey, UCPVerificationError, UCP_A2A_EXTENSION_URI, VerifyWalletSignerResult, type WorkOutcome, X402BaseRailSpec, buildA2AAgentCard, buildContactSupportNextSteps, buildJWKSResponse, buildSignerMismatchBody, buildVerificationRequiredBody, computeFirstCheckout, createDefaultOnDenied, createQuoteCache, defaultReadOnlyOnDenied, denialReasonStatus, denialReasonToBody, extractOwnerScope, generateUCPSigningKey, hashOperatorToken, isFixableDenial, loadUCPSigningKeyFromEnv, signUCPProfile, ucpA2AExtension, verificationAgentInstructions, verifyUCPProfile };
+/**
+ * RFC 9421 HTTP Message Signatures — the AIP-constrained subset.
+ *
+ * AIP (Agentic Identity Protocol) binds an Agent Identity Token (AIT) to the
+ * agent that presents it: the agent signs each HTTP request with the private key whose
+ * public half is carried in the AIT's `cnf.jwk` (RFC 7800). A verifier reconstructs the
+ * RFC 9421 signature base, verifies it against `cnf.jwk`, and confirms the signature's
+ * `keyid` equals the JWK thumbprint (RFC 7638) of that key. A stolen AIT is then useless
+ * without the bound private key.
+ *
+ * This module implements ONLY the shape AIP uses, not the full RFC 9421 grammar:
+ *
+ *   - Covered components: the derived components `@method`, `@authority`, `@path`, plus the
+ *     `agent-identity` header field. (The AIP "minimum required" set.) Extra components in a
+ *     presented signature are accepted and covered if the caller supplies their values.
+ *   - One labeled signature per request, tagged `tag="agent-identity"`. Web Bot Auth
+ *     signatures (`tag="web-bot-auth"`) may coexist on the same request under a different
+ *     label; we select ours by tag, ignoring the rest.
+ *   - Algorithm: Ed25519 (EdDSA over OKP/Ed25519). AIP's default and only signing curve.
+ *
+ * The structured-field parsing here is deliberately narrow: it parses the AIP member of the
+ * `Signature-Input` / `Signature` dictionaries (a parenthesized inner list + integer/string
+ * params, and a single byte-sequence value). It is not a general RFC 8941 parser.
+ */
+
+/** The AIP "minimum required" covered components, in canonical order. */
+declare const AIP_COVERED_COMPONENTS: readonly ["@method", "@authority", "@path", "agent-identity"];
+/** Tag that identifies the AIP signature among coexisting RFC 9421 signatures. */
+declare const AIP_SIGNATURE_TAG = "agent-identity";
+/** Hard ceiling on the PoP signature's own declared lifetime (`expires - created`), in seconds.
+ *  Requiring `created`+`expires` bounds replay to the declared window — but with no ceiling a
+ *  malicious trusted-issuer agent could set `expires = created + (AIT lifetime)` and replay for the
+ *  full window. Cap it tightly so every accepted PoP is short-lived. First-party `pay` signs a 60s
+ *  window, so it passes; this only bites a signer that declares an over-long PoP. Matches the
+ *  authoritative API verifier's `MAX_POP_WINDOW_SECONDS` (the AgentScore API verifier) so the
+ *  edge (standalone `aipGate`) and the API can't drift. (Distinct from the AIT JWT's `exp - iat`
+ *  ceiling in verify.ts — this is the HTTP-signature layer.) */
+declare const MAX_POP_WINDOW_SECONDS = 120;
+/** Parameters parsed from (or used to build) a `Signature-Input` member. */
+interface SignatureParams {
+    components: string[];
+    created?: number;
+    expires?: number;
+    keyid?: string;
+    tag?: string;
+    alg?: string;
+}
+interface VerifyMessageSignatureInput {
+    /** HTTP method, e.g. `POST`. Case-insensitive; normalized to upper. */
+    method: string;
+    /** Authority (host[:port]), e.g. `wine-merchant.com`. Lowercased; default ports dropped. */
+    authority: string;
+    /** Request path (no query), e.g. `/checkout`. */
+    path: string;
+    /** Raw value of the `Agent-Identity` header the signature covers. */
+    agentIdentity: string;
+    /** Raw `Signature-Input` header value. */
+    signatureInput: string;
+    /** Raw `Signature` header value. */
+    signature: string;
+    /** The agent's public key from the AIT's `cnf.jwk`. */
+    cnfJwk: JWK;
+    /** Wall-clock seconds; defaults to now. Injectable for tests. */
+    now?: number;
+    /** Skew tolerance for created/expires. Defaults to {@link DEFAULT_MAX_SKEW_SECONDS}. */
+    maxSkewSeconds?: number;
+    /** Extra covered-component values, keyed by component name (for components beyond the AIP minimum). */
+    extraComponents?: Record<string, string>;
+}
+type VerifyFailureReason = 'no_aip_signature' | 'malformed_signature_input' | 'malformed_signature' | 'unsupported_alg' | 'missing_keyid' | 'keyid_mismatch' | 'missing_covered_component' | 'created_missing' | 'expires_missing' | 'pop_window_too_long' | 'created_in_future' | 'expired' | 'unsupported_cnf_key' | 'signature_invalid';
+type VerifyMessageSignatureResult = {
+    ok: true;
+    params: SignatureParams;
+} | {
+    ok: false;
+    reason: VerifyFailureReason;
+};
+/**
+ * Verify an AIP HTTP Message Signature. Performs the full check:
+ *   1. select the AIP-tagged member of `Signature-Input`
+ *   2. confirm the AIP minimum covered components are present
+ *   3. REQUIRE both `created` and `expires`, reject an over-long declared window
+ *      (`expires - created` > MAX_POP_WINDOW_SECONDS → `pop_window_too_long`), then enforce them
+ *      against `now` with skew tolerance. Both are mandatory: an optional time bound is no time
+ *      bound — without `expires` a captured `(token, Signature-Input, Signature)` triple is
+ *      replayable for the whole AIT lifetime. A signature omitting either is rejected
+ *      (`created_missing` / `expires_missing`). This matches the authoritative API verifier
+ *      (the AgentScore API verifier) so a merchant running `aipGate` STANDALONE (the
+ *      crypto-identity-only deployment with no `/v1/assess`) gets the same replay defense.
+ *   4. confirm `keyid` equals the RFC 7638 thumbprint of `cnf.jwk`
+ *   5. reconstruct the signature base and verify Ed25519 over it
+ *
+ * NOTE: this is a STATELESS verifier — it bounds the replay WINDOW but does not dedupe within it.
+ * A captured triple can still be replayed until `expires` (≤ MAX_POP_WINDOW_SECONDS + skew from
+ * `created`). A stateful seen-signature cache (as in the authoritative API) is out of scope for the
+ * SDK edge; the tight window bound is the meaningful mitigation here.
+ */
+declare const verifyMessageSignature: (input: VerifyMessageSignatureInput) => Promise<VerifyMessageSignatureResult>;
+interface SignMessageInput {
+    method: string;
+    authority: string;
+    path: string;
+    agentIdentity: string;
+    /** Agent private key (Ed25519 JWK with `d`). */
+    privateJwk: JWK;
+    /** Agent public key; used to derive `keyid` (thumbprint). */
+    publicJwk: JWK;
+    created?: number;
+    expires?: number;
+    /** Signature dictionary label. Defaults to `ait`. */
+    label?: string;
+    components?: string[];
+    extraComponents?: Record<string, string>;
+}
+/** Build the `Signature-Input` and `Signature` header values for an AIP request. */
+declare const signMessage: (input: SignMessageInput) => Promise<{
+    signatureInput: string;
+    signature: string;
+}>;
+
+/**
+ * Build an AIP {@link VerifyRequestContext} from a standard WHATWG `Request`.
+ *
+ * Every framework adapter ultimately has (or can produce) a `Request`: Hono exposes
+ * `c.req.raw`, Next.js / Web Fetch hand you one directly, and Express/Fastify can be shimmed.
+ * This helper centralizes the header + URL extraction so adapters stay thin and the parsing
+ * rules (authority derivation, multiple `Agent-Identity` headers) live in one place.
+ */
+
+/** Build the framework-agnostic verify context from a standard `Request`. A configured
+ *  `authority` pin (e.g. `AipGateOptions.authority`) wins over the inbound `Host` header. */
+declare const buildVerifyContextFromRequest: (req: Request, authority?: string) => VerifyRequestContext;
+/** True when the request carries an AIP credential (at least one `Agent-Identity` header). */
+declare const hasAgentIdentityHeader: (req: Request) => boolean;
+
+export { type A2AAgentCard, type A2AAgentCardCapabilities, type A2AAgentCardExtension, type A2AAgentCardSignature, type A2AAgentInterface, type A2AAgentProvider, type A2AAgentSkill, A2A_DEFAULT_TRANSPORT, A2A_PROTOCOL_VERSION, AIP_A2A_EXTENSION_URI, AIP_COVERED_COMPONENTS, AIP_SIGNATURE_TAG, type CachedQuote, CheckoutValidationError, type ComputeFirstHandler, type ComputeFirstMintContext, type ComputeFirstMppContext, type ComputeFirstOptions, type ComputeFirstRails, type ComputeFirstSettledContext, type ComputeFirstWorkContext, type CreateDefaultOnDeniedOptions, type DefaultOnDeniedResult, DenialReason, FIXABLE_DENIAL_REASONS, type GeneratedUCPKey, type JWKSResponse, MAX_POP_WINDOW_SECONDS, type MintedRecipients, type OwnerScope, type QuoteCache, type QuoteCacheOptions, type SignMessageInput, type SignedUCPProfile, SolanaMppRailSpec, StripeRailSpec, type SuccessBodyArgs, TempoRailSpec, UCPProfile, UCPSigningKey, UCPVerificationError, UCP_A2A_EXTENSION_URI, type VerifyFailureReason, type VerifyMessageSignatureInput, type VerifyMessageSignatureResult, VerifyRequestContext, VerifyWalletSignerResult, type WorkOutcome, X402BaseRailSpec, aipA2AExtension, buildA2AAgentCard, buildContactSupportNextSteps, buildJWKSResponse, buildSignerMismatchBody, buildVerificationRequiredBody, buildVerifyContextFromRequest, computeFirstCheckout, createDefaultOnDenied, createQuoteCache, defaultReadOnlyOnDenied, denialReasonStatus, denialReasonToBody, extractOwnerScope, generateUCPSigningKey, hasAgentIdentityHeader, hashOperatorToken, isFixableDenial, loadUCPSigningKeyFromEnv, normalizeAddress, signMessage, signUCPProfile, ucpA2AExtension, verificationAgentInstructions, verifyMessageSignature, verifyUCPProfile };

package/dist/index.d.ts

@@ -1,14 +1,19 @@
 import { VerifyWalletSignerResult, DenialReason } from './core.js';
 export { AccountVerification, AgentIdentity, AgentMemoryHint, AgentScoreCore, AssessResult, CreateSessionOnMissing, DenialCode, EvaluateOutcome, OperatorVerification, PolicyCheck, PolicyResult, SignerVerdict, buildAgentMemoryHint } from './core.js';
 export { P as PaymentSigner, S as SignerNetwork, e as extractPaymentSigner, a as extractPaymentSignerFromAuth, b as extractSignerForPrecheck, r as readX402PaymentHeader } from './signer-3FAit11j.js';
-import { q as UCPSigningKey, n as UCPProfile } from './checkout-B-MIzYzW.js';
-export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildUCPProfile, s as getIdentityStatus, t as makeMppxComposeHook, u as mppPaymentHandler, v as pricingResult, w as stripeSptPaymentHandler, x as validationEnvelope, y as validationResponseExpress, z as validationResponseFastify, B as validationResponseHono, E as validationResponseNextjs, F as validationResponseWeb, H as x402PaymentHandler } from './checkout-B-MIzYzW.js';
+import { q as UCPSigningKey, n as UCPProfile } from './checkout-C4RD7M0Z.js';
+export { A as AGENTSCORE_UCP_CAPABILITY, a as AgentScoreGatePolicy, C as Checkout, b as CheckoutContext, c as CheckoutGateConfig, d as CheckoutRailSpec, e as CheckoutRequest, f as CheckoutResult, g as ComposeMppxFn, D as DiscoveryProbeConfig, G as GateDenial, I as IsCachedAddressFn, M as MountUcpRoutesOptions, h as MppxComposeOutcome, O as OnSettledFn, P as PreValidateFn, i as PricingFn, j as PricingResult, R as RecipientsFn, k as ReferenceIdFn, l as RunGateFn, S as SettleOutcome, U as UCPCapabilityBinding, m as UCPPaymentHandlerBinding, o as UCPProfileBody, p as UCPServiceBinding, r as buildAipTrustedIssuers, s as buildUCPProfile, t as getIdentityStatus, u as makeMppxComposeHook, v as mppPaymentHandler, w as pricingResult, x as stripeSptPaymentHandler, y as validationEnvelope, z as validationResponseExpress, B as validationResponseFastify, E as validationResponseHono, F as validationResponseNextjs, H as validationResponseWeb, J as x402PaymentHandler } from './checkout-C4RD7M0Z.js';
 export { EnforcementMode, GateResult, IdentityStatus, PolicyBlock, buildGateFromPolicy, runGateWithEnforcement, shippingCountryAllowed, shippingStateAllowed, validateShippingAgainstPolicy } from './identity/policy.js';
 import { H as HeadersLike } from './network_kind-BIJM2peR.js';
 export { c as buildDefaultCheckoutRails, d as buildMppxComposeRails, f as formatUsdCents, h as hasMppxHeader, e as hasPaymentHeader, g as hasX402Header, i as isEvmNetwork, j as isSolanaNetwork, l as loadSolanaFeePayer } from './network_kind-BIJM2peR.js';
 import { T as TempoRailSpec, X as X402BaseRailSpec, S as SolanaMppRailSpec, b as StripeRailSpec } from './rail_spec-BFZmW9RN.js';
 export { c as TempoSessionRailSpec } from './rail_spec-BFZmW9RN.js';
 import { Context } from 'hono';
+import { l as VerifyRequestContext } from './gate-D2RP6bZg.js';
+export { A as AGENTSCORE_CANONICAL_ISSUER, a as AGENT_IDENTITY_HEADER, b as AipErrorRequirements, c as AipGateEvaluation, d as AipGateOptions, e as AipGateResult, H as HARD_MAX_CACHE_SECONDS, J as JWKS_WELL_KNOWN_PATH, f as JwksCache, g as JwksCacheOptions, h as JwksLookupResult, V as VerifiedAit, i as VerifyAitFailure, j as VerifyAitOptions, k as VerifyAitResult, m as aipErrorCode, n as aipErrorStatus, o as buildAipErrorBody, p as buildAipWeakAuthBody, q as canonicalizeIssuer, r as checkTrustRequirements, s as evaluateAipParts, t as evaluateAipRequest, v as verifyAit, u as verifyAitRequest } from './gate-D2RP6bZg.js';
+import { JWK } from 'jose';
+export { A as AitHeader, a as AitPayload, b as AitValidationResult, c as AmrValue, I as IdentityClaim, d as IntentClaim, T as TrustLevel, i as isAitShape, v as validateAitPayload } from './types-D1slMt0H.js';
+import '@agent-score/sdk';
 import './pricing-CytRwhC2.js';
 import './x402_server-Ciz2mls2.js';
 
@@ -207,6 +212,9 @@ declare function denialReasonToBody(reason: DenialReason): Record<string, unknow
  *  `capabilities.extensions[]` to detect UCP support on the agent card. Pinned
  *  to the 2026-04-08 spec snapshot. */
 declare const UCP_A2A_EXTENSION_URI = "https://ucp.dev/2026-04-08/specification/reference";
+/** Canonical URI for the AIP (Agentic Identity Protocol) A2A agent-card extension — points at the
+ *  issuer-discovery well-known so a reader can resolve the protocol. */
+declare const AIP_A2A_EXTENSION_URI = "https://www.agentscore.com/.well-known/agent-identity";
 /** One transport+URL combination the agent exposes. Lives in `AgentCard.additionalInterfaces[]`
  *  for multi-binding agents; the PRIMARY transport+URL pair lives on `AgentCard.url` +
  *  `AgentCard.preferredTransport`. */
@@ -262,6 +270,17 @@ declare function ucpA2AExtension(capabilities?: Record<string, Array<{
 }>>, options?: {
     required?: boolean;
 }): A2AAgentCardExtension;
+/** Build the AIP entry for an A2A agent card's `capabilities.extensions[]`. Advertises that the
+ *  agent accepts an Agent Identity Token (JWT) in an `Agent-Identity` header plus an RFC 9421
+ *  proof-of-possession signature — so an agent discovering via the agent-card learns it can present
+ *  an AIT (matching what the merchant's mpp.json / llms.txt / skill.md already advertise). Optional
+ *  `requiredTrustLevel` / `requiredAmr` surface a gate's human-presence requirement. */
+declare function aipA2AExtension(opts?: {
+    trustedIssuers?: string[];
+    requiredTrustLevel?: 'autonomous' | 'human_present' | 'human_confirmed';
+    requiredAmr?: string[];
+    required?: boolean;
+}): A2AAgentCardExtension;
 /** Optional capabilities the agent supports. */
 interface A2AAgentCardCapabilities {
     extensions?: A2AAgentCardExtension[];
@@ -562,6 +581,8 @@ declare function loadUCPSigningKeyFromEnv({ envJwkVar, envKidVar, envAlgVar, def
     defaultAlg?: 'EdDSA' | 'ES256';
 }): Promise<GeneratedUCPKey>;
 
+declare const normalizeAddress: (address: string) => string;
+
 /**
  * Operator-token hashing.
  *
@@ -586,9 +607,14 @@ type OwnerScope = {
 /**
  * Pull the canonical owner identity from request headers so caller-scoped
  * lookups never see the plaintext operator token. Reads `X-Wallet-Address` and
- * `X-Operator-Token`; returns the wallet address verbatim and the
+ * `X-Operator-Token`; returns the network-normalized wallet address and the
  * sha256 hash of the token. Either or both may be undefined.
  *
+ * The wallet address is normalized via `normalizeAddress` (EVM lowercased,
+ * Solana base58 preserved) so it matches the stored `orders.wallet_address`
+ * column, which persists the lowercased signer. Without normalization, a
+ * checksummed (EIP-55) `X-Wallet-Address` would miss its own order rows (404).
+ *
  * Use at owner-scoped resource queries (`GET /orders/:id`, `GET /receipts/:id`,
  * ...) so persistence + lookup agree on the hashed column shape and plaintext
  * tokens never leave the request.
@@ -927,4 +953,139 @@ declare function createDefaultOnDenied(opts: CreateDefaultOnDeniedOptions): (rea
  */
 declare function defaultReadOnlyOnDenied(reason: DenialReason): DefaultOnDeniedResult;
 
-export { type A2AAgentCard, type A2AAgentCardCapabilities, type A2AAgentCardExtension, type A2AAgentCardSignature, type A2AAgentInterface, type A2AAgentProvider, type A2AAgentSkill, A2A_DEFAULT_TRANSPORT, A2A_PROTOCOL_VERSION, type CachedQuote, CheckoutValidationError, type ComputeFirstHandler, type ComputeFirstMintContext, type ComputeFirstMppContext, type ComputeFirstOptions, type ComputeFirstRails, type ComputeFirstSettledContext, type ComputeFirstWorkContext, type CreateDefaultOnDeniedOptions, type DefaultOnDeniedResult, DenialReason, FIXABLE_DENIAL_REASONS, type GeneratedUCPKey, type JWKSResponse, type MintedRecipients, type OwnerScope, type QuoteCache, type QuoteCacheOptions, type SignedUCPProfile, SolanaMppRailSpec, StripeRailSpec, type SuccessBodyArgs, TempoRailSpec, UCPProfile, UCPSigningKey, UCPVerificationError, UCP_A2A_EXTENSION_URI, VerifyWalletSignerResult, type WorkOutcome, X402BaseRailSpec, buildA2AAgentCard, buildContactSupportNextSteps, buildJWKSResponse, buildSignerMismatchBody, buildVerificationRequiredBody, computeFirstCheckout, createDefaultOnDenied, createQuoteCache, defaultReadOnlyOnDenied, denialReasonStatus, denialReasonToBody, extractOwnerScope, generateUCPSigningKey, hashOperatorToken, isFixableDenial, loadUCPSigningKeyFromEnv, signUCPProfile, ucpA2AExtension, verificationAgentInstructions, verifyUCPProfile };
+/**
+ * RFC 9421 HTTP Message Signatures — the AIP-constrained subset.
+ *
+ * AIP (Agentic Identity Protocol) binds an Agent Identity Token (AIT) to the
+ * agent that presents it: the agent signs each HTTP request with the private key whose
+ * public half is carried in the AIT's `cnf.jwk` (RFC 7800). A verifier reconstructs the
+ * RFC 9421 signature base, verifies it against `cnf.jwk`, and confirms the signature's
+ * `keyid` equals the JWK thumbprint (RFC 7638) of that key. A stolen AIT is then useless
+ * without the bound private key.
+ *
+ * This module implements ONLY the shape AIP uses, not the full RFC 9421 grammar:
+ *
+ *   - Covered components: the derived components `@method`, `@authority`, `@path`, plus the
+ *     `agent-identity` header field. (The AIP "minimum required" set.) Extra components in a
+ *     presented signature are accepted and covered if the caller supplies their values.
+ *   - One labeled signature per request, tagged `tag="agent-identity"`. Web Bot Auth
+ *     signatures (`tag="web-bot-auth"`) may coexist on the same request under a different
+ *     label; we select ours by tag, ignoring the rest.
+ *   - Algorithm: Ed25519 (EdDSA over OKP/Ed25519). AIP's default and only signing curve.
+ *
+ * The structured-field parsing here is deliberately narrow: it parses the AIP member of the
+ * `Signature-Input` / `Signature` dictionaries (a parenthesized inner list + integer/string
+ * params, and a single byte-sequence value). It is not a general RFC 8941 parser.
+ */
+
+/** The AIP "minimum required" covered components, in canonical order. */
+declare const AIP_COVERED_COMPONENTS: readonly ["@method", "@authority", "@path", "agent-identity"];
+/** Tag that identifies the AIP signature among coexisting RFC 9421 signatures. */
+declare const AIP_SIGNATURE_TAG = "agent-identity";
+/** Hard ceiling on the PoP signature's own declared lifetime (`expires - created`), in seconds.
+ *  Requiring `created`+`expires` bounds replay to the declared window — but with no ceiling a
+ *  malicious trusted-issuer agent could set `expires = created + (AIT lifetime)` and replay for the
+ *  full window. Cap it tightly so every accepted PoP is short-lived. First-party `pay` signs a 60s
+ *  window, so it passes; this only bites a signer that declares an over-long PoP. Matches the
+ *  authoritative API verifier's `MAX_POP_WINDOW_SECONDS` (the AgentScore API verifier) so the
+ *  edge (standalone `aipGate`) and the API can't drift. (Distinct from the AIT JWT's `exp - iat`
+ *  ceiling in verify.ts — this is the HTTP-signature layer.) */
+declare const MAX_POP_WINDOW_SECONDS = 120;
+/** Parameters parsed from (or used to build) a `Signature-Input` member. */
+interface SignatureParams {
+    components: string[];
+    created?: number;
+    expires?: number;
+    keyid?: string;
+    tag?: string;
+    alg?: string;
+}
+interface VerifyMessageSignatureInput {
+    /** HTTP method, e.g. `POST`. Case-insensitive; normalized to upper. */
+    method: string;
+    /** Authority (host[:port]), e.g. `wine-merchant.com`. Lowercased; default ports dropped. */
+    authority: string;
+    /** Request path (no query), e.g. `/checkout`. */
+    path: string;
+    /** Raw value of the `Agent-Identity` header the signature covers. */
+    agentIdentity: string;
+    /** Raw `Signature-Input` header value. */
+    signatureInput: string;
+    /** Raw `Signature` header value. */
+    signature: string;
+    /** The agent's public key from the AIT's `cnf.jwk`. */
+    cnfJwk: JWK;
+    /** Wall-clock seconds; defaults to now. Injectable for tests. */
+    now?: number;
+    /** Skew tolerance for created/expires. Defaults to {@link DEFAULT_MAX_SKEW_SECONDS}. */
+    maxSkewSeconds?: number;
+    /** Extra covered-component values, keyed by component name (for components beyond the AIP minimum). */
+    extraComponents?: Record<string, string>;
+}
+type VerifyFailureReason = 'no_aip_signature' | 'malformed_signature_input' | 'malformed_signature' | 'unsupported_alg' | 'missing_keyid' | 'keyid_mismatch' | 'missing_covered_component' | 'created_missing' | 'expires_missing' | 'pop_window_too_long' | 'created_in_future' | 'expired' | 'unsupported_cnf_key' | 'signature_invalid';
+type VerifyMessageSignatureResult = {
+    ok: true;
+    params: SignatureParams;
+} | {
+    ok: false;
+    reason: VerifyFailureReason;
+};
+/**
+ * Verify an AIP HTTP Message Signature. Performs the full check:
+ *   1. select the AIP-tagged member of `Signature-Input`
+ *   2. confirm the AIP minimum covered components are present
+ *   3. REQUIRE both `created` and `expires`, reject an over-long declared window
+ *      (`expires - created` > MAX_POP_WINDOW_SECONDS → `pop_window_too_long`), then enforce them
+ *      against `now` with skew tolerance. Both are mandatory: an optional time bound is no time
+ *      bound — without `expires` a captured `(token, Signature-Input, Signature)` triple is
+ *      replayable for the whole AIT lifetime. A signature omitting either is rejected
+ *      (`created_missing` / `expires_missing`). This matches the authoritative API verifier
+ *      (the AgentScore API verifier) so a merchant running `aipGate` STANDALONE (the
+ *      crypto-identity-only deployment with no `/v1/assess`) gets the same replay defense.
+ *   4. confirm `keyid` equals the RFC 7638 thumbprint of `cnf.jwk`
+ *   5. reconstruct the signature base and verify Ed25519 over it
+ *
+ * NOTE: this is a STATELESS verifier — it bounds the replay WINDOW but does not dedupe within it.
+ * A captured triple can still be replayed until `expires` (≤ MAX_POP_WINDOW_SECONDS + skew from
+ * `created`). A stateful seen-signature cache (as in the authoritative API) is out of scope for the
+ * SDK edge; the tight window bound is the meaningful mitigation here.
+ */
+declare const verifyMessageSignature: (input: VerifyMessageSignatureInput) => Promise<VerifyMessageSignatureResult>;
+interface SignMessageInput {
+    method: string;
+    authority: string;
+    path: string;
+    agentIdentity: string;
+    /** Agent private key (Ed25519 JWK with `d`). */
+    privateJwk: JWK;
+    /** Agent public key; used to derive `keyid` (thumbprint). */
+    publicJwk: JWK;
+    created?: number;
+    expires?: number;
+    /** Signature dictionary label. Defaults to `ait`. */
+    label?: string;
+    components?: string[];
+    extraComponents?: Record<string, string>;
+}
+/** Build the `Signature-Input` and `Signature` header values for an AIP request. */
+declare const signMessage: (input: SignMessageInput) => Promise<{
+    signatureInput: string;
+    signature: string;
+}>;
+
+/**
+ * Build an AIP {@link VerifyRequestContext} from a standard WHATWG `Request`.
+ *
+ * Every framework adapter ultimately has (or can produce) a `Request`: Hono exposes
+ * `c.req.raw`, Next.js / Web Fetch hand you one directly, and Express/Fastify can be shimmed.
+ * This helper centralizes the header + URL extraction so adapters stay thin and the parsing
+ * rules (authority derivation, multiple `Agent-Identity` headers) live in one place.
+ */
+
+/** Build the framework-agnostic verify context from a standard `Request`. A configured
+ *  `authority` pin (e.g. `AipGateOptions.authority`) wins over the inbound `Host` header. */
+declare const buildVerifyContextFromRequest: (req: Request, authority?: string) => VerifyRequestContext;
+/** True when the request carries an AIP credential (at least one `Agent-Identity` header). */
+declare const hasAgentIdentityHeader: (req: Request) => boolean;
+
+export { type A2AAgentCard, type A2AAgentCardCapabilities, type A2AAgentCardExtension, type A2AAgentCardSignature, type A2AAgentInterface, type A2AAgentProvider, type A2AAgentSkill, A2A_DEFAULT_TRANSPORT, A2A_PROTOCOL_VERSION, AIP_A2A_EXTENSION_URI, AIP_COVERED_COMPONENTS, AIP_SIGNATURE_TAG, type CachedQuote, CheckoutValidationError, type ComputeFirstHandler, type ComputeFirstMintContext, type ComputeFirstMppContext, type ComputeFirstOptions, type ComputeFirstRails, type ComputeFirstSettledContext, type ComputeFirstWorkContext, type CreateDefaultOnDeniedOptions, type DefaultOnDeniedResult, DenialReason, FIXABLE_DENIAL_REASONS, type GeneratedUCPKey, type JWKSResponse, MAX_POP_WINDOW_SECONDS, type MintedRecipients, type OwnerScope, type QuoteCache, type QuoteCacheOptions, type SignMessageInput, type SignedUCPProfile, SolanaMppRailSpec, StripeRailSpec, type SuccessBodyArgs, TempoRailSpec, UCPProfile, UCPSigningKey, UCPVerificationError, UCP_A2A_EXTENSION_URI, type VerifyFailureReason, type VerifyMessageSignatureInput, type VerifyMessageSignatureResult, VerifyRequestContext, VerifyWalletSignerResult, type WorkOutcome, X402BaseRailSpec, aipA2AExtension, buildA2AAgentCard, buildContactSupportNextSteps, buildJWKSResponse, buildSignerMismatchBody, buildVerificationRequiredBody, buildVerifyContextFromRequest, computeFirstCheckout, createDefaultOnDenied, createQuoteCache, defaultReadOnlyOnDenied, denialReasonStatus, denialReasonToBody, extractOwnerScope, generateUCPSigningKey, hasAgentIdentityHeader, hashOperatorToken, isFixableDenial, loadUCPSigningKeyFromEnv, normalizeAddress, signMessage, signUCPProfile, ucpA2AExtension, verificationAgentInstructions, verifyMessageSignature, verifyUCPProfile };