@agent-score/commerce 2.4.0 → 2.6.0

package/dist/{checkout-B-MIzYzW.d.ts → checkout-C4RD7M0Z.d.ts}

@@ -2,6 +2,7 @@ import { T as TempoRailSpec, S as SolanaMppRailSpec, c as TempoSessionRailSpec,
 import { P as PricingBlock, R as RailKey } from './pricing-CytRwhC2.js';
 import { CreateSessionOnMissing, AgentScoreCoreOptions, DenialReason } from './core.js';
 import { a as X402Server } from './x402_server-Ciz2mls2.js';
+import { T as TrustLevel } from './types-D1slMt0H.js';
 
 /**
  * UCP (Universal Commerce Protocol) profile builder.
@@ -11,7 +12,7 @@ import { a as X402Server } from './x402_server-Ciz2mls2.js';
  * envelope, with `services` / `capabilities` / `payment_handlers` as MAPs keyed by
  * reverse-DNS service / capability / handler name.
  *
- * AgentScore identity claims layer over UCP via the `sh.agentscore.identity` capability
+ * AgentScore identity claims layer over UCP via the `com.agentscore.identity` capability
  * (vendor-namespaced; UCP doesn't define KYC/sanctions/age/jurisdiction natively). The
  * capability extends `dev.ucp.shopping.checkout` AND `dev.ucp.shopping.cart` (multi-parent,
  * the standard pattern UCP allows for capabilities that compose multiple parents).
@@ -160,7 +161,7 @@ interface BuildUCPProfileInput {
     /** Services map, keyed by service name. UCP-shopping merchants typically advertise
      *  bindings under `'dev.ucp.shopping'`. */
     services?: Record<string, UCPServiceBinding[]>;
-    /** Capabilities map, keyed by capability name. The `sh.agentscore.identity` capability
+    /** Capabilities map, keyed by capability name. The `com.agentscore.identity` capability
      *  is auto-added when `agentscore_gate` is provided. */
     capabilities?: Record<string, UCPCapabilityBinding[]>;
     /** Payment handlers map, keyed by handler reverse-DNS name. */
@@ -168,7 +169,7 @@ interface BuildUCPProfileInput {
     /** JWKS — public keys the merchant signs with. REQUIRED by spec. */
     signing_keys: UCPSigningKey[];
     /** Merchant gate policy declaration. When provided, the SDK auto-injects an
-     *  `sh.agentscore.identity` capability binding into `capabilities`, with the
+     *  `com.agentscore.identity` capability binding into `capabilities`, with the
      *  policy as the binding's `config`. Static merchant declaration only — no
      *  per-operator data ever ends up on the public profile. Per-operator identity
      *  attestation lives on the AP2 risk-signal endpoint, not here. */
@@ -186,7 +187,7 @@ interface BuildUCPProfileInput {
     /** Vendor-specific extras INSIDE the `ucp` envelope (alongside `version`, `services`, etc.). */
     ucp_extras?: Record<string, unknown>;
 }
-/** Merchant gate policy declared on the UCP profile via `sh.agentscore.identity` capability config.
+/** Merchant gate policy declared on the UCP profile via `com.agentscore.identity` capability config.
  *  All fields optional; merchant declares which AgentScore checks the gate enforces. Snake-case
  *  field names match the AgentScore API's `/v1/assess` policy contract verbatim — no conversion
  *  layer between this declaration and what the gate actually enforces at runtime. */
@@ -210,7 +211,7 @@ interface AgentScoreGatePolicy {
  * signing_keys: [...] }`. Pass through `signUCPProfile` to attach a JWS signature for
  * trust-mode verifiers.
  *
- * Auto-injects `sh.agentscore.identity` as a vendor capability extending both
+ * Auto-injects `com.agentscore.identity` as a vendor capability extending both
  * `dev.ucp.shopping.checkout` and `dev.ucp.shopping.cart` when `agentscore_gate`
  * is provided. The capability's `config` carries the merchant's static gate
  * policy declaration (require_kyc / require_sanctions_clear / min_age /
@@ -240,10 +241,10 @@ interface AgentScoreGatePolicy {
  * ```
  */
 declare function buildUCPProfile(input: BuildUCPProfileInput): UCPProfile;
-declare const AGENTSCORE_UCP_CAPABILITY = "sh.agentscore.identity";
+declare const AGENTSCORE_UCP_CAPABILITY = "com.agentscore.identity";
 type MppRailSpec = TempoRailSpec | SolanaMppRailSpec | TempoSessionRailSpec;
 /**
- * Build the `sh.agentscore.payment.mpp` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.mpp` payment handler block for a UCP profile.
  *
  * Pass any mix of `TempoRailSpec`, `SolanaMppRailSpec`, and `TempoSessionRailSpec`.
  *
@@ -266,7 +267,7 @@ declare function mppPaymentHandler({ networks, }: {
     networks: MppRailSpec[];
 }): Record<string, UCPPaymentHandlerBinding[]>;
 /**
- * Build the `sh.agentscore.payment.x402` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.x402` payment handler block for a UCP profile.
  *
  * @example
  * ```ts
@@ -282,7 +283,7 @@ declare function x402PaymentHandler({ networks, }: {
     networks: X402BaseRailSpec[];
 }): Record<string, UCPPaymentHandlerBinding[]>;
 /**
- * Build the `sh.agentscore.payment.stripe_spt` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.stripe_spt` payment handler block for a UCP profile.
  *
  * @example
  * ```ts
@@ -534,7 +535,7 @@ type RunGateFn = (ctx: CheckoutContext) => Promise<GateDenial | null>;
 interface CheckoutGateConfig {
     /** AgentScore API key. Required when `runGate` is omitted. */
     apiKey?: string;
-    /** Override the default `https://api.agentscore.sh` base URL. */
+    /** Override the default `https://api.agentscore.com` base URL. */
     baseUrl?: string;
     /** Prepended to the default User-Agent on API calls. */
     userAgent?: string;
@@ -569,9 +570,73 @@ interface CheckoutGateConfig {
      *  DenialReason. Return a `GateDenial` to override the canonical body, or
      *  null to use `denialReasonToBody`. */
     onDenied?: (ctx: CheckoutContext, reason: DenialReason) => GateDenial | null | Promise<GateDenial | null>;
+    /** Accept AIP Agent Identity Tokens (AITs) on this route. When set and a request carries
+     *  an `Agent-Identity` header, the gate verifies the token offline (issuer signature via the
+     *  trusted-issuer JWKS + RFC 9421 proof-of-possession) BEFORE the assess call, then sends the
+     *  raw token to `/v1/assess` as `aip_token` so the same wine/age/sanctions policy evaluates
+     *  against the token's attested identity. A present-but-invalid AIT is a hard deny (the gate
+     *  does NOT fall through to wallet / operator-token). Requests with no `Agent-Identity` header
+     *  use the existing wallet / operator-token path unchanged.
+     *
+     *  Ignored when `runGate` is also set (a custom gate fully owns the flow). Without an `apiKey`,
+     *  a verified AIT is honored offline for identity-only gates, but a gate that declares policy
+     *  fields (KYC / age / sanctions / jurisdiction) without an `apiKey` fails closed
+     *  (`aip_policy_requires_api_key`) since policy can only be evaluated via `/v1/assess`. */
+    aip?: AipGateConfig;
     /** Full escape hatch — replaces the SDK gate flow. */
     runGate?: RunGateFn;
 }
+/** AIP acceptance config for {@link CheckoutGateConfig.aip}. */
+interface AipGateConfig {
+    /** ADDITIONAL external issuers to trust beyond AgentScore's own (e.g. `['https://issuer.example']`),
+     *  matched after canonicalization. AgentScore's canonical issuer
+     *  ({@link AGENTSCORE_CANONICAL_ISSUER}) is ALWAYS trusted and never needs listing — this SDK
+     *  is the AgentScore verifier, so a merchant can't accidentally fail to trust AgentScore AITs.
+     *  Omit/empty to accept only AgentScore-issued AITs. */
+    trustedIssuers?: string[];
+    /** Clock-skew tolerance in seconds for the RFC 9421 signature window (and, as an override,
+     *  the AIT JWT `exp`/`iat`). Defaults to 60s for both. */
+    maxSkewSeconds?: number;
+    /** Expected `@authority` (public hostname) the RFC 9421 signature must cover. When set, the
+     *  verifier binds the signature to this value instead of trusting the inbound `Host` header —
+     *  pin it to your real public host (e.g. `'wine.example.com'`) when behind a proxy that does
+     *  not normalize `Host`, to prevent a captured AIT+signature from being replayed to a
+     *  different virtual host on the same origin. */
+    authority?: string;
+    /** Minimum `trust_level` an AIT must assert to pass this gate (autonomous < human_present <
+     *  human_confirmed) — the spec's human-presence gate (e.g. require `human_confirmed` for
+     *  checkout). Enforced at the edge from the verified token; insufficient → 403 weak_auth with
+     *  `required_trust_level`. Unset = any trust level accepted. */
+    requireTrustLevel?: TrustLevel;
+    /** Acceptable `auth.amr` methods (RFC 8176); the AIT must carry at least one (e.g.
+     *  `['face','fpt','hwk']` to require strong human auth). Insufficient → 403 weak_auth with
+     *  `required_amr`. Unset = not enforced. */
+    requireAmr?: string[];
+    /** Per-issuer compliance policy override, keyed by issuer URL (canonicalized before lookup).
+     *  When a request's AIT is verified and its `iss` matches a key here, that block REPLACES the
+     *  gate's default policy fields (`requireKyc` / `requireSanctionsClear` / `minAge` /
+     *  `allowed/blockedJurisdictions`) for that request — letting a merchant apply different rules
+     *  by issuer (e.g. full compliance for its own AITs, a relaxed set for a partner issuer whose
+     *  tokens carry fewer attested claims). The replacement is whole-policy, not a merge: an issuer
+     *  block of `{ requireKyc: true, minAge: 21 }` evaluates ONLY those two rules for that issuer
+     *  (sanctions / jurisdiction omitted → not enforced for that issuer). Issuers NOT listed here
+     *  use the gate's default policy unchanged. Only the AIT path consults this — wallet /
+     *  operator-token requests are unaffected.
+     *
+     *  This is a deliberate compliance posture per issuer, not a default; an empty/absent map keeps
+     *  every issuer on the gate's default policy. */
+    issuerPolicies?: Record<string, AipIssuerPolicy>;
+}
+/** A per-issuer compliance policy block for {@link AipGateConfig.issuerPolicies}. The same
+ *  compliance fields as the gate, applied (as a whole-policy replacement) only to AITs from the
+ *  matching issuer. */
+interface AipIssuerPolicy {
+    requireKyc?: boolean;
+    requireSanctionsClear?: boolean;
+    minAge?: number;
+    blockedJurisdictions?: string[];
+    allowedJurisdictions?: string[];
+}
 /** Surface passed to `Checkout.onSettled` after a payment lands. */
 interface SettleOutcome {
     /** Protocol family that handled the settle. */
@@ -663,6 +728,18 @@ type IsCachedAddressFn = (address: string) => boolean | Promise<boolean>;
 declare function makeMppxComposeHook(opts: {
     serverGetter: () => Promise<unknown>;
 }): ComposeMppxFn;
+/** Resolve a per-issuer compliance-policy override for a verified AIT's issuer. Both the verified
+ *  `iss` and the map keys are canonicalized (lowercase scheme+host, no default port / trailing
+ *  slash) before comparison so `https://issuer.example` and `https://issuer.example/` resolve the same.
+ *  Returns the matching policy block, or undefined when the issuer is not overridden (→ caller
+ *  falls back to the gate's default policy). */
+/** The effective AIP trusted-issuer list: AgentScore's canonical issuer (ALWAYS trusted) plus any
+ *  external issuers. De-duped after canonicalization. Use this for the `agent_memory` hint and any
+ *  presentation surface (llms.txt / mpp.json / skill.md) that advertises AIP acceptance, so a
+ *  merchant relying solely on AgentScore AITs (no external issuers) still advertises the
+ *  `agent_identity` path. Trust enforcement itself lives in {@link JwksCache}, which merges the
+ *  canonical issuer independently. */
+declare function buildAipTrustedIssuers(externalIssuers?: string[]): string[];
 /**
  * Framework-neutral 4xx envelope (`{ error, next_steps, agent_instructions }`).
  *
@@ -733,11 +810,25 @@ declare class Checkout {
     readonly mintReferenceId: ReferenceIdFn | undefined;
     readonly onSettled: OnSettledFn | undefined;
     readonly isCachedAddress: IsCachedAddressFn | undefined;
+    /** Lowercased static recipient addresses for the x402-base rail(s). When the merchant
+     *  configured a static recipient and supplied no `isCachedAddress`, the gate binds the
+     *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
+    private readonly x402StaticRecipients;
     readonly zeroSettleCarveOut: boolean;
     readonly gate: CheckoutGateConfig | undefined;
     readonly discoveryExtensions: Record<string, unknown> | undefined;
+    readonly resourceInfo: {
+        serviceName?: string;
+        tags?: string[];
+        iconUrl?: string;
+        description?: string;
+    } | undefined;
     readonly discoveryProbe: DiscoveryProbeConfig | undefined;
     private _x402ServerGetter;
+    /** Lazily-built JWKS cache for AIP verification, shared across requests so issuer keys
+     *  are fetched once and cached (per the verifier's hard 24h cap). Built on first AIT. */
+    private aipJwks;
+    private getAipJwks;
     /**
      * True when the merchant has configured an identity-bearing policy flag —
      * `require_kyc`, `require_sanctions_clear` (name screening on the KYC
@@ -782,7 +873,10 @@ declare class Checkout {
         /** Runs after a settle lands; can return an inline response body for API sellers. */
         onSettled?: OnSettledFn;
         /** Pass when the merchant mints per-order addresses so `verifyX402Request` can
-         *  confirm the `payTo` was minted by this merchant. Defaults to permissive. */
+         *  confirm the `payTo` was minted by this merchant (e.g. `piCache.hasAddress`).
+         *  When omitted, Checkout auto-binds the agent-supplied `payTo` to the rail's
+         *  configured STATIC recipient(s) — the permissive default applies ONLY when no
+         *  static recipient exists (pure per-order minting). */
         isCachedAddress?: IsCachedAddressFn;
         /** Engage the EIP-3009 value=0 + pympp `proof` carve-out when pricing
          *  resolves to $0. Goods merchants offering free redemption codes set this
@@ -798,6 +892,16 @@ declare class Checkout {
          *  `extensions` field so Bazaar crawlers and other spec-compliant clients
          *  read the route's declared input/output schema. */
         discoveryExtensions?: Record<string, unknown>;
+        /** Optional x402 v2 ResourceInfo metadata advertised on the 402 (both the
+         *  body and the PAYMENT-REQUIRED header): `serviceName` / `tags` (max 5) /
+         *  `iconUrl` / `description`, used by Bazaar search + filtering. `url` and
+         *  `mimeType` are filled automatically from the request. */
+        resourceInfo?: {
+            serviceName?: string;
+            tags?: string[];
+            iconUrl?: string;
+            description?: string;
+        };
         /** Optional discovery-probe config: auto-route empty-body POSTs without a
          *  payment header to a sample 402 advertising the merchant's shape for
          *  crawlers (`awal x402 details`, x402-proxy, x402scan, ...). */
@@ -844,7 +948,7 @@ declare class Checkout {
      *   - `AGENTSCORE_API_KEY` — required. No key → one-time warning + skip
      *     (dev/testnet pattern; production should always configure a key).
      *   - `AGENTSCORE_BASE_URL` — optional override for staging/dev API
-     *     (e.g. `https://api-dev.agentscore.sh` or `http://localhost:3002`).
+     *     (e.g. `https://api.staging.example` or `http://localhost:3002`).
      *
      * Stripe SPT (no extractable wallet signer) → skip silently; Stripe runs
      * its own OFAC screen on the buyer's Stripe account at customer creation.
@@ -955,4 +1059,4 @@ interface MountUcpRoutesOptions {
     jwksPath?: string;
 }
 
-export { AGENTSCORE_UCP_CAPABILITY as A, validationResponseHono as B, Checkout as C, type DiscoveryProbeConfig as D, validationResponseNextjs as E, validationResponseWeb as F, type GateDenial as G, x402PaymentHandler as H, type IsCachedAddressFn as I, type MountUcpRoutesOptions as M, type OnSettledFn as O, type PreValidateFn as P, type RecipientsFn as R, type SettleOutcome as S, type UCPCapabilityBinding as U, type AgentScoreGatePolicy as a, type CheckoutContext as b, type CheckoutGateConfig as c, type CheckoutRailSpec as d, type CheckoutRequest as e, type CheckoutResult as f, type ComposeMppxFn as g, type MppxComposeOutcome as h, type PricingFn as i, type PricingResult as j, type ReferenceIdFn as k, type RunGateFn as l, type UCPPaymentHandlerBinding as m, type UCPProfile as n, type UCPProfileBody as o, type UCPServiceBinding as p, UCPSigningKey as q, buildUCPProfile as r, getIdentityStatus as s, makeMppxComposeHook as t, mppPaymentHandler as u, pricingResult as v, stripeSptPaymentHandler as w, validationEnvelope as x, validationResponseExpress as y, validationResponseFastify as z };
+export { AGENTSCORE_UCP_CAPABILITY as A, validationResponseFastify as B, Checkout as C, type DiscoveryProbeConfig as D, validationResponseHono as E, validationResponseNextjs as F, type GateDenial as G, validationResponseWeb as H, type IsCachedAddressFn as I, x402PaymentHandler as J, type MountUcpRoutesOptions as M, type OnSettledFn as O, type PreValidateFn as P, type RecipientsFn as R, type SettleOutcome as S, type UCPCapabilityBinding as U, type AgentScoreGatePolicy as a, type CheckoutContext as b, type CheckoutGateConfig as c, type CheckoutRailSpec as d, type CheckoutRequest as e, type CheckoutResult as f, type ComposeMppxFn as g, type MppxComposeOutcome as h, type PricingFn as i, type PricingResult as j, type ReferenceIdFn as k, type RunGateFn as l, type UCPPaymentHandlerBinding as m, type UCPProfile as n, type UCPProfileBody as o, type UCPServiceBinding as p, UCPSigningKey as q, buildAipTrustedIssuers as r, buildUCPProfile as s, getIdentityStatus as t, makeMppxComposeHook as u, mppPaymentHandler as v, pricingResult as w, stripeSptPaymentHandler as x, validationEnvelope as y, validationResponseExpress as z };

package/dist/{checkout-Bn7ZKIBD.d.mts → checkout-CzB9f_jf.d.mts}

@@ -2,6 +2,7 @@ import { T as TempoRailSpec, S as SolanaMppRailSpec, c as TempoSessionRailSpec,
 import { P as PricingBlock, R as RailKey } from './pricing-KHDqMLd7.mjs';
 import { CreateSessionOnMissing, AgentScoreCoreOptions, DenialReason } from './core.mjs';
 import { a as X402Server } from './x402_server-Ciz2mls2.mjs';
+import { T as TrustLevel } from './types-D1slMt0H.mjs';
 
 /**
  * UCP (Universal Commerce Protocol) profile builder.
@@ -11,7 +12,7 @@ import { a as X402Server } from './x402_server-Ciz2mls2.mjs';
  * envelope, with `services` / `capabilities` / `payment_handlers` as MAPs keyed by
  * reverse-DNS service / capability / handler name.
  *
- * AgentScore identity claims layer over UCP via the `sh.agentscore.identity` capability
+ * AgentScore identity claims layer over UCP via the `com.agentscore.identity` capability
  * (vendor-namespaced; UCP doesn't define KYC/sanctions/age/jurisdiction natively). The
  * capability extends `dev.ucp.shopping.checkout` AND `dev.ucp.shopping.cart` (multi-parent,
  * the standard pattern UCP allows for capabilities that compose multiple parents).
@@ -160,7 +161,7 @@ interface BuildUCPProfileInput {
     /** Services map, keyed by service name. UCP-shopping merchants typically advertise
      *  bindings under `'dev.ucp.shopping'`. */
     services?: Record<string, UCPServiceBinding[]>;
-    /** Capabilities map, keyed by capability name. The `sh.agentscore.identity` capability
+    /** Capabilities map, keyed by capability name. The `com.agentscore.identity` capability
      *  is auto-added when `agentscore_gate` is provided. */
     capabilities?: Record<string, UCPCapabilityBinding[]>;
     /** Payment handlers map, keyed by handler reverse-DNS name. */
@@ -168,7 +169,7 @@ interface BuildUCPProfileInput {
     /** JWKS — public keys the merchant signs with. REQUIRED by spec. */
     signing_keys: UCPSigningKey[];
     /** Merchant gate policy declaration. When provided, the SDK auto-injects an
-     *  `sh.agentscore.identity` capability binding into `capabilities`, with the
+     *  `com.agentscore.identity` capability binding into `capabilities`, with the
      *  policy as the binding's `config`. Static merchant declaration only — no
      *  per-operator data ever ends up on the public profile. Per-operator identity
      *  attestation lives on the AP2 risk-signal endpoint, not here. */
@@ -186,7 +187,7 @@ interface BuildUCPProfileInput {
     /** Vendor-specific extras INSIDE the `ucp` envelope (alongside `version`, `services`, etc.). */
     ucp_extras?: Record<string, unknown>;
 }
-/** Merchant gate policy declared on the UCP profile via `sh.agentscore.identity` capability config.
+/** Merchant gate policy declared on the UCP profile via `com.agentscore.identity` capability config.
  *  All fields optional; merchant declares which AgentScore checks the gate enforces. Snake-case
  *  field names match the AgentScore API's `/v1/assess` policy contract verbatim — no conversion
  *  layer between this declaration and what the gate actually enforces at runtime. */
@@ -210,7 +211,7 @@ interface AgentScoreGatePolicy {
  * signing_keys: [...] }`. Pass through `signUCPProfile` to attach a JWS signature for
  * trust-mode verifiers.
  *
- * Auto-injects `sh.agentscore.identity` as a vendor capability extending both
+ * Auto-injects `com.agentscore.identity` as a vendor capability extending both
  * `dev.ucp.shopping.checkout` and `dev.ucp.shopping.cart` when `agentscore_gate`
  * is provided. The capability's `config` carries the merchant's static gate
  * policy declaration (require_kyc / require_sanctions_clear / min_age /
@@ -240,10 +241,10 @@ interface AgentScoreGatePolicy {
  * ```
  */
 declare function buildUCPProfile(input: BuildUCPProfileInput): UCPProfile;
-declare const AGENTSCORE_UCP_CAPABILITY = "sh.agentscore.identity";
+declare const AGENTSCORE_UCP_CAPABILITY = "com.agentscore.identity";
 type MppRailSpec = TempoRailSpec | SolanaMppRailSpec | TempoSessionRailSpec;
 /**
- * Build the `sh.agentscore.payment.mpp` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.mpp` payment handler block for a UCP profile.
  *
  * Pass any mix of `TempoRailSpec`, `SolanaMppRailSpec`, and `TempoSessionRailSpec`.
  *
@@ -266,7 +267,7 @@ declare function mppPaymentHandler({ networks, }: {
     networks: MppRailSpec[];
 }): Record<string, UCPPaymentHandlerBinding[]>;
 /**
- * Build the `sh.agentscore.payment.x402` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.x402` payment handler block for a UCP profile.
  *
  * @example
  * ```ts
@@ -282,7 +283,7 @@ declare function x402PaymentHandler({ networks, }: {
     networks: X402BaseRailSpec[];
 }): Record<string, UCPPaymentHandlerBinding[]>;
 /**
- * Build the `sh.agentscore.payment.stripe_spt` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.stripe_spt` payment handler block for a UCP profile.
  *
  * @example
  * ```ts
@@ -534,7 +535,7 @@ type RunGateFn = (ctx: CheckoutContext) => Promise<GateDenial | null>;
 interface CheckoutGateConfig {
     /** AgentScore API key. Required when `runGate` is omitted. */
     apiKey?: string;
-    /** Override the default `https://api.agentscore.sh` base URL. */
+    /** Override the default `https://api.agentscore.com` base URL. */
     baseUrl?: string;
     /** Prepended to the default User-Agent on API calls. */
     userAgent?: string;
@@ -569,9 +570,73 @@ interface CheckoutGateConfig {
      *  DenialReason. Return a `GateDenial` to override the canonical body, or
      *  null to use `denialReasonToBody`. */
     onDenied?: (ctx: CheckoutContext, reason: DenialReason) => GateDenial | null | Promise<GateDenial | null>;
+    /** Accept AIP Agent Identity Tokens (AITs) on this route. When set and a request carries
+     *  an `Agent-Identity` header, the gate verifies the token offline (issuer signature via the
+     *  trusted-issuer JWKS + RFC 9421 proof-of-possession) BEFORE the assess call, then sends the
+     *  raw token to `/v1/assess` as `aip_token` so the same wine/age/sanctions policy evaluates
+     *  against the token's attested identity. A present-but-invalid AIT is a hard deny (the gate
+     *  does NOT fall through to wallet / operator-token). Requests with no `Agent-Identity` header
+     *  use the existing wallet / operator-token path unchanged.
+     *
+     *  Ignored when `runGate` is also set (a custom gate fully owns the flow). Without an `apiKey`,
+     *  a verified AIT is honored offline for identity-only gates, but a gate that declares policy
+     *  fields (KYC / age / sanctions / jurisdiction) without an `apiKey` fails closed
+     *  (`aip_policy_requires_api_key`) since policy can only be evaluated via `/v1/assess`. */
+    aip?: AipGateConfig;
     /** Full escape hatch — replaces the SDK gate flow. */
     runGate?: RunGateFn;
 }
+/** AIP acceptance config for {@link CheckoutGateConfig.aip}. */
+interface AipGateConfig {
+    /** ADDITIONAL external issuers to trust beyond AgentScore's own (e.g. `['https://issuer.example']`),
+     *  matched after canonicalization. AgentScore's canonical issuer
+     *  ({@link AGENTSCORE_CANONICAL_ISSUER}) is ALWAYS trusted and never needs listing — this SDK
+     *  is the AgentScore verifier, so a merchant can't accidentally fail to trust AgentScore AITs.
+     *  Omit/empty to accept only AgentScore-issued AITs. */
+    trustedIssuers?: string[];
+    /** Clock-skew tolerance in seconds for the RFC 9421 signature window (and, as an override,
+     *  the AIT JWT `exp`/`iat`). Defaults to 60s for both. */
+    maxSkewSeconds?: number;
+    /** Expected `@authority` (public hostname) the RFC 9421 signature must cover. When set, the
+     *  verifier binds the signature to this value instead of trusting the inbound `Host` header —
+     *  pin it to your real public host (e.g. `'wine.example.com'`) when behind a proxy that does
+     *  not normalize `Host`, to prevent a captured AIT+signature from being replayed to a
+     *  different virtual host on the same origin. */
+    authority?: string;
+    /** Minimum `trust_level` an AIT must assert to pass this gate (autonomous < human_present <
+     *  human_confirmed) — the spec's human-presence gate (e.g. require `human_confirmed` for
+     *  checkout). Enforced at the edge from the verified token; insufficient → 403 weak_auth with
+     *  `required_trust_level`. Unset = any trust level accepted. */
+    requireTrustLevel?: TrustLevel;
+    /** Acceptable `auth.amr` methods (RFC 8176); the AIT must carry at least one (e.g.
+     *  `['face','fpt','hwk']` to require strong human auth). Insufficient → 403 weak_auth with
+     *  `required_amr`. Unset = not enforced. */
+    requireAmr?: string[];
+    /** Per-issuer compliance policy override, keyed by issuer URL (canonicalized before lookup).
+     *  When a request's AIT is verified and its `iss` matches a key here, that block REPLACES the
+     *  gate's default policy fields (`requireKyc` / `requireSanctionsClear` / `minAge` /
+     *  `allowed/blockedJurisdictions`) for that request — letting a merchant apply different rules
+     *  by issuer (e.g. full compliance for its own AITs, a relaxed set for a partner issuer whose
+     *  tokens carry fewer attested claims). The replacement is whole-policy, not a merge: an issuer
+     *  block of `{ requireKyc: true, minAge: 21 }` evaluates ONLY those two rules for that issuer
+     *  (sanctions / jurisdiction omitted → not enforced for that issuer). Issuers NOT listed here
+     *  use the gate's default policy unchanged. Only the AIT path consults this — wallet /
+     *  operator-token requests are unaffected.
+     *
+     *  This is a deliberate compliance posture per issuer, not a default; an empty/absent map keeps
+     *  every issuer on the gate's default policy. */
+    issuerPolicies?: Record<string, AipIssuerPolicy>;
+}
+/** A per-issuer compliance policy block for {@link AipGateConfig.issuerPolicies}. The same
+ *  compliance fields as the gate, applied (as a whole-policy replacement) only to AITs from the
+ *  matching issuer. */
+interface AipIssuerPolicy {
+    requireKyc?: boolean;
+    requireSanctionsClear?: boolean;
+    minAge?: number;
+    blockedJurisdictions?: string[];
+    allowedJurisdictions?: string[];
+}
 /** Surface passed to `Checkout.onSettled` after a payment lands. */
 interface SettleOutcome {
     /** Protocol family that handled the settle. */
@@ -663,6 +728,18 @@ type IsCachedAddressFn = (address: string) => boolean | Promise<boolean>;
 declare function makeMppxComposeHook(opts: {
     serverGetter: () => Promise<unknown>;
 }): ComposeMppxFn;
+/** Resolve a per-issuer compliance-policy override for a verified AIT's issuer. Both the verified
+ *  `iss` and the map keys are canonicalized (lowercase scheme+host, no default port / trailing
+ *  slash) before comparison so `https://issuer.example` and `https://issuer.example/` resolve the same.
+ *  Returns the matching policy block, or undefined when the issuer is not overridden (→ caller
+ *  falls back to the gate's default policy). */
+/** The effective AIP trusted-issuer list: AgentScore's canonical issuer (ALWAYS trusted) plus any
+ *  external issuers. De-duped after canonicalization. Use this for the `agent_memory` hint and any
+ *  presentation surface (llms.txt / mpp.json / skill.md) that advertises AIP acceptance, so a
+ *  merchant relying solely on AgentScore AITs (no external issuers) still advertises the
+ *  `agent_identity` path. Trust enforcement itself lives in {@link JwksCache}, which merges the
+ *  canonical issuer independently. */
+declare function buildAipTrustedIssuers(externalIssuers?: string[]): string[];
 /**
  * Framework-neutral 4xx envelope (`{ error, next_steps, agent_instructions }`).
  *
@@ -733,11 +810,25 @@ declare class Checkout {
     readonly mintReferenceId: ReferenceIdFn | undefined;
     readonly onSettled: OnSettledFn | undefined;
     readonly isCachedAddress: IsCachedAddressFn | undefined;
+    /** Lowercased static recipient addresses for the x402-base rail(s). When the merchant
+     *  configured a static recipient and supplied no `isCachedAddress`, the gate binds the
+     *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
+    private readonly x402StaticRecipients;
     readonly zeroSettleCarveOut: boolean;
     readonly gate: CheckoutGateConfig | undefined;
     readonly discoveryExtensions: Record<string, unknown> | undefined;
+    readonly resourceInfo: {
+        serviceName?: string;
+        tags?: string[];
+        iconUrl?: string;
+        description?: string;
+    } | undefined;
     readonly discoveryProbe: DiscoveryProbeConfig | undefined;
     private _x402ServerGetter;
+    /** Lazily-built JWKS cache for AIP verification, shared across requests so issuer keys
+     *  are fetched once and cached (per the verifier's hard 24h cap). Built on first AIT. */
+    private aipJwks;
+    private getAipJwks;
     /**
      * True when the merchant has configured an identity-bearing policy flag —
      * `require_kyc`, `require_sanctions_clear` (name screening on the KYC
@@ -782,7 +873,10 @@ declare class Checkout {
         /** Runs after a settle lands; can return an inline response body for API sellers. */
         onSettled?: OnSettledFn;
         /** Pass when the merchant mints per-order addresses so `verifyX402Request` can
-         *  confirm the `payTo` was minted by this merchant. Defaults to permissive. */
+         *  confirm the `payTo` was minted by this merchant (e.g. `piCache.hasAddress`).
+         *  When omitted, Checkout auto-binds the agent-supplied `payTo` to the rail's
+         *  configured STATIC recipient(s) — the permissive default applies ONLY when no
+         *  static recipient exists (pure per-order minting). */
         isCachedAddress?: IsCachedAddressFn;
         /** Engage the EIP-3009 value=0 + pympp `proof` carve-out when pricing
          *  resolves to $0. Goods merchants offering free redemption codes set this
@@ -798,6 +892,16 @@ declare class Checkout {
          *  `extensions` field so Bazaar crawlers and other spec-compliant clients
          *  read the route's declared input/output schema. */
         discoveryExtensions?: Record<string, unknown>;
+        /** Optional x402 v2 ResourceInfo metadata advertised on the 402 (both the
+         *  body and the PAYMENT-REQUIRED header): `serviceName` / `tags` (max 5) /
+         *  `iconUrl` / `description`, used by Bazaar search + filtering. `url` and
+         *  `mimeType` are filled automatically from the request. */
+        resourceInfo?: {
+            serviceName?: string;
+            tags?: string[];
+            iconUrl?: string;
+            description?: string;
+        };
         /** Optional discovery-probe config: auto-route empty-body POSTs without a
          *  payment header to a sample 402 advertising the merchant's shape for
          *  crawlers (`awal x402 details`, x402-proxy, x402scan, ...). */
@@ -844,7 +948,7 @@ declare class Checkout {
      *   - `AGENTSCORE_API_KEY` — required. No key → one-time warning + skip
      *     (dev/testnet pattern; production should always configure a key).
      *   - `AGENTSCORE_BASE_URL` — optional override for staging/dev API
-     *     (e.g. `https://api-dev.agentscore.sh` or `http://localhost:3002`).
+     *     (e.g. `https://api.staging.example` or `http://localhost:3002`).
      *
      * Stripe SPT (no extractable wallet signer) → skip silently; Stripe runs
      * its own OFAC screen on the buyer's Stripe account at customer creation.
@@ -955,4 +1059,4 @@ interface MountUcpRoutesOptions {
     jwksPath?: string;
 }
 
-export { AGENTSCORE_UCP_CAPABILITY as A, validationResponseHono as B, Checkout as C, type DiscoveryProbeConfig as D, validationResponseNextjs as E, validationResponseWeb as F, type GateDenial as G, x402PaymentHandler as H, type IsCachedAddressFn as I, type MountUcpRoutesOptions as M, type OnSettledFn as O, type PreValidateFn as P, type RecipientsFn as R, type SettleOutcome as S, type UCPCapabilityBinding as U, type AgentScoreGatePolicy as a, type CheckoutContext as b, type CheckoutGateConfig as c, type CheckoutRailSpec as d, type CheckoutRequest as e, type CheckoutResult as f, type ComposeMppxFn as g, type MppxComposeOutcome as h, type PricingFn as i, type PricingResult as j, type ReferenceIdFn as k, type RunGateFn as l, type UCPPaymentHandlerBinding as m, type UCPProfile as n, type UCPProfileBody as o, type UCPServiceBinding as p, UCPSigningKey as q, buildUCPProfile as r, getIdentityStatus as s, makeMppxComposeHook as t, mppPaymentHandler as u, pricingResult as v, stripeSptPaymentHandler as w, validationEnvelope as x, validationResponseExpress as y, validationResponseFastify as z };
+export { AGENTSCORE_UCP_CAPABILITY as A, validationResponseFastify as B, Checkout as C, type DiscoveryProbeConfig as D, validationResponseHono as E, validationResponseNextjs as F, type GateDenial as G, validationResponseWeb as H, type IsCachedAddressFn as I, x402PaymentHandler as J, type MountUcpRoutesOptions as M, type OnSettledFn as O, type PreValidateFn as P, type RecipientsFn as R, type SettleOutcome as S, type UCPCapabilityBinding as U, type AgentScoreGatePolicy as a, type CheckoutContext as b, type CheckoutGateConfig as c, type CheckoutRailSpec as d, type CheckoutRequest as e, type CheckoutResult as f, type ComposeMppxFn as g, type MppxComposeOutcome as h, type PricingFn as i, type PricingResult as j, type ReferenceIdFn as k, type RunGateFn as l, type UCPPaymentHandlerBinding as m, type UCPProfile as n, type UCPProfileBody as o, type UCPServiceBinding as p, UCPSigningKey as q, buildAipTrustedIssuers as r, buildUCPProfile as s, getIdentityStatus as t, makeMppxComposeHook as u, mppPaymentHandler as v, pricingResult as w, stripeSptPaymentHandler as x, validationEnvelope as y, validationResponseExpress as z };

package/dist/core.d.mts

@@ -1,8 +1,18 @@
+import { AipSignatureMaterial } from '@agent-score/sdk';
 import { P as PaymentSigner } from './signer-3FAit11j.mjs';
 
 interface AgentIdentity {
     address?: string;
     operatorToken?: string;
+    /** Raw AIP Agent Identity Token (a JWT). When set, the gate has verified the token's RFC 9421
+     *  proof-of-possession at the edge as a fail-fast filter; `evaluate` forwards it to `/v1/assess`
+     *  as `aip_token` (with {@link aipSignature}) for AUTHORITATIVE server-side re-verification of the
+     *  IdP signature + proof-of-possession + policy. */
+    aipToken?: string;
+    /** RFC 9421 signature material accompanying {@link aipToken}, forwarded to `/v1/assess` as
+     *  `aip_signature` so the API re-verifies proof-of-possession itself (the edge is not trusted as
+     *  the authority). Always set together with `aipToken`. */
+    aipSignature?: AipSignatureMaterial;
 }
 /**
  * Session metadata returned from `POST /v1/sessions`. Surfaced to the `onBeforeSession`
@@ -66,7 +76,7 @@ interface AgentScoreCoreOptions {
     failOpen?: boolean;
     /** How long to cache results, in seconds. Defaults to 300. */
     cacheSeconds?: number;
-    /** AgentScore API base URL. Defaults to "https://api.agentscore.sh". */
+    /** AgentScore API base URL. Defaults to "https://api.agentscore.com". */
     baseUrl?: string;
     /** Optional chain to filter scoring to. */
     chain?: string;
@@ -74,6 +84,11 @@ interface AgentScoreCoreOptions {
     userAgent?: string;
     /** When set and no identity is found, create a verification session instead of denying immediately. */
     createSessionOnMissing?: CreateSessionOnMissing;
+    /** Issuers whose AIP Agent Identity Tokens this gate accepts. When set, the missing-identity
+     *  recovery instructions and the `agent_memory` hint advertise the AIT path so agents holding
+     *  one can present it. Set by Checkout from `gate.aip.trustedIssuers`; the actual AIT
+     *  verification happens at the edge (Checkout) before `evaluate`. */
+    aipTrustedIssuers?: string[];
 }
 type DenialCode = 'wallet_not_trusted' | 'missing_identity' | 'api_error' | 'payment_required' | 'identity_verification_required' | 'wallet_signer_mismatch' | 'wallet_auth_requires_wallet_signing' | 'token_expired' | 'invalid_credential';
 /**
@@ -90,7 +105,12 @@ interface AgentMemoryHint {
     identity_paths: {
         wallet: string;
         operator_token: string;
+        agent_identity?: string;
     };
+    /** Issuers whose AIP Agent Identity Tokens this merchant accepts. Present only when the
+     *  merchant opted into AIP; an agent holding an AIT from one of these can present it via an
+     *  `Agent-Identity` header + RFC 9421 signature instead of bootstrapping a fresh credential. */
+    aip_trusted_issuers?: string[];
     bootstrap: string;
     do_not_persist_in_memory: string[];
     persist_in_credential_store: string[];
@@ -169,6 +189,16 @@ interface AssessResult {
     linked_wallets?: string[];
     verify_url?: string;
     policy_result?: PolicyResult | null;
+    /** IdP provenance, present only when `identity_method === 'aip_token'` — which issuer attested
+     *  the identity and the trust level it asserted. Mirrors the SDK's `AssessResponse.aip`. */
+    aip?: {
+        issuer: string;
+        subject: string;
+        trust_level?: 'autonomous' | 'human_present' | 'human_confirmed';
+        agent_provider?: string;
+        /** True when /v1/assess re-verified the RFC 9421 proof-of-possession (always true on success). */
+        pop_verified?: boolean;
+    };
 }
 /**
  * Reason a failOpen allow short-circuited an evaluate call due to AgentScore-side
@@ -200,6 +230,12 @@ interface GateQuotaInfo {
  *   merchants can alert/log without parsing console output.
  * - `quota` propagates the SDK's per-request quota observability when the API emits the
  *   `X-Quota-*` headers. Optional; absent on Enterprise / unlimited tiers.
+ * - `signerVerdict` carries the per-request wallet-signer verdicts (signer_match + signer_sanctions)
+ *   composed by this evaluate's assess call. It rides on the RETURN VALUE (not a shared slot on the
+ *   core) so concurrent same-wallet/different-signer requests can't read each other's verdict —
+ *   the adapter stashes it on its per-request state for `getSignerVerdict(ctx)` to read back.
+ *   Present only on wallet-only identity when the response carried either signer block; `undefined`
+ *   otherwise (operator-token / AIT paths, discovery legs with no signer).
  * - `{ kind: 'deny', reason }` — the request was denied. Adapters should render a 403 with the
  *   reason, or invoke the caller's custom denial handler.
  */
@@ -209,9 +245,11 @@ type EvaluateOutcome = {
     degraded?: boolean;
     infraReason?: FailOpenInfraReason;
     quota?: GateQuotaInfo;
+    signerVerdict?: SignerVerdict;
 } | {
     kind: 'deny';
     reason: DenialReason;
+    signerVerdict?: SignerVerdict;
 };
 interface CaptureWalletOptions {
     /** Operator credential (`opc_...`) that the agent authenticated with. */
@@ -280,16 +318,11 @@ interface AgentScoreCore {
      *  it and the response includes `signer_match` + `signer_sanctions` verdicts in one
      *  round trip. */
     signer?: PaymentSigner | null): Promise<EvaluateOutcome>;
-    /** Synchronous read of the cached signer verdicts (signer_match + signer_sanctions)
-     *  populated when the gate's evaluate call was made with a pre-extracted signer. Returns
-     *  `undefined` when the gate didn't run, the request was operator-token-authenticated,
-     *  or no signer was extractable (discovery legs). */
-    getSignerVerdict(claimedAddress: string): SignerVerdict | undefined;
     /** Report a wallet seen paying under an operator credential. Fire-and-forget; silently
      *  swallows non-fatal errors because capture is informational, not on the critical path. */
     captureWallet(options: CaptureWalletOptions): Promise<void>;
 }
-declare function buildAgentMemoryHint(): AgentMemoryHint;
+declare function buildAgentMemoryHint(aipTrustedIssuers?: string[]): AgentMemoryHint;
 declare function createAgentScoreCore(options: AgentScoreCoreOptions): AgentScoreCore;
 
 export { type AccountVerification, type AgentIdentity, type AgentMemoryHint, type AgentScoreCore, type AgentScoreCoreOptions, type AssessResult, type CreateSessionOnMissing, type DenialCode, type DenialReason, type EvaluateOutcome, type FailOpenInfraReason, type GateQuotaInfo, type OperatorVerification, type PolicyCheck, type PolicyResult, type SessionMetadata, type SignerVerdict, type VerifyWalletSignerResult, buildAgentMemoryHint, createAgentScoreCore };