@agent-score/commerce 2.4.0 → 2.6.0

package/dist/types-D1slMt0H.d.mts

@@ -0,0 +1,137 @@
+import { JWK } from 'jose';
+
+/**
+ * AIP (Agentic Identity Protocol) token types and the claim contract.
+ *
+ * An Agent Identity Token (AIT) is a JWT signed by an Identity Provider (IdP). It binds a
+ * verified human's identity to the specific agent presenting it (via `cnf`, RFC 7800) and
+ * carries the trust level, authentication method, optional intent, and optional identity
+ * claims the IdP attests to.
+ *
+ * This module is the single source of truth for the claim shape on the verifier side. It
+ * encodes the spec's required / recommended / optional claims plus the AgentScore extension
+ * claims (sanctions, jurisdiction, structured id-verification, cross-merchant graph, payment
+ * signer) we carry when we act as a compliance IdP.
+ *
+ * Extensibility contract (per spec): the `identity` object is open. If a claim is present,
+ * the IdP attests to it; verifiers ignore claims they don't recognize. Absence is the
+ * "unknown" signal — IdPs do not ship `null` for "not checked".
+ */
+
+/** Degree of human involvement in issuing this specific AIT. */
+type TrustLevel = 'autonomous' | 'human_present' | 'human_confirmed';
+/**
+ * Authentication Method Reference values (RFC 8176 / IANA AMR registry). Open set — these
+ * are the values relevant to agent identity; others are valid and pass through.
+ */
+type AmrValue = 'face' | 'fpt' | 'hwk' | 'otp' | 'pin' | 'pwd' | 'sms' | 'swk' | 'user' | 'mfa';
+/** RFC 7800 confirmation claim: binds the AIT to the agent's signing key. */
+interface CnfClaim {
+    jwk: JWK;
+}
+/** Agent metadata. `provider` is required; `instance` is recommended. */
+interface AgentClaim {
+    provider: string;
+    instance?: string;
+}
+/** How the user authorized THIS AIT (not prior authentication history). */
+interface AuthClaim {
+    amr?: AmrValue[] | string[];
+    /** When the user authenticated for this token (Unix seconds). Mirrors OIDC `auth_time`. */
+    time?: number;
+}
+/** What the agent intends to do. Optional; verifiers may require it for non-read actions. */
+interface IntentClaim {
+    actions?: string[];
+    description?: string;
+}
+/** AgentScore wallet-binding extension (orthogonal to `cnf`, which binds the agent key). */
+interface PaymentSignerClaim {
+    address: string;
+    network: 'evm' | 'solana';
+    /** Relationship the IdP attests between signer and the operator graph. */
+    match?: 'linked_operator' | 'claimed_operator';
+}
+interface PaymentClaim {
+    signer?: PaymentSignerClaim;
+}
+/**
+ * Identity claims (presence == IdP attestation). Spec-defined fields plus AgentScore
+ * compliance extension claims. Open by contract — unknown fields are allowed and ignored.
+ */
+interface IdentityClaim {
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    phone?: string;
+    phone_verified?: boolean;
+    age_over_18?: boolean;
+    age_over_21?: boolean;
+    id_verified?: boolean;
+    id_verification?: {
+        provider?: string;
+        method?: string;
+        document_type?: string;
+        verified_at?: number;
+    };
+    /** ISO 3166-1 alpha-2, optionally with ISO 3166-2 subdivision (e.g. "US-CA"). */
+    jurisdiction?: string;
+    sanctions_clear?: boolean;
+    sanctions_checked_at?: number;
+    sanctions_providers?: string[];
+    linked_wallets?: Array<{
+        address: string;
+        network: 'evm' | 'solana';
+    }>;
+    merchants_paid?: number;
+    first_seen?: number;
+    [claim: string]: unknown;
+}
+/** The decoded AIT JWT payload. */
+interface AitPayload {
+    aip_version: string;
+    iss: string;
+    sub: string;
+    iat: number;
+    exp: number;
+    cnf: CnfClaim;
+    agent: AgentClaim;
+    trust_level?: TrustLevel;
+    auth?: AuthClaim;
+    intent?: IntentClaim;
+    identity?: IdentityClaim;
+    payment?: PaymentClaim;
+    [claim: string]: unknown;
+}
+/** The decoded AIT JWT header. */
+interface AitHeader {
+    alg: string;
+    typ?: string;
+    kid?: string;
+    [param: string]: unknown;
+}
+/**
+ * Structural validation of a decoded AIT payload. Confirms the required claims are present
+ * and well-typed, and enforces the one normative conditional in the spec: a
+ * `human_confirmed` token MUST carry at least one `auth.amr` value.
+ *
+ * This is shape/contract validation only — it does NOT verify signatures (that's the
+ * verifier pipeline) and does NOT apply trust policy (that's the gate / `/v1/assess`).
+ */
+type AitValidationResult = {
+    ok: true;
+    payload: AitPayload;
+} | {
+    ok: false;
+    reason: AitValidationFailure;
+};
+type AitValidationFailure = 'not_an_object' | 'missing_aip_version' | 'missing_iss' | 'missing_sub' | 'missing_iat' | 'missing_exp' | 'missing_cnf' | 'missing_agent_provider' | 'human_confirmed_without_amr';
+/**
+ * Detect whether a decoded JWT payload is an AIT: per spec, an AIT is discriminated by the
+ * presence of `cnf` + `agent` claims (not the `typ` header).
+ */
+declare const isAitShape: (payload: unknown) => boolean;
+/** Validate the structural contract of a decoded AIT payload. */
+declare const validateAitPayload: (payload: unknown) => AitValidationResult;
+
+export { type AitHeader as A, type IdentityClaim as I, type TrustLevel as T, type AitPayload as a, type AitValidationResult as b, type AmrValue as c, type IntentClaim as d, isAitShape as i, validateAitPayload as v };

package/dist/types-D1slMt0H.d.ts

@@ -0,0 +1,137 @@
+import { JWK } from 'jose';
+
+/**
+ * AIP (Agentic Identity Protocol) token types and the claim contract.
+ *
+ * An Agent Identity Token (AIT) is a JWT signed by an Identity Provider (IdP). It binds a
+ * verified human's identity to the specific agent presenting it (via `cnf`, RFC 7800) and
+ * carries the trust level, authentication method, optional intent, and optional identity
+ * claims the IdP attests to.
+ *
+ * This module is the single source of truth for the claim shape on the verifier side. It
+ * encodes the spec's required / recommended / optional claims plus the AgentScore extension
+ * claims (sanctions, jurisdiction, structured id-verification, cross-merchant graph, payment
+ * signer) we carry when we act as a compliance IdP.
+ *
+ * Extensibility contract (per spec): the `identity` object is open. If a claim is present,
+ * the IdP attests to it; verifiers ignore claims they don't recognize. Absence is the
+ * "unknown" signal — IdPs do not ship `null` for "not checked".
+ */
+
+/** Degree of human involvement in issuing this specific AIT. */
+type TrustLevel = 'autonomous' | 'human_present' | 'human_confirmed';
+/**
+ * Authentication Method Reference values (RFC 8176 / IANA AMR registry). Open set — these
+ * are the values relevant to agent identity; others are valid and pass through.
+ */
+type AmrValue = 'face' | 'fpt' | 'hwk' | 'otp' | 'pin' | 'pwd' | 'sms' | 'swk' | 'user' | 'mfa';
+/** RFC 7800 confirmation claim: binds the AIT to the agent's signing key. */
+interface CnfClaim {
+    jwk: JWK;
+}
+/** Agent metadata. `provider` is required; `instance` is recommended. */
+interface AgentClaim {
+    provider: string;
+    instance?: string;
+}
+/** How the user authorized THIS AIT (not prior authentication history). */
+interface AuthClaim {
+    amr?: AmrValue[] | string[];
+    /** When the user authenticated for this token (Unix seconds). Mirrors OIDC `auth_time`. */
+    time?: number;
+}
+/** What the agent intends to do. Optional; verifiers may require it for non-read actions. */
+interface IntentClaim {
+    actions?: string[];
+    description?: string;
+}
+/** AgentScore wallet-binding extension (orthogonal to `cnf`, which binds the agent key). */
+interface PaymentSignerClaim {
+    address: string;
+    network: 'evm' | 'solana';
+    /** Relationship the IdP attests between signer and the operator graph. */
+    match?: 'linked_operator' | 'claimed_operator';
+}
+interface PaymentClaim {
+    signer?: PaymentSignerClaim;
+}
+/**
+ * Identity claims (presence == IdP attestation). Spec-defined fields plus AgentScore
+ * compliance extension claims. Open by contract — unknown fields are allowed and ignored.
+ */
+interface IdentityClaim {
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    phone?: string;
+    phone_verified?: boolean;
+    age_over_18?: boolean;
+    age_over_21?: boolean;
+    id_verified?: boolean;
+    id_verification?: {
+        provider?: string;
+        method?: string;
+        document_type?: string;
+        verified_at?: number;
+    };
+    /** ISO 3166-1 alpha-2, optionally with ISO 3166-2 subdivision (e.g. "US-CA"). */
+    jurisdiction?: string;
+    sanctions_clear?: boolean;
+    sanctions_checked_at?: number;
+    sanctions_providers?: string[];
+    linked_wallets?: Array<{
+        address: string;
+        network: 'evm' | 'solana';
+    }>;
+    merchants_paid?: number;
+    first_seen?: number;
+    [claim: string]: unknown;
+}
+/** The decoded AIT JWT payload. */
+interface AitPayload {
+    aip_version: string;
+    iss: string;
+    sub: string;
+    iat: number;
+    exp: number;
+    cnf: CnfClaim;
+    agent: AgentClaim;
+    trust_level?: TrustLevel;
+    auth?: AuthClaim;
+    intent?: IntentClaim;
+    identity?: IdentityClaim;
+    payment?: PaymentClaim;
+    [claim: string]: unknown;
+}
+/** The decoded AIT JWT header. */
+interface AitHeader {
+    alg: string;
+    typ?: string;
+    kid?: string;
+    [param: string]: unknown;
+}
+/**
+ * Structural validation of a decoded AIT payload. Confirms the required claims are present
+ * and well-typed, and enforces the one normative conditional in the spec: a
+ * `human_confirmed` token MUST carry at least one `auth.amr` value.
+ *
+ * This is shape/contract validation only — it does NOT verify signatures (that's the
+ * verifier pipeline) and does NOT apply trust policy (that's the gate / `/v1/assess`).
+ */
+type AitValidationResult = {
+    ok: true;
+    payload: AitPayload;
+} | {
+    ok: false;
+    reason: AitValidationFailure;
+};
+type AitValidationFailure = 'not_an_object' | 'missing_aip_version' | 'missing_iss' | 'missing_sub' | 'missing_iat' | 'missing_exp' | 'missing_cnf' | 'missing_agent_provider' | 'human_confirmed_without_amr';
+/**
+ * Detect whether a decoded JWT payload is an AIT: per spec, an AIT is discriminated by the
+ * presence of `cnf` + `agent` claims (not the `typ` header).
+ */
+declare const isAitShape: (payload: unknown) => boolean;
+/** Validate the structural contract of a decoded AIT payload. */
+declare const validateAitPayload: (payload: unknown) => AitValidationResult;
+
+export { type AitHeader as A, type IdentityClaim as I, type TrustLevel as T, type AitPayload as a, type AitValidationResult as b, type AmrValue as c, type IntentClaim as d, isAitShape as i, validateAitPayload as v };

package/dist/{wwwauthenticate-CVaGUMjU.d.mts → wwwauthenticate-Dgm-_af9.d.mts}

@@ -26,13 +26,23 @@ declare function aliasAmountFields(accepts: unknown[]): unknown[];
  * output) makes the match silently fail at settle time. Keep `accepts` shape
  * identical to whatever `buildPaymentRequirements` produces server-side.
  */
-declare function paymentRequiredHeader({ x402Version, accepts, resource, }: {
+declare function paymentRequiredHeader({ x402Version, accepts, resource, extensions, }: {
     x402Version: 1 | 2;
     accepts: unknown[];
+    /** x402 v2 ResourceInfo. Per spec the full resource (incl. serviceName / tags /
+     *  iconUrl, used by Bazaar search/filtering) rides in the header, not just url. */
     resource?: {
         url: string;
+        description?: string;
         mimeType?: string;
+        serviceName?: string;
+        tags?: string[];
+        iconUrl?: string;
     };
+    /** x402 v2 `extensions`. Per the v2 HTTP transport spec the PaymentRequired
+     *  object, INCLUDING extensions, must travel in the base64 PAYMENT-REQUIRED
+     *  header (where Bazaar validators read it), not only in the response body. */
+    extensions?: Record<string, unknown>;
 }): string;
 
 export { aliasAmountFields as a, paymentRequiredHeader as p, wwwAuthenticateHeader as w };

package/dist/{wwwauthenticate-CVaGUMjU.d.ts → wwwauthenticate-Dgm-_af9.d.ts}

@@ -26,13 +26,23 @@ declare function aliasAmountFields(accepts: unknown[]): unknown[];
  * output) makes the match silently fail at settle time. Keep `accepts` shape
  * identical to whatever `buildPaymentRequirements` produces server-side.
  */
-declare function paymentRequiredHeader({ x402Version, accepts, resource, }: {
+declare function paymentRequiredHeader({ x402Version, accepts, resource, extensions, }: {
     x402Version: 1 | 2;
     accepts: unknown[];
+    /** x402 v2 ResourceInfo. Per spec the full resource (incl. serviceName / tags /
+     *  iconUrl, used by Bazaar search/filtering) rides in the header, not just url. */
     resource?: {
         url: string;
+        description?: string;
         mimeType?: string;
+        serviceName?: string;
+        tags?: string[];
+        iconUrl?: string;
     };
+    /** x402 v2 `extensions`. Per the v2 HTTP transport spec the PaymentRequired
+     *  object, INCLUDING extensions, must travel in the base64 PAYMENT-REQUIRED
+     *  header (where Bazaar validators read it), not only in the response body. */
+    extensions?: Record<string, unknown>;
 }): string;
 
 export { aliasAmountFields as a, paymentRequiredHeader as p, wwwAuthenticateHeader as w };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/commerce",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "Agent commerce SDK — identity middleware (Hono, Express, Fastify, Next.js, Web Fetch) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agent commerce.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -139,16 +139,16 @@
     "type": "git",
     "url": "https://github.com/agentscore/node-commerce"
   },
-  "homepage": "https://agentscore.sh",
+  "homepage": "https://www.agentscore.com",
   "bugs": {
     "url": "https://github.com/agentscore/node-commerce/issues"
   },
   "engines": {
-    "node": ">=22",
-    "bun": ">=1.3.0"
+    "node": ">=22 <25",
+    "bun": ">=1.3.0 <2"
   },
   "dependencies": {
-    "@agent-score/sdk": "^2.4.3"
+    "@agent-score/sdk": "^2.6.0"
   },
   "overrides": {
     "axios": "^1.15.0",
@@ -159,10 +159,14 @@
     "minimatch@^10.0.0": {
       "brace-expansion": "5.0.6"
     },
-    "ws": "^8.20.1"
+    "ws": "^8.21.0",
+    "vite": "^8.0.16",
+    "esbuild": "^0.28.1",
+    "js-yaml": "^4.2.0",
+    "form-data": "^4.0.6"
   },
   "peerDependencies": {
-    "@solana/kit": ">=6.5.0",
+    "@solana/kit": ">=6.5.0 <7.0.0",
     "@solana/mpp": ">=0.5.0",
     "express": ">=4.0.0",
     "fastify": ">=4.0.0",
@@ -201,30 +205,31 @@
     "@a2a-js/sdk": "^0.3.13",
     "@coinbase/x402": "^2.1.0",
     "@eslint/js": "^9.39.4",
-    "@solana/kit": "^6.9.0",
+    "@solana/kit": "^6.10.0",
     "@solana/mpp": "^0.6.0",
     "@types/express": "^5.0.6",
-    "@types/node": "^25.9.1",
-    "@vitest/coverage-v8": "^4.1.7",
-    "@x402/core": "^2.13.0",
-    "@x402/evm": "^2.13.0",
-    "@x402/extensions": "^2.13.0",
+    "@types/node": "^26.1.0",
+    "@vitest/coverage-v8": "^4.1.9",
+    "@x402/core": "^2.17.0",
+    "@x402/evm": "^2.17.0",
+    "@x402/extensions": "^2.17.0",
     "dotenv": "^17.4.2",
     "eslint": "^9.39.4",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-unused-imports": "^4.4.1",
     "express": "^5.2.1",
-    "fastify": "^5.8.5",
-    "hono": "^4.12.23",
-    "ioredis": "^5.10.1",
+    "fastify": "^5.10.0",
+    "hono": "^4.12.27",
+    "ioredis": "^5.11.1",
     "jose": "^6.2.3",
-    "knip": "^6.14.2",
-    "lefthook": "^2.1.8",
-    "mppx": "0.6.26",
+    "knip": "^6.24.0",
+    "lefthook": "^2.1.9",
+    "mppx": "0.8.5",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.4",
-    "vitest": "^4.1.7"
+    "typescript-eslint": "^8.62.1",
+    "viem": "2.54.4",
+    "vitest": "^4.1.9"
   },
   "packageManager": "bun@1.3.13"
 }