@agent-score/commerce 2.5.0 → 2.6.1

package/dist/discovery/index.mjs

@@ -189,9 +189,17 @@ function paymentDirective({
 function paymentRequiredHeader({
   x402Version,
   accepts,
-  resource
+  resource,
+  extensions
 }) {
-  return Buffer.from(JSON.stringify({ x402Version, accepts, ...resource ? { resource } : {} })).toString("base64");
+  return Buffer.from(
+    JSON.stringify({
+      x402Version,
+      accepts,
+      ...resource ? { resource } : {},
+      ...extensions && Object.keys(extensions).length > 0 ? { extensions } : {}
+    })
+  ).toString("base64");
 }
 
 // src/discovery/probe.ts
@@ -301,6 +309,20 @@ async function isDiscoveryProbeRequest(req) {
 }
 
 // src/discovery/bazaar.ts
+async function enrichBazaarDiscoveryExtensions(extensions, request) {
+  if (extensions === void 0) return extensions;
+  const bazaar = await dynamicImport("@x402/extensions/bazaar");
+  const ext = bazaar?.bazaarResourceServerExtension;
+  if (!ext?.key || typeof ext.enrichDeclaration !== "function") return extensions;
+  const declaration = extensions[ext.key];
+  if (declaration === void 0) return extensions;
+  const transportContext = {
+    method: request.method,
+    adapter: { getPath: () => request.path },
+    routePattern: request.path
+  };
+  return { ...extensions, [ext.key]: ext.enrichDeclaration(declaration, transportContext) };
+}
 async function createBazaarDiscovery(config) {
   const bazaar = await dynamicImport("@x402/extensions/bazaar");
   if (!bazaar?.declareDiscoveryExtension) {
@@ -522,7 +544,7 @@ function agentscoreSecuritySchemes() {
       type: "apiKey",
       in: "header",
       name: "X-Wallet-Address",
-      description: "Wallet-path identity (0x... or base58). Only works on rails that carry a wallet signature (Tempo MPP, x402 EIP-3009, x402 SPL Token). The wallet you claim MUST sign the payment."
+      description: "Wallet-path identity (0x... or base58). Only works on rails that carry a wallet signature (Tempo MPP, x402 EIP-3009 on Base, Solana MPP). The wallet you claim MUST sign the payment."
     },
     AgentIdentity: {
       type: "apiKey",
@@ -1007,7 +1029,7 @@ function buildAgentscoreOnboardingSteps(opts) {
   const installStep = `Install agentscore-pay if you don't already have a compatible client for your funded chain: \`npm i -g @agent-score/pay\` (or \`brew install agentscore/tap/agentscore-pay\`). ${merchantName} accepts: ${railsHuman}. agentscore-pay speaks every supported rail; ` + (compatibleFragment ? `the rails table also lists per-rail \`compatible_clients\` \u2014 ${compatibleFragment}. ` : "") + "Any spec-compliant client for an individual rail works too.";
   const bootstrapStep = `First-run only: bootstrap wallet + Passport. Run \`agentscore-pay agent-guide --json\` for the canonical cold-start path \u2014 it walks \`agentscore-pay init\` (creates keystore + per-chain wallet), \`agentscore-pay passport login\` (one-time KYC${requiresKyc ? "; required for this merchant" : ""}; the human completes a verify URL once and pay caches the operator_token), and \`agentscore-pay balance\` to see which chain has USDC. Skip if your wallet+Passport are already provisioned.`;
   const stripeFallbackStep = "If your only payment method is a Stripe / Link card (no crypto), install `@stripe/link-cli` instead of agentscore-pay and use it on the SPT rail. Identity gating still applies \u2014 the merchant's 403 with `verify_url` lets you bootstrap a Passport even with no crypto wallet involved.";
-  const returningUserStep = "Returning user note: if you've paid an AgentScore-gated merchant before from this wallet, the wallet is already in your Passport's `linked_wallets[]` and identity flows through automatically with no re-KYC prompt. Paying from a NEW wallet while you already hold an `opc_...` token returns 403 `wallet_signer_mismatch`; the body lists `linked_wallets[]` and `agent_instructions.action: resign_or_switch_to_operator_token` with three deterministic recoveries (switch to a linked wallet, drop the operator_token to re-KYC the new wallet, or pre-claim the new wallet via SIWE on agentscore.sh/verify).";
+  const returningUserStep = "Returning user note: if you've paid an AgentScore-gated merchant before from this wallet, the wallet is already in your Passport's `linked_wallets[]` and identity flows through automatically with no re-KYC prompt. Paying from a NEW wallet while you already hold an `opc_...` token returns 403 `wallet_signer_mismatch`; the body lists `linked_wallets[]` and `agent_instructions.action: resign_or_switch_to_operator_token` with three deterministic recoveries (switch to a linked wallet, drop the operator_token to re-KYC the new wallet, or pre-claim the new wallet via SIWE on https://www.agentscore.com/verify).";
   const pickRailStep = `Pick the rail your wallet is funded for. The 402 advertises ${acceptedRails.length} rail${acceptedRails.length === 1 ? "" : "s"}. \`agentscore-pay balance\` (without \`--chain\`) lists every chain's USDC; pay rejects with \`multi_rail_ambiguity\` if you don't pass \`--chain\` on a multi-rail challenge.`;
   const placeOrderStep = `Place the order: \`agentscore-pay pay POST ${appUrl}/purchase --chain <${chainFlags}> -d '<body>' --max-spend <amount>\` for crypto rails. For Stripe SPT, follow the handoff hint pay emits and use \`@stripe/link-cli\` instead. Either way pay handles the 402 retry, signing, and Passport attachment; branch on the structured CliError \`code\` on non-zero exit (insufficient_balance, multi_rail_ambiguity, config_error for missing wallet/Passport, etc.).`;
   const makeCallStep = `Make the paid call: \`agentscore-pay pay POST ${appUrl}/<endpoint> --chain <${chainFlags}> --max-spend <amount>\`; pay handles 402 retry, rail selection, signing, and Passport attachment. Branch on the structured CliError \`code\` on non-zero exit (insufficient_balance, multi_rail_ambiguity, config_error for missing wallet/Passport, etc.).`;
@@ -1229,10 +1251,10 @@ var UCPSigningKey = {
   fromJWK: ucpSigningKeyFromJWKImpl
 };
 var DEFAULT_VERSION = "2026-04-08";
-var AGENTSCORE_CAPABILITY_NAME = "sh.agentscore.identity";
+var AGENTSCORE_CAPABILITY_NAME = "com.agentscore.identity";
 var AGENTSCORE_CAPABILITY_VERSION = "2026-04-08";
-var AGENTSCORE_DEFAULT_SPEC_URL = "https://agentscore.sh/specification/identity";
-var AGENTSCORE_DEFAULT_SCHEMA_URL = "https://agentscore.sh/schemas/ucp/sh-agentscore-identity-v1.json";
+var AGENTSCORE_DEFAULT_SPEC_URL = "https://www.agentscore.com/specification/identity";
+var AGENTSCORE_DEFAULT_SCHEMA_URL = "https://www.agentscore.com/schemas/ucp/com-agentscore-identity-v1.json";
 var AGENTSCORE_EXTENDS = ["dev.ucp.shopping.checkout", "dev.ucp.shopping.cart"];
 var RESERVED_TOP_LEVEL = /* @__PURE__ */ new Set([
   "ucp",
@@ -1321,8 +1343,8 @@ function buildUCPProfile(input) {
   return profile;
 }
 var HANDLER_VERSION = "2026-04-08";
-var SPEC_BASE = "https://agentscore.sh/specification/payment-handlers";
-var SCHEMA_BASE = "https://agentscore.sh/schemas/payment-handlers";
+var SPEC_BASE = "https://www.agentscore.com/specification/payment-handlers";
+var SCHEMA_BASE = "https://www.agentscore.com/schemas/payment-handlers";
 var CAIP2_TO_UCP_NETWORK = {
   "eip155:8453": "base-8453",
   "eip155:84532": "base-84532",
@@ -1380,7 +1402,7 @@ function mppPaymentHandler({
   networks: networks2
 }) {
   return {
-    "sh.agentscore.payment.mpp": [{
+    "com.agentscore.payment.mpp": [{
       id: "mpp",
       version: HANDLER_VERSION,
       spec: `${SPEC_BASE}/mpp`,
@@ -1401,7 +1423,7 @@ function x402PaymentHandler({
   networks: networks2
 }) {
   return {
-    "sh.agentscore.payment.x402": [{
+    "com.agentscore.payment.x402": [{
       id: "x402",
       version: HANDLER_VERSION,
       spec: `${SPEC_BASE}/x402`,
@@ -1414,7 +1436,7 @@ function stripeSptPaymentHandler({
   spec
 }) {
   return {
-    "sh.agentscore.payment.stripe_spt": [{
+    "com.agentscore.payment.stripe_spt": [{
       id: "stripe-spt",
       version: HANDLER_VERSION,
       spec: `${SPEC_BASE}/stripe_spt`,
@@ -1886,6 +1908,7 @@ export {
   defaultA2aServices,
   defaultDiscoveryPaths,
   echoRequestIdHeaderHono,
+  enrichBazaarDiscoveryExtensions,
   isDiscoveryPath,
   isDiscoveryProbeRequest,
   llmsTxtIdentitySection,