@agent-score/commerce 2.5.0 → 2.6.1

package/dist/{gate-CWP10xPQ.d.mts → gate-D2RP6bZg.d.ts}

@@ -1,139 +1,6 @@
+import { a as AitPayload, T as TrustLevel } from './types-D1slMt0H.js';
 import { JWK } from 'jose';
 
-/**
- * AIP (Agentic Identity Protocol) token types and the claim contract.
- *
- * An Agent Identity Token (AIT) is a JWT signed by an Identity Provider (IdP). It binds a
- * verified human's identity to the specific agent presenting it (via `cnf`, RFC 7800) and
- * carries the trust level, authentication method, optional intent, and optional identity
- * claims the IdP attests to.
- *
- * This module is the single source of truth for the claim shape on the verifier side. It
- * encodes the spec's required / recommended / optional claims plus the AgentScore extension
- * claims (sanctions, jurisdiction, structured id-verification, cross-merchant graph, payment
- * signer) we carry when we act as a compliance IdP.
- *
- * Extensibility contract (per spec): the `identity` object is open. If a claim is present,
- * the IdP attests to it; verifiers ignore claims they don't recognize. Absence is the
- * "unknown" signal — IdPs do not ship `null` for "not checked".
- */
-
-/** Degree of human involvement in issuing this specific AIT. */
-type TrustLevel = 'autonomous' | 'human_present' | 'human_confirmed';
-/**
- * Authentication Method Reference values (RFC 8176 / IANA AMR registry). Open set — these
- * are the values relevant to agent identity; others are valid and pass through.
- */
-type AmrValue = 'face' | 'fpt' | 'hwk' | 'otp' | 'pin' | 'pwd' | 'sms' | 'swk' | 'user' | 'mfa';
-/** RFC 7800 confirmation claim: binds the AIT to the agent's signing key. */
-interface CnfClaim {
-    jwk: JWK;
-}
-/** Agent metadata. `provider` is required; `instance` is recommended. */
-interface AgentClaim {
-    provider: string;
-    instance?: string;
-}
-/** How the user authorized THIS AIT (not prior authentication history). */
-interface AuthClaim {
-    amr?: AmrValue[] | string[];
-    /** When the user authenticated for this token (Unix seconds). Mirrors OIDC `auth_time`. */
-    time?: number;
-}
-/** What the agent intends to do. Optional; verifiers may require it for non-read actions. */
-interface IntentClaim {
-    actions?: string[];
-    description?: string;
-}
-/** AgentScore wallet-binding extension (orthogonal to `cnf`, which binds the agent key). */
-interface PaymentSignerClaim {
-    address: string;
-    network: 'evm' | 'solana';
-    /** Relationship the IdP attests between signer and the operator graph. */
-    match?: 'linked_operator' | 'claimed_operator';
-}
-interface PaymentClaim {
-    signer?: PaymentSignerClaim;
-}
-/**
- * Identity claims (presence == IdP attestation). Spec-defined fields plus AgentScore
- * compliance extension claims. Open by contract — unknown fields are allowed and ignored.
- */
-interface IdentityClaim {
-    email?: string;
-    email_verified?: boolean;
-    name?: string;
-    phone?: string;
-    phone_verified?: boolean;
-    age_over_18?: boolean;
-    age_over_21?: boolean;
-    id_verified?: boolean;
-    id_verification?: {
-        provider?: string;
-        method?: string;
-        document_type?: string;
-        verified_at?: number;
-    };
-    /** ISO 3166-1 alpha-2, optionally with ISO 3166-2 subdivision (e.g. "US-CA"). */
-    jurisdiction?: string;
-    sanctions_clear?: boolean;
-    sanctions_checked_at?: number;
-    sanctions_providers?: string[];
-    linked_wallets?: Array<{
-        address: string;
-        network: 'evm' | 'solana';
-    }>;
-    merchants_paid?: number;
-    first_seen?: number;
-    [claim: string]: unknown;
-}
-/** The decoded AIT JWT payload. */
-interface AitPayload {
-    aip_version: string;
-    iss: string;
-    sub: string;
-    iat: number;
-    exp: number;
-    cnf: CnfClaim;
-    agent: AgentClaim;
-    trust_level?: TrustLevel;
-    auth?: AuthClaim;
-    intent?: IntentClaim;
-    identity?: IdentityClaim;
-    payment?: PaymentClaim;
-    [claim: string]: unknown;
-}
-/** The decoded AIT JWT header. */
-interface AitHeader {
-    alg: string;
-    typ?: string;
-    kid?: string;
-    [param: string]: unknown;
-}
-/**
- * Structural validation of a decoded AIT payload. Confirms the required claims are present
- * and well-typed, and enforces the one normative conditional in the spec: a
- * `human_confirmed` token MUST carry at least one `auth.amr` value.
- *
- * This is shape/contract validation only — it does NOT verify signatures (that's the
- * verifier pipeline) and does NOT apply trust policy (that's the gate / `/v1/assess`).
- */
-type AitValidationResult = {
-    ok: true;
-    payload: AitPayload;
-} | {
-    ok: false;
-    reason: AitValidationFailure;
-};
-type AitValidationFailure = 'not_an_object' | 'missing_aip_version' | 'missing_iss' | 'missing_sub' | 'missing_iat' | 'missing_exp' | 'missing_cnf' | 'missing_agent_provider' | 'human_confirmed_without_amr';
-/**
- * Detect whether a decoded JWT payload is an AIT: per spec, an AIT is discriminated by the
- * presence of `cnf` + `agent` claims (not the `typ` header).
- */
-declare const isAitShape: (payload: unknown) => boolean;
-/** Validate the structural contract of a decoded AIT payload. */
-declare const validateAitPayload: (payload: unknown) => AitValidationResult;
-
 /**
  * AIP IdP key discovery: fetch, cache, and select JWKS signing keys.
  *
@@ -172,7 +39,7 @@ type FetchLike = (url: string, init?: {
  *  gate/adapter built on it) without the merchant listing it — this SDK is the AgentScore
  *  verifier, so a merchant can't accidentally fail to trust AgentScore-issued AITs. `trustedIssuers`
  *  only needs to name ADDITIONAL external issuers. */
-declare const AGENTSCORE_CANONICAL_ISSUER = "https://agentscore.sh";
+declare const AGENTSCORE_CANONICAL_ISSUER = "https://www.agentscore.com";
 interface JwksCacheOptions {
     /** ADDITIONAL external issuer URLs to trust beyond AgentScore's own (compared after
      *  canonicalization). AgentScore's canonical issuer is always trusted; omit/empty to accept
@@ -209,6 +76,12 @@ declare class JwksCache {
     private readonly now;
     private readonly userAgent;
     private readonly cache;
+    /** Per-issuer in-flight refresh promise — coalesces concurrent refreshes to ONE upstream fetch.
+     *  Without it, a concurrent burst of distinct-kid lookups on a cold/expired cache each call
+     *  `refresh()` before any has populated the cache → N parallel JWKS GETs (refetch amplification).
+     *  The cooldown only suppresses SEQUENTIAL refetches; single-flight suppresses CONCURRENT ones.
+     *  Entry is cleared in a `finally` once the fetch settles. */
+    private readonly inflight;
     constructor(opts: JwksCacheOptions);
     /** Is this issuer on the canonicalized trust list? */
     isTrusted(iss: string): boolean;
@@ -218,7 +91,19 @@ declare class JwksCache {
      */
     getKey(iss: string, kid: string | undefined): Promise<JwksLookupResult>;
     private select;
+    /**
+     * Refresh the cached key set for `canonIssuer`, coalescing concurrent callers onto a single
+     * upstream fetch (single-flight). The first caller for an issuer with no in-flight refresh kicks
+     * off the fetch and registers the promise; concurrent callers await that same promise instead of
+     * issuing their own GET. The entry is cleared once the fetch settles so the NEXT cold/expired
+     * lookup can refresh again.
+     */
     private refresh;
+    private fetchAndCache;
+    /** Stamp the per-issuer refetch cooldown on a FAILED fetch attempt (the negative cache). Any
+     *  previously cached keys + expiry are preserved — a failed kid-miss refetch must not nuke a
+     *  still-fresh key set; only the cooldown and failure reason are updated. */
+    private stampFailure;
 }
 
 /**
@@ -260,6 +145,12 @@ interface VerifyAitOptions {
     jwks: JwksCache;
     now?: number;
     maxSkewSeconds?: number;
+    /** Max accepted AIT lifetime (`exp - iat`) in seconds. Defense-in-depth vs an external issuer
+     *  minting a long-lived bearer credential. The spec recommends a 60–300s window; default 300 so a
+     *  stolen AIT's usable window stays short even at the edge (standalone `aipGate`, no `/v1/assess`).
+     *  Our own mint is 300s, so first-party tokens sit exactly at the ceiling. Matches the
+     *  authoritative API verifier's default (the AgentScore API verifier), lowered from 3600. */
+    maxLifetimeSeconds?: number;
 }
 /**
  * Failure reasons, aligned with AIP wire error codes. The gate maps:
@@ -276,6 +167,16 @@ interface VerifiedAit {
     /** The raw JWT string that verified (the winning `Agent-Identity` header value, Bearer
      *  prefix stripped). Lets a gate forward the exact token to `/v1/assess` as `aip_token`. */
     token: string;
+    /** The RFC 9421 signature material for this request — forwarded to `/v1/assess` as
+     *  `aip_signature` so the API re-verifies proof-of-possession authoritatively (the edge
+     *  check here is only a fail-fast filter; the API is the source of truth). */
+    signatureMaterial: {
+        method: string;
+        authority: string;
+        path: string;
+        signature_input: string;
+        signature: string;
+    };
 }
 type VerifyAitResult = {
     ok: true;
@@ -310,6 +211,26 @@ interface AipGateOptions {
     jwks: JwksCache;
     now?: number;
     maxSkewSeconds?: number;
+    /** Expected `@authority` (public hostname) the RFC 9421 signature must cover. When set, the
+     *  verifier binds the signature to this value instead of trusting the inbound `Host` header —
+     *  pin it to your real public host (e.g. `'wine.example.com'`) when behind a proxy or
+     *  multi-vhost listener that does not normalize `Host`, to prevent a captured AIT+signature
+     *  from being replayed to a different virtual host on the same origin. Same semantics as
+     *  Checkout's `AipGateConfig.authority`. */
+    authority?: string;
+    /** Minimum `trust_level` (autonomous < human_present < human_confirmed) the AIT must assert —
+     *  the spec's human-presence gate. Insufficient → 403 weak_auth with `required_trust_level`.
+     *  Enforced by {@link evaluateAipRequest} / {@link evaluateAipParts}. Unset = any trust level. */
+    requireTrustLevel?: TrustLevel;
+    /** Acceptable `auth.amr` methods (RFC 8176); the AIT must carry ≥1. Insufficient → 403 weak_auth
+     *  with `required_amr`. Unset = not enforced. */
+    requireAmr?: string[];
+    /** Identity claims the endpoint needs — surfaced as `required_claims` on insufficient_claims
+     *  denials so the agent can self-correct. Advisory only (enforce by feeding the verified claims
+     *  to your own policy / `/v1/assess`; this gate does identity + trust_level/amr). */
+    requiredClaims?: string[];
+    /** Trusted issuer URLs surfaced as `trusted_issuers` on untrusted_issuer denials. */
+    trustedIssuers?: string[];
 }
 type AipGateResult = {
     ok: true;
@@ -325,15 +246,62 @@ declare const aipErrorCode: (failure: VerifyAitFailure) => string;
 /** HTTP status for an AIP verify failure: 503 when our infra couldn't reach the IdP (retryable),
  *  403 for trust/claims, 401 for auth-presence/signature. */
 declare const aipErrorStatus: (failure: VerifyAitFailure) => 401 | 403 | 503;
-/**
- * Build an RFC 9457 problem-details body for an AIP verify failure. Adapters serialize this
- * as `application/problem+json` with {@link aipErrorStatus}.
- */
-declare const buildAipErrorBody: (failure: VerifyAitFailure) => {
+/** RFC 9457 problem-details body for an AIP denial. Known fields are typed; `required_*` /
+ *  `trusted_issuers` escalation extensions ride in the index signature. */
+type AipErrorBody = {
     type: string;
     title: string;
     status: number;
     detail: string;
+    [k: string]: unknown;
+};
+/** Merchant requirements attached to an AIP escalation body so the agent can self-correct. */
+interface AipErrorRequirements {
+    trustedIssuers?: string[];
+    requiredClaims?: string[];
+    requiredTrustLevel?: TrustLevel;
+    requiredAmr?: string[];
+}
+/**
+ * Build an RFC 9457 problem-details body for an AIP verify failure. Adapters serialize this as
+ * `application/problem+json` with {@link aipErrorStatus}. Optionally carries the merchant's
+ * requirements — `trusted_issuers` on untrusted_issuer; `required_claims` / `required_trust_level` /
+ * `required_amr` on insufficient_claims — so the agent learns what would satisfy the gate.
+ */
+declare const buildAipErrorBody: (failure: VerifyAitFailure, requirements?: AipErrorRequirements) => AipErrorBody;
+/**
+ * Check a verified AIT against the gate's `trust_level` / `auth.amr` requirements (the spec's
+ * human-presence gate). Returns a detail string when insufficient (→ weak_auth), else null.
+ */
+declare const checkTrustRequirements: (payload: {
+    trust_level?: string | undefined;
+    auth?: {
+        amr?: string[] | undefined;
+    } | undefined;
+}, requiredTrustLevel?: TrustLevel, requiredAmr?: string[]) => string | null;
+/** Build an RFC 9457 `weak_auth` body for a token that failed the trust_level / auth.amr gate. */
+declare const buildAipWeakAuthBody: (opts: {
+    detail: string;
+    requiredTrustLevel?: TrustLevel;
+    requiredAmr?: string[];
+    trustedIssuers?: string[];
+}) => AipErrorBody;
+/** A verified AIT, or a ready-to-render RFC 9457 denial body (HTTP status on `body.status`). */
+type AipGateEvaluation = {
+    ok: true;
+    ait: VerifiedAit;
+} | {
+    ok: false;
+    body: AipErrorBody;
 };
+/** Verify + trust-enforce on a standard Fetch `Request` (Hono / Web / Next.js adapters). */
+declare const evaluateAipRequest: (req: Request, opts: AipGateOptions) => Promise<AipGateEvaluation>;
+/** Verify + trust-enforce from Express/Fastify-style parts (Node header map + method + url). */
+declare const evaluateAipParts: (parts: {
+    method: string;
+    url: string;
+    headers: Record<string, string | string[] | undefined>;
+    authority?: string;
+}, opts: AipGateOptions) => Promise<AipGateEvaluation>;
 
-export { AGENTSCORE_CANONICAL_ISSUER as A, HARD_MAX_CACHE_SECONDS as H, type IdentityClaim as I, JWKS_WELL_KNOWN_PATH as J, type TrustLevel as T, type VerifiedAit as V, AGENT_IDENTITY_HEADER as a, type AipGateOptions as b, type AipGateResult as c, type AitHeader as d, type AitPayload as e, type AitValidationResult as f, type AmrValue as g, type IntentClaim as h, JwksCache as i, type JwksCacheOptions as j, type JwksLookupResult as k, type VerifyAitFailure as l, type VerifyAitOptions as m, type VerifyAitResult as n, type VerifyRequestContext as o, aipErrorCode as p, aipErrorStatus as q, buildAipErrorBody as r, canonicalizeIssuer as s, isAitShape as t, verifyAit as u, validateAitPayload as v, verifyAitRequest as w };
+export { AGENTSCORE_CANONICAL_ISSUER as A, HARD_MAX_CACHE_SECONDS as H, JWKS_WELL_KNOWN_PATH as J, type VerifiedAit as V, AGENT_IDENTITY_HEADER as a, type AipErrorRequirements as b, type AipGateEvaluation as c, type AipGateOptions as d, type AipGateResult as e, JwksCache as f, type JwksCacheOptions as g, type JwksLookupResult as h, type VerifyAitFailure as i, type VerifyAitOptions as j, type VerifyAitResult as k, type VerifyRequestContext as l, aipErrorCode as m, aipErrorStatus as n, buildAipErrorBody as o, buildAipWeakAuthBody as p, canonicalizeIssuer as q, checkTrustRequirements as r, evaluateAipParts as s, evaluateAipRequest as t, verifyAitRequest as u, verifyAit as v };

package/dist/{gate-CWP10xPQ.d.ts → gate-GCXy4FHI.d.mts}

@@ -1,139 +1,6 @@
+import { a as AitPayload, T as TrustLevel } from './types-D1slMt0H.mjs';
 import { JWK } from 'jose';
 
-/**
- * AIP (Agentic Identity Protocol) token types and the claim contract.
- *
- * An Agent Identity Token (AIT) is a JWT signed by an Identity Provider (IdP). It binds a
- * verified human's identity to the specific agent presenting it (via `cnf`, RFC 7800) and
- * carries the trust level, authentication method, optional intent, and optional identity
- * claims the IdP attests to.
- *
- * This module is the single source of truth for the claim shape on the verifier side. It
- * encodes the spec's required / recommended / optional claims plus the AgentScore extension
- * claims (sanctions, jurisdiction, structured id-verification, cross-merchant graph, payment
- * signer) we carry when we act as a compliance IdP.
- *
- * Extensibility contract (per spec): the `identity` object is open. If a claim is present,
- * the IdP attests to it; verifiers ignore claims they don't recognize. Absence is the
- * "unknown" signal — IdPs do not ship `null` for "not checked".
- */
-
-/** Degree of human involvement in issuing this specific AIT. */
-type TrustLevel = 'autonomous' | 'human_present' | 'human_confirmed';
-/**
- * Authentication Method Reference values (RFC 8176 / IANA AMR registry). Open set — these
- * are the values relevant to agent identity; others are valid and pass through.
- */
-type AmrValue = 'face' | 'fpt' | 'hwk' | 'otp' | 'pin' | 'pwd' | 'sms' | 'swk' | 'user' | 'mfa';
-/** RFC 7800 confirmation claim: binds the AIT to the agent's signing key. */
-interface CnfClaim {
-    jwk: JWK;
-}
-/** Agent metadata. `provider` is required; `instance` is recommended. */
-interface AgentClaim {
-    provider: string;
-    instance?: string;
-}
-/** How the user authorized THIS AIT (not prior authentication history). */
-interface AuthClaim {
-    amr?: AmrValue[] | string[];
-    /** When the user authenticated for this token (Unix seconds). Mirrors OIDC `auth_time`. */
-    time?: number;
-}
-/** What the agent intends to do. Optional; verifiers may require it for non-read actions. */
-interface IntentClaim {
-    actions?: string[];
-    description?: string;
-}
-/** AgentScore wallet-binding extension (orthogonal to `cnf`, which binds the agent key). */
-interface PaymentSignerClaim {
-    address: string;
-    network: 'evm' | 'solana';
-    /** Relationship the IdP attests between signer and the operator graph. */
-    match?: 'linked_operator' | 'claimed_operator';
-}
-interface PaymentClaim {
-    signer?: PaymentSignerClaim;
-}
-/**
- * Identity claims (presence == IdP attestation). Spec-defined fields plus AgentScore
- * compliance extension claims. Open by contract — unknown fields are allowed and ignored.
- */
-interface IdentityClaim {
-    email?: string;
-    email_verified?: boolean;
-    name?: string;
-    phone?: string;
-    phone_verified?: boolean;
-    age_over_18?: boolean;
-    age_over_21?: boolean;
-    id_verified?: boolean;
-    id_verification?: {
-        provider?: string;
-        method?: string;
-        document_type?: string;
-        verified_at?: number;
-    };
-    /** ISO 3166-1 alpha-2, optionally with ISO 3166-2 subdivision (e.g. "US-CA"). */
-    jurisdiction?: string;
-    sanctions_clear?: boolean;
-    sanctions_checked_at?: number;
-    sanctions_providers?: string[];
-    linked_wallets?: Array<{
-        address: string;
-        network: 'evm' | 'solana';
-    }>;
-    merchants_paid?: number;
-    first_seen?: number;
-    [claim: string]: unknown;
-}
-/** The decoded AIT JWT payload. */
-interface AitPayload {
-    aip_version: string;
-    iss: string;
-    sub: string;
-    iat: number;
-    exp: number;
-    cnf: CnfClaim;
-    agent: AgentClaim;
-    trust_level?: TrustLevel;
-    auth?: AuthClaim;
-    intent?: IntentClaim;
-    identity?: IdentityClaim;
-    payment?: PaymentClaim;
-    [claim: string]: unknown;
-}
-/** The decoded AIT JWT header. */
-interface AitHeader {
-    alg: string;
-    typ?: string;
-    kid?: string;
-    [param: string]: unknown;
-}
-/**
- * Structural validation of a decoded AIT payload. Confirms the required claims are present
- * and well-typed, and enforces the one normative conditional in the spec: a
- * `human_confirmed` token MUST carry at least one `auth.amr` value.
- *
- * This is shape/contract validation only — it does NOT verify signatures (that's the
- * verifier pipeline) and does NOT apply trust policy (that's the gate / `/v1/assess`).
- */
-type AitValidationResult = {
-    ok: true;
-    payload: AitPayload;
-} | {
-    ok: false;
-    reason: AitValidationFailure;
-};
-type AitValidationFailure = 'not_an_object' | 'missing_aip_version' | 'missing_iss' | 'missing_sub' | 'missing_iat' | 'missing_exp' | 'missing_cnf' | 'missing_agent_provider' | 'human_confirmed_without_amr';
-/**
- * Detect whether a decoded JWT payload is an AIT: per spec, an AIT is discriminated by the
- * presence of `cnf` + `agent` claims (not the `typ` header).
- */
-declare const isAitShape: (payload: unknown) => boolean;
-/** Validate the structural contract of a decoded AIT payload. */
-declare const validateAitPayload: (payload: unknown) => AitValidationResult;
-
 /**
  * AIP IdP key discovery: fetch, cache, and select JWKS signing keys.
  *
@@ -172,7 +39,7 @@ type FetchLike = (url: string, init?: {
  *  gate/adapter built on it) without the merchant listing it — this SDK is the AgentScore
  *  verifier, so a merchant can't accidentally fail to trust AgentScore-issued AITs. `trustedIssuers`
  *  only needs to name ADDITIONAL external issuers. */
-declare const AGENTSCORE_CANONICAL_ISSUER = "https://agentscore.sh";
+declare const AGENTSCORE_CANONICAL_ISSUER = "https://www.agentscore.com";
 interface JwksCacheOptions {
     /** ADDITIONAL external issuer URLs to trust beyond AgentScore's own (compared after
      *  canonicalization). AgentScore's canonical issuer is always trusted; omit/empty to accept
@@ -209,6 +76,12 @@ declare class JwksCache {
     private readonly now;
     private readonly userAgent;
     private readonly cache;
+    /** Per-issuer in-flight refresh promise — coalesces concurrent refreshes to ONE upstream fetch.
+     *  Without it, a concurrent burst of distinct-kid lookups on a cold/expired cache each call
+     *  `refresh()` before any has populated the cache → N parallel JWKS GETs (refetch amplification).
+     *  The cooldown only suppresses SEQUENTIAL refetches; single-flight suppresses CONCURRENT ones.
+     *  Entry is cleared in a `finally` once the fetch settles. */
+    private readonly inflight;
     constructor(opts: JwksCacheOptions);
     /** Is this issuer on the canonicalized trust list? */
     isTrusted(iss: string): boolean;
@@ -218,7 +91,19 @@ declare class JwksCache {
      */
     getKey(iss: string, kid: string | undefined): Promise<JwksLookupResult>;
     private select;
+    /**
+     * Refresh the cached key set for `canonIssuer`, coalescing concurrent callers onto a single
+     * upstream fetch (single-flight). The first caller for an issuer with no in-flight refresh kicks
+     * off the fetch and registers the promise; concurrent callers await that same promise instead of
+     * issuing their own GET. The entry is cleared once the fetch settles so the NEXT cold/expired
+     * lookup can refresh again.
+     */
     private refresh;
+    private fetchAndCache;
+    /** Stamp the per-issuer refetch cooldown on a FAILED fetch attempt (the negative cache). Any
+     *  previously cached keys + expiry are preserved — a failed kid-miss refetch must not nuke a
+     *  still-fresh key set; only the cooldown and failure reason are updated. */
+    private stampFailure;
 }
 
 /**
@@ -260,6 +145,12 @@ interface VerifyAitOptions {
     jwks: JwksCache;
     now?: number;
     maxSkewSeconds?: number;
+    /** Max accepted AIT lifetime (`exp - iat`) in seconds. Defense-in-depth vs an external issuer
+     *  minting a long-lived bearer credential. The spec recommends a 60–300s window; default 300 so a
+     *  stolen AIT's usable window stays short even at the edge (standalone `aipGate`, no `/v1/assess`).
+     *  Our own mint is 300s, so first-party tokens sit exactly at the ceiling. Matches the
+     *  authoritative API verifier's default (the AgentScore API verifier), lowered from 3600. */
+    maxLifetimeSeconds?: number;
 }
 /**
  * Failure reasons, aligned with AIP wire error codes. The gate maps:
@@ -276,6 +167,16 @@ interface VerifiedAit {
     /** The raw JWT string that verified (the winning `Agent-Identity` header value, Bearer
      *  prefix stripped). Lets a gate forward the exact token to `/v1/assess` as `aip_token`. */
     token: string;
+    /** The RFC 9421 signature material for this request — forwarded to `/v1/assess` as
+     *  `aip_signature` so the API re-verifies proof-of-possession authoritatively (the edge
+     *  check here is only a fail-fast filter; the API is the source of truth). */
+    signatureMaterial: {
+        method: string;
+        authority: string;
+        path: string;
+        signature_input: string;
+        signature: string;
+    };
 }
 type VerifyAitResult = {
     ok: true;
@@ -310,6 +211,26 @@ interface AipGateOptions {
     jwks: JwksCache;
     now?: number;
     maxSkewSeconds?: number;
+    /** Expected `@authority` (public hostname) the RFC 9421 signature must cover. When set, the
+     *  verifier binds the signature to this value instead of trusting the inbound `Host` header —
+     *  pin it to your real public host (e.g. `'wine.example.com'`) when behind a proxy or
+     *  multi-vhost listener that does not normalize `Host`, to prevent a captured AIT+signature
+     *  from being replayed to a different virtual host on the same origin. Same semantics as
+     *  Checkout's `AipGateConfig.authority`. */
+    authority?: string;
+    /** Minimum `trust_level` (autonomous < human_present < human_confirmed) the AIT must assert —
+     *  the spec's human-presence gate. Insufficient → 403 weak_auth with `required_trust_level`.
+     *  Enforced by {@link evaluateAipRequest} / {@link evaluateAipParts}. Unset = any trust level. */
+    requireTrustLevel?: TrustLevel;
+    /** Acceptable `auth.amr` methods (RFC 8176); the AIT must carry ≥1. Insufficient → 403 weak_auth
+     *  with `required_amr`. Unset = not enforced. */
+    requireAmr?: string[];
+    /** Identity claims the endpoint needs — surfaced as `required_claims` on insufficient_claims
+     *  denials so the agent can self-correct. Advisory only (enforce by feeding the verified claims
+     *  to your own policy / `/v1/assess`; this gate does identity + trust_level/amr). */
+    requiredClaims?: string[];
+    /** Trusted issuer URLs surfaced as `trusted_issuers` on untrusted_issuer denials. */
+    trustedIssuers?: string[];
 }
 type AipGateResult = {
     ok: true;
@@ -325,15 +246,62 @@ declare const aipErrorCode: (failure: VerifyAitFailure) => string;
 /** HTTP status for an AIP verify failure: 503 when our infra couldn't reach the IdP (retryable),
  *  403 for trust/claims, 401 for auth-presence/signature. */
 declare const aipErrorStatus: (failure: VerifyAitFailure) => 401 | 403 | 503;
-/**
- * Build an RFC 9457 problem-details body for an AIP verify failure. Adapters serialize this
- * as `application/problem+json` with {@link aipErrorStatus}.
- */
-declare const buildAipErrorBody: (failure: VerifyAitFailure) => {
+/** RFC 9457 problem-details body for an AIP denial. Known fields are typed; `required_*` /
+ *  `trusted_issuers` escalation extensions ride in the index signature. */
+type AipErrorBody = {
     type: string;
     title: string;
     status: number;
     detail: string;
+    [k: string]: unknown;
+};
+/** Merchant requirements attached to an AIP escalation body so the agent can self-correct. */
+interface AipErrorRequirements {
+    trustedIssuers?: string[];
+    requiredClaims?: string[];
+    requiredTrustLevel?: TrustLevel;
+    requiredAmr?: string[];
+}
+/**
+ * Build an RFC 9457 problem-details body for an AIP verify failure. Adapters serialize this as
+ * `application/problem+json` with {@link aipErrorStatus}. Optionally carries the merchant's
+ * requirements — `trusted_issuers` on untrusted_issuer; `required_claims` / `required_trust_level` /
+ * `required_amr` on insufficient_claims — so the agent learns what would satisfy the gate.
+ */
+declare const buildAipErrorBody: (failure: VerifyAitFailure, requirements?: AipErrorRequirements) => AipErrorBody;
+/**
+ * Check a verified AIT against the gate's `trust_level` / `auth.amr` requirements (the spec's
+ * human-presence gate). Returns a detail string when insufficient (→ weak_auth), else null.
+ */
+declare const checkTrustRequirements: (payload: {
+    trust_level?: string | undefined;
+    auth?: {
+        amr?: string[] | undefined;
+    } | undefined;
+}, requiredTrustLevel?: TrustLevel, requiredAmr?: string[]) => string | null;
+/** Build an RFC 9457 `weak_auth` body for a token that failed the trust_level / auth.amr gate. */
+declare const buildAipWeakAuthBody: (opts: {
+    detail: string;
+    requiredTrustLevel?: TrustLevel;
+    requiredAmr?: string[];
+    trustedIssuers?: string[];
+}) => AipErrorBody;
+/** A verified AIT, or a ready-to-render RFC 9457 denial body (HTTP status on `body.status`). */
+type AipGateEvaluation = {
+    ok: true;
+    ait: VerifiedAit;
+} | {
+    ok: false;
+    body: AipErrorBody;
 };
+/** Verify + trust-enforce on a standard Fetch `Request` (Hono / Web / Next.js adapters). */
+declare const evaluateAipRequest: (req: Request, opts: AipGateOptions) => Promise<AipGateEvaluation>;
+/** Verify + trust-enforce from Express/Fastify-style parts (Node header map + method + url). */
+declare const evaluateAipParts: (parts: {
+    method: string;
+    url: string;
+    headers: Record<string, string | string[] | undefined>;
+    authority?: string;
+}, opts: AipGateOptions) => Promise<AipGateEvaluation>;
 
-export { AGENTSCORE_CANONICAL_ISSUER as A, HARD_MAX_CACHE_SECONDS as H, type IdentityClaim as I, JWKS_WELL_KNOWN_PATH as J, type TrustLevel as T, type VerifiedAit as V, AGENT_IDENTITY_HEADER as a, type AipGateOptions as b, type AipGateResult as c, type AitHeader as d, type AitPayload as e, type AitValidationResult as f, type AmrValue as g, type IntentClaim as h, JwksCache as i, type JwksCacheOptions as j, type JwksLookupResult as k, type VerifyAitFailure as l, type VerifyAitOptions as m, type VerifyAitResult as n, type VerifyRequestContext as o, aipErrorCode as p, aipErrorStatus as q, buildAipErrorBody as r, canonicalizeIssuer as s, isAitShape as t, verifyAit as u, validateAitPayload as v, verifyAitRequest as w };
+export { AGENTSCORE_CANONICAL_ISSUER as A, HARD_MAX_CACHE_SECONDS as H, JWKS_WELL_KNOWN_PATH as J, type VerifiedAit as V, AGENT_IDENTITY_HEADER as a, type AipErrorRequirements as b, type AipGateEvaluation as c, type AipGateOptions as d, type AipGateResult as e, JwksCache as f, type JwksCacheOptions as g, type JwksLookupResult as h, type VerifyAitFailure as i, type VerifyAitOptions as j, type VerifyAitResult as k, type VerifyRequestContext as l, aipErrorCode as m, aipErrorStatus as n, buildAipErrorBody as o, buildAipWeakAuthBody as p, canonicalizeIssuer as q, checkTrustRequirements as r, evaluateAipParts as s, evaluateAipRequest as t, verifyAitRequest as u, verifyAit as v };

package/dist/identity/express.d.mts

@@ -1,7 +1,9 @@
-import { b as AipGateOptions, r as buildAipErrorBody, V as VerifiedAit } from '../gate-CWP10xPQ.mjs';
+import { d as AipGateOptions, o as buildAipErrorBody, V as VerifiedAit } from '../gate-GCXy4FHI.mjs';
 import { AgentScoreCoreOptions, AgentIdentity, DenialReason, CreateSessionOnMissing, AssessResult, FailOpenInfraReason, GateQuotaInfo, SignerVerdict } from '../core.mjs';
 import { Request, Response, NextFunction } from 'express';
+import '../types-D1slMt0H.mjs';
 import 'jose';
+import '@agent-score/sdk';
 import '../signer-3FAit11j.mjs';
 
 interface AgentScoreGateOptions extends Omit<AgentScoreCoreOptions, 'createSessionOnMissing'> {

package/dist/identity/express.d.ts

@@ -1,7 +1,9 @@
-import { b as AipGateOptions, r as buildAipErrorBody, V as VerifiedAit } from '../gate-CWP10xPQ.js';
+import { d as AipGateOptions, o as buildAipErrorBody, V as VerifiedAit } from '../gate-D2RP6bZg.js';
 import { AgentScoreCoreOptions, AgentIdentity, DenialReason, CreateSessionOnMissing, AssessResult, FailOpenInfraReason, GateQuotaInfo, SignerVerdict } from '../core.js';
 import { Request, Response, NextFunction } from 'express';
+import '../types-D1slMt0H.js';
 import 'jose';
+import '@agent-score/sdk';
 import '../signer-3FAit11j.js';
 
 interface AgentScoreGateOptions extends Omit<AgentScoreCoreOptions, 'createSessionOnMissing'> {