@agent-score/commerce 2.5.0 → 2.6.1

package/dist/{checkout-McfNpZJf.d.ts → checkout-C4RD7M0Z.d.ts}

@@ -2,6 +2,7 @@ import { T as TempoRailSpec, S as SolanaMppRailSpec, c as TempoSessionRailSpec,
 import { P as PricingBlock, R as RailKey } from './pricing-CytRwhC2.js';
 import { CreateSessionOnMissing, AgentScoreCoreOptions, DenialReason } from './core.js';
 import { a as X402Server } from './x402_server-Ciz2mls2.js';
+import { T as TrustLevel } from './types-D1slMt0H.js';
 
 /**
  * UCP (Universal Commerce Protocol) profile builder.
@@ -11,7 +12,7 @@ import { a as X402Server } from './x402_server-Ciz2mls2.js';
  * envelope, with `services` / `capabilities` / `payment_handlers` as MAPs keyed by
  * reverse-DNS service / capability / handler name.
  *
- * AgentScore identity claims layer over UCP via the `sh.agentscore.identity` capability
+ * AgentScore identity claims layer over UCP via the `com.agentscore.identity` capability
  * (vendor-namespaced; UCP doesn't define KYC/sanctions/age/jurisdiction natively). The
  * capability extends `dev.ucp.shopping.checkout` AND `dev.ucp.shopping.cart` (multi-parent,
  * the standard pattern UCP allows for capabilities that compose multiple parents).
@@ -160,7 +161,7 @@ interface BuildUCPProfileInput {
     /** Services map, keyed by service name. UCP-shopping merchants typically advertise
      *  bindings under `'dev.ucp.shopping'`. */
     services?: Record<string, UCPServiceBinding[]>;
-    /** Capabilities map, keyed by capability name. The `sh.agentscore.identity` capability
+    /** Capabilities map, keyed by capability name. The `com.agentscore.identity` capability
      *  is auto-added when `agentscore_gate` is provided. */
     capabilities?: Record<string, UCPCapabilityBinding[]>;
     /** Payment handlers map, keyed by handler reverse-DNS name. */
@@ -168,7 +169,7 @@ interface BuildUCPProfileInput {
     /** JWKS — public keys the merchant signs with. REQUIRED by spec. */
     signing_keys: UCPSigningKey[];
     /** Merchant gate policy declaration. When provided, the SDK auto-injects an
-     *  `sh.agentscore.identity` capability binding into `capabilities`, with the
+     *  `com.agentscore.identity` capability binding into `capabilities`, with the
      *  policy as the binding's `config`. Static merchant declaration only — no
      *  per-operator data ever ends up on the public profile. Per-operator identity
      *  attestation lives on the AP2 risk-signal endpoint, not here. */
@@ -186,7 +187,7 @@ interface BuildUCPProfileInput {
     /** Vendor-specific extras INSIDE the `ucp` envelope (alongside `version`, `services`, etc.). */
     ucp_extras?: Record<string, unknown>;
 }
-/** Merchant gate policy declared on the UCP profile via `sh.agentscore.identity` capability config.
+/** Merchant gate policy declared on the UCP profile via `com.agentscore.identity` capability config.
  *  All fields optional; merchant declares which AgentScore checks the gate enforces. Snake-case
  *  field names match the AgentScore API's `/v1/assess` policy contract verbatim — no conversion
  *  layer between this declaration and what the gate actually enforces at runtime. */
@@ -210,7 +211,7 @@ interface AgentScoreGatePolicy {
  * signing_keys: [...] }`. Pass through `signUCPProfile` to attach a JWS signature for
  * trust-mode verifiers.
  *
- * Auto-injects `sh.agentscore.identity` as a vendor capability extending both
+ * Auto-injects `com.agentscore.identity` as a vendor capability extending both
  * `dev.ucp.shopping.checkout` and `dev.ucp.shopping.cart` when `agentscore_gate`
  * is provided. The capability's `config` carries the merchant's static gate
  * policy declaration (require_kyc / require_sanctions_clear / min_age /
@@ -240,10 +241,10 @@ interface AgentScoreGatePolicy {
  * ```
  */
 declare function buildUCPProfile(input: BuildUCPProfileInput): UCPProfile;
-declare const AGENTSCORE_UCP_CAPABILITY = "sh.agentscore.identity";
+declare const AGENTSCORE_UCP_CAPABILITY = "com.agentscore.identity";
 type MppRailSpec = TempoRailSpec | SolanaMppRailSpec | TempoSessionRailSpec;
 /**
- * Build the `sh.agentscore.payment.mpp` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.mpp` payment handler block for a UCP profile.
  *
  * Pass any mix of `TempoRailSpec`, `SolanaMppRailSpec`, and `TempoSessionRailSpec`.
  *
@@ -266,7 +267,7 @@ declare function mppPaymentHandler({ networks, }: {
     networks: MppRailSpec[];
 }): Record<string, UCPPaymentHandlerBinding[]>;
 /**
- * Build the `sh.agentscore.payment.x402` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.x402` payment handler block for a UCP profile.
  *
  * @example
  * ```ts
@@ -282,7 +283,7 @@ declare function x402PaymentHandler({ networks, }: {
     networks: X402BaseRailSpec[];
 }): Record<string, UCPPaymentHandlerBinding[]>;
 /**
- * Build the `sh.agentscore.payment.stripe_spt` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.stripe_spt` payment handler block for a UCP profile.
  *
  * @example
  * ```ts
@@ -534,7 +535,7 @@ type RunGateFn = (ctx: CheckoutContext) => Promise<GateDenial | null>;
 interface CheckoutGateConfig {
     /** AgentScore API key. Required when `runGate` is omitted. */
     apiKey?: string;
-    /** Override the default `https://api.agentscore.sh` base URL. */
+    /** Override the default `https://api.agentscore.com` base URL. */
     baseUrl?: string;
     /** Prepended to the default User-Agent on API calls. */
     userAgent?: string;
@@ -594,7 +595,7 @@ interface AipGateConfig {
      *  Omit/empty to accept only AgentScore-issued AITs. */
     trustedIssuers?: string[];
     /** Clock-skew tolerance in seconds for the RFC 9421 signature window (and, as an override,
-     *  the AIT JWT `exp`/`iat`). Defaults to 30s for the signature / 60s for the JWT. */
+     *  the AIT JWT `exp`/`iat`). Defaults to 60s for both. */
     maxSkewSeconds?: number;
     /** Expected `@authority` (public hostname) the RFC 9421 signature must cover. When set, the
      *  verifier binds the signature to this value instead of trusting the inbound `Host` header —
@@ -602,6 +603,15 @@ interface AipGateConfig {
      *  not normalize `Host`, to prevent a captured AIT+signature from being replayed to a
      *  different virtual host on the same origin. */
     authority?: string;
+    /** Minimum `trust_level` an AIT must assert to pass this gate (autonomous < human_present <
+     *  human_confirmed) — the spec's human-presence gate (e.g. require `human_confirmed` for
+     *  checkout). Enforced at the edge from the verified token; insufficient → 403 weak_auth with
+     *  `required_trust_level`. Unset = any trust level accepted. */
+    requireTrustLevel?: TrustLevel;
+    /** Acceptable `auth.amr` methods (RFC 8176); the AIT must carry at least one (e.g.
+     *  `['face','fpt','hwk']` to require strong human auth). Insufficient → 403 weak_auth with
+     *  `required_amr`. Unset = not enforced. */
+    requireAmr?: string[];
     /** Per-issuer compliance policy override, keyed by issuer URL (canonicalized before lookup).
      *  When a request's AIT is verified and its `iss` matches a key here, that block REPLACES the
      *  gate's default policy fields (`requireKyc` / `requireSanctionsClear` / `minAge` /
@@ -800,9 +810,19 @@ declare class Checkout {
     readonly mintReferenceId: ReferenceIdFn | undefined;
     readonly onSettled: OnSettledFn | undefined;
     readonly isCachedAddress: IsCachedAddressFn | undefined;
+    /** Lowercased static recipient addresses for the x402-base rail(s). When the merchant
+     *  configured a static recipient and supplied no `isCachedAddress`, the gate binds the
+     *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
+    private readonly x402StaticRecipients;
     readonly zeroSettleCarveOut: boolean;
     readonly gate: CheckoutGateConfig | undefined;
     readonly discoveryExtensions: Record<string, unknown> | undefined;
+    readonly resourceInfo: {
+        serviceName?: string;
+        tags?: string[];
+        iconUrl?: string;
+        description?: string;
+    } | undefined;
     readonly discoveryProbe: DiscoveryProbeConfig | undefined;
     private _x402ServerGetter;
     /** Lazily-built JWKS cache for AIP verification, shared across requests so issuer keys
@@ -853,7 +873,10 @@ declare class Checkout {
         /** Runs after a settle lands; can return an inline response body for API sellers. */
         onSettled?: OnSettledFn;
         /** Pass when the merchant mints per-order addresses so `verifyX402Request` can
-         *  confirm the `payTo` was minted by this merchant. Defaults to permissive. */
+         *  confirm the `payTo` was minted by this merchant (e.g. `piCache.hasAddress`).
+         *  When omitted, Checkout auto-binds the agent-supplied `payTo` to the rail's
+         *  configured STATIC recipient(s) — the permissive default applies ONLY when no
+         *  static recipient exists (pure per-order minting). */
         isCachedAddress?: IsCachedAddressFn;
         /** Engage the EIP-3009 value=0 + pympp `proof` carve-out when pricing
          *  resolves to $0. Goods merchants offering free redemption codes set this
@@ -869,6 +892,16 @@ declare class Checkout {
          *  `extensions` field so Bazaar crawlers and other spec-compliant clients
          *  read the route's declared input/output schema. */
         discoveryExtensions?: Record<string, unknown>;
+        /** Optional x402 v2 ResourceInfo metadata advertised on the 402 (both the
+         *  body and the PAYMENT-REQUIRED header): `serviceName` / `tags` (max 5) /
+         *  `iconUrl` / `description`, used by Bazaar search + filtering. `url` and
+         *  `mimeType` are filled automatically from the request. */
+        resourceInfo?: {
+            serviceName?: string;
+            tags?: string[];
+            iconUrl?: string;
+            description?: string;
+        };
         /** Optional discovery-probe config: auto-route empty-body POSTs without a
          *  payment header to a sample 402 advertising the merchant's shape for
          *  crawlers (`awal x402 details`, x402-proxy, x402scan, ...). */
@@ -915,7 +948,7 @@ declare class Checkout {
      *   - `AGENTSCORE_API_KEY` — required. No key → one-time warning + skip
      *     (dev/testnet pattern; production should always configure a key).
      *   - `AGENTSCORE_BASE_URL` — optional override for staging/dev API
-     *     (e.g. `https://api-dev.agentscore.sh` or `http://localhost:3002`).
+     *     (e.g. `https://api.staging.example` or `http://localhost:3002`).
      *
      * Stripe SPT (no extractable wallet signer) → skip silently; Stripe runs
      * its own OFAC screen on the buyer's Stripe account at customer creation.

package/dist/{checkout-o17dIxHi.d.mts → checkout-CzB9f_jf.d.mts}

@@ -2,6 +2,7 @@ import { T as TempoRailSpec, S as SolanaMppRailSpec, c as TempoSessionRailSpec,
 import { P as PricingBlock, R as RailKey } from './pricing-KHDqMLd7.mjs';
 import { CreateSessionOnMissing, AgentScoreCoreOptions, DenialReason } from './core.mjs';
 import { a as X402Server } from './x402_server-Ciz2mls2.mjs';
+import { T as TrustLevel } from './types-D1slMt0H.mjs';
 
 /**
  * UCP (Universal Commerce Protocol) profile builder.
@@ -11,7 +12,7 @@ import { a as X402Server } from './x402_server-Ciz2mls2.mjs';
  * envelope, with `services` / `capabilities` / `payment_handlers` as MAPs keyed by
  * reverse-DNS service / capability / handler name.
  *
- * AgentScore identity claims layer over UCP via the `sh.agentscore.identity` capability
+ * AgentScore identity claims layer over UCP via the `com.agentscore.identity` capability
  * (vendor-namespaced; UCP doesn't define KYC/sanctions/age/jurisdiction natively). The
  * capability extends `dev.ucp.shopping.checkout` AND `dev.ucp.shopping.cart` (multi-parent,
  * the standard pattern UCP allows for capabilities that compose multiple parents).
@@ -160,7 +161,7 @@ interface BuildUCPProfileInput {
     /** Services map, keyed by service name. UCP-shopping merchants typically advertise
      *  bindings under `'dev.ucp.shopping'`. */
     services?: Record<string, UCPServiceBinding[]>;
-    /** Capabilities map, keyed by capability name. The `sh.agentscore.identity` capability
+    /** Capabilities map, keyed by capability name. The `com.agentscore.identity` capability
      *  is auto-added when `agentscore_gate` is provided. */
     capabilities?: Record<string, UCPCapabilityBinding[]>;
     /** Payment handlers map, keyed by handler reverse-DNS name. */
@@ -168,7 +169,7 @@ interface BuildUCPProfileInput {
     /** JWKS — public keys the merchant signs with. REQUIRED by spec. */
     signing_keys: UCPSigningKey[];
     /** Merchant gate policy declaration. When provided, the SDK auto-injects an
-     *  `sh.agentscore.identity` capability binding into `capabilities`, with the
+     *  `com.agentscore.identity` capability binding into `capabilities`, with the
      *  policy as the binding's `config`. Static merchant declaration only — no
      *  per-operator data ever ends up on the public profile. Per-operator identity
      *  attestation lives on the AP2 risk-signal endpoint, not here. */
@@ -186,7 +187,7 @@ interface BuildUCPProfileInput {
     /** Vendor-specific extras INSIDE the `ucp` envelope (alongside `version`, `services`, etc.). */
     ucp_extras?: Record<string, unknown>;
 }
-/** Merchant gate policy declared on the UCP profile via `sh.agentscore.identity` capability config.
+/** Merchant gate policy declared on the UCP profile via `com.agentscore.identity` capability config.
  *  All fields optional; merchant declares which AgentScore checks the gate enforces. Snake-case
  *  field names match the AgentScore API's `/v1/assess` policy contract verbatim — no conversion
  *  layer between this declaration and what the gate actually enforces at runtime. */
@@ -210,7 +211,7 @@ interface AgentScoreGatePolicy {
  * signing_keys: [...] }`. Pass through `signUCPProfile` to attach a JWS signature for
  * trust-mode verifiers.
  *
- * Auto-injects `sh.agentscore.identity` as a vendor capability extending both
+ * Auto-injects `com.agentscore.identity` as a vendor capability extending both
  * `dev.ucp.shopping.checkout` and `dev.ucp.shopping.cart` when `agentscore_gate`
  * is provided. The capability's `config` carries the merchant's static gate
  * policy declaration (require_kyc / require_sanctions_clear / min_age /
@@ -240,10 +241,10 @@ interface AgentScoreGatePolicy {
  * ```
  */
 declare function buildUCPProfile(input: BuildUCPProfileInput): UCPProfile;
-declare const AGENTSCORE_UCP_CAPABILITY = "sh.agentscore.identity";
+declare const AGENTSCORE_UCP_CAPABILITY = "com.agentscore.identity";
 type MppRailSpec = TempoRailSpec | SolanaMppRailSpec | TempoSessionRailSpec;
 /**
- * Build the `sh.agentscore.payment.mpp` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.mpp` payment handler block for a UCP profile.
  *
  * Pass any mix of `TempoRailSpec`, `SolanaMppRailSpec`, and `TempoSessionRailSpec`.
  *
@@ -266,7 +267,7 @@ declare function mppPaymentHandler({ networks, }: {
     networks: MppRailSpec[];
 }): Record<string, UCPPaymentHandlerBinding[]>;
 /**
- * Build the `sh.agentscore.payment.x402` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.x402` payment handler block for a UCP profile.
  *
  * @example
  * ```ts
@@ -282,7 +283,7 @@ declare function x402PaymentHandler({ networks, }: {
     networks: X402BaseRailSpec[];
 }): Record<string, UCPPaymentHandlerBinding[]>;
 /**
- * Build the `sh.agentscore.payment.stripe_spt` payment handler block for a UCP profile.
+ * Build the `com.agentscore.payment.stripe_spt` payment handler block for a UCP profile.
  *
  * @example
  * ```ts
@@ -534,7 +535,7 @@ type RunGateFn = (ctx: CheckoutContext) => Promise<GateDenial | null>;
 interface CheckoutGateConfig {
     /** AgentScore API key. Required when `runGate` is omitted. */
     apiKey?: string;
-    /** Override the default `https://api.agentscore.sh` base URL. */
+    /** Override the default `https://api.agentscore.com` base URL. */
     baseUrl?: string;
     /** Prepended to the default User-Agent on API calls. */
     userAgent?: string;
@@ -594,7 +595,7 @@ interface AipGateConfig {
      *  Omit/empty to accept only AgentScore-issued AITs. */
     trustedIssuers?: string[];
     /** Clock-skew tolerance in seconds for the RFC 9421 signature window (and, as an override,
-     *  the AIT JWT `exp`/`iat`). Defaults to 30s for the signature / 60s for the JWT. */
+     *  the AIT JWT `exp`/`iat`). Defaults to 60s for both. */
     maxSkewSeconds?: number;
     /** Expected `@authority` (public hostname) the RFC 9421 signature must cover. When set, the
      *  verifier binds the signature to this value instead of trusting the inbound `Host` header —
@@ -602,6 +603,15 @@ interface AipGateConfig {
      *  not normalize `Host`, to prevent a captured AIT+signature from being replayed to a
      *  different virtual host on the same origin. */
     authority?: string;
+    /** Minimum `trust_level` an AIT must assert to pass this gate (autonomous < human_present <
+     *  human_confirmed) — the spec's human-presence gate (e.g. require `human_confirmed` for
+     *  checkout). Enforced at the edge from the verified token; insufficient → 403 weak_auth with
+     *  `required_trust_level`. Unset = any trust level accepted. */
+    requireTrustLevel?: TrustLevel;
+    /** Acceptable `auth.amr` methods (RFC 8176); the AIT must carry at least one (e.g.
+     *  `['face','fpt','hwk']` to require strong human auth). Insufficient → 403 weak_auth with
+     *  `required_amr`. Unset = not enforced. */
+    requireAmr?: string[];
     /** Per-issuer compliance policy override, keyed by issuer URL (canonicalized before lookup).
      *  When a request's AIT is verified and its `iss` matches a key here, that block REPLACES the
      *  gate's default policy fields (`requireKyc` / `requireSanctionsClear` / `minAge` /
@@ -800,9 +810,19 @@ declare class Checkout {
     readonly mintReferenceId: ReferenceIdFn | undefined;
     readonly onSettled: OnSettledFn | undefined;
     readonly isCachedAddress: IsCachedAddressFn | undefined;
+    /** Lowercased static recipient addresses for the x402-base rail(s). When the merchant
+     *  configured a static recipient and supplied no `isCachedAddress`, the gate binds the
+     *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
+    private readonly x402StaticRecipients;
     readonly zeroSettleCarveOut: boolean;
     readonly gate: CheckoutGateConfig | undefined;
     readonly discoveryExtensions: Record<string, unknown> | undefined;
+    readonly resourceInfo: {
+        serviceName?: string;
+        tags?: string[];
+        iconUrl?: string;
+        description?: string;
+    } | undefined;
     readonly discoveryProbe: DiscoveryProbeConfig | undefined;
     private _x402ServerGetter;
     /** Lazily-built JWKS cache for AIP verification, shared across requests so issuer keys
@@ -853,7 +873,10 @@ declare class Checkout {
         /** Runs after a settle lands; can return an inline response body for API sellers. */
         onSettled?: OnSettledFn;
         /** Pass when the merchant mints per-order addresses so `verifyX402Request` can
-         *  confirm the `payTo` was minted by this merchant. Defaults to permissive. */
+         *  confirm the `payTo` was minted by this merchant (e.g. `piCache.hasAddress`).
+         *  When omitted, Checkout auto-binds the agent-supplied `payTo` to the rail's
+         *  configured STATIC recipient(s) — the permissive default applies ONLY when no
+         *  static recipient exists (pure per-order minting). */
         isCachedAddress?: IsCachedAddressFn;
         /** Engage the EIP-3009 value=0 + pympp `proof` carve-out when pricing
          *  resolves to $0. Goods merchants offering free redemption codes set this
@@ -869,6 +892,16 @@ declare class Checkout {
          *  `extensions` field so Bazaar crawlers and other spec-compliant clients
          *  read the route's declared input/output schema. */
         discoveryExtensions?: Record<string, unknown>;
+        /** Optional x402 v2 ResourceInfo metadata advertised on the 402 (both the
+         *  body and the PAYMENT-REQUIRED header): `serviceName` / `tags` (max 5) /
+         *  `iconUrl` / `description`, used by Bazaar search + filtering. `url` and
+         *  `mimeType` are filled automatically from the request. */
+        resourceInfo?: {
+            serviceName?: string;
+            tags?: string[];
+            iconUrl?: string;
+            description?: string;
+        };
         /** Optional discovery-probe config: auto-route empty-body POSTs without a
          *  payment header to a sample 402 advertising the merchant's shape for
          *  crawlers (`awal x402 details`, x402-proxy, x402scan, ...). */
@@ -915,7 +948,7 @@ declare class Checkout {
      *   - `AGENTSCORE_API_KEY` — required. No key → one-time warning + skip
      *     (dev/testnet pattern; production should always configure a key).
      *   - `AGENTSCORE_BASE_URL` — optional override for staging/dev API
-     *     (e.g. `https://api-dev.agentscore.sh` or `http://localhost:3002`).
+     *     (e.g. `https://api.staging.example` or `http://localhost:3002`).
      *
      * Stripe SPT (no extractable wallet signer) → skip silently; Stripe runs
      * its own OFAC screen on the buyer's Stripe account at customer creation.

package/dist/core.d.mts

@@ -1,12 +1,18 @@
+import { AipSignatureMaterial } from '@agent-score/sdk';
 import { P as PaymentSigner } from './signer-3FAit11j.mjs';
 
 interface AgentIdentity {
     address?: string;
     operatorToken?: string;
-    /** Raw AIP Agent Identity Token (a JWT). When set, the gate has already verified the
-     *  token's RFC 9421 proof-of-possession at the edge; `evaluate` sends it to `/v1/assess`
-     *  as `aip_token` for server-side IdP-signature re-verification + policy enrichment. */
+    /** Raw AIP Agent Identity Token (a JWT). When set, the gate has verified the token's RFC 9421
+     *  proof-of-possession at the edge as a fail-fast filter; `evaluate` forwards it to `/v1/assess`
+     *  as `aip_token` (with {@link aipSignature}) for AUTHORITATIVE server-side re-verification of the
+     *  IdP signature + proof-of-possession + policy. */
     aipToken?: string;
+    /** RFC 9421 signature material accompanying {@link aipToken}, forwarded to `/v1/assess` as
+     *  `aip_signature` so the API re-verifies proof-of-possession itself (the edge is not trusted as
+     *  the authority). Always set together with `aipToken`. */
+    aipSignature?: AipSignatureMaterial;
 }
 /**
  * Session metadata returned from `POST /v1/sessions`. Surfaced to the `onBeforeSession`
@@ -70,7 +76,7 @@ interface AgentScoreCoreOptions {
     failOpen?: boolean;
     /** How long to cache results, in seconds. Defaults to 300. */
     cacheSeconds?: number;
-    /** AgentScore API base URL. Defaults to "https://api.agentscore.sh". */
+    /** AgentScore API base URL. Defaults to "https://api.agentscore.com". */
     baseUrl?: string;
     /** Optional chain to filter scoring to. */
     chain?: string;
@@ -190,6 +196,8 @@ interface AssessResult {
         subject: string;
         trust_level?: 'autonomous' | 'human_present' | 'human_confirmed';
         agent_provider?: string;
+        /** True when /v1/assess re-verified the RFC 9421 proof-of-possession (always true on success). */
+        pop_verified?: boolean;
     };
 }
 /**
@@ -222,6 +230,12 @@ interface GateQuotaInfo {
  *   merchants can alert/log without parsing console output.
  * - `quota` propagates the SDK's per-request quota observability when the API emits the
  *   `X-Quota-*` headers. Optional; absent on Enterprise / unlimited tiers.
+ * - `signerVerdict` carries the per-request wallet-signer verdicts (signer_match + signer_sanctions)
+ *   composed by this evaluate's assess call. It rides on the RETURN VALUE (not a shared slot on the
+ *   core) so concurrent same-wallet/different-signer requests can't read each other's verdict —
+ *   the adapter stashes it on its per-request state for `getSignerVerdict(ctx)` to read back.
+ *   Present only on wallet-only identity when the response carried either signer block; `undefined`
+ *   otherwise (operator-token / AIT paths, discovery legs with no signer).
  * - `{ kind: 'deny', reason }` — the request was denied. Adapters should render a 403 with the
  *   reason, or invoke the caller's custom denial handler.
  */
@@ -231,9 +245,11 @@ type EvaluateOutcome = {
     degraded?: boolean;
     infraReason?: FailOpenInfraReason;
     quota?: GateQuotaInfo;
+    signerVerdict?: SignerVerdict;
 } | {
     kind: 'deny';
     reason: DenialReason;
+    signerVerdict?: SignerVerdict;
 };
 interface CaptureWalletOptions {
     /** Operator credential (`opc_...`) that the agent authenticated with. */
@@ -302,11 +318,6 @@ interface AgentScoreCore {
      *  it and the response includes `signer_match` + `signer_sanctions` verdicts in one
      *  round trip. */
     signer?: PaymentSigner | null): Promise<EvaluateOutcome>;
-    /** Synchronous read of the cached signer verdicts (signer_match + signer_sanctions)
-     *  populated when the gate's evaluate call was made with a pre-extracted signer. Returns
-     *  `undefined` when the gate didn't run, the request was operator-token-authenticated,
-     *  or no signer was extractable (discovery legs). */
-    getSignerVerdict(claimedAddress: string): SignerVerdict | undefined;
     /** Report a wallet seen paying under an operator credential. Fire-and-forget; silently
      *  swallows non-fatal errors because capture is informational, not on the critical path. */
     captureWallet(options: CaptureWalletOptions): Promise<void>;

package/dist/core.d.ts

@@ -1,12 +1,18 @@
+import { AipSignatureMaterial } from '@agent-score/sdk';
 import { P as PaymentSigner } from './signer-3FAit11j.js';
 
 interface AgentIdentity {
     address?: string;
     operatorToken?: string;
-    /** Raw AIP Agent Identity Token (a JWT). When set, the gate has already verified the
-     *  token's RFC 9421 proof-of-possession at the edge; `evaluate` sends it to `/v1/assess`
-     *  as `aip_token` for server-side IdP-signature re-verification + policy enrichment. */
+    /** Raw AIP Agent Identity Token (a JWT). When set, the gate has verified the token's RFC 9421
+     *  proof-of-possession at the edge as a fail-fast filter; `evaluate` forwards it to `/v1/assess`
+     *  as `aip_token` (with {@link aipSignature}) for AUTHORITATIVE server-side re-verification of the
+     *  IdP signature + proof-of-possession + policy. */
     aipToken?: string;
+    /** RFC 9421 signature material accompanying {@link aipToken}, forwarded to `/v1/assess` as
+     *  `aip_signature` so the API re-verifies proof-of-possession itself (the edge is not trusted as
+     *  the authority). Always set together with `aipToken`. */
+    aipSignature?: AipSignatureMaterial;
 }
 /**
  * Session metadata returned from `POST /v1/sessions`. Surfaced to the `onBeforeSession`
@@ -70,7 +76,7 @@ interface AgentScoreCoreOptions {
     failOpen?: boolean;
     /** How long to cache results, in seconds. Defaults to 300. */
     cacheSeconds?: number;
-    /** AgentScore API base URL. Defaults to "https://api.agentscore.sh". */
+    /** AgentScore API base URL. Defaults to "https://api.agentscore.com". */
     baseUrl?: string;
     /** Optional chain to filter scoring to. */
     chain?: string;
@@ -190,6 +196,8 @@ interface AssessResult {
         subject: string;
         trust_level?: 'autonomous' | 'human_present' | 'human_confirmed';
         agent_provider?: string;
+        /** True when /v1/assess re-verified the RFC 9421 proof-of-possession (always true on success). */
+        pop_verified?: boolean;
     };
 }
 /**
@@ -222,6 +230,12 @@ interface GateQuotaInfo {
  *   merchants can alert/log without parsing console output.
  * - `quota` propagates the SDK's per-request quota observability when the API emits the
  *   `X-Quota-*` headers. Optional; absent on Enterprise / unlimited tiers.
+ * - `signerVerdict` carries the per-request wallet-signer verdicts (signer_match + signer_sanctions)
+ *   composed by this evaluate's assess call. It rides on the RETURN VALUE (not a shared slot on the
+ *   core) so concurrent same-wallet/different-signer requests can't read each other's verdict —
+ *   the adapter stashes it on its per-request state for `getSignerVerdict(ctx)` to read back.
+ *   Present only on wallet-only identity when the response carried either signer block; `undefined`
+ *   otherwise (operator-token / AIT paths, discovery legs with no signer).
  * - `{ kind: 'deny', reason }` — the request was denied. Adapters should render a 403 with the
  *   reason, or invoke the caller's custom denial handler.
  */
@@ -231,9 +245,11 @@ type EvaluateOutcome = {
     degraded?: boolean;
     infraReason?: FailOpenInfraReason;
     quota?: GateQuotaInfo;
+    signerVerdict?: SignerVerdict;
 } | {
     kind: 'deny';
     reason: DenialReason;
+    signerVerdict?: SignerVerdict;
 };
 interface CaptureWalletOptions {
     /** Operator credential (`opc_...`) that the agent authenticated with. */
@@ -302,11 +318,6 @@ interface AgentScoreCore {
      *  it and the response includes `signer_match` + `signer_sanctions` verdicts in one
      *  round trip. */
     signer?: PaymentSigner | null): Promise<EvaluateOutcome>;
-    /** Synchronous read of the cached signer verdicts (signer_match + signer_sanctions)
-     *  populated when the gate's evaluate call was made with a pre-extracted signer. Returns
-     *  `undefined` when the gate didn't run, the request was operator-token-authenticated,
-     *  or no signer was extractable (discovery legs). */
-    getSignerVerdict(claimedAddress: string): SignerVerdict | undefined;
     /** Report a wallet seen paying under an operator credential. Fire-and-forget; silently
      *  swallows non-fatal errors because capture is informational, not on the critical path. */
     captureWallet(options: CaptureWalletOptions): Promise<void>;