@agent-score/commerce 2.6.5 → 2.6.7

package/dist/discovery/index.mjs

@@ -532,8 +532,10 @@ function buildLlmsTxt({
 }
 
 // src/discovery/openapi.ts
-function agentscoreSecuritySchemes() {
-  return {
+function agentscoreSecuritySchemes({
+  aip = false
+} = {}) {
+  const schemes = {
     OperatorToken: {
       type: "apiKey",
       in: "header",
@@ -545,15 +547,18 @@ function agentscoreSecuritySchemes() {
       in: "header",
       name: "X-Wallet-Address",
       description: "Wallet-path identity (0x... or base58). Only works on rails that carry a wallet signature (Tempo MPP, x402 EIP-3009 on Base, Solana MPP). The wallet you claim MUST sign the payment."
-    },
-    AgentIdentity: {
+    }
+  };
+  if (aip) {
+    schemes.AgentIdentity = {
       type: "apiKey",
       in: "header",
       name: "Agent-Identity",
       description: "AIP Agent Identity Token path (a JWT from a trusted issuer; AgentScore is always trusted). Opt-in. The token is bound to the agent key via `cnf`; the request MUST also carry an RFC 9421 HTTP Message Signature (`Signature-Input` + `Signature` over `@method @authority @path agent-identity`, tag `agent-identity`) proving possession. A verified AIT is the sole identity and is evaluated against the merchant policy via its attested claims."
-    },
-    siwx: siwxSecurityScheme()
-  };
+    };
+  }
+  schemes.siwx = siwxSecurityScheme();
+  return schemes;
 }
 function siwxSecurityScheme() {
   return {
@@ -705,11 +710,12 @@ function xPaymentInfoFromCheckout(opts) {
 function agentscoreOpenApiSnippets({
   security = true,
   denials = true,
-  paymentRequired = true
+  paymentRequired = true,
+  aip = false
 } = {}) {
   const out = {};
   if (security) {
-    out.securitySchemes = agentscoreSecuritySchemes();
+    out.securitySchemes = agentscoreSecuritySchemes({ aip });
   }
   if (denials || paymentRequired) {
     out.schemas = {