twzrd-receipt-verifier 1.0.1 → 1.0.3

package/README.md

@@ -14,6 +14,21 @@ This tool recomputes the leaf **and** checks the signature against the published
 key. If it says `VALID`, the receipt was authored by TWZRD and was not altered.
 Unsigned, wrong-key, or tampered receipts fail.
 
+## Where this fits: the agent trust loop
+
+This verifier is the **last step** of the x402 trust rail an agent runs before and
+after it spends:
+
+1. **Discover** a model/provider - [`wzrd-client`](https://pypi.org/project/wzrd-client/) (PyPI) or [`@wzrd_sol/sdk`](https://www.npmjs.com/package/@wzrd_sol/sdk) (npm)
+2. **Preflight** the seller wallet, free - `POST https://intel.twzrd.xyz/v1/intel/preflight` (or MCP `get_readiness_card_tool`)
+3. **Pay** with a signed receipt - `GET https://intel.twzrd.xyz/v1/intel/trust/{seller}` (0.05 USDC, x402)
+4. **Verify** the receipt offline - **this package** (trust nothing but the bytes + the public key)
+
+```bash
+# zero-install: verify a receipt straight from the published package
+npx twzrd-receipt-verifier receipt.json --pubkey 9V6Pn19kiUA5Rn6JpQfNduanvGt2aXGwsarosNfa2Ldf
+```
+
 ## The published signing key
 
 | field | value |

package/package.json

@@ -1,14 +1,9 @@
 {
   "name": "twzrd-receipt-verifier",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Standalone offline verifier for TWZRD AO-Receipt V5 (Ed25519-signed keccak256 leaf). No trust in TWZRD servers or code.",
   "keywords": ["twzrd", "x402", "solana", "ed25519", "keccak256", "receipt", "verifier", "agent", "attestation"],
   "homepage": "https://intel.twzrd.xyz",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/twzrd-sol/wzrd-final.git",
-    "directory": "packages/twzrd-agent-intel/verifier"
-  },
   "license": "MIT",
   "author": "TWZRD",
   "bin": {

package/verify_twzrd_receipt.js

@@ -69,17 +69,35 @@ function recomputeLeaf(pre) {
 }
 
 function fetchPublishedPubkey(baseUrl) {
-  const url = baseUrl.replace(/\/+$/, '') + '/.well-known/x402';
-  return new Promise((resolve, reject) => {
-    https.get(url, { headers: { 'User-Agent': 'twzrd-receipt-verifier/1.0' } }, (res) => {
-      let body = '';
-      res.on('data', (c) => (body += c));
-      res.on('end', () => {
-        try { resolve(JSON.parse(body).receipt.signature.public_key); }
-        catch (e) { reject(e); }
-      });
-    }).on('error', reject);
-  });
+  const base = baseUrl.replace(/\/+$/, '');
+  const paths = [
+    '/.well-known/twzrd-receipt-pubkey',
+    '/v1/intel/pubkey',
+    '/.well-known/x402',
+  ];
+  const headers = { 'User-Agent': 'twzrd-receipt-verifier/1.0' };
+
+  function fetchPath(i) {
+    if (i >= paths.length) return Promise.reject(new Error('no pubkey endpoint responded'));
+    const path = paths[i];
+    return new Promise((resolve, reject) => {
+      https.get(base + path, { headers }, (res) => {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => {
+          try {
+            const doc = JSON.parse(body);
+            resolve(path.endsWith('/x402')
+              ? doc.receipt.signature.public_key
+              : doc.public_key);
+          } catch (e) {
+            reject(e);
+          }
+        });
+      }).on('error', (err) => fetchPath(i + 1).then(resolve, reject));
+    });
+  }
+  return fetchPath(0);
 }
 
 function verify(receipt, trustedPubkey) {