x402-trust-layer 5.1.0

package/dist/protocol/trust-score-v2.d.ts

@@ -0,0 +1,33 @@
+export type TrustScoreV2Input = {
+    agentId: string;
+    walletAddress: string;
+    disputeRatePct?: number;
+    refundRatePct?: number;
+    uptimePct?: number;
+    slaCompliancePct?: number;
+    deliveryQualityScore?: number;
+    stakeWeightUsdc?: number;
+    counterpartyCount?: number;
+    economicValueUsdc?: number;
+};
+export type TrustScoreV2Result = {
+    trustScore: number;
+    tier: string;
+    dimensions: Record<string, number>;
+    sybilResistance: {
+        clusterRisk: number;
+        flags: string[];
+    };
+    proof: {
+        algorithm: "trustscore-v2-hmac";
+        digest: string;
+        signature: string;
+        issuedAt: string;
+    };
+    erc8004?: {
+        trustScore: number;
+        tier: string;
+        registered: boolean;
+    };
+};
+export declare function computeTrustScoreV2(input: TrustScoreV2Input): Promise<TrustScoreV2Result>;

package/dist/protocol/trust-score-v2.js

@@ -0,0 +1,78 @@
+import { runAgentVerify } from "../agents/agent-verify.js";
+import { hmacSign, sha256Hex } from "./crypto.js";
+import { readProtocolStore, writeProtocolStore } from "./store.js";
+export async function computeTrustScoreV2(input) {
+    let erc8004;
+    try {
+        const v = await runAgentVerify({
+            walletAddress: input.walletAddress,
+            agentId: input.agentId,
+        });
+        erc8004 = {
+            trustScore: v.trustScore,
+            tier: v.tier,
+            registered: v.registered,
+        };
+    }
+    catch {
+        erc8004 = { trustScore: 0, tier: "UNKNOWN", registered: false };
+    }
+    const base = erc8004.trustScore * 0.45;
+    const success = Math.min(25, 25 - (input.disputeRatePct ?? 2) * 2);
+    const delivery = Math.min(15, (input.deliveryQualityScore ?? 70) * 0.15);
+    const uptime = Math.min(10, (input.uptimePct ?? 95) * 0.1);
+    const sla = Math.min(10, (input.slaCompliancePct ?? 90) * 0.1);
+    const stake = Math.min(10, Math.log10(1 + (input.stakeWeightUsdc ?? 0)) * 5);
+    const diversity = Math.min(10, Math.min(10, (input.counterpartyCount ?? 1) * 2));
+    const raw = base + success + delivery + uptime + sla + stake + diversity;
+    const trustScore = Math.round(Math.max(0, Math.min(100, raw)));
+    const history = await readProtocolStore("trust-history", {});
+    const key = sha256Hex(`${input.agentId}:${input.walletAddress}`).slice(0, 24);
+    const prev = history[key]?.scores ?? [];
+    const scores = [...prev, trustScore].slice(-20);
+    history[key] = { scores, updatedAt: new Date().toISOString() };
+    await writeProtocolStore("trust-history", history);
+    const variance = scores.length > 1
+        ? scores.reduce((a, b) => a + Math.abs(b - trustScore), 0) / scores.length
+        : 0;
+    const flags = [];
+    if ((input.refundRatePct ?? 0) > 15)
+        flags.push("high_refund_rate");
+    if (variance > 25)
+        flags.push("unstable_trust_history");
+    if (!erc8004.registered)
+        flags.push("no_erc8004_registration");
+    const dimensions = {
+        erc8004_base: Math.round(base),
+        transaction_success: Math.round(success),
+        delivery_quality: Math.round(delivery),
+        uptime: Math.round(uptime),
+        sla: Math.round(sla),
+        stake: Math.round(stake),
+        counterparty_diversity: Math.round(diversity),
+    };
+    const digest = sha256Hex(JSON.stringify({ agentId: input.agentId, trustScore, dimensions }));
+    const proof = {
+        algorithm: "trustscore-v2-hmac",
+        digest,
+        signature: hmacSign(digest),
+        issuedAt: new Date().toISOString(),
+    };
+    const tier = trustScore >= 85
+        ? "PLATINUM"
+        : trustScore >= 70
+            ? "GOLD"
+            : trustScore >= 50
+                ? "SILVER"
+                : trustScore >= 30
+                    ? "BRONZE"
+                    : "UNVERIFIED";
+    return {
+        trustScore,
+        tier,
+        dimensions,
+        sybilResistance: { clusterRisk: Math.min(100, flags.length * 20), flags },
+        proof,
+        erc8004,
+    };
+}

package/dist/protocol/zk-proofs.d.ts

@@ -0,0 +1,24 @@
+export type ZkProveType = "authorization" | "creditworthiness" | "reputation" | "budget" | "compliance";
+export type ZkProveInput = {
+    proofType: ZkProveType;
+    agentId: string;
+    /** Private witness — hashed, never returned in full */
+    witness: Record<string, unknown>;
+    publicInputs?: Record<string, unknown>;
+};
+export type ZkProofBundle = {
+    proofType: ZkProveType;
+    scheme: "commitment-v1-simulated" | "groth16";
+    publicInputs: Record<string, unknown>;
+    commitment: string;
+    nullifier: string;
+    verified: boolean;
+    note: string;
+    simulated: boolean;
+    productionReady: boolean;
+    disclaimer: string;
+    zkLibrary: string;
+};
+export declare function assertZkProveAllowed(): void;
+/** Commitment-based simulated proof — not a SNARK; witness never returned. */
+export declare function generateZkProof(input: ZkProveInput): ZkProofBundle;

package/dist/protocol/zk-proofs.js

@@ -0,0 +1,32 @@
+import { sha256Hex } from "./crypto.js";
+import { config } from "../config.js";
+export function assertZkProveAllowed() {
+    if (!config.zkSimulateAllowed) {
+        throw new Error("ZK prove is disabled in production. Set ALLOW_ZK_SIMULATE=1 for demo only, or integrate a real Groth16 verifier.");
+    }
+}
+/** Commitment-based simulated proof — not a SNARK; witness never returned. */
+export function generateZkProof(input) {
+    assertZkProveAllowed();
+    const witnessHash = sha256Hex(JSON.stringify(input.witness));
+    const publicInputs = {
+        agentId: input.agentId,
+        proofType: input.proofType,
+        ...(input.publicInputs ?? {}),
+    };
+    const commitment = sha256Hex(`${witnessHash}:${JSON.stringify(publicInputs)}`);
+    const nullifier = sha256Hex(`${input.agentId}:${input.proofType}:${witnessHash}`).slice(0, 32);
+    return {
+        proofType: input.proofType,
+        scheme: "commitment-v1-simulated",
+        publicInputs,
+        commitment,
+        nullifier,
+        verified: false,
+        simulated: true,
+        productionReady: false,
+        disclaimer: "This proof is cryptographically simulated (SHA256 commitment, not Groth16/PLONK). Do not use for production financial decisions.",
+        zkLibrary: "snarkjs-pending-integration",
+        note: "Simulated commitment proof — not Groth16. Roadmap: circom + on-chain verifier.",
+    };
+}

package/dist/routes/a2a-agent-card.d.ts

@@ -0,0 +1,3 @@
+import type { Express } from "express";
+/** Google A2A Agent Card discovery (/.well-known/agent.json). */
+export declare function registerA2AAgentCard(app: Express): void;

package/dist/routes/a2a-agent-card.js

@@ -0,0 +1,28 @@
+import { config } from "../config.js";
+import { listEndpoints } from "./catalog.js";
+import { SUITE_VERSION } from "../lib/version.js";
+/** Google A2A Agent Card discovery (/.well-known/agent.json). */
+export function registerA2AAgentCard(app) {
+    app.get("/.well-known/agent.json", (_req, res) => {
+        res.json({
+            name: "x402 Trust Layer",
+            description: "55 paid trust APIs for AI agents making x402 micropayments",
+            url: config.publicBaseUrl,
+            version: SUITE_VERSION,
+            protocolVersion: "0.2.6",
+            capabilities: { streaming: false, pushNotifications: false },
+            authentication: { schemes: ["x402-payment"] },
+            skills: listEndpoints().map((e) => {
+                const [, routePath] = e.path.split(" ");
+                return {
+                    id: routePath.replace(/[^a-z0-9]/gi, "_").slice(1),
+                    name: routePath,
+                    description: `${e.price} - ${e.tier} tier`,
+                    inputModes: ["application/json"],
+                    outputModes: ["application/json"],
+                    tags: ["x402", "payment", "trust", e.tier],
+                };
+            }),
+        });
+    });
+}

package/dist/routes/catalog.d.ts

@@ -0,0 +1,5 @@
+export declare function listEndpoints(): {
+    path: string;
+    price: string;
+    tier: string;
+}[];

package/dist/routes/catalog.js

@@ -0,0 +1,47 @@
+import { pricing } from "../config.js";
+import { listProtocolEndpoints } from "../routes-protocol.js";
+export function listEndpoints() {
+    return [
+        { path: "POST /api/a2a/execute", price: `$${pricing.a2aExecute}`, tier: "killer" },
+        { path: "POST /api/bedrock/preflight", price: `$${pricing.bedrockPreflight}`, tier: "orchestration" },
+        { path: "POST /api/market/buy-advisor", price: `$${pricing.marketBuyAdvisor}`, tier: "killer" },
+        { path: "POST /api/seller/audition-coach", price: `$${pricing.auditionCoach}`, tier: "killer" },
+        { path: "POST /api/x402/proxy", price: `$${pricing.x402Proxy}`, tier: "killer" },
+        { path: "POST /api/mpp/session", price: `$${pricing.mppSessionV2}`, tier: "killer" },
+        { path: "POST /api/attestation/issue", price: `$${pricing.attestationIssue}`, tier: "killer" },
+        { path: "POST /api/attestation/verify", price: `$${pricing.attestationVerify}`, tier: "killer" },
+        { path: "GET /api/attestation/registry", price: `$${pricing.trustRegistry}`, tier: "killer" },
+        { path: "POST /api/guard/pre-x402", price: `$${pricing.preX402Guard}`, tier: "bundle" },
+        { path: "POST /api/agent/verify", price: `$${pricing.agentVerify}`, tier: "identity" },
+        { path: "POST /api/pipeline/execute", price: `$${pricing.pipelineExecute}`, tier: "bundle" },
+        { path: "POST /api/payment-intent/compile", price: `$${pricing.paymentCompiler}`, tier: "orchestration" },
+        { path: "POST /api/facilitator/failover", price: `$${pricing.facilitatorFailover}`, tier: "orchestration" },
+        { path: "POST /api/mpp/session-plan", price: `$${pricing.mppBroker}`, tier: "orchestration" },
+        { path: "POST /api/spend-governor/check", price: `$${pricing.spendGovernor}`, tier: "core" },
+        { path: "POST /api/identity-gate/check", price: `$${pricing.identityGate}`, tier: "core" },
+        { path: "POST /api/risk-gate/scan", price: `$${pricing.riskGate}`, tier: "core" },
+        { path: "POST /api/router/route", price: `$${pricing.apiRouter}`, tier: "core" },
+        { path: "POST /api/research/brief", price: `$${pricing.researchBrief}`, tier: "core" },
+        { path: "POST /api/receipt-auditor/verify", price: `$${pricing.receiptAuditor}`, tier: "core" },
+        { path: "POST /api/refund-arbiter/evaluate", price: `$${pricing.refundArbiter}`, tier: "trust" },
+        { path: "POST /api/budget-allocator/run", price: `$${pricing.budgetAllocator}`, tier: "enterprise" },
+        { path: "POST /api/settlement-graph/next", price: `$${pricing.settlementGraph}`, tier: "intelligence" },
+        { path: "POST /api/quality-monitor/probe", price: `$${pricing.qualityMonitor}`, tier: "intelligence" },
+        { path: "POST /api/evidence-locker/export", price: `$${pricing.evidenceLocker}`, tier: "enterprise" },
+        { path: "POST /api/agent-escrow", price: `$${pricing.agentEscrow}`, tier: "enterprise" },
+        { path: "POST /api/merchant-trust/score", price: `$${pricing.merchantTrust}`, tier: "tier1" },
+        { path: "POST /api/mandate/compile", price: `$${pricing.mandateCompile}`, tier: "tier1" },
+        { path: "POST /api/mandate/verify", price: `$${pricing.mandateVerify}`, tier: "tier1" },
+        { path: "POST /api/rail-optimizer/route", price: `$${pricing.railOptimizer}`, tier: "tier1" },
+        { path: "POST /api/compliance/ledger", price: `$${pricing.complianceLedger}`, tier: "tier1" },
+        { path: "POST /api/dispute/resolve", price: `$${pricing.disputeResolve}`, tier: "tier1" },
+        { path: "POST /api/quality-escrow/settle", price: `$${pricing.qualityEscrow}`, tier: "tier1" },
+        { path: "POST /api/quality-escrow/semantic-settle", price: `$${pricing.qualityEscrowSemantic}`, tier: "tier1" },
+        { path: "POST /api/mandate/diff", price: `$${pricing.mandateDiff}`, tier: "tier1" },
+        { path: "POST /api/merchant-trust/certify", price: `$${pricing.merchantCertify}`, tier: "tier1" },
+        { path: "POST /api/trust-network/buyer-gate", price: `$${pricing.buyerGate}`, tier: "tier1" },
+        { path: "POST /api/pipeline/trust-v2", price: `$${pricing.pipelineTrustV2}`, tier: "tier1" },
+        { path: "POST /api/trust-network/bond/slash", price: `$${pricing.bondSlash}`, tier: "tier1" },
+        ...listProtocolEndpoints(),
+    ];
+}

package/dist/routes/register-all.d.ts

@@ -0,0 +1,3 @@
+import type { Express, RequestHandler } from "express";
+import type { PaidFn, AsyncRoute } from "./shared.js";
+export declare function registerRoutes(app: Express, paid: PaidFn, asyncRoute: AsyncRoute): Map<string, RequestHandler>;