AVA Pay
The merchant-side trust gateway for AI shopping agents — one API that verifies any signed agent and tells merchants exactly what that verification means.
One install on the merchant side. One registration on the agent-issuer side. Four protocols supported out of the box — Visa Trusted Agent Protocol (the real wire format: agent-browser-auth/agent-payer-auth tags, Consumer Recognition Objects, Agentic Payment Containers, Visa-signed IdTokens), AVA's TAP-style profile (RFC 9421 + Ed25519 + x-ava-mandate), Google Agent Payments Protocol (AP2 v0.2 dSD-JWT mandate chains), and IETF Web Bot Auth (the signature scheme real ChatGPT agent traffic carries today). One protocol-agnostic VerificationResult shape downstream.
Web Bot Auth results are agent identity only — they prove which agent operator sent the request (e.g. https://chatgpt.com), not that a buyer authorized a purchase. Payment authority comes from the mandate-carrying protocols (Visa TAP, AP2).
If you're an AI agent issuer, the on-ramp is AGENT_ISSUERS.md — publish or register your public key once, and every AVA Pay merchant can verify you on any protocol you sign with.
60-second quickstart
npm install
npm run demo # AVA TAP-style profile (RFC 9421 + Ed25519 + x-ava-mandate)
npm run demo:ap2 # Google AP2 v0.2 (dSD-JWT mandate chains)
npm run demo:wba # IETF Web Bot Auth (identity-only, key-directory discovery)
npm run demo:tap # Visa Trusted Agent Protocol, real wire format
You'll see a signed request and a ✓ trusted response in well under a millisecond, on every protocol. The same primitives the demo uses are published as @ava-pay/agent on npm — that's what production agents import.
Repo layout
AVA Pay/
├── packages/
│ └── agent-sdk/ # @ava-pay/agent — publishable npm package
│ ├── src/agent/{visa,ap2}.ts # signWithVisa, buildCheckoutMandateChain, …
│ ├── src/protocol/visa/ # RFC 9421 primitives (parser, base, Ed25519 verify)
│ ├── src/protocol/ap2/ # dSD-JWT chains, v0.2 mandates, JWS primitives
│ ├── src/types.ts # canonical shared types
│ └── src/index.ts # public exports
├── src/ # API server (depends on @ava-pay/agent)
│ ├── routes/verify.ts # POST /verify, schema-validated, structured logs
│ ├── verifier/
│ │ ├── interface.ts # AgentVerifier — the swap point
│ │ ├── multi.ts # MultiProtocolVerifier — header-sniffs and dispatches
│ │ ├── visa.ts # AVA TAP-style profile verifier (x-ava-mandate)
│ │ ├── visa-tap.ts # REAL Visa TAP verifier + Visa JWKS resolver
│ │ ├── ap2.ts # AP2 verifier
│ │ ├── web-bot-auth.ts # Web Bot Auth verifier + key-directory resolvers
│ │ ├── agent-directory.ts # Static/Remote + 5-min CachingAgentDirectory (kid/protocol-aware)
│ │ ├── federated-directory.ts # federated resolution chain across roots of trust
│ │ ├── mandate.ts # shared mandate scope check
│ │ └── mock.ts # non-crypto mock for plumbing tests
│ ├── directory/
│ │ ├── types.ts # DirectoryAgentRecord, DirectoryAgentKey
│ │ ├── storage.ts # InMemory + File backed stores
│ │ ├── routes.ts # /.well-known + /directory/agents (register, lookup, revoke)
│ │ └── storage-directory.ts # adapter — verifier resolves through hosted storage
│ └── server.ts # buildServer — composes verifier, directory, static landing
├── public/ # static landing page (live in-browser demo using Web Crypto)
├── examples/agent-demo.ts # runnable Node demo (all four protocols)
├── tests/ # 634 Vitest cases — real cryptography, no fakes
├── scripts/check-type-sync.ts # CI guardrail against API↔plugin type drift
├── shopify-app/ # Shopify Remix plugin (settings + traffic dashboard + theme extension)
├── AGENT_ISSUERS.md # how AI agent issuers register with the directory
└── Dockerfile + docker-compose.yml + .github/workflows/ci.yml
여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗
