Let createSessionOnMissing mint a sign_in session - #127
Merged
Conversation
A kind option on createSessionOnMissing rides through to POST /v1/sessions. A gate running an empty compliance policy that only needs an account to key state on could previously mint only the KYC kind, which asks the buyer for documents nothing checks. For sign_in the denial's default message says what the session actually asks for instead of the KYC copy. Needs @agent-score/sdk 2.7.10. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
createSessionOnMissinggains an optionalkind('kyc' | 'sign_in') that rides through toPOST /v1/sessions. A gate running an empty compliance policy that only needs an account to key durable state on (a prepaid balance, say) could previously auto-mint only the KYC kind, which asks the buyer for identity documents nothing in that merchant ever checks;sign_inis registration-only and still yields an operator token. When the kind issign_inthe minted denial's defaulterror.messagedescribes an account sign-in instead of the KYC copy, so a merchant using the default 403 body does not tell the agent something false. Whenkindis not set nothing changes: the body omits it and the API default applies. Takes@agent-score/sdk2.7.10, which carries the option.Type of change
Public API
CreateSessionOnMissing.kind?: 'kyc' | 'sign_in'(new, optional). No migration for existing callers.Test plan
tests/express.test.ts: a new case asserts the POST body carrieskind: 'sign_in'and that the 403'serror.messagetalks about signing in with an AgentScore account and not about KYC; the existing first-class-fields case is unchanged and still asserts the body has no extra keys when kind is unset. Locally:bun run lint,bun run typecheck(including examples),bun run test(119 files, 1825 passed, 4 skipped).Checklist
Worked with Varun. Version bumped to 2.12.0; the tag follows the merge. The first consumer is the ScaleDown store, whose bare-call 401 will carry a sign-in session through this option.
🤖 Generated with Claude Code