feat!: agentkit cli v0.2

.changeset/rfc9421-signatures.md

@@ -0,0 +1,7 @@
+---
+'@worldcoin/agentkit-core': minor
+'@worldcoin/agentkit': minor
+'@worldcoin/agentkit-cli': minor
+---
+
+Replace the bare EIP-191 body signature with RFC 9421 HTTP Message Signatures. Requests are now signed under a closed profile covering `@method`, `@authority`, `@path`, `@query`, and `content-digest` (RFC 9530), with `created`/`expires`/`keyid` parameters, transported in the standard `Signature-Input`, `Signature`, and `Content-Digest` headers instead of `X-AgentKit`. The CLI's `prove` command now takes `<method> <url> [body]` and returns the three header values, and `verify` enforces the five-minute validity window and keyid binding. Nonce-based single-use signatures are a planned follow-up.

README.md

@@ -2,90 +2,58 @@
 
 # **AgentKit**
 
-**Verify that an agent is backed by a real, [World ID-verified human](https://docs.world.org/agents/agent-kit).**
+**Let an agent show that a person with a verified [World ID](https://docs.world.org/agents/agent-kit) controls it.**
 
-<img src="registration.gif" alt="AgentKit Registration" width="960" />
+<img src="registration.gif" alt="AgentKit registration" width="960" />
 
 </div>
 
-## Skills
-For your Agent to use your registration when accessing x402 endpoints
-```bash
-npx skills add worldcoin/agentkit agentkit-x402 
-```
+AgentKit lets an agent show that a verified person controls it. A service can use this proof to control access. AgentKit does not give the identity of the person to the service.
 
-For developers building x402 servers, add the integration guide to your knowledge base:
-```bash
-npx skills add worldcoin/agentkit integrate-agentkit
-```
+## Register an agent
 
-## How it Works
+Run this command:
 
-1. An agent wallet is registered in AgentBook using a World ID proof.
-2. A website or API using x402 challenges the agent to sign a CAIP-122 message.
-3. The server verifies the signature, resolves the registering human from AgentBook, and applies the configured access policy.
+```bash
+npx @worldcoin/agentkit-cli register
+```
 
-This lets applications distinguish between arbitrary automation and automation acting on behalf of a real human, without exposing the human's underlying identity.
+The CLI creates an identity for the agent. It then asks you to complete a World ID check in World App. You register the identity only one time.
 
-## For Agents
+For more information, read the [registration guide](./cli/REGISTRATION.md).
 
-### Register
+## Add AgentKit to a service
 
-Register your wallet in AgentBook so servers can verify you are human-backed. Registration is gasless by default (uses a hosted relay on Base mainnet).
+Install the Core package:
 
 ```bash
-npx @worldcoin/agentkit-cli register <your-wallet-address>
+npm install @worldcoin/agentkit-core
 ```
 
-This will prompt a World ID verification via World App. You only need to register once per wallet.
-
-Check whether a wallet is already registered:
+Add the integration skill to help an agent protect one endpoint:
 
 ```bash
-npx @worldcoin/agentkit-cli status <your-wallet-address>
+npx skills add worldcoin/agentkit integrate-agentkit
 ```
 
-For the full registration guide (manual mode, custom relays, Base Sepolia): [`./cli/REGISTRATION.md`](./cli/REGISTRATION.md)
+## Optional x402 support
 
-### Use
-
-Once registered, create an AgentKit client and use `agentkit.fetch` for x402 HTTP calls. It tries AgentKit verification before payment and only leaves the normal x402 payment flow in place when verification is unavailable, fails, or is exhausted.
+AgentKit also supports services that use x402. Install the server package:
 
 ```bash
 npm install @worldcoin/agentkit
 ```
 
-```typescript
-import { createAgentkitClient } from '@worldcoin/agentkit'
-
-const agentkit = createAgentkitClient({
-	signer: {
-		address: agentWallet.address,
-		chainId: 'eip155:8453',
-		type: 'eip191',
-		signMessage: message => agentWallet.signMessage(message),
-	},
-})
-
-const response = await agentkit.fetch('https://api.example.com/data')
-```
-
-If your agent cannot change its HTTP client code, install the agent skill as fallback guidance:
+Add the client skill:
 
 ```bash
 npx skills add worldcoin/agentkit agentkit-x402
 ```
 
-The full flow — parsing 402 responses, signing the CAIP-122 challenge, and sending the `agentkit` header — is documented in the agent skill: [`./skills/agentkit-x402/SKILL.md`](./skills/agentkit-x402/SKILL.md)
-
-## For x402 Developers
-
-### Integrate
-
-Add AgentKit to your x402 server to offer human-backed agents free access, free trials, or discounts.
+Add the server integration skill:
 
 ```bash
-npm install @worldcoin/agentkit
+npx skills add worldcoin/agentkit integrate-agentkit-x402
 ```
 
-For the full integration guide (client wrapper, hooks setup, access modes, World Chain payments, AgentBook configuration): [`./x402/DOCS.md`](./x402/DOCS.md)
+Read the [x402 integration guide](./x402/DOCS.md) for more information.

cli/README.md

@@ -1,26 +1,45 @@
 # @worldcoin/agentkit-cli
 
-Register agent wallet addresses with World ID-verified humans via the [AgentBook](../contracts/src/AgentBook.sol) smart contract.
+Register an agent with a World ID-verified human through AgentBook.
 
-## Quick Start
+## Usage
+
+```bash
+agentkit register
+```
 
-Prompt your agent:
+That is the entire registration command. On its first run, the CLI creates a local identity, checks whether it is already registered, and only starts World ID verification when registration is still needed. Successful registrations are submitted through the hosted relay.
 
+The private key is stored at:
+
+```text
+$XDG_CONFIG_HOME/agentkit/key
 ```
-Run `npx @worldcoin/agentkit-cli --llms`, then help me register your wallet address in the AgentBook.
+
+When `XDG_CONFIG_HOME` is not set to an absolute path, the CLI uses:
+
+```text
+~/.config/agentkit/key
 ```
 
-Use this by default. Do not ask the agent to inspect the repo to infer the flow.
+Keep this file private. Store any backup in a secure location. It is the durable identity for this agent. The CLI does not send the private key over the network. Registration sends the derived public address and World ID proof to the hosted relay.
 
-## Usage
+Full registration guide: [REGISTRATION.md](./REGISTRATION.md)
+
+## Sign a request as this agent
+
+Pass the HTTP method, the full URL, and the exact UTF-8 request body to `prove`:
 
 ```bash
-agentkit register <address> [options]
-agentkit status <address>
+agentkit prove POST 'https://api.example.com/data' '{"query":"weather","city":"Lisbon"}'
 ```
 
-By default, `agentkit register <address>` uses Base mainnet and submits through the hosted relay. Use `--manual` to print raw registration call data instead.
+For a request with no body, omit the last argument:
 
-Use `agentkit status <address>` to check whether an agent wallet is already registered in the canonical AgentBook on World Chain.
+```bash
+agentkit prove GET 'https://api.example.com/data'
+```
 
-Full registration guide: [REGISTRATION.md](./REGISTRATION.md)
+The command requires the key created by `agentkit register` and confirms that its address is registered before signing. It returns a `headers` object with three values — `Content-Digest`, `Signature-Input`, and `Signature` (RFC 9421 HTTP message signatures) — to copy onto the request unmodified.
+
+The signature is bound to the method, host, path, query string, and body, and expires after five minutes. Send the request with the exact same method, URL, and byte-identical body, and run `prove` again for each new request.