feat: add attestation extension for third-party verification

[A1igator]

Summary

• Generic attestation extension for third-party verification in x402 payment flows
• Works with any scheme (escrow, exact, etc.) — not escrow-specific
• No operatorAddress parameter — attestor manages its own identity
• Two hooks: enrichPaymentRequiredResponse (identity in 402) + enrichSettlementResponse (acknowledgment in 200)

Usage

import { createAttestationExtension, declareAttestationExtension } from "@x402r/evm/extensions/attestation";

// Merchant setup
const resourceServer = new x402ResourceServer(facilitatorClient)
  .registerExtension(createAttestationExtension("https://arbiter.example.com"));

// Route config (only escrow routes, or any route)
app.use(paymentMiddleware({
  "GET /weather": {
    accepts: [{ scheme: "escrow", ... }],
    ...declareAttestationExtension(),
  },
}, resourceServer));

Attestor API

The extension expects two endpoints on the attestor:

• GET /identity — returns signed AttestationIdentity (role, operator, info, signature)
• POST /verify — accepts { responseBody, transaction, network, contentHash }, returns { acknowledgment } with signed AttestationAcknowledgment

Signing utilities

For attestor implementors:

• signAttestationIdentity(account, operator, role, info) — EIP-712 signed identity
• signAttestationAcknowledgment(account, { operator, transaction, network, contentHash }) — EIP-712 signed acknowledgment

Test plan

• Typecheck passes
• Build passes
• Integration test with garbage detector example

🤖 Generated with Claude Code