Three ways in.
Start with the one that runs today.

npm install @aria-registry/verify@1.1.0

import { verifyAgent } from '@aria-registry/verify';

// `credential` is the AID JSON the agent presented, or the document at
// https://api.aria.bar/v1/aids/<did>. Verification runs offline.
const result = await verifyAgent(credential);

if (result.valid) {
  result.did;                  // "did:aria:example.com:my-agent"
  result.trustLevel;           // "L0" today; L1–L3 once issued
  result.scopes;               // ["commerce:order:create", …]
  result.credentialId;         // credential-instance URL
  result.principal
    .verificationStatus;       // "self-declared" | "registry-confirmed"
                               // | "legal-verified" | null
  result.revocationStatus;     // 'unknown' — verifyAgent never checks revocation.
                               // Use checkRevocation(did), or a policy that requires it.
}

import { verifyAgent } from '@aria-registry/verify';

const result = await verifyAgent(credential, {
  // requireRevocationCheck is what makes revocation part of the verdict at all:
  // without it verifyAgent returns revocationStatus 'unknown' and passes.
  // maxOfflineAge bounds how old that evidence may be (ATP/1 fresh=, floor 60 s);
  // never null, which means "any age" and lets a revoked AID pass from cache.
  policy: {
    requireRevocationCheck: true,
    lastRevocationCheck: await lastCheckedAt(did),   // your cache, refreshed by checkRevocation()
    maxOfflineAge: 60 * 60 * 1000,
    requirePrincipalVerified: true,
  },
});
// Self-declared principals fail: result.policyResult.passed === false and
// result.policyResult.reason starts with "PRINCIPAL_NOT_VERIFIED:"

_aria-policy.yourdomain.com  TXT  "v=ATP1; min=L0; enforce=monitor; rua=mailto:you@yourdomain.com"

import { verifyAgent } from '@aria-registry/verify';
import type { MiddlewareHandler } from 'hono';

// IDENTIFICATION ONLY. The header name below is a placeholder: no ATP wire
// binding is published yet (protocol decision D7), so there is no standard
// way to carry a presentation. AIDs are public documents: anyone can fetch your
// competitor's from /v1/aids/{did} and replay it. Without the holder proof
// (ATP/1 step 2, in deployment) this tells you WHICH agent a request claims
// to be, not that the caller holds its key. Do not gate writes on this.
// Log it, rate it, route it — the monitor mode of your _aria-policy.

// Scope match per spec §6: exact, or a trailing wildcard on the action.
const covers = (granted: string, wanted: string) =>
  granted === wanted || (granted.endsWith(':*') && wanted.startsWith(granted.slice(0, -1)));

export const identifyAgent = (scope: string): MiddlewareHandler => async (c, next) => {
  const header = c.req.header('X-ARIA-AID');
  if (!header) return next();                                  // anonymous: still served
  const credential = JSON.parse(Buffer.from(header, 'base64url').toString('utf8'));
  const result = await verifyAgent(credential, { policy: { maxOfflineAge: 60 * 60 * 1000 } });
  c.set('agent', {
    did: result.valid ? result.did : null,
    level: result.valid ? result.trustLevel : null,
    inScope: result.valid && result.scopes.some(s => covers(s, scope)),
  });
  await next();
};

// Read-only route: the identity is logged with the request, nothing is authorized by it.
app.get('/catalog', identifyAgent('commerce:catalog:read'), listCatalog);

curl -s -X POST https://api.aria.bar/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"verify_aid","arguments":{"did":"did:aria:example.com:my-agent"}}}'

# tools/list works the same way, without a session.

$ curl -s https://api.aria.bar/.well-known/aria
{
  "protocol": "ARIA",
  "didMethod": "did:aria",
  "cryptoSuites": ["mldsa65-ed25519-2026"],
  "issuer": "did:aria:registry.aria.bar",
  "statusList": "https://api.aria.bar/v1/status/1",
  "api": "https://api.aria.bar/v1",
  "mcp": "https://api.aria.bar/mcp",
  "spec": "https://aria.bar/spec"
}