@astrasyncai/verification-gateway 2.3.9 → 2.4.0

package/dist/{express-BiB51d5t.d.mts → express-4Vau6x6X.d.mts}

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { V as VerificationResult, E as ExpressMiddlewareOptions, A as AstraSyncCredentials } from './types-UYT4GdPW.mjs';
+import { V as VerificationResult, E as ExpressMiddlewareOptions, A as AstraSyncCredentials } from './types-BVp22KkN.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/{express-D6tEDU08.d.ts → express-Nq-wWICa.d.ts}

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { V as VerificationResult, E as ExpressMiddlewareOptions, A as AstraSyncCredentials } from './types-UYT4GdPW.js';
+import { V as VerificationResult, E as ExpressMiddlewareOptions, A as AstraSyncCredentials } from './types-BVp22KkN.js';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/gateway/gateway.d.mts

@@ -1,5 +1,5 @@
-import { b as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-CKafuHDn.mjs';
-import '../types-UYT4GdPW.mjs';
+import { b as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-pU2O0BFq.mjs';
+import '../types-BVp22KkN.mjs';
 
 /**
  * AstraSyncGateway — Primary API surface for agent verification.

package/dist/gateway/gateway.d.ts

@@ -1,5 +1,5 @@
-import { b as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-ppkhdldJ.js';
-import '../types-UYT4GdPW.js';
+import { b as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-DVCWReEN.js';
+import '../types-BVp22KkN.js';
 
 /**
  * AstraSyncGateway — Primary API surface for agent verification.

package/dist/gateway/gateway.js

@@ -3278,6 +3278,9 @@ async function verify(config, request) {
       verifiedAt: /* @__PURE__ */ new Date(),
       // Extract sessionId so decisions can be recorded for denials too
       sessionId: apiResponse.sessionId,
+      // v2.3.10 (defect #34, round-4): anonymous traffic has no session →
+      // correlationId is the linking key for paired local_override events.
+      correlationId: apiResponse.correlationId,
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons
     };
@@ -3318,6 +3321,9 @@ async function verify(config, request) {
     cacheTtl: mergedConfig.cacheTtl,
     // Handshake Protocol v10 enhanced fields (present when backend returns them)
     sessionId: apiResponse.sessionId,
+    // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId
+    // (no session row exists for unverified callers).
+    correlationId: apiResponse.correlationId,
     runtimeChallenge: apiResponse.runtimeChallenge,
     tokenGuidance: apiResponse.tokenGuidance,
     recommendation: apiResponse.recommendation,