@astrasyncai/verification-gateway 3.11.0 → 3.12.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-BV6abBnF.mjs';
-import '../types-sy3tq8lp.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-Djw4GLtz.mjs';
+import '../types-BntuzEEn.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-C23_uaY8.js';
-import '../types-9tns4wyl.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-DHu7m9HI.js';
+import '../types-SDu4Llbe.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{index-CfHurO1P.d.ts → index-BG62SXso.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, h as ProtocolTransport, G as GatewayConfig } from './types-9tns4wyl.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-SDu4Llbe.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-D2ztkumS.d.ts → index-CLHdqs2M.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, h as ProtocolTransport } from './types-9tns4wyl.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-SDu4Llbe.js';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-Dr_XiN65.d.mts → index-CqydB4ks.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, h as ProtocolTransport, G as GatewayConfig } from './types-sy3tq8lp.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-BntuzEEn.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-BrNKDmiR.d.mts → index-DME3w3lf.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, h as ProtocolTransport } from './types-sy3tq8lp.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-BntuzEEn.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, n as StepUpApprovalInfo, p as StepUpOutcome, o as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-sy3tq8lp.mjs';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, C as CommerceArtifactsPayload, d as CommerceShieldProps, e as CounterpartyType, f as ExpressMiddlewareOptions, F as FiatSettlementBinding, g as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, h as ProtocolTransport, R as RouteAccessConfig, i as RuntimeChallengeResult, S as SDKOptions, j as SettlementArtifact, k as SettlementArtifactBinding, l as SettlementArtifactBindingBase, m as StablecoinSettlementBinding, T as TokenGuidance, q as TrustLevel, V as VerificationRequest, r as VerificationResult, s as VerifiedAgent, t as VerifiedDeveloper, u as VerifiedOrganization } from './types-sy3tq8lp.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CZkbSOeO.mjs';
-export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportUnregisteredAttempt, verify } from './verify.mjs';
-export { e as express } from './express-DCXa1oqj.mjs';
-export { n as nextjs } from './nextjs-DcQIk6Zj.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-BrNKDmiR.mjs';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-BntuzEEn.mjs';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-BntuzEEn.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Bn6bj7kt.mjs';
+export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.mjs';
+export { e as express } from './express-B39o89gf.mjs';
+export { n as nextjs } from './nextjs-D74W7wt-.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-DME3w3lf.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-Dr_XiN65.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CqydB4ks.mjs';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.mjs';
 export { MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.mjs';
@@ -145,6 +145,6 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "3.11.0";
+declare const SDK_VERSION = "3.12.0";
 
 export { EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown };

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, n as StepUpApprovalInfo, p as StepUpOutcome, o as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-9tns4wyl.js';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, C as CommerceArtifactsPayload, d as CommerceShieldProps, e as CounterpartyType, f as ExpressMiddlewareOptions, F as FiatSettlementBinding, g as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, h as ProtocolTransport, R as RouteAccessConfig, i as RuntimeChallengeResult, S as SDKOptions, j as SettlementArtifact, k as SettlementArtifactBinding, l as SettlementArtifactBindingBase, m as StablecoinSettlementBinding, T as TokenGuidance, q as TrustLevel, V as VerificationRequest, r as VerificationResult, s as VerifiedAgent, t as VerifiedDeveloper, u as VerifiedOrganization } from './types-9tns4wyl.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-H0JCLW2y.js';
-export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportUnregisteredAttempt, verify } from './verify.js';
-export { e as express } from './express-ClNtDhhc.js';
-export { n as nextjs } from './nextjs-CEBVBsdi.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-D2ztkumS.js';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-SDu4Llbe.js';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-SDu4Llbe.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CT7gdkfR.js';
+export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.js';
+export { e as express } from './express-BuxKNO_q.js';
+export { n as nextjs } from './nextjs-Ddlw_J1J.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-CLHdqs2M.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CfHurO1P.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BG62SXso.js';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.js';
 export { MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.js';
@@ -145,6 +145,6 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "3.11.0";
+declare const SDK_VERSION = "3.12.0";
 
 export { EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown };

package/dist/index.js

@@ -82,6 +82,7 @@ __export(src_exports, {
   prefetchWellKnown: () => prefetchWellKnown,
   quickVerify: () => quickVerify,
   recordDecision: () => recordDecision2,
+  reportAttempt: () => reportAttempt,
   reportUnregisteredAttempt: () => reportUnregisteredAttempt,
   sanitizeHeaders: () => sanitizeHeaders,
   sdk: () => sdk_exports,
@@ -213,7 +214,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.11.0";
+var SDK_VERSION = "3.12.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -472,6 +473,7 @@ function createGuidanceResponse(_config, reason, options = {}) {
       }
     ] : void 0,
     correlationId: options.correlationId,
+    attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
@@ -501,6 +503,8 @@ async function callVerifyAccessAPI(config, request) {
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
+  if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
@@ -528,6 +532,9 @@ async function callVerifyAccessAPI(config, request) {
     if (response.status === 410) {
       return {
         success: true,
+        // 3.12.0 (Trust Record): keep the server-echoed attempt handle even on
+        // the synthesised 410 deny shape (echoed on every branch).
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
           accessLevel: "none",
@@ -546,7 +553,8 @@ async function callVerifyAccessAPI(config, request) {
       return {
         success: false,
         error: data.message || data.error || `API returned ${response.status}`,
-        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0
+        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
       };
     }
     return data;
@@ -580,7 +588,13 @@ async function verify(config, request, options) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      return cached;
+      const hit = { ...cached };
+      if (request.attemptId) {
+        hit.attemptId = request.attemptId;
+      } else {
+        delete hit.attemptId;
+      }
+      return hit;
     }
   }
   const enrichedRequest = { ...request };
@@ -600,6 +614,7 @@ async function verify(config, request, options) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
       source: "api_error",
       correlationId: apiResponse.correlationId,
+      attemptId: apiResponse.attemptId,
       urls
     });
   }
@@ -635,6 +650,9 @@ async function verify(config, request, options) {
       // Anonymous traffic has no session → correlationId is the per-attempt
       // linking key (the sessionId-equivalent for anonymous callers).
       correlationId: apiResponse.correlationId,
+      // 3.12.0 (Trust Record): server echoes the attempt-chain handle on
+      // every branch — denials included (the funnel outlives one deny).
+      attemptId: apiResponse.attemptId,
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
@@ -686,6 +704,8 @@ async function verify(config, request, options) {
     // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId
     // (no session row exists for unverified callers).
     correlationId: apiResponse.correlationId,
+    // 3.12.0 (Trust Record): server-echoed attempt-chain handle.
+    attemptId: apiResponse.attemptId,
     runtimeChallenge: apiResponse.runtimeChallenge,
     tokenGuidance: apiResponse.tokenGuidance,
     recommendation: apiResponse.recommendation,
@@ -730,6 +750,24 @@ async function recordDecision(config, sessionId, decision, reason) {
   }).catch(() => {
   });
 }
+async function reportAttempt(config, report) {
+  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
+  const headers = { "Content-Type": "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  const body = {
+    ...report,
+    ...!report.counterpartyId && config.counterpartyId && { counterpartyId: config.counterpartyId }
+  };
+  await fetch(`${apiBaseUrl}/agents/verify-access/attempt-report`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body)
+  }).catch(() => {
+  });
+}
 async function fetchRoutes(config, counterpartyId) {
   if (!counterpartyId) return null;
   const headers = { "Content-Type": "application/json" };
@@ -6185,6 +6223,7 @@ function detectPlatformFingerprint(input) {
   prefetchWellKnown,
   quickVerify,
   recordDecision,
+  reportAttempt,
   reportUnregisteredAttempt,
   sanitizeHeaders,
   sdk,