@astrasyncai/verification-gateway 3.11.1 → 3.12.0

package/dist/bin/astrasync-guard.js

@@ -4609,7 +4609,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.11.1";
+var SDK_VERSION = "3.12.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -4776,6 +4776,7 @@ function createGuidanceResponse(_config, reason, options = {}) {
       }
     ] : void 0,
     correlationId: options.correlationId,
+    attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
@@ -4805,6 +4806,8 @@ async function callVerifyAccessAPI(config, request2) {
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
+  if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
@@ -4832,6 +4835,9 @@ async function callVerifyAccessAPI(config, request2) {
     if (response.status === 410) {
       return {
         success: true,
+        // 3.12.0 (Trust Record): keep the server-echoed attempt handle even on
+        // the synthesised 410 deny shape (echoed on every branch).
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
           accessLevel: "none",
@@ -4850,7 +4856,8 @@ async function callVerifyAccessAPI(config, request2) {
       return {
         success: false,
         error: data.message || data.error || `API returned ${response.status}`,
-        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0
+        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
       };
     }
     return data;
@@ -4884,7 +4891,13 @@ async function verify(config, request2, options) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      return cached;
+      const hit = { ...cached };
+      if (request2.attemptId) {
+        hit.attemptId = request2.attemptId;
+      } else {
+        delete hit.attemptId;
+      }
+      return hit;
     }
   }
   const enrichedRequest = { ...request2 };
@@ -4904,6 +4917,7 @@ async function verify(config, request2, options) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
       source: "api_error",
       correlationId: apiResponse.correlationId,
+      attemptId: apiResponse.attemptId,
       urls
     });
   }
@@ -4939,6 +4953,9 @@ async function verify(config, request2, options) {
       // Anonymous traffic has no session → correlationId is the per-attempt
       // linking key (the sessionId-equivalent for anonymous callers).
       correlationId: apiResponse.correlationId,
+      // 3.12.0 (Trust Record): server echoes the attempt-chain handle on
+      // every branch — denials included (the funnel outlives one deny).
+      attemptId: apiResponse.attemptId,
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
@@ -4990,6 +5007,8 @@ async function verify(config, request2, options) {
     // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId
     // (no session row exists for unverified callers).
     correlationId: apiResponse.correlationId,
+    // 3.12.0 (Trust Record): server-echoed attempt-chain handle.
+    attemptId: apiResponse.attemptId,
     runtimeChallenge: apiResponse.runtimeChallenge,
     tokenGuidance: apiResponse.tokenGuidance,
     recommendation: apiResponse.recommendation,

package/dist/bin/astrasync.js

@@ -5000,7 +5000,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    SDK_VERSION = "3.11.1";
+    SDK_VERSION = "3.12.0";
   }
 });
 
@@ -5157,6 +5157,7 @@ function createGuidanceResponse(_config, reason, options = {}) {
       }
     ] : void 0,
     correlationId: options.correlationId,
+    attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
@@ -5186,6 +5187,8 @@ async function callVerifyAccessAPI(config, request2) {
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
+  if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
@@ -5213,6 +5216,9 @@ async function callVerifyAccessAPI(config, request2) {
     if (response.status === 410) {
       return {
         success: true,
+        // 3.12.0 (Trust Record): keep the server-echoed attempt handle even on
+        // the synthesised 410 deny shape (echoed on every branch).
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
           accessLevel: "none",
@@ -5231,7 +5237,8 @@ async function callVerifyAccessAPI(config, request2) {
       return {
         success: false,
         error: data.message || data.error || `API returned ${response.status}`,
-        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0
+        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
       };
     }
     return data;
@@ -5265,7 +5272,13 @@ async function verify(config, request2, options) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      return cached;
+      const hit = { ...cached };
+      if (request2.attemptId) {
+        hit.attemptId = request2.attemptId;
+      } else {
+        delete hit.attemptId;
+      }
+      return hit;
     }
   }
   const enrichedRequest = { ...request2 };
@@ -5285,6 +5298,7 @@ async function verify(config, request2, options) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
       source: "api_error",
       correlationId: apiResponse.correlationId,
+      attemptId: apiResponse.attemptId,
       urls
     });
   }
@@ -5320,6 +5334,9 @@ async function verify(config, request2, options) {
       // Anonymous traffic has no session → correlationId is the per-attempt
       // linking key (the sessionId-equivalent for anonymous callers).
       correlationId: apiResponse.correlationId,
+      // 3.12.0 (Trust Record): server echoes the attempt-chain handle on
+      // every branch — denials included (the funnel outlives one deny).
+      attemptId: apiResponse.attemptId,
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
@@ -5371,6 +5388,8 @@ async function verify(config, request2, options) {
     // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId
     // (no session row exists for unverified callers).
     correlationId: apiResponse.correlationId,
+    // 3.12.0 (Trust Record): server-echoed attempt-chain handle.
+    attemptId: apiResponse.attemptId,
     runtimeChallenge: apiResponse.runtimeChallenge,
     tokenGuidance: apiResponse.tokenGuidance,
     recommendation: apiResponse.recommendation,
@@ -5949,6 +5968,7 @@ var init_src = __esm({
     init_edge_config();
     init_platform_signatures();
     init_verify();
+    init_verify();
     init_metadata_capture();
     init_version();
   }

package/dist/browser/background.js

@@ -3938,7 +3938,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.11.1";
+var SDK_VERSION = "3.12.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -4105,6 +4105,7 @@ function createGuidanceResponse(_config, reason, options = {}) {
       }
     ] : void 0,
     correlationId: options.correlationId,
+    attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
@@ -4134,6 +4135,8 @@ async function callVerifyAccessAPI(config, request) {
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
+  if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
@@ -4161,6 +4164,9 @@ async function callVerifyAccessAPI(config, request) {
     if (response.status === 410) {
       return {
         success: true,
+        // 3.12.0 (Trust Record): keep the server-echoed attempt handle even on
+        // the synthesised 410 deny shape (echoed on every branch).
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
           accessLevel: "none",
@@ -4179,7 +4185,8 @@ async function callVerifyAccessAPI(config, request) {
       return {
         success: false,
         error: data.message || data.error || `API returned ${response.status}`,
-        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0
+        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
       };
     }
     return data;
@@ -4213,7 +4220,13 @@ async function verify(config, request, options) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      return cached;
+      const hit = { ...cached };
+      if (request.attemptId) {
+        hit.attemptId = request.attemptId;
+      } else {
+        delete hit.attemptId;
+      }
+      return hit;
     }
   }
   const enrichedRequest = { ...request };
@@ -4233,6 +4246,7 @@ async function verify(config, request, options) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
       source: "api_error",
       correlationId: apiResponse.correlationId,
+      attemptId: apiResponse.attemptId,
       urls
     });
   }
@@ -4268,6 +4282,9 @@ async function verify(config, request, options) {
       // Anonymous traffic has no session → correlationId is the per-attempt
       // linking key (the sessionId-equivalent for anonymous callers).
       correlationId: apiResponse.correlationId,
+      // 3.12.0 (Trust Record): server echoes the attempt-chain handle on
+      // every branch — denials included (the funnel outlives one deny).
+      attemptId: apiResponse.attemptId,
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
@@ -4319,6 +4336,8 @@ async function verify(config, request, options) {
     // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId
     // (no session row exists for unverified callers).
     correlationId: apiResponse.correlationId,
+    // 3.12.0 (Trust Record): server-echoed attempt-chain handle.
+    attemptId: apiResponse.attemptId,
     runtimeChallenge: apiResponse.runtimeChallenge,
     tokenGuidance: apiResponse.tokenGuidance,
     recommendation: apiResponse.recommendation,