@astrasyncai/verification-gateway 3.11.1 → 3.12.0

package/dist/local-evaluator/evaluator.d.mts

@@ -1,5 +1,5 @@
-import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-cQVCMeNV.mjs';
-import '../types-sy3tq8lp.mjs';
+import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-Djw4GLtz.mjs';
+import '../types-BntuzEEn.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/local-evaluator/evaluator.d.ts

@@ -1,5 +1,5 @@
-import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-DhFPiZ3t.js';
-import '../types-9tns4wyl.js';
+import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-DHu7m9HI.js';
+import '../types-SDu4Llbe.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{nextjs-DcQIk6Zj.d.mts → nextjs-D74W7wt-.d.mts}

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from './types-sy3tq8lp.mjs';
+import { N as NextJsMiddlewareOptions } from './types-BntuzEEn.mjs';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/{nextjs-CEBVBsdi.d.ts → nextjs-Ddlw_J1J.d.ts}

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from './types-9tns4wyl.js';
+import { N as NextJsMiddlewareOptions } from './types-SDu4Llbe.js';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/{sdk-CZkbSOeO.d.mts → sdk-Bn6bj7kt.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, q as TrustLevel, S as SDKOptions, r as VerificationResult } from './types-sy3tq8lp.mjs';
+import { a as AccessLevel, v as TrustLevel, S as SDKOptions, w as VerificationResult } from './types-BntuzEEn.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Access Level Definitions

package/dist/{sdk-H0JCLW2y.d.ts → sdk-CT7gdkfR.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, q as TrustLevel, S as SDKOptions, r as VerificationResult } from './types-9tns4wyl.js';
+import { a as AccessLevel, v as TrustLevel, S as SDKOptions, w as VerificationResult } from './types-SDu4Llbe.js';
 
 /**
  * AstraSync Universal Verification Gateway - Access Level Definitions

package/dist/transport/index.d.mts

@@ -1,4 +1,4 @@
-import '../types-sy3tq8lp.mjs';
-export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-BrNKDmiR.mjs';
+import '../types-BntuzEEn.mjs';
+export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-DME3w3lf.mjs';
 import '../metadata-capture.mjs';
 import 'jose';

package/dist/transport/index.d.ts

@@ -1,4 +1,4 @@
-import '../types-9tns4wyl.js';
-export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-D2ztkumS.js';
+import '../types-SDu4Llbe.js';
+export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-CLHdqs2M.js';
 import '../metadata-capture.js';
 import 'jose';

package/dist/{types-sy3tq8lp.d.mts → types-BntuzEEn.d.mts}

@@ -459,6 +459,16 @@ interface VerificationResult {
      * `verify_access.internal_error` 200-shaped failure shape.
      */
     correlationId?: string;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3): attempt-chain handle, server-echoed on
+     * every response branch (caller-supplied or server-minted). Disjoint from
+     * `correlationId`/`sessionId` — those identify one verification EVENT; an
+     * attempt CONTAINS events (the whole catalog → intent → settlement funnel
+     * for one shopping attempt). On a cache hit the SDK overwrites this with
+     * the current request's own attemptId (or drops it) so a cached verdict
+     * never leaks a prior attempt's id.
+     */
+    attemptId?: string;
     /** Whether step-up authentication is required */
     requiresStepUp?: boolean;
     /** Whether approval is required */
@@ -582,6 +592,98 @@ interface VerificationRequest {
      * backend's `commerceArtifacts` schema 1:1.
      */
     commerceArtifacts?: CommerceArtifactsPayload;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3) — attempt-chain handle correlating the
+     * multi-call commerce funnel (catalog → intent → settlement) into ONE
+     * attempt. Format `att_` + 32 lowercase hex. Optional: the server mints one
+     * when absent and echoes it top-level on every response branch either way.
+     * Observational pass-through — never affects the verdict, so it's excluded
+     * from the verify cache key (see `getCacheKey`).
+     */
+    attemptId?: string;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3) — first-party observational data: the
+     * offers the agent evaluated at this checkpoint (catalog browse / intent
+     * selection). Forwarded verbatim to verify-access; never affects the
+     * verdict (also excluded from the cache key).
+     */
+    considerationSet?: ConsiderationSet;
+}
+/**
+ * One offer the agent evaluated (Trust Record, §33.5 #3). Mirrors the
+ * backend's `considerationItemSchema` 1:1 — first-party observational data
+ * reported by the transport (bridge / adapters), never verified locally.
+ */
+interface ConsiderationItem {
+    /** SKU identifier as the merchant catalog publishes it (1–128 chars). */
+    sku: string;
+    /** Display title (≤256 chars). */
+    name?: string;
+    /** Price in MAJOR units (same convention as `transactionValue`), non-negative. */
+    price?: number;
+    /** ISO-4217 or settlement-asset code (3–6 alphanumeric chars). */
+    currency?: string;
+    /** Stock state as the catalog declared it; omit when the catalog didn't say. */
+    availability?: 'in_stock' | 'out_of_stock' | 'preorder' | 'unknown';
+    /** True when the agent selected this offer (intent/settlement checkpoints). */
+    chosen?: boolean;
+    /** Why an evaluated-but-unchosen offer lost, when the agent can say. */
+    notChosenReason?: 'price' | 'policy' | 'trust_threshold' | 'stock' | 'other';
+}
+/**
+ * The set of offers evaluated at one funnel checkpoint (Trust Record,
+ * §33.5 #3). Mirrors the backend's `considerationSetSchema` 1:1.
+ *
+ * `items` is capped at 50 server-side — reporters MUST order chosen items
+ * FIRST so purchased counts survive truncation; `totalEvaluated` carries the
+ * true pre-cap count and `truncated` flags that the cap was applied.
+ */
+interface ConsiderationSet {
+    /** Funnel checkpoint this set was observed at. */
+    checkpoint?: 'catalog' | 'intent' | 'settlement';
+    /** Offers evaluated (max 50; chosen-first ordering under the cap). */
+    items: ConsiderationItem[];
+    /** True evaluated count — survives the 50-item cap. */
+    totalEvaluated?: number;
+    /** True when `items` was truncated to the cap. */
+    truncated?: boolean;
+}
+/**
+ * Terminal (or notable) outcome of an attempt chain, reported post-hoc via
+ * `reportAttempt` (Trust Record, §33.5 #3). Mirrors the backend's
+ * `attemptReportSchema.outcome` 1:1.
+ */
+interface AttemptOutcome {
+    kind: 'settled' | 'blocked_step_up' | 'failed' | 'high_value_action';
+    /** Dotted ACTION-axis token for the failure class, e.g. `commerce.catalog.sku_not_found` (≤128 chars). */
+    dimension?: string;
+    /** Human-readable detail (≤512 chars). */
+    reason?: string;
+    /** For `high_value_action`: the non-payment conversion type. */
+    actionType?: 'lead' | 'signup' | 'application' | 'enquiry';
+    /** Value in MAJOR units (settled amount / estimated action value), non-negative. */
+    value?: number;
+    /** ISO-4217 or settlement-asset code (3–6 alphanumeric chars). */
+    currency?: string;
+    /** Settlement rail / mandate type, e.g. `ap2.payment_mandate` (≤64 chars). */
+    rail?: string;
+}
+/**
+ * Body for `POST /agents/verify-access/attempt-report` (Trust Record,
+ * §33.5 #3): post-hoc consideration/outcome data for an attempt chain that a
+ * verify-access call couldn't carry (e.g. the catalog was served from a local
+ * cache, or the deny happened transport-side). Must carry `considerationSet`
+ * and/or `outcome`.
+ */
+interface AttemptReport {
+    /** Attempt-chain handle — `att_` + 32 lowercase hex. */
+    attemptId: string;
+    /** Merchant/endpoint the attempt targeted; falls back to `config.counterpartyId`. */
+    counterpartyId?: string;
+    /** Canonical ASTRA-* id of the acting agent, when known. */
+    agentId?: string;
+    considerationSet?: ConsiderationSet;
+    outcome?: AttemptOutcome;
 }
 /**
  * Raw commerce-protocol artifacts as verify-access accepts them (backend
@@ -929,4 +1031,4 @@ interface CommerceShieldProps {
     className?: string;
 }
 
-export type { AccessFailure as A, CommerceArtifactsPayload as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CommerceShieldProps as d, CounterpartyType as e, ExpressMiddlewareOptions as f, GuidanceInfo as g, ProtocolTransport as h, RuntimeChallengeResult as i, SettlementArtifact as j, SettlementArtifactBinding as k, SettlementArtifactBindingBase as l, StablecoinSettlementBinding as m, StepUpApprovalInfo as n, StepUpApprovalStatus as o, StepUpOutcome as p, TrustLevel as q, VerificationResult as r, VerifiedAgent as s, VerifiedDeveloper as t, VerifiedOrganization as u };
+export type { AccessFailure as A, CallerMetadata as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, AttemptOutcome as d, AttemptReport as e, CommerceArtifactsPayload as f, CommerceShieldProps as g, ConsiderationItem as h, ConsiderationSet as i, CounterpartyType as j, ExpressMiddlewareOptions as k, GuidanceInfo as l, ProtocolTransport as m, RuntimeChallengeResult as n, SettlementArtifact as o, SettlementArtifactBinding as p, SettlementArtifactBindingBase as q, StablecoinSettlementBinding as r, StepUpApprovalInfo as s, StepUpApprovalStatus as t, StepUpOutcome as u, TrustLevel as v, VerificationResult as w, VerifiedAgent as x, VerifiedDeveloper as y, VerifiedOrganization as z };

package/dist/{types-DhFPiZ3t.d.ts → types-DHu7m9HI.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, e as CounterpartyType, T as TokenGuidance } from './types-9tns4wyl.js';
+import { a as AccessLevel, j as CounterpartyType, T as TokenGuidance } from './types-SDu4Llbe.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-cQVCMeNV.d.mts → types-Djw4GLtz.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, e as CounterpartyType, T as TokenGuidance } from './types-sy3tq8lp.mjs';
+import { a as AccessLevel, j as CounterpartyType, T as TokenGuidance } from './types-BntuzEEn.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-9tns4wyl.d.ts → types-SDu4Llbe.d.ts}

@@ -459,6 +459,16 @@ interface VerificationResult {
      * `verify_access.internal_error` 200-shaped failure shape.
      */
     correlationId?: string;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3): attempt-chain handle, server-echoed on
+     * every response branch (caller-supplied or server-minted). Disjoint from
+     * `correlationId`/`sessionId` — those identify one verification EVENT; an
+     * attempt CONTAINS events (the whole catalog → intent → settlement funnel
+     * for one shopping attempt). On a cache hit the SDK overwrites this with
+     * the current request's own attemptId (or drops it) so a cached verdict
+     * never leaks a prior attempt's id.
+     */
+    attemptId?: string;
     /** Whether step-up authentication is required */
     requiresStepUp?: boolean;
     /** Whether approval is required */
@@ -582,6 +592,98 @@ interface VerificationRequest {
      * backend's `commerceArtifacts` schema 1:1.
      */
     commerceArtifacts?: CommerceArtifactsPayload;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3) — attempt-chain handle correlating the
+     * multi-call commerce funnel (catalog → intent → settlement) into ONE
+     * attempt. Format `att_` + 32 lowercase hex. Optional: the server mints one
+     * when absent and echoes it top-level on every response branch either way.
+     * Observational pass-through — never affects the verdict, so it's excluded
+     * from the verify cache key (see `getCacheKey`).
+     */
+    attemptId?: string;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3) — first-party observational data: the
+     * offers the agent evaluated at this checkpoint (catalog browse / intent
+     * selection). Forwarded verbatim to verify-access; never affects the
+     * verdict (also excluded from the cache key).
+     */
+    considerationSet?: ConsiderationSet;
+}
+/**
+ * One offer the agent evaluated (Trust Record, §33.5 #3). Mirrors the
+ * backend's `considerationItemSchema` 1:1 — first-party observational data
+ * reported by the transport (bridge / adapters), never verified locally.
+ */
+interface ConsiderationItem {
+    /** SKU identifier as the merchant catalog publishes it (1–128 chars). */
+    sku: string;
+    /** Display title (≤256 chars). */
+    name?: string;
+    /** Price in MAJOR units (same convention as `transactionValue`), non-negative. */
+    price?: number;
+    /** ISO-4217 or settlement-asset code (3–6 alphanumeric chars). */
+    currency?: string;
+    /** Stock state as the catalog declared it; omit when the catalog didn't say. */
+    availability?: 'in_stock' | 'out_of_stock' | 'preorder' | 'unknown';
+    /** True when the agent selected this offer (intent/settlement checkpoints). */
+    chosen?: boolean;
+    /** Why an evaluated-but-unchosen offer lost, when the agent can say. */
+    notChosenReason?: 'price' | 'policy' | 'trust_threshold' | 'stock' | 'other';
+}
+/**
+ * The set of offers evaluated at one funnel checkpoint (Trust Record,
+ * §33.5 #3). Mirrors the backend's `considerationSetSchema` 1:1.
+ *
+ * `items` is capped at 50 server-side — reporters MUST order chosen items
+ * FIRST so purchased counts survive truncation; `totalEvaluated` carries the
+ * true pre-cap count and `truncated` flags that the cap was applied.
+ */
+interface ConsiderationSet {
+    /** Funnel checkpoint this set was observed at. */
+    checkpoint?: 'catalog' | 'intent' | 'settlement';
+    /** Offers evaluated (max 50; chosen-first ordering under the cap). */
+    items: ConsiderationItem[];
+    /** True evaluated count — survives the 50-item cap. */
+    totalEvaluated?: number;
+    /** True when `items` was truncated to the cap. */
+    truncated?: boolean;
+}
+/**
+ * Terminal (or notable) outcome of an attempt chain, reported post-hoc via
+ * `reportAttempt` (Trust Record, §33.5 #3). Mirrors the backend's
+ * `attemptReportSchema.outcome` 1:1.
+ */
+interface AttemptOutcome {
+    kind: 'settled' | 'blocked_step_up' | 'failed' | 'high_value_action';
+    /** Dotted ACTION-axis token for the failure class, e.g. `commerce.catalog.sku_not_found` (≤128 chars). */
+    dimension?: string;
+    /** Human-readable detail (≤512 chars). */
+    reason?: string;
+    /** For `high_value_action`: the non-payment conversion type. */
+    actionType?: 'lead' | 'signup' | 'application' | 'enquiry';
+    /** Value in MAJOR units (settled amount / estimated action value), non-negative. */
+    value?: number;
+    /** ISO-4217 or settlement-asset code (3–6 alphanumeric chars). */
+    currency?: string;
+    /** Settlement rail / mandate type, e.g. `ap2.payment_mandate` (≤64 chars). */
+    rail?: string;
+}
+/**
+ * Body for `POST /agents/verify-access/attempt-report` (Trust Record,
+ * §33.5 #3): post-hoc consideration/outcome data for an attempt chain that a
+ * verify-access call couldn't carry (e.g. the catalog was served from a local
+ * cache, or the deny happened transport-side). Must carry `considerationSet`
+ * and/or `outcome`.
+ */
+interface AttemptReport {
+    /** Attempt-chain handle — `att_` + 32 lowercase hex. */
+    attemptId: string;
+    /** Merchant/endpoint the attempt targeted; falls back to `config.counterpartyId`. */
+    counterpartyId?: string;
+    /** Canonical ASTRA-* id of the acting agent, when known. */
+    agentId?: string;
+    considerationSet?: ConsiderationSet;
+    outcome?: AttemptOutcome;
 }
 /**
  * Raw commerce-protocol artifacts as verify-access accepts them (backend
@@ -929,4 +1031,4 @@ interface CommerceShieldProps {
     className?: string;
 }
 
-export type { AccessFailure as A, CommerceArtifactsPayload as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CommerceShieldProps as d, CounterpartyType as e, ExpressMiddlewareOptions as f, GuidanceInfo as g, ProtocolTransport as h, RuntimeChallengeResult as i, SettlementArtifact as j, SettlementArtifactBinding as k, SettlementArtifactBindingBase as l, StablecoinSettlementBinding as m, StepUpApprovalInfo as n, StepUpApprovalStatus as o, StepUpOutcome as p, TrustLevel as q, VerificationResult as r, VerifiedAgent as s, VerifiedDeveloper as t, VerifiedOrganization as u };
+export type { AccessFailure as A, CallerMetadata as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, AttemptOutcome as d, AttemptReport as e, CommerceArtifactsPayload as f, CommerceShieldProps as g, ConsiderationItem as h, ConsiderationSet as i, CounterpartyType as j, ExpressMiddlewareOptions as k, GuidanceInfo as l, ProtocolTransport as m, RuntimeChallengeResult as n, SettlementArtifact as o, SettlementArtifactBinding as p, SettlementArtifactBindingBase as q, StablecoinSettlementBinding as r, StepUpApprovalInfo as s, StepUpApprovalStatus as t, StepUpOutcome as u, TrustLevel as v, VerificationResult as w, VerifiedAgent as x, VerifiedDeveloper as y, VerifiedOrganization as z };

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { d as CommerceShieldProps, r as VerificationResult, b as AgentCredentials, g as GuidanceInfo, q as TrustLevel } from '../types-sy3tq8lp.mjs';
+import { g as CommerceShieldProps, w as VerificationResult, b as AgentCredentials, l as GuidanceInfo, v as TrustLevel } from '../types-BntuzEEn.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { d as CommerceShieldProps, r as VerificationResult, b as AgentCredentials, g as GuidanceInfo, q as TrustLevel } from '../types-9tns4wyl.js';
+import { g as CommerceShieldProps, w as VerificationResult, b as AgentCredentials, l as GuidanceInfo, v as TrustLevel } from '../types-SDu4Llbe.js';
 import '../metadata-capture.js';
 
 /**

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, r as VerificationResult } from './types-sy3tq8lp.mjs';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, e as AttemptReport, V as VerificationRequest, w as VerificationResult } from './types-BntuzEEn.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**
@@ -42,6 +42,17 @@ declare function verify(config: GatewayConfig, request: VerificationRequest, opt
  * Fire-and-forget — errors are silently swallowed.
  */
 declare function recordDecision(config: GatewayConfig, sessionId: string, decision: 'granted' | 'denied', reason?: string): Promise<void>;
+/**
+ * Report post-hoc consideration/outcome data for an attempt chain (Trust
+ * Record, §33.5 #3). Use when the signal never reached verify-access: a
+ * catalog served from a local cache, a transport-side deny (sku not found,
+ * over budget), or a terminal outcome (settled / blocked on step-up).
+ * Authenticated with the same credentials as verify(); the backend responds
+ * 202 and folds the data into the attempt chain keyed by `attemptId`.
+ *
+ * Fire-and-forget — errors are silently swallowed, never throws.
+ */
+declare function reportAttempt(config: GatewayConfig, report: AttemptReport): Promise<void>;
 /**
  * Fetch the per-route policy for an endpoint from the AstraSync backend.
  * v2.9.7 moved policy authority into the dashboard — the SDK no longer
@@ -148,4 +159,4 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     reason?: string;
 }>;
 
-export { type RouteAccessConfigShape, type VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };
+export { type RouteAccessConfigShape, type VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, r as VerificationResult } from './types-9tns4wyl.js';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, e as AttemptReport, V as VerificationRequest, w as VerificationResult } from './types-SDu4Llbe.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**
@@ -42,6 +42,17 @@ declare function verify(config: GatewayConfig, request: VerificationRequest, opt
  * Fire-and-forget — errors are silently swallowed.
  */
 declare function recordDecision(config: GatewayConfig, sessionId: string, decision: 'granted' | 'denied', reason?: string): Promise<void>;
+/**
+ * Report post-hoc consideration/outcome data for an attempt chain (Trust
+ * Record, §33.5 #3). Use when the signal never reached verify-access: a
+ * catalog served from a local cache, a transport-side deny (sku not found,
+ * over budget), or a terminal outcome (settled / blocked on step-up).
+ * Authenticated with the same credentials as verify(); the backend responds
+ * 202 and folds the data into the attempt chain keyed by `attemptId`.
+ *
+ * Fire-and-forget — errors are silently swallowed, never throws.
+ */
+declare function reportAttempt(config: GatewayConfig, report: AttemptReport): Promise<void>;
 /**
  * Fetch the per-route policy for an endpoint from the AstraSync backend.
  * v2.9.7 moved policy authority into the dashboard — the SDK no longer
@@ -148,4 +159,4 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     reason?: string;
 }>;
 
-export { type RouteAccessConfigShape, type VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };
+export { type RouteAccessConfigShape, type VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };

package/dist/verify.js

@@ -26,6 +26,7 @@ __export(verify_exports, {
   hasCredentials: () => hasCredentials,
   quickVerify: () => quickVerify,
   recordDecision: () => recordDecision,
+  reportAttempt: () => reportAttempt,
   reportCounterpartyPreCheckFailure: () => reportCounterpartyPreCheckFailure,
   reportUnregisteredAttempt: () => reportUnregisteredAttempt,
   verify: () => verify,
@@ -42,7 +43,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.11.1";
+var SDK_VERSION = "3.12.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -249,6 +250,7 @@ function createGuidanceResponse(_config, reason, options = {}) {
       }
     ] : void 0,
     correlationId: options.correlationId,
+    attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
@@ -278,6 +280,8 @@ async function callVerifyAccessAPI(config, request) {
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
+  if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
@@ -305,6 +309,9 @@ async function callVerifyAccessAPI(config, request) {
     if (response.status === 410) {
       return {
         success: true,
+        // 3.12.0 (Trust Record): keep the server-echoed attempt handle even on
+        // the synthesised 410 deny shape (echoed on every branch).
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
           accessLevel: "none",
@@ -323,7 +330,8 @@ async function callVerifyAccessAPI(config, request) {
       return {
         success: false,
         error: data.message || data.error || `API returned ${response.status}`,
-        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0
+        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
       };
     }
     return data;
@@ -357,7 +365,13 @@ async function verify(config, request, options) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      return cached;
+      const hit = { ...cached };
+      if (request.attemptId) {
+        hit.attemptId = request.attemptId;
+      } else {
+        delete hit.attemptId;
+      }
+      return hit;
     }
   }
   const enrichedRequest = { ...request };
@@ -377,6 +391,7 @@ async function verify(config, request, options) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
       source: "api_error",
       correlationId: apiResponse.correlationId,
+      attemptId: apiResponse.attemptId,
       urls
     });
   }
@@ -412,6 +427,9 @@ async function verify(config, request, options) {
       // Anonymous traffic has no session → correlationId is the per-attempt
       // linking key (the sessionId-equivalent for anonymous callers).
       correlationId: apiResponse.correlationId,
+      // 3.12.0 (Trust Record): server echoes the attempt-chain handle on
+      // every branch — denials included (the funnel outlives one deny).
+      attemptId: apiResponse.attemptId,
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
@@ -463,6 +481,8 @@ async function verify(config, request, options) {
     // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId
     // (no session row exists for unverified callers).
     correlationId: apiResponse.correlationId,
+    // 3.12.0 (Trust Record): server-echoed attempt-chain handle.
+    attemptId: apiResponse.attemptId,
     runtimeChallenge: apiResponse.runtimeChallenge,
     tokenGuidance: apiResponse.tokenGuidance,
     recommendation: apiResponse.recommendation,
@@ -507,6 +527,24 @@ async function recordDecision(config, sessionId, decision, reason) {
   }).catch(() => {
   });
 }
+async function reportAttempt(config, report) {
+  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
+  const headers = { "Content-Type": "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  const body = {
+    ...report,
+    ...!report.counterpartyId && config.counterpartyId && { counterpartyId: config.counterpartyId }
+  };
+  await fetch(`${apiBaseUrl}/agents/verify-access/attempt-report`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body)
+  }).catch(() => {
+  });
+}
 async function fetchRoutes(config, counterpartyId) {
   if (!counterpartyId) return null;
   const headers = { "Content-Type": "application/json" };
@@ -585,6 +623,7 @@ async function quickVerify(config, credentials) {
   hasCredentials,
   quickVerify,
   recordDecision,
+  reportAttempt,
   reportCounterpartyPreCheckFailure,
   reportUnregisteredAttempt,
   verify,