@astrasyncai/verification-gateway 3.11.1 → 4.0.0

package/dist/local-evaluator/evaluator.d.mts

@@ -1,5 +1,5 @@
-import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-cQVCMeNV.mjs';
-import '../types-sy3tq8lp.mjs';
+import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-DfnP7JiM.mjs';
+import '../types-BcDf9Kk0.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/local-evaluator/evaluator.d.ts

@@ -1,5 +1,5 @@
-import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-DhFPiZ3t.js';
-import '../types-9tns4wyl.js';
+import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-CHKCgDFC.js';
+import '../types-fTQD448H.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{nextjs-CEBVBsdi.d.ts → nextjs-D_iFf5k-.d.ts}

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from './types-9tns4wyl.js';
+import { N as NextJsMiddlewareOptions } from './types-fTQD448H.js';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/{nextjs-DcQIk6Zj.d.mts → nextjs-DeUTnOBd.d.mts}

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from './types-sy3tq8lp.mjs';
+import { N as NextJsMiddlewareOptions } from './types-BcDf9Kk0.mjs';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/{sdk-H0JCLW2y.d.ts → sdk-BM3mwEAq.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, q as TrustLevel, S as SDKOptions, r as VerificationResult } from './types-9tns4wyl.js';
+import { a as AccessLevel, v as TrustLevel, S as SDKOptions, w as VerificationResult } from './types-fTQD448H.js';
 
 /**
  * AstraSync Universal Verification Gateway - Access Level Definitions

package/dist/{sdk-CZkbSOeO.d.mts → sdk-_il1Q41f.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, q as TrustLevel, S as SDKOptions, r as VerificationResult } from './types-sy3tq8lp.mjs';
+import { a as AccessLevel, v as TrustLevel, S as SDKOptions, w as VerificationResult } from './types-BcDf9Kk0.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Access Level Definitions

package/dist/transport/index.d.mts

@@ -1,4 +1,4 @@
-import '../types-sy3tq8lp.mjs';
-export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-BrNKDmiR.mjs';
+import '../types-BcDf9Kk0.mjs';
+export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-B0cyMZDL.mjs';
 import '../metadata-capture.mjs';
 import 'jose';

package/dist/transport/index.d.ts

@@ -1,4 +1,4 @@
-import '../types-9tns4wyl.js';
-export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-D2ztkumS.js';
+import '../types-fTQD448H.js';
+export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-adgKhujR.js';
 import '../metadata-capture.js';
 import 'jose';

package/dist/{types-sy3tq8lp.d.mts → types-BcDf9Kk0.d.mts}

@@ -144,6 +144,13 @@ interface GatewayConfig {
      * compatibility.
      */
     strictInit?: boolean;
+    /**
+     * 4.0.0: hard timeout (ms) on the outbound verify-access call. Without it
+     * a hanging backend hangs the merchant's middleware — and every inbound
+     * agent request behind it — indefinitely. Timeouts surface as the
+     * fail-closed `verify_access.api_error` result. Default 10_000.
+     */
+    verifyTimeoutMs?: number;
     /**
      * v2.3.8: emit `X-Astra-Gateway-Mode: unenforced` (with
      * `X-Astra-Gateway-Reason: no-policy | no-match`) on responses where the
@@ -459,6 +466,24 @@ interface VerificationResult {
      * `verify_access.internal_error` 200-shaped failure shape.
      */
     correlationId?: string;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3): attempt-chain handle, server-echoed on
+     * every response branch (caller-supplied or server-minted). Disjoint from
+     * `correlationId`/`sessionId` — those identify one verification EVENT; an
+     * attempt CONTAINS events (the whole catalog → intent → settlement funnel
+     * for one shopping attempt). On a cache hit the SDK overwrites this with
+     * the current request's own attemptId (or drops it) so a cached verdict
+     * never leaks a prior attempt's id.
+     */
+    attemptId?: string;
+    /**
+     * 4.0.0: the backend rejected THIS INTEGRATION'S own API key (revoked /
+     * expired / rotated) — a deterministic merchant-side misconfig, distinct
+     * from both an agent denial and a transient `verify_access.api_error`.
+     * Adapters branch on it to answer inbound agents with 503 +
+     * `MERCHANT_VERIFICATION_MISCONFIGURED` instead of a misleading 401.
+     */
+    misconfigured?: boolean;
     /** Whether step-up authentication is required */
     requiresStepUp?: boolean;
     /** Whether approval is required */
@@ -582,6 +607,98 @@ interface VerificationRequest {
      * backend's `commerceArtifacts` schema 1:1.
      */
     commerceArtifacts?: CommerceArtifactsPayload;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3) — attempt-chain handle correlating the
+     * multi-call commerce funnel (catalog → intent → settlement) into ONE
+     * attempt. Format `att_` + 32 lowercase hex. Optional: the server mints one
+     * when absent and echoes it top-level on every response branch either way.
+     * Observational pass-through — never affects the verdict, so it's excluded
+     * from the verify cache key (see `getCacheKey`).
+     */
+    attemptId?: string;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3) — first-party observational data: the
+     * offers the agent evaluated at this checkpoint (catalog browse / intent
+     * selection). Forwarded verbatim to verify-access; never affects the
+     * verdict (also excluded from the cache key).
+     */
+    considerationSet?: ConsiderationSet;
+}
+/**
+ * One offer the agent evaluated (Trust Record, §33.5 #3). Mirrors the
+ * backend's `considerationItemSchema` 1:1 — first-party observational data
+ * reported by the transport (bridge / adapters), never verified locally.
+ */
+interface ConsiderationItem {
+    /** SKU identifier as the merchant catalog publishes it (1–128 chars). */
+    sku: string;
+    /** Display title (≤256 chars). */
+    name?: string;
+    /** Price in MAJOR units (same convention as `transactionValue`), non-negative. */
+    price?: number;
+    /** ISO-4217 or settlement-asset code (3–6 alphanumeric chars). */
+    currency?: string;
+    /** Stock state as the catalog declared it; omit when the catalog didn't say. */
+    availability?: 'in_stock' | 'out_of_stock' | 'preorder' | 'unknown';
+    /** True when the agent selected this offer (intent/settlement checkpoints). */
+    chosen?: boolean;
+    /** Why an evaluated-but-unchosen offer lost, when the agent can say. */
+    notChosenReason?: 'price' | 'policy' | 'trust_threshold' | 'stock' | 'other';
+}
+/**
+ * The set of offers evaluated at one funnel checkpoint (Trust Record,
+ * §33.5 #3). Mirrors the backend's `considerationSetSchema` 1:1.
+ *
+ * `items` is capped at 50 server-side — reporters MUST order chosen items
+ * FIRST so purchased counts survive truncation; `totalEvaluated` carries the
+ * true pre-cap count and `truncated` flags that the cap was applied.
+ */
+interface ConsiderationSet {
+    /** Funnel checkpoint this set was observed at. */
+    checkpoint?: 'catalog' | 'intent' | 'settlement';
+    /** Offers evaluated (max 50; chosen-first ordering under the cap). */
+    items: ConsiderationItem[];
+    /** True evaluated count — survives the 50-item cap. */
+    totalEvaluated?: number;
+    /** True when `items` was truncated to the cap. */
+    truncated?: boolean;
+}
+/**
+ * Terminal (or notable) outcome of an attempt chain, reported post-hoc via
+ * `reportAttempt` (Trust Record, §33.5 #3). Mirrors the backend's
+ * `attemptReportSchema.outcome` 1:1.
+ */
+interface AttemptOutcome {
+    kind: 'settled' | 'blocked_step_up' | 'failed' | 'high_value_action';
+    /** Dotted ACTION-axis token for the failure class, e.g. `commerce.catalog.sku_not_found` (≤128 chars). */
+    dimension?: string;
+    /** Human-readable detail (≤512 chars). */
+    reason?: string;
+    /** For `high_value_action`: the non-payment conversion type. */
+    actionType?: 'lead' | 'signup' | 'application' | 'enquiry';
+    /** Value in MAJOR units (settled amount / estimated action value), non-negative. */
+    value?: number;
+    /** ISO-4217 or settlement-asset code (3–6 alphanumeric chars). */
+    currency?: string;
+    /** Settlement rail / mandate type, e.g. `ap2.payment_mandate` (≤64 chars). */
+    rail?: string;
+}
+/**
+ * Body for `POST /agents/verify-access/attempt-report` (Trust Record,
+ * §33.5 #3): post-hoc consideration/outcome data for an attempt chain that a
+ * verify-access call couldn't carry (e.g. the catalog was served from a local
+ * cache, or the deny happened transport-side). Must carry `considerationSet`
+ * and/or `outcome`.
+ */
+interface AttemptReport {
+    /** Attempt-chain handle — `att_` + 32 lowercase hex. */
+    attemptId: string;
+    /** Merchant/endpoint the attempt targeted; falls back to `config.counterpartyId`. */
+    counterpartyId?: string;
+    /** Canonical ASTRA-* id of the acting agent, when known. */
+    agentId?: string;
+    considerationSet?: ConsiderationSet;
+    outcome?: AttemptOutcome;
 }
 /**
  * Raw commerce-protocol artifacts as verify-access accepts them (backend
@@ -929,4 +1046,4 @@ interface CommerceShieldProps {
     className?: string;
 }
 
-export type { AccessFailure as A, CommerceArtifactsPayload as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CommerceShieldProps as d, CounterpartyType as e, ExpressMiddlewareOptions as f, GuidanceInfo as g, ProtocolTransport as h, RuntimeChallengeResult as i, SettlementArtifact as j, SettlementArtifactBinding as k, SettlementArtifactBindingBase as l, StablecoinSettlementBinding as m, StepUpApprovalInfo as n, StepUpApprovalStatus as o, StepUpOutcome as p, TrustLevel as q, VerificationResult as r, VerifiedAgent as s, VerifiedDeveloper as t, VerifiedOrganization as u };
+export type { AccessFailure as A, CallerMetadata as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, AttemptOutcome as d, AttemptReport as e, CommerceArtifactsPayload as f, CommerceShieldProps as g, ConsiderationItem as h, ConsiderationSet as i, CounterpartyType as j, ExpressMiddlewareOptions as k, GuidanceInfo as l, ProtocolTransport as m, RuntimeChallengeResult as n, SettlementArtifact as o, SettlementArtifactBinding as p, SettlementArtifactBindingBase as q, StablecoinSettlementBinding as r, StepUpApprovalInfo as s, StepUpApprovalStatus as t, StepUpOutcome as u, TrustLevel as v, VerificationResult as w, VerifiedAgent as x, VerifiedDeveloper as y, VerifiedOrganization as z };

package/dist/{types-DhFPiZ3t.d.ts → types-CHKCgDFC.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, e as CounterpartyType, T as TokenGuidance } from './types-9tns4wyl.js';
+import { a as AccessLevel, j as CounterpartyType, T as TokenGuidance } from './types-fTQD448H.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-cQVCMeNV.d.mts → types-DfnP7JiM.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, e as CounterpartyType, T as TokenGuidance } from './types-sy3tq8lp.mjs';
+import { a as AccessLevel, j as CounterpartyType, T as TokenGuidance } from './types-BcDf9Kk0.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-9tns4wyl.d.ts → types-fTQD448H.d.ts}

@@ -144,6 +144,13 @@ interface GatewayConfig {
      * compatibility.
      */
     strictInit?: boolean;
+    /**
+     * 4.0.0: hard timeout (ms) on the outbound verify-access call. Without it
+     * a hanging backend hangs the merchant's middleware — and every inbound
+     * agent request behind it — indefinitely. Timeouts surface as the
+     * fail-closed `verify_access.api_error` result. Default 10_000.
+     */
+    verifyTimeoutMs?: number;
     /**
      * v2.3.8: emit `X-Astra-Gateway-Mode: unenforced` (with
      * `X-Astra-Gateway-Reason: no-policy | no-match`) on responses where the
@@ -459,6 +466,24 @@ interface VerificationResult {
      * `verify_access.internal_error` 200-shaped failure shape.
      */
     correlationId?: string;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3): attempt-chain handle, server-echoed on
+     * every response branch (caller-supplied or server-minted). Disjoint from
+     * `correlationId`/`sessionId` — those identify one verification EVENT; an
+     * attempt CONTAINS events (the whole catalog → intent → settlement funnel
+     * for one shopping attempt). On a cache hit the SDK overwrites this with
+     * the current request's own attemptId (or drops it) so a cached verdict
+     * never leaks a prior attempt's id.
+     */
+    attemptId?: string;
+    /**
+     * 4.0.0: the backend rejected THIS INTEGRATION'S own API key (revoked /
+     * expired / rotated) — a deterministic merchant-side misconfig, distinct
+     * from both an agent denial and a transient `verify_access.api_error`.
+     * Adapters branch on it to answer inbound agents with 503 +
+     * `MERCHANT_VERIFICATION_MISCONFIGURED` instead of a misleading 401.
+     */
+    misconfigured?: boolean;
     /** Whether step-up authentication is required */
     requiresStepUp?: boolean;
     /** Whether approval is required */
@@ -582,6 +607,98 @@ interface VerificationRequest {
      * backend's `commerceArtifacts` schema 1:1.
      */
     commerceArtifacts?: CommerceArtifactsPayload;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3) — attempt-chain handle correlating the
+     * multi-call commerce funnel (catalog → intent → settlement) into ONE
+     * attempt. Format `att_` + 32 lowercase hex. Optional: the server mints one
+     * when absent and echoes it top-level on every response branch either way.
+     * Observational pass-through — never affects the verdict, so it's excluded
+     * from the verify cache key (see `getCacheKey`).
+     */
+    attemptId?: string;
+    /**
+     * 3.12.0 (Trust Record, §33.5 #3) — first-party observational data: the
+     * offers the agent evaluated at this checkpoint (catalog browse / intent
+     * selection). Forwarded verbatim to verify-access; never affects the
+     * verdict (also excluded from the cache key).
+     */
+    considerationSet?: ConsiderationSet;
+}
+/**
+ * One offer the agent evaluated (Trust Record, §33.5 #3). Mirrors the
+ * backend's `considerationItemSchema` 1:1 — first-party observational data
+ * reported by the transport (bridge / adapters), never verified locally.
+ */
+interface ConsiderationItem {
+    /** SKU identifier as the merchant catalog publishes it (1–128 chars). */
+    sku: string;
+    /** Display title (≤256 chars). */
+    name?: string;
+    /** Price in MAJOR units (same convention as `transactionValue`), non-negative. */
+    price?: number;
+    /** ISO-4217 or settlement-asset code (3–6 alphanumeric chars). */
+    currency?: string;
+    /** Stock state as the catalog declared it; omit when the catalog didn't say. */
+    availability?: 'in_stock' | 'out_of_stock' | 'preorder' | 'unknown';
+    /** True when the agent selected this offer (intent/settlement checkpoints). */
+    chosen?: boolean;
+    /** Why an evaluated-but-unchosen offer lost, when the agent can say. */
+    notChosenReason?: 'price' | 'policy' | 'trust_threshold' | 'stock' | 'other';
+}
+/**
+ * The set of offers evaluated at one funnel checkpoint (Trust Record,
+ * §33.5 #3). Mirrors the backend's `considerationSetSchema` 1:1.
+ *
+ * `items` is capped at 50 server-side — reporters MUST order chosen items
+ * FIRST so purchased counts survive truncation; `totalEvaluated` carries the
+ * true pre-cap count and `truncated` flags that the cap was applied.
+ */
+interface ConsiderationSet {
+    /** Funnel checkpoint this set was observed at. */
+    checkpoint?: 'catalog' | 'intent' | 'settlement';
+    /** Offers evaluated (max 50; chosen-first ordering under the cap). */
+    items: ConsiderationItem[];
+    /** True evaluated count — survives the 50-item cap. */
+    totalEvaluated?: number;
+    /** True when `items` was truncated to the cap. */
+    truncated?: boolean;
+}
+/**
+ * Terminal (or notable) outcome of an attempt chain, reported post-hoc via
+ * `reportAttempt` (Trust Record, §33.5 #3). Mirrors the backend's
+ * `attemptReportSchema.outcome` 1:1.
+ */
+interface AttemptOutcome {
+    kind: 'settled' | 'blocked_step_up' | 'failed' | 'high_value_action';
+    /** Dotted ACTION-axis token for the failure class, e.g. `commerce.catalog.sku_not_found` (≤128 chars). */
+    dimension?: string;
+    /** Human-readable detail (≤512 chars). */
+    reason?: string;
+    /** For `high_value_action`: the non-payment conversion type. */
+    actionType?: 'lead' | 'signup' | 'application' | 'enquiry';
+    /** Value in MAJOR units (settled amount / estimated action value), non-negative. */
+    value?: number;
+    /** ISO-4217 or settlement-asset code (3–6 alphanumeric chars). */
+    currency?: string;
+    /** Settlement rail / mandate type, e.g. `ap2.payment_mandate` (≤64 chars). */
+    rail?: string;
+}
+/**
+ * Body for `POST /agents/verify-access/attempt-report` (Trust Record,
+ * §33.5 #3): post-hoc consideration/outcome data for an attempt chain that a
+ * verify-access call couldn't carry (e.g. the catalog was served from a local
+ * cache, or the deny happened transport-side). Must carry `considerationSet`
+ * and/or `outcome`.
+ */
+interface AttemptReport {
+    /** Attempt-chain handle — `att_` + 32 lowercase hex. */
+    attemptId: string;
+    /** Merchant/endpoint the attempt targeted; falls back to `config.counterpartyId`. */
+    counterpartyId?: string;
+    /** Canonical ASTRA-* id of the acting agent, when known. */
+    agentId?: string;
+    considerationSet?: ConsiderationSet;
+    outcome?: AttemptOutcome;
 }
 /**
  * Raw commerce-protocol artifacts as verify-access accepts them (backend
@@ -929,4 +1046,4 @@ interface CommerceShieldProps {
     className?: string;
 }
 
-export type { AccessFailure as A, CommerceArtifactsPayload as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CommerceShieldProps as d, CounterpartyType as e, ExpressMiddlewareOptions as f, GuidanceInfo as g, ProtocolTransport as h, RuntimeChallengeResult as i, SettlementArtifact as j, SettlementArtifactBinding as k, SettlementArtifactBindingBase as l, StablecoinSettlementBinding as m, StepUpApprovalInfo as n, StepUpApprovalStatus as o, StepUpOutcome as p, TrustLevel as q, VerificationResult as r, VerifiedAgent as s, VerifiedDeveloper as t, VerifiedOrganization as u };
+export type { AccessFailure as A, CallerMetadata as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, AttemptOutcome as d, AttemptReport as e, CommerceArtifactsPayload as f, CommerceShieldProps as g, ConsiderationItem as h, ConsiderationSet as i, CounterpartyType as j, ExpressMiddlewareOptions as k, GuidanceInfo as l, ProtocolTransport as m, RuntimeChallengeResult as n, SettlementArtifact as o, SettlementArtifactBinding as p, SettlementArtifactBindingBase as q, StablecoinSettlementBinding as r, StepUpApprovalInfo as s, StepUpApprovalStatus as t, StepUpOutcome as u, TrustLevel as v, VerificationResult as w, VerifiedAgent as x, VerifiedDeveloper as y, VerifiedOrganization as z };

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { d as CommerceShieldProps, r as VerificationResult, b as AgentCredentials, g as GuidanceInfo, q as TrustLevel } from '../types-sy3tq8lp.mjs';
+import { g as CommerceShieldProps, w as VerificationResult, b as AgentCredentials, l as GuidanceInfo, v as TrustLevel } from '../types-BcDf9Kk0.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { d as CommerceShieldProps, r as VerificationResult, b as AgentCredentials, g as GuidanceInfo, q as TrustLevel } from '../types-9tns4wyl.js';
+import { g as CommerceShieldProps, w as VerificationResult, b as AgentCredentials, l as GuidanceInfo, v as TrustLevel } from '../types-fTQD448H.js';
 import '../metadata-capture.js';
 
 /**

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, r as VerificationResult } from './types-sy3tq8lp.mjs';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, e as AttemptReport, V as VerificationRequest, w as VerificationResult } from './types-BcDf9Kk0.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**
@@ -8,6 +8,8 @@ import { ObservedMetadata } from './metadata-capture.mjs';
  * and processing the response into a standardized VerificationResult.
  */
 
+/** Test-only: re-arm the one-time init self-check. */
+declare function _resetInitCheck(): void;
 /**
  * Clear the verification cache
  */
@@ -42,6 +44,17 @@ declare function verify(config: GatewayConfig, request: VerificationRequest, opt
  * Fire-and-forget — errors are silently swallowed.
  */
 declare function recordDecision(config: GatewayConfig, sessionId: string, decision: 'granted' | 'denied', reason?: string): Promise<void>;
+/**
+ * Report post-hoc consideration/outcome data for an attempt chain (Trust
+ * Record, §33.5 #3). Use when the signal never reached verify-access: a
+ * catalog served from a local cache, a transport-side deny (sku not found,
+ * over budget), or a terminal outcome (settled / blocked on step-up).
+ * Authenticated with the same credentials as verify(); the backend responds
+ * 202 and folds the data into the attempt chain keyed by `attemptId`.
+ *
+ * Fire-and-forget — errors are silently swallowed, never throws.
+ */
+declare function reportAttempt(config: GatewayConfig, report: AttemptReport): Promise<void>;
 /**
  * Fetch the per-route policy for an endpoint from the AstraSync backend.
  * v2.9.7 moved policy authority into the dashboard — the SDK no longer
@@ -148,4 +161,4 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     reason?: string;
 }>;
 
-export { type RouteAccessConfigShape, type VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };
+export { type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, r as VerificationResult } from './types-9tns4wyl.js';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, e as AttemptReport, V as VerificationRequest, w as VerificationResult } from './types-fTQD448H.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**
@@ -8,6 +8,8 @@ import { ObservedMetadata } from './metadata-capture.js';
  * and processing the response into a standardized VerificationResult.
  */
 
+/** Test-only: re-arm the one-time init self-check. */
+declare function _resetInitCheck(): void;
 /**
  * Clear the verification cache
  */
@@ -42,6 +44,17 @@ declare function verify(config: GatewayConfig, request: VerificationRequest, opt
  * Fire-and-forget — errors are silently swallowed.
  */
 declare function recordDecision(config: GatewayConfig, sessionId: string, decision: 'granted' | 'denied', reason?: string): Promise<void>;
+/**
+ * Report post-hoc consideration/outcome data for an attempt chain (Trust
+ * Record, §33.5 #3). Use when the signal never reached verify-access: a
+ * catalog served from a local cache, a transport-side deny (sku not found,
+ * over budget), or a terminal outcome (settled / blocked on step-up).
+ * Authenticated with the same credentials as verify(); the backend responds
+ * 202 and folds the data into the attempt chain keyed by `attemptId`.
+ *
+ * Fire-and-forget — errors are silently swallowed, never throws.
+ */
+declare function reportAttempt(config: GatewayConfig, report: AttemptReport): Promise<void>;
 /**
  * Fetch the per-route policy for an endpoint from the AstraSync backend.
  * v2.9.7 moved policy authority into the dashboard — the SDK no longer
@@ -148,4 +161,4 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     reason?: string;
 }>;
 
-export { type RouteAccessConfigShape, type VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };
+export { type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };