@astrasyncai/verification-gateway 3.4.0 → 3.6.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-Cj92yKeA.mjs';
-import '../types-Cwrvo30g.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-B-ubjHER.mjs';
+import '../types-CKe8O0lR.mjs';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-DOeL-dIw.js';
-import '../types-Cwrvo30g.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-Bgn5gxHQ.js';
+import '../types-CKe8O0lR.js';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/{index-DgVBEiwI.d.mts → index-BT_aRn-I.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-Cwrvo30g.mjs';
+import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-CKe8O0lR.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-BYu1FKMy.d.ts → index-D8-dvUFA.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-Cwrvo30g.js';
+import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-CKe8O0lR.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-Bw4FeHMY.d.mts → index-WHKq2v17.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-Cwrvo30g.mjs';
+import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-CKe8O0lR.mjs';
 import { JWK } from 'jose';
 
 /**
@@ -96,6 +96,10 @@ interface TransactionValueContext {
     amount: number;
     currency: string;
     source: string;
+    /** When true, the amount is in raw atomic/minor units and could NOT be
+     *  converted to major units (unknown token decimals). The limit engine
+     *  must fail-closed — never compare raw units against major-unit limits. */
+    rawUnits?: boolean;
 }
 declare function extractUCPTransactionValue(input: {
     totals?: Array<{

package/dist/{index-C-K0WCrk.d.ts → index-rftma0ln.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-Cwrvo30g.js';
+import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-CKe8O0lR.js';
 import { JWK } from 'jose';
 
 /**
@@ -96,6 +96,10 @@ interface TransactionValueContext {
     amount: number;
     currency: string;
     source: string;
+    /** When true, the amount is in raw atomic/minor units and could NOT be
+     *  converted to major units (unknown token decimals). The limit engine
+     *  must fail-closed — never compare raw units against major-unit limits. */
+    rawUnits?: boolean;
 }
 declare function extractUCPTransactionValue(input: {
     totals?: Array<{

package/dist/index.d.mts

@@ -1,12 +1,12 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, l as VerificationResult, E as EnhancedVerificationResult, A as AccessFailure, j as StepUpApprovalInfo } from './types-Cwrvo30g.mjs';
-export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, T as TokenGuidance, k as TrustLevel, m as VerifiedAgent, n as VerifiedDeveloper, o as VerifiedOrganization } from './types-Cwrvo30g.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CJYCLMI0.mjs';
-export { e as express } from './express-CeFvNWDD.mjs';
-export { n as nextjs } from './nextjs-xciaMpsZ.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-Bw4FeHMY.mjs';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, n as VerificationResult, j as StepUpApprovalInfo, l as StepUpOutcome, k as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CKe8O0lR.mjs';
+export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, T as TokenGuidance, m as TrustLevel, o as VerifiedAgent, p as VerifiedDeveloper, q as VerifiedOrganization } from './types-CKe8O0lR.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Cy3wAmDt.mjs';
+export { e as express } from './express-BnMO-H3y.mjs';
+export { n as nextjs } from './nextjs-DFKYhxe6.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-WHKq2v17.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DgVBEiwI.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BT_aRn-I.mjs';
 import 'express';
 import 'next/server';
 import 'jose';
@@ -30,10 +30,23 @@ declare function extractCredentials(headers: Record<string, string | string[] |
  * Check if credentials are present
  */
 declare function hasCredentials(credentials: AgentCredentials): boolean;
+/**
+ * Options for a single verify() call (as opposed to GatewayConfig, which is
+ * per-gateway). Mirrors the Java SDK's `verify(request, bypassCache)`.
+ */
+interface VerifyOptions {
+    /**
+     * Skip the cache READ for this call so the request is guaranteed to reach
+     * the backend (the result is still written to the cache if cacheable).
+     * Used by the step-up hold-and-poll retry: the re-verify after an approval
+     * must hit the server to redeem the single-use approval.
+     */
+    bypassCache?: boolean;
+}
 /**
  * Main verification function
  */
-declare function verify(config: GatewayConfig, request: VerificationRequest): Promise<VerificationResult>;
+declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
 /**
  * Quick verification — checks credentials and policy in one call.
  *
@@ -50,6 +63,39 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     reason?: string;
 }>;
 
+/**
+ * Step-up hold-and-poll (3.6.0) — the synchronous half of the MFA-style gate,
+ * mirroring the Java SDK's `awaitStepUpApproval` / `pollStepUpStatus`.
+ *
+ * A verify() that comes back step_up_required carries a `stepUpApproval`
+ * handle: `{ approvalId, pollUrl, expiresAt }`. The adapter HOLDS the original
+ * request, polls the approval status, and on 'approved' re-verifies the same
+ * request once (cache-bypassed) so the backend redeems the single-use approval
+ * and returns a grant. Any other terminal outcome falls into the adapter's
+ * normal fail-closed deny path.
+ *
+ * The poll endpoint is deliberately unauthenticated (it sits above the
+ * backend router's `authenticate` middleware): the unguessable UUIDv4
+ * approvalId is the capability token, and the route is rate-limited
+ * (60/min/IP). No Authorization header is sent.
+ */
+
+/**
+ * One GET of the approval's poll endpoint. Returns the status string, or
+ * null on any error / non-2xx / unparsable body — the hold loop treats null
+ * as transient and just polls again.
+ */
+declare function pollStepUpStatus(config: GatewayConfig, approval: StepUpApprovalInfo): Promise<StepUpApprovalStatus | null>;
+/**
+ * Block until a pending step-up approval reaches a terminal state or the wait
+ * budget runs out. Returns the terminal status, or 'timeout'.
+ *
+ * Unknown non-pending statuses (a future backend state) still terminate the
+ * hold — they are returned as-is and land in the deny path, which is the safe
+ * reading of "not approved".
+ */
+declare function awaitStepUpApproval(config: GatewayConfig, approval: StepUpApprovalInfo): Promise<StepUpOutcome>;
+
 /**
  * Settlement authorization — the value-aware, FAIL-CLOSED gate a direct merchant
  * MUST call before settling a priced cart (post-#447 partner round, finding #1).
@@ -156,4 +202,4 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
 
 declare const VERSION = "3.4.0";
 
-export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, VERSION, VerificationRequest, VerificationResult, type WellKnownAgenticCommerce, authorizeSettlement, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, prefetchWellKnown, quickVerify, verify };
+export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, VERSION, VerificationRequest, VerificationResult, type VerifyOptions, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, pollStepUpStatus, prefetchWellKnown, quickVerify, verify };

package/dist/index.d.ts

@@ -1,12 +1,12 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, l as VerificationResult, E as EnhancedVerificationResult, A as AccessFailure, j as StepUpApprovalInfo } from './types-Cwrvo30g.js';
-export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, T as TokenGuidance, k as TrustLevel, m as VerifiedAgent, n as VerifiedDeveloper, o as VerifiedOrganization } from './types-Cwrvo30g.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-FP7xT9F8.js';
-export { e as express } from './express-RIh05wW2.js';
-export { n as nextjs } from './nextjs--xR9zbSJ.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-C-K0WCrk.js';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, n as VerificationResult, j as StepUpApprovalInfo, l as StepUpOutcome, k as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CKe8O0lR.js';
+export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, T as TokenGuidance, m as TrustLevel, o as VerifiedAgent, p as VerifiedDeveloper, q as VerifiedOrganization } from './types-CKe8O0lR.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CAcHgB5x.js';
+export { e as express } from './express-DQhDzNAt.js';
+export { n as nextjs } from './nextjs-DPj7ZNlq.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-rftma0ln.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BYu1FKMy.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-D8-dvUFA.js';
 import 'express';
 import 'next/server';
 import 'jose';
@@ -30,10 +30,23 @@ declare function extractCredentials(headers: Record<string, string | string[] |
  * Check if credentials are present
  */
 declare function hasCredentials(credentials: AgentCredentials): boolean;
+/**
+ * Options for a single verify() call (as opposed to GatewayConfig, which is
+ * per-gateway). Mirrors the Java SDK's `verify(request, bypassCache)`.
+ */
+interface VerifyOptions {
+    /**
+     * Skip the cache READ for this call so the request is guaranteed to reach
+     * the backend (the result is still written to the cache if cacheable).
+     * Used by the step-up hold-and-poll retry: the re-verify after an approval
+     * must hit the server to redeem the single-use approval.
+     */
+    bypassCache?: boolean;
+}
 /**
  * Main verification function
  */
-declare function verify(config: GatewayConfig, request: VerificationRequest): Promise<VerificationResult>;
+declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
 /**
  * Quick verification — checks credentials and policy in one call.
  *
@@ -50,6 +63,39 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     reason?: string;
 }>;
 
+/**
+ * Step-up hold-and-poll (3.6.0) — the synchronous half of the MFA-style gate,
+ * mirroring the Java SDK's `awaitStepUpApproval` / `pollStepUpStatus`.
+ *
+ * A verify() that comes back step_up_required carries a `stepUpApproval`
+ * handle: `{ approvalId, pollUrl, expiresAt }`. The adapter HOLDS the original
+ * request, polls the approval status, and on 'approved' re-verifies the same
+ * request once (cache-bypassed) so the backend redeems the single-use approval
+ * and returns a grant. Any other terminal outcome falls into the adapter's
+ * normal fail-closed deny path.
+ *
+ * The poll endpoint is deliberately unauthenticated (it sits above the
+ * backend router's `authenticate` middleware): the unguessable UUIDv4
+ * approvalId is the capability token, and the route is rate-limited
+ * (60/min/IP). No Authorization header is sent.
+ */
+
+/**
+ * One GET of the approval's poll endpoint. Returns the status string, or
+ * null on any error / non-2xx / unparsable body — the hold loop treats null
+ * as transient and just polls again.
+ */
+declare function pollStepUpStatus(config: GatewayConfig, approval: StepUpApprovalInfo): Promise<StepUpApprovalStatus | null>;
+/**
+ * Block until a pending step-up approval reaches a terminal state or the wait
+ * budget runs out. Returns the terminal status, or 'timeout'.
+ *
+ * Unknown non-pending statuses (a future backend state) still terminate the
+ * hold — they are returned as-is and land in the deny path, which is the safe
+ * reading of "not approved".
+ */
+declare function awaitStepUpApproval(config: GatewayConfig, approval: StepUpApprovalInfo): Promise<StepUpOutcome>;
+
 /**
  * Settlement authorization — the value-aware, FAIL-CLOSED gate a direct merchant
  * MUST call before settling a priced cart (post-#447 partner round, finding #1).
@@ -156,4 +202,4 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
 
 declare const VERSION = "3.4.0";
 
-export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, VERSION, VerificationRequest, VerificationResult, type WellKnownAgenticCommerce, authorizeSettlement, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, prefetchWellKnown, quickVerify, verify };
+export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, VERSION, VerificationRequest, VerificationResult, type VerifyOptions, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, pollStepUpStatus, prefetchWellKnown, quickVerify, verify };