@astrasyncai/verification-gateway 3.5.0 → 3.6.0

package/dist/local-evaluator/evaluator.d.mts

@@ -1,5 +1,5 @@
-import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-C8HyQEaz.mjs';
-import '../types-DrDIouvO.mjs';
+import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-B-ubjHER.mjs';
+import '../types-CKe8O0lR.mjs';
 
 /**
  * Local PDLSS Evaluator

package/dist/local-evaluator/evaluator.d.ts

@@ -1,5 +1,5 @@
-import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-xofemo0G.js';
-import '../types-DrDIouvO.js';
+import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-Bgn5gxHQ.js';
+import '../types-CKe8O0lR.js';
 
 /**
  * Local PDLSS Evaluator

package/dist/{nextjs-LTeoPqMH.d.mts → nextjs-DFKYhxe6.d.mts}

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from './types-DrDIouvO.mjs';
+import { N as NextJsMiddlewareOptions } from './types-CKe8O0lR.mjs';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/{nextjs-DfXOd0Au.d.ts → nextjs-DPj7ZNlq.d.ts}

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from './types-DrDIouvO.js';
+import { N as NextJsMiddlewareOptions } from './types-CKe8O0lR.js';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/{sdk-LmvyDVpL.d.ts → sdk-CAcHgB5x.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, k as TrustLevel, S as SDKOptions, l as VerificationResult } from './types-DrDIouvO.js';
+import { a as AccessLevel, m as TrustLevel, S as SDKOptions, n as VerificationResult } from './types-CKe8O0lR.js';
 
 /**
  * AstraSync Universal Verification Gateway - Access Level Definitions

package/dist/{sdk-DKhwVL9X.d.mts → sdk-Cy3wAmDt.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, k as TrustLevel, S as SDKOptions, l as VerificationResult } from './types-DrDIouvO.mjs';
+import { a as AccessLevel, m as TrustLevel, S as SDKOptions, n as VerificationResult } from './types-CKe8O0lR.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Access Level Definitions

package/dist/transport/index.d.mts

@@ -1,3 +1,3 @@
-import '../types-DrDIouvO.mjs';
-export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-BR2nmxBU.mjs';
+import '../types-CKe8O0lR.mjs';
+export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-WHKq2v17.mjs';
 import 'jose';

package/dist/transport/index.d.ts

@@ -1,3 +1,3 @@
-import '../types-DrDIouvO.js';
-export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-DEixUCu0.js';
+import '../types-CKe8O0lR.js';
+export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-rftma0ln.js';
 import 'jose';

package/dist/{types-C8HyQEaz.d.mts → types-B-ubjHER.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, d as CounterpartyType, T as TokenGuidance } from './types-DrDIouvO.mjs';
+import { a as AccessLevel, d as CounterpartyType, T as TokenGuidance } from './types-CKe8O0lR.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-xofemo0G.d.ts → types-Bgn5gxHQ.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, d as CounterpartyType, T as TokenGuidance } from './types-DrDIouvO.js';
+import { a as AccessLevel, d as CounterpartyType, T as TokenGuidance } from './types-CKe8O0lR.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-DrDIouvO.d.mts → types-CKe8O0lR.d.mts}

@@ -101,6 +101,29 @@ interface GatewayConfig {
      *    the registered origin
      */
     counterpartyId?: string;
+    /**
+     * Step-up hold-and-poll (3.6.0, opt-in). When set, adapters HOLD a request
+     * whose verify() came back step_up_required, poll the approval status, and
+     * on 'approved' re-verify the same request once (cache-bypassed) so the
+     * backend redeems the single-use approval — the MFA model the Java SDK
+     * ships default-on. Values:
+     *  - undefined (default): feature OFF — adapters fail closed immediately,
+     *    exactly as 3.5.0 (a minor release must not silently convert instant
+     *    403s into multi-minute holds).
+     *  - 0: hold until the approval's expiresAt (+5s grace); 5-min fallback
+     *    when expiresAt is missing/unparsable (Java parity).
+     *  - >0: hold at most this many milliseconds.
+     * Next.js edge runtimes enforce ~25s wall-clock budgets — set a small value
+     * there (≤20000) or gate in a Node route handler instead.
+     */
+    stepUpMaxWaitMs?: number;
+    /**
+     * Poll interval for the step-up hold (3.6.0). Default 3000ms, clamped to a
+     * 250ms floor. At the default the backend's 60/min/IP poll rate limit
+     * tolerates ~3 concurrent holds per merchant IP; poll errors are treated as
+     * transient, so limiter hits degrade the hold to 'timeout', never an error.
+     */
+    stepUpPollIntervalMs?: number;
     /**
      * Disable the one-time init self-test. The SDK normally fires a HEAD/OPTIONS
      * to `${apiBaseUrl}/agents/verify-access` on first verify() call and warns
@@ -310,6 +333,16 @@ interface StepUpApprovalInfo {
     pollUrl: string;
     expiresAt: string;
 }
+/**
+ * Lifecycle states of a step-up approval row (mirrors the backend's
+ * step_up_approval_status_check constraint).
+ */
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+/**
+ * Terminal outcome of a hold-and-poll wait: any non-pending status, or
+ * 'timeout' when the hold budget ran out while the approval was still pending.
+ */
+type StepUpOutcome = Exclude<StepUpApprovalStatus, 'pending'> | 'timeout';
 interface SettlementArtifact {
     type: string;
     artifact: string;
@@ -401,6 +434,13 @@ interface VerificationResult {
     requiresApproval?: boolean;
     /** Step-up approval info (present when transaction is in the human-approval band). */
     stepUpApproval?: StepUpApprovalInfo;
+    /**
+     * Terminal outcome of an opt-in hold-and-poll wait (3.6.0). Set by adapters
+     * on the result they deny with when the hold ended in denied / expired /
+     * consumed / timeout. Absent when the feature is off or the hold succeeded
+     * (an approved hold re-verifies and the fresh grant result replaces this one).
+     */
+    stepUpOutcome?: StepUpOutcome;
     /** Settlement voucher (present on clean merchant-mediated grants with a verified wallet). */
     settlement?: SettlementArtifact;
     /** Timestamp of verification */
@@ -774,4 +814,4 @@ interface CommerceShieldProps {
     className?: string;
 }
 
-export type { AccessFailure as A, CommerceShieldProps as C, EnhancedVerificationResult as E, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CounterpartyType as d, ExpressMiddlewareOptions as e, GuidanceInfo as f, ProtocolTransport as g, RuntimeChallengeResult as h, SettlementArtifact as i, StepUpApprovalInfo as j, TrustLevel as k, VerificationResult as l, VerifiedAgent as m, VerifiedDeveloper as n, VerifiedOrganization as o };
+export type { AccessFailure as A, CommerceShieldProps as C, EnhancedVerificationResult as E, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CounterpartyType as d, ExpressMiddlewareOptions as e, GuidanceInfo as f, ProtocolTransport as g, RuntimeChallengeResult as h, SettlementArtifact as i, StepUpApprovalInfo as j, StepUpApprovalStatus as k, StepUpOutcome as l, TrustLevel as m, VerificationResult as n, VerifiedAgent as o, VerifiedDeveloper as p, VerifiedOrganization as q };

package/dist/{types-DrDIouvO.d.ts → types-CKe8O0lR.d.ts}

@@ -101,6 +101,29 @@ interface GatewayConfig {
      *    the registered origin
      */
     counterpartyId?: string;
+    /**
+     * Step-up hold-and-poll (3.6.0, opt-in). When set, adapters HOLD a request
+     * whose verify() came back step_up_required, poll the approval status, and
+     * on 'approved' re-verify the same request once (cache-bypassed) so the
+     * backend redeems the single-use approval — the MFA model the Java SDK
+     * ships default-on. Values:
+     *  - undefined (default): feature OFF — adapters fail closed immediately,
+     *    exactly as 3.5.0 (a minor release must not silently convert instant
+     *    403s into multi-minute holds).
+     *  - 0: hold until the approval's expiresAt (+5s grace); 5-min fallback
+     *    when expiresAt is missing/unparsable (Java parity).
+     *  - >0: hold at most this many milliseconds.
+     * Next.js edge runtimes enforce ~25s wall-clock budgets — set a small value
+     * there (≤20000) or gate in a Node route handler instead.
+     */
+    stepUpMaxWaitMs?: number;
+    /**
+     * Poll interval for the step-up hold (3.6.0). Default 3000ms, clamped to a
+     * 250ms floor. At the default the backend's 60/min/IP poll rate limit
+     * tolerates ~3 concurrent holds per merchant IP; poll errors are treated as
+     * transient, so limiter hits degrade the hold to 'timeout', never an error.
+     */
+    stepUpPollIntervalMs?: number;
     /**
      * Disable the one-time init self-test. The SDK normally fires a HEAD/OPTIONS
      * to `${apiBaseUrl}/agents/verify-access` on first verify() call and warns
@@ -310,6 +333,16 @@ interface StepUpApprovalInfo {
     pollUrl: string;
     expiresAt: string;
 }
+/**
+ * Lifecycle states of a step-up approval row (mirrors the backend's
+ * step_up_approval_status_check constraint).
+ */
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+/**
+ * Terminal outcome of a hold-and-poll wait: any non-pending status, or
+ * 'timeout' when the hold budget ran out while the approval was still pending.
+ */
+type StepUpOutcome = Exclude<StepUpApprovalStatus, 'pending'> | 'timeout';
 interface SettlementArtifact {
     type: string;
     artifact: string;
@@ -401,6 +434,13 @@ interface VerificationResult {
     requiresApproval?: boolean;
     /** Step-up approval info (present when transaction is in the human-approval band). */
     stepUpApproval?: StepUpApprovalInfo;
+    /**
+     * Terminal outcome of an opt-in hold-and-poll wait (3.6.0). Set by adapters
+     * on the result they deny with when the hold ended in denied / expired /
+     * consumed / timeout. Absent when the feature is off or the hold succeeded
+     * (an approved hold re-verifies and the fresh grant result replaces this one).
+     */
+    stepUpOutcome?: StepUpOutcome;
     /** Settlement voucher (present on clean merchant-mediated grants with a verified wallet). */
     settlement?: SettlementArtifact;
     /** Timestamp of verification */
@@ -774,4 +814,4 @@ interface CommerceShieldProps {
     className?: string;
 }
 
-export type { AccessFailure as A, CommerceShieldProps as C, EnhancedVerificationResult as E, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CounterpartyType as d, ExpressMiddlewareOptions as e, GuidanceInfo as f, ProtocolTransport as g, RuntimeChallengeResult as h, SettlementArtifact as i, StepUpApprovalInfo as j, TrustLevel as k, VerificationResult as l, VerifiedAgent as m, VerifiedDeveloper as n, VerifiedOrganization as o };
+export type { AccessFailure as A, CommerceShieldProps as C, EnhancedVerificationResult as E, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CounterpartyType as d, ExpressMiddlewareOptions as e, GuidanceInfo as f, ProtocolTransport as g, RuntimeChallengeResult as h, SettlementArtifact as i, StepUpApprovalInfo as j, StepUpApprovalStatus as k, StepUpOutcome as l, TrustLevel as m, VerificationResult as n, VerifiedAgent as o, VerifiedDeveloper as p, VerifiedOrganization as q };

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { C as CommerceShieldProps, l as VerificationResult, b as AgentCredentials, f as GuidanceInfo, k as TrustLevel } from '../types-DrDIouvO.mjs';
+import { C as CommerceShieldProps, n as VerificationResult, b as AgentCredentials, f as GuidanceInfo, m as TrustLevel } from '../types-CKe8O0lR.mjs';
 
 /**
  * AstraSync Commerce Shield Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { C as CommerceShieldProps, l as VerificationResult, b as AgentCredentials, f as GuidanceInfo, k as TrustLevel } from '../types-DrDIouvO.js';
+import { C as CommerceShieldProps, n as VerificationResult, b as AgentCredentials, f as GuidanceInfo, m as TrustLevel } from '../types-CKe8O0lR.js';
 
 /**
  * AstraSync Commerce Shield Component

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrasyncai/verification-gateway",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "AstraSync KYA Platform SDK — counterparty verification gateway (verify incoming requests) + agent registration (register AI agents with the KYA backend).",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",