@astrasyncai/verification-gateway 3.7.1 → 3.8.0

package/README.md

@@ -16,6 +16,7 @@ As of v2.4.0 this is the only npm package you need for AstraSync integration. Pi
 | **Doing direct verification (no framework)**                                              | `@astrasyncai/verification-gateway/sdk`          | `VerificationGatewayClient` with retry / backoff / timeout.                                   |
 | **Parsing protocol-level credentials** (HTTP / A2A / MCP / x402 / AP2 / MPP)              | `@astrasyncai/verification-gateway/transport`    | Cross-protocol credential extraction + injection.                                             |
 | **Evaluating PDLSS offline** (local / hybrid mode)                                        | `@astrasyncai/verification-gateway/gateway`      | `AstraSyncGateway` (online / local / hybrid).                                                 |
+| **Governing Claude Code with a local policy**                                             | `@astrasyncai/verification-gateway/claude-code`  | PreToolUse-hook adapter; `astrasync-guard install-claude-code` sets it up.                    |
 | **Receiving webhook callbacks**                                                           | `@astrasyncai/verification-gateway/webhooks`     | `verifyAstraSyncWebhook()`, `signAstraSyncWebhook()`.                                         |
 
 > All subpaths talk to the same backend — `POST /agents/verify-access` for verification, `POST /agents/register` for registration. The contract is shared; the role is just which side of the handshake you're sitting on.
@@ -445,24 +446,67 @@ Poll the `pollUrl` (unauthenticated, rate-limited 60 req/min) to check if the ow
 
 ## Settlement Artifacts
 
-On a clean merchant-mediated grant where the owner has a verified payment instrument, verify-access returns a `settlement` object:
+On a clean merchant-mediated grant where the owner has a verified payment instrument, verify-access returns a `settlement` object (wire format **v2**, versioned via the `ver: 2` claim — verify/redeem reject other versions):
 
 ```typescript
 interface SettlementArtifact {
   type: string; // e.g. "stablecoin_voucher"
-  artifact: string; // JWS compact-serialised (ES256)
-  binding: {
-    merchantId: string;
-    amount: number;
-    currency: string;
-    sessionId: string;
-    singleUse: true;
-    expiresAt: string;
-  };
+  artifact: string; // JWS compact-serialised (ES256) — the authoritative, signed object
+  binding: FiatSettlementBinding | StablecoinSettlementBinding; // display-only mirror
+}
+
+// Stablecoin voucher (v2): integer minor units, pinned settlement asset
+interface StablecoinSettlementBinding {
+  merchantId: string;
+  amountMinor: number; // integer minor units — no floats anywhere
+  assetDecimals: number; // scale for display: amountMinor / 10^assetDecimals
+  currency: string; // e.g. "USDC"
+  chainId: number; // the chain this voucher settles on
+  tokenContract: string; // the token contract it settles in
+  asset: string; // CAIP-19 asset id
+  sessionId: string;
+  singleUse: true;
+  expiresAt: string;
+}
+
+// Fiat/processor artifacts (Stripe, Skyfire, PayPal): the processor is the
+// unit authority, so the binding carries the major-unit pricing amount
+interface FiatSettlementBinding {
+  merchantId: string;
+  amount: number;
+  currency: string;
+  sessionId: string;
+  singleUse: true;
+  expiresAt: string;
 }
 ```
 
-Verify vouchers server-side via `POST /api/wallets/voucher/verify` or fetch the signing keys from `GET /api/wallets/voucher/.well-known/jwks.json`.
+**`binding` is display-only convenience.** It mirrors the signed JWT claims but is not itself signed — render it, never settle from it. Decide from the server-verified payload returned by redeem.
+
+### Voucher lifecycle (server-to-server)
+
+| Endpoint                                         | Purpose                                                                                                                                                           |
+| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `POST /api/wallets/voucher/verify`               | Verify signature/issuer and return the decoded payload — proves authenticity only, no spend                                                                       |
+| `POST /api/wallets/voucher/redeem`               | Atomic single-use spend: first caller gets `200 redeemed`, replays get `409 already_redeemed` (with first-redeemer forensics), revoked vouchers get `409 revoked` |
+| `GET /api/wallets/voucher/.well-known/jwks.json` | Public JWKS for offline signature verification                                                                                                                    |
+
+Redeem accepts optional `expectedAmountMinor` / `expectedCurrency` — mismatches are rejected (`400 amount_mismatch` / `currency_mismatch`) **before** the voucher is spent, so a mismatch never burns the voucher. Vouchers carry `aud` = your merchant id; declare `merchantId` on verify/redeem to have the audience check enforced (standard JWT libraries give you the same check free on offline verification).
+
+Single-use is enforced server-side by an atomic claim on the voucher id — N of your nodes presenting the same voucher get exactly one `200` and N−1 `409`s, with no coordination between them.
+
+### What a successful redeem proves — and what it doesn't
+
+A `200` from redeem proves, at that moment:
+
+- the voucher is **authentic** — signed by AstraSync, unexpired, format-valid;
+- the agent was **authorised** to commit this spend when the voucher was minted — it passed verification and the amount was within the owner's configured limits;
+- the voucher is bound to **you** (audience = your merchant id) and to the stated amount, currency, and settlement asset;
+- the spend is **exactly-once** — this voucher was never redeemed before, was not revoked, and can never be redeemed again.
+
+It does **not** verify that funds exist in, or are reserved from, the owner's wallet. The voucher is a payment _authorization_, not a funds _guarantee_ — today, funds assurance at settlement time comes from your own settlement rail, exactly as it does for any other payer.
+
+**Coming later:** a settlement upgrade that makes redemption and funds transfer a single atomic on-chain event. A voucher will only redeem if the funds actually move — if the wallet can't cover it, the redemption fails and the voucher is not consumed — making "redeemed" and "funded" the same event. The wire format already carries what that needs (pinned chain, token contract, integer minor units), so no integration change is expected beyond opting in.
 
 ## Configuration
 
@@ -563,8 +607,52 @@ The SDK sets `X-Astra-Gateway-Mode` on every response that's been through the ga
 
 Pre-v2.4.2 used the value `pass-through` — renamed in v2.4.2 to disambiguate "gate skipped" from "request allowed".
 
+## Local Guard for Claude Code
+
+Native governance for Claude Code via its PreToolUse hook (subpath `./claude-code`, shipped in v3.7.0). Every tool call — file reads/writes, shell commands, web fetches, and optionally MCP tools — is evaluated against a local PDLSS policy before it runs. No proxy, no cloud dependency.
+
+```bash
+npm install -g @astrasyncai/verification-gateway
+
+# User-level install (~/.claude + ~/.astrasync); add --project for repo-scoped
+astrasync-guard install-claude-code
+```
+
+The installer registers the `astrasync-claude-hook` binary in Claude Code's `settings.json` and creates `.astrasync/policy.yaml` (the PDLSS policy — re-read on every tool call) plus `.astrasync/guard.json` (guard settings). Flags: `--project` (install into the current repo; a project policy overrides the user-level one), `--wizard` (interactive policy builder), `--active` (start enforcing immediately), `--policy <path>` (use an existing policy file).
+
+- **Posture** — installs default to `"posture": "passive"`: decisions are evaluated and written to JSONL traces under `.astrasync/traces/`, nothing is blocked. Flip to `"active"` in `guard.json` to enforce: DENY blocks the tool call with a reason (`permissionDecision: "deny"`), MANUAL_REVIEW routes to Claude Code's own permission prompt (`"ask"`), and ALLOW emits nothing — the guard only tightens, it can never bypass Claude Code's native permission system.
+- **Safe by default** — a machine with no policy file is a silent no-op; a corrupt `guard.json` falls back to enforcing defaults rather than silently loosening the guard. `ASTRASYNC_GUARD_DISABLE=1` turns the hook off; `ASTRASYNC_GUARD_FAIL_OPEN=1` allows on internal hook errors (default is fail-closed in active posture).
+- **MCP governance** — set `"governMcp": true` to govern MCP tools too; `mcp__{server}__{tool}` maps to purpose `{server}.{tool}` in the policy.
+- **Uninstall** — `astrasync-guard uninstall-claude-code` removes the hook; policy and traces are left in place.
+
 ## Changelog
 
+### v3.8.0 — Settlement voucher wire format v2
+
+- **BREAKING type change:** `SettlementArtifact.binding` is now a union — `StablecoinSettlementBinding` (v2: `amountMinor` integer minor units + `assetDecimals`, pinned `chainId`/`tokenContract`/CAIP-19 `asset`) or `FiatSettlementBinding` (processor artifacts keep major-unit `amount`). The float `amount` field is gone from stablecoin bindings. Matches the server's `ver: 2` wire format, which redeems/verifies reject other versions of.
+- Settlement Artifacts docs rewritten: voucher lifecycle endpoints (verify / redeem / JWKS), expected-value gates on redeem, revocation semantics, and an explicit **guarantee boundary** — what a successful redeem proves and what it doesn't (redeem proves the authorization is live and single-use; it does not check or move funds).
+
+### v3.7.1 — ChallengeHandler auto-include
+
+- `ChallengeHandler` auto-includes the incoming `counterpartyId`/`counterpartyUrl` in the challenge response when no counterparties were pre-registered via `registerPending()` — the correct default for agents that never call it. Pre-registered whitelists behave exactly as before.
+- Runtime-challenge docs: auto-include default + double-appended-path warning.
+
+### v3.7.0 — AstraSync Local Guard for Claude Code
+
+- `./claude-code` subpath export — Layer 4 Local Guard adapter for Claude Code's PreToolUse hook (see the Local Guard section above). Strictly tightening: DENY → `deny`, MANUAL_REVIEW → `ask`, ALLOW → no output.
+- `astrasync-claude-hook` binary + `astrasync-guard install-claude-code` / `uninstall-claude-code` installer commands.
+
+### v3.6.0 — Step-up hold-and-poll
+
+- Opt-in `stepUpMaxWaitMs` / `stepUpPollIntervalMs` on `GatewayConfig`: middleware holds a `step_up_required` request, polls the approval, and on `approved` re-verifies cache-bypassed so the backend redeems the single-use approval. Non-approved outcomes deny with `stepUpOutcome` (`denied | expired | consumed | timeout`) and an `X-Astra-Step-Up` header. OFF by default.
+- `awaitStepUpApproval()` / `pollStepUpStatus()` exported for direct use.
+- `reportUnregisteredAttempt` sends the configured `counterpartyId` (anon-lead attribution is id-first) and omits a null `counterpartyUrl`.
+
+### v3.5.0 — Partner feedback round
+
+- `extractTransactionValue` option on Express middleware — opt-in upfront value extraction so PDLSS limit evaluation runs at middleware time (`authorizeSettlement()` remains the required fail-closed settlement gate).
+- Settlement architecture: merchant-mediated grants are voucher-primary — only crypto wallets mint settlement artifacts; fiat instruments log a diagnostic and do not mint.
+
 ### v3.4.0 — Type alignment for LMAX settlement + step-up approval
 
 - `StepUpApprovalInfo` and `SettlementArtifact` interfaces added to `VerificationResult`

package/dist/adapter-interface/interface.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-B-ubjHER.mjs';
-import '../types-CKe8O0lR.mjs';
+import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-CSFci5zD.mjs';
+import '../types-DedAJbNI.mjs';
 
 /**
  * PlatformAdapter Interface

package/dist/adapter-interface/interface.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-Bgn5gxHQ.js';
-import '../types-CKe8O0lR.js';
+import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-D1kyMiml.js';
+import '../types-DedAJbNI.js';
 
 /**
  * PlatformAdapter Interface

package/dist/adapters/express.d.mts

@@ -1,3 +1,3 @@
 import 'express';
-import '../types-CKe8O0lR.mjs';
-export { c as createMiddleware, a as extractAstraSyncCredentials } from '../express-BnMO-H3y.mjs';
+import '../types-DedAJbNI.mjs';
+export { c as createMiddleware, a as extractAstraSyncCredentials } from '../express-Di_hnZZS.mjs';

package/dist/adapters/express.d.ts

@@ -1,3 +1,3 @@
 import 'express';
-import '../types-CKe8O0lR.js';
-export { c as createMiddleware, a as extractAstraSyncCredentials } from '../express-DQhDzNAt.js';
+import '../types-DedAJbNI.js';
+export { c as createMiddleware, a as extractAstraSyncCredentials } from '../express-C8nJGi5P.js';

package/dist/adapters/mcp.d.mts

@@ -1,5 +1,5 @@
 import { Request, Response, RequestHandler } from 'express';
-import { a as AccessLevel, G as GatewayConfig, n as VerificationResult } from '../types-CKe8O0lR.mjs';
+import { a as AccessLevel, G as GatewayConfig, q as VerificationResult } from '../types-DedAJbNI.mjs';
 
 /**
  * MCP server-side helpers — companion to `transport/mcp.ts` (which handles the

package/dist/adapters/mcp.d.ts

@@ -1,5 +1,5 @@
 import { Request, Response, RequestHandler } from 'express';
-import { a as AccessLevel, G as GatewayConfig, n as VerificationResult } from '../types-CKe8O0lR.js';
+import { a as AccessLevel, G as GatewayConfig, q as VerificationResult } from '../types-DedAJbNI.js';
 
 /**
  * MCP server-side helpers — companion to `transport/mcp.ts` (which handles the

package/dist/adapters/nextjs.d.mts

@@ -1,3 +1,3 @@
 import 'next/server';
-import '../types-CKe8O0lR.mjs';
-export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-DFKYhxe6.mjs';
+import '../types-DedAJbNI.mjs';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-BMAe8ode.mjs';

package/dist/adapters/nextjs.d.ts

@@ -1,3 +1,3 @@
 import 'next/server';
-import '../types-CKe8O0lR.js';
-export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-DPj7ZNlq.js';
+import '../types-DedAJbNI.js';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-IyXWW2KL.js';

package/dist/adapters/sdk.d.mts

@@ -1,2 +1,2 @@
-import '../types-CKe8O0lR.mjs';
-export { V as VerificationGatewayClient, c as createClient, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-Cy3wAmDt.mjs';
+import '../types-DedAJbNI.mjs';
+export { V as VerificationGatewayClient, c as createClient, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-Cn4KcZ5G.mjs';

package/dist/adapters/sdk.d.ts

@@ -1,2 +1,2 @@
-import '../types-CKe8O0lR.js';
-export { V as VerificationGatewayClient, c as createClient, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-CAcHgB5x.js';
+import '../types-DedAJbNI.js';
+export { V as VerificationGatewayClient, c as createClient, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-ThdA_NtL.js';

package/dist/agent/index.d.mts

@@ -1,2 +1,2 @@
-export { A as AgentClient, a as AstraSyncSdkError, C as ChallengeHandler, O as OwnershipMismatchError, P as PDLSSConfig, T as TransportPDLSS, f as formatPDLSSForTransport, p as parsePDLSSFromTransport, r as recordDecision } from '../index-BT_aRn-I.mjs';
-import '../types-CKe8O0lR.mjs';
+export { A as AgentClient, a as AstraSyncSdkError, C as ChallengeHandler, O as OwnershipMismatchError, P as PDLSSConfig, T as TransportPDLSS, f as formatPDLSSForTransport, p as parsePDLSSFromTransport, r as recordDecision } from '../index-DALAqct7.mjs';
+import '../types-DedAJbNI.mjs';

package/dist/agent/index.d.ts

@@ -1,2 +1,2 @@
-export { A as AgentClient, a as AstraSyncSdkError, C as ChallengeHandler, O as OwnershipMismatchError, P as PDLSSConfig, T as TransportPDLSS, f as formatPDLSSForTransport, p as parsePDLSSFromTransport, r as recordDecision } from '../index-D8-dvUFA.js';
-import '../types-CKe8O0lR.js';
+export { A as AgentClient, a as AstraSyncSdkError, C as ChallengeHandler, O as OwnershipMismatchError, P as PDLSSConfig, T as TransportPDLSS, f as formatPDLSSForTransport, p as parsePDLSSFromTransport, r as recordDecision } from '../index-CuCkjT7B.js';
+import '../types-DedAJbNI.js';

package/dist/browser/browser-adapter.d.mts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-B-ubjHER.mjs';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-CSFci5zD.mjs';
 import '../gateway/gateway.mjs';
-import '../types-CKe8O0lR.mjs';
+import '../types-DedAJbNI.mjs';
 
 /**
  * @astrasyncai/adapter-openclaw-browser

package/dist/browser/browser-adapter.d.ts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bgn5gxHQ.js';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-D1kyMiml.js';
 import '../gateway/gateway.js';
-import '../types-CKe8O0lR.js';
+import '../types-DedAJbNI.js';
 
 /**
  * @astrasyncai/adapter-openclaw-browser

package/dist/claude-code/claude-code-adapter.d.mts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-B-ubjHER.mjs';
+import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-CSFci5zD.mjs';
 import '../gateway/gateway.mjs';
-import '../types-CKe8O0lR.mjs';
+import '../types-DedAJbNI.mjs';
 
 /**
  * @astrasyncai/adapter-claude-code

package/dist/claude-code/claude-code-adapter.d.ts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-Bgn5gxHQ.js';
+import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-D1kyMiml.js';
 import '../gateway/gateway.js';
-import '../types-CKe8O0lR.js';
+import '../types-DedAJbNI.js';
 
 /**
  * @astrasyncai/adapter-claude-code

package/dist/cli/index.d.mts

@@ -1,6 +1,6 @@
-import { b as LocalPurposeRule, d as LocalScope, c as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-B-ubjHER.mjs';
+import { b as LocalPurposeRule, d as LocalScope, c as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-CSFci5zD.mjs';
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import '../types-CKe8O0lR.mjs';
+import '../types-DedAJbNI.mjs';
 import '../gateway/gateway.mjs';
 
 /**

package/dist/cli/index.d.ts

@@ -1,6 +1,6 @@
-import { b as LocalPurposeRule, d as LocalScope, c as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bgn5gxHQ.js';
+import { b as LocalPurposeRule, d as LocalScope, c as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-D1kyMiml.js';
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import '../types-CKe8O0lR.js';
+import '../types-DedAJbNI.js';
 import '../gateway/gateway.js';
 
 /**

package/dist/cursor/cursor-adapter.d.mts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-B-ubjHER.mjs';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-CSFci5zD.mjs';
 import '../gateway/gateway.mjs';
-import '../types-CKe8O0lR.mjs';
+import '../types-DedAJbNI.mjs';
 
 /**
  * @astrasyncai/adapter-cursor

package/dist/cursor/cursor-adapter.d.ts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bgn5gxHQ.js';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-D1kyMiml.js';
 import '../gateway/gateway.js';
-import '../types-CKe8O0lR.js';
+import '../types-DedAJbNI.js';
 
 /**
  * @astrasyncai/adapter-cursor

package/dist/cursor/extension.d.mts

@@ -1,8 +1,8 @@
 import { VSCodeAPI } from './cursor-adapter.mjs';
 import '../adapter-interface/interface.mjs';
 import '../gateway/gateway.mjs';
-import '../types-B-ubjHER.mjs';
-import '../types-CKe8O0lR.mjs';
+import '../types-CSFci5zD.mjs';
+import '../types-DedAJbNI.mjs';
 
 /**
  * VS Code Extension entry point for AstraSync Local Guard (Cursor/VS Code).

package/dist/cursor/extension.d.ts

@@ -1,8 +1,8 @@
 import { VSCodeAPI } from './cursor-adapter.js';
 import '../adapter-interface/interface.js';
 import '../gateway/gateway.js';
-import '../types-Bgn5gxHQ.js';
-import '../types-CKe8O0lR.js';
+import '../types-D1kyMiml.js';
+import '../types-DedAJbNI.js';
 
 /**
  * VS Code Extension entry point for AstraSync Local Guard (Cursor/VS Code).

package/dist/{express-DQhDzNAt.d.ts → express-C8nJGi5P.d.ts}

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { n as VerificationResult, e as ExpressMiddlewareOptions, c as AstraSyncCredentials } from './types-CKe8O0lR.js';
+import { q as VerificationResult, e as ExpressMiddlewareOptions, c as AstraSyncCredentials } from './types-DedAJbNI.js';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/{express-BnMO-H3y.d.mts → express-Di_hnZZS.d.mts}

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { n as VerificationResult, e as ExpressMiddlewareOptions, c as AstraSyncCredentials } from './types-CKe8O0lR.mjs';
+import { q as VerificationResult, e as ExpressMiddlewareOptions, c as AstraSyncCredentials } from './types-DedAJbNI.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/gateway/gateway.d.mts

@@ -1,5 +1,5 @@
-import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-B-ubjHER.mjs';
-import '../types-CKe8O0lR.mjs';
+import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-CSFci5zD.mjs';
+import '../types-DedAJbNI.mjs';
 
 /**
  * AstraSyncGateway — Primary API surface for agent verification.

package/dist/gateway/gateway.d.ts

@@ -1,5 +1,5 @@
-import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-Bgn5gxHQ.js';
-import '../types-CKe8O0lR.js';
+import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-D1kyMiml.js';
+import '../types-DedAJbNI.js';
 
 /**
  * AstraSyncGateway — Primary API surface for agent verification.

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-B-ubjHER.mjs';
-import '../types-CKe8O0lR.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-CSFci5zD.mjs';
+import '../types-DedAJbNI.mjs';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-Bgn5gxHQ.js';
-import '../types-CKe8O0lR.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-D1kyMiml.js';
+import '../types-DedAJbNI.js';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/{index-rftma0ln.d.ts → index-CBQr4FGs.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-CKe8O0lR.js';
+import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-DedAJbNI.js';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-WHKq2v17.d.mts → index-CXcvO9Au.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-CKe8O0lR.mjs';
+import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-DedAJbNI.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-D8-dvUFA.d.ts → index-CuCkjT7B.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-CKe8O0lR.js';
+import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-DedAJbNI.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-BT_aRn-I.d.mts → index-DALAqct7.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-CKe8O0lR.mjs';
+import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-DedAJbNI.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/index.d.mts

@@ -1,12 +1,12 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, n as VerificationResult, j as StepUpApprovalInfo, l as StepUpOutcome, k as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CKe8O0lR.mjs';
-export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, T as TokenGuidance, m as TrustLevel, o as VerifiedAgent, p as VerifiedDeveloper, q as VerifiedOrganization } from './types-CKe8O0lR.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Cy3wAmDt.mjs';
-export { e as express } from './express-BnMO-H3y.mjs';
-export { n as nextjs } from './nextjs-DFKYhxe6.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-WHKq2v17.mjs';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, q as VerificationResult, m as StepUpApprovalInfo, o as StepUpOutcome, n as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-DedAJbNI.mjs';
+export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, F as FiatSettlementBinding, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, j as SettlementArtifactBinding, k as SettlementArtifactBindingBase, l as StablecoinSettlementBinding, T as TokenGuidance, p as TrustLevel, r as VerifiedAgent, s as VerifiedDeveloper, t as VerifiedOrganization } from './types-DedAJbNI.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Cn4KcZ5G.mjs';
+export { e as express } from './express-Di_hnZZS.mjs';
+export { n as nextjs } from './nextjs-BMAe8ode.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-CXcvO9Au.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BT_aRn-I.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DALAqct7.mjs';
 import 'express';
 import 'next/server';
 import 'jose';

package/dist/index.d.ts

@@ -1,12 +1,12 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, n as VerificationResult, j as StepUpApprovalInfo, l as StepUpOutcome, k as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CKe8O0lR.js';
-export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, T as TokenGuidance, m as TrustLevel, o as VerifiedAgent, p as VerifiedDeveloper, q as VerifiedOrganization } from './types-CKe8O0lR.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CAcHgB5x.js';
-export { e as express } from './express-DQhDzNAt.js';
-export { n as nextjs } from './nextjs-DPj7ZNlq.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-rftma0ln.js';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, q as VerificationResult, m as StepUpApprovalInfo, o as StepUpOutcome, n as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-DedAJbNI.js';
+export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, F as FiatSettlementBinding, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, j as SettlementArtifactBinding, k as SettlementArtifactBindingBase, l as StablecoinSettlementBinding, T as TokenGuidance, p as TrustLevel, r as VerifiedAgent, s as VerifiedDeveloper, t as VerifiedOrganization } from './types-DedAJbNI.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-ThdA_NtL.js';
+export { e as express } from './express-C8nJGi5P.js';
+export { n as nextjs } from './nextjs-IyXWW2KL.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-CBQr4FGs.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-D8-dvUFA.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CuCkjT7B.js';
 import 'express';
 import 'next/server';
 import 'jose';