@astrasyncai/verification-gateway 3.7.1 → 3.9.0

package/dist/local-evaluator/evaluator.d.mts

@@ -1,5 +1,5 @@
-import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-B-ubjHER.mjs';
-import '../types-CKe8O0lR.mjs';
+import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-BtqUvK8v.mjs';
+import '../types-ACMsV07B.mjs';
 
 /**
  * Local PDLSS Evaluator

package/dist/local-evaluator/evaluator.d.ts

@@ -1,5 +1,5 @@
-import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-Bgn5gxHQ.js';
-import '../types-CKe8O0lR.js';
+import { L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, b as LocalPurposeRule } from '../types-DmSDgPpG.js';
+import '../types-ACMsV07B.js';
 
 /**
  * Local PDLSS Evaluator

package/dist/{nextjs-DPj7ZNlq.d.ts → nextjs-DwUW-Nm1.d.ts}

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from './types-CKe8O0lR.js';
+import { N as NextJsMiddlewareOptions } from './types-ACMsV07B.js';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/{nextjs-DFKYhxe6.d.mts → nextjs-F_2pbPIA.d.mts}

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from './types-CKe8O0lR.mjs';
+import { N as NextJsMiddlewareOptions } from './types-ACMsV07B.mjs';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/platform-signatures.d.mts

@@ -0,0 +1,47 @@
+/**
+ * Platform-agent fingerprint signatures — the shared registry of known
+ * platform-agent UA / agent-card patterns (Claude / ChatGPT / Gemini /
+ * Cursor / Goose).
+ *
+ * Single source of truth, lifted verbatim from the backend's
+ * `platform-agent-detector.service` (which now imports detection from
+ * here): the backend's verify-access anonymous handler and the edge
+ * adapter (`@astrasyncai/adapter-lambda`) must classify identically or
+ * the three-tier visibility numbers drift between capture points.
+ *
+ * Pure regex — no Node built-ins, edge-safe. Detection is regex-only for
+ * v2.9 — TLS fingerprinting / behavioural signatures are deferred
+ * (recorded in adapter requirements doc).
+ */
+type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'unknown';
+interface PlatformFingerprint {
+    vendor: PlatformAgentVendor;
+    /** A stable identifier used as the orphan-agent dedup key. */
+    fingerprintKey: string;
+    /** Human-readable name surfaced in the admin panel. */
+    displayName: string;
+}
+interface PlatformDetectionInput {
+    userAgent?: string;
+    agentCardUrl?: string;
+}
+/**
+ * Registry of known platform-agent signatures. Order matters — first match wins.
+ *
+ * Patterns are intentionally permissive (case-insensitive substring match) since
+ * platform UA strings drift between versions. False positives are tolerable —
+ * the orphan record is informational, not enforcement.
+ */
+declare const PLATFORM_AGENT_SIGNATURES: ReadonlyArray<{
+    vendor: PlatformAgentVendor;
+    displayName: string;
+    uaPatterns?: RegExp[];
+    agentCardPatterns?: RegExp[];
+}>;
+/**
+ * Inspect caller metadata for a known platform-agent fingerprint.
+ * Returns undefined if no signature matches.
+ */
+declare function detectPlatformFingerprint(input: PlatformDetectionInput): PlatformFingerprint | undefined;
+
+export { PLATFORM_AGENT_SIGNATURES, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, detectPlatformFingerprint };

package/dist/platform-signatures.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Platform-agent fingerprint signatures — the shared registry of known
+ * platform-agent UA / agent-card patterns (Claude / ChatGPT / Gemini /
+ * Cursor / Goose).
+ *
+ * Single source of truth, lifted verbatim from the backend's
+ * `platform-agent-detector.service` (which now imports detection from
+ * here): the backend's verify-access anonymous handler and the edge
+ * adapter (`@astrasyncai/adapter-lambda`) must classify identically or
+ * the three-tier visibility numbers drift between capture points.
+ *
+ * Pure regex — no Node built-ins, edge-safe. Detection is regex-only for
+ * v2.9 — TLS fingerprinting / behavioural signatures are deferred
+ * (recorded in adapter requirements doc).
+ */
+type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'unknown';
+interface PlatformFingerprint {
+    vendor: PlatformAgentVendor;
+    /** A stable identifier used as the orphan-agent dedup key. */
+    fingerprintKey: string;
+    /** Human-readable name surfaced in the admin panel. */
+    displayName: string;
+}
+interface PlatformDetectionInput {
+    userAgent?: string;
+    agentCardUrl?: string;
+}
+/**
+ * Registry of known platform-agent signatures. Order matters — first match wins.
+ *
+ * Patterns are intentionally permissive (case-insensitive substring match) since
+ * platform UA strings drift between versions. False positives are tolerable —
+ * the orphan record is informational, not enforcement.
+ */
+declare const PLATFORM_AGENT_SIGNATURES: ReadonlyArray<{
+    vendor: PlatformAgentVendor;
+    displayName: string;
+    uaPatterns?: RegExp[];
+    agentCardPatterns?: RegExp[];
+}>;
+/**
+ * Inspect caller metadata for a known platform-agent fingerprint.
+ * Returns undefined if no signature matches.
+ */
+declare function detectPlatformFingerprint(input: PlatformDetectionInput): PlatformFingerprint | undefined;
+
+export { PLATFORM_AGENT_SIGNATURES, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, detectPlatformFingerprint };

package/dist/platform-signatures.js

@@ -0,0 +1,89 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/platform-signatures.ts
+var platform_signatures_exports = {};
+__export(platform_signatures_exports, {
+  PLATFORM_AGENT_SIGNATURES: () => PLATFORM_AGENT_SIGNATURES,
+  detectPlatformFingerprint: () => detectPlatformFingerprint
+});
+module.exports = __toCommonJS(platform_signatures_exports);
+var PLATFORM_AGENT_SIGNATURES = [
+  {
+    vendor: "claude",
+    displayName: "Anthropic Claude",
+    uaPatterns: [/claude/i, /anthropic/i],
+    agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i]
+  },
+  {
+    vendor: "chatgpt",
+    displayName: "OpenAI ChatGPT",
+    uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i],
+    agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i]
+  },
+  {
+    vendor: "gemini",
+    displayName: "Google Gemini",
+    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i]
+  },
+  {
+    vendor: "cursor",
+    displayName: "Cursor",
+    uaPatterns: [/cursor/i],
+    agentCardPatterns: [/cursor\.sh/i, /cursor\.com/i]
+  },
+  {
+    vendor: "goose",
+    displayName: "Block Goose",
+    uaPatterns: [/goose/i, /block-goose/i],
+    agentCardPatterns: [/block\.xyz\/goose/i, /goose\.tools/i]
+  }
+];
+function detectPlatformFingerprint(input) {
+  const ua = input.userAgent ?? "";
+  const cardUrl = input.agentCardUrl ?? "";
+  for (const sig of PLATFORM_AGENT_SIGNATURES) {
+    const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));
+    const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));
+    if (uaMatch || cardMatch) {
+      const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
+      const cardHost = (() => {
+        try {
+          return cardUrl ? new URL(cardUrl).host : "";
+        } catch {
+          return "";
+        }
+      })();
+      const fingerprintKey = `${sig.vendor}:${uaBase || cardHost || "unknown"}`;
+      return {
+        vendor: sig.vendor,
+        fingerprintKey,
+        displayName: sig.displayName
+      };
+    }
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PLATFORM_AGENT_SIGNATURES,
+  detectPlatformFingerprint
+});
+//# sourceMappingURL=platform-signatures.js.map

package/dist/platform-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/platform-signatures.ts"],"sourcesContent":["/**\n * Platform-agent fingerprint signatures — the shared registry of known\n * platform-agent UA / agent-card patterns (Claude / ChatGPT / Gemini /\n * Cursor / Goose).\n *\n * Single source of truth, lifted verbatim from the backend's\n * `platform-agent-detector.service` (which now imports detection from\n * here): the backend's verify-access anonymous handler and the edge\n * adapter (`@astrasyncai/adapter-lambda`) must classify identically or\n * the three-tier visibility numbers drift between capture points.\n *\n * Pure regex — no Node built-ins, edge-safe. Detection is regex-only for\n * v2.9 — TLS fingerprinting / behavioural signatures are deferred\n * (recorded in adapter requirements doc).\n */\n\nexport type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'unknown';\n\nexport interface PlatformFingerprint {\n  vendor: PlatformAgentVendor;\n  /** A stable identifier used as the orphan-agent dedup key. */\n  fingerprintKey: string;\n  /** Human-readable name surfaced in the admin panel. */\n  displayName: string;\n}\n\nexport interface PlatformDetectionInput {\n  userAgent?: string;\n  agentCardUrl?: string;\n}\n\n/**\n * Registry of known platform-agent signatures. Order matters — first match wins.\n *\n * Patterns are intentionally permissive (case-insensitive substring match) since\n * platform UA strings drift between versions. False positives are tolerable —\n * the orphan record is informational, not enforcement.\n */\nexport const PLATFORM_AGENT_SIGNATURES: ReadonlyArray<{\n  vendor: PlatformAgentVendor;\n  displayName: string;\n  uaPatterns?: RegExp[];\n  agentCardPatterns?: RegExp[];\n}> = [\n  {\n    vendor: 'claude',\n    displayName: 'Anthropic Claude',\n    uaPatterns: [/claude/i, /anthropic/i],\n    agentCardPatterns: [/anthropic\\.com/i, /claude\\.ai/i],\n  },\n  {\n    vendor: 'chatgpt',\n    displayName: 'OpenAI ChatGPT',\n    uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\\d/i],\n    agentCardPatterns: [/openai\\.com/i, /chatgpt\\.com/i],\n  },\n  {\n    vendor: 'gemini',\n    displayName: 'Google Gemini',\n    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],\n    agentCardPatterns: [/gemini\\.google\\.com/i, /ai\\.google\\.dev/i],\n  },\n  {\n    vendor: 'cursor',\n    displayName: 'Cursor',\n    uaPatterns: [/cursor/i],\n    agentCardPatterns: [/cursor\\.sh/i, /cursor\\.com/i],\n  },\n  {\n    vendor: 'goose',\n    displayName: 'Block Goose',\n    uaPatterns: [/goose/i, /block-goose/i],\n    agentCardPatterns: [/block\\.xyz\\/goose/i, /goose\\.tools/i],\n  },\n];\n\n/**\n * Inspect caller metadata for a known platform-agent fingerprint.\n * Returns undefined if no signature matches.\n */\nexport function detectPlatformFingerprint(\n  input: PlatformDetectionInput\n): PlatformFingerprint | undefined {\n  const ua = input.userAgent ?? '';\n  const cardUrl = input.agentCardUrl ?? '';\n\n  for (const sig of PLATFORM_AGENT_SIGNATURES) {\n    const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));\n    const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));\n    if (uaMatch || cardMatch) {\n      // Stable dedup key: vendor + lowercased UA basename (before first slash/space).\n      // For requests without UA, fall back to vendor + agent-card host.\n      const uaBase = ua.split(/[\\s/]/)[0]?.toLowerCase() ?? '';\n      const cardHost = (() => {\n        try {\n          return cardUrl ? new URL(cardUrl).host : '';\n        } catch {\n          return '';\n        }\n      })();\n      const fingerprintKey = `${sig.vendor}:${uaBase || cardHost || 'unknown'}`;\n      return {\n        vendor: sig.vendor,\n        fingerprintKey,\n        displayName: sig.displayName,\n      };\n    }\n  }\n\n  return undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsCO,IAAM,4BAKR;AAAA,EACH;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,WAAW,YAAY;AAAA,IACpC,mBAAmB,CAAC,mBAAmB,aAAa;AAAA,EACtD;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,YAAY,WAAW,UAAU;AAAA,IAC9C,mBAAmB,CAAC,gBAAgB,eAAe;AAAA,EACrD;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,WAAW,kBAAkB,OAAO;AAAA,IACjD,mBAAmB,CAAC,wBAAwB,kBAAkB;AAAA,EAChE;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,SAAS;AAAA,IACtB,mBAAmB,CAAC,eAAe,cAAc;AAAA,EACnD;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,UAAU,cAAc;AAAA,IACrC,mBAAmB,CAAC,sBAAsB,eAAe;AAAA,EAC3D;AACF;AAMO,SAAS,0BACd,OACiC;AACjC,QAAM,KAAK,MAAM,aAAa;AAC9B,QAAM,UAAU,MAAM,gBAAgB;AAEtC,aAAW,OAAO,2BAA2B;AAC3C,UAAM,UAAU,IAAI,YAAY,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;AACtD,UAAM,YAAY,IAAI,mBAAmB,KAAK,CAAC,MAAM,EAAE,KAAK,OAAO,CAAC;AACpE,QAAI,WAAW,WAAW;AAGxB,YAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK;AACtD,YAAM,YAAY,MAAM;AACtB,YAAI;AACF,iBAAO,UAAU,IAAI,IAAI,OAAO,EAAE,OAAO;AAAA,QAC3C,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF,GAAG;AACH,YAAM,iBAAiB,GAAG,IAAI,MAAM,IAAI,UAAU,YAAY,SAAS;AACvE,aAAO;AAAA,QACL,QAAQ,IAAI;AAAA,QACZ;AAAA,QACA,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/platform-signatures.mjs

@@ -0,0 +1,63 @@
+// src/platform-signatures.ts
+var PLATFORM_AGENT_SIGNATURES = [
+  {
+    vendor: "claude",
+    displayName: "Anthropic Claude",
+    uaPatterns: [/claude/i, /anthropic/i],
+    agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i]
+  },
+  {
+    vendor: "chatgpt",
+    displayName: "OpenAI ChatGPT",
+    uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i],
+    agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i]
+  },
+  {
+    vendor: "gemini",
+    displayName: "Google Gemini",
+    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i]
+  },
+  {
+    vendor: "cursor",
+    displayName: "Cursor",
+    uaPatterns: [/cursor/i],
+    agentCardPatterns: [/cursor\.sh/i, /cursor\.com/i]
+  },
+  {
+    vendor: "goose",
+    displayName: "Block Goose",
+    uaPatterns: [/goose/i, /block-goose/i],
+    agentCardPatterns: [/block\.xyz\/goose/i, /goose\.tools/i]
+  }
+];
+function detectPlatformFingerprint(input) {
+  const ua = input.userAgent ?? "";
+  const cardUrl = input.agentCardUrl ?? "";
+  for (const sig of PLATFORM_AGENT_SIGNATURES) {
+    const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));
+    const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));
+    if (uaMatch || cardMatch) {
+      const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
+      const cardHost = (() => {
+        try {
+          return cardUrl ? new URL(cardUrl).host : "";
+        } catch {
+          return "";
+        }
+      })();
+      const fingerprintKey = `${sig.vendor}:${uaBase || cardHost || "unknown"}`;
+      return {
+        vendor: sig.vendor,
+        fingerprintKey,
+        displayName: sig.displayName
+      };
+    }
+  }
+  return void 0;
+}
+export {
+  PLATFORM_AGENT_SIGNATURES,
+  detectPlatformFingerprint
+};
+//# sourceMappingURL=platform-signatures.mjs.map

package/dist/platform-signatures.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/platform-signatures.ts"],"sourcesContent":["/**\n * Platform-agent fingerprint signatures — the shared registry of known\n * platform-agent UA / agent-card patterns (Claude / ChatGPT / Gemini /\n * Cursor / Goose).\n *\n * Single source of truth, lifted verbatim from the backend's\n * `platform-agent-detector.service` (which now imports detection from\n * here): the backend's verify-access anonymous handler and the edge\n * adapter (`@astrasyncai/adapter-lambda`) must classify identically or\n * the three-tier visibility numbers drift between capture points.\n *\n * Pure regex — no Node built-ins, edge-safe. Detection is regex-only for\n * v2.9 — TLS fingerprinting / behavioural signatures are deferred\n * (recorded in adapter requirements doc).\n */\n\nexport type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'unknown';\n\nexport interface PlatformFingerprint {\n  vendor: PlatformAgentVendor;\n  /** A stable identifier used as the orphan-agent dedup key. */\n  fingerprintKey: string;\n  /** Human-readable name surfaced in the admin panel. */\n  displayName: string;\n}\n\nexport interface PlatformDetectionInput {\n  userAgent?: string;\n  agentCardUrl?: string;\n}\n\n/**\n * Registry of known platform-agent signatures. Order matters — first match wins.\n *\n * Patterns are intentionally permissive (case-insensitive substring match) since\n * platform UA strings drift between versions. False positives are tolerable —\n * the orphan record is informational, not enforcement.\n */\nexport const PLATFORM_AGENT_SIGNATURES: ReadonlyArray<{\n  vendor: PlatformAgentVendor;\n  displayName: string;\n  uaPatterns?: RegExp[];\n  agentCardPatterns?: RegExp[];\n}> = [\n  {\n    vendor: 'claude',\n    displayName: 'Anthropic Claude',\n    uaPatterns: [/claude/i, /anthropic/i],\n    agentCardPatterns: [/anthropic\\.com/i, /claude\\.ai/i],\n  },\n  {\n    vendor: 'chatgpt',\n    displayName: 'OpenAI ChatGPT',\n    uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\\d/i],\n    agentCardPatterns: [/openai\\.com/i, /chatgpt\\.com/i],\n  },\n  {\n    vendor: 'gemini',\n    displayName: 'Google Gemini',\n    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],\n    agentCardPatterns: [/gemini\\.google\\.com/i, /ai\\.google\\.dev/i],\n  },\n  {\n    vendor: 'cursor',\n    displayName: 'Cursor',\n    uaPatterns: [/cursor/i],\n    agentCardPatterns: [/cursor\\.sh/i, /cursor\\.com/i],\n  },\n  {\n    vendor: 'goose',\n    displayName: 'Block Goose',\n    uaPatterns: [/goose/i, /block-goose/i],\n    agentCardPatterns: [/block\\.xyz\\/goose/i, /goose\\.tools/i],\n  },\n];\n\n/**\n * Inspect caller metadata for a known platform-agent fingerprint.\n * Returns undefined if no signature matches.\n */\nexport function detectPlatformFingerprint(\n  input: PlatformDetectionInput\n): PlatformFingerprint | undefined {\n  const ua = input.userAgent ?? '';\n  const cardUrl = input.agentCardUrl ?? '';\n\n  for (const sig of PLATFORM_AGENT_SIGNATURES) {\n    const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));\n    const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));\n    if (uaMatch || cardMatch) {\n      // Stable dedup key: vendor + lowercased UA basename (before first slash/space).\n      // For requests without UA, fall back to vendor + agent-card host.\n      const uaBase = ua.split(/[\\s/]/)[0]?.toLowerCase() ?? '';\n      const cardHost = (() => {\n        try {\n          return cardUrl ? new URL(cardUrl).host : '';\n        } catch {\n          return '';\n        }\n      })();\n      const fingerprintKey = `${sig.vendor}:${uaBase || cardHost || 'unknown'}`;\n      return {\n        vendor: sig.vendor,\n        fingerprintKey,\n        displayName: sig.displayName,\n      };\n    }\n  }\n\n  return undefined;\n}\n"],"mappings":";AAsCO,IAAM,4BAKR;AAAA,EACH;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,WAAW,YAAY;AAAA,IACpC,mBAAmB,CAAC,mBAAmB,aAAa;AAAA,EACtD;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,YAAY,WAAW,UAAU;AAAA,IAC9C,mBAAmB,CAAC,gBAAgB,eAAe;AAAA,EACrD;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,WAAW,kBAAkB,OAAO;AAAA,IACjD,mBAAmB,CAAC,wBAAwB,kBAAkB;AAAA,EAChE;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,SAAS;AAAA,IACtB,mBAAmB,CAAC,eAAe,cAAc;AAAA,EACnD;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,YAAY,CAAC,UAAU,cAAc;AAAA,IACrC,mBAAmB,CAAC,sBAAsB,eAAe;AAAA,EAC3D;AACF;AAMO,SAAS,0BACd,OACiC;AACjC,QAAM,KAAK,MAAM,aAAa;AAC9B,QAAM,UAAU,MAAM,gBAAgB;AAEtC,aAAW,OAAO,2BAA2B;AAC3C,UAAM,UAAU,IAAI,YAAY,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;AACtD,UAAM,YAAY,IAAI,mBAAmB,KAAK,CAAC,MAAM,EAAE,KAAK,OAAO,CAAC;AACpE,QAAI,WAAW,WAAW;AAGxB,YAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK;AACtD,YAAM,YAAY,MAAM;AACtB,YAAI;AACF,iBAAO,UAAU,IAAI,IAAI,OAAO,EAAE,OAAO;AAAA,QAC3C,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF,GAAG;AACH,YAAM,iBAAiB,GAAG,IAAI,MAAM,IAAI,UAAU,YAAY,SAAS;AACvE,aAAO;AAAA,QACL,QAAQ,IAAI;AAAA,QACZ;AAAA,QACA,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/{sdk-CAcHgB5x.d.ts → sdk-CfHANs4A.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, m as TrustLevel, S as SDKOptions, n as VerificationResult } from './types-CKe8O0lR.js';
+import { a as AccessLevel, q as TrustLevel, S as SDKOptions, r as VerificationResult } from './types-ACMsV07B.js';
 
 /**
  * AstraSync Universal Verification Gateway - Access Level Definitions

package/dist/{sdk-Cy3wAmDt.d.mts → sdk-Clob2-0A.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, m as TrustLevel, S as SDKOptions, n as VerificationResult } from './types-CKe8O0lR.mjs';
+import { a as AccessLevel, q as TrustLevel, S as SDKOptions, r as VerificationResult } from './types-ACMsV07B.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Access Level Definitions

package/dist/transport/index.d.mts

@@ -1,3 +1,3 @@
-import '../types-CKe8O0lR.mjs';
-export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-WHKq2v17.mjs';
+import '../types-ACMsV07B.mjs';
+export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-Dalih3EB.mjs';
 import 'jose';

package/dist/transport/index.d.ts

@@ -1,3 +1,3 @@
-import '../types-CKe8O0lR.js';
-export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-rftma0ln.js';
+import '../types-ACMsV07B.js';
+export { A as ACPEndpoint, a as ACPPaymentTokenType, b as ACPRequestContext, c as ACPRequestLike, d as ACPSignatureAlgorithm, e as ACPTotal, f as ACPVerifyInput, g as ACPVerifyResult, h as AP2CartMandateClaims, i as AP2ChainResult, j as AP2IntentMandateClaims, k as AP2MandateClaims, l as AP2MandateTriple, m as AP2MandateTripleInput, n as AP2MandateType, o as AP2PaymentDetailsTotal, p as AP2PaymentMandateClaims, q as AP2PaymentMandateForValue, r as AP2VerifyInput, C as CommerceContext, s as CommercePipelineInput, t as CommerceProtocol, u as CommercePurpose, v as CommerceSignatureStack, w as ConstraintEvalResult, x as ConstraintKey, y as ConstraintResult, E as ExtractorRequestLike, I as IdentityBindingResult, z as IdentityClaim, B as IdentityResolver, M as MPPChallengeForValue, D as MPPChallengeSummary, F as MPPCredentialSummary, G as MPPIntent, H as MPPKind, J as MPPReceiptSummary, K as MPPRequestContext, L as MPPRequestLike, N as MPPResponseLike, O as MPPVerifyInput, P as MPPVerifyResult, Q as ParsedRFC9421, R as PaymentMethodAllowlistInput, S as RFC9421SignatureParams, T as RFC9421Tag, U as RFC9421VerifyOptions, V as RFC9421VerifyRequest, W as RFC9421VerifyResult, X as RegistryName, Y as RegistryResolver, Z as ResolveContext, _ as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, $ as SpendingLimitInput, a0 as StripeWebhookInformationalEvent, a1 as TransactionContext, a2 as TransactionValueContext, a3 as TransportExtractor, a4 as UCPCheckoutContext, a5 as UCPManifestValidationResult, a6 as UCPRequestLike, a7 as UCPTotal, a8 as VIAllowedParty, a9 as VIBudgetLimit, aa as VIClaimsForValue, ab as VIConstraintEvalInput, ac as VIConstraints, ad as VIExecutionMode, ae as VIExtractedClaims, af as VILayer, ag as VILineItem, ah as VIMandateType, ai as VIPaymentAmount, aj as VIRecurrence, ak as VIVerifyInput, al as VIVerifyResult, am as VerifyStripeWebhookOptions, an as VerifyStripeWebhookResult, ao as X402Kind, ap as X402RequestContext, aq as X402RequestForValue, ar as X402RequestLike, as as X402RequirementsSummary, at as X402ResponseLike, au as applyCredentials, av as bindIdentity, aw as claim, ax as clearTransportExtractors, ay as createMastercardRegistry, az as createVisaRegistry, aA as createWebBotAuthRegistry, aB as detectProtocol, aC as evaluatePaymentMethodAllowlist, aD as evaluateSpendingLimit, aE as evaluateVIConstraints, aF as extractA2ACredentials, aG as extractACPContext, aH as extractACPTransactionValue, aI as extractAP2Mandate, aJ as extractAP2Mandates, aK as extractAP2TransactionValue, aL as extractCredentialsFromProtocol, aM as extractHttpCredentials, aN as extractMPPContext, aO as extractMPPFromRequest, aP as extractMPPFromResponse, aQ as extractMPPTransactionValue, aR as extractMcpCredentials, aS as extractUCPContext, aT as extractUCPTransactionValue, aU as extractVIClaims, aV as extractVITransactionValue, aW as extractX402Context, aX as extractX402FromRequest, aY as extractX402FromResponse, aZ as extractX402TransactionValue, a_ as fetchUCPManifest, a$ as getTransportExtractor, b0 as getTransportExtractors, b2 as isStripeWebhookInformational, b3 as mapACPRequestToPurpose, b4 as mapAP2MandateToPurpose, b5 as mapMPPRequestToPurpose, b6 as mapRFC9421TagToPurpose, b7 as mapUCPRequestToPurpose, b8 as mapVIMandateToPurpose, b9 as mapX402RequestToPurpose, ba as parseRFC9421, bb as registerTransportExtractor, bc as runCommercePipeline, bd as runMatchingExtractors, be as setA2AMetadata, bf as setHttpHeaders, bg as setMcpMeta, bh as validateUCPManifest, bi as verifyACPSignature, bj as verifyAP2Chain, bk as verifyMPP, bl as verifyRFC9421, bm as verifyStripeWebhook, bn as verifyVIChain } from '../index-CMg-vjEK.js';
 import 'jose';

package/dist/{types-CKe8O0lR.d.mts → types-ACMsV07B.d.mts}

@@ -343,17 +343,45 @@ type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'con
  * 'timeout' when the hold budget ran out while the approval was still pending.
  */
 type StepUpOutcome = Exclude<StepUpApprovalStatus, 'pending'> | 'timeout';
+/** Fields common to every settlement-artifact binding. */
+interface SettlementArtifactBindingBase {
+    merchantId: string;
+    sessionId: string;
+    singleUse: true;
+    expiresAt: string;
+}
+/**
+ * Fiat/processor artifact binding (Stripe, Skyfire, PayPal) — the processor
+ * is the unit authority, so the binding carries the major-unit pricing amount.
+ */
+interface FiatSettlementBinding extends SettlementArtifactBindingBase {
+    amount: number;
+    currency: string;
+}
+/**
+ * Stablecoin voucher binding — wire format v2. Money is integer minor units
+ * (`amountMinor` scaled by `assetDecimals`, no floats), and the settlement
+ * asset is pinned to a chain + token contract (CAIP-19 `asset`).
+ */
+interface StablecoinSettlementBinding extends SettlementArtifactBindingBase {
+    amountMinor: number;
+    assetDecimals: number;
+    currency: string;
+    chainId: number;
+    tokenContract: string;
+    asset: string;
+}
+type SettlementArtifactBinding = FiatSettlementBinding | StablecoinSettlementBinding;
+/**
+ * Settlement artifact returned on a clean merchant-mediated grant. The JWS
+ * `artifact` is the authoritative, signed object — `binding` mirrors its
+ * claims for display convenience only. Never settle from `binding`; decide
+ * from the server-verified payload at redeem time.
+ */
 interface SettlementArtifact {
     type: string;
     artifact: string;
-    binding: {
-        merchantId: string;
-        amount: number;
-        currency: string;
-        sessionId: string;
-        singleUse: true;
-        expiresAt: string;
-    };
+    binding: SettlementArtifactBinding;
 }
 /**
  * Complete verification result
@@ -532,6 +560,81 @@ interface VerificationRequest {
      * visibility into transport-vs-intent.
      */
     invocationProtocol?: 'rest' | 'mcp' | 'a2a' | 'acp' | 'ap2' | 'mpp' | 'ucp';
+    /**
+     * 3.9.0 (§33.5 #1) — raw commerce-protocol artifacts forwarded verbatim
+     * to verify-access, whose Step 0.5 commerce pipeline runs the full
+     * cryptographic verification SERVER-side and persists commerce_context on
+     * the session. Adapters forward artifacts, they never verify them locally
+     * (bridge-is-transport: verify-access is the sole verification sink, so
+     * every decision is recorded once, with events). Shape mirrors the
+     * backend's `commerceArtifacts` schema 1:1.
+     */
+    commerceArtifacts?: CommerceArtifactsPayload;
+}
+/**
+ * Raw commerce-protocol artifacts as verify-access accepts them (backend
+ * `validation.ts` → `commerceArtifacts`). All optional; send what was
+ * detected on the wire.
+ */
+interface CommerceArtifactsPayload {
+    /** Compact VI SD-JWT. */
+    viSdJwt?: string;
+    /** AP2 mandate triple as compact SD-JWTs. */
+    ap2Mandates?: {
+        intent?: string;
+        cart?: string;
+        payment?: string;
+    };
+    /** RFC 9421 signed request (Agent Pay / TAP / Web Bot Auth). */
+    rfc9421?: {
+        headers: Record<string, string | string[]>;
+        method: string;
+        url: string;
+        body?: string;
+        tag?: string;
+    };
+    /** UCP checkout session request. */
+    ucpRequest?: {
+        method: string;
+        url: string;
+        body?: unknown;
+    };
+    /** ACP request (HMAC-signed webhook or checkout body). */
+    acpRequest?: {
+        method: string;
+        url: string;
+        headers?: Record<string, string | string[]>;
+        body?: unknown;
+        rawBody?: string;
+    };
+    mppRequest?: {
+        method: string;
+        url: string;
+        headers: Record<string, string | string[]>;
+        body?: unknown;
+        rawBody?: string;
+    };
+    mppResponse?: {
+        status: number;
+        headers: Record<string, string | string[]>;
+        body?: unknown;
+    };
+    x402Request?: {
+        method?: string;
+        url?: string;
+        headers?: Record<string, string | string[]>;
+        body?: unknown;
+    };
+    x402Response?: {
+        status?: number;
+        headers?: Record<string, string | string[]>;
+        body?: unknown;
+    };
+    stripeWebhook?: {
+        payload: string;
+        signatureHeader: string;
+        secret: string;
+    };
 }
 /**
  * Route-specific access configuration
@@ -814,4 +917,4 @@ interface CommerceShieldProps {
     className?: string;
 }
 
-export type { AccessFailure as A, CommerceShieldProps as C, EnhancedVerificationResult as E, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CounterpartyType as d, ExpressMiddlewareOptions as e, GuidanceInfo as f, ProtocolTransport as g, RuntimeChallengeResult as h, SettlementArtifact as i, StepUpApprovalInfo as j, StepUpApprovalStatus as k, StepUpOutcome as l, TrustLevel as m, VerificationResult as n, VerifiedAgent as o, VerifiedDeveloper as p, VerifiedOrganization as q };
+export type { AccessFailure as A, CommerceArtifactsPayload as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CommerceShieldProps as d, CounterpartyType as e, ExpressMiddlewareOptions as f, GuidanceInfo as g, ProtocolTransport as h, RuntimeChallengeResult as i, SettlementArtifact as j, SettlementArtifactBinding as k, SettlementArtifactBindingBase as l, StablecoinSettlementBinding as m, StepUpApprovalInfo as n, StepUpApprovalStatus as o, StepUpOutcome as p, TrustLevel as q, VerificationResult as r, VerifiedAgent as s, VerifiedDeveloper as t, VerifiedOrganization as u };

package/dist/{types-CKe8O0lR.d.ts → types-ACMsV07B.d.ts}

@@ -343,17 +343,45 @@ type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'con
  * 'timeout' when the hold budget ran out while the approval was still pending.
  */
 type StepUpOutcome = Exclude<StepUpApprovalStatus, 'pending'> | 'timeout';
+/** Fields common to every settlement-artifact binding. */
+interface SettlementArtifactBindingBase {
+    merchantId: string;
+    sessionId: string;
+    singleUse: true;
+    expiresAt: string;
+}
+/**
+ * Fiat/processor artifact binding (Stripe, Skyfire, PayPal) — the processor
+ * is the unit authority, so the binding carries the major-unit pricing amount.
+ */
+interface FiatSettlementBinding extends SettlementArtifactBindingBase {
+    amount: number;
+    currency: string;
+}
+/**
+ * Stablecoin voucher binding — wire format v2. Money is integer minor units
+ * (`amountMinor` scaled by `assetDecimals`, no floats), and the settlement
+ * asset is pinned to a chain + token contract (CAIP-19 `asset`).
+ */
+interface StablecoinSettlementBinding extends SettlementArtifactBindingBase {
+    amountMinor: number;
+    assetDecimals: number;
+    currency: string;
+    chainId: number;
+    tokenContract: string;
+    asset: string;
+}
+type SettlementArtifactBinding = FiatSettlementBinding | StablecoinSettlementBinding;
+/**
+ * Settlement artifact returned on a clean merchant-mediated grant. The JWS
+ * `artifact` is the authoritative, signed object — `binding` mirrors its
+ * claims for display convenience only. Never settle from `binding`; decide
+ * from the server-verified payload at redeem time.
+ */
 interface SettlementArtifact {
     type: string;
     artifact: string;
-    binding: {
-        merchantId: string;
-        amount: number;
-        currency: string;
-        sessionId: string;
-        singleUse: true;
-        expiresAt: string;
-    };
+    binding: SettlementArtifactBinding;
 }
 /**
  * Complete verification result
@@ -532,6 +560,81 @@ interface VerificationRequest {
      * visibility into transport-vs-intent.
      */
     invocationProtocol?: 'rest' | 'mcp' | 'a2a' | 'acp' | 'ap2' | 'mpp' | 'ucp';
+    /**
+     * 3.9.0 (§33.5 #1) — raw commerce-protocol artifacts forwarded verbatim
+     * to verify-access, whose Step 0.5 commerce pipeline runs the full
+     * cryptographic verification SERVER-side and persists commerce_context on
+     * the session. Adapters forward artifacts, they never verify them locally
+     * (bridge-is-transport: verify-access is the sole verification sink, so
+     * every decision is recorded once, with events). Shape mirrors the
+     * backend's `commerceArtifacts` schema 1:1.
+     */
+    commerceArtifacts?: CommerceArtifactsPayload;
+}
+/**
+ * Raw commerce-protocol artifacts as verify-access accepts them (backend
+ * `validation.ts` → `commerceArtifacts`). All optional; send what was
+ * detected on the wire.
+ */
+interface CommerceArtifactsPayload {
+    /** Compact VI SD-JWT. */
+    viSdJwt?: string;
+    /** AP2 mandate triple as compact SD-JWTs. */
+    ap2Mandates?: {
+        intent?: string;
+        cart?: string;
+        payment?: string;
+    };
+    /** RFC 9421 signed request (Agent Pay / TAP / Web Bot Auth). */
+    rfc9421?: {
+        headers: Record<string, string | string[]>;
+        method: string;
+        url: string;
+        body?: string;
+        tag?: string;
+    };
+    /** UCP checkout session request. */
+    ucpRequest?: {
+        method: string;
+        url: string;
+        body?: unknown;
+    };
+    /** ACP request (HMAC-signed webhook or checkout body). */
+    acpRequest?: {
+        method: string;
+        url: string;
+        headers?: Record<string, string | string[]>;
+        body?: unknown;
+        rawBody?: string;
+    };
+    mppRequest?: {
+        method: string;
+        url: string;
+        headers: Record<string, string | string[]>;
+        body?: unknown;
+        rawBody?: string;
+    };
+    mppResponse?: {
+        status: number;
+        headers: Record<string, string | string[]>;
+        body?: unknown;
+    };
+    x402Request?: {
+        method?: string;
+        url?: string;
+        headers?: Record<string, string | string[]>;
+        body?: unknown;
+    };
+    x402Response?: {
+        status?: number;
+        headers?: Record<string, string | string[]>;
+        body?: unknown;
+    };
+    stripeWebhook?: {
+        payload: string;
+        signatureHeader: string;
+        secret: string;
+    };
 }
 /**
  * Route-specific access configuration
@@ -814,4 +917,4 @@ interface CommerceShieldProps {
     className?: string;
 }
 
-export type { AccessFailure as A, CommerceShieldProps as C, EnhancedVerificationResult as E, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CounterpartyType as d, ExpressMiddlewareOptions as e, GuidanceInfo as f, ProtocolTransport as g, RuntimeChallengeResult as h, SettlementArtifact as i, StepUpApprovalInfo as j, StepUpApprovalStatus as k, StepUpOutcome as l, TrustLevel as m, VerificationResult as n, VerifiedAgent as o, VerifiedDeveloper as p, VerifiedOrganization as q };
+export type { AccessFailure as A, CommerceArtifactsPayload as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationRequest as V, AccessLevel as a, AgentCredentials as b, AstraSyncCredentials as c, CommerceShieldProps as d, CounterpartyType as e, ExpressMiddlewareOptions as f, GuidanceInfo as g, ProtocolTransport as h, RuntimeChallengeResult as i, SettlementArtifact as j, SettlementArtifactBinding as k, SettlementArtifactBindingBase as l, StablecoinSettlementBinding as m, StepUpApprovalInfo as n, StepUpApprovalStatus as o, StepUpOutcome as p, TrustLevel as q, VerificationResult as r, VerifiedAgent as s, VerifiedDeveloper as t, VerifiedOrganization as u };