@astrasyncai/verification-gateway 3.7.1 → 3.9.0

package/dist/{types-B-ubjHER.d.mts → types-BtqUvK8v.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, d as CounterpartyType, T as TokenGuidance } from './types-CKe8O0lR.mjs';
+import { a as AccessLevel, e as CounterpartyType, T as TokenGuidance } from './types-ACMsV07B.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-Bgn5gxHQ.d.ts → types-DmSDgPpG.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, d as CounterpartyType, T as TokenGuidance } from './types-CKe8O0lR.js';
+import { a as AccessLevel, e as CounterpartyType, T as TokenGuidance } from './types-ACMsV07B.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { C as CommerceShieldProps, n as VerificationResult, b as AgentCredentials, f as GuidanceInfo, m as TrustLevel } from '../types-CKe8O0lR.mjs';
+import { d as CommerceShieldProps, r as VerificationResult, b as AgentCredentials, g as GuidanceInfo, q as TrustLevel } from '../types-ACMsV07B.mjs';
 
 /**
  * AstraSync Commerce Shield Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { C as CommerceShieldProps, n as VerificationResult, b as AgentCredentials, f as GuidanceInfo, m as TrustLevel } from '../types-CKe8O0lR.js';
+import { d as CommerceShieldProps, r as VerificationResult, b as AgentCredentials, g as GuidanceInfo, q as TrustLevel } from '../types-ACMsV07B.js';
 
 /**
  * AstraSync Commerce Shield Component

package/dist/verify.d.mts

@@ -0,0 +1,144 @@
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, r as VerificationResult } from './types-ACMsV07B.mjs';
+
+/**
+ * AstraSync Universal Verification Gateway - Core Verification Logic
+ *
+ * This module handles the core verification logic, calling the AstraSync API
+ * and processing the response into a standardized VerificationResult.
+ */
+
+/**
+ * Clear the verification cache
+ */
+declare function clearCache(): void;
+/**
+ * Extract agent credentials from various sources
+ */
+declare function extractCredentials(headers: Record<string, string | string[] | undefined>, query?: Record<string, string | undefined>): AgentCredentials;
+/**
+ * Check if credentials are present
+ */
+declare function hasCredentials(credentials: AgentCredentials): boolean;
+/**
+ * Options for a single verify() call (as opposed to GatewayConfig, which is
+ * per-gateway). Mirrors the Java SDK's `verify(request, bypassCache)`.
+ */
+interface VerifyOptions {
+    /**
+     * Skip the cache READ for this call so the request is guaranteed to reach
+     * the backend (the result is still written to the cache if cacheable).
+     * Used by the step-up hold-and-poll retry: the re-verify after an approval
+     * must hit the server to redeem the single-use approval.
+     */
+    bypassCache?: boolean;
+}
+/**
+ * Main verification function
+ */
+declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Record a counterparty's grant/deny decision for a verification session.
+ * Fire-and-forget — errors are silently swallowed.
+ */
+declare function recordDecision(config: GatewayConfig, sessionId: string, decision: 'granted' | 'denied', reason?: string): Promise<void>;
+/**
+ * Fetch the per-route policy for an endpoint from the AstraSync backend.
+ * v2.9.7 moved policy authority into the dashboard — the SDK no longer
+ * accepts `routes` from merchant-side source code, it fetches them from
+ * here on init (and refreshes periodically).
+ *
+ * Returns `null` when the request fails for any reason — the caller decides
+ * how to fall back (the middleware allows-all when no policy is loaded so
+ * a misconfigured init doesn't take down the merchant's API).
+ */
+declare function fetchRoutes(config: GatewayConfig, counterpartyId: string): Promise<RouteAccessConfigShape[] | null>;
+/**
+ * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
+ * server's `EndpointRoute` type and the SDK's `RouteAccessConfig` — same
+ * JSON moves between server and SDK unchanged.
+ */
+interface RouteAccessConfigShape {
+    pattern: string;
+    method: string;
+    /** @deprecated 3.2.0 — band no longer gates; optional, ignored. Use minTrustScore. */
+    minAccessLevel?: 'none' | 'restricted' | 'read-only' | 'standard' | 'full' | 'internal';
+    minTrustScore?: number;
+    requiredPurposes?: string[];
+    allowedPurposes?: string[];
+    allowedJurisdictions?: string[];
+    maxDuration?: number;
+    maxTransactionValue?: number;
+    requirePurpose?: boolean;
+    /** Send-mapping (Bug 14, §4.6) — see RouteAccessConfig in types.ts. */
+    purpose?: string;
+    action?: string;
+}
+/**
+ * Verify an agent AND automatically record the grant/deny decision.
+ *
+ * This is the recommended entry point for counterparties that call verify()
+ * directly (e.g. MCP servers) rather than using createMiddleware().
+ * It adds createSession: true, then fire-and-forgets the decision.
+ */
+declare function verifyAndRecord(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Report an unregistered agent attempt (no AstraSync credentials).
+ * Called by SDK adapters when an agent is redirected to /docs/agent-access.
+ * Fire-and-forget — errors are silently swallowed.
+ */
+declare function reportUnregisteredAttempt(config: GatewayConfig, data: {
+    /**
+     * 3.6.0: optional — the backend attributes by counterpartyId first (sent
+     * from config below) and requires at least ONE of counterpartyId/URL.
+     * A null/undefined URL is omitted from the body, not sent as null.
+     */
+    counterpartyUrl?: string;
+    counterpartyType?: string;
+    sourceIp?: string;
+    userAgent?: string;
+    requestPath?: string;
+    requestMethod?: string;
+    /**
+     * 3.9.0 (§33.5 #1) — edge-adapter evidence fields, persisted into the
+     * event's eventData by the backend: `protocol` = detected transport/
+     * credential protocol; `evidence` = light crypto-free detection detail.
+     */
+    protocol?: string;
+    evidence?: Record<string, unknown>;
+}): Promise<void>;
+/**
+ * Report a counterparty-side PDLSS pre-check failure.
+ * Called by SDK adapters when the agent's requested PDLSS exceeds
+ * counterparty-defined maximums BEFORE calling verify-access.
+ * Fire-and-forget — errors are silently swallowed.
+ */
+declare function reportCounterpartyPreCheckFailure(config: GatewayConfig, data: {
+    agentId: string;
+    counterpartyUrl: string;
+    counterpartyType?: string;
+    failures: Array<{
+        field: string;
+        requested: string | number;
+        limit: string | number | string[];
+        message: string;
+    }>;
+    requestPath?: string;
+    requestMethod?: string;
+}): Promise<void>;
+/**
+ * Quick verification — checks credentials and policy in one call.
+ *
+ * Round-18 G4: return shape mirrors `VerificationResult`'s split — partners
+ * writing custom handlers around `quickVerify` get the same identity/policy
+ * distinction as those calling `verify()` directly. Map to HTTP status the
+ * same way: `!identityVerified` → 401; `identityVerified && !policyAllowed`
+ * → 403.
+ */
+declare function quickVerify(config: GatewayConfig, credentials: AgentCredentials): Promise<{
+    identityVerified: boolean;
+    policyAllowed: boolean;
+    accessLevel: AccessLevel;
+    reason?: string;
+}>;
+
+export { type RouteAccessConfigShape, type VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };

package/dist/verify.d.ts

@@ -0,0 +1,144 @@
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, r as VerificationResult } from './types-ACMsV07B.js';
+
+/**
+ * AstraSync Universal Verification Gateway - Core Verification Logic
+ *
+ * This module handles the core verification logic, calling the AstraSync API
+ * and processing the response into a standardized VerificationResult.
+ */
+
+/**
+ * Clear the verification cache
+ */
+declare function clearCache(): void;
+/**
+ * Extract agent credentials from various sources
+ */
+declare function extractCredentials(headers: Record<string, string | string[] | undefined>, query?: Record<string, string | undefined>): AgentCredentials;
+/**
+ * Check if credentials are present
+ */
+declare function hasCredentials(credentials: AgentCredentials): boolean;
+/**
+ * Options for a single verify() call (as opposed to GatewayConfig, which is
+ * per-gateway). Mirrors the Java SDK's `verify(request, bypassCache)`.
+ */
+interface VerifyOptions {
+    /**
+     * Skip the cache READ for this call so the request is guaranteed to reach
+     * the backend (the result is still written to the cache if cacheable).
+     * Used by the step-up hold-and-poll retry: the re-verify after an approval
+     * must hit the server to redeem the single-use approval.
+     */
+    bypassCache?: boolean;
+}
+/**
+ * Main verification function
+ */
+declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Record a counterparty's grant/deny decision for a verification session.
+ * Fire-and-forget — errors are silently swallowed.
+ */
+declare function recordDecision(config: GatewayConfig, sessionId: string, decision: 'granted' | 'denied', reason?: string): Promise<void>;
+/**
+ * Fetch the per-route policy for an endpoint from the AstraSync backend.
+ * v2.9.7 moved policy authority into the dashboard — the SDK no longer
+ * accepts `routes` from merchant-side source code, it fetches them from
+ * here on init (and refreshes periodically).
+ *
+ * Returns `null` when the request fails for any reason — the caller decides
+ * how to fall back (the middleware allows-all when no policy is loaded so
+ * a misconfigured init doesn't take down the merchant's API).
+ */
+declare function fetchRoutes(config: GatewayConfig, counterpartyId: string): Promise<RouteAccessConfigShape[] | null>;
+/**
+ * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
+ * server's `EndpointRoute` type and the SDK's `RouteAccessConfig` — same
+ * JSON moves between server and SDK unchanged.
+ */
+interface RouteAccessConfigShape {
+    pattern: string;
+    method: string;
+    /** @deprecated 3.2.0 — band no longer gates; optional, ignored. Use minTrustScore. */
+    minAccessLevel?: 'none' | 'restricted' | 'read-only' | 'standard' | 'full' | 'internal';
+    minTrustScore?: number;
+    requiredPurposes?: string[];
+    allowedPurposes?: string[];
+    allowedJurisdictions?: string[];
+    maxDuration?: number;
+    maxTransactionValue?: number;
+    requirePurpose?: boolean;
+    /** Send-mapping (Bug 14, §4.6) — see RouteAccessConfig in types.ts. */
+    purpose?: string;
+    action?: string;
+}
+/**
+ * Verify an agent AND automatically record the grant/deny decision.
+ *
+ * This is the recommended entry point for counterparties that call verify()
+ * directly (e.g. MCP servers) rather than using createMiddleware().
+ * It adds createSession: true, then fire-and-forgets the decision.
+ */
+declare function verifyAndRecord(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Report an unregistered agent attempt (no AstraSync credentials).
+ * Called by SDK adapters when an agent is redirected to /docs/agent-access.
+ * Fire-and-forget — errors are silently swallowed.
+ */
+declare function reportUnregisteredAttempt(config: GatewayConfig, data: {
+    /**
+     * 3.6.0: optional — the backend attributes by counterpartyId first (sent
+     * from config below) and requires at least ONE of counterpartyId/URL.
+     * A null/undefined URL is omitted from the body, not sent as null.
+     */
+    counterpartyUrl?: string;
+    counterpartyType?: string;
+    sourceIp?: string;
+    userAgent?: string;
+    requestPath?: string;
+    requestMethod?: string;
+    /**
+     * 3.9.0 (§33.5 #1) — edge-adapter evidence fields, persisted into the
+     * event's eventData by the backend: `protocol` = detected transport/
+     * credential protocol; `evidence` = light crypto-free detection detail.
+     */
+    protocol?: string;
+    evidence?: Record<string, unknown>;
+}): Promise<void>;
+/**
+ * Report a counterparty-side PDLSS pre-check failure.
+ * Called by SDK adapters when the agent's requested PDLSS exceeds
+ * counterparty-defined maximums BEFORE calling verify-access.
+ * Fire-and-forget — errors are silently swallowed.
+ */
+declare function reportCounterpartyPreCheckFailure(config: GatewayConfig, data: {
+    agentId: string;
+    counterpartyUrl: string;
+    counterpartyType?: string;
+    failures: Array<{
+        field: string;
+        requested: string | number;
+        limit: string | number | string[];
+        message: string;
+    }>;
+    requestPath?: string;
+    requestMethod?: string;
+}): Promise<void>;
+/**
+ * Quick verification — checks credentials and policy in one call.
+ *
+ * Round-18 G4: return shape mirrors `VerificationResult`'s split — partners
+ * writing custom handlers around `quickVerify` get the same identity/policy
+ * distinction as those calling `verify()` directly. Map to HTTP status the
+ * same way: `!identityVerified` → 401; `identityVerified && !policyAllowed`
+ * → 403.
+ */
+declare function quickVerify(config: GatewayConfig, credentials: AgentCredentials): Promise<{
+    identityVerified: boolean;
+    policyAllowed: boolean;
+    accessLevel: AccessLevel;
+    reason?: string;
+}>;
+
+export { type RouteAccessConfigShape, type VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, recordDecision, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };