@astrasyncai/verification-gateway 3.8.0 → 3.10.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,7 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-CSFci5zD.mjs';
-import '../types-DedAJbNI.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-D0lCtFQ7.mjs';
+import '../types-sy3tq8lp.mjs';
+import '../metadata-capture.mjs';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,7 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-D1kyMiml.js';
-import '../types-DedAJbNI.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-YbiXYKx1.js';
+import '../types-9tns4wyl.js';
+import '../metadata-capture.js';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/{index-CXcvO9Au.d.mts → index-BrNKDmiR.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-DedAJbNI.mjs';
+import { c as AstraSyncCredentials, h as ProtocolTransport } from './types-sy3tq8lp.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-CuCkjT7B.d.ts → index-CfHurO1P.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-DedAJbNI.js';
+import { c as AstraSyncCredentials, h as ProtocolTransport, G as GatewayConfig } from './types-9tns4wyl.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-CBQr4FGs.d.ts → index-D2ztkumS.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-DedAJbNI.js';
+import { c as AstraSyncCredentials, h as ProtocolTransport } from './types-9tns4wyl.js';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-DALAqct7.d.mts → index-Dr_XiN65.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-DedAJbNI.mjs';
+import { c as AstraSyncCredentials, h as ProtocolTransport, G as GatewayConfig } from './types-sy3tq8lp.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/index.d.mts

@@ -1,68 +1,20 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, q as VerificationResult, m as StepUpApprovalInfo, o as StepUpOutcome, n as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-DedAJbNI.mjs';
-export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, F as FiatSettlementBinding, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, j as SettlementArtifactBinding, k as SettlementArtifactBindingBase, l as StablecoinSettlementBinding, T as TokenGuidance, p as TrustLevel, r as VerifiedAgent, s as VerifiedDeveloper, t as VerifiedOrganization } from './types-DedAJbNI.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Cn4KcZ5G.mjs';
-export { e as express } from './express-Di_hnZZS.mjs';
-export { n as nextjs } from './nextjs-BMAe8ode.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-CXcvO9Au.mjs';
+import { G as GatewayConfig, n as StepUpApprovalInfo, p as StepUpOutcome, o as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-sy3tq8lp.mjs';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, C as CommerceArtifactsPayload, d as CommerceShieldProps, e as CounterpartyType, f as ExpressMiddlewareOptions, F as FiatSettlementBinding, g as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, h as ProtocolTransport, R as RouteAccessConfig, i as RuntimeChallengeResult, S as SDKOptions, j as SettlementArtifact, k as SettlementArtifactBinding, l as SettlementArtifactBindingBase, m as StablecoinSettlementBinding, T as TokenGuidance, q as TrustLevel, V as VerificationRequest, r as VerificationResult, s as VerifiedAgent, t as VerifiedDeveloper, u as VerifiedOrganization } from './types-sy3tq8lp.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CZkbSOeO.mjs';
+export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportUnregisteredAttempt, verify } from './verify.mjs';
+export { e as express } from './express-DCXa1oqj.mjs';
+export { n as nextjs } from './nextjs-DcQIk6Zj.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-BrNKDmiR.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DALAqct7.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-Dr_XiN65.mjs';
+export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
+export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.mjs';
+export { MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.mjs';
 import 'express';
 import 'next/server';
 import 'jose';
 
-/**
- * AstraSync Universal Verification Gateway - Core Verification Logic
- *
- * This module handles the core verification logic, calling the AstraSync API
- * and processing the response into a standardized VerificationResult.
- */
-
-/**
- * Clear the verification cache
- */
-declare function clearCache(): void;
-/**
- * Extract agent credentials from various sources
- */
-declare function extractCredentials(headers: Record<string, string | string[] | undefined>, query?: Record<string, string | undefined>): AgentCredentials;
-/**
- * Check if credentials are present
- */
-declare function hasCredentials(credentials: AgentCredentials): boolean;
-/**
- * Options for a single verify() call (as opposed to GatewayConfig, which is
- * per-gateway). Mirrors the Java SDK's `verify(request, bypassCache)`.
- */
-interface VerifyOptions {
-    /**
-     * Skip the cache READ for this call so the request is guaranteed to reach
-     * the backend (the result is still written to the cache if cacheable).
-     * Used by the step-up hold-and-poll retry: the re-verify after an approval
-     * must hit the server to redeem the single-use approval.
-     */
-    bypassCache?: boolean;
-}
-/**
- * Main verification function
- */
-declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
-/**
- * Quick verification — checks credentials and policy in one call.
- *
- * Round-18 G4: return shape mirrors `VerificationResult`'s split — partners
- * writing custom handlers around `quickVerify` get the same identity/policy
- * distinction as those calling `verify()` directly. Map to HTTP status the
- * same way: `!identityVerified` → 401; `identityVerified && !policyAllowed`
- * → 403.
- */
-declare function quickVerify(config: GatewayConfig, credentials: AgentCredentials): Promise<{
-    identityVerified: boolean;
-    policyAllowed: boolean;
-    accessLevel: AccessLevel;
-    reason?: string;
-}>;
-
 /**
  * Step-up hold-and-poll (3.6.0) — the synchronous half of the MFA-style gate,
  * mirroring the Java SDK's `awaitStepUpApproval` / `pollStepUpStatus`.
@@ -176,30 +128,23 @@ declare function getWellKnownUrls(apiBaseUrl: string): Promise<WellKnownAgenticC
 declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCommerce | undefined;
 
 /**
- * AstraSync Universal Verification Gateway
- *
- * A single verification library for any system to verify AI agents.
- * One codebase, multiple deployment targets.
- *
- * @example
- * ```typescript
- * import { verify, extractCredentials } from '@astrasyncai/verification-gateway';
+ * Round-13 (F14 closure / R13-7): single source-of-truth for the SDK's
+ * package version emitted on verify-access bodies (and any future
+ * telemetry). Bumped alongside `package.json#version` on every release.
  *
- * const credentials = extractCredentials(request.headers);
- * const result = await verify(config, { credentials, purpose: 'data-access' });
+ * Why a constant rather than `import pkg from '../package.json'`:
+ * - `tsconfig.json` sets `rootDir: ./src`; importing the sibling
+ *   package.json fails the build with "outside rootDir".
+ * - Build-time string replacement (tsup `define`, esbuild banner, etc.)
+ *   adds toolchain coupling for a trivial gain.
+ * - Embedded readonly constant works in every environment (Node, browser,
+ *   bundlers, Deno) without runtime fs / network access.
  *
- * if (result.identityVerified && result.policyAllowed && result.accessLevel !== 'none') {
- *   // Grant access based on result.accessLevel
- * }
- *
- * // Or map to HTTP status codes directly:
- * if (!result.identityVerified) return res.status(401).json({ ... });   // re-auth
- * if (!result.policyAllowed)    return res.status(403).json({ ... });   // step up / update PDLSS
- * ```
- *
- * @packageDocumentation
+ * Release discipline: a CI lint can grep `package.json#version` against
+ * this constant if the two ever diverge in the wild. Round-13 manual bump
+ * is fine — bumping both in the release-ceremony commit keeps them
+ * lockstep.
  */
+declare const SDK_VERSION = "3.10.0";
 
-declare const VERSION = "3.4.0";
-
-export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, VERSION, VerificationRequest, VerificationResult, type VerifyOptions, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, pollStepUpStatus, prefetchWellKnown, quickVerify, verify };
+export { EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown };

package/dist/index.d.ts

@@ -1,68 +1,20 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, q as VerificationResult, m as StepUpApprovalInfo, o as StepUpOutcome, n as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-DedAJbNI.js';
-export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, F as FiatSettlementBinding, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, j as SettlementArtifactBinding, k as SettlementArtifactBindingBase, l as StablecoinSettlementBinding, T as TokenGuidance, p as TrustLevel, r as VerifiedAgent, s as VerifiedDeveloper, t as VerifiedOrganization } from './types-DedAJbNI.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-ThdA_NtL.js';
-export { e as express } from './express-C8nJGi5P.js';
-export { n as nextjs } from './nextjs-IyXWW2KL.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-CBQr4FGs.js';
+import { G as GatewayConfig, n as StepUpApprovalInfo, p as StepUpOutcome, o as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-9tns4wyl.js';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, C as CommerceArtifactsPayload, d as CommerceShieldProps, e as CounterpartyType, f as ExpressMiddlewareOptions, F as FiatSettlementBinding, g as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, h as ProtocolTransport, R as RouteAccessConfig, i as RuntimeChallengeResult, S as SDKOptions, j as SettlementArtifact, k as SettlementArtifactBinding, l as SettlementArtifactBindingBase, m as StablecoinSettlementBinding, T as TokenGuidance, q as TrustLevel, V as VerificationRequest, r as VerificationResult, s as VerifiedAgent, t as VerifiedDeveloper, u as VerifiedOrganization } from './types-9tns4wyl.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-H0JCLW2y.js';
+export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportUnregisteredAttempt, verify } from './verify.js';
+export { e as express } from './express-ClNtDhhc.js';
+export { n as nextjs } from './nextjs-CEBVBsdi.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-D2ztkumS.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CuCkjT7B.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CfHurO1P.js';
+export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
+export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.js';
+export { MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.js';
 import 'express';
 import 'next/server';
 import 'jose';
 
-/**
- * AstraSync Universal Verification Gateway - Core Verification Logic
- *
- * This module handles the core verification logic, calling the AstraSync API
- * and processing the response into a standardized VerificationResult.
- */
-
-/**
- * Clear the verification cache
- */
-declare function clearCache(): void;
-/**
- * Extract agent credentials from various sources
- */
-declare function extractCredentials(headers: Record<string, string | string[] | undefined>, query?: Record<string, string | undefined>): AgentCredentials;
-/**
- * Check if credentials are present
- */
-declare function hasCredentials(credentials: AgentCredentials): boolean;
-/**
- * Options for a single verify() call (as opposed to GatewayConfig, which is
- * per-gateway). Mirrors the Java SDK's `verify(request, bypassCache)`.
- */
-interface VerifyOptions {
-    /**
-     * Skip the cache READ for this call so the request is guaranteed to reach
-     * the backend (the result is still written to the cache if cacheable).
-     * Used by the step-up hold-and-poll retry: the re-verify after an approval
-     * must hit the server to redeem the single-use approval.
-     */
-    bypassCache?: boolean;
-}
-/**
- * Main verification function
- */
-declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
-/**
- * Quick verification — checks credentials and policy in one call.
- *
- * Round-18 G4: return shape mirrors `VerificationResult`'s split — partners
- * writing custom handlers around `quickVerify` get the same identity/policy
- * distinction as those calling `verify()` directly. Map to HTTP status the
- * same way: `!identityVerified` → 401; `identityVerified && !policyAllowed`
- * → 403.
- */
-declare function quickVerify(config: GatewayConfig, credentials: AgentCredentials): Promise<{
-    identityVerified: boolean;
-    policyAllowed: boolean;
-    accessLevel: AccessLevel;
-    reason?: string;
-}>;
-
 /**
  * Step-up hold-and-poll (3.6.0) — the synchronous half of the MFA-style gate,
  * mirroring the Java SDK's `awaitStepUpApproval` / `pollStepUpStatus`.
@@ -176,30 +128,23 @@ declare function getWellKnownUrls(apiBaseUrl: string): Promise<WellKnownAgenticC
 declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCommerce | undefined;
 
 /**
- * AstraSync Universal Verification Gateway
- *
- * A single verification library for any system to verify AI agents.
- * One codebase, multiple deployment targets.
- *
- * @example
- * ```typescript
- * import { verify, extractCredentials } from '@astrasyncai/verification-gateway';
+ * Round-13 (F14 closure / R13-7): single source-of-truth for the SDK's
+ * package version emitted on verify-access bodies (and any future
+ * telemetry). Bumped alongside `package.json#version` on every release.
  *
- * const credentials = extractCredentials(request.headers);
- * const result = await verify(config, { credentials, purpose: 'data-access' });
+ * Why a constant rather than `import pkg from '../package.json'`:
+ * - `tsconfig.json` sets `rootDir: ./src`; importing the sibling
+ *   package.json fails the build with "outside rootDir".
+ * - Build-time string replacement (tsup `define`, esbuild banner, etc.)
+ *   adds toolchain coupling for a trivial gain.
+ * - Embedded readonly constant works in every environment (Node, browser,
+ *   bundlers, Deno) without runtime fs / network access.
  *
- * if (result.identityVerified && result.policyAllowed && result.accessLevel !== 'none') {
- *   // Grant access based on result.accessLevel
- * }
- *
- * // Or map to HTTP status codes directly:
- * if (!result.identityVerified) return res.status(401).json({ ... });   // re-auth
- * if (!result.policyAllowed)    return res.status(403).json({ ... });   // step up / update PDLSS
- * ```
- *
- * @packageDocumentation
+ * Release discipline: a CI lint can grep `package.json#version` against
+ * this constant if the two ever diverge in the wild. Round-13 manual bump
+ * is fine — bumping both in the release-ceremony commit keeps them
+ * lockstep.
  */
+declare const SDK_VERSION = "3.10.0";
 
-declare const VERSION = "3.4.0";
-
-export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, VERSION, VerificationRequest, VerificationResult, type VerifyOptions, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, pollStepUpStatus, prefetchWellKnown, quickVerify, verify };
+export { EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown };