@astrasyncai/verification-gateway 4.2.0 → 4.3.0

package/dist/edge-config.d.mts

@@ -1,4 +1,4 @@
-import { G as GatewayConfig } from './types-r850cOt0.mjs';
+import { G as GatewayConfig } from './types-C0zfSXMB.mjs';
 import './metadata-capture.mjs';
 
 /**

package/dist/edge-config.d.ts

@@ -1,4 +1,4 @@
-import { G as GatewayConfig } from './types-sMxBT-nM.js';
+import { G as GatewayConfig } from './types-DwSfO7Sb.js';
 import './metadata-capture.js';
 
 /**

package/dist/edge-core/index.d.mts

@@ -1,6 +1,6 @@
 import { EdgeMode, EdgeVerificationDepth, EdgeConfig } from '../edge-config.mjs';
 import { PlatformFingerprint } from '../platform-signatures.mjs';
-import { f as CommerceArtifactsPayload, w as VerificationRequest } from '../types-r850cOt0.mjs';
+import { f as CommerceArtifactsPayload, w as VerificationRequest } from '../types-C0zfSXMB.mjs';
 import { verify } from '../verify.mjs';
 import { ObservedMetadata } from '../metadata-capture.mjs';
 

package/dist/edge-core/index.d.ts

@@ -1,6 +1,6 @@
 import { EdgeMode, EdgeVerificationDepth, EdgeConfig } from '../edge-config.js';
 import { PlatformFingerprint } from '../platform-signatures.js';
-import { f as CommerceArtifactsPayload, w as VerificationRequest } from '../types-sMxBT-nM.js';
+import { f as CommerceArtifactsPayload, w as VerificationRequest } from '../types-DwSfO7Sb.js';
 import { verify } from '../verify.js';
 import { ObservedMetadata } from '../metadata-capture.js';
 

package/dist/edge-core/index.js

@@ -74,7 +74,9 @@ var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-astrasync-signature",
   "x-astrasync-secret",
   "x-hub-signature",
-  "x-hub-signature-256"
+  "x-hub-signature-256",
+  // Short-lived verify dedupe token — must never persist in stored metadata.
+  "x-astra-verified-hop"
 ]);
 var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
 var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
@@ -1098,6 +1100,12 @@ function buildManualReviewBody(outcome) {
   };
 }
 
+// src/verified-hop.ts
+var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
+function serializeVerifiedHop(marker) {
+  return `${marker.astraId};${marker.sessionId ?? ""};${marker.checkedAt}`;
+}
+
 // src/edge-core/enforce.ts
 var ASAT_HEADERS = {
   trustScore: "X-AstraSync-Trust-Score",
@@ -1106,6 +1114,7 @@ var ASAT_HEADERS = {
   permissions: "X-AstraSync-Permissions",
   observedDecision: "X-AstraSync-Observed-Decision"
 };
+var STRIP_HEADER_PREFIXES = ["x-astrasync-", "x-astra-verified-hop"];
 function passUntouched() {
   return { action: "pass", injectHeaders: {}, stripHeaderPrefixes: [] };
 }
@@ -1118,8 +1127,8 @@ function applyOutcome(options, outcome, policy) {
     if (outcome.decision !== "allow") {
       injectHeaders[ASAT_HEADERS.observedDecision] = outcome.decision;
     }
-    Object.assign(injectHeaders, asatHeaders(outcome));
-    return { action: "pass", injectHeaders, stripHeaderPrefixes: ["x-astrasync-"] };
+    Object.assign(injectHeaders, asatHeaders(outcome), verifiedHopHeader(outcome));
+    return { action: "pass", injectHeaders, stripHeaderPrefixes: STRIP_HEADER_PREFIXES };
   }
   switch (outcome.decision) {
     case "deny":
@@ -1137,8 +1146,8 @@ function applyOutcome(options, outcome, policy) {
         bodyJson: buildManualReviewBody(outcome)
       };
     default:
-      Object.assign(injectHeaders, asatHeaders(outcome));
-      return { action: "pass", injectHeaders, stripHeaderPrefixes: ["x-astrasync-"] };
+      Object.assign(injectHeaders, asatHeaders(outcome), verifiedHopHeader(outcome));
+      return { action: "pass", injectHeaders, stripHeaderPrefixes: STRIP_HEADER_PREFIXES };
   }
 }
 function asatHeaders(outcome) {
@@ -1151,6 +1160,17 @@ function asatHeaders(outcome) {
     ...accessLevel && { [ASAT_HEADERS.permissions]: accessLevel }
   };
 }
+function verifiedHopHeader(outcome) {
+  const agentId = outcome.asat?.agentId;
+  if (!agentId) return {};
+  return {
+    [MCP_VERIFIED_HOP_HEADER]: serializeVerifiedHop({
+      astraId: agentId,
+      ...outcome.sessionId && { sessionId: outcome.sessionId },
+      checkedAt: Date.now()
+    })
+  };
+}
 
 // src/adapters/http-pdlss.ts
 var HTTP_METHOD_ACTION_TABLE = {