@astrasyncai/verification-gateway 4.2.0 → 4.3.0

package/dist/edge-core/index.mjs

@@ -30,7 +30,9 @@ var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-astrasync-signature",
   "x-astrasync-secret",
   "x-hub-signature",
-  "x-hub-signature-256"
+  "x-hub-signature-256",
+  // Short-lived verify dedupe token — must never persist in stored metadata.
+  "x-astra-verified-hop"
 ]);
 var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
 var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
@@ -1054,6 +1056,12 @@ function buildManualReviewBody(outcome) {
   };
 }
 
+// src/verified-hop.ts
+var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
+function serializeVerifiedHop(marker) {
+  return `${marker.astraId};${marker.sessionId ?? ""};${marker.checkedAt}`;
+}
+
 // src/edge-core/enforce.ts
 var ASAT_HEADERS = {
   trustScore: "X-AstraSync-Trust-Score",
@@ -1062,6 +1070,7 @@ var ASAT_HEADERS = {
   permissions: "X-AstraSync-Permissions",
   observedDecision: "X-AstraSync-Observed-Decision"
 };
+var STRIP_HEADER_PREFIXES = ["x-astrasync-", "x-astra-verified-hop"];
 function passUntouched() {
   return { action: "pass", injectHeaders: {}, stripHeaderPrefixes: [] };
 }
@@ -1074,8 +1083,8 @@ function applyOutcome(options, outcome, policy) {
     if (outcome.decision !== "allow") {
       injectHeaders[ASAT_HEADERS.observedDecision] = outcome.decision;
     }
-    Object.assign(injectHeaders, asatHeaders(outcome));
-    return { action: "pass", injectHeaders, stripHeaderPrefixes: ["x-astrasync-"] };
+    Object.assign(injectHeaders, asatHeaders(outcome), verifiedHopHeader(outcome));
+    return { action: "pass", injectHeaders, stripHeaderPrefixes: STRIP_HEADER_PREFIXES };
   }
   switch (outcome.decision) {
     case "deny":
@@ -1093,8 +1102,8 @@ function applyOutcome(options, outcome, policy) {
         bodyJson: buildManualReviewBody(outcome)
       };
     default:
-      Object.assign(injectHeaders, asatHeaders(outcome));
-      return { action: "pass", injectHeaders, stripHeaderPrefixes: ["x-astrasync-"] };
+      Object.assign(injectHeaders, asatHeaders(outcome), verifiedHopHeader(outcome));
+      return { action: "pass", injectHeaders, stripHeaderPrefixes: STRIP_HEADER_PREFIXES };
   }
 }
 function asatHeaders(outcome) {
@@ -1107,6 +1116,17 @@ function asatHeaders(outcome) {
     ...accessLevel && { [ASAT_HEADERS.permissions]: accessLevel }
   };
 }
+function verifiedHopHeader(outcome) {
+  const agentId = outcome.asat?.agentId;
+  if (!agentId) return {};
+  return {
+    [MCP_VERIFIED_HOP_HEADER]: serializeVerifiedHop({
+      astraId: agentId,
+      ...outcome.sessionId && { sessionId: outcome.sessionId },
+      checkedAt: Date.now()
+    })
+  };
+}
 
 // src/adapters/http-pdlss.ts
 var HTTP_METHOD_ACTION_TABLE = {