@astrasyncai/verification-gateway 4.2.0 → 4.3.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-DqfPU5Bl.mjs';
-import '../types-r850cOt0.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-C7Rb-w0d.mjs';
+import '../types-C0zfSXMB.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-BLUx92FJ.js';
-import '../types-sMxBT-nM.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-nIh3HtuA.js';
+import '../types-DwSfO7Sb.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{index-B0YHu_SP.d.ts → index-B5Ts1WtM.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-sMxBT-nM.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-DwSfO7Sb.js';
 import { JWK } from 'jose';
 
 /**
@@ -628,7 +628,7 @@ declare const claim: {
  *   - payment_mandate — authorizes the actual payment rail
  *
  * Mandates are cross-referenced via ids; each is an SD-JWT over ES256 (or
- * equivalent). We decode via @sd-jwt/decode and extract the AP2-specific
+ * equivalent). We decode via @sd-jwt/core and extract the AP2-specific
  * shape — verification lives in ap2-verify.ts.
  */
 
@@ -1024,7 +1024,7 @@ declare function extractX402Context(message: {
  * AstraSync-specific composition logic — that's the whitespace here.
  *
  * This module does NOT re-verify selective-disclosure hashes (the extractor
- * already applied them via @sd-jwt/decode). It DOES verify:
+ * already applied them via @sd-jwt/core). It DOES verify:
  *  - cnf.jwk in L1 payload points to L2's signing key (thumbprint match)
  *  - cnf.jwk in L2 payload points to L3's signing key
  *  - L3a.transaction_id === L3b.transaction_id (when both present)

package/dist/{index-T1aBoUcc.d.ts → index-BfIxCYIZ.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-sMxBT-nM.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-DwSfO7Sb.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-BPEBlOsE.d.mts → index-Cub7lK-T.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-r850cOt0.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-C0zfSXMB.mjs';
 import { JWK } from 'jose';
 
 /**
@@ -628,7 +628,7 @@ declare const claim: {
  *   - payment_mandate — authorizes the actual payment rail
  *
  * Mandates are cross-referenced via ids; each is an SD-JWT over ES256 (or
- * equivalent). We decode via @sd-jwt/decode and extract the AP2-specific
+ * equivalent). We decode via @sd-jwt/core and extract the AP2-specific
  * shape — verification lives in ap2-verify.ts.
  */
 
@@ -1024,7 +1024,7 @@ declare function extractX402Context(message: {
  * AstraSync-specific composition logic — that's the whitespace here.
  *
  * This module does NOT re-verify selective-disclosure hashes (the extractor
- * already applied them via @sd-jwt/decode). It DOES verify:
+ * already applied them via @sd-jwt/core). It DOES verify:
  *  - cnf.jwk in L1 payload points to L2's signing key (thumbprint match)
  *  - cnf.jwk in L2 payload points to L3's signing key
  *  - L3a.transaction_id === L3b.transaction_id (when both present)

package/dist/{index-DQb5-_1X.d.mts → index-CwAh7Tln.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-r850cOt0.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-C0zfSXMB.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-r850cOt0.mjs';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-r850cOt0.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CbTNIkAa.mjs';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-C0zfSXMB.mjs';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-C0zfSXMB.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Bbh9B_dw.mjs';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.mjs';
-export { e as express } from './express-D_4hTn5Z.mjs';
-export { n as nextjs } from './nextjs-WyeVr2Kp.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-BPEBlOsE.mjs';
+export { e as express } from './express-CR6F3njD.mjs';
+export { n as nextjs } from './nextjs-DlX6xwbU.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-Cub7lK-T.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DQb5-_1X.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CwAh7Tln.mjs';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.mjs';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.mjs';

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-sMxBT-nM.js';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-sMxBT-nM.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-QeX0Z8Ho.js';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-DwSfO7Sb.js';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-DwSfO7Sb.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-C6SASmsh.js';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.js';
-export { e as express } from './express-BVd1_3FE.js';
-export { n as nextjs } from './nextjs-w7RTbP1P.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-B0YHu_SP.js';
+export { e as express } from './express-DaqL11tx.js';
+export { n as nextjs } from './nextjs-DL6uE1ye.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-B5Ts1WtM.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-T1aBoUcc.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BfIxCYIZ.js';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.js';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.js';

package/dist/index.js

@@ -1087,6 +1087,34 @@ function extractHttpCredentials(headers) {
   return credentials;
 }
 
+// src/verified-hop.ts
+var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
+var MCP_VERIFIED_HOP_MAX_AGE_MS = 6e4;
+function serializeVerifiedHop(marker) {
+  return `${marker.astraId};${marker.sessionId ?? ""};${marker.checkedAt}`;
+}
+function parseVerifiedHop(value) {
+  if (!value) return null;
+  const parts = value.split(";");
+  if (parts.length !== 3) return null;
+  const [astraId, sessionId, checkedAtRaw] = parts;
+  if (!astraId) return null;
+  const checkedAt = Number(checkedAtRaw);
+  if (!Number.isFinite(checkedAt) || checkedAt <= 0) return null;
+  return {
+    astraId,
+    ...sessionId ? { sessionId } : {},
+    checkedAt
+  };
+}
+function isVerifiedHopValidFor(marker, expectedAstraId, opts = {}) {
+  if (!marker) return false;
+  if (marker.astraId !== expectedAstraId) return false;
+  const maxAge = opts.maxAgeMs ?? MCP_VERIFIED_HOP_MAX_AGE_MS;
+  const now = opts.now ?? Date.now();
+  return now - marker.checkedAt <= maxAge && now >= marker.checkedAt;
+}
+
 // src/adapters/http-pdlss.ts
 var HTTP_METHOD_ACTION_TABLE = {
   GET: "data.read",
@@ -1224,7 +1252,9 @@ var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-astrasync-signature",
   "x-astrasync-secret",
   "x-hub-signature",
-  "x-hub-signature-256"
+  "x-hub-signature-256",
+  // Short-lived verify dedupe token — must never persist in stored metadata.
+  "x-astra-verified-hop"
 ]);
 var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
 var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
@@ -1367,16 +1397,25 @@ var CONNECTION_HEADER_SOURCES = [
     ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
   ],
   ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
+  ["countryRegionName", ["cloudfront-viewer-country-region-name"]],
   ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
   ["asn", ["cloudfront-viewer-asn"]],
   ["tlsVersion", ["cloudfront-viewer-tls"]],
   ["httpVersion", ["cloudfront-viewer-http-version"]],
+  ["timeZone", ["x-vercel-ip-timezone", "cloudfront-viewer-time-zone"]],
+  ["metroCode", ["cloudfront-viewer-metro-code"]],
   // TLS fingerprints can only be computed where TLS terminates. When a CDN
   // terminates TLS in front of the merchant, its fingerprint headers ARE the
   // connection-layer truth — normalising them here is the permanent design.
-  ["tlsFingerprint", ["cf-ja3-hash"]],
-  ["ja4", ["cf-ja4"]]
+  // CloudFront delivers JA3/JA4 only via an origin request policy and only
+  // for HTTPS viewer connections.
+  ["tlsFingerprint", ["cf-ja3-hash", "cloudfront-viewer-ja3-fingerprint"]],
+  ["ja4", ["cf-ja4", "cloudfront-viewer-ja4-fingerprint"]],
+  // Header-structure fingerprint: browser/SDK-distinctive header ordering.
+  ["headerOrder", ["cloudfront-viewer-header-order"]],
+  ["headerCount", ["cloudfront-viewer-header-count"]]
 ];
+var MAX_CONNECTION_VALUE_CHARS = 256;
 function deriveConnectionFromHeaders(headers) {
   if (!headers) return void 0;
   const lower = {};
@@ -1389,11 +1428,15 @@ function deriveConnectionFromHeaders(headers) {
     for (const source of sources) {
       const value = lower[source]?.trim();
       if (value) {
-        connection[key] = value;
+        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);
         break;
       }
     }
   }
+  if (!connection.ip) {
+    const addr = lower["cloudfront-viewer-address"]?.trim();
+    if (addr) connection.ip = addr.replace(/:\d+$/, "");
+  }
   if (!connection.ip) {
     const xff = lower["x-forwarded-for"];
     const client = xff?.split(",")[0]?.trim();
@@ -1848,6 +1891,8 @@ function createMiddleware(options) {
     failOnError = "open",
     caseInsensitiveRouteMatch = false,
     anonymousBeacon = true,
+    trustVerifiedHop = false,
+    verifiedHopMaxAgeMs,
     ...config
   } = options;
   if (config.apiBaseUrl) {
@@ -1940,6 +1985,16 @@ function createMiddleware(options) {
         beaconPassThrough?.(req);
         return next();
       }
+      if (trustVerifiedHop && credentials.astraId) {
+        const hopRaw = req.headers[MCP_VERIFIED_HOP_HEADER.toLowerCase()];
+        const hopValue = typeof hopRaw === "string" ? hopRaw : Array.isArray(hopRaw) ? hopRaw[0] : void 0;
+        const marker = parseVerifiedHop(hopValue);
+        if (isVerifiedHopValidFor(marker, credentials.astraId, {
+          ...verifiedHopMaxAgeMs !== void 0 ? { maxAgeMs: verifiedHopMaxAgeMs } : {}
+        })) {
+          return next();
+        }
+      }
       const pdlssPair = resolveRequestPdlss(
         req,
         routeConfig,
@@ -2395,6 +2450,8 @@ function createMiddleware2(options) {
     enableRuntimeChallenge = true,
     routesRefreshMs = DEFAULT_ROUTES_REFRESH_MS2,
     anonymousBeacon = true,
+    trustVerifiedHop = false,
+    verifiedHopMaxAgeMs,
     ...config
   } = options;
   const interstitialEnabled = showInterstitial ?? showCommerceShield ?? true;
@@ -2457,6 +2514,14 @@ function createMiddleware2(options) {
       return NextResponse.next();
     }
     const credentials = extractCredentialsFromNextRequest(request);
+    if (trustVerifiedHop && credentials.astraId) {
+      const marker = parseVerifiedHop(request.headers.get(MCP_VERIFIED_HOP_HEADER) ?? void 0);
+      if (isVerifiedHopValidFor(marker, credentials.astraId, {
+        ...verifiedHopMaxAgeMs !== void 0 ? { maxAgeMs: verifiedHopMaxAgeMs } : {}
+      })) {
+        return NextResponse.next();
+      }
+    }
     const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;
     const pdlssPair = resolveNextPdlss(request, routeConfig);
     const purpose = pdlssPair.purpose;
@@ -3564,13 +3629,13 @@ function coerceString3(v) {
 }
 
 // src/transport/vi.ts
-var import_decode = require("@sd-jwt/decode");
+var import_core = require("@sd-jwt/core");
 var import_node_crypto = require("crypto");
 function extractVIClaims(sdJwtCompact) {
   if (!sdJwtCompact || typeof sdJwtCompact !== "string") return null;
   let decoded;
   try {
-    decoded = (0, import_decode.decodeSdJwtSync)(sdJwtCompact, sha256Sync);
+    decoded = (0, import_core.decodeSdJwtSync)(sdJwtCompact, sha256Sync);
   } catch {
     return null;
   }
@@ -3610,7 +3675,7 @@ function extractVIClaims(sdJwtCompact) {
 }
 function safeSplit(compact) {
   try {
-    const { jwt, kbJwt } = (0, import_decode.splitSdJwt)(compact);
+    const { jwt, kbJwt } = (0, import_core.splitSdJwt)(compact);
     return { l3: jwt, l2: kbJwt };
   } catch {
     return {};
@@ -3957,13 +4022,13 @@ var claim = {
 };
 
 // src/transport/ap2.ts
-var import_decode2 = require("@sd-jwt/decode");
+var import_core2 = require("@sd-jwt/core");
 var import_node_crypto3 = require("crypto");
 function extractAP2Mandate(sdJwtCompact) {
   if (!sdJwtCompact || typeof sdJwtCompact !== "string") return null;
   let decoded;
   try {
-    decoded = (0, import_decode2.decodeSdJwtSync)(sdJwtCompact, sha256Sync2);
+    decoded = (0, import_core2.decodeSdJwtSync)(sdJwtCompact, sha256Sync2);
   } catch {
     return null;
   }
@@ -5345,32 +5410,6 @@ function extractCredentialsFromProtocol(protocol, context) {
 }
 
 // src/transport/mcp-server.ts
-var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
-var MCP_VERIFIED_HOP_MAX_AGE_MS = 6e4;
-function serializeVerifiedHop(marker) {
-  return `${marker.astraId};${marker.sessionId ?? ""};${marker.checkedAt}`;
-}
-function parseVerifiedHop(value) {
-  if (!value) return null;
-  const parts = value.split(";");
-  if (parts.length !== 3) return null;
-  const [astraId, sessionId, checkedAtRaw] = parts;
-  if (!astraId) return null;
-  const checkedAt = Number(checkedAtRaw);
-  if (!Number.isFinite(checkedAt) || checkedAt <= 0) return null;
-  return {
-    astraId,
-    ...sessionId ? { sessionId } : {},
-    checkedAt
-  };
-}
-function isVerifiedHopValidFor(marker, expectedAstraId, opts = {}) {
-  if (!marker) return false;
-  if (marker.astraId !== expectedAstraId) return false;
-  const maxAge = opts.maxAgeMs ?? MCP_VERIFIED_HOP_MAX_AGE_MS;
-  const now = opts.now ?? Date.now();
-  return now - marker.checkedAt <= maxAge && now >= marker.checkedAt;
-}
 function parseMcpJsonRpc(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const obj = body;