@astrasyncai/verification-gateway 4.2.1 → 4.4.0

package/dist/bin/astrasync-claude-hook.js

@@ -3701,7 +3701,25 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.1.0";
+var SDK_VERSION = "4.4.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -3731,7 +3749,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -3745,7 +3763,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -3958,7 +3976,7 @@ async function callVerifyAccessAPI(config, request) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),

package/dist/bin/astrasync-codex-hook.js

@@ -3700,7 +3700,25 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.1.0";
+var SDK_VERSION = "4.4.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -3730,7 +3748,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -3744,7 +3762,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -3957,7 +3975,7 @@ async function callVerifyAccessAPI(config, request) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),

package/dist/bin/astrasync-guard.js

@@ -3677,6 +3677,27 @@ Policy saved to ${outputPath}`);
   }
 };
 
+// src/version.ts
+var SDK_VERSION = "4.4.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
+
 // src/cli/upgrade.ts
 var UpgradeFlow = class {
   constructor(config, callbacks, trigger) {
@@ -3822,7 +3843,7 @@ var UpgradeFlow = class {
    */
   async validateApiKey(apiKey) {
     try {
-      const response = await fetch(`${this.platformUrl}/api/v1/auth/me`, {
+      const response = await sdkFetch(`${this.platformUrl}/api/v1/auth/me`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (!response.ok) {
@@ -3844,7 +3865,7 @@ var UpgradeFlow = class {
   async uploadPolicy(apiKey) {
     const policyYaml = toYaml(this.config.policy);
     try {
-      const response = await fetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
+      const response = await sdkFetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -4608,9 +4629,6 @@ function getTrustLevel(score) {
   return "BRONZE";
 }
 
-// src/version.ts
-var SDK_VERSION = "4.1.0";
-
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 var cache = /* @__PURE__ */ new Map();
@@ -4639,7 +4657,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -4653,7 +4671,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -4866,7 +4884,7 @@ async function callVerifyAccessAPI(config, request2) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),

package/dist/bin/astrasync.js

@@ -26,6 +26,40 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/version.ts
+var SDK_VERSION;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    SDK_VERSION = "4.4.0";
+  }
+});
+
+// src/http.ts
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var SDK_USER_AGENT, sdkFetch;
+var init_http = __esm({
+  "src/http.ts"() {
+    "use strict";
+    init_version();
+    SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+    sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
+  }
+});
+
 // src/registration/errors.ts
 var AstraSyncError, KYDRequiredError, AuthenticationError, RegistrationDeniedError, RegistrationExpiredError, RegistrationTimeoutError;
 var init_errors = __esm({
@@ -101,6 +135,7 @@ var DEFAULT_BASE_URL, sleep, AstraSync;
 var init_api = __esm({
   "src/registration/api.ts"() {
     "use strict";
+    init_http();
     init_errors();
     DEFAULT_BASE_URL = "https://astrasync.ai";
     sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -222,7 +257,7 @@ var init_api = __esm({
        */
       async pollRegistration(requestId) {
         const url = `${this.baseUrl}/api/agents/request-registration/${requestId}`;
-        const res = await fetch(url, { headers: { Accept: "application/json" } });
+        const res = await sdkFetch(url, { headers: { Accept: "application/json" } });
         if (!res.ok) {
           const errBody = await res.json().catch(() => ({}));
           throw new AstraSyncError(
@@ -279,7 +314,7 @@ var init_api = __esm({
        * Check API health.
        */
       async health() {
-        const res = await fetch(`${this.baseUrl}/api/health/`);
+        const res = await sdkFetch(`${this.baseUrl}/api/health/`);
         if (!res.ok) {
           throw new AstraSyncError(`Health check failed: ${res.status}`, res.status);
         }
@@ -306,7 +341,7 @@ var init_api = __esm({
           const signature = await this.signRequest(method, endpoint, body || {});
           headers["X-AstraSync-Signature"] = signature;
         }
-        const res = await fetch(url, {
+        const res = await sdkFetch(url, {
           method,
           headers,
           ...body ? { body: JSON.stringify(body) } : {}
@@ -331,7 +366,7 @@ var init_api = __esm({
         if (this.cachedJwt && this.jwtExpiresAt && Date.now() < this.jwtExpiresAt) {
           return this.cachedJwt;
         }
-        const res = await fetch(`${this.baseUrl}/api/auth/login`, {
+        const res = await sdkFetch(`${this.baseUrl}/api/auth/login`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({ email: this.email, password: this.password })
@@ -4019,6 +4054,7 @@ var UpgradeFlow;
 var init_upgrade = __esm({
   "src/cli/upgrade.ts"() {
     "use strict";
+    init_http();
     init_pdlss_parser();
     UpgradeFlow = class {
       constructor(config, callbacks, trigger) {
@@ -4164,7 +4200,7 @@ var init_upgrade = __esm({
        */
       async validateApiKey(apiKey) {
         try {
-          const response = await fetch(`${this.platformUrl}/api/v1/auth/me`, {
+          const response = await sdkFetch(`${this.platformUrl}/api/v1/auth/me`, {
             headers: { Authorization: `Bearer ${apiKey}` }
           });
           if (!response.ok) {
@@ -4186,7 +4222,7 @@ var init_upgrade = __esm({
       async uploadPolicy(apiKey) {
         const policyYaml = toYaml(this.config.policy);
         try {
-          const response = await fetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
+          const response = await sdkFetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
             method: "POST",
             headers: {
               "Content-Type": "application/json",
@@ -4995,15 +5031,6 @@ var init_access_levels = __esm({
   }
 });
 
-// src/version.ts
-var SDK_VERSION;
-var init_version = __esm({
-  "src/version.ts"() {
-    "use strict";
-    SDK_VERSION = "4.1.0";
-  }
-});
-
 // src/well-known.ts
 function getCachedWellKnownUrls(apiBaseUrl) {
   return cache.get(apiBaseUrl)?.data;
@@ -5012,6 +5039,7 @@ var CACHE_TTL_MS, cache;
 var init_well_known = __esm({
   "src/well-known.ts"() {
     "use strict";
+    init_http();
     CACHE_TTL_MS = 60 * 60 * 1e3;
     cache = /* @__PURE__ */ new Map();
   }
@@ -5022,7 +5050,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -5036,7 +5064,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -5247,7 +5275,7 @@ async function callVerifyAccessAPI(config, request2) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
@@ -5488,6 +5516,7 @@ var DEFAULT_CONFIG, initCheckPerformed, deprecationWarningShown, verificationCac
 var init_verify = __esm({
   "src/verify.ts"() {
     "use strict";
+    init_http();
     init_access_levels();
     init_version();
     init_well_known();
@@ -5517,6 +5546,7 @@ var FALLBACK_MAX_WAIT_MS;
 var init_stepup_poll = __esm({
   "src/adapters/stepup-poll.ts"() {
     "use strict";
+    init_http();
     FALLBACK_MAX_WAIT_MS = 5 * 60 * 1e3;
   }
 });
@@ -5538,12 +5568,19 @@ var init_settlement = __esm({
 });
 
 // src/transport/http.ts
-var init_http = __esm({
+var init_http2 = __esm({
   "src/transport/http.ts"() {
     "use strict";
   }
 });
 
+// src/verified-hop.ts
+var init_verified_hop = __esm({
+  "src/verified-hop.ts"() {
+    "use strict";
+  }
+});
+
 // src/adapters/http-pdlss.ts
 var init_http_pdlss = __esm({
   "src/adapters/http-pdlss.ts"() {
@@ -5572,6 +5609,7 @@ var DEFAULT_EDGE_CONFIG, DEFAULT_TTL_MS, DEFAULT_MAX_STALE_MS;
 var init_edge_config = __esm({
   "src/edge-config.ts"() {
     "use strict";
+    init_http();
     DEFAULT_EDGE_CONFIG = Object.freeze({
       version: 1,
       mode: "observe",
@@ -5650,7 +5688,8 @@ var init_express = __esm({
     "use strict";
     init_stepup_poll();
     init_verify();
-    init_http();
+    init_http2();
+    init_verified_hop();
     init_http_pdlss();
     init_approval_gate();
     init_pdlss_pre_check();
@@ -5668,12 +5707,13 @@ var init_nextjs = __esm({
     "use strict";
     init_stepup_poll();
     init_verify();
-    init_http();
+    init_http2();
     init_pdlss_pre_check();
     init_metadata_capture();
     init_anonymous_beacon();
     init_http_pdlss();
     init_approval_gate();
+    init_verified_hop();
     DEFAULT_ROUTES_REFRESH_MS2 = 5 * 60 * 1e3;
   }
 });
@@ -5773,6 +5813,7 @@ var init_rfc9421_verify = __esm({
 var init_ucp = __esm({
   "src/transport/ucp.ts"() {
     "use strict";
+    init_http();
     init_purpose_mapping2();
   }
 });
@@ -5941,10 +5982,10 @@ var init_web_bot_auth = __esm({
 var init_transport = __esm({
   "src/transport/index.ts"() {
     "use strict";
-    init_http();
+    init_http2();
     init_a2a();
     init_mcp();
-    init_http();
+    init_http2();
     init_a2a();
     init_mcp();
     init_purpose_mapping2();
@@ -5977,6 +6018,7 @@ var init_transport = __esm({
 var init_mcp_server = __esm({
   "src/transport/mcp-server.ts"() {
     "use strict";
+    init_verified_hop();
   }
 });
 
@@ -6022,6 +6064,7 @@ var init_client = __esm({
   "src/agent/client.ts"() {
     "use strict";
     init_http();
+    init_http2();
     init_a2a();
     init_mcp();
     init_transport();
@@ -6047,6 +6090,7 @@ var init_pdlss_formatter = __esm({
 var init_decision_client = __esm({
   "src/agent/decision-client.ts"() {
     "use strict";
+    init_http();
   }
 });
 
@@ -6062,6 +6106,13 @@ var init_agent = __esm({
   }
 });
 
+// src/runtime-signatures.ts
+var init_runtime_signatures = __esm({
+  "src/runtime-signatures.ts"() {
+    "use strict";
+  }
+});
+
 // src/index.ts
 var init_src = __esm({
   "src/index.ts"() {
@@ -6087,6 +6138,8 @@ var init_src = __esm({
     init_verify();
     init_verify();
     init_metadata_capture();
+    init_runtime_signatures();
+    init_http();
     init_version();
   }
 });

package/dist/browser/background.js

@@ -3938,7 +3938,25 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.1.0";
+var SDK_VERSION = "4.4.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -3968,7 +3986,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -3982,7 +4000,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -4195,7 +4213,7 @@ async function callVerifyAccessAPI(config, request) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),