@astrasyncai/verification-gateway 4.2.1 → 4.4.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-DqfPU5Bl.mjs';
-import '../types-r850cOt0.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-C7Rb-w0d.mjs';
+import '../types-C0zfSXMB.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-BLUx92FJ.js';
-import '../types-sMxBT-nM.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-nIh3HtuA.js';
+import '../types-DwSfO7Sb.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{index-BqHKlLOU.d.ts → index-B5Ts1WtM.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-sMxBT-nM.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-DwSfO7Sb.js';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-T1aBoUcc.d.ts → index-BfIxCYIZ.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-sMxBT-nM.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-DwSfO7Sb.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-BTeQ9fgV.d.mts → index-Cub7lK-T.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-r850cOt0.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-C0zfSXMB.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-DQb5-_1X.d.mts → index-CwAh7Tln.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-r850cOt0.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-C0zfSXMB.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-r850cOt0.mjs';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-r850cOt0.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CbTNIkAa.mjs';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-C0zfSXMB.mjs';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-C0zfSXMB.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Bbh9B_dw.mjs';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.mjs';
-export { e as express } from './express-D_4hTn5Z.mjs';
-export { n as nextjs } from './nextjs-WyeVr2Kp.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-BTeQ9fgV.mjs';
+export { e as express } from './express-CR6F3njD.mjs';
+export { n as nextjs } from './nextjs-DlX6xwbU.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-Cub7lK-T.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DQb5-_1X.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CwAh7Tln.mjs';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.mjs';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.mjs';
@@ -127,6 +127,55 @@ declare function getWellKnownUrls(apiBaseUrl: string): Promise<WellKnownAgenticC
  */
 declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCommerce | undefined;
 
+/**
+ * HTTP-client RUNTIME signatures — a display-only vocabulary, disjoint from
+ * the platform-agent vendor vocabulary in `platform-signatures.ts`.
+ *
+ * A UA of `node` or `python-requests` identifies the HTTP STACK, never the
+ * operator: OpenAI Codex, Claude Code, Perplexity's tooling, and our own SDK
+ * all fetch through Node — labeling any of them a vendor from the runtime
+ * alone would be fabrication. What we CAN say honestly is "undeclared
+ * automation on the Node.js runtime", which beats "unknown" in every surface.
+ *
+ * HARD RULE: this module must NEVER be consulted by `edge-core/classify.ts`,
+ * `detectPlatformFingerprint`, or any tiering / orphan-provisioning path.
+ * Runtime matches carry no identity: promoting them to the `identified` tier
+ * would flip anonymous-bot traffic to 1:1 beacons and auto-provision orphan
+ * agents literally named "node". Display and clustering layers only.
+ */
+interface RuntimeSignature {
+    /** Stable runtime key — namespace disjoint from `PlatformAgentVendor`. */
+    runtime: string;
+    /** Human-readable label, e.g. "Node.js runtime". */
+    displayName: string;
+    uaPatterns: RegExp[];
+}
+/** First match wins — order more-specific tokens before generic ones. */
+declare const RUNTIME_SIGNATURES: ReadonlyArray<RuntimeSignature>;
+/**
+ * Detect the HTTP-client runtime from a User-Agent. Returns the displayName
+ * (e.g. "Node.js runtime") or undefined when the UA doesn't look like a bare
+ * runtime/library client.
+ */
+declare function detectRuntime(userAgent: string | undefined | null): string | undefined;
+
+/**
+ * Shared outbound-HTTP wrapper — every request the SDK makes to the
+ * AstraSync backend (or anywhere else) goes through `sdkFetch` so it
+ * carries an identifying User-Agent.
+ *
+ * Why: Node's global fetch defaults to `user-agent: node`, which is
+ * indistinguishable from every other Node client on the wire. Visit
+ * Intelligence observed our own SDK/beacon traffic as anonymous "node"
+ * visits. Self-identification is the platform's own medicine.
+ *
+ * Browser note: some browsers filter the User-Agent request header
+ * silently (never throwing), so this is a no-op there — which is correct:
+ * in a browser the page's real UA is the honest identity.
+ */
+declare const SDK_USER_AGENT = "astrasync-sdk/4.4.0";
+declare const sdkFetch: typeof fetch;
+
 /**
  * Single source-of-truth for the SDK's
  * package version emitted on verify-access bodies (and any future
@@ -145,6 +194,6 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "4.1.0";
+declare const SDK_VERSION = "4.4.0";
 
-export { EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown };
+export { EnhancedVerificationResult, GatewayConfig, RUNTIME_SIGNATURES, type RuntimeSignature, SDK_USER_AGENT, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, detectRuntime, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown, sdkFetch };

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-sMxBT-nM.js';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-sMxBT-nM.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-QeX0Z8Ho.js';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-DwSfO7Sb.js';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-DwSfO7Sb.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-C6SASmsh.js';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.js';
-export { e as express } from './express-BVd1_3FE.js';
-export { n as nextjs } from './nextjs-w7RTbP1P.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-BqHKlLOU.js';
+export { e as express } from './express-DaqL11tx.js';
+export { n as nextjs } from './nextjs-DL6uE1ye.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-B5Ts1WtM.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-T1aBoUcc.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BfIxCYIZ.js';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.js';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.js';
@@ -127,6 +127,55 @@ declare function getWellKnownUrls(apiBaseUrl: string): Promise<WellKnownAgenticC
  */
 declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCommerce | undefined;
 
+/**
+ * HTTP-client RUNTIME signatures — a display-only vocabulary, disjoint from
+ * the platform-agent vendor vocabulary in `platform-signatures.ts`.
+ *
+ * A UA of `node` or `python-requests` identifies the HTTP STACK, never the
+ * operator: OpenAI Codex, Claude Code, Perplexity's tooling, and our own SDK
+ * all fetch through Node — labeling any of them a vendor from the runtime
+ * alone would be fabrication. What we CAN say honestly is "undeclared
+ * automation on the Node.js runtime", which beats "unknown" in every surface.
+ *
+ * HARD RULE: this module must NEVER be consulted by `edge-core/classify.ts`,
+ * `detectPlatformFingerprint`, or any tiering / orphan-provisioning path.
+ * Runtime matches carry no identity: promoting them to the `identified` tier
+ * would flip anonymous-bot traffic to 1:1 beacons and auto-provision orphan
+ * agents literally named "node". Display and clustering layers only.
+ */
+interface RuntimeSignature {
+    /** Stable runtime key — namespace disjoint from `PlatformAgentVendor`. */
+    runtime: string;
+    /** Human-readable label, e.g. "Node.js runtime". */
+    displayName: string;
+    uaPatterns: RegExp[];
+}
+/** First match wins — order more-specific tokens before generic ones. */
+declare const RUNTIME_SIGNATURES: ReadonlyArray<RuntimeSignature>;
+/**
+ * Detect the HTTP-client runtime from a User-Agent. Returns the displayName
+ * (e.g. "Node.js runtime") or undefined when the UA doesn't look like a bare
+ * runtime/library client.
+ */
+declare function detectRuntime(userAgent: string | undefined | null): string | undefined;
+
+/**
+ * Shared outbound-HTTP wrapper — every request the SDK makes to the
+ * AstraSync backend (or anywhere else) goes through `sdkFetch` so it
+ * carries an identifying User-Agent.
+ *
+ * Why: Node's global fetch defaults to `user-agent: node`, which is
+ * indistinguishable from every other Node client on the wire. Visit
+ * Intelligence observed our own SDK/beacon traffic as anonymous "node"
+ * visits. Self-identification is the platform's own medicine.
+ *
+ * Browser note: some browsers filter the User-Agent request header
+ * silently (never throwing), so this is a no-op there — which is correct:
+ * in a browser the page's real UA is the honest identity.
+ */
+declare const SDK_USER_AGENT = "astrasync-sdk/4.4.0";
+declare const sdkFetch: typeof fetch;
+
 /**
  * Single source-of-truth for the SDK's
  * package version emitted on verify-access bodies (and any future
@@ -145,6 +194,6 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "4.1.0";
+declare const SDK_VERSION = "4.4.0";
 
-export { EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown };
+export { EnhancedVerificationResult, GatewayConfig, RUNTIME_SIGNATURES, type RuntimeSignature, SDK_USER_AGENT, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, detectRuntime, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown, sdkFetch };