@astrasyncai/verification-gateway 4.2.1 → 4.4.0

package/dist/{types-r850cOt0.d.mts → types-C0zfSXMB.d.mts}

@@ -897,6 +897,19 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
      * disable the beacon and its config fetch entirely.
      */
     anonymousBeacon?: boolean;
+    /**
+     * Trust a fresh `X-Astra-Verified-Hop` marker from an upstream AstraSync
+     * hop (edge gateway at authenticate/authorize depth, or an MCP outer hop)
+     * and skip the duplicate verify-access call when the marker matches the
+     * presented `X-Astra-Id` and is within the freshness window. The marker is
+     * an UNSIGNED dedupe advisory — enable only when every network path to
+     * this middleware crosses a stripping gateway or equivalent trusted
+     * boundary. Default false. No `req.agentVerification` is populated on a
+     * hop-skip (same contract as the MCP adapter).
+     */
+    trustVerifiedHop?: boolean;
+    /** Acceptable `X-Astra-Verified-Hop` age in ms (default 60 000). */
+    verifiedHopMaxAgeMs?: number;
 }
 /**
  * Next.js middleware options.
@@ -907,6 +920,15 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
 interface NextJsMiddlewareOptions extends GatewayConfig {
     /** Paths to skip verification */
     skipPaths?: string[];
+    /**
+     * Trust a fresh `X-Astra-Verified-Hop` marker from an upstream AstraSync
+     * hop and skip the duplicate verify-access call — see
+     * `ExpressMiddlewareOptions.trustVerifiedHop` for the trust model.
+     * Default false.
+     */
+    trustVerifiedHop?: boolean;
+    /** Acceptable `X-Astra-Verified-Hop` age in ms (default 60 000). */
+    verifiedHopMaxAgeMs?: number;
     /** Refresh interval (ms) for the remote-fetched route policy. Default: 5 minutes. */
     routesRefreshMs?: number;
     /**

package/dist/{types-DqfPU5Bl.d.mts → types-C7Rb-w0d.d.mts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, j as CounterpartyType, T as TokenGuidance } from './types-r850cOt0.mjs';
+import { a as AccessLevel, j as CounterpartyType, T as TokenGuidance } from './types-C0zfSXMB.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-sMxBT-nM.d.ts → types-DwSfO7Sb.d.ts}

@@ -897,6 +897,19 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
      * disable the beacon and its config fetch entirely.
      */
     anonymousBeacon?: boolean;
+    /**
+     * Trust a fresh `X-Astra-Verified-Hop` marker from an upstream AstraSync
+     * hop (edge gateway at authenticate/authorize depth, or an MCP outer hop)
+     * and skip the duplicate verify-access call when the marker matches the
+     * presented `X-Astra-Id` and is within the freshness window. The marker is
+     * an UNSIGNED dedupe advisory — enable only when every network path to
+     * this middleware crosses a stripping gateway or equivalent trusted
+     * boundary. Default false. No `req.agentVerification` is populated on a
+     * hop-skip (same contract as the MCP adapter).
+     */
+    trustVerifiedHop?: boolean;
+    /** Acceptable `X-Astra-Verified-Hop` age in ms (default 60 000). */
+    verifiedHopMaxAgeMs?: number;
 }
 /**
  * Next.js middleware options.
@@ -907,6 +920,15 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
 interface NextJsMiddlewareOptions extends GatewayConfig {
     /** Paths to skip verification */
     skipPaths?: string[];
+    /**
+     * Trust a fresh `X-Astra-Verified-Hop` marker from an upstream AstraSync
+     * hop and skip the duplicate verify-access call — see
+     * `ExpressMiddlewareOptions.trustVerifiedHop` for the trust model.
+     * Default false.
+     */
+    trustVerifiedHop?: boolean;
+    /** Acceptable `X-Astra-Verified-Hop` age in ms (default 60 000). */
+    verifiedHopMaxAgeMs?: number;
     /** Refresh interval (ms) for the remote-fetched route policy. Default: 5 minutes. */
     routesRefreshMs?: number;
     /**

package/dist/{types-BLUx92FJ.d.ts → types-nIh3HtuA.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccessLevel, j as CounterpartyType, T as TokenGuidance } from './types-sMxBT-nM.js';
+import { a as AccessLevel, j as CounterpartyType, T as TokenGuidance } from './types-DwSfO7Sb.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, x as VerificationResult, b as AgentCredentials, l as GuidanceInfo, v as TrustLevel } from '../types-r850cOt0.mjs';
+import { V as VerificationInterstitialProps, x as VerificationResult, b as AgentCredentials, l as GuidanceInfo, v as TrustLevel } from '../types-C0zfSXMB.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, x as VerificationResult, b as AgentCredentials, l as GuidanceInfo, v as TrustLevel } from '../types-sMxBT-nM.js';
+import { V as VerificationInterstitialProps, x as VerificationResult, b as AgentCredentials, l as GuidanceInfo, v as TrustLevel } from '../types-DwSfO7Sb.js';
 import '../metadata-capture.js';
 
 /**

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, e as AttemptReport, w as VerificationRequest, x as VerificationResult } from './types-r850cOt0.mjs';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, e as AttemptReport, w as VerificationRequest, x as VerificationResult } from './types-C0zfSXMB.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, e as AttemptReport, w as VerificationRequest, x as VerificationResult } from './types-sMxBT-nM.js';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, e as AttemptReport, w as VerificationRequest, x as VerificationResult } from './types-DwSfO7Sb.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**

package/dist/verify.js

@@ -35,6 +35,27 @@ __export(verify_exports, {
 });
 module.exports = __toCommonJS(verify_exports);
 
+// src/version.ts
+var SDK_VERSION = "4.4.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
+
 // src/access-levels.ts
 function getTrustLevel(score) {
   if (score >= 80) return "PLATINUM";
@@ -43,9 +64,6 @@ function getTrustLevel(score) {
   return "BRONZE";
 }
 
-// src/version.ts
-var SDK_VERSION = "4.1.0";
-
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 var cache = /* @__PURE__ */ new Map();
@@ -77,7 +95,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -91,7 +109,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -344,7 +362,7 @@ async function callVerifyAccessAPI(config, request) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
@@ -587,7 +605,7 @@ async function recordDecision(config, sessionId, decision, reason) {
     headers["Authorization"] = `Bearer ${config.apiKey}`;
     headers["X-API-Key"] = config.apiKey;
   }
-  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {
+  await sdkFetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {
     method: "POST",
     headers,
     body: JSON.stringify({ decision, reason })
@@ -605,7 +623,7 @@ async function reportAttempt(config, report) {
     ...report,
     ...!report.counterpartyId && config.counterpartyId && { counterpartyId: config.counterpartyId }
   };
-  await fetch(`${apiBaseUrl}/agents/verify-access/attempt-report`, {
+  await sdkFetch(`${apiBaseUrl}/agents/verify-access/attempt-report`, {
     method: "POST",
     headers,
     body: JSON.stringify(body)
@@ -620,7 +638,7 @@ async function fetchRoutes(config, counterpartyId) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(
+    const response = await sdkFetch(
       `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes`,
       { method: "GET", headers }
     );
@@ -654,7 +672,7 @@ async function reportUnregisteredAttempt(config, data) {
     ...counterpartyUrl && { counterpartyUrl },
     ...config.counterpartyId && { counterpartyId: config.counterpartyId }
   };
-  await fetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {
+  await sdkFetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body)
@@ -663,7 +681,7 @@ async function reportUnregisteredAttempt(config, data) {
 }
 async function reportCounterpartyPreCheckFailure(config, data) {
   const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
-  await fetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {
+  await sdkFetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(data)