@astrasyncai/verification-gateway 4.3.0 → 4.5.0

package/dist/bin/astrasync-claude-hook.js

@@ -3701,7 +3701,25 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.1.0";
+var SDK_VERSION = "4.5.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -3731,7 +3749,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -3745,7 +3763,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -3958,7 +3976,7 @@ async function callVerifyAccessAPI(config, request) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
@@ -4140,12 +4158,15 @@ async function verify(config, request, options) {
   const verificationContext = apiResponse.verificationContext;
   const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
-    // Round-18 G4: backend allowed access. Identity is verified (we resolved
-    // the caller to an agent) and policy passed all gates. Read idVerified
-    // from verificationContext for symmetry with the deny branch; default true
-    // on success path since `access.allowed === true` implies identity was
-    // resolvable (anonymous-allow paths flow through createGuidanceResponse).
-    identityVerified: apiResponse.verificationContext?.idVerified !== false,
+    // 4.5.0 (probe F1): read idVerified from verificationContext with the
+    // SAME absent⇒false default as the deny branch. The previous `!== false`
+    // default manufactured `identityVerified: true` for anonymous
+    // allow_full/allow_partial/audit responses (which allow access but omit
+    // verificationContext entirely) — the "anonymous caller labelled
+    // verified" defect. Every authenticated success response has carried
+    // `verificationContext.idVerified: true` since v2.2.4, so a truth claim
+    // this load-bearing must never be defaulted on.
+    identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
     accessLevel,
     agent,

package/dist/bin/astrasync-codex-hook.js

@@ -3700,7 +3700,25 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.1.0";
+var SDK_VERSION = "4.5.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -3730,7 +3748,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -3744,7 +3762,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -3957,7 +3975,7 @@ async function callVerifyAccessAPI(config, request) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
@@ -4139,12 +4157,15 @@ async function verify(config, request, options) {
   const verificationContext = apiResponse.verificationContext;
   const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
-    // Round-18 G4: backend allowed access. Identity is verified (we resolved
-    // the caller to an agent) and policy passed all gates. Read idVerified
-    // from verificationContext for symmetry with the deny branch; default true
-    // on success path since `access.allowed === true` implies identity was
-    // resolvable (anonymous-allow paths flow through createGuidanceResponse).
-    identityVerified: apiResponse.verificationContext?.idVerified !== false,
+    // 4.5.0 (probe F1): read idVerified from verificationContext with the
+    // SAME absent⇒false default as the deny branch. The previous `!== false`
+    // default manufactured `identityVerified: true` for anonymous
+    // allow_full/allow_partial/audit responses (which allow access but omit
+    // verificationContext entirely) — the "anonymous caller labelled
+    // verified" defect. Every authenticated success response has carried
+    // `verificationContext.idVerified: true` since v2.2.4, so a truth claim
+    // this load-bearing must never be defaulted on.
+    identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
     accessLevel,
     agent,

package/dist/bin/astrasync-guard.js

@@ -3677,6 +3677,27 @@ Policy saved to ${outputPath}`);
   }
 };
 
+// src/version.ts
+var SDK_VERSION = "4.5.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
+
 // src/cli/upgrade.ts
 var UpgradeFlow = class {
   constructor(config, callbacks, trigger) {
@@ -3822,7 +3843,7 @@ var UpgradeFlow = class {
    */
   async validateApiKey(apiKey) {
     try {
-      const response = await fetch(`${this.platformUrl}/api/v1/auth/me`, {
+      const response = await sdkFetch(`${this.platformUrl}/api/v1/auth/me`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (!response.ok) {
@@ -3844,7 +3865,7 @@ var UpgradeFlow = class {
   async uploadPolicy(apiKey) {
     const policyYaml = toYaml(this.config.policy);
     try {
-      const response = await fetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
+      const response = await sdkFetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -4608,9 +4629,6 @@ function getTrustLevel(score) {
   return "BRONZE";
 }
 
-// src/version.ts
-var SDK_VERSION = "4.1.0";
-
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 var cache = /* @__PURE__ */ new Map();
@@ -4639,7 +4657,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -4653,7 +4671,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -4866,7 +4884,7 @@ async function callVerifyAccessAPI(config, request2) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
@@ -5048,12 +5066,15 @@ async function verify(config, request2, options) {
   const verificationContext = apiResponse.verificationContext;
   const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
-    // Round-18 G4: backend allowed access. Identity is verified (we resolved
-    // the caller to an agent) and policy passed all gates. Read idVerified
-    // from verificationContext for symmetry with the deny branch; default true
-    // on success path since `access.allowed === true` implies identity was
-    // resolvable (anonymous-allow paths flow through createGuidanceResponse).
-    identityVerified: apiResponse.verificationContext?.idVerified !== false,
+    // 4.5.0 (probe F1): read idVerified from verificationContext with the
+    // SAME absent⇒false default as the deny branch. The previous `!== false`
+    // default manufactured `identityVerified: true` for anonymous
+    // allow_full/allow_partial/audit responses (which allow access but omit
+    // verificationContext entirely) — the "anonymous caller labelled
+    // verified" defect. Every authenticated success response has carried
+    // `verificationContext.idVerified: true` since v2.2.4, so a truth claim
+    // this load-bearing must never be defaulted on.
+    identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
     accessLevel,
     agent,

package/dist/bin/astrasync.js

@@ -26,6 +26,40 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/version.ts
+var SDK_VERSION;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    SDK_VERSION = "4.5.0";
+  }
+});
+
+// src/http.ts
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var SDK_USER_AGENT, sdkFetch;
+var init_http = __esm({
+  "src/http.ts"() {
+    "use strict";
+    init_version();
+    SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+    sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
+  }
+});
+
 // src/registration/errors.ts
 var AstraSyncError, KYDRequiredError, AuthenticationError, RegistrationDeniedError, RegistrationExpiredError, RegistrationTimeoutError;
 var init_errors = __esm({
@@ -101,6 +135,7 @@ var DEFAULT_BASE_URL, sleep, AstraSync;
 var init_api = __esm({
   "src/registration/api.ts"() {
     "use strict";
+    init_http();
     init_errors();
     DEFAULT_BASE_URL = "https://astrasync.ai";
     sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -222,7 +257,7 @@ var init_api = __esm({
        */
       async pollRegistration(requestId) {
         const url = `${this.baseUrl}/api/agents/request-registration/${requestId}`;
-        const res = await fetch(url, { headers: { Accept: "application/json" } });
+        const res = await sdkFetch(url, { headers: { Accept: "application/json" } });
         if (!res.ok) {
           const errBody = await res.json().catch(() => ({}));
           throw new AstraSyncError(
@@ -279,7 +314,7 @@ var init_api = __esm({
        * Check API health.
        */
       async health() {
-        const res = await fetch(`${this.baseUrl}/api/health/`);
+        const res = await sdkFetch(`${this.baseUrl}/api/health/`);
         if (!res.ok) {
           throw new AstraSyncError(`Health check failed: ${res.status}`, res.status);
         }
@@ -306,7 +341,7 @@ var init_api = __esm({
           const signature = await this.signRequest(method, endpoint, body || {});
           headers["X-AstraSync-Signature"] = signature;
         }
-        const res = await fetch(url, {
+        const res = await sdkFetch(url, {
           method,
           headers,
           ...body ? { body: JSON.stringify(body) } : {}
@@ -331,7 +366,7 @@ var init_api = __esm({
         if (this.cachedJwt && this.jwtExpiresAt && Date.now() < this.jwtExpiresAt) {
           return this.cachedJwt;
         }
-        const res = await fetch(`${this.baseUrl}/api/auth/login`, {
+        const res = await sdkFetch(`${this.baseUrl}/api/auth/login`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({ email: this.email, password: this.password })
@@ -4019,6 +4054,7 @@ var UpgradeFlow;
 var init_upgrade = __esm({
   "src/cli/upgrade.ts"() {
     "use strict";
+    init_http();
     init_pdlss_parser();
     UpgradeFlow = class {
       constructor(config, callbacks, trigger) {
@@ -4164,7 +4200,7 @@ var init_upgrade = __esm({
        */
       async validateApiKey(apiKey) {
         try {
-          const response = await fetch(`${this.platformUrl}/api/v1/auth/me`, {
+          const response = await sdkFetch(`${this.platformUrl}/api/v1/auth/me`, {
             headers: { Authorization: `Bearer ${apiKey}` }
           });
           if (!response.ok) {
@@ -4186,7 +4222,7 @@ var init_upgrade = __esm({
       async uploadPolicy(apiKey) {
         const policyYaml = toYaml(this.config.policy);
         try {
-          const response = await fetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
+          const response = await sdkFetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
             method: "POST",
             headers: {
               "Content-Type": "application/json",
@@ -4995,15 +5031,6 @@ var init_access_levels = __esm({
   }
 });
 
-// src/version.ts
-var SDK_VERSION;
-var init_version = __esm({
-  "src/version.ts"() {
-    "use strict";
-    SDK_VERSION = "4.1.0";
-  }
-});
-
 // src/well-known.ts
 function getCachedWellKnownUrls(apiBaseUrl) {
   return cache.get(apiBaseUrl)?.data;
@@ -5012,6 +5039,7 @@ var CACHE_TTL_MS, cache;
 var init_well_known = __esm({
   "src/well-known.ts"() {
     "use strict";
+    init_http();
     CACHE_TTL_MS = 60 * 60 * 1e3;
     cache = /* @__PURE__ */ new Map();
   }
@@ -5022,7 +5050,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -5036,7 +5064,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -5247,7 +5275,7 @@ async function callVerifyAccessAPI(config, request2) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
@@ -5429,12 +5457,15 @@ async function verify(config, request2, options) {
   const verificationContext = apiResponse.verificationContext;
   const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
-    // Round-18 G4: backend allowed access. Identity is verified (we resolved
-    // the caller to an agent) and policy passed all gates. Read idVerified
-    // from verificationContext for symmetry with the deny branch; default true
-    // on success path since `access.allowed === true` implies identity was
-    // resolvable (anonymous-allow paths flow through createGuidanceResponse).
-    identityVerified: apiResponse.verificationContext?.idVerified !== false,
+    // 4.5.0 (probe F1): read idVerified from verificationContext with the
+    // SAME absent⇒false default as the deny branch. The previous `!== false`
+    // default manufactured `identityVerified: true` for anonymous
+    // allow_full/allow_partial/audit responses (which allow access but omit
+    // verificationContext entirely) — the "anonymous caller labelled
+    // verified" defect. Every authenticated success response has carried
+    // `verificationContext.idVerified: true` since v2.2.4, so a truth claim
+    // this load-bearing must never be defaulted on.
+    identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
     accessLevel,
     agent,
@@ -5488,6 +5519,7 @@ var DEFAULT_CONFIG, initCheckPerformed, deprecationWarningShown, verificationCac
 var init_verify = __esm({
   "src/verify.ts"() {
     "use strict";
+    init_http();
     init_access_levels();
     init_version();
     init_well_known();
@@ -5517,6 +5549,7 @@ var FALLBACK_MAX_WAIT_MS;
 var init_stepup_poll = __esm({
   "src/adapters/stepup-poll.ts"() {
     "use strict";
+    init_http();
     FALLBACK_MAX_WAIT_MS = 5 * 60 * 1e3;
   }
 });
@@ -5538,7 +5571,7 @@ var init_settlement = __esm({
 });
 
 // src/transport/http.ts
-var init_http = __esm({
+var init_http2 = __esm({
   "src/transport/http.ts"() {
     "use strict";
   }
@@ -5579,6 +5612,7 @@ var DEFAULT_EDGE_CONFIG, DEFAULT_TTL_MS, DEFAULT_MAX_STALE_MS;
 var init_edge_config = __esm({
   "src/edge-config.ts"() {
     "use strict";
+    init_http();
     DEFAULT_EDGE_CONFIG = Object.freeze({
       version: 1,
       mode: "observe",
@@ -5657,7 +5691,7 @@ var init_express = __esm({
     "use strict";
     init_stepup_poll();
     init_verify();
-    init_http();
+    init_http2();
     init_verified_hop();
     init_http_pdlss();
     init_approval_gate();
@@ -5676,7 +5710,7 @@ var init_nextjs = __esm({
     "use strict";
     init_stepup_poll();
     init_verify();
-    init_http();
+    init_http2();
     init_pdlss_pre_check();
     init_metadata_capture();
     init_anonymous_beacon();
@@ -5782,6 +5816,7 @@ var init_rfc9421_verify = __esm({
 var init_ucp = __esm({
   "src/transport/ucp.ts"() {
     "use strict";
+    init_http();
     init_purpose_mapping2();
   }
 });
@@ -5950,10 +5985,10 @@ var init_web_bot_auth = __esm({
 var init_transport = __esm({
   "src/transport/index.ts"() {
     "use strict";
-    init_http();
+    init_http2();
     init_a2a();
     init_mcp();
-    init_http();
+    init_http2();
     init_a2a();
     init_mcp();
     init_purpose_mapping2();
@@ -6032,6 +6067,7 @@ var init_client = __esm({
   "src/agent/client.ts"() {
     "use strict";
     init_http();
+    init_http2();
     init_a2a();
     init_mcp();
     init_transport();
@@ -6057,6 +6093,7 @@ var init_pdlss_formatter = __esm({
 var init_decision_client = __esm({
   "src/agent/decision-client.ts"() {
     "use strict";
+    init_http();
   }
 });
 
@@ -6072,6 +6109,13 @@ var init_agent = __esm({
   }
 });
 
+// src/runtime-signatures.ts
+var init_runtime_signatures = __esm({
+  "src/runtime-signatures.ts"() {
+    "use strict";
+  }
+});
+
 // src/index.ts
 var init_src = __esm({
   "src/index.ts"() {
@@ -6097,6 +6141,8 @@ var init_src = __esm({
     init_verify();
     init_verify();
     init_metadata_capture();
+    init_runtime_signatures();
+    init_http();
     init_version();
   }
 });

package/dist/browser/background.js

@@ -3938,7 +3938,25 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.1.0";
+var SDK_VERSION = "4.5.0";
+
+// src/http.ts
+var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
+function withUserAgent(initHeaders) {
+  if (!initHeaders) return { "user-agent": SDK_USER_AGENT };
+  if (initHeaders instanceof Headers) {
+    const copy = new Headers(initHeaders);
+    if (!copy.has("user-agent")) copy.set("user-agent", SDK_USER_AGENT);
+    return copy;
+  }
+  if (Array.isArray(initHeaders)) {
+    const has2 = initHeaders.some(([name]) => name.toLowerCase() === "user-agent");
+    return has2 ? initHeaders : [...initHeaders, ["user-agent", SDK_USER_AGENT]];
+  }
+  const has = Object.keys(initHeaders).some((name) => name.toLowerCase() === "user-agent");
+  return has ? initHeaders : { "user-agent": SDK_USER_AGENT, ...initHeaders };
+}
+var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -3968,7 +3986,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
-    const response = await fetch(probeUrl, { method: "HEAD" });
+    const response = await sdkFetch(probeUrl, { method: "HEAD" });
     const contentType = response.headers.get("content-type") ?? "";
     if (contentType.startsWith("text/html")) {
       const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
@@ -3982,7 +4000,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
       );
     }
     if (apiKey) {
-      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+      const selfCheck = await sdkFetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
         headers: { Authorization: `Bearer ${apiKey}` }
       });
       if (selfCheck.status === 401) {
@@ -4195,7 +4213,7 @@ async function callVerifyAccessAPI(config, request) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
-    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+    const response = await sdkFetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
@@ -4377,12 +4395,15 @@ async function verify(config, request, options) {
   const verificationContext = apiResponse.verificationContext;
   const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
-    // Round-18 G4: backend allowed access. Identity is verified (we resolved
-    // the caller to an agent) and policy passed all gates. Read idVerified
-    // from verificationContext for symmetry with the deny branch; default true
-    // on success path since `access.allowed === true` implies identity was
-    // resolvable (anonymous-allow paths flow through createGuidanceResponse).
-    identityVerified: apiResponse.verificationContext?.idVerified !== false,
+    // 4.5.0 (probe F1): read idVerified from verificationContext with the
+    // SAME absent⇒false default as the deny branch. The previous `!== false`
+    // default manufactured `identityVerified: true` for anonymous
+    // allow_full/allow_partial/audit responses (which allow access but omit
+    // verificationContext entirely) — the "anonymous caller labelled
+    // verified" defect. Every authenticated success response has carried
+    // `verificationContext.idVerified: true` since v2.2.4, so a truth claim
+    // this load-bearing must never be defaulted on.
+    identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
     accessLevel,
     agent,