@astrasyncai/verification-gateway 4.5.0 → 4.5.1

package/dist/index.d.mts

@@ -5,7 +5,7 @@ export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredenti
 export { e as express } from './express-CR6F3njD.mjs';
 export { n as nextjs } from './nextjs-DlX6xwbU.mjs';
 export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-Cub7lK-T.mjs';
-export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
+export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGateConfig, V as VerifiedHopMarker, c as createMcpMiddleware, i as isVerifiedHopValidFor, e as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-BgBJu4Jl.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
 export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CwAh7Tln.mjs';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
@@ -173,7 +173,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/4.5.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/4.5.1";
 declare const sdkFetch: typeof fetch;
 
 /**
@@ -194,6 +194,6 @@ declare const sdkFetch: typeof fetch;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "4.5.0";
+declare const SDK_VERSION = "4.5.1";
 
 export { EnhancedVerificationResult, GatewayConfig, RUNTIME_SIGNATURES, type RuntimeSignature, SDK_USER_AGENT, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, detectRuntime, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown, sdkFetch };

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredenti
 export { e as express } from './express-DaqL11tx.js';
 export { n as nextjs } from './nextjs-DL6uE1ye.js';
 export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-B5Ts1WtM.js';
-export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
+export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGateConfig, V as VerifiedHopMarker, c as createMcpMiddleware, i as isVerifiedHopValidFor, e as parseVerifiedHop, s as serializeVerifiedHop } from './mcp--DgKOwfu.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
 export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BfIxCYIZ.js';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
@@ -173,7 +173,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/4.5.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/4.5.1";
 declare const sdkFetch: typeof fetch;
 
 /**
@@ -194,6 +194,6 @@ declare const sdkFetch: typeof fetch;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "4.5.0";
+declare const SDK_VERSION = "4.5.1";
 
 export { EnhancedVerificationResult, GatewayConfig, RUNTIME_SIGNATURES, type RuntimeSignature, SDK_USER_AGENT, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, detectRuntime, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown, sdkFetch };

package/dist/index.js

@@ -44,6 +44,8 @@ __export(src_exports, {
   MAX_HEADERS: () => MAX_HEADERS,
   MAX_HEADER_VALUE_BYTES: () => MAX_HEADER_VALUE_BYTES,
   MAX_TOTAL_BYTES: () => MAX_TOTAL_BYTES,
+  MCP_VERIFIED_HOP_HEADER: () => MCP_VERIFIED_HOP_HEADER,
+  MCP_VERIFIED_HOP_MAX_AGE_MS: () => MCP_VERIFIED_HOP_MAX_AGE_MS,
   PLATFORM_AGENT_SIGNATURES: () => PLATFORM_AGENT_SIGNATURES,
   RUNTIME_SIGNATURES: () => RUNTIME_SIGNATURES,
   RegistrationDeniedError: () => RegistrationDeniedError,
@@ -81,9 +83,11 @@ __export(src_exports, {
   hasCredentials: () => hasCredentials,
   hasMinimumAccess: () => hasMinimumAccess,
   isEdgeConfig: () => isEdgeConfig,
+  isVerifiedHopValidFor: () => isVerifiedHopValidFor,
   matchEdgePathRule: () => matchEdgePathRule,
   matchPlatformSignature: () => matchPlatformSignature,
   nextjs: () => nextjs_exports,
+  parseVerifiedHop: () => parseVerifiedHop,
   pollStepUpStatus: () => pollStepUpStatus,
   prefetchWellKnown: () => prefetchWellKnown,
   quickVerify: () => quickVerify,
@@ -93,6 +97,7 @@ __export(src_exports, {
   sanitizeHeaders: () => sanitizeHeaders,
   sdk: () => sdk_exports,
   sdkFetch: () => sdkFetch,
+  serializeVerifiedHop: () => serializeVerifiedHop,
   setMcpMeta: () => setMcpMeta,
   transport: () => transport_exports,
   verify: () => verify
@@ -221,7 +226,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.5.0";
+var SDK_VERSION = "4.5.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -6283,6 +6288,7 @@ function buildGuidance(params) {
       steps: [
         "Credentialed path (recommended): have your human mint an agent-scoped API key at Settings \u2192 API Keys, then re-call register_agent with apiKey set. An agent holding its own scoped kya_ key is fine and intended.",
         "No-credentials path: call request_registration({ name, ownerEmail, ... }) with the human owner's email \u2014 the only bootstrap credential. No API key is involved.",
+        "Include as much metadata as you can in the registration \u2014 especially model ({ modelName, modelProvider }) and framework ({ frameworkName, frameworkVersion }). Declared platform/model metadata directly improves your trust score and attributes your traffic correctly.",
         "The owner approves via an emailed link (first time, they create an account and complete a quick verification).",
         "Use poll_registration({ requestId }) once the owner confirms approval to retrieve the astraId.",
         "Never transmit a password or private key over the MCP wire \u2014 those are never required."
@@ -6669,6 +6675,8 @@ function detectRuntime(userAgent) {
   MAX_HEADERS,
   MAX_HEADER_VALUE_BYTES,
   MAX_TOTAL_BYTES,
+  MCP_VERIFIED_HOP_HEADER,
+  MCP_VERIFIED_HOP_MAX_AGE_MS,
   PLATFORM_AGENT_SIGNATURES,
   RUNTIME_SIGNATURES,
   RegistrationDeniedError,
@@ -6706,9 +6714,11 @@ function detectRuntime(userAgent) {
   hasCredentials,
   hasMinimumAccess,
   isEdgeConfig,
+  isVerifiedHopValidFor,
   matchEdgePathRule,
   matchPlatformSignature,
   nextjs,
+  parseVerifiedHop,
   pollStepUpStatus,
   prefetchWellKnown,
   quickVerify,
@@ -6718,6 +6728,7 @@ function detectRuntime(userAgent) {
   sanitizeHeaders,
   sdk,
   sdkFetch,
+  serializeVerifiedHop,
   setMcpMeta,
   transport,
   verify