@astrasyncai/verification-gateway 4.5.0 → 4.6.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-C7Rb-w0d.mjs';
-import '../types-C0zfSXMB.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-CfSJLS4i.mjs';
+import '../types-Cx9hTpKI.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-nIh3HtuA.js';
-import '../types-DwSfO7Sb.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-DhhJxKIC.js';
+import '../types-CGPU7HLi.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{index-BfIxCYIZ.d.ts → index-BND3kQev.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-DwSfO7Sb.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-CGPU7HLi.js';
 
 /**
  * AgentClient — Credential Presentation
@@ -151,7 +151,6 @@ interface PDLSSConfig {
     };
     limits?: {
         autonomousThreshold?: number;
-        stepUpThreshold?: number;
         approvalThreshold?: number;
         currency?: string;
     };

package/dist/{index-CwAh7Tln.d.mts → index-CUfmJ1Dq.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-C0zfSXMB.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-Cx9hTpKI.mjs';
 
 /**
  * AgentClient — Credential Presentation
@@ -151,7 +151,6 @@ interface PDLSSConfig {
     };
     limits?: {
         autonomousThreshold?: number;
-        stepUpThreshold?: number;
         approvalThreshold?: number;
         currency?: string;
     };

package/dist/{index-B5Ts1WtM.d.ts → index-DlZORQsb.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-DwSfO7Sb.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-CGPU7HLi.js';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-Cub7lK-T.d.mts → index-kGCGWd5x.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-C0zfSXMB.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-Cx9hTpKI.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-C0zfSXMB.mjs';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-C0zfSXMB.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Bbh9B_dw.mjs';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-Cx9hTpKI.mjs';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-Cx9hTpKI.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-B9dSwum7.mjs';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.mjs';
-export { e as express } from './express-CR6F3njD.mjs';
-export { n as nextjs } from './nextjs-DlX6xwbU.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-Cub7lK-T.mjs';
-export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
+export { e as express } from './express-DBtPKXOL.mjs';
+export { n as nextjs } from './nextjs-C0KASOy_.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-kGCGWd5x.mjs';
+export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGateConfig, V as VerifiedHopMarker, c as createMcpMiddleware, i as isVerifiedHopValidFor, e as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-ZRN4kY3b.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CwAh7Tln.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CUfmJ1Dq.mjs';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.mjs';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.mjs';
@@ -173,7 +173,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/4.5.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/4.6.0";
 declare const sdkFetch: typeof fetch;
 
 /**
@@ -194,6 +194,6 @@ declare const sdkFetch: typeof fetch;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "4.5.0";
+declare const SDK_VERSION = "4.6.0";
 
 export { EnhancedVerificationResult, GatewayConfig, RUNTIME_SIGNATURES, type RuntimeSignature, SDK_USER_AGENT, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, detectRuntime, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown, sdkFetch };

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-DwSfO7Sb.js';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-DwSfO7Sb.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-C6SASmsh.js';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CGPU7HLi.js';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-CGPU7HLi.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-B4aodEwj.js';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.js';
-export { e as express } from './express-DaqL11tx.js';
-export { n as nextjs } from './nextjs-DL6uE1ye.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-B5Ts1WtM.js';
-export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
+export { e as express } from './express-D-8Ks2Uo.js';
+export { n as nextjs } from './nextjs-lwNvWYWT.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-DlZORQsb.js';
+export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGateConfig, V as VerifiedHopMarker, c as createMcpMiddleware, i as isVerifiedHopValidFor, e as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-DToTlwIn.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BfIxCYIZ.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BND3kQev.js';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.js';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.js';
@@ -173,7 +173,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/4.5.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/4.6.0";
 declare const sdkFetch: typeof fetch;
 
 /**
@@ -194,6 +194,6 @@ declare const sdkFetch: typeof fetch;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "4.5.0";
+declare const SDK_VERSION = "4.6.0";
 
 export { EnhancedVerificationResult, GatewayConfig, RUNTIME_SIGNATURES, type RuntimeSignature, SDK_USER_AGENT, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, detectRuntime, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown, sdkFetch };

package/dist/index.js

@@ -44,6 +44,8 @@ __export(src_exports, {
   MAX_HEADERS: () => MAX_HEADERS,
   MAX_HEADER_VALUE_BYTES: () => MAX_HEADER_VALUE_BYTES,
   MAX_TOTAL_BYTES: () => MAX_TOTAL_BYTES,
+  MCP_VERIFIED_HOP_HEADER: () => MCP_VERIFIED_HOP_HEADER,
+  MCP_VERIFIED_HOP_MAX_AGE_MS: () => MCP_VERIFIED_HOP_MAX_AGE_MS,
   PLATFORM_AGENT_SIGNATURES: () => PLATFORM_AGENT_SIGNATURES,
   RUNTIME_SIGNATURES: () => RUNTIME_SIGNATURES,
   RegistrationDeniedError: () => RegistrationDeniedError,
@@ -81,9 +83,11 @@ __export(src_exports, {
   hasCredentials: () => hasCredentials,
   hasMinimumAccess: () => hasMinimumAccess,
   isEdgeConfig: () => isEdgeConfig,
+  isVerifiedHopValidFor: () => isVerifiedHopValidFor,
   matchEdgePathRule: () => matchEdgePathRule,
   matchPlatformSignature: () => matchPlatformSignature,
   nextjs: () => nextjs_exports,
+  parseVerifiedHop: () => parseVerifiedHop,
   pollStepUpStatus: () => pollStepUpStatus,
   prefetchWellKnown: () => prefetchWellKnown,
   quickVerify: () => quickVerify,
@@ -93,6 +97,7 @@ __export(src_exports, {
   sanitizeHeaders: () => sanitizeHeaders,
   sdk: () => sdk_exports,
   sdkFetch: () => sdkFetch,
+  serializeVerifiedHop: () => serializeVerifiedHop,
   setMcpMeta: () => setMcpMeta,
   transport: () => transport_exports,
   verify: () => verify
@@ -221,7 +226,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.5.0";
+var SDK_VERSION = "4.6.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -537,6 +542,11 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
     // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
     ...isMisconfig && { misconfigured: true },
+    // 4.6.0: a transient api_error is retryable — mark it so consumers surface
+    // "temporarily unavailable, retry" (recommendation 'error') instead of
+    // coercing the absent recommendation to a policy 'deny'. Misconfig is
+    // deterministic and intentionally NOT marked retryable.
+    ...isApiError && { retryable: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -6283,6 +6293,7 @@ function buildGuidance(params) {
       steps: [
         "Credentialed path (recommended): have your human mint an agent-scoped API key at Settings \u2192 API Keys, then re-call register_agent with apiKey set. An agent holding its own scoped kya_ key is fine and intended.",
         "No-credentials path: call request_registration({ name, ownerEmail, ... }) with the human owner's email \u2014 the only bootstrap credential. No API key is involved.",
+        "Include as much metadata as you can in the registration \u2014 especially model ({ modelName, modelProvider }) and framework ({ frameworkName, frameworkVersion }). Declared platform/model metadata directly improves your trust score and attributes your traffic correctly.",
         "The owner approves via an emailed link (first time, they create an account and complete a quick verification).",
         "Use poll_registration({ requestId }) once the owner confirms approval to retrieve the astraId.",
         "Never transmit a password or private key over the MCP wire \u2014 those are never required."
@@ -6669,6 +6680,8 @@ function detectRuntime(userAgent) {
   MAX_HEADERS,
   MAX_HEADER_VALUE_BYTES,
   MAX_TOTAL_BYTES,
+  MCP_VERIFIED_HOP_HEADER,
+  MCP_VERIFIED_HOP_MAX_AGE_MS,
   PLATFORM_AGENT_SIGNATURES,
   RUNTIME_SIGNATURES,
   RegistrationDeniedError,
@@ -6706,9 +6719,11 @@ function detectRuntime(userAgent) {
   hasCredentials,
   hasMinimumAccess,
   isEdgeConfig,
+  isVerifiedHopValidFor,
   matchEdgePathRule,
   matchPlatformSignature,
   nextjs,
+  parseVerifiedHop,
   pollStepUpStatus,
   prefetchWellKnown,
   quickVerify,
@@ -6718,6 +6733,7 @@ function detectRuntime(userAgent) {
   sanitizeHeaders,
   sdk,
   sdkFetch,
+  serializeVerifiedHop,
   setMcpMeta,
   transport,
   verify