@astrasyncai/verification-gateway 4.5.0 → 4.6.0

package/dist/index.mjs

@@ -126,7 +126,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.5.0";
+var SDK_VERSION = "4.6.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -442,6 +442,11 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
     // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
     ...isMisconfig && { misconfigured: true },
+    // 4.6.0: a transient api_error is retryable — mark it so consumers surface
+    // "temporarily unavailable, retry" (recommendation 'error') instead of
+    // coercing the absent recommendation to a policy 'deny'. Misconfig is
+    // deterministic and intentionally NOT marked retryable.
+    ...isApiError && { retryable: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -6191,6 +6196,7 @@ function buildGuidance(params) {
       steps: [
         "Credentialed path (recommended): have your human mint an agent-scoped API key at Settings \u2192 API Keys, then re-call register_agent with apiKey set. An agent holding its own scoped kya_ key is fine and intended.",
         "No-credentials path: call request_registration({ name, ownerEmail, ... }) with the human owner's email \u2014 the only bootstrap credential. No API key is involved.",
+        "Include as much metadata as you can in the registration \u2014 especially model ({ modelName, modelProvider }) and framework ({ frameworkName, frameworkVersion }). Declared platform/model metadata directly improves your trust score and attributes your traffic correctly.",
         "The owner approves via an emailed link (first time, they create an account and complete a quick verification).",
         "Use poll_registration({ requestId }) once the owner confirms approval to retrieve the astraId.",
         "Never transmit a password or private key over the MCP wire \u2014 those are never required."
@@ -6576,6 +6582,8 @@ export {
   MAX_HEADERS,
   MAX_HEADER_VALUE_BYTES,
   MAX_TOTAL_BYTES,
+  MCP_VERIFIED_HOP_HEADER,
+  MCP_VERIFIED_HOP_MAX_AGE_MS,
   PLATFORM_AGENT_SIGNATURES,
   RUNTIME_SIGNATURES,
   RegistrationDeniedError,
@@ -6613,9 +6621,11 @@ export {
   hasCredentials,
   hasMinimumAccess,
   isEdgeConfig,
+  isVerifiedHopValidFor,
   matchEdgePathRule,
   matchPlatformSignature,
   nextjs_exports as nextjs,
+  parseVerifiedHop,
   pollStepUpStatus,
   prefetchWellKnown,
   quickVerify,
@@ -6625,6 +6635,7 @@ export {
   sanitizeHeaders,
   sdk_exports as sdk,
   sdkFetch,
+  serializeVerifiedHop,
   setMcpMeta,
   transport_exports as transport,
   verify