@astrasyncai/verification-gateway 5.0.0 → 5.1.0

package/dist/edge-config.d.mts

@@ -1,4 +1,4 @@
-import { G as GatewayConfig } from './types-CJjZvPr9.mjs';
+import { G as GatewayConfig } from './types-CSHcByFX.mjs';
 import './metadata-capture.mjs';
 
 /**

package/dist/edge-config.d.ts

@@ -1,4 +1,4 @@
-import { G as GatewayConfig } from './types-BK2POWNc.js';
+import { G as GatewayConfig } from './types-CNBaZKxY.js';
 import './metadata-capture.js';
 
 /**

package/dist/edge-core/index.d.mts

@@ -1,6 +1,6 @@
 import { EdgeMode, EdgeVerificationDepth, EdgeConfig } from '../edge-config.mjs';
 import { PlatformFingerprint } from '../platform-signatures.mjs';
-import { e as CommerceArtifactsPayload, v as VerificationRequest } from '../types-CJjZvPr9.mjs';
+import { e as CommerceArtifactsPayload, v as VerificationRequest } from '../types-CSHcByFX.mjs';
 import { verify } from '../verify.mjs';
 import { ObservedMetadata } from '../metadata-capture.mjs';
 
@@ -132,6 +132,11 @@ interface TierOutcome {
         message?: string;
         registrationUrl?: string;
         documentationUrl?: string;
+        mcp?: {
+            endpoint?: string;
+            discoveryUrl?: string;
+            message?: string;
+        };
     };
     stepUp?: {
         pollUrl?: string;
@@ -362,6 +367,12 @@ interface DenyBody {
             message?: string;
             registrationUrl?: string;
             documentationUrl?: string;
+            /** 5.1.0: MCP-connector steering — the keyless, human-approved path. */
+            mcp?: {
+                endpoint: string;
+                discoveryUrl?: string;
+                message: string;
+            };
         };
     };
 }

package/dist/edge-core/index.d.ts

@@ -1,6 +1,6 @@
 import { EdgeMode, EdgeVerificationDepth, EdgeConfig } from '../edge-config.js';
 import { PlatformFingerprint } from '../platform-signatures.js';
-import { e as CommerceArtifactsPayload, v as VerificationRequest } from '../types-BK2POWNc.js';
+import { e as CommerceArtifactsPayload, v as VerificationRequest } from '../types-CNBaZKxY.js';
 import { verify } from '../verify.js';
 import { ObservedMetadata } from '../metadata-capture.js';
 
@@ -132,6 +132,11 @@ interface TierOutcome {
         message?: string;
         registrationUrl?: string;
         documentationUrl?: string;
+        mcp?: {
+            endpoint?: string;
+            discoveryUrl?: string;
+            message?: string;
+        };
     };
     stepUp?: {
         pollUrl?: string;
@@ -362,6 +367,12 @@ interface DenyBody {
             message?: string;
             registrationUrl?: string;
             documentationUrl?: string;
+            /** 5.1.0: MCP-connector steering — the keyless, human-approved path. */
+            mcp?: {
+                endpoint: string;
+                discoveryUrl?: string;
+                message: string;
+            };
         };
     };
 }

package/dist/edge-core/index.js

@@ -528,6 +528,14 @@ function extractCredentials(headers, query) {
   }
   return credentials;
 }
+function mcpGuidance(urls) {
+  if (!urls?.mcpEndpoint) return void 0;
+  return {
+    endpoint: urls.mcpEndpoint,
+    discoveryUrl: urls.mcpDiscoveryUrl,
+    message: "If you are operating inside an MCP-capable host (Claude, ChatGPT, Cursor, or any MCP client), add the AstraSync MCP connector instead of integrating these URLs by hand: registration through the connector is KEYLESS and HUMAN-APPROVED \u2014 your human approves in an in-chat card, and you never see, hold, or transmit an API key, password, or private key."
+  };
+}
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
@@ -554,11 +562,17 @@ function createGuidanceResponse(_config, reason, options = {}) {
     registrationUrl: urls?.registrationUrl ?? "",
     documentationUrl: urls?.documentationUrl ?? "",
     steps: [
+      // MCP steering leads when the hosted bridge is advertised — the
+      // connector is the agent-actionable path (keyless, human-approved).
+      ...urls?.mcpEndpoint ? [
+        `Fastest path (inside an MCP host): add the AstraSync MCP connector at ${urls.mcpEndpoint} \u2014 keyless, human-approved registration`
+      ] : [],
       "Register for an AstraSync account",
       "Create and register your agent",
       "Add your ASTRA-ID to request headers",
       "Retry your request"
-    ]
+    ],
+    ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
   };
   return {
     // Round-18 G4: createGuidanceResponse fires for unverified-agent path or
@@ -777,7 +791,10 @@ async function verify(config, request, options) {
       guidance: {
         message: apiResponse.access?.reason || "Access denied by PDLSS policy",
         registrationUrl: urls?.registrationUrl ?? "",
-        documentationUrl: urls?.documentationUrl ?? ""
+        documentationUrl: urls?.documentationUrl ?? "",
+        // 5.1.0: anonymous callers land on this branch — steer MCP-hosted
+        // agents to the connector (this is what the edge deny body surfaces).
+        ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
       },
       verifiedAt: /* @__PURE__ */ new Date(),
       // Extract sessionId so decisions can be recorded for denials too
@@ -1140,8 +1157,17 @@ var PROTOCOL_MESSAGES = {
   "platform-ua": "This traffic was identified as a platform AI agent without AstraSync credentials. Register the agent to access this property with a verified identity.",
   "x-astra": "The presented AstraSync credentials failed verification or were denied by this property\u2019s access policy."
 };
+function fallbackMcpEndpoint(origin) {
+  try {
+    const host = new URL(origin).hostname.replace(/^www\./, "");
+    if (host === "astrasync.ai" || host.endsWith(".astrasync.ai")) return `https://mcp.${host}/mcp`;
+  } catch {
+  }
+  return void 0;
+}
 function buildDenyBody(outcome, apiBaseUrl) {
   const origin = apiBaseUrl.replace(/\/api\/?$/, "");
+  const mcpEndpoint = outcome.guidance?.mcp?.endpoint || fallbackMcpEndpoint(origin);
   const protocolMessage = (outcome.protocol && PROTOCOL_MESSAGES[outcome.protocol]) ?? "This request could not be verified by AstraSync.";
   return {
     success: false,
@@ -1158,7 +1184,14 @@ function buildDenyBody(outcome, apiBaseUrl) {
         // well-known cache is cold — empty means "use the fallback".
         message: outcome.guidance?.message || "Register this agent with AstraSync to receive verifiable credentials.",
         registrationUrl: outcome.guidance?.registrationUrl || `${origin}/register`,
-        documentationUrl: outcome.guidance?.documentationUrl || `${origin}/docs/edge-adapter`
+        documentationUrl: outcome.guidance?.documentationUrl || `${origin}/docs/edge-adapter`,
+        ...mcpEndpoint && {
+          mcp: {
+            endpoint: mcpEndpoint,
+            discoveryUrl: outcome.guidance?.mcp?.discoveryUrl || `${mcpEndpoint.replace(/\/mcp$/, "")}/.well-known/mcp.json`,
+            message: outcome.guidance?.mcp?.message || "Inside an MCP host? Add the AstraSync MCP connector at this endpoint instead of the registration URL \u2014 registration through the connector is keyless and human-approved (your human approves in an in-chat card; you never handle credentials)."
+          }
+        }
       }
     }
   };