@astrasyncai/verification-gateway 5.0.0 → 5.1.0

package/dist/{express-Dm-snUuY.d.mts → express-KkBZBMqi.d.mts}

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { w as VerificationResult, j as ExpressMiddlewareOptions, b as AstraSyncCredentials } from './types-CJjZvPr9.mjs';
+import { w as VerificationResult, j as ExpressMiddlewareOptions, b as AstraSyncCredentials } from './types-CSHcByFX.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/{express-B5lWuemA.d.ts → express-xK8pRrmj.d.ts}

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { w as VerificationResult, j as ExpressMiddlewareOptions, b as AstraSyncCredentials } from './types-BK2POWNc.js';
+import { w as VerificationResult, j as ExpressMiddlewareOptions, b as AstraSyncCredentials } from './types-CNBaZKxY.js';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/gateway/gateway.d.mts

@@ -1,5 +1,5 @@
-import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-DQmop7ZW.mjs';
-import '../types-CJjZvPr9.mjs';
+import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-CoDjpbVY.mjs';
+import '../types-CSHcByFX.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/gateway/gateway.d.ts

@@ -1,5 +1,5 @@
-import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-CXf3q4kZ.js';
-import '../types-BK2POWNc.js';
+import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-3UV7IZx7.js';
+import '../types-CNBaZKxY.js';
 import '../metadata-capture.js';
 
 /**

package/dist/gateway/gateway.js

@@ -3892,6 +3892,14 @@ function cacheResult(request, result, configuredTtl, counterpartyId) {
     expiresAt: Date.now() + ttlSeconds * 1e3
   });
 }
+function mcpGuidance(urls) {
+  if (!urls?.mcpEndpoint) return void 0;
+  return {
+    endpoint: urls.mcpEndpoint,
+    discoveryUrl: urls.mcpDiscoveryUrl,
+    message: "If you are operating inside an MCP-capable host (Claude, ChatGPT, Cursor, or any MCP client), add the AstraSync MCP connector instead of integrating these URLs by hand: registration through the connector is KEYLESS and HUMAN-APPROVED \u2014 your human approves in an in-chat card, and you never see, hold, or transmit an API key, password, or private key."
+  };
+}
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
@@ -3918,11 +3926,17 @@ function createGuidanceResponse(_config, reason, options = {}) {
     registrationUrl: urls?.registrationUrl ?? "",
     documentationUrl: urls?.documentationUrl ?? "",
     steps: [
+      // MCP steering leads when the hosted bridge is advertised — the
+      // connector is the agent-actionable path (keyless, human-approved).
+      ...urls?.mcpEndpoint ? [
+        `Fastest path (inside an MCP host): add the AstraSync MCP connector at ${urls.mcpEndpoint} \u2014 keyless, human-approved registration`
+      ] : [],
       "Register for an AstraSync account",
       "Create and register your agent",
       "Add your ASTRA-ID to request headers",
       "Retry your request"
-    ]
+    ],
+    ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
   };
   return {
     // Round-18 G4: createGuidanceResponse fires for unverified-agent path or
@@ -4141,7 +4155,10 @@ async function verify(config, request, options) {
       guidance: {
         message: apiResponse.access?.reason || "Access denied by PDLSS policy",
         registrationUrl: urls?.registrationUrl ?? "",
-        documentationUrl: urls?.documentationUrl ?? ""
+        documentationUrl: urls?.documentationUrl ?? "",
+        // 5.1.0: anonymous callers land on this branch — steer MCP-hosted
+        // agents to the connector (this is what the edge deny body surfaces).
+        ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
       },
       verifiedAt: /* @__PURE__ */ new Date(),
       // Extract sessionId so decisions can be recorded for denials too