@astrasyncai/verification-gateway 5.0.0 → 5.1.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-DQmop7ZW.mjs';
-import '../types-CJjZvPr9.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-CoDjpbVY.mjs';
+import '../types-CSHcByFX.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-CXf3q4kZ.js';
-import '../types-BK2POWNc.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-3UV7IZx7.js';
+import '../types-CNBaZKxY.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{index-B5k_vUmK.d.mts → index-DIRzR5IS.d.mts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-CJjZvPr9.mjs';
+import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-CSHcByFX.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-y8xToocF.d.ts → index-DLQ4Rcuc.d.ts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-BK2POWNc.js';
+import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-CNBaZKxY.js';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-BOzM6xUq.d.mts → index-GPDn_EGI.d.mts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport, G as GatewayConfig } from './types-CJjZvPr9.mjs';
+import { b as AstraSyncCredentials, l as ProtocolTransport, G as GatewayConfig } from './types-CSHcByFX.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-dRfxUdFA.d.ts → index-Hnz5VyMR.d.ts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport, G as GatewayConfig } from './types-BK2POWNc.js';
+import { b as AstraSyncCredentials, l as ProtocolTransport, G as GatewayConfig } from './types-CNBaZKxY.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, r as StepUpApprovalInfo, t as StepUpOutcome, s as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CJjZvPr9.mjs';
-export { a as AgentCredentials, b as AstraSyncCredentials, c as AttemptOutcome, d as AttemptReport, C as CallerMetadata, e as CommerceArtifactsPayload, f as CommerceShieldProps, g as ConsiderationItem, h as ConsiderationSet, i as CounterpartyType, j as ExpressMiddlewareOptions, F as FiatSettlementBinding, k as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, l as ProtocolTransport, R as RouteAccessConfig, m as RuntimeChallengeResult, S as SDKOptions, n as SettlementArtifact, o as SettlementArtifactBinding, p as SettlementArtifactBindingBase, q as StablecoinSettlementBinding, T as TokenGuidance, u as TrustLevel, V as VerificationInterstitialProps, v as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-CJjZvPr9.mjs';
-export { T as TRUST_LEVEL_RANGES, g as getTrustLevel, s as sdk } from './sdk-B83N3xKc.mjs';
+import { G as GatewayConfig, r as StepUpApprovalInfo, t as StepUpOutcome, s as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CSHcByFX.mjs';
+export { a as AgentCredentials, b as AstraSyncCredentials, c as AttemptOutcome, d as AttemptReport, C as CallerMetadata, e as CommerceArtifactsPayload, f as CommerceShieldProps, g as ConsiderationItem, h as ConsiderationSet, i as CounterpartyType, j as ExpressMiddlewareOptions, F as FiatSettlementBinding, k as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, l as ProtocolTransport, R as RouteAccessConfig, m as RuntimeChallengeResult, S as SDKOptions, n as SettlementArtifact, o as SettlementArtifactBinding, p as SettlementArtifactBindingBase, q as StablecoinSettlementBinding, T as TokenGuidance, u as TrustLevel, V as VerificationInterstitialProps, v as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-CSHcByFX.mjs';
+export { T as TRUST_LEVEL_RANGES, g as getTrustLevel, s as sdk } from './sdk-CdO6TIEf.mjs';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.mjs';
-export { e as express } from './express-Dm-snUuY.mjs';
-export { n as nextjs } from './nextjs-B1sBdEav.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-B5k_vUmK.mjs';
-export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGate, c as ToolGateConfig, V as VerifiedHopMarker, d as createMcpMiddleware, i as isVerifiedHopValidFor, f as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-DgsyQiQq.mjs';
+export { e as express } from './express-KkBZBMqi.mjs';
+export { n as nextjs } from './nextjs-BuoDBN4g.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-DIRzR5IS.mjs';
+export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGate, c as ToolGateConfig, V as VerifiedHopMarker, d as createMcpMiddleware, i as isVerifiedHopValidFor, f as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-Dju_Sr1o.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BOzM6xUq.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-GPDn_EGI.mjs';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.mjs';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.mjs';
@@ -108,6 +108,10 @@ interface WellKnownAgenticCommerce {
     registrationUrl: string;
     documentationUrl: string;
     verifyAccessUrl: string;
+    /** 5.1.0: hosted AstraSync MCP bridge endpoint (absent on self-hosted backends). */
+    mcpEndpoint?: string;
+    /** 5.1.0: bridge connector-discovery doc (absent on self-hosted backends). */
+    mcpDiscoveryUrl?: string;
 }
 /**
  * Start a background fetch. Returns the promise for callers that need

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, r as StepUpApprovalInfo, t as StepUpOutcome, s as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-BK2POWNc.js';
-export { a as AgentCredentials, b as AstraSyncCredentials, c as AttemptOutcome, d as AttemptReport, C as CallerMetadata, e as CommerceArtifactsPayload, f as CommerceShieldProps, g as ConsiderationItem, h as ConsiderationSet, i as CounterpartyType, j as ExpressMiddlewareOptions, F as FiatSettlementBinding, k as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, l as ProtocolTransport, R as RouteAccessConfig, m as RuntimeChallengeResult, S as SDKOptions, n as SettlementArtifact, o as SettlementArtifactBinding, p as SettlementArtifactBindingBase, q as StablecoinSettlementBinding, T as TokenGuidance, u as TrustLevel, V as VerificationInterstitialProps, v as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-BK2POWNc.js';
-export { T as TRUST_LEVEL_RANGES, g as getTrustLevel, s as sdk } from './sdk-H_9BTNBS.js';
+import { G as GatewayConfig, r as StepUpApprovalInfo, t as StepUpOutcome, s as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CNBaZKxY.js';
+export { a as AgentCredentials, b as AstraSyncCredentials, c as AttemptOutcome, d as AttemptReport, C as CallerMetadata, e as CommerceArtifactsPayload, f as CommerceShieldProps, g as ConsiderationItem, h as ConsiderationSet, i as CounterpartyType, j as ExpressMiddlewareOptions, F as FiatSettlementBinding, k as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, l as ProtocolTransport, R as RouteAccessConfig, m as RuntimeChallengeResult, S as SDKOptions, n as SettlementArtifact, o as SettlementArtifactBinding, p as SettlementArtifactBindingBase, q as StablecoinSettlementBinding, T as TokenGuidance, u as TrustLevel, V as VerificationInterstitialProps, v as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-CNBaZKxY.js';
+export { T as TRUST_LEVEL_RANGES, g as getTrustLevel, s as sdk } from './sdk-DxHuIJBm.js';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.js';
-export { e as express } from './express-B5lWuemA.js';
-export { n as nextjs } from './nextjs-DoRmhV_Z.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-y8xToocF.js';
-export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGate, c as ToolGateConfig, V as VerifiedHopMarker, d as createMcpMiddleware, i as isVerifiedHopValidFor, f as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-OosmAcKf.js';
+export { e as express } from './express-xK8pRrmj.js';
+export { n as nextjs } from './nextjs-rZKzY_8o.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-DLQ4Rcuc.js';
+export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGate, c as ToolGateConfig, V as VerifiedHopMarker, d as createMcpMiddleware, i as isVerifiedHopValidFor, f as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-DPpu4xQz.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-dRfxUdFA.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-Hnz5VyMR.js';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.js';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.js';
@@ -108,6 +108,10 @@ interface WellKnownAgenticCommerce {
     registrationUrl: string;
     documentationUrl: string;
     verifyAccessUrl: string;
+    /** 5.1.0: hosted AstraSync MCP bridge endpoint (absent on self-hosted backends). */
+    mcpEndpoint?: string;
+    /** 5.1.0: bridge connector-discovery doc (absent on self-hosted backends). */
+    mcpDiscoveryUrl?: string;
 }
 /**
  * Start a background fetch. Returns the promise for callers that need

package/dist/index.js

@@ -356,6 +356,14 @@ function extractCredentials(headers, query) {
 function hasCredentials(credentials) {
   return !!(credentials.astraId || credentials.apiKey || credentials.jwt);
 }
+function mcpGuidance(urls) {
+  if (!urls?.mcpEndpoint) return void 0;
+  return {
+    endpoint: urls.mcpEndpoint,
+    discoveryUrl: urls.mcpDiscoveryUrl,
+    message: "If you are operating inside an MCP-capable host (Claude, ChatGPT, Cursor, or any MCP client), add the AstraSync MCP connector instead of integrating these URLs by hand: registration through the connector is KEYLESS and HUMAN-APPROVED \u2014 your human approves in an in-chat card, and you never see, hold, or transmit an API key, password, or private key."
+  };
+}
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
@@ -382,11 +390,17 @@ function createGuidanceResponse(_config, reason, options = {}) {
     registrationUrl: urls?.registrationUrl ?? "",
     documentationUrl: urls?.documentationUrl ?? "",
     steps: [
+      // MCP steering leads when the hosted bridge is advertised — the
+      // connector is the agent-actionable path (keyless, human-approved).
+      ...urls?.mcpEndpoint ? [
+        `Fastest path (inside an MCP host): add the AstraSync MCP connector at ${urls.mcpEndpoint} \u2014 keyless, human-approved registration`
+      ] : [],
       "Register for an AstraSync account",
       "Create and register your agent",
       "Add your ASTRA-ID to request headers",
       "Retry your request"
-    ]
+    ],
+    ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
   };
   return {
     // Round-18 G4: createGuidanceResponse fires for unverified-agent path or
@@ -605,7 +619,10 @@ async function verify(config, request, options) {
       guidance: {
         message: apiResponse.access?.reason || "Access denied by PDLSS policy",
         registrationUrl: urls?.registrationUrl ?? "",
-        documentationUrl: urls?.documentationUrl ?? ""
+        documentationUrl: urls?.documentationUrl ?? "",
+        // 5.1.0: anonymous callers land on this branch — steer MCP-hosted
+        // agents to the connector (this is what the edge deny body surfaces).
+        ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
       },
       verifiedAt: /* @__PURE__ */ new Date(),
       // Extract sessionId so decisions can be recorded for denials too