@astrasyncai/verification-gateway 5.0.0 → 5.1.0

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
 import 'express';
-import '../types-CJjZvPr9.mjs';
-export { M as MCP_VERIFIED_HOP_HEADER, b as McpMiddlewareOptions, P as ParsedMcpRequest, T as ToolGate, c as ToolGateConfig, d as createMcpMiddleware, i as isVerifiedHopValidFor, m as mcpDefaultEnforced, e as mcpToPdlss, p as parseMcpJsonRpc, f as parseVerifiedHop, s as serializeVerifiedHop } from '../mcp-DgsyQiQq.mjs';
+import '../types-CSHcByFX.mjs';
+export { M as MCP_VERIFIED_HOP_HEADER, b as McpMiddlewareOptions, P as ParsedMcpRequest, T as ToolGate, c as ToolGateConfig, d as createMcpMiddleware, i as isVerifiedHopValidFor, m as mcpDefaultEnforced, e as mcpToPdlss, p as parseMcpJsonRpc, f as parseVerifiedHop, s as serializeVerifiedHop } from '../mcp-Dju_Sr1o.mjs';
 import '../metadata-capture.mjs';

package/dist/adapters/mcp.d.ts

@@ -1,4 +1,4 @@
 import 'express';
-import '../types-BK2POWNc.js';
-export { M as MCP_VERIFIED_HOP_HEADER, b as McpMiddlewareOptions, P as ParsedMcpRequest, T as ToolGate, c as ToolGateConfig, d as createMcpMiddleware, i as isVerifiedHopValidFor, m as mcpDefaultEnforced, e as mcpToPdlss, p as parseMcpJsonRpc, f as parseVerifiedHop, s as serializeVerifiedHop } from '../mcp-OosmAcKf.js';
+import '../types-CNBaZKxY.js';
+export { M as MCP_VERIFIED_HOP_HEADER, b as McpMiddlewareOptions, P as ParsedMcpRequest, T as ToolGate, c as ToolGateConfig, d as createMcpMiddleware, i as isVerifiedHopValidFor, m as mcpDefaultEnforced, e as mcpToPdlss, p as parseMcpJsonRpc, f as parseVerifiedHop, s as serializeVerifiedHop } from '../mcp-DPpu4xQz.js';
 import '../metadata-capture.js';

package/dist/adapters/mcp.js

@@ -278,6 +278,14 @@ function extractCredentials(headers, query) {
   }
   return credentials;
 }
+function mcpGuidance(urls) {
+  if (!urls?.mcpEndpoint) return void 0;
+  return {
+    endpoint: urls.mcpEndpoint,
+    discoveryUrl: urls.mcpDiscoveryUrl,
+    message: "If you are operating inside an MCP-capable host (Claude, ChatGPT, Cursor, or any MCP client), add the AstraSync MCP connector instead of integrating these URLs by hand: registration through the connector is KEYLESS and HUMAN-APPROVED \u2014 your human approves in an in-chat card, and you never see, hold, or transmit an API key, password, or private key."
+  };
+}
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
@@ -304,11 +312,17 @@ function createGuidanceResponse(_config, reason, options = {}) {
     registrationUrl: urls?.registrationUrl ?? "",
     documentationUrl: urls?.documentationUrl ?? "",
     steps: [
+      // MCP steering leads when the hosted bridge is advertised — the
+      // connector is the agent-actionable path (keyless, human-approved).
+      ...urls?.mcpEndpoint ? [
+        `Fastest path (inside an MCP host): add the AstraSync MCP connector at ${urls.mcpEndpoint} \u2014 keyless, human-approved registration`
+      ] : [],
       "Register for an AstraSync account",
       "Create and register your agent",
       "Add your ASTRA-ID to request headers",
       "Retry your request"
-    ]
+    ],
+    ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
   };
   return {
     // Round-18 G4: createGuidanceResponse fires for unverified-agent path or
@@ -527,7 +541,10 @@ async function verify(config, request, options) {
       guidance: {
         message: apiResponse.access?.reason || "Access denied by PDLSS policy",
         registrationUrl: urls?.registrationUrl ?? "",
-        documentationUrl: urls?.documentationUrl ?? ""
+        documentationUrl: urls?.documentationUrl ?? "",
+        // 5.1.0: anonymous callers land on this branch — steer MCP-hosted
+        // agents to the connector (this is what the edge deny body surfaces).
+        ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
       },
       verifiedAt: /* @__PURE__ */ new Date(),
       // Extract sessionId so decisions can be recorded for denials too