@astrasyncai/verification-gateway 5.0.0 → 5.2.0

package/dist/edge-core/index.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "5.0.0";
+var SDK_VERSION = "5.2.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -484,6 +484,14 @@ function extractCredentials(headers, query) {
   }
   return credentials;
 }
+function mcpGuidance(urls) {
+  if (!urls?.mcpEndpoint) return void 0;
+  return {
+    endpoint: urls.mcpEndpoint,
+    discoveryUrl: urls.mcpDiscoveryUrl,
+    message: "If you are operating inside an MCP-capable host (Claude, ChatGPT, Cursor, or any MCP client), add the AstraSync MCP connector instead of integrating these URLs by hand: registration through the connector is KEYLESS and HUMAN-APPROVED \u2014 your human approves in an in-chat card, and you never see, hold, or transmit an API key, password, or private key."
+  };
+}
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
@@ -510,11 +518,17 @@ function createGuidanceResponse(_config, reason, options = {}) {
     registrationUrl: urls?.registrationUrl ?? "",
     documentationUrl: urls?.documentationUrl ?? "",
     steps: [
+      // MCP steering leads when the hosted bridge is advertised — the
+      // connector is the agent-actionable path (keyless, human-approved).
+      ...urls?.mcpEndpoint ? [
+        `Fastest path (inside an MCP host): add the AstraSync MCP connector at ${urls.mcpEndpoint} \u2014 keyless, human-approved registration`
+      ] : [],
       "Register for an AstraSync account",
       "Create and register your agent",
       "Add your ASTRA-ID to request headers",
       "Retry your request"
-    ]
+    ],
+    ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
   };
   return {
     // Round-18 G4: createGuidanceResponse fires for unverified-agent path or
@@ -733,7 +747,10 @@ async function verify(config, request, options) {
       guidance: {
         message: apiResponse.access?.reason || "Access denied by PDLSS policy",
         registrationUrl: urls?.registrationUrl ?? "",
-        documentationUrl: urls?.documentationUrl ?? ""
+        documentationUrl: urls?.documentationUrl ?? "",
+        // 5.1.0: anonymous callers land on this branch — steer MCP-hosted
+        // agents to the connector (this is what the edge deny body surfaces).
+        ...mcpGuidance(urls) && { mcp: mcpGuidance(urls) }
       },
       verifiedAt: /* @__PURE__ */ new Date(),
       // Extract sessionId so decisions can be recorded for denials too
@@ -1096,8 +1113,17 @@ var PROTOCOL_MESSAGES = {
   "platform-ua": "This traffic was identified as a platform AI agent without AstraSync credentials. Register the agent to access this property with a verified identity.",
   "x-astra": "The presented AstraSync credentials failed verification or were denied by this property\u2019s access policy."
 };
-function buildDenyBody(outcome, apiBaseUrl) {
-  const origin = apiBaseUrl.replace(/\/api\/?$/, "");
+function fallbackMcpEndpoint(origin) {
+  try {
+    const host = new URL(origin).hostname.replace(/^www\./, "");
+    if (host === "astrasync.ai" || host.endsWith(".astrasync.ai")) return `https://mcp.${host}/mcp`;
+  } catch {
+  }
+  return void 0;
+}
+function buildDenyBody(outcome, apiBaseUrl, publicBaseUrl) {
+  const origin = (publicBaseUrl || apiBaseUrl).replace(/\/api\/?$/, "");
+  const mcpEndpoint = outcome.guidance?.mcp?.endpoint || fallbackMcpEndpoint(origin);
   const protocolMessage = (outcome.protocol && PROTOCOL_MESSAGES[outcome.protocol]) ?? "This request could not be verified by AstraSync.";
   return {
     success: false,
@@ -1114,7 +1140,14 @@ function buildDenyBody(outcome, apiBaseUrl) {
         // well-known cache is cold — empty means "use the fallback".
         message: outcome.guidance?.message || "Register this agent with AstraSync to receive verifiable credentials.",
         registrationUrl: outcome.guidance?.registrationUrl || `${origin}/register`,
-        documentationUrl: outcome.guidance?.documentationUrl || `${origin}/docs/edge-adapter`
+        documentationUrl: outcome.guidance?.documentationUrl || `${origin}/docs/edge-adapter`,
+        ...mcpEndpoint && {
+          mcp: {
+            endpoint: mcpEndpoint,
+            discoveryUrl: outcome.guidance?.mcp?.discoveryUrl || `${mcpEndpoint.replace(/\/mcp$/, "")}/.well-known/mcp.json`,
+            message: outcome.guidance?.mcp?.message || "Inside an MCP host? Add the AstraSync MCP connector at this endpoint instead of the registration URL \u2014 registration through the connector is keyless and human-approved (your human approves in an in-chat card; you never handle credentials)."
+          }
+        }
       }
     }
   };
@@ -1186,7 +1219,7 @@ function applyOutcome(options, outcome, policy) {
         action: "respond",
         status: 403,
         headers: {},
-        bodyJson: buildDenyBody(outcome, options.apiBaseUrl)
+        bodyJson: buildDenyBody(outcome, options.apiBaseUrl, options.publicBaseUrl)
       };
     case "manual_review":
       return {