@astrasyncai/verification-gateway 5.13.0 → 5.15.0

package/dist/bin/astrasync.js

@@ -36,7 +36,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    SDK_VERSION = "5.13.0";
+    SDK_VERSION = "5.15.0";
   }
 });
 
@@ -5341,6 +5341,7 @@ async function callVerifyAccessAPI(config, request2) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -5491,7 +5492,8 @@ async function verify(config, request2, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request2.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request2, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -5572,7 +5574,10 @@ async function verify(config, request2, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -5582,7 +5587,10 @@ async function verify(config, request2, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -5633,7 +5641,11 @@ async function verify(config, request2, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -5653,7 +5665,9 @@ async function verify(config, request2, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request2, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request2, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -5709,6 +5723,41 @@ var init_settlement = __esm({
   }
 });
 
+// src/metadata-capture.ts
+var MAX_TOTAL_BYTES;
+var init_metadata_capture = __esm({
+  "src/metadata-capture.ts"() {
+    "use strict";
+    MAX_TOTAL_BYTES = 16 * 1024;
+  }
+});
+
+// src/edge-core/request.ts
+var init_request = __esm({
+  "src/edge-core/request.ts"() {
+    "use strict";
+    init_metadata_capture();
+  }
+});
+
+// src/edge-core/detect.ts
+var init_detect = __esm({
+  "src/edge-core/detect.ts"() {
+    "use strict";
+    init_request();
+  }
+});
+
+// src/adapters/commerce-detect.ts
+var MAX_BODY_BYTES;
+var init_commerce_detect = __esm({
+  "src/adapters/commerce-detect.ts"() {
+    "use strict";
+    init_detect();
+    MAX_BODY_BYTES = 64 * 1024;
+  }
+});
+
 // src/transport/http.ts
 var init_http2 = __esm({
   "src/transport/http.ts"() {
@@ -5737,12 +5786,10 @@ var init_pdlss_pre_check = __esm({
   }
 });
 
-// src/metadata-capture.ts
-var MAX_TOTAL_BYTES;
-var init_metadata_capture = __esm({
-  "src/metadata-capture.ts"() {
+// src/route-pattern.ts
+var init_route_pattern = __esm({
+  "src/route-pattern.ts"() {
     "use strict";
-    MAX_TOTAL_BYTES = 16 * 1024;
   }
 });
 
@@ -5752,6 +5799,8 @@ var init_edge_config = __esm({
   "src/edge-config.ts"() {
     "use strict";
     init_http();
+    init_route_pattern();
+    init_route_pattern();
     DEFAULT_EDGE_CONFIG = Object.freeze({
       version: 1,
       mode: "observe",
@@ -5772,22 +5821,6 @@ var init_platform_signatures = __esm({
   }
 });
 
-// src/edge-core/request.ts
-var init_request = __esm({
-  "src/edge-core/request.ts"() {
-    "use strict";
-    init_metadata_capture();
-  }
-});
-
-// src/edge-core/detect.ts
-var init_detect = __esm({
-  "src/edge-core/detect.ts"() {
-    "use strict";
-    init_request();
-  }
-});
-
 // src/edge-core/classify.ts
 var init_classify = __esm({
   "src/edge-core/classify.ts"() {
@@ -5817,7 +5850,7 @@ async function withBudget(promise, ms) {
     if (timer) clearTimeout(timer);
   }
 }
-var destKeyOf, BeaconBuffer, beaconBuffer;
+var CONTAINER_ID, destKeyOf, BeaconBuffer, beaconBuffer;
 var init_events = __esm({
   "src/edge-core/events.ts"() {
     "use strict";
@@ -5825,6 +5858,11 @@ var init_events = __esm({
     init_metadata_capture();
     init_version();
     init_request();
+    CONTAINER_ID = (() => {
+      const c = globalThis.crypto;
+      if (c?.randomUUID) return c.randomUUID();
+      return `c-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 12)}`;
+    })();
     destKeyOf = (d) => `${d.apiBaseUrl}\0${d.apiKey ?? ""}\0${d.counterparty}\0${d.adapter ?? ""}`;
     BeaconBuffer = class {
       constructor(options = {}) {
@@ -5832,6 +5870,7 @@ var init_events = __esm({
         this.droppedSinceLast = 0;
         this.droppedTotal = 0;
         this.deliveredTotal = 0;
+        this.enqueuedTotal = 0;
         this.backoffUntil = 0;
         this.collapse = /* @__PURE__ */ new Map();
         /** Keys the backend answered 401 for — later batches go unauthenticated. */
@@ -5844,13 +5883,16 @@ var init_events = __esm({
           collapseMaxKeys: options.collapseMaxKeys ?? 1e3,
           requestTimeoutMs: options.requestTimeoutMs ?? 1e4,
           retryBackoffMs: options.retryBackoffMs ?? 1e3,
+          holdRepeats: options.holdRepeats ?? false,
+          containerId: options.containerId ?? CONTAINER_ID,
           now: options.now ?? Date.now
         };
       }
       /**
        * Queue one beacon. With a `collapseKey`, a repeat inside the window is
-       * merged into a held aggregate (sent when the window closes) instead of
-       * becoming its own item.
+       * merged into this key's item while that item is still queued (not yet in
+       * flight). Once it has left, the repeat becomes a new item, sendable on
+       * this flush — nothing waits for a later invocation (round 27.6).
        */
       enqueue(dest, item, collapseKey) {
         const now = this.opts.now();
@@ -5863,12 +5905,15 @@ var init_events = __esm({
                 return;
               }
             }
-            const held = this.push(
-              dest,
-              { ...item, repeatCount: 1 },
-              entry.firstSeenAt + this.opts.collapseWindowMs
-            );
-            entry.held = held;
+            if (this.opts.holdRepeats) {
+              entry.held = this.push(
+                dest,
+                { ...item, repeatCount: 1 },
+                entry.firstSeenAt + this.opts.collapseWindowMs
+              );
+              return;
+            }
+            entry.first = this.push(dest, { ...item, repeatCount: 1 }, now);
             return;
           }
           this.collapse.delete(collapseKey);
@@ -5904,6 +5949,7 @@ var init_events = __esm({
           droppedSinceLast: this.droppedSinceLast,
           droppedTotal: this.droppedTotal,
           deliveredTotal: this.deliveredTotal,
+          enqueuedTotal: this.enqueuedTotal,
           flushing: this.inFlight !== void 0
         };
       }
@@ -5918,6 +5964,7 @@ var init_events = __esm({
           inFlight: false
         };
         this.queue.push(entry);
+        this.enqueuedTotal += 1;
         return entry;
       }
       dropOldest() {
@@ -5963,7 +6010,11 @@ var init_events = __esm({
           droppedSinceLast: reportedDropped,
           queueDepth: this.queue.length,
           adapter: dest.adapter ?? "edge-core",
-          version: SDK_VERSION
+          version: SDK_VERSION,
+          containerId: this.opts.containerId,
+          enqueuedTotal: this.enqueuedTotal,
+          deliveredTotal: this.deliveredTotal,
+          droppedTotal: this.droppedTotal
         };
         const controller = typeof AbortController !== "undefined" ? new AbortController() : void 0;
         const response = await withBudget(
@@ -6040,6 +6091,7 @@ var DEFAULT_ROUTES_REFRESH_MS;
 var init_express = __esm({
   "src/adapters/express.ts"() {
     "use strict";
+    init_commerce_detect();
     init_stepup_poll();
     init_verify();
     init_http2();
@@ -6051,6 +6103,7 @@ var init_express = __esm({
     init_metadata_capture();
     init_anonymous_beacon();
     init_failure_posture();
+    init_route_pattern();
     DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
   }
 });
@@ -6060,6 +6113,7 @@ var DEFAULT_ROUTES_REFRESH_MS2;
 var init_nextjs = __esm({
   "src/adapters/nextjs.ts"() {
     "use strict";
+    init_commerce_detect();
     init_stepup_poll();
     init_verify();
     init_http2();
@@ -6070,6 +6124,7 @@ var init_nextjs = __esm({
     init_http_pdlss();
     init_approval_gate();
     init_verified_hop();
+    init_route_pattern();
     DEFAULT_ROUTES_REFRESH_MS2 = 5 * 60 * 1e3;
   }
 });
@@ -6081,6 +6136,7 @@ var init_sdk = __esm({
     init_verify();
     init_trust_levels();
     init_http();
+    init_errors();
   }
 });
 
@@ -6471,6 +6527,215 @@ var init_runtime_signatures = __esm({
   }
 });
 
+// src/ucp/agent-header.ts
+var init_agent_header = __esm({
+  "src/ucp/agent-header.ts"() {
+    "use strict";
+  }
+});
+
+// src/ucp/profile.ts
+var UCP_VERSION, SPEC, SCHEMAS;
+var init_profile = __esm({
+  "src/ucp/profile.ts"() {
+    "use strict";
+    UCP_VERSION = "2026-08-25";
+    SPEC = `https://ucp.dev/${UCP_VERSION}/specification`;
+    SCHEMAS = `https://ucp.dev/${UCP_VERSION}/schemas`;
+  }
+});
+
+// src/ucp/negotiate.ts
+var init_negotiate = __esm({
+  "src/ucp/negotiate.ts"() {
+    "use strict";
+  }
+});
+
+// src/ucp/messages.ts
+var init_messages = __esm({
+  "src/ucp/messages.ts"() {
+    "use strict";
+  }
+});
+
+// src/http-signatures/sign.ts
+var import_http_message_signatures2;
+var init_sign = __esm({
+  "src/http-signatures/sign.ts"() {
+    "use strict";
+    import_http_message_signatures2 = require("http-message-signatures");
+  }
+});
+
+// src/ucp/signatures.ts
+var import_http_message_signatures3;
+var init_signatures = __esm({
+  "src/ucp/signatures.ts"() {
+    "use strict";
+    import_http_message_signatures3 = require("http-message-signatures");
+    init_sign();
+    init_rfc9421_verify();
+  }
+});
+
+// src/mandates/sd-jwt.ts
+var import_jose2;
+var init_sd_jwt = __esm({
+  "src/mandates/sd-jwt.ts"() {
+    "use strict";
+    import_jose2 = require("jose");
+  }
+});
+
+// src/mandates/ap2.ts
+var init_ap22 = __esm({
+  "src/mandates/ap2.ts"() {
+    "use strict";
+    init_sd_jwt();
+  }
+});
+
+// src/mandates/index.ts
+var init_mandates = __esm({
+  "src/mandates/index.ts"() {
+    "use strict";
+    init_sd_jwt();
+    init_ap22();
+  }
+});
+
+// src/idempotency/index.ts
+var DEFAULT_IDEMPOTENCY_TTL_MS;
+var init_idempotency = __esm({
+  "src/idempotency/index.ts"() {
+    "use strict";
+    DEFAULT_IDEMPOTENCY_TTL_MS = 24 * 60 * 60 * 1e3;
+  }
+});
+
+// src/ucp/jcs.ts
+var init_jcs = __esm({
+  "src/ucp/jcs.ts"() {
+    "use strict";
+  }
+});
+
+// src/ucp/report-amount.ts
+var init_report_amount = __esm({
+  "src/ucp/report-amount.ts"() {
+    "use strict";
+  }
+});
+
+// src/ucp/checkout-kit.ts
+var import_jose3;
+var init_checkout_kit = __esm({
+  "src/ucp/checkout-kit.ts"() {
+    "use strict";
+    import_jose3 = require("jose");
+    init_mandates();
+    init_idempotency();
+    init_jcs();
+    init_agent_header();
+    init_negotiate();
+    init_messages();
+    init_profile();
+    init_signatures();
+    init_report_amount();
+  }
+});
+
+// src/ucp/index.ts
+var init_ucp2 = __esm({
+  "src/ucp/index.ts"() {
+    "use strict";
+    init_agent_header();
+    init_profile();
+    init_negotiate();
+    init_messages();
+    init_signatures();
+    init_checkout_kit();
+    init_jcs();
+  }
+});
+
+// src/payments/x402.ts
+var init_x4022 = __esm({
+  "src/payments/x402.ts"() {
+    "use strict";
+  }
+});
+
+// src/payments/mpp.ts
+var init_mpp2 = __esm({
+  "src/payments/mpp.ts"() {
+    "use strict";
+  }
+});
+
+// src/payments/kyapay.ts
+var import_jose4;
+var init_kyapay = __esm({
+  "src/payments/kyapay.ts"() {
+    "use strict";
+    import_jose4 = require("jose");
+  }
+});
+
+// src/payments/index.ts
+var init_payments = __esm({
+  "src/payments/index.ts"() {
+    "use strict";
+    init_x4022();
+    init_mpp2();
+    init_kyapay();
+  }
+});
+
+// src/aep/core.ts
+var ED25519_PKCS8_PREFIX, ED25519_SPKI_PREFIX;
+var init_core = __esm({
+  "src/aep/core.ts"() {
+    "use strict";
+    ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+    ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+  }
+});
+
+// src/aep/index.ts
+var init_aep = __esm({
+  "src/aep/index.ts"() {
+    "use strict";
+    init_core();
+  }
+});
+
+// src/acp/checkout-kit.ts
+var init_checkout_kit2 = __esm({
+  "src/acp/checkout-kit.ts"() {
+    "use strict";
+    init_idempotency();
+    init_report_amount();
+  }
+});
+
+// src/acp/index.ts
+var init_acp2 = __esm({
+  "src/acp/index.ts"() {
+    "use strict";
+    init_checkout_kit2();
+  }
+});
+
+// src/http-signatures/index.ts
+var init_http_signatures = __esm({
+  "src/http-signatures/index.ts"() {
+    "use strict";
+    init_sign();
+  }
+});
+
 // src/index.ts
 var init_src = __esm({
   "src/index.ts"() {
@@ -6503,6 +6768,14 @@ var init_src = __esm({
     init_pdlss_parser();
     init_schema();
     init_version();
+    init_route_pattern();
+    init_ucp2();
+    init_payments();
+    init_aep();
+    init_acp2();
+    init_mandates();
+    init_http_signatures();
+    init_idempotency();
   }
 });
 
@@ -7643,8 +7916,8 @@ async function verifyFleetPolicy(jws, jwks, options) {
   let payloadBytes;
   let header;
   try {
-    const keySet = (0, import_jose2.createLocalJWKSet)(jwks);
-    const result = await (0, import_jose2.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
+    const keySet = (0, import_jose5.createLocalJWKSet)(jwks);
+    const result = await (0, import_jose5.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
     payloadBytes = result.payload;
     header = result.protectedHeader;
   } catch (err) {
@@ -7690,9 +7963,9 @@ async function resolveFleetJwks(pinned, chain, ownerId) {
   let lastSeq = 0;
   for (const link of chain) {
     try {
-      const { payload, protectedHeader } = await (0, import_jose2.compactVerify)(
+      const { payload, protectedHeader } = await (0, import_jose5.compactVerify)(
         link,
-        (0, import_jose2.createLocalJWKSet)(trusted),
+        (0, import_jose5.createLocalJWKSet)(trusted),
         { algorithms: ["ES256"] }
       );
       if (protectedHeader.typ !== FLEET_KEYS_TYP) continue;
@@ -7722,12 +7995,12 @@ async function pickNewestValid(candidates, jwks, options) {
   if (!best) throw lastError;
   return best;
 }
-var import_crypto, import_jose2, FleetPolicyError;
+var import_crypto, import_jose5, FleetPolicyError;
 var init_policy_verify = __esm({
   "src/fleet/policy-verify.ts"() {
     "use strict";
     import_crypto = require("crypto");
-    import_jose2 = require("jose");
+    import_jose5 = require("jose");
     init_pdlss_parser();
     init_types3();
     FleetPolicyError = class extends Error {