@astrasyncai/verification-gateway 5.14.0 → 5.15.0

package/dist/bin/astrasync-claude-hook.js

@@ -3752,7 +3752,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.15.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4071,6 +4071,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -4221,7 +4222,8 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -4302,7 +4304,10 @@ async function verify(config, request, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -4312,7 +4317,10 @@ async function verify(config, request, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -4363,7 +4371,11 @@ async function verify(config, request, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -4383,7 +4395,9 @@ async function verify(config, request, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -4394,6 +4408,9 @@ var FALLBACK_MAX_WAIT_MS = 5 * 60 * 1e3;
 // src/metadata-capture.ts
 var MAX_TOTAL_BYTES = 16 * 1024;
 
+// src/adapters/commerce-detect.ts
+var MAX_BODY_BYTES = 64 * 1024;
+
 // src/edge-config.ts
 var DEFAULT_EDGE_CONFIG = Object.freeze({
   version: 1,
@@ -4703,6 +4720,33 @@ var import_node_crypto4 = require("crypto");
 // src/transport/registry/visa.ts
 var import_jose = require("jose");
 
+// src/ucp/profile.ts
+var UCP_VERSION = "2026-08-25";
+var SPEC = `https://ucp.dev/${UCP_VERSION}/specification`;
+var SCHEMAS = `https://ucp.dev/${UCP_VERSION}/schemas`;
+
+// src/ucp/signatures.ts
+var import_http_message_signatures3 = require("http-message-signatures");
+
+// src/http-signatures/sign.ts
+var import_http_message_signatures2 = require("http-message-signatures");
+
+// src/ucp/checkout-kit.ts
+var import_jose3 = require("jose");
+
+// src/mandates/sd-jwt.ts
+var import_jose2 = require("jose");
+
+// src/idempotency/index.ts
+var DEFAULT_IDEMPOTENCY_TTL_MS = 24 * 60 * 60 * 1e3;
+
+// src/payments/kyapay.ts
+var import_jose4 = require("jose");
+
+// src/aep/core.ts
+var ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
 // src/gateway/modes/online.ts
 function toGatewayConfig(config) {
   return {
@@ -5693,7 +5737,7 @@ async function sendHeartbeat(enrolment, request, timeoutMs = 1500) {
 
 // src/fleet/policy-verify.ts
 var import_crypto = require("crypto");
-var import_jose2 = require("jose");
+var import_jose5 = require("jose");
 
 // src/fleet/types.ts
 var FLEET_POLICY_TYP = "fleet-policy+jwt";
@@ -5742,8 +5786,8 @@ async function verifyFleetPolicy(jws, jwks, options) {
   let payloadBytes;
   let header;
   try {
-    const keySet = (0, import_jose2.createLocalJWKSet)(jwks);
-    const result = await (0, import_jose2.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
+    const keySet = (0, import_jose5.createLocalJWKSet)(jwks);
+    const result = await (0, import_jose5.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
     payloadBytes = result.payload;
     header = result.protectedHeader;
   } catch (err) {
@@ -5789,9 +5833,9 @@ async function resolveFleetJwks(pinned, chain, ownerId) {
   let lastSeq = 0;
   for (const link of chain) {
     try {
-      const { payload, protectedHeader } = await (0, import_jose2.compactVerify)(
+      const { payload, protectedHeader } = await (0, import_jose5.compactVerify)(
         link,
-        (0, import_jose2.createLocalJWKSet)(trusted),
+        (0, import_jose5.createLocalJWKSet)(trusted),
         { algorithms: ["ES256"] }
       );
       if (protectedHeader.typ !== FLEET_KEYS_TYP) continue;

package/dist/bin/astrasync-codex-hook.js

@@ -3751,7 +3751,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.15.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4070,6 +4070,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -4220,7 +4221,8 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -4301,7 +4303,10 @@ async function verify(config, request, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -4311,7 +4316,10 @@ async function verify(config, request, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -4362,7 +4370,11 @@ async function verify(config, request, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -4382,7 +4394,9 @@ async function verify(config, request, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -4393,6 +4407,9 @@ var FALLBACK_MAX_WAIT_MS = 5 * 60 * 1e3;
 // src/metadata-capture.ts
 var MAX_TOTAL_BYTES = 16 * 1024;
 
+// src/adapters/commerce-detect.ts
+var MAX_BODY_BYTES = 64 * 1024;
+
 // src/edge-config.ts
 var DEFAULT_EDGE_CONFIG = Object.freeze({
   version: 1,
@@ -4702,6 +4719,33 @@ var import_node_crypto4 = require("crypto");
 // src/transport/registry/visa.ts
 var import_jose = require("jose");
 
+// src/ucp/profile.ts
+var UCP_VERSION = "2026-08-25";
+var SPEC = `https://ucp.dev/${UCP_VERSION}/specification`;
+var SCHEMAS = `https://ucp.dev/${UCP_VERSION}/schemas`;
+
+// src/ucp/signatures.ts
+var import_http_message_signatures3 = require("http-message-signatures");
+
+// src/http-signatures/sign.ts
+var import_http_message_signatures2 = require("http-message-signatures");
+
+// src/ucp/checkout-kit.ts
+var import_jose3 = require("jose");
+
+// src/mandates/sd-jwt.ts
+var import_jose2 = require("jose");
+
+// src/idempotency/index.ts
+var DEFAULT_IDEMPOTENCY_TTL_MS = 24 * 60 * 60 * 1e3;
+
+// src/payments/kyapay.ts
+var import_jose4 = require("jose");
+
+// src/aep/core.ts
+var ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
 // src/gateway/modes/online.ts
 function toGatewayConfig(config) {
   return {
@@ -5439,7 +5483,7 @@ async function sendHeartbeat(enrolment, request, timeoutMs = 1500) {
 
 // src/fleet/policy-verify.ts
 var import_crypto = require("crypto");
-var import_jose2 = require("jose");
+var import_jose5 = require("jose");
 
 // src/fleet/types.ts
 var FLEET_POLICY_TYP = "fleet-policy+jwt";
@@ -5488,8 +5532,8 @@ async function verifyFleetPolicy(jws, jwks, options) {
   let payloadBytes;
   let header;
   try {
-    const keySet = (0, import_jose2.createLocalJWKSet)(jwks);
-    const result = await (0, import_jose2.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
+    const keySet = (0, import_jose5.createLocalJWKSet)(jwks);
+    const result = await (0, import_jose5.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
     payloadBytes = result.payload;
     header = result.protectedHeader;
   } catch (err) {
@@ -5535,9 +5579,9 @@ async function resolveFleetJwks(pinned, chain, ownerId) {
   let lastSeq = 0;
   for (const link of chain) {
     try {
-      const { payload, protectedHeader } = await (0, import_jose2.compactVerify)(
+      const { payload, protectedHeader } = await (0, import_jose5.compactVerify)(
         link,
-        (0, import_jose2.createLocalJWKSet)(trusted),
+        (0, import_jose5.createLocalJWKSet)(trusted),
         { algorithms: ["ES256"] }
       );
       if (protectedHeader.typ !== FLEET_KEYS_TYP) continue;

package/dist/bin/astrasync-guard.js

@@ -3713,7 +3713,7 @@ Policy saved to ${outputPath}`);
 };
 
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.15.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4936,6 +4936,7 @@ async function callVerifyAccessAPI(config, request2) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -5086,7 +5087,8 @@ async function verify(config, request2, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request2.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request2, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -5167,7 +5169,10 @@ async function verify(config, request2, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -5177,7 +5182,10 @@ async function verify(config, request2, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -5228,7 +5236,11 @@ async function verify(config, request2, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -5248,7 +5260,9 @@ async function verify(config, request2, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request2, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request2, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -5259,6 +5273,9 @@ var FALLBACK_MAX_WAIT_MS = 5 * 60 * 1e3;
 // src/metadata-capture.ts
 var MAX_TOTAL_BYTES = 16 * 1024;
 
+// src/adapters/commerce-detect.ts
+var MAX_BODY_BYTES = 64 * 1024;
+
 // src/edge-config.ts
 var DEFAULT_EDGE_CONFIG = Object.freeze({
   version: 1,
@@ -5568,6 +5585,33 @@ var import_node_crypto4 = require("crypto");
 // src/transport/registry/visa.ts
 var import_jose = require("jose");
 
+// src/ucp/profile.ts
+var UCP_VERSION = "2026-08-25";
+var SPEC = `https://ucp.dev/${UCP_VERSION}/specification`;
+var SCHEMAS = `https://ucp.dev/${UCP_VERSION}/schemas`;
+
+// src/ucp/signatures.ts
+var import_http_message_signatures3 = require("http-message-signatures");
+
+// src/http-signatures/sign.ts
+var import_http_message_signatures2 = require("http-message-signatures");
+
+// src/ucp/checkout-kit.ts
+var import_jose3 = require("jose");
+
+// src/mandates/sd-jwt.ts
+var import_jose2 = require("jose");
+
+// src/idempotency/index.ts
+var DEFAULT_IDEMPOTENCY_TTL_MS = 24 * 60 * 60 * 1e3;
+
+// src/payments/kyapay.ts
+var import_jose4 = require("jose");
+
+// src/aep/core.ts
+var ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
 // src/gateway/modes/online.ts
 function toGatewayConfig(config) {
   return {
@@ -6595,7 +6639,7 @@ function writeState(paths, state) {
 
 // src/fleet/policy-verify.ts
 var import_crypto = require("crypto");
-var import_jose2 = require("jose");
+var import_jose5 = require("jose");
 
 // src/fleet/types.ts
 var FLEET_POLICY_TYP = "fleet-policy+jwt";
@@ -6644,8 +6688,8 @@ async function verifyFleetPolicy(jws, jwks, options) {
   let payloadBytes;
   let header;
   try {
-    const keySet = (0, import_jose2.createLocalJWKSet)(jwks);
-    const result = await (0, import_jose2.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
+    const keySet = (0, import_jose5.createLocalJWKSet)(jwks);
+    const result = await (0, import_jose5.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
     payloadBytes = result.payload;
     header = result.protectedHeader;
   } catch (err) {
@@ -6691,9 +6735,9 @@ async function resolveFleetJwks(pinned, chain, ownerId) {
   let lastSeq = 0;
   for (const link of chain) {
     try {
-      const { payload, protectedHeader } = await (0, import_jose2.compactVerify)(
+      const { payload, protectedHeader } = await (0, import_jose5.compactVerify)(
         link,
-        (0, import_jose2.createLocalJWKSet)(trusted),
+        (0, import_jose5.createLocalJWKSet)(trusted),
         { algorithms: ["ES256"] }
       );
       if (protectedHeader.typ !== FLEET_KEYS_TYP) continue;