@astrasyncai/verification-gateway 5.14.0 → 5.16.0

package/dist/agent/index.d.mts

@@ -1,5 +1,60 @@
 import { A as AstraSyncCredentials, P as ProtocolTransport, G as GatewayConfig } from '../types-BfILnheI.mjs';
 
+/**
+ * ChallengeHandler — Agent-Side Runtime Challenge Responder
+ *
+ * Handles incoming runtime challenges from AstraSync's verification service.
+ * Agents register pending counterparties before initiating contact,
+ * then this handler validates and responds to challenges.
+ */
+interface ChallengeResponse {
+    status: number;
+    body: {
+        challengeId: string;
+        acknowledged: boolean;
+        pendingCounterparties: string[];
+        respondedAt: string;
+        error?: string;
+    };
+}
+interface ChallengeHandlerConfig {
+    agentId: string;
+}
+declare class ChallengeHandler {
+    private agentId;
+    /** Counterparty → in-flight interactions (two concurrent calls to one counterparty both count). */
+    private pendingCounterparties;
+    constructor(config: ChallengeHandlerConfig);
+    /**
+     * Register a counterparty as pending (before initiating contact).
+     */
+    registerPending(counterpartyId: string): void;
+    /**
+     * Remove a counterparty from pending list (after interaction complete).
+     */
+    removePending(counterpartyId: string): void;
+    /**
+     * Get current pending counterparties list.
+     */
+    getPendingList(): string[];
+    /**
+     * Express middleware for the challenge endpoint.
+     * Mount at: app.post('/astrasync/challenge', handler.expressMiddleware())
+     */
+    expressMiddleware(): (req: {
+        body: unknown;
+    }, res: {
+        status: (code: number) => {
+            json: (body: unknown) => void;
+        };
+    }) => void;
+    /**
+     * Generic handler (framework-agnostic).
+     * Returns { status, body } for the caller to send.
+     */
+    handleChallenge(body: unknown): ChallengeResponse;
+}
+
 /**
  * AgentClient — Credential Presentation
  *
@@ -16,15 +71,29 @@ interface AgentClientConfig {
     apiBaseUrl?: string;
     /** API key used to authenticate ownership check + other authenticated calls. */
     apiKey?: string;
+    /**
+     * 5.16.0: the agent's runtime-challenge responder. When set, fetch()
+     * registers each call's counterparty as pending while the call is in
+     * flight, so the destination's runtime challenge passes for calls this
+     * agent is really making — and only those.
+     */
+    challengeHandler?: ChallengeHandler;
 }
 interface FetchOptions extends RequestInit {
     purpose?: string;
     action?: string;
+    /**
+     * 5.16.0: the destination's ASTRAE-id, when known. Its runtime challenge
+     * names the endpoint by ASTRAE-id (else by URL), so pass it for endpoints
+     * that require the challenge.
+     */
+    counterpartyId?: string;
 }
 declare class AgentClient {
     private credentials;
     private apiBaseUrl;
     private apiKey;
+    private challengeHandler;
     constructor(config: AgentClientConfig);
     /**
      * Async factory that validates the API key's account owns the configured
@@ -70,60 +139,6 @@ declare class AgentClient {
     private buildCredentials;
 }
 
-/**
- * ChallengeHandler — Agent-Side Runtime Challenge Responder
- *
- * Handles incoming runtime challenges from AstraSync's verification service.
- * Agents register pending counterparties before initiating contact,
- * then this handler validates and responds to challenges.
- */
-interface ChallengeResponse {
-    status: number;
-    body: {
-        challengeId: string;
-        acknowledged: boolean;
-        pendingCounterparties: string[];
-        respondedAt: string;
-        error?: string;
-    };
-}
-interface ChallengeHandlerConfig {
-    agentId: string;
-}
-declare class ChallengeHandler {
-    private agentId;
-    private pendingCounterparties;
-    constructor(config: ChallengeHandlerConfig);
-    /**
-     * Register a counterparty as pending (before initiating contact).
-     */
-    registerPending(counterpartyId: string): void;
-    /**
-     * Remove a counterparty from pending list (after interaction complete).
-     */
-    removePending(counterpartyId: string): void;
-    /**
-     * Get current pending counterparties list.
-     */
-    getPendingList(): string[];
-    /**
-     * Express middleware for the challenge endpoint.
-     * Mount at: app.post('/astrasync/challenge', handler.expressMiddleware())
-     */
-    expressMiddleware(): (req: {
-        body: unknown;
-    }, res: {
-        status: (code: number) => {
-            json: (body: unknown) => void;
-        };
-    }) => void;
-    /**
-     * Generic handler (framework-agnostic).
-     * Returns { status, body } for the caller to send.
-     */
-    handleChallenge(body: unknown): ChallengeResponse;
-}
-
 /**
  * PDLSS Formatter — Transport Format Conversion
  *

package/dist/agent/index.d.ts

@@ -1,5 +1,60 @@
 import { A as AstraSyncCredentials, P as ProtocolTransport, G as GatewayConfig } from '../types-BfILnheI.js';
 
+/**
+ * ChallengeHandler — Agent-Side Runtime Challenge Responder
+ *
+ * Handles incoming runtime challenges from AstraSync's verification service.
+ * Agents register pending counterparties before initiating contact,
+ * then this handler validates and responds to challenges.
+ */
+interface ChallengeResponse {
+    status: number;
+    body: {
+        challengeId: string;
+        acknowledged: boolean;
+        pendingCounterparties: string[];
+        respondedAt: string;
+        error?: string;
+    };
+}
+interface ChallengeHandlerConfig {
+    agentId: string;
+}
+declare class ChallengeHandler {
+    private agentId;
+    /** Counterparty → in-flight interactions (two concurrent calls to one counterparty both count). */
+    private pendingCounterparties;
+    constructor(config: ChallengeHandlerConfig);
+    /**
+     * Register a counterparty as pending (before initiating contact).
+     */
+    registerPending(counterpartyId: string): void;
+    /**
+     * Remove a counterparty from pending list (after interaction complete).
+     */
+    removePending(counterpartyId: string): void;
+    /**
+     * Get current pending counterparties list.
+     */
+    getPendingList(): string[];
+    /**
+     * Express middleware for the challenge endpoint.
+     * Mount at: app.post('/astrasync/challenge', handler.expressMiddleware())
+     */
+    expressMiddleware(): (req: {
+        body: unknown;
+    }, res: {
+        status: (code: number) => {
+            json: (body: unknown) => void;
+        };
+    }) => void;
+    /**
+     * Generic handler (framework-agnostic).
+     * Returns { status, body } for the caller to send.
+     */
+    handleChallenge(body: unknown): ChallengeResponse;
+}
+
 /**
  * AgentClient — Credential Presentation
  *
@@ -16,15 +71,29 @@ interface AgentClientConfig {
     apiBaseUrl?: string;
     /** API key used to authenticate ownership check + other authenticated calls. */
     apiKey?: string;
+    /**
+     * 5.16.0: the agent's runtime-challenge responder. When set, fetch()
+     * registers each call's counterparty as pending while the call is in
+     * flight, so the destination's runtime challenge passes for calls this
+     * agent is really making — and only those.
+     */
+    challengeHandler?: ChallengeHandler;
 }
 interface FetchOptions extends RequestInit {
     purpose?: string;
     action?: string;
+    /**
+     * 5.16.0: the destination's ASTRAE-id, when known. Its runtime challenge
+     * names the endpoint by ASTRAE-id (else by URL), so pass it for endpoints
+     * that require the challenge.
+     */
+    counterpartyId?: string;
 }
 declare class AgentClient {
     private credentials;
     private apiBaseUrl;
     private apiKey;
+    private challengeHandler;
     constructor(config: AgentClientConfig);
     /**
      * Async factory that validates the API key's account owns the configured
@@ -70,60 +139,6 @@ declare class AgentClient {
     private buildCredentials;
 }
 
-/**
- * ChallengeHandler — Agent-Side Runtime Challenge Responder
- *
- * Handles incoming runtime challenges from AstraSync's verification service.
- * Agents register pending counterparties before initiating contact,
- * then this handler validates and responds to challenges.
- */
-interface ChallengeResponse {
-    status: number;
-    body: {
-        challengeId: string;
-        acknowledged: boolean;
-        pendingCounterparties: string[];
-        respondedAt: string;
-        error?: string;
-    };
-}
-interface ChallengeHandlerConfig {
-    agentId: string;
-}
-declare class ChallengeHandler {
-    private agentId;
-    private pendingCounterparties;
-    constructor(config: ChallengeHandlerConfig);
-    /**
-     * Register a counterparty as pending (before initiating contact).
-     */
-    registerPending(counterpartyId: string): void;
-    /**
-     * Remove a counterparty from pending list (after interaction complete).
-     */
-    removePending(counterpartyId: string): void;
-    /**
-     * Get current pending counterparties list.
-     */
-    getPendingList(): string[];
-    /**
-     * Express middleware for the challenge endpoint.
-     * Mount at: app.post('/astrasync/challenge', handler.expressMiddleware())
-     */
-    expressMiddleware(): (req: {
-        body: unknown;
-    }, res: {
-        status: (code: number) => {
-            json: (body: unknown) => void;
-        };
-    }) => void;
-    /**
-     * Generic handler (framework-agnostic).
-     * Returns { status, body } for the caller to send.
-     */
-    handleChallenge(body: unknown): ChallengeResponse;
-}
-
 /**
  * PDLSS Formatter — Transport Format Conversion
  *

package/dist/agent/index.js

@@ -31,7 +31,7 @@ __export(agent_exports, {
 module.exports = __toCommonJS(agent_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -214,6 +214,7 @@ var OwnershipMismatchError = class extends AstraSyncSdkError {
 // src/agent/client.ts
 var AgentClient = class _AgentClient {
   constructor(config) {
+    this.challengeHandler = config.challengeHandler;
     this.credentials = {
       agentId: config.agentId,
       verifyUrl: config.verifyUrl ?? "https://astrasync.ai/api/agents/verify-access",
@@ -268,7 +269,7 @@ var AgentClient = class _AgentClient {
    * Make an HTTP request with AstraSync headers automatically injected.
    */
   async fetch(url, options) {
-    const { purpose, action, ...fetchOptions } = options ?? {};
+    const { purpose, action, counterpartyId, ...fetchOptions } = options ?? {};
     const creds = { ...this.credentials };
     if (purpose) {
       creds.pdlss = {
@@ -291,10 +292,16 @@ var AgentClient = class _AgentClient {
       }
     }
     const enrichedHeaders = setHttpHeaders(existingHeaders, creds);
-    return sdkFetch(url, {
-      ...fetchOptions,
-      headers: enrichedHeaders
-    });
+    const pending = this.challengeHandler ? [counterpartyId, new URL(url).origin].filter((v) => Boolean(v)) : [];
+    pending.forEach((p) => this.challengeHandler.registerPending(p));
+    try {
+      return await sdkFetch(url, {
+        ...fetchOptions,
+        headers: enrichedHeaders
+      });
+    } finally {
+      pending.forEach((p) => this.challengeHandler.removePending(p));
+    }
   }
   /**
    * Prepare A2A task metadata with AstraSync credentials.
@@ -332,26 +339,32 @@ var AgentClient = class _AgentClient {
 // src/agent/challenge-handler.ts
 var ChallengeHandler = class {
   constructor(config) {
-    this.pendingCounterparties = /* @__PURE__ */ new Set();
+    /** Counterparty → in-flight interactions (two concurrent calls to one counterparty both count). */
+    this.pendingCounterparties = /* @__PURE__ */ new Map();
     this.agentId = config.agentId;
   }
   /**
    * Register a counterparty as pending (before initiating contact).
    */
   registerPending(counterpartyId) {
-    this.pendingCounterparties.add(counterpartyId);
+    this.pendingCounterparties.set(
+      counterpartyId,
+      (this.pendingCounterparties.get(counterpartyId) ?? 0) + 1
+    );
   }
   /**
    * Remove a counterparty from pending list (after interaction complete).
    */
   removePending(counterpartyId) {
-    this.pendingCounterparties.delete(counterpartyId);
+    const n = (this.pendingCounterparties.get(counterpartyId) ?? 0) - 1;
+    if (n > 0) this.pendingCounterparties.set(counterpartyId, n);
+    else this.pendingCounterparties.delete(counterpartyId);
   }
   /**
    * Get current pending counterparties list.
    */
   getPendingList() {
-    return [...this.pendingCounterparties];
+    return [...this.pendingCounterparties.keys()];
   }
   /**
    * Express middleware for the challenge endpoint.
@@ -407,10 +420,7 @@ var ChallengeHandler = class {
         }
       };
     }
-    const explicitList = this.getPendingList();
-    const pendingCounterparties = explicitList.length > 0 ? explicitList : [payload.counterpartyId, payload.counterpartyUrl].filter(
-      (v) => typeof v === "string" && v.length > 0
-    );
+    const pendingCounterparties = this.getPendingList();
     return {
       status: 200,
       body: {