@astrasyncai/verification-gateway 5.14.0 → 5.16.0

package/dist/{types-DlshIIR-.d.mts → types-DBe4hgfT.d.mts}

@@ -169,6 +169,30 @@ interface VerifiedAgent {
     blockchainAnchored: boolean;
     /** Agent status */
     status: 'active' | 'inactive' | 'suspended' | 'migrating' | 'terminated' | 'retired';
+    /**
+     * 5.15.0: the protocol identities the agent declared at registration (its
+     * shared signing key, UCP profile, Web Bot Auth key directory, x402 wallet,
+     * network agent ids). Bind incoming protocol requests to these — e.g.
+     * {@link checkUcpAgentBinding} rejects a `UCP-Agent` profile that isn't the
+     * agent's. Identities AstraSync failed to verify are never included.
+     */
+    protocolIdentities?: AgentProtocolIdentities;
+}
+interface AgentProtocolIdentities {
+    /** Shared signing key (AP2 / VI `cnf`, RFC 9421). `thumbprint` = RFC 7638. */
+    agentKey?: {
+        kid: string | null;
+        thumbprint: string | null;
+        jwk: Record<string, unknown>;
+    };
+    ucpProfile?: string;
+    webBotAuthKeyDirectory?: string;
+    a2aCard?: string;
+    x402Wallet?: string;
+    visaAgentId?: string;
+    mastercardAgentId?: string;
+    /** Protocols whose identity AstraSync checked successfully. */
+    verified: string[];
 }
 /**
  * Verified developer (KYD) information
@@ -253,6 +277,13 @@ interface GuidanceInfo {
 interface StepUpApprovalInfo {
     approvalId: string;
     pollUrl: string;
+    /**
+     * 5.15.0: absolute https URL of the buyer-facing approval page. A UCP
+     * merchant returns it as `continue_url` with status `requires_escalation`;
+     * after the buyer approves, complete the same checkout again and the
+     * approval is redeemed once. Absent from backends older than 27.9.
+     */
+    approvalUrl?: string;
     expiresAt: string;
 }
 /**
@@ -428,19 +459,19 @@ interface VerificationResult {
     /** Settlement voucher (present on clean merchant-mediated grants with a verified wallet). */
     settlement?: SettlementArtifact;
     /**
-     * 5.3.0 (astra-pay): sanitized first-party settlement outcome. Present
-     * INSTEAD of `settlement` when the counterparty is an AstraSync-operated
-     * storefront and the request carried `commercePhase: 'confirm'` — the
-     * backend redeemed the voucher and executed the charge server-side
-     * (charge-at-redeem), so there is no artifact to deliver, only the result.
-     * `no_instrument` = policy passed but the owner has no chargeable
-     * instrument on file (steer the user to add one via onboarding).
+     * Sanitized order outcome for a purchase leg. 5.14.1: AstraSync never
+     * charges — every purchase grant records an order and hands YOU the
+     * settlement artifact, so the status is `pending_merchant` (with
+     * `orderId`): charge the `settlementToken` (card, first-party tenant) or
+     * redeem the `settlement` voucher (stablecoin), then `reportSettlement()`.
+     * `no_instrument` = policy passed but the owner has nothing usable on file
+     * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
     /**
-     * 5.5.0 (astra-pay): interim merchant self-settlement token. Present ONLY
-     * for firstParty merchants opted into settlement_mode='self_settle' on the
-     * confirm leg — YOUR server charges with this material on the shared Stripe
+     * Card settlement token. Present on a card purchase at a first-party
+     * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
+     * mode. YOUR server charges with this material on the shared Stripe
      * account and reports the outcome via `client.reportSettlement()`.
      * MERCHANT-ONLY lane: never expose it to the agent plane, never log it,
      * never echo it back over the bridge handoff (the bridge strips it
@@ -461,6 +492,29 @@ interface VerificationResult {
      * confirm handoff body wins over `fulfilment.email` (the platform default).
      */
     fulfilment?: FulfilmentInfo;
+    /**
+     * 5.15.0: AP2 v0.2 mandates AstraSync issued for this purchase (merchant
+     * lane — never forward to the agent). `mode: 'closed'` on a purchase leg
+     * (Checkout + Payment, bound to your `checkoutJwt`), `'open'` on a quote
+     * leg for an agent with a registered key. Verify with `verifyAp2Mandate()`
+     * against AstraSync's JWKS (`kid`).
+     */
+    mandates?: AstraSyncMandates;
+    /**
+     * 5.15.0: a KYAPay `kya+jwt` identity token AstraSync issued for this agent
+     * at your endpoint (commerce legs; merchant lane). `hid.email` is where to
+     * send the receipt. Verify with `verifyKyaPayTokens()` (issuer = the
+     * AstraSync origin, audience = your ASTRAE-id).
+     */
+    kyaToken?: string;
+    /**
+     * 5.15.0: A-Comm Evidence Protocol (AEP v1.0.3-rc.2) artifact payloads for
+     * your AEP chain — present when your endpoint lists `aep`: `policy` (section 3.4),
+     * `delegation` (section 3.9 protocol_metadata: kya_identity, consumer_authorization)
+     * and, for AstraSync bridge traffic, platform-countersigned `intents` (section 8.7).
+     * Append them with `AepChain` (your Ed25519 key). Merchant lane only.
+     */
+    aep?: AstraSyncAepEvidence;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
@@ -612,6 +666,12 @@ interface VerificationRequest {
      * key charge the owner's card at most once. Omit for raw one-shot confirms.
      */
     checkoutSessionId?: string;
+    /**
+     * 5.15.0: your signed checkout as a compact JWS (AP2 `checkout_jwt`). At a
+     * merchant whose endpoint lists `ap2`, a granted purchase leg returns
+     * `mandates` — closed AP2 Checkout + Payment mandates bound to it.
+     */
+    checkoutJwt?: string;
     /**
      * 5.3.0 (astra-pay): the checkout's authoritative line items, forwarded on
      * the confirm leg for the ORDER plane (receipts + digital-goods fulfillment
@@ -655,6 +715,8 @@ interface VerificationRequest {
     callerMetadata?: CallerMetadata;
     /** Enable runtime challenge for this request */
     enableRuntimeChallenge?: boolean;
+    /** 5.16.0: the matched route's policy for verify-access to enforce. */
+    routePolicy?: RoutePolicy;
     /** Create a verification session (returns sessionId) */
     createSession?: boolean;
     /** Counterparty type */
@@ -848,6 +910,14 @@ interface CommerceArtifactsPayload {
         secret: string;
     };
 }
+/**
+ * 5.16.0: the matched route's policy that verify-access enforces (forwarded
+ * by the middleware from the dashboard route). Tighten-only.
+ */
+interface RoutePolicy {
+    allowedOwners?: string[];
+    requiresRuntimeChallenge?: boolean;
+}
 /**
  * Token guidance returned from verify-access.
  *
@@ -875,5 +945,39 @@ interface TokenGuidance {
         scopeConvention: 'astrasync-canonical';
     };
 }
+/** 5.15.0: AP2 mandates AstraSync issued (see VerificationResult.mandates). */
+interface AstraSyncMandates {
+    kid: string;
+    mode: 'closed' | 'open';
+    /** Delegate SD-JWT: mandate.checkout.1 / mandate.checkout.open.1. */
+    checkout: string;
+    /** Delegate SD-JWT: mandate.payment.1 / mandate.payment.open.1. */
+    payment?: string;
+}
+/** 5.15.0: AstraSync's AEP evidence (see VerificationResult.aep). */
+interface AstraSyncAepEvidence {
+    spec_version: string;
+    policy: {
+        artifact_type: 'policy';
+        actor_type: 'merchant';
+        payload: Record<string, unknown>;
+    };
+    delegation?: {
+        artifact_type: 'delegation';
+        actor_type: 'agent';
+        actor_id: string;
+        payload: {
+            protocol_metadata: Record<string, unknown>;
+        };
+    };
+    intents?: Array<{
+        artifact_type: 'intent';
+        actor_type: 'agent';
+        actor_id: string;
+        payload: Record<string, unknown>;
+        /** Compact JWS (ES256) over the canonical payload; key in AstraSync's JWKS. */
+        platform_countersignature: string;
+    }>;
+}
 
 export type { AgentCredentials as A, CommerceArtifactsPayload as C, GatewayConfig as G, TokenGuidance as T, VerificationRequest as V, AttemptReport as a, CounterpartyType as b, VerificationResult as c };

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-BCkwBA84.mjs';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-Blz520bR.mjs';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-BCkwBA84.js';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-Blz520bR.js';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-DlshIIR-.mjs';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-DBe4hgfT.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-C_b4QTyO.js';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-Bm1QvGqI.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**

package/dist/verify.js

@@ -37,7 +37,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -200,6 +200,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -412,6 +414,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -422,6 +425,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -572,7 +576,8 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -653,7 +658,10 @@ async function verify(config, request, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -663,7 +671,10 @@ async function verify(config, request, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -714,7 +725,11 @@ async function verify(config, request, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -734,7 +749,9 @@ async function verify(config, request, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }