@astrasyncai/verification-gateway 5.15.0 → 5.16.0

package/README.md

@@ -836,7 +836,15 @@ The installer registers the `astrasync-claude-hook` binary in Claude Code's `set
 - **BREAKING type change:** `SettlementArtifact.binding` is now a union — `StablecoinSettlementBinding` (v2: `amountMinor` integer minor units + `assetDecimals`, pinned `chainId`/`tokenContract`/CAIP-19 `asset`) or `FiatSettlementBinding` (processor artifacts keep major-unit `amount`). The float `amount` field is gone from stablecoin bindings. Matches the server's `ver: 2` wire format, which redeems/verifies reject other versions of.
 - Settlement Artifacts docs rewritten: voucher lifecycle endpoints (verify / redeem / JWKS), expected-value gates on redeem, revocation semantics, and an explicit **guarantee boundary** — what a successful redeem proves and what it doesn't (redeem proves the authorization is live and single-use; it does not check or move funds).
 
-### v3.7.1 — ChallengeHandler auto-include
+### v5.16.0 — ChallengeHandler auto-include removed
+
+- `ChallengeHandler` answers only for counterparties registered as pending —
+  the 3.7.1 auto-include let anyone presenting an agent's ASTRA-id pass its
+  runtime challenge. Pass `challengeHandler` to `AgentClient` and `fetch()`
+  registers each call while it is in flight; otherwise call
+  `registerPending()` / `removePending()` around each interaction.
+
+### v3.7.1 — ChallengeHandler auto-include (removed in 5.16.0)
 
 - `ChallengeHandler` auto-includes the incoming `counterpartyId`/`counterpartyUrl` in the challenge response when no counterparties were pre-registered via `registerPending()` — the correct default for agents that never call it. Pre-registered whitelists behave exactly as before.
 - Runtime-challenge docs: auto-include default + double-appended-path warning.

package/dist/adapters/express.d.mts

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-Dxf9DBpr.mjs';
+import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-Blz520bR.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/adapters/express.d.ts

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-Dxf9DBpr.js';
+import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-Blz520bR.js';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/adapters/express.js

@@ -350,7 +350,7 @@ function detectCommerce(req, host) {
       evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
     };
   }
-  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri)) {
+  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
     return {
       protocol: "ucp",
       artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
@@ -457,8 +457,19 @@ function detectExpressCommerce(req) {
   );
 }
 
+// src/types.ts
+function routePolicyOf(route) {
+  if (!route) return void 0;
+  const owners = route.allowedOwners?.filter(Boolean) ?? [];
+  const policy = {
+    ...owners.length > 0 && { allowedOwners: owners },
+    ...route.requiresRuntimeChallenge === true && { requiresRuntimeChallenge: true }
+  };
+  return Object.keys(policy).length > 0 ? policy : void 0;
+}
+
 // src/version.ts
-var SDK_VERSION = "5.15.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -758,6 +769,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -964,6 +977,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -2508,6 +2522,7 @@ function createMiddleware(options) {
         counterpartyUrl,
         counterpartyType: config.counterpartyType || "api",
         enableRuntimeChallenge,
+        ...routePolicyOf(routeConfig) && { routePolicy: routePolicyOf(routeConfig) },
         durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
         ...txValue !== void 0 && { transactionValue: txValue },
         ...txCurrency && { currency: txCurrency },