@astrasyncai/verification-gateway 5.15.0 → 5.17.0

package/dist/index.mjs

@@ -4,6 +4,17 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/types.ts
+function routePolicyOf(route) {
+  if (!route) return void 0;
+  const owners = route.allowedOwners?.filter(Boolean) ?? [];
+  const policy = {
+    ...owners.length > 0 && { allowedOwners: owners },
+    ...route.requiresRuntimeChallenge === true && { requiresRuntimeChallenge: true }
+  };
+  return Object.keys(policy).length > 0 ? policy : void 0;
+}
+
 // src/trust-levels.ts
 var TRUST_LEVEL_RANGES = {
   BRONZE: { min: 0, max: 39 },
@@ -19,7 +30,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.15.0";
+var SDK_VERSION = "5.17.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -253,6 +264,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -465,6 +478,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -1397,7 +1411,7 @@ function detectCommerce(req, host) {
       evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
     };
   }
-  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri)) {
+  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
     return {
       protocol: "ucp",
       artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
@@ -2686,6 +2700,7 @@ function createMiddleware(options) {
         counterpartyUrl,
         counterpartyType: config.counterpartyType || "api",
         enableRuntimeChallenge,
+        ...routePolicyOf(routeConfig) && { routePolicy: routePolicyOf(routeConfig) },
         durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
         ...txValue !== void 0 && { transactionValue: txValue },
         ...txCurrency && { currency: txCurrency },
@@ -3201,6 +3216,7 @@ function createMiddleware2(options) {
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",
       enableRuntimeChallenge,
+      ...routePolicyOf(routeConfig) && { routePolicy: routePolicyOf(routeConfig) },
       durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
       ...inboundAttemptId && { attemptId: inboundAttemptId },
       callerMetadata: {
@@ -7060,6 +7076,7 @@ var OwnershipMismatchError = class extends AstraSyncSdkError {
 // src/agent/client.ts
 var AgentClient = class _AgentClient {
   constructor(config) {
+    this.challengeHandler = config.challengeHandler;
     this.credentials = {
       agentId: config.agentId,
       verifyUrl: config.verifyUrl ?? "https://astrasync.ai/api/agents/verify-access",
@@ -7114,7 +7131,7 @@ var AgentClient = class _AgentClient {
    * Make an HTTP request with AstraSync headers automatically injected.
    */
   async fetch(url, options) {
-    const { purpose, action, ...fetchOptions } = options ?? {};
+    const { purpose, action, counterpartyId, ...fetchOptions } = options ?? {};
     const creds = { ...this.credentials };
     if (purpose) {
       creds.pdlss = {
@@ -7137,10 +7154,16 @@ var AgentClient = class _AgentClient {
       }
     }
     const enrichedHeaders = setHttpHeaders(existingHeaders, creds);
-    return sdkFetch(url, {
-      ...fetchOptions,
-      headers: enrichedHeaders
-    });
+    const pending = this.challengeHandler ? [counterpartyId, new URL(url).origin].filter((v) => Boolean(v)) : [];
+    pending.forEach((p) => this.challengeHandler.registerPending(p));
+    try {
+      return await sdkFetch(url, {
+        ...fetchOptions,
+        headers: enrichedHeaders
+      });
+    } finally {
+      pending.forEach((p) => this.challengeHandler.removePending(p));
+    }
   }
   /**
    * Prepare A2A task metadata with AstraSync credentials.
@@ -7178,26 +7201,32 @@ var AgentClient = class _AgentClient {
 // src/agent/challenge-handler.ts
 var ChallengeHandler = class {
   constructor(config) {
-    this.pendingCounterparties = /* @__PURE__ */ new Set();
+    /** Counterparty → in-flight interactions (two concurrent calls to one counterparty both count). */
+    this.pendingCounterparties = /* @__PURE__ */ new Map();
     this.agentId = config.agentId;
   }
   /**
    * Register a counterparty as pending (before initiating contact).
    */
   registerPending(counterpartyId) {
-    this.pendingCounterparties.add(counterpartyId);
+    this.pendingCounterparties.set(
+      counterpartyId,
+      (this.pendingCounterparties.get(counterpartyId) ?? 0) + 1
+    );
   }
   /**
    * Remove a counterparty from pending list (after interaction complete).
    */
   removePending(counterpartyId) {
-    this.pendingCounterparties.delete(counterpartyId);
+    const n = (this.pendingCounterparties.get(counterpartyId) ?? 0) - 1;
+    if (n > 0) this.pendingCounterparties.set(counterpartyId, n);
+    else this.pendingCounterparties.delete(counterpartyId);
   }
   /**
    * Get current pending counterparties list.
    */
   getPendingList() {
-    return [...this.pendingCounterparties];
+    return [...this.pendingCounterparties.keys()];
   }
   /**
    * Express middleware for the challenge endpoint.
@@ -7253,10 +7282,7 @@ var ChallengeHandler = class {
         }
       };
     }
-    const explicitList = this.getPendingList();
-    const pendingCounterparties = explicitList.length > 0 ? explicitList : [payload.counterpartyId, payload.counterpartyUrl].filter(
-      (v) => typeof v === "string" && v.length > 0
-    );
+    const pendingCounterparties = this.getPendingList();
     return {
       status: 200,
       body: {
@@ -12783,6 +12809,7 @@ export {
   requestFingerprint,
   rootMandateDigest,
   routePatternToRegExp,
+  routePolicyOf,
   sanitizeHeaders,
   sdk_exports as sdk,
   sdkFetch,