@astrasyncai/verification-gateway 5.17.2 → 5.18.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,4 +1,4 @@
-import { T as TokenGuidance, b as CounterpartyType } from '../types-vNBvYD7Z.mjs';
+import { T as TokenGuidance, b as CounterpartyType } from '../types-3ObBpsnf.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,4 +1,4 @@
-import { T as TokenGuidance, b as CounterpartyType } from '../types-DA8LzAOB.js';
+import { T as TokenGuidance, b as CounterpartyType } from '../types-BoxZEYPS.js';
 import '../metadata-capture.js';
 
 /**

package/dist/index.d.mts

@@ -531,6 +531,13 @@ interface StepUpApprovalInfo {
      */
     approvalUrl?: string;
     expiresAt: string;
+    /**
+     * 5.18.0: `'consumed'` when this verification just redeemed the approval
+     * (the purchase may proceed); `'pending'` (or absent) while the buyer
+     * still has to approve; `'approved'` when the buyer approved but the
+     * purchase can't settle yet (e.g. no payment method) — still held.
+     */
+    status?: 'pending' | 'approved' | 'consumed';
 }
 /**
  * Lifecycle states of a step-up approval row (mirrors the backend's
@@ -1295,6 +1302,16 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
      * owner approves once. Any deny is still refused. Default: none.
      */
     approvalHeldByRoute?: (req: unknown) => boolean;
+    /**
+     * 5.18.0: what happens to a request no configured route matches.
+     * `'pass'` (default): it passes unevaluated — unless
+     * `evaluateAlwaysIfCredentialed` is set and the caller sent an X-Astra-Id,
+     * in which case it's evaluated in observe mode. `'observe'`: any caller
+     * presenting AstraSync credentials (X-Astra-Id, API key or JWT) is
+     * evaluated in observe mode. Observe never vetoes: the request always
+     * reaches your handler, with `req.agentVerification` populated.
+     */
+    defaultRoutePolicy?: 'pass' | 'observe';
     /**
      * Refresh interval (ms) for the remote-fetched route policy. Default:
      * 5 minutes. Operators can shorten this to test policy edits faster, or
@@ -2968,9 +2985,10 @@ declare function verifyACPSignature(input: ACPVerifyInput): Promise<ACPVerifyRes
 /**
  * MPP (Machine Payments Protocol) extractor.
  *
- * Wraps mppx (wevm) — pinned to 0.5.13, wrapped behind this adapter so
- * upgrades localise here. MPP launched March 18 2026 (Stripe + Tempo +
- * Paradigm), IETF draft-ryan-httpauth-payment-01.
+ * Wraps mppx (wevm) — the exact version is pinned in package.json (0.8.2 as
+ * of 5.18.0), wrapped behind this adapter so upgrades localise here. MPP
+ * launched March 18 2026 (Stripe + Tempo + Paradigm), IETF
+ * draft-ryan-httpauth-payment-01.
  *
  * Flow:
  *   Client → GET /resource
@@ -5148,7 +5166,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.17.2";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.18.0";
 declare const sdkFetch: typeof fetch;
 
 interface LocalPolicy {
@@ -5266,7 +5284,7 @@ declare function parseYaml(yamlContent: string): ParseResult;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.17.2";
+declare const SDK_VERSION = "5.18.0";
 
 /**
  * 5.15.0 — the `UCP-Agent` request header (UCP 2026-08-25): an RFC 8941
@@ -5357,9 +5375,16 @@ interface BuildProfileOptions {
     paymentHandlers?: string[];
     /** Accept AP2 mandates (adds dev.ucp.common.payment.ap2_mandate). */
     ap2Mandates?: boolean;
+    /**
+     * 5.18.0: advertise the order capability (`dev.ucp.shopping.order`) —
+     * `GET /orders/{id}` and order webhooks. The checkout kit serves both.
+     */
+    orders?: boolean;
     /** Extra capabilities beyond checkout (e.g. order). */
     capabilities?: Record<string, UcpCapabilityEntry[]>;
 }
+/** 5.18.0: the order capability id. */
+declare const UCP_ORDER_CAPABILITY = "dev.ucp.shopping.order";
 declare function buildUcpProfile(opts: BuildProfileOptions): UcpProfile;
 /** A fetch-style handler for GET /.well-known/ucp. */
 declare function ucpProfileHandler(profile: UcpProfile, maxAgeSec?: number): () => Promise<Response>;
@@ -5630,6 +5655,16 @@ declare function idempotencyMiddleware(opts: IdempotencyOptions): (req: ExpressR
 /** Next.js / fetch-style route handler wrapper. */
 declare function withIdempotency(opts: IdempotencyOptions, handler: (req: Request) => Promise<Response>): (req: Request) => Promise<Response>;
 
+/** Per-request context a host adapter (e.g. `expressHandler`) passes to `kit.handle`. */
+interface KitRequestContext {
+    /**
+     * The caller's VERIFIED ASTRA-id (e.g. from `req.agentVerification` after
+     * the AstraSync middleware ran). Sessions and idempotency keys are scoped
+     * to it; without it the kit falls back to Authorization, then X-Astra-Id.
+     */
+    callerId?: string;
+}
+
 interface CatalogItem {
     id: string;
     title: string;
@@ -5662,6 +5697,23 @@ interface CheckoutSession {
         permalink_url?: string;
     };
     /** Kit state (never serialised). */
+    /** 5.18.0: hashed caller scope (see `KitRequestContext`). */
+    _caller?: string;
+    /** 5.18.0: the detached merchant_authorization last sent, and the hash of the view it signs. */
+    _merchantAuth?: string;
+    _merchantAuthFor?: string;
+    /** 5.18.0: a settlement the processor hasn't confirmed yet (see `resolvePending`). */
+    _pending?: {
+        orderId?: string;
+        report: {
+            amountMinor: number;
+            currency: string;
+        };
+        /** The verification result, minus merchant-lane secrets. */
+        result: VerificationResult;
+    };
+    /** 5.18.0: the platform's order webhook URL from its profile, when it declared one. */
+    _webhookUrl?: string;
     _platformProfile?: string;
     _ap2?: boolean;
     _platformKeys?: JWK[];
@@ -5675,12 +5727,80 @@ interface CheckoutSession {
 interface CheckoutStore {
     get(id: string): Promise<CheckoutSession | null>;
     put(s: CheckoutSession): Promise<void>;
+    /**
+     * 5.18.0: compare-and-set the session's status — set it to `to` only when
+     * it is currently `from`; true when this call won. `complete` claims
+     * `complete_in_progress` with it so concurrent completes can't both
+     * charge. Implement it atomically (e.g. `UPDATE … WHERE status = $from`).
+     * Without it the kit warns once and the lock is best-effort.
+     */
+    claim?(id: string, from: CheckoutSession['status'], to: CheckoutSession['status']): Promise<boolean>;
+    /** 5.18.0: the session that produced an order (for `GET /orders/{id}`). */
+    findByOrderId?(orderId: string): Promise<CheckoutSession | null>;
 }
 declare class MemoryCheckoutStore implements CheckoutStore {
     private m;
+    private orders;
     get(id: string): Promise<CheckoutSession | null>;
     put(s: CheckoutSession): Promise<void>;
+    claim(id: string, from: CheckoutSession['status'], to: CheckoutSession['status']): Promise<boolean>;
+    findByOrderId(orderId: string): Promise<CheckoutSession | null>;
+}
+/** 5.18.0: a policy link shown with the checkout (part of the signed body). */
+interface UcpLink {
+    type: 'terms_of_service' | 'privacy_policy' | 'refund_policy' | 'shipping_policy' | 'faq' | (string & {});
+    url: string;
+    title?: string;
 }
+/** 5.18.0: the order entity (`dev.ucp.shopping.order`). */
+interface UcpOrder {
+    ucp: {
+        version: string;
+        capabilities: Record<string, Array<{
+            version: string;
+        }>>;
+    };
+    id: string;
+    checkout_id: string;
+    permalink_url?: string;
+    currency: string;
+    line_items: Array<{
+        id: string;
+        item: CatalogItem;
+        quantity: {
+            total: number;
+            fulfilled: number;
+        };
+        totals: Array<{
+            type: string;
+            amount: number;
+        }>;
+        status: 'processing' | 'fulfilled' | 'removed';
+    }>;
+    fulfillment: {
+        expectations: unknown[];
+        events: unknown[];
+    };
+    adjustments: unknown[];
+    totals: Array<{
+        type: string;
+        amount: number;
+    }>;
+}
+/** 5.18.0: the order entity for a completed checkout, or null when it has no order yet. */
+declare function buildUcpOrder(session: CheckoutSession, opts?: {
+    version?: string;
+}): UcpOrder | null;
+/** 5.18.0: the outcome your processor reported for a pending settlement. */
+type PendingResolution = {
+    status: 'settled';
+    processorRef?: string;
+    txHash?: string;
+    chainId?: number;
+} | {
+    status: 'failed';
+    failureCode?: string;
+};
 type SettleResult = {
     status: 'settled';
     processorRef?: string;
@@ -5743,11 +5863,69 @@ interface UcpCheckoutKitOptions {
     fallbackContinueUrl?: string;
     /** Profile fetch override (tests). */
     fetchProfile?: (url: string, fresh: boolean) => Promise<UcpProfile | UcpDiscoveryError>;
+    /**
+     * 5.18.0: policy links (terms of service, privacy, refund, shipping, FAQ)
+     * returned on every checkout and covered by `ap2.merchant_authorization`.
+     */
+    links?: UcpLink[];
+    /**
+     * 5.18.0: the caller's verified ASTRA-id for scoping sessions and
+     * idempotency keys (default: `ctx.callerId`, then Authorization, then
+     * X-Astra-Id, then the platform profile).
+     */
+    resolveCallerId?: (req: Request) => string | undefined | Promise<string | undefined>;
+    /**
+     * 5.18.0: the protocol identities to bind `UCP-Agent` against (default
+     * `result.agent.protocolIdentities` from `verifyPurchase`).
+     */
+    resolveIdentities?: (req: Request, result: VerificationResult) => AgentProtocolIdentities | undefined | Promise<AgentProtocolIdentities | undefined>;
+    /**
+     * 5.18.0: how `UCP-Agent` is bound to the verified agent after
+     * `verifyPurchase` (a mismatch never settles).
+     * - `'registered'` (default): refuse a profile that differs from the one
+     *   the agent registered; an agent with no registered profile passes (e.g.
+     *   calls relayed by the AstraSync bridge under its own profile).
+     * - `'strict'`: `checkUcpAgentBinding` verbatim — also refuses agents with
+     *   no registered profile.
+     * - `'off'`: no binding check.
+     */
+    ucpAgentBinding?: 'registered' | 'strict' | 'off';
+    /** 5.18.0: `permalink_url` = `${permalinkBase}/${orderId}` when `fulfil` returns none. */
+    permalinkBase?: string;
+    /**
+     * 5.18.0: send signed order webhooks (`sendUcpWebhook`, full order entity)
+     * when an order is created — including from `resolvePending` — and on
+     * `kit.sendOrderWebhook(sessionId)` after you update it.
+     */
+    webhook?: {
+        /** Default: the platform profile's `dev.ucp.shopping.order` `config.webhook_url`. */
+        url?: string;
+        /** Default: `signingKey.privateKey`. */
+        privateKey?: KeyObject | string;
+        /** Default: `signingKey.kid`. */
+        keyId?: string;
+        /** Default: `/.well-known/ucp` on the origin of `profile.endpoint`. */
+        businessProfileUrl?: string;
+        attempts?: number;
+        fetch?: typeof fetch;
+        /** Delivery outcome of the background sends. */
+        onResult?: (r: {
+            ok: boolean;
+            status: number;
+            attempts: number;
+        }, order: UcpOrder) => void;
+    };
 }
 declare function createUcpCheckoutKit(opts: UcpCheckoutKitOptions): {
-    handle: (req: Request) => Promise<Response>;
+    handle: (req: Request, reqCtx?: KitRequestContext) => Promise<Response>;
     profile: UcpProfile;
     profileHandler: () => Response;
+    resolvePending: (sessionId: string, outcome: PendingResolution) => Promise<CheckoutSession | null>;
+    sendOrderWebhook: (sessionId: string) => Promise<{
+        ok: boolean;
+        status: number;
+        attempts: number;
+    } | null>;
 };
 
 /** RFC 8785-style canonical JSON (sorted keys, no whitespace). */
@@ -5841,6 +6019,7 @@ interface MppChallenge {
     expires?: string;
     digest?: string;
     description?: string;
+    /** base64url (no padding) of the canonical JSON correlation map (mppx `meta`). */
     opaque?: string;
     header?: 'Payment-Authorization';
 }
@@ -5862,14 +6041,75 @@ interface MppReceipt {
  */
 declare function buildMppChallenge(input: Omit<MppChallenge, 'id' | 'request'> & {
     request: Record<string, unknown>;
+    /** 5.18.0: correlation data, encoded into `opaque` (mppx `meta`). */
+    meta?: Record<string, string>;
 }, hmacSecret: string): {
     challenge: MppChallenge;
     header: string;
 };
 /** Decode `Authorization: Payment <…>` (or Payment-Authorization). */
 declare function parseMppCredential(header: string | null | undefined): MppCredential | null;
+/**
+ * 5.18.0: remembers which challenges were already redeemed, so a credential
+ * is accepted once. `consume` returns true the first time an id is seen
+ * (atomically, e.g. Redis `SET NX PX`) and false after; `expiresAt` (epoch
+ * ms) says how long the id must be kept.
+ */
+interface MppChallengeStore {
+    consume(id: string, expiresAt: number): Promise<boolean>;
+}
+/** In-process {@link MppChallengeStore} (single instance / tests). */
+declare class MemoryMppChallengeStore implements MppChallengeStore {
+    /** Kept this long when the challenge has no `expires`. Default 1 h. */
+    private defaultTtlMs;
+    private now;
+    private seen;
+    constructor(
+    /** Kept this long when the challenge has no `expires`. Default 1 h. */
+    defaultTtlMs?: number, now?: () => number);
+    consume(id: string, expiresAt: number): Promise<boolean>;
+}
+interface MppVerifyOptions {
+    now?: Date;
+    /**
+     * The request body the credential was sent with. Required when the
+     * challenge carries a `digest` (`sha-256=<base64 SHA-256 of the body>`).
+     */
+    body?: string | Uint8Array;
+    /** Accept each challenge once (see {@link MppChallengeStore}). */
+    store?: MppChallengeStore;
+}
+type MppVerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'invalid_id' | 'expired' | 'body_required' | 'digest_mismatch' | 'already_used';
+};
+/** `sha-256=<base64>` of a body (the MPP `digest` parameter). */
+declare function mppBodyDigest(body: string | Uint8Array): string;
 /** True when the echoed challenge is one this server issued (and isn't expired). */
 declare function verifyMppChallenge(challenge: MppChallenge, hmacSecret: string, now?: Date): boolean;
+/**
+ * 5.18.0: the full check — issued here, not expired, the body matches the
+ * challenge `digest`, and (with `store`) not redeemed before. The challenge
+ * is consumed only when every other check passed.
+ */
+declare function verifyMppChallenge(challenge: MppChallenge, hmacSecret: string, options: MppVerifyOptions): Promise<MppVerifyResult>;
+/**
+ * 5.18.0: the 402 response carrying one or more challenges — one
+ * `WWW-Authenticate` per offered method, `Cache-Control: no-store` (a
+ * challenge is single-use), and an RFC 9457 problem body.
+ */
+declare function buildMpp402Response(challenges: string | {
+    header: string;
+} | Array<string | {
+    header: string;
+}>, problem?: {
+    title?: string;
+    detail?: string;
+    type?: string;
+    instance?: string;
+}): Response;
 /** The decoded method request from a challenge. */
 declare function decodeMppRequest(challenge: MppChallenge): Record<string, unknown> | null;
 /** `Payment-Receipt` header value — 2xx responses only. */
@@ -6064,6 +6304,8 @@ declare function aepPublicKeyDocument(keys: Array<{
 };
 
 declare const ACP_API_VERSION = "2026-04-17";
+/** 5.18.0: `API-Version` values this kit serves. */
+declare const ACP_SUPPORTED_API_VERSIONS: readonly string[];
 type AcpStatus = 'not_ready_for_payment' | 'ready_for_payment' | 'pending_approval' | 'complete_in_progress' | 'completed' | 'canceled';
 interface AcpMessage {
     type: 'error' | 'info' | 'warning';
@@ -6099,9 +6341,27 @@ interface AcpCheckoutSession {
     messages: AcpMessage[];
     continue_url?: string;
     order?: Record<string, unknown>;
+    /** 5.18.0: hashed caller scope (was the raw Authorization header). */
     _caller?: string;
     _astraCheckoutSessionId?: string;
+    /** 5.18.0: a settlement the processor hasn't confirmed yet (see `resolvePending`). */
+    _pending?: {
+        orderId?: string;
+        report: {
+            amountMinor: number;
+            currency: string;
+        };
+        result: VerificationResult;
+    };
+}
+/** 5.18.0: the ACP kit's session store (`claim` and the memory default as in the UCP kit). */
+interface AcpCheckoutStore {
+    get(id: string): Promise<AcpCheckoutSession | null>;
+    put(s: AcpCheckoutSession): Promise<void>;
+    /** Atomic compare-and-set of `status` (see the UCP `CheckoutStore.claim`). */
+    claim?(id: string, from: AcpStatus, to: AcpStatus): Promise<boolean>;
 }
+type AcpCheckoutStatus = AcpStatus;
 interface AcpCheckoutKitOptions {
     currency: string;
     /** Payment handlers you accept (endpoint paymentHandlers), e.g. ['ai.astrasync.voucher']. */
@@ -6130,17 +6390,135 @@ interface AcpCheckoutKitOptions {
     }>;
     /** Base path the kit is mounted at (default ''). */
     basePath?: string;
-    store?: {
-        get(id: string): Promise<AcpCheckoutSession | null>;
-        put(s: AcpCheckoutSession): Promise<void>;
-    };
+    store?: AcpCheckoutStore;
     idempotencyStore?: IdempotencyStore;
     fallbackContinueUrl?: string;
+    /**
+     * 5.18.0: the caller's verified ASTRA-id for scoping sessions and
+     * idempotency keys (default: `ctx.callerId`, then Authorization, then X-Astra-Id).
+     */
+    resolveCallerId?: (req: Request) => string | undefined | Promise<string | undefined>;
+    /** 5.18.0: `permalink_url` = `${permalinkBase}/${orderId}` when `fulfil` returns none. */
+    permalinkBase?: string;
+}
+/** 5.18.0: inputs for {@link buildAcpWellKnown}. */
+interface AcpWellKnownOptions {
+    /** Absolute base URL the checkout routes are served under. */
+    endpoint: string;
+    /** Payment handlers you accept, e.g. ['ai.astrasync.voucher']. */
+    paymentHandlers: string[];
+    /** Default {@link ACP_SUPPORTED_API_VERSIONS}. */
+    apiVersions?: readonly string[];
+    /** Policy links (terms of use, privacy, …). */
+    links?: Array<{
+        type: string;
+        url: string;
+        title?: string;
+    }>;
 }
+/** The `capabilities.payment.handlers` entries for AstraSync handler names. */
+declare function acpPaymentHandlers(names: string[]): {
+    id: string;
+    name: string;
+    version: string;
+    spec: string;
+    requires_delegate_payment: boolean;
+    requires_pci_compliance: boolean;
+    psp: string;
+    config_schema: string;
+    instrument_schemas: never[];
+    config: {};
+    display_order: number;
+}[];
+/**
+ * 5.18.0: a discovery document for your ACP endpoint (serve it at e.g.
+ * `/.well-known/acp.json`): the API versions you speak, where the checkout
+ * routes live, and the payment handlers you accept.
+ */
+declare function buildAcpWellKnown(opts: AcpWellKnownOptions): {
+    links?: {
+        type: string;
+        url: string;
+        title?: string;
+    }[] | undefined;
+    protocol: "acp";
+    api_versions: string[];
+    endpoint: string;
+    capabilities: {
+        payment: {
+            handlers: {
+                id: string;
+                name: string;
+                version: string;
+                spec: string;
+                requires_delegate_payment: boolean;
+                requires_pci_compliance: boolean;
+                psp: string;
+                config_schema: string;
+                instrument_schemas: never[];
+                config: {};
+                display_order: number;
+            }[];
+        };
+    };
+};
 declare function createAcpCheckoutKit(opts: AcpCheckoutKitOptions): {
-    handle: (req: Request) => Promise<Response>;
+    handle: (req: Request, reqCtx?: KitRequestContext) => Promise<Response>;
+    resolvePending: (sessionId: string, outcome: PendingResolution) => Promise<AcpCheckoutSession | null>;
 };
 
+/**
+ * 5.18.0 — mount a fetch-style checkout kit (`createUcpCheckoutKit`,
+ * `createAcpCheckoutKit`) on Express.
+ *
+ *   app.use('/ucp/v1', express.raw({ type: '*\/*' }), expressHandler(ucpKit));
+ *
+ * The kit checks RFC 9421 signatures and Content-Digest / idempotency
+ * fingerprints over the EXACT request bytes, so give it the raw body: mount
+ * `express.raw()` on the kit's routes (req.body is a Buffer), or keep a copy
+ * on `req.rawBody` (Buffer or string) in your JSON parser's `verify` hook.
+ * A body that was already parsed to an object is re-serialised with
+ * JSON.stringify — fine for unsigned traffic, but signatures won't verify.
+ *
+ * When the AstraSync middleware ran first, the caller's verified ASTRA-id
+ * (`req.agentVerification.agent.astraId`) scopes sessions and idempotency
+ * keys; override with `callerId`.
+ */
+
+/** Anything with a fetch-style `handle` (both checkout kits). */
+interface FetchKit {
+    handle(req: Request, ctx?: KitRequestContext): Promise<Response>;
+}
+/** The parts of an Express request this adapter reads. */
+interface KitExpressRequest {
+    method: string;
+    protocol?: string;
+    originalUrl?: string;
+    url: string;
+    headers: Record<string, string | string[] | undefined>;
+    body?: unknown;
+    rawBody?: unknown;
+    get?(name: string): string | undefined;
+    agentVerification?: {
+        identityVerified?: boolean;
+        agent?: {
+            astraId?: string;
+        };
+    };
+}
+/** The parts of an Express response this adapter writes. */
+interface KitExpressResponse {
+    status(code: number): unknown;
+    setHeader(name: string, value: string | string[]): unknown;
+    end(body?: unknown): unknown;
+}
+interface ExpressHandlerOptions {
+    /** The caller's verified ASTRA-id (default: from `req.agentVerification` when identity-verified). */
+    callerId?: (req: KitExpressRequest) => string | undefined;
+}
+/** An Express handler that runs a checkout kit and writes its Response back. */
+declare function expressHandler(kit: FetchKit, options?: ExpressHandlerOptions): (req: KitExpressRequest, res: KitExpressResponse, next: (err?: unknown) => void) => Promise<void>;
+
 interface IssueDelegateOptions {
     /** The mandate object (e.g. `{ vct: 'mandate.checkout.1', … }`). */
     mandate: Record<string, unknown>;
@@ -6388,4 +6766,4 @@ declare function contentDigest(body: string): string;
  */
 declare function signHttpRequest(req: SignableRequest, opts: SignHttpRequestOptions): Promise<Record<string, string>>;
 
-export { ACP_API_VERSION, AEP_SPEC_VERSION, AP2_VCT, type AcpCheckoutKitOptions, type AcpCheckoutSession, type AepActorType, type AepArtifactRecord, type AepArtifactType, AepChain, type AepChainOptions, type AepChainVerification, type AepHashInput, AgentClient, type AgentCredentials, type AgentProtocol, type AgentProtocolIdentities, type AgentRecord, type Ap2Party, type Ap2VerifyResult, AstraSync, type AstraSyncAepEvidence, type AstraSyncConfig, type AstraSyncCredentials, AstraSyncError, type AstraSyncMandates, type AttemptOutcome, type AttemptReport, AuthenticationError, type BuildGuidanceParams, CAPTURE_SCHEMA_VERSION, type CallerMetadata, ChallengeHandler, type CommerceArtifactsPayload, type CommerceContext, type CommercePipelineInput, type CommerceShieldProps, type ConsiderationItem, type ConsiderationSet, type CounterpartyType, DECLARED_SOURCE_MAX, DEFAULT_EDGE_CONFIG, DEFAULT_IDEMPOTENCY_TTL_MS, type DynamicPlatformFingerprint, type EdgeConfig, type EdgeMode, type EdgePathRule, type EdgeVerificationDepth, type EnhancedVerificationResult, type ExpressMiddlewareOptions, type FetchEdgeConfigResult, type FetchEdgeConfigSuccess, type FiatSettlementBinding, type FrameworkConfig, type FulfilmentInfo, type GatewayConfig, type GuidanceEnvelope, type GuidanceInfo, type HealthResponse, type HttpSignatureAlgorithm, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, KYDRequiredError, type KyaPayIdentity, type KyaPayResult, type KyaPayTokenType, type KyaPayVerifyOptions, type ParseResult as LocalPolicyParseResult, type ValidationError as LocalPolicyValidationError, type ValidationResult as LocalPolicyValidationResult, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, MCP_VERIFIED_HOP_HEADER, MCP_VERIFIED_HOP_MAX_AGE_MS, type McpMiddlewareOptions, MemoryCheckoutStore, MemoryIdempotencyStore, type MerchantSettlementToken, type ModelConfig, type MppChallenge, type MppCredential, type MppReceipt, type NegotiationResult, type NextJsMiddlewareOptions, type ObservedMetadata, type PDLSSConfig$1 as PDLSSConfig, type PDLSSDuration, type PDLSSInfo, type PDLSSLimits, type PDLSSPurpose, type PDLSSScope, type PDLSSSelfInstantiation, PLATFORM_AGENT_SIGNATURES, type PendingRegistrationResponse, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, type PlatformSignatureDef, type PollRegistrationResult, type ProtocolTransport, RUNTIME_SIGNATURES, RedisIdempotencyStore, type RedisLike, type RegisterOptions, type RegisterResult, RegistrationDeniedError, RegistrationExpiredError, type RegistrationResponse, RegistrationTimeoutError, type ReportAttemptOptions, type RootKeyResolver, type RouteAccessConfig, type RoutePolicy, type RuntimeChallengeResult, type RuntimeSignature, type SDKOptions, SDK_USER_AGENT, type SanitizeHeadersResult, type SettlementArtifact, type SettlementArtifactBinding, type SettlementArtifactBindingBase, type SettlementDecision, type SettlementOutcomeInfo, SettlementReportError, type SettlementRequest, type SignHttpRequestOptions, type SignableRequest, type StablecoinSettlementBinding, type StepUpApprovalInfo, type StepUpApprovalStatus, type StepUpOutcome, TRUST_LEVEL_RANGES, type TokenGuidance, type ToolGate, type ToolGateConfig, type TrustLevel, UCP_VERSION, type UcpAgentBinding, type CatalogItem as UcpCatalogItem, type UcpCheckoutKitOptions, type CheckoutSession as UcpCheckoutSession, type CheckoutStore as UcpCheckoutStore, type UcpMessage, type UcpProfile, type UcpProfileResult, type SettleResult as UcpSettleResult, type UcpSeverity, type UcpSignatureResult, VERIFICATION_STATUS_HEADER, SDK_VERSION as VERSION, type VerificationInterstitialProps, type VerificationRequest, type VerificationResult, type VerifiedAgent, type VerifiedDeveloper, type VerifiedHopMarker, type VerifiedOrganization, type VerifyAp2Options, type VerifyOptions, type VerifyResponse, type WaitForApprovalOptions, type WellKnownAgenticCommerce, type X402PaymentPayload, type X402PaymentRequired, type X402PaymentRequirements, type X402ResourceInfo, type X402SettlementResponse, _resetEdgeConfigCache, aepCanonicalJson, aepHash, aepPrivateKeyFromSeed, aepPublicKeyDocument, aepPublicKeyFromBase64, aepRawPublicKey, aepSign, aepTimestamp, aepVerifySignature, index as agent, astrasyncPaymentHandlers, authorizeSettlement, awaitStepUpApproval, beginIdempotent, buildGuidance, buildMppChallenge, buildSdkObservedMetadata, buildUcpProfile, buildVerificationUnavailableBody, buildX402Challenge, canonicalJson, checkUcpAgentBinding, checkoutHash, clearCache, closedCheckoutMandate, closedPaymentMandate, contentDigest, createAcpCheckoutKit, createKbHop, createMcpMiddleware, createUcpCheckoutKit, decodeMppRequest, degradeToObserve, denyStatusFor, deriveConnectionFromHeaders, detectPlatformFingerprint, detectRuntime, encodeMppReceipt, encodeX402SettlementResponse, express, extractApiKeyFormat, extractCredentials, extractMcpCredentials, extractPlatformHeaders, fetchEdgeConfig, fetchRoutes, fetchUcpProfile, finishIdempotent, getCachedWellKnownUrls, getEdgeConfig, getTrustLevel, getWellKnownUrls, hasCredentials, idempotencyMiddleware, isEdgeConfig, isRejectedIdentityClaim, isRetryableSettlementError, isSpecialUseIp, isVerificationUnavailable, isVerifiedHopValidFor, issueDelegateSdJwt, matchEdgePathRule, matchPlatformSignature, matchRoutePattern, negotiateUcp, nextjs, normalizeDeclaredSource, openCheckoutMandate, openPaymentMandate, parseYaml as parseLocalPolicyYaml, parseMppCredential, parseUcpAgentHeader, parseVerifiedHop, parseX402Challenge, parseX402Payment, pollStepUpStatus, prefetchWellKnown, quickVerify, recordDecision, reportAttempt, reportUnregisteredAttempt, requestFingerprint, rootMandateDigest, routePatternToRegExp, routePolicyOf, sanitizeHeaders, sdk, sdkFetch, sendUcpWebhook, serializeVerifiedHop, setMcpMeta, signHttpRequest, signRootMandate, signUcpRequest, signUcpResponse, index$1 as transport, ucpError, ucpEscalation, ucpFailure, ucpProfileHandler, ucpRequiredComponents, unavailableRetryAfterSeconds, validatePolicy as validateLocalPolicy, verify, verifyAepChain, verifyAp2Mandate, verifyDelegateChain, verifyKyaPayTokens, verifyMppChallenge, verifyUcpRequest, withIdempotency, x402PaymentMatchesOffer };
+export { ACP_API_VERSION, ACP_SUPPORTED_API_VERSIONS, AEP_SPEC_VERSION, AP2_VCT, type AcpCheckoutKitOptions, type AcpCheckoutSession, type AcpCheckoutStatus, type AcpCheckoutStore, type AcpWellKnownOptions, type AepActorType, type AepArtifactRecord, type AepArtifactType, AepChain, type AepChainOptions, type AepChainVerification, type AepHashInput, AgentClient, type AgentCredentials, type AgentProtocol, type AgentProtocolIdentities, type AgentRecord, type Ap2Party, type Ap2VerifyResult, AstraSync, type AstraSyncAepEvidence, type AstraSyncConfig, type AstraSyncCredentials, AstraSyncError, type AstraSyncMandates, type AttemptOutcome, type AttemptReport, AuthenticationError, type BuildGuidanceParams, CAPTURE_SCHEMA_VERSION, type CallerMetadata, ChallengeHandler, type CommerceArtifactsPayload, type CommerceContext, type CommercePipelineInput, type CommerceShieldProps, type ConsiderationItem, type ConsiderationSet, type CounterpartyType, DECLARED_SOURCE_MAX, DEFAULT_EDGE_CONFIG, DEFAULT_IDEMPOTENCY_TTL_MS, type DynamicPlatformFingerprint, type EdgeConfig, type EdgeMode, type EdgePathRule, type EdgeVerificationDepth, type EnhancedVerificationResult, type ExpressHandlerOptions, type ExpressMiddlewareOptions, type FetchEdgeConfigResult, type FetchEdgeConfigSuccess, type FetchKit, type FiatSettlementBinding, type FrameworkConfig, type FulfilmentInfo, type GatewayConfig, type GuidanceEnvelope, type GuidanceInfo, type HealthResponse, type HttpSignatureAlgorithm, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, KYDRequiredError, type KitExpressRequest, type KitExpressResponse, type KitRequestContext, type KyaPayIdentity, type KyaPayResult, type KyaPayTokenType, type KyaPayVerifyOptions, type ParseResult as LocalPolicyParseResult, type ValidationError as LocalPolicyValidationError, type ValidationResult as LocalPolicyValidationResult, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, MCP_VERIFIED_HOP_HEADER, MCP_VERIFIED_HOP_MAX_AGE_MS, type McpMiddlewareOptions, MemoryCheckoutStore, MemoryIdempotencyStore, MemoryMppChallengeStore, type MerchantSettlementToken, type ModelConfig, type MppChallenge, type MppChallengeStore, type MppCredential, type MppReceipt, type MppVerifyOptions, type MppVerifyResult, type NegotiationResult, type NextJsMiddlewareOptions, type ObservedMetadata, type PDLSSConfig$1 as PDLSSConfig, type PDLSSDuration, type PDLSSInfo, type PDLSSLimits, type PDLSSPurpose, type PDLSSScope, type PDLSSSelfInstantiation, PLATFORM_AGENT_SIGNATURES, type PendingRegistrationResponse, type PendingResolution, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, type PlatformSignatureDef, type PollRegistrationResult, type ProtocolTransport, RUNTIME_SIGNATURES, RedisIdempotencyStore, type RedisLike, type RegisterOptions, type RegisterResult, RegistrationDeniedError, RegistrationExpiredError, type RegistrationResponse, RegistrationTimeoutError, type ReportAttemptOptions, type RootKeyResolver, type RouteAccessConfig, type RoutePolicy, type RuntimeChallengeResult, type RuntimeSignature, type SDKOptions, SDK_USER_AGENT, type SanitizeHeadersResult, type SettlementArtifact, type SettlementArtifactBinding, type SettlementArtifactBindingBase, type SettlementDecision, type SettlementOutcomeInfo, SettlementReportError, type SettlementRequest, type SignHttpRequestOptions, type SignableRequest, type StablecoinSettlementBinding, type StepUpApprovalInfo, type StepUpApprovalStatus, type StepUpOutcome, TRUST_LEVEL_RANGES, type TokenGuidance, type ToolGate, type ToolGateConfig, type TrustLevel, UCP_ORDER_CAPABILITY, UCP_VERSION, type UcpAgentBinding, type CatalogItem as UcpCatalogItem, type UcpCheckoutKitOptions, type CheckoutSession as UcpCheckoutSession, type CheckoutStore as UcpCheckoutStore, type UcpLink, type UcpMessage, type UcpOrder, type UcpProfile, type UcpProfileResult, type SettleResult as UcpSettleResult, type UcpSeverity, type UcpSignatureResult, VERIFICATION_STATUS_HEADER, SDK_VERSION as VERSION, type VerificationInterstitialProps, type VerificationRequest, type VerificationResult, type VerifiedAgent, type VerifiedDeveloper, type VerifiedHopMarker, type VerifiedOrganization, type VerifyAp2Options, type VerifyOptions, type VerifyResponse, type WaitForApprovalOptions, type WellKnownAgenticCommerce, type X402PaymentPayload, type X402PaymentRequired, type X402PaymentRequirements, type X402ResourceInfo, type X402SettlementResponse, _resetEdgeConfigCache, acpPaymentHandlers, aepCanonicalJson, aepHash, aepPrivateKeyFromSeed, aepPublicKeyDocument, aepPublicKeyFromBase64, aepRawPublicKey, aepSign, aepTimestamp, aepVerifySignature, index as agent, astrasyncPaymentHandlers, authorizeSettlement, awaitStepUpApproval, beginIdempotent, buildAcpWellKnown, buildGuidance, buildMpp402Response, buildMppChallenge, buildSdkObservedMetadata, buildUcpOrder, buildUcpProfile, buildVerificationUnavailableBody, buildX402Challenge, canonicalJson, checkUcpAgentBinding, checkoutHash, clearCache, closedCheckoutMandate, closedPaymentMandate, contentDigest, createAcpCheckoutKit, createKbHop, createMcpMiddleware, createUcpCheckoutKit, decodeMppRequest, degradeToObserve, denyStatusFor, deriveConnectionFromHeaders, detectPlatformFingerprint, detectRuntime, encodeMppReceipt, encodeX402SettlementResponse, express, expressHandler, extractApiKeyFormat, extractCredentials, extractMcpCredentials, extractPlatformHeaders, fetchEdgeConfig, fetchRoutes, fetchUcpProfile, finishIdempotent, getCachedWellKnownUrls, getEdgeConfig, getTrustLevel, getWellKnownUrls, hasCredentials, idempotencyMiddleware, isEdgeConfig, isRejectedIdentityClaim, isRetryableSettlementError, isSpecialUseIp, isVerificationUnavailable, isVerifiedHopValidFor, issueDelegateSdJwt, matchEdgePathRule, matchPlatformSignature, matchRoutePattern, mppBodyDigest, negotiateUcp, nextjs, normalizeDeclaredSource, openCheckoutMandate, openPaymentMandate, parseYaml as parseLocalPolicyYaml, parseMppCredential, parseUcpAgentHeader, parseVerifiedHop, parseX402Challenge, parseX402Payment, pollStepUpStatus, prefetchWellKnown, quickVerify, recordDecision, reportAttempt, reportUnregisteredAttempt, requestFingerprint, rootMandateDigest, routePatternToRegExp, routePolicyOf, sanitizeHeaders, sdk, sdkFetch, sendUcpWebhook, serializeVerifiedHop, setMcpMeta, signHttpRequest, signRootMandate, signUcpRequest, signUcpResponse, index$1 as transport, ucpError, ucpEscalation, ucpFailure, ucpProfileHandler, ucpRequiredComponents, unavailableRetryAfterSeconds, validatePolicy as validateLocalPolicy, verify, verifyAepChain, verifyAp2Mandate, verifyDelegateChain, verifyKyaPayTokens, verifyMppChallenge, verifyUcpRequest, withIdempotency, x402PaymentMatchesOffer };