@astrasyncai/verification-gateway 5.18.1 → 5.19.0

package/dist/{types-3ObBpsnf.d.mts → types-BoGjyon0.d.mts}

@@ -161,9 +161,15 @@ interface VerifiedAgent {
     astraId: string;
     /** Agent display name */
     name: string;
-    /** Composite trust score (0-100) */
+    /**
+     * Composite trust score (0-100). 5.19.0: verify-access returns it to an
+     * authenticated counterparty (your API key) — counterparties may see an
+     * agent's score; the agent itself never does, so never relay it to the
+     * agent. It is withheld (undefined at runtime) for a keyless caller and when
+     * the caller is the agent itself; a route `minTrustScore` then fails closed.
+     */
     trustScore: number;
-    /** Trust level tier */
+    /** Trust level tier (derived from `trustScore`) */
     trustLevel: TrustLevel;
     /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
     blockchainAnchored: boolean;
@@ -359,6 +365,20 @@ interface SettlementArtifact {
  *   - `counterparty.<allowlist|trust>`
  *   - `attestation.<type>` (e.g. `attestation.verified_human_party`)
  *   - `endpoint.<deactivated|trust|policy>`
+ *   - `behaviour.<limit_probing|unattributed_limit_check>` (5.19.0) — the
+ *     call is part of a sweep of unfinished attempts at rising values (quotes,
+ *     held/denied confirms, orders that never settled) that maps the agent's
+ *     spending limit. Completed purchases never count.
+ *     - `behaviour.limit_probing`: the sweep is provably the agent's own
+ *       (signed agent request, first-party bridge hop, runtime challenge or
+ *       the agent's key). Denied with no new step-up approval; the agent's
+ *       trust drops and its owner is alerted.
+ *     - `behaviour.unattributed_limit_check`: the sweep can't be attributed
+ *       to the agent (unsigned or direct merchant calls). Denied — it "needs
+ *       a signed agent request" — with no agent trust penalty; owners are
+ *       alerted with the evidence. A repeat of the merchant's own direct
+ *       calls, or the same pattern across agents of two or more owners,
+ *       reduces the endpoint owner's trust score.
  */
 interface AccessFailure {
     dimension: string;
@@ -638,6 +658,46 @@ interface CallerMetadata {
      */
     observedMetadata?: ObservedMetadata;
 }
+/**
+ * 5.19.0 — the inbound agent request behind a kit confirm, forwarded so
+ * verify-access can tell whether the confirm is provably the agent's own
+ * (limit-probing attribution). The kits build it from `handle(req)`.
+ *
+ * - Signed (UCP, RFC 9421): the covered headers (`signature`,
+ *   `signature-input`, `signature-agent`, `ucp-agent`, `content-digest` and
+ *   every other header the signature covers — never `authorization` or
+ *   `cookie`), the method, the PUBLIC request URL (your `publicOrigin` + the
+ *   path and query, so `@target-uri` / `@authority` match what the agent
+ *   signed behind a TLS-terminating proxy) and `contentDigest`, the
+ *   `sha-256=:<base64>:` digest of the exact raw body.
+ * - `{ unsigned: true }`: the inbound request carried no signature, or it
+ *   came over ACP (the ACP `Authorization` bearer is the platform's
+ *   credential to you and is never forwarded, so ACP confirms are
+ *   unattributable). Sent explicitly so the platform can tell a kit relay
+ *   from a direct merchant call.
+ */
+type AgentArtifacts = {
+    unsigned: true;
+    protocol?: 'ucp' | 'acp';
+} | {
+    unsigned?: false;
+    protocol: 'ucp' | 'acp';
+    method: string;
+    /** Absolute public URL of the inbound request. */
+    url: string;
+    /** Lower-cased covered headers. */
+    headers: Record<string, string>;
+    /** `sha-256=:<base64>:` over the raw request body (absent for an empty body). */
+    contentDigest?: string;
+};
+/** 5.19.0 — kit context on a confirm (carried onto the approval and its events). */
+interface CheckoutMetadata {
+    /** The kit's own checkout session id (`chk_…` / `cs_…`). */
+    kitSessionId?: string;
+    protocol?: 'ucp' | 'acp';
+}
+/** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
+type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
 interface VerificationRequest {
     /** Agent credentials */
     credentials: AgentCredentials;
@@ -769,6 +829,25 @@ interface VerificationRequest {
      * from the verify cache key.
      */
     attemptId?: string;
+    /**
+     * 5.19.0 — where `purpose` came from: `'route_config'` (a dashboard route
+     * rule matched this request), `'header'` (the agent's X-Astra-Purpose /
+     * legacy header / query), `'body'` (request-derived by your own
+     * extractor), or `'default'` (derived from the action or the transport
+     * default). Set by the express and Next.js adapters. verify-access keeps a
+     * `'route_config'` purpose over a commerce-derived one (e.g. an MPP paid
+     * leg) only when a stored rule on the endpoint matches `requestMethod` +
+     * `requestPath` with the same purpose and action.
+     */
+    purposeSource?: PurposeSource;
+    /** 5.19.0 — the inbound agent request behind a kit confirm (see {@link AgentArtifacts}). */
+    agentArtifacts?: AgentArtifacts;
+    /** 5.19.0 — kit session id + protocol, stored on any approval this confirm creates. */
+    metadata?: CheckoutMetadata;
+    /** 5.19.0 — the inbound request's HTTP method (for the route-rule check above). */
+    requestMethod?: string;
+    /** 5.19.0 — the inbound request's path, without the query (for the route-rule check above). */
+    requestPath?: string;
     /**
      * 3.12.0 — first-party observational data: the
      * offers the agent evaluated at this checkpoint (catalog browse / intent

package/dist/{types-Cns4l8gX.d.mts → types-DqWPkiYl.d.mts}

@@ -219,9 +219,15 @@ interface VerifiedAgent {
     astraId: string;
     /** Agent display name */
     name: string;
-    /** Composite trust score (0-100) */
+    /**
+     * Composite trust score (0-100). 5.19.0: verify-access returns it to an
+     * authenticated counterparty (your API key) — counterparties may see an
+     * agent's score; the agent itself never does, so never relay it to the
+     * agent. It is withheld (undefined at runtime) for a keyless caller and when
+     * the caller is the agent itself; a route `minTrustScore` then fails closed.
+     */
     trustScore: number;
-    /** Trust level tier */
+    /** Trust level tier (derived from `trustScore`) */
     trustLevel: TrustLevel;
     /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
     blockchainAnchored: boolean;
@@ -417,6 +423,20 @@ interface SettlementArtifact {
  *   - `counterparty.<allowlist|trust>`
  *   - `attestation.<type>` (e.g. `attestation.verified_human_party`)
  *   - `endpoint.<deactivated|trust|policy>`
+ *   - `behaviour.<limit_probing|unattributed_limit_check>` (5.19.0) — the
+ *     call is part of a sweep of unfinished attempts at rising values (quotes,
+ *     held/denied confirms, orders that never settled) that maps the agent's
+ *     spending limit. Completed purchases never count.
+ *     - `behaviour.limit_probing`: the sweep is provably the agent's own
+ *       (signed agent request, first-party bridge hop, runtime challenge or
+ *       the agent's key). Denied with no new step-up approval; the agent's
+ *       trust drops and its owner is alerted.
+ *     - `behaviour.unattributed_limit_check`: the sweep can't be attributed
+ *       to the agent (unsigned or direct merchant calls). Denied — it "needs
+ *       a signed agent request" — with no agent trust penalty; owners are
+ *       alerted with the evidence. A repeat of the merchant's own direct
+ *       calls, or the same pattern across agents of two or more owners,
+ *       reduces the endpoint owner's trust score.
  */
 interface AccessFailure {
     dimension: string;
@@ -696,6 +716,46 @@ interface CallerMetadata {
      */
     observedMetadata?: ObservedMetadata;
 }
+/**
+ * 5.19.0 — the inbound agent request behind a kit confirm, forwarded so
+ * verify-access can tell whether the confirm is provably the agent's own
+ * (limit-probing attribution). The kits build it from `handle(req)`.
+ *
+ * - Signed (UCP, RFC 9421): the covered headers (`signature`,
+ *   `signature-input`, `signature-agent`, `ucp-agent`, `content-digest` and
+ *   every other header the signature covers — never `authorization` or
+ *   `cookie`), the method, the PUBLIC request URL (your `publicOrigin` + the
+ *   path and query, so `@target-uri` / `@authority` match what the agent
+ *   signed behind a TLS-terminating proxy) and `contentDigest`, the
+ *   `sha-256=:<base64>:` digest of the exact raw body.
+ * - `{ unsigned: true }`: the inbound request carried no signature, or it
+ *   came over ACP (the ACP `Authorization` bearer is the platform's
+ *   credential to you and is never forwarded, so ACP confirms are
+ *   unattributable). Sent explicitly so the platform can tell a kit relay
+ *   from a direct merchant call.
+ */
+type AgentArtifacts = {
+    unsigned: true;
+    protocol?: 'ucp' | 'acp';
+} | {
+    unsigned?: false;
+    protocol: 'ucp' | 'acp';
+    method: string;
+    /** Absolute public URL of the inbound request. */
+    url: string;
+    /** Lower-cased covered headers. */
+    headers: Record<string, string>;
+    /** `sha-256=:<base64>:` over the raw request body (absent for an empty body). */
+    contentDigest?: string;
+};
+/** 5.19.0 — kit context on a confirm (carried onto the approval and its events). */
+interface CheckoutMetadata {
+    /** The kit's own checkout session id (`chk_…` / `cs_…`). */
+    kitSessionId?: string;
+    protocol?: 'ucp' | 'acp';
+}
+/** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
+type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
 interface VerificationRequest {
     /** Agent credentials */
     credentials: AgentCredentials;
@@ -827,6 +887,25 @@ interface VerificationRequest {
      * from the verify cache key.
      */
     attemptId?: string;
+    /**
+     * 5.19.0 — where `purpose` came from: `'route_config'` (a dashboard route
+     * rule matched this request), `'header'` (the agent's X-Astra-Purpose /
+     * legacy header / query), `'body'` (request-derived by your own
+     * extractor), or `'default'` (derived from the action or the transport
+     * default). Set by the express and Next.js adapters. verify-access keeps a
+     * `'route_config'` purpose over a commerce-derived one (e.g. an MPP paid
+     * leg) only when a stored rule on the endpoint matches `requestMethod` +
+     * `requestPath` with the same purpose and action.
+     */
+    purposeSource?: PurposeSource;
+    /** 5.19.0 — the inbound agent request behind a kit confirm (see {@link AgentArtifacts}). */
+    agentArtifacts?: AgentArtifacts;
+    /** 5.19.0 — kit session id + protocol, stored on any approval this confirm creates. */
+    metadata?: CheckoutMetadata;
+    /** 5.19.0 — the inbound request's HTTP method (for the route-rule check above). */
+    requestMethod?: string;
+    /** 5.19.0 — the inbound request's path, without the query (for the route-rule check above). */
+    requestPath?: string;
     /**
      * 3.12.0 — first-party observational data: the
      * offers the agent evaluated at this checkpoint (catalog browse / intent
@@ -1025,17 +1104,16 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
     /**
      * Posture when the middleware itself throws an internal error (header
      * parsing failure, `fetchRoutes` network error, malformed proxy state,
-     * etc.). Default `'open'` for backward compatibility in SDK 2.4.13 —
-     * legitimate traffic continues to pass through during platform outages.
+     * etc.).
      *
-     * In shadow mode (default), the middleware ALWAYS logs a
-     * `[SHADOW] would-have-denied` line on throws including correlationId so
-     * merchants can grep their own logs for impact analysis. The default
-     * flips to `'closed'` in a follow-up release once the shadow logs confirm
-     * legitimate traffic is unaffected.
+     * 5.19.0 (behaviour change): default `'closed'` — the request is refused
+     * with 503 + Retry-After + `VERIFICATION_UNAVAILABLE` (the
+     * `middleware.internal_error` dimension; never an identity-shaped 401) and
+     * your handler is not called. Set `'open'` explicitly to pass the request
+     * through unverified instead (e.g. small-value demo merchants).
      *
-     * Small-value demo merchants can keep `'open'` indefinitely after the
-     * default flip by setting this explicitly.
+     * The middleware always logs a `[SHADOW] would-have-denied` line on throws
+     * including correlationId, whichever posture is set.
      */
     failOnError?: 'open' | 'closed';
     /**
@@ -1212,4 +1290,4 @@ interface AstraSyncAepEvidence {
     }>;
 }
 
-export type { AgentCredentials as A, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AstraSyncCredentials as a, GuidanceInfo as b, VerificationRequest as c, VerificationResult as d };
+export type { AgentArtifacts as A, CheckoutMetadata as C, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, GuidanceInfo as c, VerificationRequest as d, VerificationResult as e };

package/dist/{types-Cns4l8gX.d.ts → types-DqWPkiYl.d.ts}

@@ -219,9 +219,15 @@ interface VerifiedAgent {
     astraId: string;
     /** Agent display name */
     name: string;
-    /** Composite trust score (0-100) */
+    /**
+     * Composite trust score (0-100). 5.19.0: verify-access returns it to an
+     * authenticated counterparty (your API key) — counterparties may see an
+     * agent's score; the agent itself never does, so never relay it to the
+     * agent. It is withheld (undefined at runtime) for a keyless caller and when
+     * the caller is the agent itself; a route `minTrustScore` then fails closed.
+     */
     trustScore: number;
-    /** Trust level tier */
+    /** Trust level tier (derived from `trustScore`) */
     trustLevel: TrustLevel;
     /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
     blockchainAnchored: boolean;
@@ -417,6 +423,20 @@ interface SettlementArtifact {
  *   - `counterparty.<allowlist|trust>`
  *   - `attestation.<type>` (e.g. `attestation.verified_human_party`)
  *   - `endpoint.<deactivated|trust|policy>`
+ *   - `behaviour.<limit_probing|unattributed_limit_check>` (5.19.0) — the
+ *     call is part of a sweep of unfinished attempts at rising values (quotes,
+ *     held/denied confirms, orders that never settled) that maps the agent's
+ *     spending limit. Completed purchases never count.
+ *     - `behaviour.limit_probing`: the sweep is provably the agent's own
+ *       (signed agent request, first-party bridge hop, runtime challenge or
+ *       the agent's key). Denied with no new step-up approval; the agent's
+ *       trust drops and its owner is alerted.
+ *     - `behaviour.unattributed_limit_check`: the sweep can't be attributed
+ *       to the agent (unsigned or direct merchant calls). Denied — it "needs
+ *       a signed agent request" — with no agent trust penalty; owners are
+ *       alerted with the evidence. A repeat of the merchant's own direct
+ *       calls, or the same pattern across agents of two or more owners,
+ *       reduces the endpoint owner's trust score.
  */
 interface AccessFailure {
     dimension: string;
@@ -696,6 +716,46 @@ interface CallerMetadata {
      */
     observedMetadata?: ObservedMetadata;
 }
+/**
+ * 5.19.0 — the inbound agent request behind a kit confirm, forwarded so
+ * verify-access can tell whether the confirm is provably the agent's own
+ * (limit-probing attribution). The kits build it from `handle(req)`.
+ *
+ * - Signed (UCP, RFC 9421): the covered headers (`signature`,
+ *   `signature-input`, `signature-agent`, `ucp-agent`, `content-digest` and
+ *   every other header the signature covers — never `authorization` or
+ *   `cookie`), the method, the PUBLIC request URL (your `publicOrigin` + the
+ *   path and query, so `@target-uri` / `@authority` match what the agent
+ *   signed behind a TLS-terminating proxy) and `contentDigest`, the
+ *   `sha-256=:<base64>:` digest of the exact raw body.
+ * - `{ unsigned: true }`: the inbound request carried no signature, or it
+ *   came over ACP (the ACP `Authorization` bearer is the platform's
+ *   credential to you and is never forwarded, so ACP confirms are
+ *   unattributable). Sent explicitly so the platform can tell a kit relay
+ *   from a direct merchant call.
+ */
+type AgentArtifacts = {
+    unsigned: true;
+    protocol?: 'ucp' | 'acp';
+} | {
+    unsigned?: false;
+    protocol: 'ucp' | 'acp';
+    method: string;
+    /** Absolute public URL of the inbound request. */
+    url: string;
+    /** Lower-cased covered headers. */
+    headers: Record<string, string>;
+    /** `sha-256=:<base64>:` over the raw request body (absent for an empty body). */
+    contentDigest?: string;
+};
+/** 5.19.0 — kit context on a confirm (carried onto the approval and its events). */
+interface CheckoutMetadata {
+    /** The kit's own checkout session id (`chk_…` / `cs_…`). */
+    kitSessionId?: string;
+    protocol?: 'ucp' | 'acp';
+}
+/** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
+type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
 interface VerificationRequest {
     /** Agent credentials */
     credentials: AgentCredentials;
@@ -827,6 +887,25 @@ interface VerificationRequest {
      * from the verify cache key.
      */
     attemptId?: string;
+    /**
+     * 5.19.0 — where `purpose` came from: `'route_config'` (a dashboard route
+     * rule matched this request), `'header'` (the agent's X-Astra-Purpose /
+     * legacy header / query), `'body'` (request-derived by your own
+     * extractor), or `'default'` (derived from the action or the transport
+     * default). Set by the express and Next.js adapters. verify-access keeps a
+     * `'route_config'` purpose over a commerce-derived one (e.g. an MPP paid
+     * leg) only when a stored rule on the endpoint matches `requestMethod` +
+     * `requestPath` with the same purpose and action.
+     */
+    purposeSource?: PurposeSource;
+    /** 5.19.0 — the inbound agent request behind a kit confirm (see {@link AgentArtifacts}). */
+    agentArtifacts?: AgentArtifacts;
+    /** 5.19.0 — kit session id + protocol, stored on any approval this confirm creates. */
+    metadata?: CheckoutMetadata;
+    /** 5.19.0 — the inbound request's HTTP method (for the route-rule check above). */
+    requestMethod?: string;
+    /** 5.19.0 — the inbound request's path, without the query (for the route-rule check above). */
+    requestPath?: string;
     /**
      * 3.12.0 — first-party observational data: the
      * offers the agent evaluated at this checkpoint (catalog browse / intent
@@ -1025,17 +1104,16 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
     /**
      * Posture when the middleware itself throws an internal error (header
      * parsing failure, `fetchRoutes` network error, malformed proxy state,
-     * etc.). Default `'open'` for backward compatibility in SDK 2.4.13 —
-     * legitimate traffic continues to pass through during platform outages.
+     * etc.).
      *
-     * In shadow mode (default), the middleware ALWAYS logs a
-     * `[SHADOW] would-have-denied` line on throws including correlationId so
-     * merchants can grep their own logs for impact analysis. The default
-     * flips to `'closed'` in a follow-up release once the shadow logs confirm
-     * legitimate traffic is unaffected.
+     * 5.19.0 (behaviour change): default `'closed'` — the request is refused
+     * with 503 + Retry-After + `VERIFICATION_UNAVAILABLE` (the
+     * `middleware.internal_error` dimension; never an identity-shaped 401) and
+     * your handler is not called. Set `'open'` explicitly to pass the request
+     * through unverified instead (e.g. small-value demo merchants).
      *
-     * Small-value demo merchants can keep `'open'` indefinitely after the
-     * default flip by setting this explicitly.
+     * The middleware always logs a `[SHADOW] would-have-denied` line on throws
+     * including correlationId, whichever posture is set.
      */
     failOnError?: 'open' | 'closed';
     /**
@@ -1212,4 +1290,4 @@ interface AstraSyncAepEvidence {
     }>;
 }
 
-export type { AgentCredentials as A, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AstraSyncCredentials as a, GuidanceInfo as b, VerificationRequest as c, VerificationResult as d };
+export type { AgentArtifacts as A, CheckoutMetadata as C, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, GuidanceInfo as c, VerificationRequest as d, VerificationResult as e };

package/dist/{types-BoxZEYPS.d.ts → types-eWyZuz-3.d.ts}

@@ -161,9 +161,15 @@ interface VerifiedAgent {
     astraId: string;
     /** Agent display name */
     name: string;
-    /** Composite trust score (0-100) */
+    /**
+     * Composite trust score (0-100). 5.19.0: verify-access returns it to an
+     * authenticated counterparty (your API key) — counterparties may see an
+     * agent's score; the agent itself never does, so never relay it to the
+     * agent. It is withheld (undefined at runtime) for a keyless caller and when
+     * the caller is the agent itself; a route `minTrustScore` then fails closed.
+     */
     trustScore: number;
-    /** Trust level tier */
+    /** Trust level tier (derived from `trustScore`) */
     trustLevel: TrustLevel;
     /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
     blockchainAnchored: boolean;
@@ -359,6 +365,20 @@ interface SettlementArtifact {
  *   - `counterparty.<allowlist|trust>`
  *   - `attestation.<type>` (e.g. `attestation.verified_human_party`)
  *   - `endpoint.<deactivated|trust|policy>`
+ *   - `behaviour.<limit_probing|unattributed_limit_check>` (5.19.0) — the
+ *     call is part of a sweep of unfinished attempts at rising values (quotes,
+ *     held/denied confirms, orders that never settled) that maps the agent's
+ *     spending limit. Completed purchases never count.
+ *     - `behaviour.limit_probing`: the sweep is provably the agent's own
+ *       (signed agent request, first-party bridge hop, runtime challenge or
+ *       the agent's key). Denied with no new step-up approval; the agent's
+ *       trust drops and its owner is alerted.
+ *     - `behaviour.unattributed_limit_check`: the sweep can't be attributed
+ *       to the agent (unsigned or direct merchant calls). Denied — it "needs
+ *       a signed agent request" — with no agent trust penalty; owners are
+ *       alerted with the evidence. A repeat of the merchant's own direct
+ *       calls, or the same pattern across agents of two or more owners,
+ *       reduces the endpoint owner's trust score.
  */
 interface AccessFailure {
     dimension: string;
@@ -638,6 +658,46 @@ interface CallerMetadata {
      */
     observedMetadata?: ObservedMetadata;
 }
+/**
+ * 5.19.0 — the inbound agent request behind a kit confirm, forwarded so
+ * verify-access can tell whether the confirm is provably the agent's own
+ * (limit-probing attribution). The kits build it from `handle(req)`.
+ *
+ * - Signed (UCP, RFC 9421): the covered headers (`signature`,
+ *   `signature-input`, `signature-agent`, `ucp-agent`, `content-digest` and
+ *   every other header the signature covers — never `authorization` or
+ *   `cookie`), the method, the PUBLIC request URL (your `publicOrigin` + the
+ *   path and query, so `@target-uri` / `@authority` match what the agent
+ *   signed behind a TLS-terminating proxy) and `contentDigest`, the
+ *   `sha-256=:<base64>:` digest of the exact raw body.
+ * - `{ unsigned: true }`: the inbound request carried no signature, or it
+ *   came over ACP (the ACP `Authorization` bearer is the platform's
+ *   credential to you and is never forwarded, so ACP confirms are
+ *   unattributable). Sent explicitly so the platform can tell a kit relay
+ *   from a direct merchant call.
+ */
+type AgentArtifacts = {
+    unsigned: true;
+    protocol?: 'ucp' | 'acp';
+} | {
+    unsigned?: false;
+    protocol: 'ucp' | 'acp';
+    method: string;
+    /** Absolute public URL of the inbound request. */
+    url: string;
+    /** Lower-cased covered headers. */
+    headers: Record<string, string>;
+    /** `sha-256=:<base64>:` over the raw request body (absent for an empty body). */
+    contentDigest?: string;
+};
+/** 5.19.0 — kit context on a confirm (carried onto the approval and its events). */
+interface CheckoutMetadata {
+    /** The kit's own checkout session id (`chk_…` / `cs_…`). */
+    kitSessionId?: string;
+    protocol?: 'ucp' | 'acp';
+}
+/** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
+type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
 interface VerificationRequest {
     /** Agent credentials */
     credentials: AgentCredentials;
@@ -769,6 +829,25 @@ interface VerificationRequest {
      * from the verify cache key.
      */
     attemptId?: string;
+    /**
+     * 5.19.0 — where `purpose` came from: `'route_config'` (a dashboard route
+     * rule matched this request), `'header'` (the agent's X-Astra-Purpose /
+     * legacy header / query), `'body'` (request-derived by your own
+     * extractor), or `'default'` (derived from the action or the transport
+     * default). Set by the express and Next.js adapters. verify-access keeps a
+     * `'route_config'` purpose over a commerce-derived one (e.g. an MPP paid
+     * leg) only when a stored rule on the endpoint matches `requestMethod` +
+     * `requestPath` with the same purpose and action.
+     */
+    purposeSource?: PurposeSource;
+    /** 5.19.0 — the inbound agent request behind a kit confirm (see {@link AgentArtifacts}). */
+    agentArtifacts?: AgentArtifacts;
+    /** 5.19.0 — kit session id + protocol, stored on any approval this confirm creates. */
+    metadata?: CheckoutMetadata;
+    /** 5.19.0 — the inbound request's HTTP method (for the route-rule check above). */
+    requestMethod?: string;
+    /** 5.19.0 — the inbound request's path, without the query (for the route-rule check above). */
+    requestPath?: string;
     /**
      * 3.12.0 — first-party observational data: the
      * offers the agent evaluated at this checkpoint (catalog browse / intent

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-Cns4l8gX.mjs';
+import { V as VerificationInterstitialProps, e as VerificationResult, a as AgentCredentials, c as GuidanceInfo, T as TrustLevel } from '../types-DqWPkiYl.mjs';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-Cns4l8gX.js';
+import { V as VerificationInterstitialProps, e as VerificationResult, a as AgentCredentials, c as GuidanceInfo, T as TrustLevel } from '../types-DqWPkiYl.js';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-3ObBpsnf.mjs';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-BoGjyon0.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**
@@ -79,15 +79,36 @@ interface ReportAttemptOptions {
         retried: boolean;
     }) => void;
 }
-declare function fetchRoutes(config: GatewayConfig, counterpartyId: string): Promise<RouteAccessConfigShape[] | null>;
+declare function fetchRoutes(config: GatewayConfig, counterpartyId: string, options?: {
+    /**
+     * 5.19.0: tool names the MCP middleware gates in code, sent as
+     * `?codeGates=a,b` so the dashboard can mark them "gated in code — a rule
+     * here can only add checks".
+     */
+    codeGates?: string[];
+}): Promise<RouteAccessConfigShape[] | null>;
 /**
  * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
  * server's `EndpointRoute` type and the SDK's `RouteAccessConfig` — same
  * JSON moves between server and SDK unchanged.
  */
 interface RouteAccessConfigShape {
+    /** Path pattern (path rules). Absent on an MCP tool rule. */
     pattern: string;
     method: string;
+    /**
+     * 5.19.0: MCP tool rule — the `tools/call` tool name this rule governs
+     * (`mcp_server` endpoints store only tool rules: `{tool, purpose, action,
+     * resource?, observe?}`). Path-rule matchers skip rules carrying it.
+     */
+    tool?: string;
+    /** 5.19.0: a tool rule's resource override. */
+    resource?: string;
+    /**
+     * 5.19.0: a path rule stored on an `mcp_server` endpoint before tool rules
+     * existed. The MCP middleware ignores it (replace it with tool rules).
+     */
+    legacy?: boolean;
     /** Pass through unenforced (observe). Replaces `minAccessLevel: 'none'`. */
     observe?: boolean;
     minTrustScore?: number;

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-BoxZEYPS.js';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-eWyZuz-3.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**
@@ -79,15 +79,36 @@ interface ReportAttemptOptions {
         retried: boolean;
     }) => void;
 }
-declare function fetchRoutes(config: GatewayConfig, counterpartyId: string): Promise<RouteAccessConfigShape[] | null>;
+declare function fetchRoutes(config: GatewayConfig, counterpartyId: string, options?: {
+    /**
+     * 5.19.0: tool names the MCP middleware gates in code, sent as
+     * `?codeGates=a,b` so the dashboard can mark them "gated in code — a rule
+     * here can only add checks".
+     */
+    codeGates?: string[];
+}): Promise<RouteAccessConfigShape[] | null>;
 /**
  * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
  * server's `EndpointRoute` type and the SDK's `RouteAccessConfig` — same
  * JSON moves between server and SDK unchanged.
  */
 interface RouteAccessConfigShape {
+    /** Path pattern (path rules). Absent on an MCP tool rule. */
     pattern: string;
     method: string;
+    /**
+     * 5.19.0: MCP tool rule — the `tools/call` tool name this rule governs
+     * (`mcp_server` endpoints store only tool rules: `{tool, purpose, action,
+     * resource?, observe?}`). Path-rule matchers skip rules carrying it.
+     */
+    tool?: string;
+    /** 5.19.0: a tool rule's resource override. */
+    resource?: string;
+    /**
+     * 5.19.0: a path rule stored on an `mcp_server` endpoint before tool rules
+     * existed. The MCP middleware ignores it (replace it with tool rules).
+     */
+    legacy?: boolean;
     /** Pass through unenforced (observe). Replaces `minAccessLevel: 'none'`. */
     observe?: boolean;
     minTrustScore?: number;