@astrasyncai/verification-gateway 5.18.1 → 5.20.0

package/dist/{types-BRz2U0Pn.d.ts → types-B_HLhZ9n.d.ts}

@@ -1,4 +1,4 @@
-import { C as CounterpartyType, T as TokenGuidance } from './types-BfILnheI.js';
+import { C as CounterpartyType, T as TokenGuidance } from './types-CU17R4Nr.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-BfILnheI.d.mts → types-CU17R4Nr.d.mts}

@@ -34,6 +34,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */

package/dist/{types-BfILnheI.d.ts → types-CU17R4Nr.d.ts}

@@ -34,6 +34,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */

package/dist/{types-Cns4l8gX.d.mts → types-CxjqmPl-.d.mts}

@@ -111,6 +111,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -219,9 +230,15 @@ interface VerifiedAgent {
     astraId: string;
     /** Agent display name */
     name: string;
-    /** Composite trust score (0-100) */
+    /**
+     * Composite trust score (0-100). 5.19.0: verify-access returns it to an
+     * authenticated counterparty (your API key) — counterparties may see an
+     * agent's score; the agent itself never does, so never relay it to the
+     * agent. It is withheld (undefined at runtime) for a keyless caller and when
+     * the caller is the agent itself; a route `minTrustScore` then fails closed.
+     */
     trustScore: number;
-    /** Trust level tier */
+    /** Trust level tier (derived from `trustScore`) */
     trustLevel: TrustLevel;
     /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
     blockchainAnchored: boolean;
@@ -355,7 +372,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -417,6 +436,20 @@ interface SettlementArtifact {
  *   - `counterparty.<allowlist|trust>`
  *   - `attestation.<type>` (e.g. `attestation.verified_human_party`)
  *   - `endpoint.<deactivated|trust|policy>`
+ *   - `behaviour.<limit_probing|unattributed_limit_check>` (5.19.0) — the
+ *     call is part of a sweep of unfinished attempts at rising values (quotes,
+ *     held/denied confirms, orders that never settled) that maps the agent's
+ *     spending limit. Completed purchases never count.
+ *     - `behaviour.limit_probing`: the sweep is provably the agent's own
+ *       (signed agent request, first-party bridge hop, runtime challenge or
+ *       the agent's key). Denied with no new step-up approval; the agent's
+ *       trust drops and its owner is alerted.
+ *     - `behaviour.unattributed_limit_check`: the sweep can't be attributed
+ *       to the agent (unsigned or direct merchant calls). Denied — it "needs
+ *       a signed agent request" — with no agent trust penalty; owners are
+ *       alerted with the evidence. A repeat of the merchant's own direct
+ *       calls, or the same pattern across agents of two or more owners,
+ *       reduces the endpoint owner's trust score.
  */
 interface AccessFailure {
     dimension: string;
@@ -533,6 +566,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -696,6 +735,46 @@ interface CallerMetadata {
      */
     observedMetadata?: ObservedMetadata;
 }
+/**
+ * 5.19.0 — the inbound agent request behind a kit confirm, forwarded so
+ * verify-access can tell whether the confirm is provably the agent's own
+ * (limit-probing attribution). The kits build it from `handle(req)`.
+ *
+ * - Signed (UCP, RFC 9421): the covered headers (`signature`,
+ *   `signature-input`, `signature-agent`, `ucp-agent`, `content-digest` and
+ *   every other header the signature covers — never `authorization` or
+ *   `cookie`), the method, the PUBLIC request URL (your `publicOrigin` + the
+ *   path and query, so `@target-uri` / `@authority` match what the agent
+ *   signed behind a TLS-terminating proxy) and `contentDigest`, the
+ *   `sha-256=:<base64>:` digest of the exact raw body.
+ * - `{ unsigned: true }`: the inbound request carried no signature, or it
+ *   came over ACP (the ACP `Authorization` bearer is the platform's
+ *   credential to you and is never forwarded, so ACP confirms are
+ *   unattributable). Sent explicitly so the platform can tell a kit relay
+ *   from a direct merchant call.
+ */
+type AgentArtifacts = {
+    unsigned: true;
+    protocol?: 'ucp' | 'acp';
+} | {
+    unsigned?: false;
+    protocol: 'ucp' | 'acp';
+    method: string;
+    /** Absolute public URL of the inbound request. */
+    url: string;
+    /** Lower-cased covered headers. */
+    headers: Record<string, string>;
+    /** `sha-256=:<base64>:` over the raw request body (absent for an empty body). */
+    contentDigest?: string;
+};
+/** 5.19.0 — kit context on a confirm (carried onto the approval and its events). */
+interface CheckoutMetadata {
+    /** The kit's own checkout session id (`chk_…` / `cs_…`). */
+    kitSessionId?: string;
+    protocol?: 'ucp' | 'acp';
+}
+/** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
+type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
 interface VerificationRequest {
     /** Agent credentials */
     credentials: AgentCredentials;
@@ -827,6 +906,25 @@ interface VerificationRequest {
      * from the verify cache key.
      */
     attemptId?: string;
+    /**
+     * 5.19.0 — where `purpose` came from: `'route_config'` (a dashboard route
+     * rule matched this request), `'header'` (the agent's X-Astra-Purpose /
+     * legacy header / query), `'body'` (request-derived by your own
+     * extractor), or `'default'` (derived from the action or the transport
+     * default). Set by the express and Next.js adapters. verify-access keeps a
+     * `'route_config'` purpose over a commerce-derived one (e.g. an MPP paid
+     * leg) only when a stored rule on the endpoint matches `requestMethod` +
+     * `requestPath` with the same purpose and action.
+     */
+    purposeSource?: PurposeSource;
+    /** 5.19.0 — the inbound agent request behind a kit confirm (see {@link AgentArtifacts}). */
+    agentArtifacts?: AgentArtifacts;
+    /** 5.19.0 — kit session id + protocol, stored on any approval this confirm creates. */
+    metadata?: CheckoutMetadata;
+    /** 5.19.0 — the inbound request's HTTP method (for the route-rule check above). */
+    requestMethod?: string;
+    /** 5.19.0 — the inbound request's path, without the query (for the route-rule check above). */
+    requestPath?: string;
     /**
      * 3.12.0 — first-party observational data: the
      * offers the agent evaluated at this checkpoint (catalog browse / intent
@@ -1025,17 +1123,16 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
     /**
      * Posture when the middleware itself throws an internal error (header
      * parsing failure, `fetchRoutes` network error, malformed proxy state,
-     * etc.). Default `'open'` for backward compatibility in SDK 2.4.13 —
-     * legitimate traffic continues to pass through during platform outages.
+     * etc.).
      *
-     * In shadow mode (default), the middleware ALWAYS logs a
-     * `[SHADOW] would-have-denied` line on throws including correlationId so
-     * merchants can grep their own logs for impact analysis. The default
-     * flips to `'closed'` in a follow-up release once the shadow logs confirm
-     * legitimate traffic is unaffected.
+     * 5.19.0 (behaviour change): default `'closed'` — the request is refused
+     * with 503 + Retry-After + `VERIFICATION_UNAVAILABLE` (the
+     * `middleware.internal_error` dimension; never an identity-shaped 401) and
+     * your handler is not called. Set `'open'` explicitly to pass the request
+     * through unverified instead (e.g. small-value demo merchants).
      *
-     * Small-value demo merchants can keep `'open'` indefinitely after the
-     * default flip by setting this explicitly.
+     * The middleware always logs a `[SHADOW] would-have-denied` line on throws
+     * including correlationId, whichever posture is set.
      */
     failOnError?: 'open' | 'closed';
     /**
@@ -1211,5 +1308,10 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
-export type { AgentCredentials as A, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AstraSyncCredentials as a, GuidanceInfo as b, VerificationRequest as c, VerificationResult as d };
+export type { AgentArtifacts as A, CheckoutMetadata as C, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, GuidanceInfo as c, VerificationRequest as d, VerificationResult as e };

package/dist/{types-Cns4l8gX.d.ts → types-CxjqmPl-.d.ts}

@@ -111,6 +111,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -219,9 +230,15 @@ interface VerifiedAgent {
     astraId: string;
     /** Agent display name */
     name: string;
-    /** Composite trust score (0-100) */
+    /**
+     * Composite trust score (0-100). 5.19.0: verify-access returns it to an
+     * authenticated counterparty (your API key) — counterparties may see an
+     * agent's score; the agent itself never does, so never relay it to the
+     * agent. It is withheld (undefined at runtime) for a keyless caller and when
+     * the caller is the agent itself; a route `minTrustScore` then fails closed.
+     */
     trustScore: number;
-    /** Trust level tier */
+    /** Trust level tier (derived from `trustScore`) */
     trustLevel: TrustLevel;
     /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
     blockchainAnchored: boolean;
@@ -355,7 +372,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -417,6 +436,20 @@ interface SettlementArtifact {
  *   - `counterparty.<allowlist|trust>`
  *   - `attestation.<type>` (e.g. `attestation.verified_human_party`)
  *   - `endpoint.<deactivated|trust|policy>`
+ *   - `behaviour.<limit_probing|unattributed_limit_check>` (5.19.0) — the
+ *     call is part of a sweep of unfinished attempts at rising values (quotes,
+ *     held/denied confirms, orders that never settled) that maps the agent's
+ *     spending limit. Completed purchases never count.
+ *     - `behaviour.limit_probing`: the sweep is provably the agent's own
+ *       (signed agent request, first-party bridge hop, runtime challenge or
+ *       the agent's key). Denied with no new step-up approval; the agent's
+ *       trust drops and its owner is alerted.
+ *     - `behaviour.unattributed_limit_check`: the sweep can't be attributed
+ *       to the agent (unsigned or direct merchant calls). Denied — it "needs
+ *       a signed agent request" — with no agent trust penalty; owners are
+ *       alerted with the evidence. A repeat of the merchant's own direct
+ *       calls, or the same pattern across agents of two or more owners,
+ *       reduces the endpoint owner's trust score.
  */
 interface AccessFailure {
     dimension: string;
@@ -533,6 +566,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -696,6 +735,46 @@ interface CallerMetadata {
      */
     observedMetadata?: ObservedMetadata;
 }
+/**
+ * 5.19.0 — the inbound agent request behind a kit confirm, forwarded so
+ * verify-access can tell whether the confirm is provably the agent's own
+ * (limit-probing attribution). The kits build it from `handle(req)`.
+ *
+ * - Signed (UCP, RFC 9421): the covered headers (`signature`,
+ *   `signature-input`, `signature-agent`, `ucp-agent`, `content-digest` and
+ *   every other header the signature covers — never `authorization` or
+ *   `cookie`), the method, the PUBLIC request URL (your `publicOrigin` + the
+ *   path and query, so `@target-uri` / `@authority` match what the agent
+ *   signed behind a TLS-terminating proxy) and `contentDigest`, the
+ *   `sha-256=:<base64>:` digest of the exact raw body.
+ * - `{ unsigned: true }`: the inbound request carried no signature, or it
+ *   came over ACP (the ACP `Authorization` bearer is the platform's
+ *   credential to you and is never forwarded, so ACP confirms are
+ *   unattributable). Sent explicitly so the platform can tell a kit relay
+ *   from a direct merchant call.
+ */
+type AgentArtifacts = {
+    unsigned: true;
+    protocol?: 'ucp' | 'acp';
+} | {
+    unsigned?: false;
+    protocol: 'ucp' | 'acp';
+    method: string;
+    /** Absolute public URL of the inbound request. */
+    url: string;
+    /** Lower-cased covered headers. */
+    headers: Record<string, string>;
+    /** `sha-256=:<base64>:` over the raw request body (absent for an empty body). */
+    contentDigest?: string;
+};
+/** 5.19.0 — kit context on a confirm (carried onto the approval and its events). */
+interface CheckoutMetadata {
+    /** The kit's own checkout session id (`chk_…` / `cs_…`). */
+    kitSessionId?: string;
+    protocol?: 'ucp' | 'acp';
+}
+/** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
+type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
 interface VerificationRequest {
     /** Agent credentials */
     credentials: AgentCredentials;
@@ -827,6 +906,25 @@ interface VerificationRequest {
      * from the verify cache key.
      */
     attemptId?: string;
+    /**
+     * 5.19.0 — where `purpose` came from: `'route_config'` (a dashboard route
+     * rule matched this request), `'header'` (the agent's X-Astra-Purpose /
+     * legacy header / query), `'body'` (request-derived by your own
+     * extractor), or `'default'` (derived from the action or the transport
+     * default). Set by the express and Next.js adapters. verify-access keeps a
+     * `'route_config'` purpose over a commerce-derived one (e.g. an MPP paid
+     * leg) only when a stored rule on the endpoint matches `requestMethod` +
+     * `requestPath` with the same purpose and action.
+     */
+    purposeSource?: PurposeSource;
+    /** 5.19.0 — the inbound agent request behind a kit confirm (see {@link AgentArtifacts}). */
+    agentArtifacts?: AgentArtifacts;
+    /** 5.19.0 — kit session id + protocol, stored on any approval this confirm creates. */
+    metadata?: CheckoutMetadata;
+    /** 5.19.0 — the inbound request's HTTP method (for the route-rule check above). */
+    requestMethod?: string;
+    /** 5.19.0 — the inbound request's path, without the query (for the route-rule check above). */
+    requestPath?: string;
     /**
      * 3.12.0 — first-party observational data: the
      * offers the agent evaluated at this checkpoint (catalog browse / intent
@@ -1025,17 +1123,16 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
     /**
      * Posture when the middleware itself throws an internal error (header
      * parsing failure, `fetchRoutes` network error, malformed proxy state,
-     * etc.). Default `'open'` for backward compatibility in SDK 2.4.13 —
-     * legitimate traffic continues to pass through during platform outages.
+     * etc.).
      *
-     * In shadow mode (default), the middleware ALWAYS logs a
-     * `[SHADOW] would-have-denied` line on throws including correlationId so
-     * merchants can grep their own logs for impact analysis. The default
-     * flips to `'closed'` in a follow-up release once the shadow logs confirm
-     * legitimate traffic is unaffected.
+     * 5.19.0 (behaviour change): default `'closed'` — the request is refused
+     * with 503 + Retry-After + `VERIFICATION_UNAVAILABLE` (the
+     * `middleware.internal_error` dimension; never an identity-shaped 401) and
+     * your handler is not called. Set `'open'` explicitly to pass the request
+     * through unverified instead (e.g. small-value demo merchants).
      *
-     * Small-value demo merchants can keep `'open'` indefinitely after the
-     * default flip by setting this explicitly.
+     * The middleware always logs a `[SHADOW] would-have-denied` line on throws
+     * including correlationId, whichever posture is set.
      */
     failOnError?: 'open' | 'closed';
     /**
@@ -1211,5 +1308,10 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
-export type { AgentCredentials as A, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AstraSyncCredentials as a, GuidanceInfo as b, VerificationRequest as c, VerificationResult as d };
+export type { AgentArtifacts as A, CheckoutMetadata as C, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, GuidanceInfo as c, VerificationRequest as d, VerificationResult as e };

package/dist/{types-3ObBpsnf.d.mts → types-D37aSQ9c.d.mts}

@@ -53,6 +53,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -161,9 +172,15 @@ interface VerifiedAgent {
     astraId: string;
     /** Agent display name */
     name: string;
-    /** Composite trust score (0-100) */
+    /**
+     * Composite trust score (0-100). 5.19.0: verify-access returns it to an
+     * authenticated counterparty (your API key) — counterparties may see an
+     * agent's score; the agent itself never does, so never relay it to the
+     * agent. It is withheld (undefined at runtime) for a keyless caller and when
+     * the caller is the agent itself; a route `minTrustScore` then fails closed.
+     */
     trustScore: number;
-    /** Trust level tier */
+    /** Trust level tier (derived from `trustScore`) */
     trustLevel: TrustLevel;
     /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
     blockchainAnchored: boolean;
@@ -297,7 +314,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -359,6 +378,20 @@ interface SettlementArtifact {
  *   - `counterparty.<allowlist|trust>`
  *   - `attestation.<type>` (e.g. `attestation.verified_human_party`)
  *   - `endpoint.<deactivated|trust|policy>`
+ *   - `behaviour.<limit_probing|unattributed_limit_check>` (5.19.0) — the
+ *     call is part of a sweep of unfinished attempts at rising values (quotes,
+ *     held/denied confirms, orders that never settled) that maps the agent's
+ *     spending limit. Completed purchases never count.
+ *     - `behaviour.limit_probing`: the sweep is provably the agent's own
+ *       (signed agent request, first-party bridge hop, runtime challenge or
+ *       the agent's key). Denied with no new step-up approval; the agent's
+ *       trust drops and its owner is alerted.
+ *     - `behaviour.unattributed_limit_check`: the sweep can't be attributed
+ *       to the agent (unsigned or direct merchant calls). Denied — it "needs
+ *       a signed agent request" — with no agent trust penalty; owners are
+ *       alerted with the evidence. A repeat of the merchant's own direct
+ *       calls, or the same pattern across agents of two or more owners,
+ *       reduces the endpoint owner's trust score.
  */
 interface AccessFailure {
     dimension: string;
@@ -475,6 +508,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -638,6 +677,46 @@ interface CallerMetadata {
      */
     observedMetadata?: ObservedMetadata;
 }
+/**
+ * 5.19.0 — the inbound agent request behind a kit confirm, forwarded so
+ * verify-access can tell whether the confirm is provably the agent's own
+ * (limit-probing attribution). The kits build it from `handle(req)`.
+ *
+ * - Signed (UCP, RFC 9421): the covered headers (`signature`,
+ *   `signature-input`, `signature-agent`, `ucp-agent`, `content-digest` and
+ *   every other header the signature covers — never `authorization` or
+ *   `cookie`), the method, the PUBLIC request URL (your `publicOrigin` + the
+ *   path and query, so `@target-uri` / `@authority` match what the agent
+ *   signed behind a TLS-terminating proxy) and `contentDigest`, the
+ *   `sha-256=:<base64>:` digest of the exact raw body.
+ * - `{ unsigned: true }`: the inbound request carried no signature, or it
+ *   came over ACP (the ACP `Authorization` bearer is the platform's
+ *   credential to you and is never forwarded, so ACP confirms are
+ *   unattributable). Sent explicitly so the platform can tell a kit relay
+ *   from a direct merchant call.
+ */
+type AgentArtifacts = {
+    unsigned: true;
+    protocol?: 'ucp' | 'acp';
+} | {
+    unsigned?: false;
+    protocol: 'ucp' | 'acp';
+    method: string;
+    /** Absolute public URL of the inbound request. */
+    url: string;
+    /** Lower-cased covered headers. */
+    headers: Record<string, string>;
+    /** `sha-256=:<base64>:` over the raw request body (absent for an empty body). */
+    contentDigest?: string;
+};
+/** 5.19.0 — kit context on a confirm (carried onto the approval and its events). */
+interface CheckoutMetadata {
+    /** The kit's own checkout session id (`chk_…` / `cs_…`). */
+    kitSessionId?: string;
+    protocol?: 'ucp' | 'acp';
+}
+/** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
+type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
 interface VerificationRequest {
     /** Agent credentials */
     credentials: AgentCredentials;
@@ -769,6 +848,25 @@ interface VerificationRequest {
      * from the verify cache key.
      */
     attemptId?: string;
+    /**
+     * 5.19.0 — where `purpose` came from: `'route_config'` (a dashboard route
+     * rule matched this request), `'header'` (the agent's X-Astra-Purpose /
+     * legacy header / query), `'body'` (request-derived by your own
+     * extractor), or `'default'` (derived from the action or the transport
+     * default). Set by the express and Next.js adapters. verify-access keeps a
+     * `'route_config'` purpose over a commerce-derived one (e.g. an MPP paid
+     * leg) only when a stored rule on the endpoint matches `requestMethod` +
+     * `requestPath` with the same purpose and action.
+     */
+    purposeSource?: PurposeSource;
+    /** 5.19.0 — the inbound agent request behind a kit confirm (see {@link AgentArtifacts}). */
+    agentArtifacts?: AgentArtifacts;
+    /** 5.19.0 — kit session id + protocol, stored on any approval this confirm creates. */
+    metadata?: CheckoutMetadata;
+    /** 5.19.0 — the inbound request's HTTP method (for the route-rule check above). */
+    requestMethod?: string;
+    /** 5.19.0 — the inbound request's path, without the query (for the route-rule check above). */
+    requestPath?: string;
     /**
      * 3.12.0 — first-party observational data: the
      * offers the agent evaluated at this checkpoint (catalog browse / intent
@@ -992,5 +1090,10 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
 export type { AgentCredentials as A, CommerceArtifactsPayload as C, GatewayConfig as G, TokenGuidance as T, VerificationRequest as V, AttemptReport as a, CounterpartyType as b, VerificationResult as c };

package/dist/{types-CfBpm3w5.d.mts → types-Djpz-L0w.d.mts}

@@ -1,4 +1,4 @@
-import { C as CounterpartyType, T as TokenGuidance } from './types-BfILnheI.mjs';
+import { C as CounterpartyType, T as TokenGuidance } from './types-CU17R4Nr.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.