@astrasyncai/verification-gateway 5.18.1 → 5.20.0

package/dist/{types-BoxZEYPS.d.ts → types-Dn8tXnei.d.ts}

@@ -53,6 +53,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -161,9 +172,15 @@ interface VerifiedAgent {
     astraId: string;
     /** Agent display name */
     name: string;
-    /** Composite trust score (0-100) */
+    /**
+     * Composite trust score (0-100). 5.19.0: verify-access returns it to an
+     * authenticated counterparty (your API key) — counterparties may see an
+     * agent's score; the agent itself never does, so never relay it to the
+     * agent. It is withheld (undefined at runtime) for a keyless caller and when
+     * the caller is the agent itself; a route `minTrustScore` then fails closed.
+     */
     trustScore: number;
-    /** Trust level tier */
+    /** Trust level tier (derived from `trustScore`) */
     trustLevel: TrustLevel;
     /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
     blockchainAnchored: boolean;
@@ -297,7 +314,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -359,6 +378,20 @@ interface SettlementArtifact {
  *   - `counterparty.<allowlist|trust>`
  *   - `attestation.<type>` (e.g. `attestation.verified_human_party`)
  *   - `endpoint.<deactivated|trust|policy>`
+ *   - `behaviour.<limit_probing|unattributed_limit_check>` (5.19.0) — the
+ *     call is part of a sweep of unfinished attempts at rising values (quotes,
+ *     held/denied confirms, orders that never settled) that maps the agent's
+ *     spending limit. Completed purchases never count.
+ *     - `behaviour.limit_probing`: the sweep is provably the agent's own
+ *       (signed agent request, first-party bridge hop, runtime challenge or
+ *       the agent's key). Denied with no new step-up approval; the agent's
+ *       trust drops and its owner is alerted.
+ *     - `behaviour.unattributed_limit_check`: the sweep can't be attributed
+ *       to the agent (unsigned or direct merchant calls). Denied — it "needs
+ *       a signed agent request" — with no agent trust penalty; owners are
+ *       alerted with the evidence. A repeat of the merchant's own direct
+ *       calls, or the same pattern across agents of two or more owners,
+ *       reduces the endpoint owner's trust score.
  */
 interface AccessFailure {
     dimension: string;
@@ -475,6 +508,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -638,6 +677,46 @@ interface CallerMetadata {
      */
     observedMetadata?: ObservedMetadata;
 }
+/**
+ * 5.19.0 — the inbound agent request behind a kit confirm, forwarded so
+ * verify-access can tell whether the confirm is provably the agent's own
+ * (limit-probing attribution). The kits build it from `handle(req)`.
+ *
+ * - Signed (UCP, RFC 9421): the covered headers (`signature`,
+ *   `signature-input`, `signature-agent`, `ucp-agent`, `content-digest` and
+ *   every other header the signature covers — never `authorization` or
+ *   `cookie`), the method, the PUBLIC request URL (your `publicOrigin` + the
+ *   path and query, so `@target-uri` / `@authority` match what the agent
+ *   signed behind a TLS-terminating proxy) and `contentDigest`, the
+ *   `sha-256=:<base64>:` digest of the exact raw body.
+ * - `{ unsigned: true }`: the inbound request carried no signature, or it
+ *   came over ACP (the ACP `Authorization` bearer is the platform's
+ *   credential to you and is never forwarded, so ACP confirms are
+ *   unattributable). Sent explicitly so the platform can tell a kit relay
+ *   from a direct merchant call.
+ */
+type AgentArtifacts = {
+    unsigned: true;
+    protocol?: 'ucp' | 'acp';
+} | {
+    unsigned?: false;
+    protocol: 'ucp' | 'acp';
+    method: string;
+    /** Absolute public URL of the inbound request. */
+    url: string;
+    /** Lower-cased covered headers. */
+    headers: Record<string, string>;
+    /** `sha-256=:<base64>:` over the raw request body (absent for an empty body). */
+    contentDigest?: string;
+};
+/** 5.19.0 — kit context on a confirm (carried onto the approval and its events). */
+interface CheckoutMetadata {
+    /** The kit's own checkout session id (`chk_…` / `cs_…`). */
+    kitSessionId?: string;
+    protocol?: 'ucp' | 'acp';
+}
+/** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
+type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
 interface VerificationRequest {
     /** Agent credentials */
     credentials: AgentCredentials;
@@ -769,6 +848,25 @@ interface VerificationRequest {
      * from the verify cache key.
      */
     attemptId?: string;
+    /**
+     * 5.19.0 — where `purpose` came from: `'route_config'` (a dashboard route
+     * rule matched this request), `'header'` (the agent's X-Astra-Purpose /
+     * legacy header / query), `'body'` (request-derived by your own
+     * extractor), or `'default'` (derived from the action or the transport
+     * default). Set by the express and Next.js adapters. verify-access keeps a
+     * `'route_config'` purpose over a commerce-derived one (e.g. an MPP paid
+     * leg) only when a stored rule on the endpoint matches `requestMethod` +
+     * `requestPath` with the same purpose and action.
+     */
+    purposeSource?: PurposeSource;
+    /** 5.19.0 — the inbound agent request behind a kit confirm (see {@link AgentArtifacts}). */
+    agentArtifacts?: AgentArtifacts;
+    /** 5.19.0 — kit session id + protocol, stored on any approval this confirm creates. */
+    metadata?: CheckoutMetadata;
+    /** 5.19.0 — the inbound request's HTTP method (for the route-rule check above). */
+    requestMethod?: string;
+    /** 5.19.0 — the inbound request's path, without the query (for the route-rule check above). */
+    requestPath?: string;
     /**
      * 3.12.0 — first-party observational data: the
      * offers the agent evaluated at this checkpoint (catalog browse / intent
@@ -992,5 +1090,10 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
 export type { AgentCredentials as A, CommerceArtifactsPayload as C, GatewayConfig as G, TokenGuidance as T, VerificationRequest as V, AttemptReport as a, CounterpartyType as b, VerificationResult as c };

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-Cns4l8gX.mjs';
+import { V as VerificationInterstitialProps, e as VerificationResult, a as AgentCredentials, c as GuidanceInfo, T as TrustLevel } from '../types-CxjqmPl-.mjs';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-Cns4l8gX.js';
+import { V as VerificationInterstitialProps, e as VerificationResult, a as AgentCredentials, c as GuidanceInfo, T as TrustLevel } from '../types-CxjqmPl-.js';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-3ObBpsnf.mjs';
+import { A as AgentCredentials, G as GatewayConfig, c as VerificationResult, V as VerificationRequest, a as AttemptReport } from './types-D37aSQ9c.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**
@@ -11,7 +11,8 @@ import { ObservedMetadata } from './metadata-capture.mjs';
 /** Test-only: re-arm the one-time init self-check. */
 declare function _resetInitCheck(): void;
 /**
- * Clear the verification cache
+ * Clear the verification cache, and (5.20.0) forget in-flight single-flight
+ * calls so a later identical request reaches the backend on its own.
  */
 declare function clearCache(): void;
 /**
@@ -48,6 +49,24 @@ interface VerifyOptions {
  * Main verification function
  */
 declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Whether `result` was served from the verdict cache or shared from a
+ * concurrent identical call (5.20.0). The adapters skip the decision POST for
+ * these: the session already has its decision from the call that created it.
+ */
+declare function isSharedVerdict(result: VerificationResult): boolean;
+type VerificationListener = (result: VerificationResult, request: VerificationRequest) => void;
+/**
+ * 5.20.0: observe every verdict this process fetched from verify-access
+ * (cache hits and single-flight followers are not repeated). Listeners run
+ * synchronously after the result is built and must not throw (a throw is
+ * swallowed). Returns an unsubscribe function.
+ *
+ * The MCP bridge uses it to size its per-agent rate limit from the trust
+ * score its tools' own verifies return, instead of paying for a second
+ * verify-access call in the gate.
+ */
+declare function onVerificationResult(listener: VerificationListener): () => void;
 /**
  * Record a counterparty's grant/deny decision for a verification session.
  * Fire-and-forget — errors are silently swallowed.
@@ -79,15 +98,42 @@ interface ReportAttemptOptions {
         retried: boolean;
     }) => void;
 }
-declare function fetchRoutes(config: GatewayConfig, counterpartyId: string): Promise<RouteAccessConfigShape[] | null>;
+declare function fetchRoutes(config: GatewayConfig, counterpartyId: string, options?: {
+    /**
+     * 5.19.0: tool names the MCP middleware gates in code, sent as
+     * `?codeGates=a,b` so the dashboard can mark them "gated in code — a rule
+     * here can only add checks".
+     */
+    codeGates?: string[];
+    /**
+     * 5.20.0: called with the endpoint's `counterpartyType` when the routes
+     * response carries it (backend round 29.1+). The MCP middleware uses it
+     * to warn when it is pointed at a non-`mcp_server` endpoint.
+     */
+    onEndpointType?: (counterpartyType: string) => void;
+}): Promise<RouteAccessConfigShape[] | null>;
 /**
  * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
  * server's `EndpointRoute` type and the SDK's `RouteAccessConfig` — same
  * JSON moves between server and SDK unchanged.
  */
 interface RouteAccessConfigShape {
+    /** Path pattern (path rules). Absent on an MCP tool rule. */
     pattern: string;
     method: string;
+    /**
+     * 5.19.0: MCP tool rule — the `tools/call` tool name this rule governs
+     * (`mcp_server` endpoints store only tool rules: `{tool, purpose, action,
+     * resource?, observe?}`). Path-rule matchers skip rules carrying it.
+     */
+    tool?: string;
+    /** 5.19.0: a tool rule's resource override. */
+    resource?: string;
+    /**
+     * 5.19.0: a path rule stored on an `mcp_server` endpoint before tool rules
+     * existed. The MCP middleware ignores it (replace it with tool rules).
+     */
+    legacy?: boolean;
     /** Pass through unenforced (observe). Replaces `minAccessLevel: 'none'`. */
     observe?: boolean;
     minTrustScore?: number;
@@ -194,4 +240,4 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     retryAfterMs?: number;
 }>;
 
-export { type ReportAttemptOptions, type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, parseRetryAfterMs, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };
+export { type ReportAttemptOptions, type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, isSharedVerdict, onVerificationResult, parseRetryAfterMs, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-BoxZEYPS.js';
+import { A as AgentCredentials, G as GatewayConfig, c as VerificationResult, V as VerificationRequest, a as AttemptReport } from './types-Dn8tXnei.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**
@@ -11,7 +11,8 @@ import { ObservedMetadata } from './metadata-capture.js';
 /** Test-only: re-arm the one-time init self-check. */
 declare function _resetInitCheck(): void;
 /**
- * Clear the verification cache
+ * Clear the verification cache, and (5.20.0) forget in-flight single-flight
+ * calls so a later identical request reaches the backend on its own.
  */
 declare function clearCache(): void;
 /**
@@ -48,6 +49,24 @@ interface VerifyOptions {
  * Main verification function
  */
 declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Whether `result` was served from the verdict cache or shared from a
+ * concurrent identical call (5.20.0). The adapters skip the decision POST for
+ * these: the session already has its decision from the call that created it.
+ */
+declare function isSharedVerdict(result: VerificationResult): boolean;
+type VerificationListener = (result: VerificationResult, request: VerificationRequest) => void;
+/**
+ * 5.20.0: observe every verdict this process fetched from verify-access
+ * (cache hits and single-flight followers are not repeated). Listeners run
+ * synchronously after the result is built and must not throw (a throw is
+ * swallowed). Returns an unsubscribe function.
+ *
+ * The MCP bridge uses it to size its per-agent rate limit from the trust
+ * score its tools' own verifies return, instead of paying for a second
+ * verify-access call in the gate.
+ */
+declare function onVerificationResult(listener: VerificationListener): () => void;
 /**
  * Record a counterparty's grant/deny decision for a verification session.
  * Fire-and-forget — errors are silently swallowed.
@@ -79,15 +98,42 @@ interface ReportAttemptOptions {
         retried: boolean;
     }) => void;
 }
-declare function fetchRoutes(config: GatewayConfig, counterpartyId: string): Promise<RouteAccessConfigShape[] | null>;
+declare function fetchRoutes(config: GatewayConfig, counterpartyId: string, options?: {
+    /**
+     * 5.19.0: tool names the MCP middleware gates in code, sent as
+     * `?codeGates=a,b` so the dashboard can mark them "gated in code — a rule
+     * here can only add checks".
+     */
+    codeGates?: string[];
+    /**
+     * 5.20.0: called with the endpoint's `counterpartyType` when the routes
+     * response carries it (backend round 29.1+). The MCP middleware uses it
+     * to warn when it is pointed at a non-`mcp_server` endpoint.
+     */
+    onEndpointType?: (counterpartyType: string) => void;
+}): Promise<RouteAccessConfigShape[] | null>;
 /**
  * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
  * server's `EndpointRoute` type and the SDK's `RouteAccessConfig` — same
  * JSON moves between server and SDK unchanged.
  */
 interface RouteAccessConfigShape {
+    /** Path pattern (path rules). Absent on an MCP tool rule. */
     pattern: string;
     method: string;
+    /**
+     * 5.19.0: MCP tool rule — the `tools/call` tool name this rule governs
+     * (`mcp_server` endpoints store only tool rules: `{tool, purpose, action,
+     * resource?, observe?}`). Path-rule matchers skip rules carrying it.
+     */
+    tool?: string;
+    /** 5.19.0: a tool rule's resource override. */
+    resource?: string;
+    /**
+     * 5.19.0: a path rule stored on an `mcp_server` endpoint before tool rules
+     * existed. The MCP middleware ignores it (replace it with tool rules).
+     */
+    legacy?: boolean;
     /** Pass through unenforced (observe). Replaces `minAccessLevel: 'none'`. */
     observe?: boolean;
     minTrustScore?: number;
@@ -194,4 +240,4 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     retryAfterMs?: number;
 }>;
 
-export { type ReportAttemptOptions, type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, parseRetryAfterMs, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };
+export { type ReportAttemptOptions, type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, isSharedVerdict, onVerificationResult, parseRetryAfterMs, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };

package/dist/verify.js

@@ -25,6 +25,8 @@ __export(verify_exports, {
   extractCredentials: () => extractCredentials,
   fetchRoutes: () => fetchRoutes,
   hasCredentials: () => hasCredentials,
+  isSharedVerdict: () => isSharedVerdict,
+  onVerificationResult: () => onVerificationResult,
   parseRetryAfterMs: () => parseRetryAfterMs,
   quickVerify: () => quickVerify,
   recordDecision: () => recordDecision,
@@ -37,7 +39,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.18.1";
+var SDK_VERSION = "5.20.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -218,7 +220,12 @@ function getCacheKey(request, counterpartyId) {
     // its start_checkout quote was served the cached quote-leg grant (no
     // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
     request.commercePhase || "",
-    request.checkoutSessionId || ""
+    request.checkoutSessionId || "",
+    // 5.19.0: a route_config purpose claim is checked server-side against
+    // the stored rule for this method + path, so it changes the verdict.
+    request.purposeSource || "",
+    request.requestMethod || "",
+    request.requestPath || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {
@@ -243,6 +250,7 @@ function cacheResult(request, result, configuredTtl, counterpartyId) {
 }
 function clearCache() {
   verificationCache.clear();
+  inflightVerifies.clear();
 }
 function extractCredentials(headers, query) {
   const credentials = {};
@@ -416,6 +424,9 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (config.actingProof?.connectorToken) {
+    body.actingProof = { connectorToken: config.actingProof.connectorToken };
+  }
   if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
@@ -432,6 +443,11 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.purposeSource) body.purposeSource = requestData.purposeSource;
+  if (requestData.agentArtifacts) body.agentArtifacts = requestData.agentArtifacts;
+  if (requestData.metadata) body.metadata = requestData.metadata;
+  if (requestData.requestMethod) body.requestMethod = requestData.requestMethod;
+  if (requestData.requestPath) body.requestPath = requestData.requestPath;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
@@ -578,22 +594,46 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  const uncacheable = Boolean(request.commerceArtifacts);
+  const uncacheable = Boolean(request.commerceArtifacts) || Boolean(mergedConfig.actingProof);
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      const hit = { ...cached };
-      if (request.attemptId) {
-        hit.attemptId = request.attemptId;
-      } else {
-        delete hit.attemptId;
-      }
-      return hit;
+      return sharedVerdict(cached, request);
+    }
+  }
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
+    const key = getCacheKey(request, mergedConfig.counterpartyId);
+    const pending = inflightVerifies.get(key);
+    if (pending) return sharedVerdict(await pending, request);
+    const flight = verifyViaApi(mergedConfig, request, urls, uncacheable);
+    inflightVerifies.set(key, flight);
+    try {
+      return await flight;
+    } finally {
+      inflightVerifies.delete(key);
     }
   }
+  return verifyViaApi(mergedConfig, request, urls, uncacheable);
+}
+var inflightVerifies = /* @__PURE__ */ new Map();
+var sharedVerdicts = /* @__PURE__ */ new WeakSet();
+function isSharedVerdict(result) {
+  return sharedVerdicts.has(result);
+}
+function sharedVerdict(source, request) {
+  const hit = { ...source };
+  if (request.attemptId) {
+    hit.attemptId = request.attemptId;
+  } else {
+    delete hit.attemptId;
+  }
+  sharedVerdicts.add(hit);
+  return hit;
+}
+async function verifyViaApi(mergedConfig, request, urls, uncacheable) {
   const enrichedRequest = { ...request };
   if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {
     enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;
@@ -621,9 +661,18 @@ async function verify(config, request, options) {
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;
     const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true && !aggregatedFailures?.some((f) => REJECTED_IDENTITY_DIMENSIONS.has(f.dimension));
+    const denyAgent = idVerifiedFromBackend && apiResponse.agent ? {
+      astraId: apiResponse.agent.astraId,
+      name: apiResponse.agent.name,
+      trustScore: apiResponse.agent.trustScore,
+      trustLevel: getTrustLevel(apiResponse.agent.trustScore),
+      blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
+      status: apiResponse.agent.agentStatus
+    } : void 0;
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
+      ...denyAgent && { agent: denyAgent },
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -663,7 +712,9 @@ async function verify(config, request, options) {
       fulfilment: apiResponse.fulfilment,
       mandates: apiResponse.mandates,
       kyaToken: apiResponse.kyaToken,
-      aep: apiResponse.aep
+      aep: apiResponse.aep,
+      // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+      warnings: apiResponse.warnings
     };
     return result2;
   }
@@ -731,7 +782,9 @@ async function verify(config, request, options) {
     // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
     mandates: apiResponse.mandates,
     kyaToken: apiResponse.kyaToken,
-    aep: apiResponse.aep
+    aep: apiResponse.aep,
+    // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+    warnings: apiResponse.warnings
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -757,8 +810,24 @@ async function verify(config, request, options) {
       cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
     }
   }
+  notifyVerificationListeners(request, result);
   return result;
 }
+var verificationListeners = /* @__PURE__ */ new Set();
+function onVerificationResult(listener) {
+  verificationListeners.add(listener);
+  return () => {
+    verificationListeners.delete(listener);
+  };
+}
+function notifyVerificationListeners(request, result) {
+  for (const listener of verificationListeners) {
+    try {
+      listener(result, request);
+    } catch {
+    }
+  }
+}
 async function recordDecision(config, sessionId, decision, reason) {
   const headers = { "Content-Type": "application/json" };
   if (config.apiKey) {
@@ -815,7 +884,7 @@ async function reportAttempt(config, report, options = {}) {
 }
 var ATTEMPT_REPORT_MAX_RETRY_DELAY_MS = 2e3;
 var refusedPolicyReads = /* @__PURE__ */ new Set();
-async function fetchRoutes(config, counterpartyId) {
+async function fetchRoutes(config, counterpartyId, options = {}) {
   if (!counterpartyId) return null;
   const headers = { "Content-Type": "application/json" };
   if (config.apiKey) {
@@ -823,8 +892,9 @@ async function fetchRoutes(config, counterpartyId) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
+    headers["X-AstraSync-SDK-Version"] = SDK_VERSION;
     const response = await sdkFetch(
-      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes`,
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes` + (options.codeGates?.length ? `?codeGates=${options.codeGates.map(encodeURIComponent).join(",")}` : ""),
       { method: "GET", headers }
     );
     if (!response.ok) {
@@ -837,6 +907,13 @@ async function fetchRoutes(config, counterpartyId) {
       return null;
     }
     const body = await response.json();
+    const type = body.data?.counterpartyType;
+    if (typeof type === "string" && options.onEndpointType) {
+      try {
+        options.onEndpointType(type);
+      } catch {
+      }
+    }
     return body.data?.routes ?? [];
   } catch {
     return null;
@@ -906,6 +983,8 @@ async function quickVerify(config, credentials) {
   extractCredentials,
   fetchRoutes,
   hasCredentials,
+  isSharedVerdict,
+  onVerificationResult,
   parseRetryAfterMs,
   quickVerify,
   recordDecision,