@astrasyncai/verification-gateway 5.19.0 → 5.20.0

package/dist/adapters/sdk.d.mts

@@ -1,4 +1,4 @@
-import { T as TrustLevel, S as SDKOptions, e as VerificationResult, d as VerificationRequest, A as AgentArtifacts, C as CheckoutMetadata } from '../types-DqWPkiYl.mjs';
+import { T as TrustLevel, S as SDKOptions, e as VerificationResult, d as VerificationRequest, A as AgentArtifacts, C as CheckoutMetadata } from '../types-CxjqmPl-.mjs';
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -199,6 +199,40 @@ declare class VerificationGatewayClient {
         status: string;
         alreadySettled?: boolean;
     }>;
+    /**
+     * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
+     * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
+     * endpoint's owner, or a personal key of an individual with an active seat
+     * in the owning organisation. Policy (rules, trust floor, challenge, edge
+     * config) stays dashboard-only. `null` clears a field. The owner is alerted
+     * when `eventsUrl` changes.
+     *
+     * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
+     * @returns the endpoint as stored, plus `changed` (the fields that changed)
+     * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
+     */
+    updateEndpoint(endpointId: string | undefined, patch: EndpointOperationalPatch): Promise<Record<string, unknown> & {
+        changed: Array<keyof EndpointOperationalPatch>;
+    }>;
+    /**
+     * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
+     * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
+     * Delivered synchronously, outside the event outbox (random `eventId`, no
+     * retries), signed with the endpoint's webhook secret like a real event.
+     * Without `approvalId` the payload is synthetic (a kit acknowledges and
+     * ignores it). With the id of a held kit approval at this endpoint the
+     * payload is the real one, so your resume path runs: `approved` makes the
+     * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
+     * `lapsed` release the session.
+     *
+     * Resolves even when your endpoint refused the event (`delivered: false`,
+     * with `responseCode` / `error`).
+     */
+    sendTestEvent(endpointId: string | undefined, options: {
+        type: TestEventType;
+        approvalId?: string;
+    }): Promise<TestEventResult>;
+    private endpointCall;
     /**
      * Quick verification — checks credentials and policy in one call.
      *
@@ -238,6 +272,28 @@ declare class VerificationGatewayClient {
      */
     private executeWithRetry;
 }
+/** 5.20.0: the operational fields `updateEndpoint` may change (`null` clears). */
+interface EndpointOperationalPatch {
+    eventsUrl?: string | null;
+    healthCheckUrl?: string | null;
+    skillUrl?: string | null;
+    catalogUrl?: string | null;
+    checkoutUrl?: string | null;
+}
+/** 5.20.0: the step-up event types `sendTestEvent` can send. */
+type TestEventType = 'step_up.approved' | 'step_up.denied' | 'step_up.expired' | 'step_up.lapsed';
+/** 5.20.0: what `sendTestEvent` reports. */
+interface TestEventResult {
+    delivered: boolean;
+    /** delivered | failed (bad answer / unreachable) | not_configured (no Events URL or secret). */
+    status: 'delivered' | 'failed' | 'not_configured';
+    /** Your endpoint's HTTP status, or null when nothing answered. */
+    responseCode: number | null;
+    error: string | null;
+    eventId: string;
+    type: TestEventType;
+    approvalId: string | null;
+}
 /**
  * Create a new SDK client
  */
@@ -253,4 +309,4 @@ declare function verifyOnce(options: SDKOptions & {
     action?: string;
 }): Promise<VerificationResult>;
 
-export { VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };
+export { type EndpointOperationalPatch, type TestEventResult, type TestEventType, VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };

package/dist/adapters/sdk.d.ts

@@ -1,4 +1,4 @@
-import { T as TrustLevel, S as SDKOptions, e as VerificationResult, d as VerificationRequest, A as AgentArtifacts, C as CheckoutMetadata } from '../types-DqWPkiYl.js';
+import { T as TrustLevel, S as SDKOptions, e as VerificationResult, d as VerificationRequest, A as AgentArtifacts, C as CheckoutMetadata } from '../types-CxjqmPl-.js';
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -199,6 +199,40 @@ declare class VerificationGatewayClient {
         status: string;
         alreadySettled?: boolean;
     }>;
+    /**
+     * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
+     * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
+     * endpoint's owner, or a personal key of an individual with an active seat
+     * in the owning organisation. Policy (rules, trust floor, challenge, edge
+     * config) stays dashboard-only. `null` clears a field. The owner is alerted
+     * when `eventsUrl` changes.
+     *
+     * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
+     * @returns the endpoint as stored, plus `changed` (the fields that changed)
+     * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
+     */
+    updateEndpoint(endpointId: string | undefined, patch: EndpointOperationalPatch): Promise<Record<string, unknown> & {
+        changed: Array<keyof EndpointOperationalPatch>;
+    }>;
+    /**
+     * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
+     * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
+     * Delivered synchronously, outside the event outbox (random `eventId`, no
+     * retries), signed with the endpoint's webhook secret like a real event.
+     * Without `approvalId` the payload is synthetic (a kit acknowledges and
+     * ignores it). With the id of a held kit approval at this endpoint the
+     * payload is the real one, so your resume path runs: `approved` makes the
+     * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
+     * `lapsed` release the session.
+     *
+     * Resolves even when your endpoint refused the event (`delivered: false`,
+     * with `responseCode` / `error`).
+     */
+    sendTestEvent(endpointId: string | undefined, options: {
+        type: TestEventType;
+        approvalId?: string;
+    }): Promise<TestEventResult>;
+    private endpointCall;
     /**
      * Quick verification — checks credentials and policy in one call.
      *
@@ -238,6 +272,28 @@ declare class VerificationGatewayClient {
      */
     private executeWithRetry;
 }
+/** 5.20.0: the operational fields `updateEndpoint` may change (`null` clears). */
+interface EndpointOperationalPatch {
+    eventsUrl?: string | null;
+    healthCheckUrl?: string | null;
+    skillUrl?: string | null;
+    catalogUrl?: string | null;
+    checkoutUrl?: string | null;
+}
+/** 5.20.0: the step-up event types `sendTestEvent` can send. */
+type TestEventType = 'step_up.approved' | 'step_up.denied' | 'step_up.expired' | 'step_up.lapsed';
+/** 5.20.0: what `sendTestEvent` reports. */
+interface TestEventResult {
+    delivered: boolean;
+    /** delivered | failed (bad answer / unreachable) | not_configured (no Events URL or secret). */
+    status: 'delivered' | 'failed' | 'not_configured';
+    /** Your endpoint's HTTP status, or null when nothing answered. */
+    responseCode: number | null;
+    error: string | null;
+    eventId: string;
+    type: TestEventType;
+    approvalId: string | null;
+}
 /**
  * Create a new SDK client
  */
@@ -253,4 +309,4 @@ declare function verifyOnce(options: SDKOptions & {
     action?: string;
 }): Promise<VerificationResult>;
 
-export { VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };
+export { type EndpointOperationalPatch, type TestEventResult, type TestEventType, VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };

package/dist/adapters/sdk.js

@@ -28,7 +28,7 @@ __export(sdk_exports, {
 module.exports = __toCommonJS(sdk_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.19.0";
+var SDK_VERSION = "5.20.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -236,6 +236,7 @@ function cacheResult(request, result, configuredTtl, counterpartyId) {
 }
 function clearCache() {
   verificationCache.clear();
+  inflightVerifies.clear();
 }
 function mcpGuidance(urls) {
   if (!urls?.mcpEndpoint) return void 0;
@@ -372,6 +373,9 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (config.actingProof?.connectorToken) {
+    body.actingProof = { connectorToken: config.actingProof.connectorToken };
+  }
   if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
@@ -539,22 +543,43 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  const uncacheable = Boolean(request.commerceArtifacts);
+  const uncacheable = Boolean(request.commerceArtifacts) || Boolean(mergedConfig.actingProof);
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      const hit = { ...cached };
-      if (request.attemptId) {
-        hit.attemptId = request.attemptId;
-      } else {
-        delete hit.attemptId;
-      }
-      return hit;
+      return sharedVerdict(cached, request);
+    }
+  }
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
+    const key = getCacheKey(request, mergedConfig.counterpartyId);
+    const pending = inflightVerifies.get(key);
+    if (pending) return sharedVerdict(await pending, request);
+    const flight = verifyViaApi(mergedConfig, request, urls, uncacheable);
+    inflightVerifies.set(key, flight);
+    try {
+      return await flight;
+    } finally {
+      inflightVerifies.delete(key);
     }
   }
+  return verifyViaApi(mergedConfig, request, urls, uncacheable);
+}
+var inflightVerifies = /* @__PURE__ */ new Map();
+var sharedVerdicts = /* @__PURE__ */ new WeakSet();
+function sharedVerdict(source, request) {
+  const hit = { ...source };
+  if (request.attemptId) {
+    hit.attemptId = request.attemptId;
+  } else {
+    delete hit.attemptId;
+  }
+  sharedVerdicts.add(hit);
+  return hit;
+}
+async function verifyViaApi(mergedConfig, request, urls, uncacheable) {
   const enrichedRequest = { ...request };
   if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {
     enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;
@@ -633,7 +658,9 @@ async function verify(config, request, options) {
       fulfilment: apiResponse.fulfilment,
       mandates: apiResponse.mandates,
       kyaToken: apiResponse.kyaToken,
-      aep: apiResponse.aep
+      aep: apiResponse.aep,
+      // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+      warnings: apiResponse.warnings
     };
     return result2;
   }
@@ -701,7 +728,9 @@ async function verify(config, request, options) {
     // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
     mandates: apiResponse.mandates,
     kyaToken: apiResponse.kyaToken,
-    aep: apiResponse.aep
+    aep: apiResponse.aep,
+    // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+    warnings: apiResponse.warnings
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -727,8 +756,18 @@ async function verify(config, request, options) {
       cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
     }
   }
+  notifyVerificationListeners(request, result);
   return result;
 }
+var verificationListeners = /* @__PURE__ */ new Set();
+function notifyVerificationListeners(request, result) {
+  for (const listener of verificationListeners) {
+    try {
+      listener(result, request);
+    } catch {
+    }
+  }
+}
 async function quickVerify(config, credentials) {
   const result = await verify(config, {
     credentials,
@@ -988,6 +1027,80 @@ var VerificationGatewayClient = class {
     }
     return json.data;
   }
+  /**
+   * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
+   * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
+   * endpoint's owner, or a personal key of an individual with an active seat
+   * in the owning organisation. Policy (rules, trust floor, challenge, edge
+   * config) stays dashboard-only. `null` clears a field. The owner is alerted
+   * when `eventsUrl` changes.
+   *
+   * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
+   * @returns the endpoint as stored, plus `changed` (the fields that changed)
+   * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
+   */
+  async updateEndpoint(endpointId, patch) {
+    return this.endpointCall("PATCH", endpointId, "", patch);
+  }
+  /**
+   * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
+   * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
+   * Delivered synchronously, outside the event outbox (random `eventId`, no
+   * retries), signed with the endpoint's webhook secret like a real event.
+   * Without `approvalId` the payload is synthetic (a kit acknowledges and
+   * ignores it). With the id of a held kit approval at this endpoint the
+   * payload is the real one, so your resume path runs: `approved` makes the
+   * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
+   * `lapsed` release the session.
+   *
+   * Resolves even when your endpoint refused the event (`delivered: false`,
+   * with `responseCode` / `error`).
+   */
+  async sendTestEvent(endpointId, options) {
+    return this.endpointCall("POST", endpointId, "/events/test", options);
+  }
+  async endpointCall(method, endpointId, suffix, body) {
+    const id = endpointId ?? this.config.counterpartyId;
+    if (!id) {
+      throw new AstraSyncError(
+        "An endpoint id (ASTRAE-\u2026) is required: pass it, or set counterpartyId on the client",
+        400,
+        "VALIDATION"
+      );
+    }
+    if (!this.config.apiKey) {
+      throw new AstraSyncError("This call needs the client apiKey", 401, "AUTH_REQUIRED");
+    }
+    const base = this.config.apiBaseUrl.replace(/\/+$/, "");
+    const url = `${base}/endpoints/${encodeURIComponent(id)}${suffix}`;
+    let res;
+    try {
+      res = await sdkFetch(url, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "X-API-Key": this.config.apiKey
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(Math.max(this.timeout, 15e3))
+      });
+    } catch (err) {
+      throw new AstraSyncError(
+        `${method} ${suffix || "/endpoints/:id"} failed: ${err instanceof Error ? err.message : String(err)}`,
+        0,
+        "network_error"
+      );
+    }
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok || json.success === false || json.data === void 0) {
+      const errObj = typeof json.error === "object" ? json.error : void 0;
+      const code = json.code ?? errObj?.code ?? (typeof json.error === "string" ? json.error : "unknown_error");
+      const message = json.message ?? errObj?.message ?? `HTTP ${res.status}`;
+      throw new AstraSyncError(`${message} (${code})`, res.status, code);
+    }
+    return json.data;
+  }
   /**
    * Quick verification — checks credentials and policy in one call.
    *