@astrasyncai/verification-gateway 5.19.0 → 5.20.0

package/dist/index.d.ts

@@ -243,6 +243,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -549,7 +560,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -741,6 +754,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -1658,6 +1677,11 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -1689,7 +1713,8 @@ declare function getTrustLevel(score: number): TrustLevel;
  */
 
 /**
- * Clear the verification cache
+ * Clear the verification cache, and (5.20.0) forget in-flight single-flight
+ * calls so a later identical request reaches the backend on its own.
  */
 declare function clearCache(): void;
 /**
@@ -1717,6 +1742,24 @@ interface VerifyOptions {
  * Main verification function
  */
 declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Whether `result` was served from the verdict cache or shared from a
+ * concurrent identical call (5.20.0). The adapters skip the decision POST for
+ * these: the session already has its decision from the call that created it.
+ */
+declare function isSharedVerdict(result: VerificationResult): boolean;
+type VerificationListener = (result: VerificationResult, request: VerificationRequest) => void;
+/**
+ * 5.20.0: observe every verdict this process fetched from verify-access
+ * (cache hits and single-flight followers are not repeated). Listeners run
+ * synchronously after the result is built and must not throw (a throw is
+ * swallowed). Returns an unsubscribe function.
+ *
+ * The MCP bridge uses it to size its per-agent rate limit from the trust
+ * score its tools' own verifies return, instead of paying for a second
+ * verify-access call in the gate.
+ */
+declare function onVerificationResult(listener: VerificationListener): () => void;
 /**
  * Report post-hoc consideration/outcome data for an attempt chain (Trust
  * Record). Use when the signal never reached verify-access: a
@@ -1750,6 +1793,12 @@ declare function fetchRoutes(config: GatewayConfig, counterpartyId: string, opti
      * here can only add checks".
      */
     codeGates?: string[];
+    /**
+     * 5.20.0: called with the endpoint's `counterpartyType` when the routes
+     * response carries it (backend round 29.1+). The MCP middleware uses it
+     * to warn when it is pointed at a non-`mcp_server` endpoint.
+     */
+    onEndpointType?: (counterpartyType: string) => void;
 }): Promise<RouteAccessConfigShape[] | null>;
 /**
  * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
@@ -2274,6 +2323,40 @@ declare class VerificationGatewayClient {
         status: string;
         alreadySettled?: boolean;
     }>;
+    /**
+     * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
+     * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
+     * endpoint's owner, or a personal key of an individual with an active seat
+     * in the owning organisation. Policy (rules, trust floor, challenge, edge
+     * config) stays dashboard-only. `null` clears a field. The owner is alerted
+     * when `eventsUrl` changes.
+     *
+     * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
+     * @returns the endpoint as stored, plus `changed` (the fields that changed)
+     * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
+     */
+    updateEndpoint(endpointId: string | undefined, patch: EndpointOperationalPatch): Promise<Record<string, unknown> & {
+        changed: Array<keyof EndpointOperationalPatch>;
+    }>;
+    /**
+     * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
+     * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
+     * Delivered synchronously, outside the event outbox (random `eventId`, no
+     * retries), signed with the endpoint's webhook secret like a real event.
+     * Without `approvalId` the payload is synthetic (a kit acknowledges and
+     * ignores it). With the id of a held kit approval at this endpoint the
+     * payload is the real one, so your resume path runs: `approved` makes the
+     * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
+     * `lapsed` release the session.
+     *
+     * Resolves even when your endpoint refused the event (`delivered: false`,
+     * with `responseCode` / `error`).
+     */
+    sendTestEvent(endpointId: string | undefined, options: {
+        type: TestEventType;
+        approvalId?: string;
+    }): Promise<TestEventResult>;
+    private endpointCall;
     /**
      * Quick verification — checks credentials and policy in one call.
      *
@@ -2313,6 +2396,28 @@ declare class VerificationGatewayClient {
      */
     private executeWithRetry;
 }
+/** 5.20.0: the operational fields `updateEndpoint` may change (`null` clears). */
+interface EndpointOperationalPatch {
+    eventsUrl?: string | null;
+    healthCheckUrl?: string | null;
+    skillUrl?: string | null;
+    catalogUrl?: string | null;
+    checkoutUrl?: string | null;
+}
+/** 5.20.0: the step-up event types `sendTestEvent` can send. */
+type TestEventType = 'step_up.approved' | 'step_up.denied' | 'step_up.expired' | 'step_up.lapsed';
+/** 5.20.0: what `sendTestEvent` reports. */
+interface TestEventResult {
+    delivered: boolean;
+    /** delivered | failed (bad answer / unreachable) | not_configured (no Events URL or secret). */
+    status: 'delivered' | 'failed' | 'not_configured';
+    /** Your endpoint's HTTP status, or null when nothing answered. */
+    responseCode: number | null;
+    error: string | null;
+    eventId: string;
+    type: TestEventType;
+    approvalId: string | null;
+}
 /**
  * Create a new SDK client
  */
@@ -2328,13 +2433,16 @@ declare function verifyOnce(options: SDKOptions & {
     action?: string;
 }): Promise<VerificationResult>;
 
+type sdk_EndpointOperationalPatch = EndpointOperationalPatch;
+type sdk_TestEventResult = TestEventResult;
+type sdk_TestEventType = TestEventType;
 type sdk_VerificationGatewayClient = VerificationGatewayClient;
 declare const sdk_VerificationGatewayClient: typeof VerificationGatewayClient;
 declare const sdk_createClient: typeof createClient;
 declare const sdk_getTrustLevel: typeof getTrustLevel;
 declare const sdk_verifyOnce: typeof verifyOnce;
 declare namespace sdk {
-  export { sdk_VerificationGatewayClient as VerificationGatewayClient, sdk_createClient as createClient, sdk_getTrustLevel as getTrustLevel, sdk_verifyOnce as verifyOnce };
+  export { type sdk_EndpointOperationalPatch as EndpointOperationalPatch, type sdk_TestEventResult as TestEventResult, type sdk_TestEventType as TestEventType, sdk_VerificationGatewayClient as VerificationGatewayClient, sdk_createClient as createClient, sdk_getTrustLevel as getTrustLevel, sdk_verifyOnce as verifyOnce };
 }
 
 /**
@@ -4127,6 +4235,28 @@ interface McpMiddlewareOptions extends GatewayConfig {
     toolGatePrecedence?: 'code' | 'dashboard';
     /** 5.19.0: refresh interval (ms) for the dashboard tool rules. Default 5 minutes. */
     routesRefreshMs?: number;
+    /**
+     * 5.20.0: tools and JSON-RPC methods that pass through with NO verify-access
+     * call at all — not even the audit evaluation `evaluateAlwaysIfCredentialed`
+     * adds for credentialed callers. Applies only while the call is not
+     * enforced (an `'observe'` gate, or a handshake/introspection method with
+     * no `methodGates` entry); a dashboard rule that enforces a listed tool
+     * still verifies.
+     *
+     * Use it for:
+     *   - `methods`: handshake and introspection (`initialize`, `tools/list`,
+     *     `resources/list`, `resources/read`) — nothing to attribute, and a
+     *     backend round trip slows the host's first card fetch;
+     *   - `tools`: observe tools whose handler calls verify-access itself, so
+     *     the gate's evaluation would be a second backend verify for the same
+     *     call (the MCP bridge measured ~3 backend calls per `verify_agent`).
+     *
+     * Listed calls leave `req.agentVerification` unset.
+     */
+    skipEvaluation?: {
+        tools?: readonly string[];
+        methods?: readonly string[];
+    };
     /**
      * Posture when the MCP middleware itself throws an internal error.
      *
@@ -4443,7 +4573,12 @@ interface AgentRecord {
     description?: string;
     agentType: string;
     agentStatus: string;
-    trustScore: number;
+    /**
+     * @deprecated Round 29.1: no longer returned. An agent never sees its own
+     * trust score (the register response omits it; counterparties read it
+     * from verify-access).
+     */
+    trustScore?: number;
     astrasyncIdLevel1?: string | null;
     tempId?: string | null;
     metadata?: Record<string, unknown>;
@@ -4457,7 +4592,11 @@ interface VerifyResponse {
         agentUuid: string;
         agentName: string;
         agentDescription: string;
-        agentTrustScore: number;
+        /**
+         * @deprecated Round 29.1: no longer returned by public verification.
+         * Counterparties read the score from verify-access.
+         */
+        agentTrustScore?: number;
         agentStatus: string;
         ownerName?: string;
     };
@@ -5346,7 +5485,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.19.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.20.0";
 declare const sdkFetch: typeof fetch;
 
 interface LocalPolicy {
@@ -5464,7 +5603,7 @@ declare function parseYaml(yamlContent: string): ParseResult;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.19.0";
+declare const SDK_VERSION = "5.20.0";
 
 /**
  * 5.15.0 — the `UCP-Agent` request header (UCP 2026-08-25): an RFC 8941
@@ -5507,6 +5646,9 @@ declare function checkUcpAgentBinding(header: string | string[] | null | undefin
  * `ucp.payment_handlers` are required even when empty; signing keys are the
  * TOP-LEVEL `keys[]` (a JWK Set). Served over HTTPS, never redirected, with
  * `Cache-Control: public, max-age >= 60`.
+ *
+ * 5.20.0: platforms that publish their keys as `signing_keys` are read too —
+ * use {@link ucpProfileKeys} wherever a profile's signing keys are needed.
  */
 
 declare const UCP_VERSION = "2026-08-25";
@@ -5543,7 +5685,14 @@ interface UcpProfile {
         payment_handlers: Record<string, UcpPaymentHandlerEntry[]>;
     };
     keys?: JWK[];
+    /** 5.20.0: accepted alongside `keys[]` (some platforms publish this name). */
+    signing_keys?: JWK[];
 }
+/**
+ * 5.20.0: a profile's signing keys — `keys[]` plus `signing_keys`, skipping
+ * malformed entries and encryption keys (`use: 'enc'`).
+ */
+declare function ucpProfileKeys(profile: Partial<UcpProfile> | null | undefined): JWK[];
 /** AstraSync payment handler declarations (spec pages hosted on astrasync.ai). */
 declare function astrasyncPaymentHandlers(handlers: string[], specBase?: string): Record<string, UcpPaymentHandlerEntry[]>;
 interface BuildProfileOptions {
@@ -5916,6 +6065,13 @@ interface CatalogItem {
     title: string;
     /** Minor units. */
     price: number;
+    /**
+     * 5.20.0: product image, an absolute http(s) URL. A relative or invalid value is
+     * dropped when the kit prices the line.
+     */
+    image_url?: string;
+    /** 5.20.0: short product description. */
+    description?: string;
 }
 interface CheckoutLine {
     id: string;
@@ -6715,6 +6871,10 @@ interface AcpCheckoutSession {
             id: string;
             name: string;
             unit_amount: number;
+            /** 5.20.0: absolute http(s) product image from the catalog. */
+            image_url?: string;
+            /** 5.20.0: product description from the catalog. */
+            description?: string;
         };
         quantity: number;
         name: string;
@@ -7278,4 +7438,4 @@ declare function contentDigest(body: string): string;
  */
 declare function signHttpRequest(req: SignableRequest, opts: SignHttpRequestOptions): Promise<Record<string, string>>;
 
-export { ACP_API_VERSION, ACP_SUPPORTED_API_VERSIONS, AEP_SPEC_VERSION, AP2_VCT, type AcpCheckoutKitOptions, type AcpCheckoutSession, type AcpCheckoutStatus, type AcpCheckoutStore, type AcpWellKnownOptions, type AepActorType, type AepArtifactRecord, type AepArtifactType, AepChain, type AepChainOptions, type AepChainVerification, type AepHashInput, type AgentArtifacts, AgentClient, type AgentCredentials, type AgentProtocol, type AgentProtocolIdentities, type AgentRecord, type Ap2Party, type Ap2VerifyResult, type ApprovalEvent, type ApprovalEventKit, type ApprovalEventsHandlerOptions, type ApprovalEventsResponse, AstraSync, type AstraSyncAepEvidence, type AstraSyncConfig, type AstraSyncCredentials, AstraSyncError, type AstraSyncMandates, type AttemptOutcome, type AttemptReport, AuthenticationError, type BuildGuidanceParams, CAPTURE_SCHEMA_VERSION, type CallerMetadata, ChallengeHandler, type CheckoutMetadata, type CommerceArtifactsPayload, type CommerceContext, type CommercePipelineInput, type CommerceShieldProps, type ConsiderationItem, type ConsiderationSet, type CounterpartyType, DECLARED_SOURCE_MAX, DEFAULT_EDGE_CONFIG, DEFAULT_IDEMPOTENCY_TTL_MS, type DashboardToolRule, type DynamicPlatformFingerprint, type EdgeConfig, type EdgeMode, type EdgePathRule, type EdgeVerificationDepth, type EnhancedVerificationResult, type ExpressHandlerOptions, type ExpressMiddlewareOptions, type FetchEdgeConfigResult, type FetchEdgeConfigSuccess, type FetchKit, type FiatSettlementBinding, type FrameworkConfig, type FulfilmentInfo, type GatewayConfig, type GuidanceEnvelope, type GuidanceInfo, type HandleApprovalEventsOptions, type HealthResponse, type HttpSignatureAlgorithm, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, KYDRequiredError, type KitExpressRequest, type KitExpressResponse, type KitMessage, type KitRequestContext, type KyaPayIdentity, type KyaPayResult, type KyaPayTokenType, type KyaPayVerifyOptions, type ParseResult as LocalPolicyParseResult, type ValidationError as LocalPolicyValidationError, type ValidationResult as LocalPolicyValidationResult, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, MCP_VERIFIED_HOP_HEADER, MCP_VERIFIED_HOP_MAX_AGE_MS, type McpMiddlewareOptions, MemoryCheckoutStore, MemoryIdempotencyStore, MemoryMppChallengeStore, MemorySeenEvents, type MerchantSettlementToken, type ModelConfig, type MppChallenge, type MppChallengeStore, type MppCredential, type MppReceipt, type MppVerifyOptions, type MppVerifyResult, type NegotiationResult, type NextJsMiddlewareOptions, type ObservedMetadata, type PDLSSConfig$1 as PDLSSConfig, type PDLSSDuration, type PDLSSInfo, type PDLSSLimits, type PDLSSPurpose, type PDLSSScope, type PDLSSSelfInstantiation, PLATFORM_AGENT_SIGNATURES, type PendingRegistrationResponse, type PendingResolution, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, type PlatformSignatureDef, type PollRegistrationResult, type ProtocolTransport, type PurposeSource, RUNTIME_SIGNATURES, RedisIdempotencyStore, type RedisLike, type RegisterOptions, type RegisterResult, RegistrationDeniedError, RegistrationExpiredError, type RegistrationResponse, RegistrationTimeoutError, type ReportAttemptOptions, type ReportRetryOptions, type ResumeOutcome, type ResumeResult, type RootKeyResolver, type RouteAccessConfig, type RoutePolicy, type RuntimeChallengeResult, type RuntimeSignature, type SDKOptions, SDK_USER_AGENT, type SanitizeHeadersResult, type SeenEvents, type SettlementArtifact, type SettlementArtifactBinding, type SettlementArtifactBindingBase, type SettlementDecision, type SettlementOutcomeInfo, SettlementReportError, type SettlementRequest, type SignHttpRequestOptions, type SignableRequest, type StablecoinSettlementBinding, type StepUpApprovalInfo, type StepUpApprovalStatus, type StepUpOutcome, TRUST_LEVEL_RANGES, type TokenGuidance, type ToolGate, type ToolGateConfig, type TrustLevel, UCP_ORDER_CAPABILITY, UCP_VERSION, type UcpAgentBinding, type CatalogItem as UcpCatalogItem, type UcpCheckoutKitOptions, type CheckoutSession as UcpCheckoutSession, type CheckoutStore as UcpCheckoutStore, type UcpLink, type UcpMessage, type UcpOrder, type UcpProfile, type UcpProfileResult, type SettleResult as UcpSettleResult, type UcpSeverity, type UcpSignatureResult, VERIFICATION_STATUS_HEADER, SDK_VERSION as VERSION, type VerificationInterstitialProps, type VerificationRequest, type VerificationResult, type VerifiedAgent, type VerifiedDeveloper, type VerifiedHopMarker, type VerifiedOrganization, type VerifyAp2Options, type VerifyOptions, type VerifyResponse, type WaitForApprovalOptions, type WellKnownAgenticCommerce, type X402PaymentPayload, type X402PaymentRequired, type X402PaymentRequirements, type X402ResourceInfo, type X402SettlementResponse, _resetEdgeConfigCache, abandonIdempotent, acpPaymentHandlers, aepCanonicalJson, aepHash, aepPrivateKeyFromSeed, aepPublicKeyDocument, aepPublicKeyFromBase64, aepRawPublicKey, aepSign, aepTimestamp, aepVerifySignature, index as agent, approvalEventsHandler, astrasyncPaymentHandlers, authorizeSettlement, awaitStepUpApproval, beginIdempotent, buildAcpWellKnown, buildGuidance, buildMpp402Response, buildMppChallenge, buildSdkObservedMetadata, buildUcpOrder, buildUcpProfile, buildVerificationUnavailableBody, buildX402Challenge, canonicalJson, checkUcpAgentBinding, checkoutHash, clearCache, closedCheckoutMandate, closedPaymentMandate, contentDigest, createAcpCheckoutKit, createKbHop, createMcpMiddleware, createUcpCheckoutKit, decodeMppRequest, degradeToObserve, denyStatusFor, deriveConnectionFromHeaders, detectPlatformFingerprint, detectRuntime, encodeMppReceipt, encodeX402SettlementResponse, express, expressHandler, extractApiKeyFormat, extractCredentials, extractMcpCredentials, extractPlatformHeaders, fetchEdgeConfig, fetchRoutes, fetchUcpProfile, finishIdempotent, getCachedWellKnownUrls, getEdgeConfig, getTrustLevel, getWellKnownUrls, handleApprovalEvents, hasCredentials, idempotencyMiddleware, isEdgeConfig, isRejectedIdentityClaim, isRetryableSettlementError, isSpecialUseIp, isVerificationUnavailable, isVerifiedHopValidFor, issueDelegateSdJwt, matchEdgePathRule, matchPlatformSignature, matchRoutePattern, mppBodyDigest, negotiateUcp, nextjs, normalizeDeclaredSource, openCheckoutMandate, openPaymentMandate, parseYaml as parseLocalPolicyYaml, parseMppCredential, parseUcpAgentHeader, parseVerifiedHop, parseX402Challenge, parseX402Payment, pollStepUpStatus, prefetchWellKnown, quickVerify, recordDecision, reportAttempt, reportUnregisteredAttempt, requestFingerprint, rootMandateDigest, routePatternToRegExp, routePolicyOf, sanitizeHeaders, sdk, sdkFetch, sendUcpWebhook, serializeVerifiedHop, setMcpMeta, signHttpRequest, signRootMandate, signUcpRequest, signUcpResponse, index$1 as transport, ucpError, ucpEscalation, ucpFailure, ucpProfileHandler, ucpRequiredComponents, unavailableRetryAfterSeconds, validatePolicy as validateLocalPolicy, verify, verifyAepChain, verifyAp2Mandate, verifyDelegateChain, verifyKyaPayTokens, verifyMppChallenge, verifyUcpRequest, withIdempotency, x402PaymentMatchesOffer };
+export { ACP_API_VERSION, ACP_SUPPORTED_API_VERSIONS, AEP_SPEC_VERSION, AP2_VCT, type AcpCheckoutKitOptions, type AcpCheckoutSession, type AcpCheckoutStatus, type AcpCheckoutStore, type AcpWellKnownOptions, type AepActorType, type AepArtifactRecord, type AepArtifactType, AepChain, type AepChainOptions, type AepChainVerification, type AepHashInput, type AgentArtifacts, AgentClient, type AgentCredentials, type AgentProtocol, type AgentProtocolIdentities, type AgentRecord, type Ap2Party, type Ap2VerifyResult, type ApprovalEvent, type ApprovalEventKit, type ApprovalEventsHandlerOptions, type ApprovalEventsResponse, AstraSync, type AstraSyncAepEvidence, type AstraSyncConfig, type AstraSyncCredentials, AstraSyncError, type AstraSyncMandates, type AttemptOutcome, type AttemptReport, AuthenticationError, type BuildGuidanceParams, CAPTURE_SCHEMA_VERSION, type CallerMetadata, ChallengeHandler, type CheckoutMetadata, type CommerceArtifactsPayload, type CommerceContext, type CommercePipelineInput, type CommerceShieldProps, type ConsiderationItem, type ConsiderationSet, type CounterpartyType, DECLARED_SOURCE_MAX, DEFAULT_EDGE_CONFIG, DEFAULT_IDEMPOTENCY_TTL_MS, type DashboardToolRule, type DynamicPlatformFingerprint, type EdgeConfig, type EdgeMode, type EdgePathRule, type EdgeVerificationDepth, type EndpointOperationalPatch, type EnhancedVerificationResult, type ExpressHandlerOptions, type ExpressMiddlewareOptions, type FetchEdgeConfigResult, type FetchEdgeConfigSuccess, type FetchKit, type FiatSettlementBinding, type FrameworkConfig, type FulfilmentInfo, type GatewayConfig, type GuidanceEnvelope, type GuidanceInfo, type HandleApprovalEventsOptions, type HealthResponse, type HttpSignatureAlgorithm, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, KYDRequiredError, type KitExpressRequest, type KitExpressResponse, type KitMessage, type KitRequestContext, type KyaPayIdentity, type KyaPayResult, type KyaPayTokenType, type KyaPayVerifyOptions, type ParseResult as LocalPolicyParseResult, type ValidationError as LocalPolicyValidationError, type ValidationResult as LocalPolicyValidationResult, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, MCP_VERIFIED_HOP_HEADER, MCP_VERIFIED_HOP_MAX_AGE_MS, type McpMiddlewareOptions, MemoryCheckoutStore, MemoryIdempotencyStore, MemoryMppChallengeStore, MemorySeenEvents, type MerchantSettlementToken, type ModelConfig, type MppChallenge, type MppChallengeStore, type MppCredential, type MppReceipt, type MppVerifyOptions, type MppVerifyResult, type NegotiationResult, type NextJsMiddlewareOptions, type ObservedMetadata, type PDLSSConfig$1 as PDLSSConfig, type PDLSSDuration, type PDLSSInfo, type PDLSSLimits, type PDLSSPurpose, type PDLSSScope, type PDLSSSelfInstantiation, PLATFORM_AGENT_SIGNATURES, type PendingRegistrationResponse, type PendingResolution, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, type PlatformSignatureDef, type PollRegistrationResult, type ProtocolTransport, type PurposeSource, RUNTIME_SIGNATURES, RedisIdempotencyStore, type RedisLike, type RegisterOptions, type RegisterResult, RegistrationDeniedError, RegistrationExpiredError, type RegistrationResponse, RegistrationTimeoutError, type ReportAttemptOptions, type ReportRetryOptions, type ResumeOutcome, type ResumeResult, type RootKeyResolver, type RouteAccessConfig, type RoutePolicy, type RuntimeChallengeResult, type RuntimeSignature, type SDKOptions, SDK_USER_AGENT, type SanitizeHeadersResult, type SeenEvents, type SettlementArtifact, type SettlementArtifactBinding, type SettlementArtifactBindingBase, type SettlementDecision, type SettlementOutcomeInfo, SettlementReportError, type SettlementRequest, type SignHttpRequestOptions, type SignableRequest, type StablecoinSettlementBinding, type StepUpApprovalInfo, type StepUpApprovalStatus, type StepUpOutcome, TRUST_LEVEL_RANGES, type TestEventResult, type TestEventType, type TokenGuidance, type ToolGate, type ToolGateConfig, type TrustLevel, UCP_ORDER_CAPABILITY, UCP_VERSION, type UcpAgentBinding, type CatalogItem as UcpCatalogItem, type UcpCheckoutKitOptions, type CheckoutSession as UcpCheckoutSession, type CheckoutStore as UcpCheckoutStore, type UcpLink, type UcpMessage, type UcpOrder, type UcpProfile, type UcpProfileResult, type SettleResult as UcpSettleResult, type UcpSeverity, type UcpSignatureResult, VERIFICATION_STATUS_HEADER, SDK_VERSION as VERSION, type VerificationInterstitialProps, type VerificationRequest, type VerificationResult, type VerificationWarning, type VerifiedAgent, type VerifiedDeveloper, type VerifiedHopMarker, type VerifiedOrganization, type VerifyAp2Options, type VerifyOptions, type VerifyResponse, type WaitForApprovalOptions, type WellKnownAgenticCommerce, type X402PaymentPayload, type X402PaymentRequired, type X402PaymentRequirements, type X402ResourceInfo, type X402SettlementResponse, _resetEdgeConfigCache, abandonIdempotent, acpPaymentHandlers, aepCanonicalJson, aepHash, aepPrivateKeyFromSeed, aepPublicKeyDocument, aepPublicKeyFromBase64, aepRawPublicKey, aepSign, aepTimestamp, aepVerifySignature, index as agent, approvalEventsHandler, astrasyncPaymentHandlers, authorizeSettlement, awaitStepUpApproval, beginIdempotent, buildAcpWellKnown, buildGuidance, buildMpp402Response, buildMppChallenge, buildSdkObservedMetadata, buildUcpOrder, buildUcpProfile, buildVerificationUnavailableBody, buildX402Challenge, canonicalJson, checkUcpAgentBinding, checkoutHash, clearCache, closedCheckoutMandate, closedPaymentMandate, contentDigest, createAcpCheckoutKit, createKbHop, createMcpMiddleware, createUcpCheckoutKit, decodeMppRequest, degradeToObserve, denyStatusFor, deriveConnectionFromHeaders, detectPlatformFingerprint, detectRuntime, encodeMppReceipt, encodeX402SettlementResponse, express, expressHandler, extractApiKeyFormat, extractCredentials, extractMcpCredentials, extractPlatformHeaders, fetchEdgeConfig, fetchRoutes, fetchUcpProfile, finishIdempotent, getCachedWellKnownUrls, getEdgeConfig, getTrustLevel, getWellKnownUrls, handleApprovalEvents, hasCredentials, idempotencyMiddleware, isEdgeConfig, isRejectedIdentityClaim, isRetryableSettlementError, isSharedVerdict, isSpecialUseIp, isVerificationUnavailable, isVerifiedHopValidFor, issueDelegateSdJwt, matchEdgePathRule, matchPlatformSignature, matchRoutePattern, mppBodyDigest, negotiateUcp, nextjs, normalizeDeclaredSource, onVerificationResult, openCheckoutMandate, openPaymentMandate, parseYaml as parseLocalPolicyYaml, parseMppCredential, parseUcpAgentHeader, parseVerifiedHop, parseX402Challenge, parseX402Payment, pollStepUpStatus, prefetchWellKnown, quickVerify, recordDecision, reportAttempt, reportUnregisteredAttempt, requestFingerprint, rootMandateDigest, routePatternToRegExp, routePolicyOf, sanitizeHeaders, sdk, sdkFetch, sendUcpWebhook, serializeVerifiedHop, setMcpMeta, signHttpRequest, signRootMandate, signUcpRequest, signUcpResponse, index$1 as transport, ucpError, ucpEscalation, ucpFailure, ucpProfileHandler, ucpProfileKeys, ucpRequiredComponents, unavailableRetryAfterSeconds, validatePolicy as validateLocalPolicy, verify, verifyAepChain, verifyAp2Mandate, verifyDelegateChain, verifyKyaPayTokens, verifyMppChallenge, verifyUcpRequest, withIdempotency, x402PaymentMatchesOffer };