@astrasyncai/verification-gateway 5.19.0 → 5.20.0

package/dist/{types-BRz2U0Pn.d.ts → types-B_HLhZ9n.d.ts}

@@ -1,4 +1,4 @@
-import { C as CounterpartyType, T as TokenGuidance } from './types-BfILnheI.js';
+import { C as CounterpartyType, T as TokenGuidance } from './types-CU17R4Nr.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-BfILnheI.d.mts → types-CU17R4Nr.d.mts}

@@ -34,6 +34,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */

package/dist/{types-BfILnheI.d.ts → types-CU17R4Nr.d.ts}

@@ -34,6 +34,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */

package/dist/{types-DqWPkiYl.d.mts → types-CxjqmPl-.d.mts}

@@ -111,6 +111,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -361,7 +372,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -553,6 +566,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -1289,5 +1308,10 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
 export type { AgentArtifacts as A, CheckoutMetadata as C, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, GuidanceInfo as c, VerificationRequest as d, VerificationResult as e };

package/dist/{types-DqWPkiYl.d.ts → types-CxjqmPl-.d.ts}

@@ -111,6 +111,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -361,7 +372,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -553,6 +566,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -1289,5 +1308,10 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
 export type { AgentArtifacts as A, CheckoutMetadata as C, ExpressMiddlewareOptions as E, GatewayConfig as G, NextJsMiddlewareOptions as N, SDKOptions as S, TrustLevel as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, GuidanceInfo as c, VerificationRequest as d, VerificationResult as e };

package/dist/{types-BoGjyon0.d.mts → types-D37aSQ9c.d.mts}

@@ -53,6 +53,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -303,7 +314,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -495,6 +508,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -1071,5 +1090,10 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
 export type { AgentCredentials as A, CommerceArtifactsPayload as C, GatewayConfig as G, TokenGuidance as T, VerificationRequest as V, AttemptReport as a, CounterpartyType as b, VerificationResult as c };

package/dist/{types-CfBpm3w5.d.mts → types-Djpz-L0w.d.mts}

@@ -1,4 +1,4 @@
-import { C as CounterpartyType, T as TokenGuidance } from './types-BfILnheI.mjs';
+import { C as CounterpartyType, T as TokenGuidance } from './types-CU17R4Nr.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-eWyZuz-3.d.ts → types-Dn8tXnei.d.ts}

@@ -53,6 +53,17 @@ interface GatewayConfig {
     debug?: boolean;
     /** Custom headers to send with verification requests */
     customHeaders?: Record<string, string>;
+    /**
+     * 5.20.0: proof that this caller may act as the agent, sent as
+     * `actingProof` in the verify-access body. Honoured only from a
+     * first-party AstraSync service caller (the bridge): the backend checks the
+     * connector's OAuth access token and records a `connector_owner` proof when
+     * its owner owns the agent. Ignored for any other key. A verify carrying it
+     * is never served from, or written to, the verdict cache.
+     */
+    actingProof?: {
+        connectorToken: string;
+    };
     /** This counterparty's URL (sent with verify-access requests for analytics) */
     counterpartyUrl?: string;
     /** This counterparty's type (sent with verify-access requests for analytics) */
@@ -303,7 +314,9 @@ interface StepUpApprovalInfo {
  * Lifecycle states of a step-up approval row (mirrors the backend's
  * step_up_approval_status_check constraint).
  */
-type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
+type StepUpApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed'
+/** 5.20.0: approved but never redeemed inside the redemption window. */
+ | 'lapsed';
 /**
  * Terminal outcome of a hold-and-poll wait: any non-pending status, or
  * 'timeout' when the hold budget ran out while the approval was still pending.
@@ -495,6 +508,12 @@ interface VerificationResult {
      * (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.20.0 (round 29.1): non-fatal integration warnings for the caller —
+     * e.g. `events_url_missing` when a kit's held confirm is on an endpoint with
+     * no Events URL (the kit would never hear the owner's decision).
+     */
+    warnings?: VerificationWarning[];
     /**
      * Card settlement token. Present on a card purchase at a first-party
      * storefront (our Stripe tenant) — 5.14.1: always, there is no charge-here
@@ -1071,5 +1090,10 @@ interface AstraSyncAepEvidence {
         platform_countersignature: string;
     }>;
 }
+/** 5.20.0: a non-fatal warning on a verify-access result (see `warnings`). */
+interface VerificationWarning {
+    code: string;
+    message: string;
+}
 
 export type { AgentCredentials as A, CommerceArtifactsPayload as C, GatewayConfig as G, TokenGuidance as T, VerificationRequest as V, AttemptReport as a, CounterpartyType as b, VerificationResult as c };

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, e as VerificationResult, a as AgentCredentials, c as GuidanceInfo, T as TrustLevel } from '../types-DqWPkiYl.mjs';
+import { V as VerificationInterstitialProps, e as VerificationResult, a as AgentCredentials, c as GuidanceInfo, T as TrustLevel } from '../types-CxjqmPl-.mjs';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, e as VerificationResult, a as AgentCredentials, c as GuidanceInfo, T as TrustLevel } from '../types-DqWPkiYl.js';
+import { V as VerificationInterstitialProps, e as VerificationResult, a as AgentCredentials, c as GuidanceInfo, T as TrustLevel } from '../types-CxjqmPl-.js';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-BoGjyon0.mjs';
+import { A as AgentCredentials, G as GatewayConfig, c as VerificationResult, V as VerificationRequest, a as AttemptReport } from './types-D37aSQ9c.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**
@@ -11,7 +11,8 @@ import { ObservedMetadata } from './metadata-capture.mjs';
 /** Test-only: re-arm the one-time init self-check. */
 declare function _resetInitCheck(): void;
 /**
- * Clear the verification cache
+ * Clear the verification cache, and (5.20.0) forget in-flight single-flight
+ * calls so a later identical request reaches the backend on its own.
  */
 declare function clearCache(): void;
 /**
@@ -48,6 +49,24 @@ interface VerifyOptions {
  * Main verification function
  */
 declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Whether `result` was served from the verdict cache or shared from a
+ * concurrent identical call (5.20.0). The adapters skip the decision POST for
+ * these: the session already has its decision from the call that created it.
+ */
+declare function isSharedVerdict(result: VerificationResult): boolean;
+type VerificationListener = (result: VerificationResult, request: VerificationRequest) => void;
+/**
+ * 5.20.0: observe every verdict this process fetched from verify-access
+ * (cache hits and single-flight followers are not repeated). Listeners run
+ * synchronously after the result is built and must not throw (a throw is
+ * swallowed). Returns an unsubscribe function.
+ *
+ * The MCP bridge uses it to size its per-agent rate limit from the trust
+ * score its tools' own verifies return, instead of paying for a second
+ * verify-access call in the gate.
+ */
+declare function onVerificationResult(listener: VerificationListener): () => void;
 /**
  * Record a counterparty's grant/deny decision for a verification session.
  * Fire-and-forget — errors are silently swallowed.
@@ -86,6 +105,12 @@ declare function fetchRoutes(config: GatewayConfig, counterpartyId: string, opti
      * here can only add checks".
      */
     codeGates?: string[];
+    /**
+     * 5.20.0: called with the endpoint's `counterpartyType` when the routes
+     * response carries it (backend round 29.1+). The MCP middleware uses it
+     * to warn when it is pointed at a non-`mcp_server` endpoint.
+     */
+    onEndpointType?: (counterpartyType: string) => void;
 }): Promise<RouteAccessConfigShape[] | null>;
 /**
  * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
@@ -215,4 +240,4 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     retryAfterMs?: number;
 }>;
 
-export { type ReportAttemptOptions, type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, parseRetryAfterMs, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };
+export { type ReportAttemptOptions, type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, isSharedVerdict, onVerificationResult, parseRetryAfterMs, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-eWyZuz-3.js';
+import { A as AgentCredentials, G as GatewayConfig, c as VerificationResult, V as VerificationRequest, a as AttemptReport } from './types-Dn8tXnei.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**
@@ -11,7 +11,8 @@ import { ObservedMetadata } from './metadata-capture.js';
 /** Test-only: re-arm the one-time init self-check. */
 declare function _resetInitCheck(): void;
 /**
- * Clear the verification cache
+ * Clear the verification cache, and (5.20.0) forget in-flight single-flight
+ * calls so a later identical request reaches the backend on its own.
  */
 declare function clearCache(): void;
 /**
@@ -48,6 +49,24 @@ interface VerifyOptions {
  * Main verification function
  */
 declare function verify(config: GatewayConfig, request: VerificationRequest, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Whether `result` was served from the verdict cache or shared from a
+ * concurrent identical call (5.20.0). The adapters skip the decision POST for
+ * these: the session already has its decision from the call that created it.
+ */
+declare function isSharedVerdict(result: VerificationResult): boolean;
+type VerificationListener = (result: VerificationResult, request: VerificationRequest) => void;
+/**
+ * 5.20.0: observe every verdict this process fetched from verify-access
+ * (cache hits and single-flight followers are not repeated). Listeners run
+ * synchronously after the result is built and must not throw (a throw is
+ * swallowed). Returns an unsubscribe function.
+ *
+ * The MCP bridge uses it to size its per-agent rate limit from the trust
+ * score its tools' own verifies return, instead of paying for a second
+ * verify-access call in the gate.
+ */
+declare function onVerificationResult(listener: VerificationListener): () => void;
 /**
  * Record a counterparty's grant/deny decision for a verification session.
  * Fire-and-forget — errors are silently swallowed.
@@ -86,6 +105,12 @@ declare function fetchRoutes(config: GatewayConfig, counterpartyId: string, opti
      * here can only add checks".
      */
     codeGates?: string[];
+    /**
+     * 5.20.0: called with the endpoint's `counterpartyType` when the routes
+     * response carries it (backend round 29.1+). The MCP middleware uses it
+     * to warn when it is pointed at a non-`mcp_server` endpoint.
+     */
+    onEndpointType?: (counterpartyType: string) => void;
 }): Promise<RouteAccessConfigShape[] | null>;
 /**
  * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the
@@ -215,4 +240,4 @@ declare function quickVerify(config: GatewayConfig, credentials: AgentCredential
     retryAfterMs?: number;
 }>;
 
-export { type ReportAttemptOptions, type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, parseRetryAfterMs, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };
+export { type ReportAttemptOptions, type RouteAccessConfigShape, type VerifyOptions, _resetInitCheck, clearCache, extractCredentials, fetchRoutes, hasCredentials, isSharedVerdict, onVerificationResult, parseRetryAfterMs, quickVerify, recordDecision, reportAttempt, reportCounterpartyPreCheckFailure, reportUnregisteredAttempt, verify, verifyAndRecord };

package/dist/verify.js

@@ -25,6 +25,8 @@ __export(verify_exports, {
   extractCredentials: () => extractCredentials,
   fetchRoutes: () => fetchRoutes,
   hasCredentials: () => hasCredentials,
+  isSharedVerdict: () => isSharedVerdict,
+  onVerificationResult: () => onVerificationResult,
   parseRetryAfterMs: () => parseRetryAfterMs,
   quickVerify: () => quickVerify,
   recordDecision: () => recordDecision,
@@ -37,7 +39,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.19.0";
+var SDK_VERSION = "5.20.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -248,6 +250,7 @@ function cacheResult(request, result, configuredTtl, counterpartyId) {
 }
 function clearCache() {
   verificationCache.clear();
+  inflightVerifies.clear();
 }
 function extractCredentials(headers, query) {
   const credentials = {};
@@ -421,6 +424,9 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (config.actingProof?.connectorToken) {
+    body.actingProof = { connectorToken: config.actingProof.connectorToken };
+  }
   if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
@@ -588,22 +594,46 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  const uncacheable = Boolean(request.commerceArtifacts);
+  const uncacheable = Boolean(request.commerceArtifacts) || Boolean(mergedConfig.actingProof);
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      const hit = { ...cached };
-      if (request.attemptId) {
-        hit.attemptId = request.attemptId;
-      } else {
-        delete hit.attemptId;
-      }
-      return hit;
+      return sharedVerdict(cached, request);
+    }
+  }
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
+    const key = getCacheKey(request, mergedConfig.counterpartyId);
+    const pending = inflightVerifies.get(key);
+    if (pending) return sharedVerdict(await pending, request);
+    const flight = verifyViaApi(mergedConfig, request, urls, uncacheable);
+    inflightVerifies.set(key, flight);
+    try {
+      return await flight;
+    } finally {
+      inflightVerifies.delete(key);
     }
   }
+  return verifyViaApi(mergedConfig, request, urls, uncacheable);
+}
+var inflightVerifies = /* @__PURE__ */ new Map();
+var sharedVerdicts = /* @__PURE__ */ new WeakSet();
+function isSharedVerdict(result) {
+  return sharedVerdicts.has(result);
+}
+function sharedVerdict(source, request) {
+  const hit = { ...source };
+  if (request.attemptId) {
+    hit.attemptId = request.attemptId;
+  } else {
+    delete hit.attemptId;
+  }
+  sharedVerdicts.add(hit);
+  return hit;
+}
+async function verifyViaApi(mergedConfig, request, urls, uncacheable) {
   const enrichedRequest = { ...request };
   if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {
     enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;
@@ -682,7 +712,9 @@ async function verify(config, request, options) {
       fulfilment: apiResponse.fulfilment,
       mandates: apiResponse.mandates,
       kyaToken: apiResponse.kyaToken,
-      aep: apiResponse.aep
+      aep: apiResponse.aep,
+      // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+      warnings: apiResponse.warnings
     };
     return result2;
   }
@@ -750,7 +782,9 @@ async function verify(config, request, options) {
     // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
     mandates: apiResponse.mandates,
     kyaToken: apiResponse.kyaToken,
-    aep: apiResponse.aep
+    aep: apiResponse.aep,
+    // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+    warnings: apiResponse.warnings
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -776,8 +810,24 @@ async function verify(config, request, options) {
       cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
     }
   }
+  notifyVerificationListeners(request, result);
   return result;
 }
+var verificationListeners = /* @__PURE__ */ new Set();
+function onVerificationResult(listener) {
+  verificationListeners.add(listener);
+  return () => {
+    verificationListeners.delete(listener);
+  };
+}
+function notifyVerificationListeners(request, result) {
+  for (const listener of verificationListeners) {
+    try {
+      listener(result, request);
+    } catch {
+    }
+  }
+}
 async function recordDecision(config, sessionId, decision, reason) {
   const headers = { "Content-Type": "application/json" };
   if (config.apiKey) {
@@ -842,6 +892,7 @@ async function fetchRoutes(config, counterpartyId, options = {}) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
+    headers["X-AstraSync-SDK-Version"] = SDK_VERSION;
     const response = await sdkFetch(
       `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes` + (options.codeGates?.length ? `?codeGates=${options.codeGates.map(encodeURIComponent).join(",")}` : ""),
       { method: "GET", headers }
@@ -856,6 +907,13 @@ async function fetchRoutes(config, counterpartyId, options = {}) {
       return null;
     }
     const body = await response.json();
+    const type = body.data?.counterpartyType;
+    if (typeof type === "string" && options.onEndpointType) {
+      try {
+        options.onEndpointType(type);
+      } catch {
+      }
+    }
     return body.data?.routes ?? [];
   } catch {
     return null;
@@ -925,6 +983,8 @@ async function quickVerify(config, credentials) {
   extractCredentials,
   fetchRoutes,
   hasCredentials,
+  isSharedVerdict,
+  onVerificationResult,
   parseRetryAfterMs,
   quickVerify,
   recordDecision,