@astrasyncai/verification-gateway 5.19.0 → 5.21.0

package/dist/index.js

@@ -44,6 +44,7 @@ __export(src_exports, {
   DECLARED_SOURCE_MAX: () => DECLARED_SOURCE_MAX,
   DEFAULT_EDGE_CONFIG: () => DEFAULT_EDGE_CONFIG,
   DEFAULT_IDEMPOTENCY_TTL_MS: () => DEFAULT_IDEMPOTENCY_TTL_MS,
+  ISSUER_PROGRAM_HEADER: () => ISSUER_PROGRAM_HEADER,
   KYDRequiredError: () => KYDRequiredError,
   MAX_HEADERS: () => MAX_HEADERS,
   MAX_HEADER_VALUE_BYTES: () => MAX_HEADER_VALUE_BYTES,
@@ -102,6 +103,7 @@ __export(src_exports, {
   closedPaymentMandate: () => closedPaymentMandate,
   contentDigest: () => contentDigest,
   createAcpCheckoutKit: () => createAcpCheckoutKit,
+  createAgentCommerce: () => createAgentCommerce,
   createKbHop: () => createKbHop,
   createMcpMiddleware: () => createMcpMiddleware,
   createUcpCheckoutKit: () => createUcpCheckoutKit,
@@ -123,6 +125,7 @@ __export(src_exports, {
   fetchRoutes: () => fetchRoutes,
   fetchUcpProfile: () => fetchUcpProfile,
   finishIdempotent: () => finishIdempotent,
+  fromFeed: () => fromFeed,
   getCachedWellKnownUrls: () => getCachedWellKnownUrls,
   getEdgeConfig: () => getEdgeConfig,
   getTrustLevel: () => getTrustLevel,
@@ -133,10 +136,12 @@ __export(src_exports, {
   isEdgeConfig: () => isEdgeConfig,
   isRejectedIdentityClaim: () => isRejectedIdentityClaim,
   isRetryableSettlementError: () => isRetryableSettlementError,
+  isSharedVerdict: () => isSharedVerdict,
   isSpecialUseIp: () => isSpecialUseIp,
   isVerificationUnavailable: () => isVerificationUnavailable,
   isVerifiedHopValidFor: () => isVerifiedHopValidFor,
   issueDelegateSdJwt: () => issueDelegateSdJwt,
+  issuerOfferPrice: () => issuerOfferPrice,
   matchEdgePathRule: () => matchEdgePathRule,
   matchPlatformSignature: () => matchPlatformSignature,
   matchRoutePattern: () => matchRoutePattern,
@@ -144,8 +149,10 @@ __export(src_exports, {
   negotiateUcp: () => negotiateUcp,
   nextjs: () => nextjs_exports,
   normalizeDeclaredSource: () => normalizeDeclaredSource,
+  onVerificationResult: () => onVerificationResult,
   openCheckoutMandate: () => openCheckoutMandate,
   openPaymentMandate: () => openPaymentMandate,
+  parseFeed: () => parseFeed,
   parseLocalPolicyYaml: () => parseYaml,
   parseMppCredential: () => parseMppCredential,
   parseUcpAgentHeader: () => parseUcpAgentHeader,
@@ -154,6 +161,7 @@ __export(src_exports, {
   parseX402Payment: () => parseX402Payment,
   pollStepUpStatus: () => pollStepUpStatus,
   prefetchWellKnown: () => prefetchWellKnown,
+  priceForAgent: () => priceForAgent,
   quickVerify: () => quickVerify,
   recordDecision: () => recordDecision2,
   reportAttempt: () => reportAttempt,
@@ -167,6 +175,7 @@ __export(src_exports, {
   sdkFetch: () => sdkFetch,
   sendUcpWebhook: () => sendUcpWebhook,
   serializeVerifiedHop: () => serializeVerifiedHop,
+  serveAgentCatalog: () => serveAgentCatalog,
   setMcpMeta: () => setMcpMeta,
   signHttpRequest: () => signHttpRequest,
   signRootMandate: () => signRootMandate,
@@ -177,6 +186,7 @@ __export(src_exports, {
   ucpEscalation: () => ucpEscalation,
   ucpFailure: () => ucpFailure,
   ucpProfileHandler: () => ucpProfileHandler,
+  ucpProfileKeys: () => ucpProfileKeys,
   ucpRequiredComponents: () => ucpRequiredComponents,
   unavailableRetryAfterSeconds: () => unavailableRetryAfterSeconds,
   validateLocalPolicy: () => validatePolicy,
@@ -218,7 +228,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.19.0";
+var SDK_VERSION = "5.21.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -500,6 +510,7 @@ function cacheResult(request, result, configuredTtl, counterpartyId) {
 }
 function clearCache() {
   verificationCache.clear();
+  inflightVerifies.clear();
 }
 function extractCredentials(headers, query) {
   const credentials = {};
@@ -673,6 +684,9 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (config.actingProof?.connectorToken) {
+    body.actingProof = { connectorToken: config.actingProof.connectorToken };
+  }
   if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
@@ -840,22 +854,46 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  const uncacheable = Boolean(request.commerceArtifacts);
+  const uncacheable = Boolean(request.commerceArtifacts) || Boolean(mergedConfig.actingProof);
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      const hit = { ...cached };
-      if (request.attemptId) {
-        hit.attemptId = request.attemptId;
-      } else {
-        delete hit.attemptId;
-      }
-      return hit;
+      return sharedVerdict(cached, request);
+    }
+  }
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
+    const key = getCacheKey(request, mergedConfig.counterpartyId);
+    const pending = inflightVerifies.get(key);
+    if (pending) return sharedVerdict(await pending, request);
+    const flight = verifyViaApi(mergedConfig, request, urls, uncacheable);
+    inflightVerifies.set(key, flight);
+    try {
+      return await flight;
+    } finally {
+      inflightVerifies.delete(key);
     }
   }
+  return verifyViaApi(mergedConfig, request, urls, uncacheable);
+}
+var inflightVerifies = /* @__PURE__ */ new Map();
+var sharedVerdicts = /* @__PURE__ */ new WeakSet();
+function isSharedVerdict(result) {
+  return sharedVerdicts.has(result);
+}
+function sharedVerdict(source, request) {
+  const hit = { ...source };
+  if (request.attemptId) {
+    hit.attemptId = request.attemptId;
+  } else {
+    delete hit.attemptId;
+  }
+  sharedVerdicts.add(hit);
+  return hit;
+}
+async function verifyViaApi(mergedConfig, request, urls, uncacheable) {
   const enrichedRequest = { ...request };
   if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {
     enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;
@@ -934,7 +972,9 @@ async function verify(config, request, options) {
       fulfilment: apiResponse.fulfilment,
       mandates: apiResponse.mandates,
       kyaToken: apiResponse.kyaToken,
-      aep: apiResponse.aep
+      aep: apiResponse.aep,
+      // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+      warnings: apiResponse.warnings
     };
     return result2;
   }
@@ -1002,7 +1042,9 @@ async function verify(config, request, options) {
     // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
     mandates: apiResponse.mandates,
     kyaToken: apiResponse.kyaToken,
-    aep: apiResponse.aep
+    aep: apiResponse.aep,
+    // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+    warnings: apiResponse.warnings
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -1028,8 +1070,24 @@ async function verify(config, request, options) {
       cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
     }
   }
+  notifyVerificationListeners(request, result);
   return result;
 }
+var verificationListeners = /* @__PURE__ */ new Set();
+function onVerificationResult(listener) {
+  verificationListeners.add(listener);
+  return () => {
+    verificationListeners.delete(listener);
+  };
+}
+function notifyVerificationListeners(request, result) {
+  for (const listener of verificationListeners) {
+    try {
+      listener(result, request);
+    } catch {
+    }
+  }
+}
 async function recordDecision(config, sessionId, decision, reason) {
   const headers = { "Content-Type": "application/json" };
   if (config.apiKey) {
@@ -1094,6 +1152,7 @@ async function fetchRoutes(config, counterpartyId, options = {}) {
     headers["X-API-Key"] = config.apiKey;
   }
   try {
+    headers["X-AstraSync-SDK-Version"] = SDK_VERSION;
     const response = await sdkFetch(
       `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes` + (options.codeGates?.length ? `?codeGates=${options.codeGates.map(encodeURIComponent).join(",")}` : ""),
       { method: "GET", headers }
@@ -1108,6 +1167,13 @@ async function fetchRoutes(config, counterpartyId, options = {}) {
       return null;
     }
     const body = await response.json();
+    const type2 = body.data?.counterpartyType;
+    if (typeof type2 === "string" && options.onEndpointType) {
+      try {
+        options.onEndpointType(type2);
+      } catch {
+      }
+    }
     return body.data?.routes ?? [];
   } catch {
     return null;
@@ -3031,14 +3097,14 @@ function createMiddleware(options) {
           res.setHeader("X-Astra-Gateway-Mode", "enforced");
           res.setHeader("X-Astra-Gateway-Reason", "evaluated-not-enforced");
         }
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "granted").catch(() => {
           });
         }
         return next();
       }
       if (!result.policyAllowed) {
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
           });
         }
@@ -3051,7 +3117,7 @@ function createMiddleware(options) {
       }
       if (requiresHumanApproval(result)) {
         annotateApprovalRequired(result);
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
           });
         }
@@ -3076,7 +3142,7 @@ function createMiddleware(options) {
               documentationUrl: wellKnownUrls.documentationUrl
             };
           }
-          if (shouldRecordDecisions && sessionId) {
+          if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
             recordDecision(config, sessionId, "denied", trustFailure.message).catch(() => {
             });
           }
@@ -3085,7 +3151,7 @@ function createMiddleware(options) {
           return;
         }
       }
-      if (shouldRecordDecisions && sessionId) {
+      if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
         recordDecision(config, sessionId, "granted").catch(() => {
         });
       }
@@ -3933,6 +3999,66 @@ var VerificationGatewayClient = class {
     }
     return json4.data;
   }
+  /**
+   * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
+   * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
+   * Delivered synchronously, outside the event outbox (random `eventId`, no
+   * retries), signed with the endpoint's webhook secret like a real event.
+   * The payload is synthetic (`approvalId: "test_…"`); a kit acknowledges and
+   * ignores it.
+   *
+   * 5.21.0 (shops' item 48): synthetic only. Sending a real held approval's
+   * payload (which releases or re-drives that checkout) is dashboard-only, so
+   * a leaked API key can't do it.
+   *
+   * Resolves even when your endpoint refused the event (`delivered: false`,
+   * with `responseCode` / `error`).
+   */
+  async sendTestEvent(endpointId, options) {
+    return this.endpointCall("POST", endpointId, "/events/test", { type: options.type });
+  }
+  async endpointCall(method, endpointId, suffix, body) {
+    const id = endpointId ?? this.config.counterpartyId;
+    if (!id) {
+      throw new AstraSyncError(
+        "An endpoint id (ASTRAE-\u2026) is required: pass it, or set counterpartyId on the client",
+        400,
+        "VALIDATION"
+      );
+    }
+    if (!this.config.apiKey) {
+      throw new AstraSyncError("This call needs the client apiKey", 401, "AUTH_REQUIRED");
+    }
+    const base = this.config.apiBaseUrl.replace(/\/+$/, "");
+    const url = `${base}/endpoints/${encodeURIComponent(id)}${suffix}`;
+    let res;
+    try {
+      res = await sdkFetch(url, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "X-API-Key": this.config.apiKey
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(Math.max(this.timeout, 15e3))
+      });
+    } catch (err) {
+      throw new AstraSyncError(
+        `${method} ${suffix || "/endpoints/:id"} failed: ${err instanceof Error ? err.message : String(err)}`,
+        0,
+        "network_error"
+      );
+    }
+    const json4 = await res.json().catch(() => ({}));
+    if (!res.ok || json4.success === false || json4.data === void 0) {
+      const errObj = typeof json4.error === "object" ? json4.error : void 0;
+      const code = json4.code ?? errObj?.code ?? (typeof json4.error === "string" ? json4.error : "unknown_error");
+      const message = json4.message ?? errObj?.message ?? `HTTP ${res.status}`;
+      throw new AstraSyncError(`${message} (${code})`, res.status, code);
+    }
+    return json4.data;
+  }
   /**
    * Quick verification — checks credentials and policy in one call.
    *
@@ -6894,16 +7020,30 @@ function createMcpMiddleware(options) {
     failOnError = "closed",
     toolGatePrecedence = "code",
     routesRefreshMs,
+    skipEvaluation,
     ...config
   } = options;
+  const skipTools = new Set(skipEvaluation?.tools ?? []);
+  const skipMethods = new Set(skipEvaluation?.methods ?? []);
   if (config.apiBaseUrl) {
     prefetchWellKnown(config.apiBaseUrl).catch(() => {
     });
   }
   const codeGatedTools = Object.entries(toolGates ?? {}).filter(([, g]) => g !== "observe").map(([name]) => name);
+  let warnedEndpointType = false;
+  const onEndpointType = (counterpartyType) => {
+    if (counterpartyType === "mcp_server" || warnedEndpointType) return;
+    warnedEndpointType = true;
+    console.warn(
+      `[VerificationGateway/MCP] counterpartyId ${config.counterpartyId} is a '${counterpartyType}' endpoint, not an 'mcp_server' endpoint. Dashboard tool rules are read from an mcp_server endpoint only: register a separate MCP endpoint for this server (same owner) and use its id here. See https://astrasync.ai/docs/mcp-integration#tool-rules.`
+    );
+  };
   const rulesCache = config.apiKey && config.counterpartyId ? createRoutesCache(config, {
     ...routesRefreshMs !== void 0 && { refreshMs: routesRefreshMs },
-    ...codeGatedTools.length && { fetchOptions: { codeGates: codeGatedTools } }
+    fetchOptions: {
+      ...codeGatedTools.length && { codeGates: codeGatedTools },
+      onEndpointType
+    }
   }) : void 0;
   return async (req, res, next) => {
     try {
@@ -6953,6 +7093,9 @@ function createMcpMiddleware(options) {
           return next();
         }
       }
+      if (!parsed.toolName && skipMethods.has(parsed.method) && methodGates?.[parsed.method] === void 0) {
+        return next();
+      }
       const dashboardRules = rulesCache ? dashboardToolRules(await rulesCache.current()) : void 0;
       const gateDecision = resolveGate(parsed, {
         toolGates,
@@ -6960,6 +7103,9 @@ function createMcpMiddleware(options) {
         dashboardRules,
         toolGatePrecedence
       });
+      if (!gateDecision.enforce && (parsed.toolName && skipTools.has(parsed.toolName) || !parsed.toolName && skipMethods.has(parsed.method))) {
+        return next();
+      }
       const credentials = extractCredentials(
         req.headers,
         req.query
@@ -7016,8 +7162,14 @@ function createMcpMiddleware(options) {
       const forwardedFor = req.headers["x-forwarded-for"];
       const forwardedForStr = Array.isArray(forwardedFor) ? forwardedFor.join(", ") : forwardedFor;
       const sourceIp = req.ip ?? (forwardedForStr ? forwardedForStr.split(",")[0].trim() : void 0);
+      const attemptRaw = readSingleHeader(req.headers["x-astra-attempt-id"]);
+      const metaAttempt = req.body?.params?._meta?.astrasync?.attemptId;
+      const attemptId = [attemptRaw, metaAttempt].find(
+        (v) => typeof v === "string" && /^att_[0-9a-f]{32}$/.test(v)
+      );
       const verificationRequest = {
         credentials,
+        ...attemptId && { attemptId },
         purpose: pdlss.purpose,
         action: pdlss.action,
         resource: pdlss.resource,
@@ -7079,14 +7231,14 @@ function createMcpMiddleware(options) {
           res.setHeader("X-Astra-Gateway-Mode", "enforced");
           res.setHeader("X-Astra-Gateway-Reason", "evaluated-not-enforced");
         }
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "granted").catch(() => {
           });
         }
         return next();
       }
       if (!result.policyAllowed) {
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
           });
         }
@@ -7096,7 +7248,7 @@ function createMcpMiddleware(options) {
       }
       if (requiresHumanApproval(result)) {
         annotateApprovalRequired(result);
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
           });
         }
@@ -7114,7 +7266,7 @@ function createMcpMiddleware(options) {
           })
         );
       }
-      if (shouldRecordDecisions && sessionId) {
+      if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
         recordDecision(config, sessionId, "granted").catch(() => {
         });
       }
@@ -9054,13 +9206,13 @@ function requireLoader() {
         throwError(state, "ill-formed argument of the YAML directive");
       }
       const major = parseInt(match[1], 10);
-      const minor = parseInt(match[2], 10);
+      const minor2 = parseInt(match[2], 10);
       if (major !== 1) {
         throwError(state, "unacceptable YAML version of the document");
       }
       state.version = args[0];
-      state.checkLineBreaks = minor < 2;
-      if (minor !== 1 && minor !== 2) {
+      state.checkLineBreaks = minor2 < 2;
+      if (minor2 !== 1 && minor2 !== 2) {
         throwWarning(state, "unsupported YAML version of the document");
       }
     },
@@ -11123,6 +11275,16 @@ function checkUcpAgentBinding(header, identities) {
 
 // src/ucp/profile.ts
 var UCP_VERSION = "2026-08-25";
+function ucpProfileKeys(profile) {
+  const out = [];
+  for (const list of [profile?.keys, profile?.signing_keys]) {
+    if (!Array.isArray(list)) continue;
+    for (const k of list) {
+      if (k && typeof k === "object" && k.use !== "enc") out.push(k);
+    }
+  }
+  return out;
+}
 var SPEC = `https://ucp.dev/${UCP_VERSION}/specification`;
 var SCHEMAS = `https://ucp.dev/${UCP_VERSION}/schemas`;
 function astrasyncPaymentHandlers(handlers, specBase = "https://astrasync.ai/ucp/handlers") {
@@ -11546,6 +11708,228 @@ async function sendUcpWebhook(opts) {
   return { ok: false, status: last, attempts };
 }
 
+// src/ucp/agent-commerce.ts
+var ISSUER_PROGRAM_HEADER = "X-Astra-Issuer-Program";
+function issuerOfferPrice(priceMinor, percentOff) {
+  if (!percentOff) return priceMinor;
+  const pct = Math.min(100, Math.max(0, percentOff));
+  return Math.max(0, Math.round(priceMinor * (1 - pct / 100)));
+}
+function priceForAgent(rules, sku, basePriceMinor, ctx) {
+  const rule = rules?.products?.[sku];
+  let price = rule?.priceMinor ?? basePriceMinor;
+  if (ctx.verified && rules?.verifiedPercentOff) {
+    price = issuerOfferPrice(price, rules.verifiedPercentOff);
+  }
+  const offer = ctx.verified && ctx.issuerProgram && rule?.issuerEligible !== false ? rules?.offers?.find((o) => o.program === ctx.issuerProgram) : void 0;
+  if (offer?.pricePercentOff) {
+    return {
+      priceMinor: issuerOfferPrice(price, offer.pricePercentOff),
+      regularMinor: price,
+      issuerProgram: offer.program
+    };
+  }
+  return { priceMinor: price };
+}
+function visibleToAgent(rules, sku, ctx) {
+  if (!ctx.verified && rules?.hideFromUnverified) return false;
+  return rules?.products?.[sku]?.visible !== false;
+}
+function createAgentCommerce(opts) {
+  const f = opts.fetch ?? sdkFetch;
+  let current = null;
+  let kitReport;
+  const refreshMs = opts.refreshMs ?? 5 * 6e4;
+  async function refresh() {
+    try {
+      const headers = {
+        Accept: "application/json",
+        Authorization: `Bearer ${opts.apiKey}`,
+        "X-AstraSync-SDK-Version": SDK_VERSION
+      };
+      if (kitReport) {
+        headers["X-AstraSync-Kit-Report"] = Buffer.from(JSON.stringify(kitReport)).toString(
+          "base64url"
+        );
+      }
+      const res = await f(
+        `${opts.apiBaseUrl.replace(/\/+$/, "")}/endpoints/${encodeURIComponent(
+          opts.counterpartyId
+        )}/agent-commerce`,
+        { method: "GET", headers }
+      );
+      if (!res.ok) return;
+      const body = await res.json();
+      if (body.data && typeof body.data.version === "number") current = body.data;
+    } catch {
+    }
+  }
+  const timer = refreshMs > 0 ? setInterval(() => {
+    void refresh();
+  }, refreshMs) : null;
+  timer?.unref?.();
+  void refresh();
+  return {
+    rules: () => current,
+    refresh,
+    price: (sku, base, ctx) => priceForAgent(current, sku, base, ctx),
+    visible: (sku, ctx) => visibleToAgent(current, sku, ctx),
+    report: (r) => {
+      kitReport = { ...kitReport, ...r };
+    },
+    stop: () => {
+      if (timer) clearInterval(timer);
+    }
+  };
+}
+function pricingContextFrom(headers) {
+  const astraId = headers.get("x-astra-id");
+  const hop = parseVerifiedHop(headers.get(MCP_VERIFIED_HOP_HEADER.toLowerCase()));
+  const verified = !!astraId && (!hop || hop.astraId === astraId && Date.now() - hop.checkedAt <= MCP_VERIFIED_HOP_MAX_AGE_MS);
+  const program = headers.get(ISSUER_PROGRAM_HEADER.toLowerCase());
+  return {
+    verified,
+    ...verified && program && /^[a-z0-9-]{2,40}$/.test(program) && { issuerProgram: program }
+  };
+}
+function minor(value) {
+  const n = typeof value === "number" ? value : Number(String(value ?? "").replace(/[^\d.]/g, ""));
+  return Number.isFinite(n) && n >= 0 ? Math.round(n * 100) : null;
+}
+function fromFeed(url, options = {}) {
+  const f = options.fetch ?? fetch;
+  let cache4 = null;
+  return async () => {
+    if (cache4 && Date.now() - cache4.at < 6e4) return cache4.products;
+    const res = await f(url, {
+      headers: { Accept: "application/json, application/xml, text/csv" }
+    });
+    if (!res.ok) throw new Error(`Product feed ${url} answered ${res.status}`);
+    const text = await res.text();
+    const products = parseFeed(text, options.currency ?? "AUD");
+    cache4 = { at: Date.now(), products };
+    return products;
+  };
+}
+function parseFeed(text, currency) {
+  const trimmed = text.trimStart();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    const json4 = JSON.parse(trimmed);
+    const list = Array.isArray(json4) ? json4 : json4.products ?? json4.items ?? [];
+    return list.flatMap((p) => {
+      const variant = p.variants?.[0];
+      const price = minor(variant?.price ?? p.price);
+      const sku = String(variant?.sku || p.sku || p.id || "");
+      if (!sku || price === null) return [];
+      const images = Array.isArray(p.images) ? p.images.map(
+        (i) => typeof i === "string" ? i : i.src ?? ""
+      ) : [p.image_url, p.image].filter((x) => typeof x === "string");
+      return [
+        {
+          sku,
+          name: String(p.title ?? p.name ?? sku),
+          priceMinor: price,
+          currency: String(p.currency ?? currency),
+          ...typeof p.description === "string" && { description: p.description },
+          imageUrls: images.filter((u) => /^https:\/\//.test(u)),
+          inStock: variant ? variant.available !== false : p.in_stock !== false
+        }
+      ];
+    });
+  }
+  if (trimmed.startsWith("<")) {
+    const items = trimmed.split(/<item[\s>]|<entry[\s>]/).slice(1);
+    return items.flatMap((chunk) => {
+      const tag = (name) => {
+        const m = new RegExp(`<(?:g:)?${name}[^>]*>([\\s\\S]*?)</(?:g:)?${name}>`).exec(chunk);
+        return m ? m[1].replace(/<!\[CDATA\[|\]\]>/g, "").trim() : void 0;
+      };
+      const sku = tag("id");
+      const price = minor(tag("price"));
+      if (!sku || price === null) return [];
+      const extra = [...chunk.matchAll(/<g:additional_image_link>([^<]+)</g)].map(
+        (m) => m[1].trim()
+      );
+      return [
+        {
+          sku,
+          name: tag("title") ?? sku,
+          priceMinor: price,
+          currency: /[A-Z]{3}/.exec(tag("price") ?? "")?.[0] ?? currency,
+          imageUrls: [tag("image_link"), ...extra].filter(
+            (u) => !!u && /^https:\/\//.test(u)
+          ),
+          inStock: (tag("availability") ?? "in stock").replace(/_/g, " ") !== "out of stock"
+        }
+      ];
+    });
+  }
+  const [head, ...rows] = trimmed.split(/\r?\n/).filter(Boolean);
+  const cols = head.split(",").map((c) => c.trim().toLowerCase());
+  const at = (r, ...names) => {
+    const i = cols.findIndex((c) => names.includes(c));
+    return i >= 0 ? r[i]?.trim() : void 0;
+  };
+  return rows.flatMap((line) => {
+    const r = line.split(",");
+    const sku = at(r, "id", "sku");
+    const price = minor(at(r, "price"));
+    if (!sku || price === null) return [];
+    const image = at(r, "image_link", "image_url", "image");
+    return [
+      {
+        sku,
+        name: at(r, "title", "name") ?? sku,
+        priceMinor: price,
+        currency,
+        imageUrls: image && /^https:\/\//.test(image) ? [image] : [],
+        inStock: (at(r, "availability", "in_stock") ?? "in stock") !== "out of stock"
+      }
+    ];
+  });
+}
+function serveAgentCatalog(opts) {
+  return async (req, res) => {
+    const ctx = pricingContextFrom({
+      get: (name) => {
+        const v = req.headers[name.toLowerCase()];
+        return Array.isArray(v) ? v[0] ?? null : v ?? null;
+      }
+    });
+    let products;
+    try {
+      products = await opts.products();
+    } catch {
+      res.status(503).json({ error: "catalog_unavailable" });
+      return;
+    }
+    const rules = opts.commerce.rules();
+    res.setHeader?.("Cache-Control", ctx.verified ? "private, no-store" : "public, max-age=60");
+    res.json({
+      products: products.filter((p) => opts.commerce.visible(p.sku, ctx)).map((p) => {
+        const priced = opts.commerce.price(p.sku, p.priceMinor, ctx);
+        const image = rules?.products?.[p.sku]?.imageUrl ?? p.imageUrls?.[0];
+        return {
+          sku: p.sku,
+          name: p.name,
+          ...p.description && { description: p.description },
+          price: priced.priceMinor / 100,
+          currency: p.currency,
+          ...image && { image_url: image },
+          in_stock: p.inStock !== false,
+          ...p.url && { url: p.url },
+          ...priced.issuerProgram && {
+            issuer_offer: {
+              program: priced.issuerProgram,
+              regular_price: (priced.regularMinor ?? p.priceMinor) / 100
+            }
+          }
+        };
+      })
+    });
+  };
+}
+
 // src/ucp/checkout-kit.ts
 var import_crypto8 = require("crypto");
 var import_jose3 = require("jose");
@@ -12282,6 +12666,19 @@ var resumeResult = (outcome, session) => ({
 });
 
 // src/ucp/checkout-kit.ts
+function withValidImageUrl(item) {
+  if (item.image_url === void 0) return item;
+  let ok = false;
+  try {
+    const u = new URL(item.image_url);
+    ok = u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    ok = false;
+  }
+  if (ok) return item;
+  const { image_url: _drop, ...rest } = item;
+  return rest;
+}
 var MemoryCheckoutStore = class {
   constructor() {
     this.m = /* @__PURE__ */ new Map();
@@ -12351,6 +12748,7 @@ var clone = (v) => JSON.parse(JSON.stringify(v));
 var inFlight = (st) => st === "complete_in_progress" || st === "finishing";
 function createUcpCheckoutKit(opts) {
   const profile = buildUcpProfile(opts.profile);
+  opts.agentCommerce?.report({ checkoutUrl: opts.profile.endpoint, protocols: ["ucp"] });
   const store = opts.store ?? new MemoryCheckoutStore();
   const idem = {
     store: opts.idempotencyStore ?? new MemoryIdempotencyStore(),
@@ -12524,9 +12922,7 @@ function createUcpCheckoutKit(opts) {
     delete s._approvalId;
     if (settled.status === "failed") {
       s.status = "ready_for_complete";
-      s.messages = [
-        ucpError("payment_failed", "The payment did not go through.", "recoverable")
-      ];
+      s.messages = [ucpError("payment_failed", "The payment did not go through.", "recoverable")];
       await save(s);
       return;
     }
@@ -12560,12 +12956,14 @@ function createUcpCheckoutKit(opts) {
     const b = checkUcpAgentBinding(req.headers.get("ucp-agent"), identities);
     return b.ok ? null : b;
   }
-  async function priceLines(lines) {
+  async function priceLines(lines, pricing = { verified: false }) {
     const out = [];
     const messages = [];
+    let issuerProgram;
     for (const [i, l] of lines.entries()) {
       const q = Math.max(1, Math.floor(l.quantity ?? 1));
-      const item = l.item?.id ? await opts.catalog(l.item.id, q) : null;
+      const found = l.item?.id ? await opts.catalog(l.item.id, q) : null;
+      const item = found && withValidImageUrl(found);
       if (!item) {
         messages.push(
           ucpError(
@@ -12577,6 +12975,22 @@ function createUcpCheckoutKit(opts) {
         );
         continue;
       }
+      if (opts.agentCommerce) {
+        if (!opts.agentCommerce.visible(item.id, pricing)) {
+          messages.push(
+            ucpError(
+              "item_unavailable",
+              `Item ${item.id} is unavailable.`,
+              "recoverable",
+              `$.line_items[${i}]`
+            )
+          );
+          continue;
+        }
+        const priced = opts.agentCommerce.price(item.id, item.price, pricing);
+        item.price = priced.priceMinor;
+        if (priced.issuerProgram) issuerProgram = priced.issuerProgram;
+      }
       const amount = item.price * q;
       out.push({
         id: `li_${i + 1}`,
@@ -12592,6 +13006,7 @@ function createUcpCheckoutKit(opts) {
     return {
       lines: out,
       messages,
+      issuerProgram,
       totals: [
         { type: "subtotal", amount: sum },
         { type: "total", amount: sum }
@@ -12654,7 +13069,7 @@ function createUcpCheckoutKit(opts) {
         { method: req.method, url: req.url, headers, body: body || void 0 },
         async (fresh) => {
           const pp = fresh ? await fetchProfile(profileUrl, true) : plat;
-          return "keys" in pp && pp.keys ? pp.keys : [];
+          return "ucp" in pp ? ucpProfileKeys(pp) : [];
         }
       );
       if (!sig.ok) return { error: json2(sig.status, { code: sig.code, content: sig.content }) };
@@ -12761,7 +13176,11 @@ function createUcpCheckoutKit(opts) {
         ...checkoutJwt && { checkoutJwt },
         valueMajor: total(s) / 100,
         agentArtifacts,
-        metadata: { kitSessionId: s.id, protocol: "ucp" }
+        metadata: {
+          kitSessionId: s.id,
+          protocol: "ucp",
+          ...s._issuerProgram && { issuerProgram: s._issuerProgram }
+        }
       });
       const binding2 = await bindAgent(req, result);
       if (binding2) {
@@ -12900,7 +13319,11 @@ function createUcpCheckoutKit(opts) {
         attemptId: s._attemptId,
         ...checkoutJwt && { checkoutJwt },
         valueMajor: total(s) / 100,
-        metadata: { kitSessionId: s.id, protocol: "ucp" },
+        metadata: {
+          kitSessionId: s.id,
+          protocol: "ucp",
+          ...s._issuerProgram && { issuerProgram: s._issuerProgram }
+        },
         resumed: { ...s._approvalId && { approvalId: s._approvalId } }
       });
       if (isHeld(result)) {
@@ -12950,7 +13373,7 @@ function createUcpCheckoutKit(opts) {
       ucpError(
         `approval_${reason}`,
         reason === "denied" ? "The buyer declined this purchase." : "The approval for this purchase is no longer valid. Complete the checkout again to request a new one.",
-        "requires_buyer_review"
+        "recoverable"
       )
     ];
     await store.put(s);
@@ -12985,7 +13408,7 @@ function createUcpCheckoutKit(opts) {
       });
       if (status === "approved" || status === "consumed") {
         out.push({ sessionId: s.id, outcome: (await resumeApproved(s.id)).outcome });
-      } else if (status === "denied" || status === "expired") {
+      } else if (status === "denied" || status === "expired" || status === "lapsed") {
         out.push({ sessionId: s.id, outcome: (await resumeDeclined(s.id, status)).outcome });
       } else {
         out.push({ sessionId: s.id, outcome: "pending" });
@@ -13015,7 +13438,10 @@ function createUcpCheckoutKit(opts) {
     const caller = await resolveCallerScope(req, reqCtx, opts.resolveCallerId) ?? fallbackScope("ucp-profile", ctx.profileUrl);
     if (req.method === "POST" && path === "/checkout-sessions") {
       return withIdempotency2(req, body, path, caller, async () => {
-        const priced = await priceLines(parsed.line_items ?? []);
+        const priced = await priceLines(
+          parsed.line_items ?? [],
+          pricingContextFrom(req.headers)
+        );
         const webhookUrl = ctx.plat.ucp.capabilities?.[UCP_ORDER_CAPABILITY]?.[0]?.config?.webhook_url;
         const s2 = {
           id: `chk_${(0, import_crypto8.randomUUID)().replace(/-/g, "")}`,
@@ -13028,11 +13454,12 @@ function createUcpCheckoutKit(opts) {
           _caller: caller,
           _platformProfile: ctx.profileUrl,
           _ap2: ctx.ap2,
-          _platformKeys: ctx.plat.keys ?? [],
+          _platformKeys: ucpProfileKeys(ctx.plat),
           ...typeof webhookUrl === "string" && /^https:\/\//.test(webhookUrl) && { _webhookUrl: webhookUrl },
           ...req.headers.get("x-astra-checkout-session") && {
             _astraCheckoutSessionId: req.headers.get("x-astra-checkout-session").slice(0, 64)
-          }
+          },
+          ...priced.issuerProgram && { _issuerProgram: priced.issuerProgram }
         };
         if (!priced.lines.length) {
           return json2(
@@ -13077,8 +13504,13 @@ function createUcpCheckoutKit(opts) {
         if (inFlight(s.status)) return busy(s);
         if (s.status === "requires_escalation") return heldNoEdit(s);
         if (parsed.line_items) {
-          const priced = await priceLines(parsed.line_items);
+          const priced = await priceLines(
+            parsed.line_items,
+            pricingContextFrom(req.headers)
+          );
           s.line_items = priced.lines;
+          if (priced.issuerProgram) s._issuerProgram = priced.issuerProgram;
+          else delete s._issuerProgram;
           s.totals = priced.totals;
           s.messages = priced.messages;
           s.status = priced.lines.length && !priced.messages.length ? "ready_for_complete" : "incomplete";
@@ -13709,7 +14141,12 @@ var ACP_CODES = /* @__PURE__ */ new Set([
   "out_of_stock",
   "payment_declined",
   "requires_sign_in",
-  "requires_3ds"
+  "requires_3ds",
+  // 5.20.0: the owner-approval codes the kit itself emits.
+  "approval_required",
+  "approval_denied",
+  "approval_expired",
+  "approval_lapsed"
 ]);
 function heldBody2(text) {
   try {
@@ -13719,6 +14156,7 @@ function heldBody2(text) {
   }
 }
 function createAcpCheckoutKit(opts) {
+  opts.agentCommerce?.report({ protocols: ["acp"] });
   const mem = /* @__PURE__ */ new Map();
   const store = opts.store ?? {
     get: async (id) => mem.get(id) ?? null,
@@ -13771,12 +14209,14 @@ function createAcpCheckoutKit(opts) {
       ...s.order && { order: s.order }
     };
   }
-  async function price(items) {
+  async function price(items, pricing = { verified: false }) {
     const lines = [];
     const messages = [];
+    let issuerProgram;
     for (const [i, it] of items.entries()) {
       const q = Math.max(1, Math.floor(it.quantity ?? 1));
-      const c = it.id ? await opts.catalog(it.id, q) : null;
+      const found = it.id ? await opts.catalog(it.id, q) : null;
+      const c = found && withValidImageUrl(found);
       if (!c) {
         messages.push({
           type: "error",
@@ -13787,10 +14227,31 @@ function createAcpCheckoutKit(opts) {
         });
         continue;
       }
+      if (opts.agentCommerce) {
+        if (!opts.agentCommerce.visible(c.id, pricing)) {
+          messages.push({
+            type: "error",
+            code: "not_found",
+            content: `Item ${c.id} not found.`,
+            resolution: "recoverable",
+            param: `$.line_items[${i}]`
+          });
+          continue;
+        }
+        const priced = opts.agentCommerce.price(c.id, c.price, pricing);
+        c.price = priced.priceMinor;
+        if (priced.issuerProgram) issuerProgram = priced.issuerProgram;
+      }
       const amount = c.price * q;
       lines.push({
         id: `li_${i + 1}`,
-        item: { id: c.id, name: c.title, unit_amount: c.price },
+        item: {
+          id: c.id,
+          name: c.title,
+          unit_amount: c.price,
+          ...c.image_url && { image_url: c.image_url },
+          ...typeof c.description === "string" && { description: c.description }
+        },
         quantity: q,
         name: c.title,
         unit_amount: c.price,
@@ -13804,6 +14265,7 @@ function createAcpCheckoutKit(opts) {
     return {
       lines,
       messages,
+      issuerProgram,
       totals: [
         { type: "subtotal", amount: sum },
         { type: "total", amount: sum }
@@ -13955,7 +14417,11 @@ function createAcpCheckoutKit(opts) {
         attemptId,
         valueMajor: total2(s) / 100,
         agentArtifacts,
-        metadata: { kitSessionId: s.id, protocol: "acp" }
+        metadata: {
+          kitSessionId: s.id,
+          protocol: "acp",
+          ...s._issuerProgram && { issuerProgram: s._issuerProgram }
+        }
       });
       if (isHeld(result)) {
         s.status = "pending_approval";
@@ -14092,7 +14558,11 @@ function createAcpCheckoutKit(opts) {
         astraId: s._astraId,
         attemptId: s._attemptId,
         valueMajor: total2(s) / 100,
-        metadata: { kitSessionId: s.id, protocol: "acp" },
+        metadata: {
+          kitSessionId: s.id,
+          protocol: "acp",
+          ...s._issuerProgram && { issuerProgram: s._issuerProgram }
+        },
         resumed: { ...s._approvalId && { approvalId: s._approvalId } }
       });
       if (isHeld(result)) {
@@ -14137,7 +14607,7 @@ function createAcpCheckoutKit(opts) {
         code: `approval_${reason}`,
         content: reason === "denied" ? "The buyer declined this purchase." : "The approval for this purchase is no longer valid. Complete the session again to request a new one.",
         severity: "medium",
-        resolution: "requires_buyer_review"
+        resolution: "recoverable"
       }
     ];
     await store.put(s);
@@ -14172,7 +14642,7 @@ function createAcpCheckoutKit(opts) {
       });
       if (status === "approved" || status === "consumed") {
         out.push({ sessionId: s.id, outcome: (await resumeApproved(s.id)).outcome });
-      } else if (status === "denied" || status === "expired") {
+      } else if (status === "denied" || status === "expired" || status === "lapsed") {
         out.push({ sessionId: s.id, outcome: (await resumeDeclined(s.id, status)).outcome });
       } else {
         out.push({ sessionId: s.id, outcome: "pending" });
@@ -14210,7 +14680,7 @@ function createAcpCheckoutKit(opts) {
         const items = parsed.line_items ?? parsed.items;
         if (!items?.length)
           return apiError(400, "missing", "line_items is required.", "$.line_items");
-        const p = await price(items);
+        const p = await price(items, pricingContextFrom(req.headers));
         const s2 = {
           id: `cs_${(0, import_crypto12.randomUUID)().replace(/-/g, "")}`,
           status: p.lines.length && !p.messages.length ? "ready_for_payment" : "not_ready_for_payment",
@@ -14221,7 +14691,8 @@ function createAcpCheckoutKit(opts) {
           _caller: caller,
           ...req.headers.get("x-astra-checkout-session") && {
             _astraCheckoutSessionId: req.headers.get("x-astra-checkout-session").slice(0, 64)
-          }
+          },
+          ...p.issuerProgram && { _issuerProgram: p.issuerProgram }
         };
         if (s2.status === "ready_for_payment") {
           const v = await validate(s2);
@@ -14250,7 +14721,9 @@ function createAcpCheckoutKit(opts) {
           );
         const items = parsed.line_items ?? parsed.items;
         if (items) {
-          const p = await price(items);
+          const p = await price(items, pricingContextFrom(req.headers));
+          if (p.issuerProgram) s._issuerProgram = p.issuerProgram;
+          else delete s._issuerProgram;
           Object.assign(s, {
             line_items: p.lines,
             totals: p.totals,
@@ -14401,6 +14874,7 @@ function expressHandler(kit, options = {}) {
   DECLARED_SOURCE_MAX,
   DEFAULT_EDGE_CONFIG,
   DEFAULT_IDEMPOTENCY_TTL_MS,
+  ISSUER_PROGRAM_HEADER,
   KYDRequiredError,
   MAX_HEADERS,
   MAX_HEADER_VALUE_BYTES,
@@ -14459,6 +14933,7 @@ function expressHandler(kit, options = {}) {
   closedPaymentMandate,
   contentDigest,
   createAcpCheckoutKit,
+  createAgentCommerce,
   createKbHop,
   createMcpMiddleware,
   createUcpCheckoutKit,
@@ -14480,6 +14955,7 @@ function expressHandler(kit, options = {}) {
   fetchRoutes,
   fetchUcpProfile,
   finishIdempotent,
+  fromFeed,
   getCachedWellKnownUrls,
   getEdgeConfig,
   getTrustLevel,
@@ -14490,10 +14966,12 @@ function expressHandler(kit, options = {}) {
   isEdgeConfig,
   isRejectedIdentityClaim,
   isRetryableSettlementError,
+  isSharedVerdict,
   isSpecialUseIp,
   isVerificationUnavailable,
   isVerifiedHopValidFor,
   issueDelegateSdJwt,
+  issuerOfferPrice,
   matchEdgePathRule,
   matchPlatformSignature,
   matchRoutePattern,
@@ -14501,8 +14979,10 @@ function expressHandler(kit, options = {}) {
   negotiateUcp,
   nextjs,
   normalizeDeclaredSource,
+  onVerificationResult,
   openCheckoutMandate,
   openPaymentMandate,
+  parseFeed,
   parseLocalPolicyYaml,
   parseMppCredential,
   parseUcpAgentHeader,
@@ -14511,6 +14991,7 @@ function expressHandler(kit, options = {}) {
   parseX402Payment,
   pollStepUpStatus,
   prefetchWellKnown,
+  priceForAgent,
   quickVerify,
   recordDecision,
   reportAttempt,
@@ -14524,6 +15005,7 @@ function expressHandler(kit, options = {}) {
   sdkFetch,
   sendUcpWebhook,
   serializeVerifiedHop,
+  serveAgentCatalog,
   setMcpMeta,
   signHttpRequest,
   signRootMandate,
@@ -14534,6 +15016,7 @@ function expressHandler(kit, options = {}) {
   ucpEscalation,
   ucpFailure,
   ucpProfileHandler,
+  ucpProfileKeys,
   ucpRequiredComponents,
   unavailableRetryAfterSeconds,
   validateLocalPolicy,