@astrasyncai/verification-gateway 5.20.0 → 5.21.1

package/dist/git-trigger/git-hooks.d.mts

@@ -1,4 +1,4 @@
-import { T as TokenGuidance, b as CounterpartyType } from '../types-D37aSQ9c.mjs';
+import { T as TokenGuidance, b as CounterpartyType } from '../types-B4zhOAlq.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,4 +1,4 @@
-import { T as TokenGuidance, b as CounterpartyType } from '../types-Dn8tXnei.js';
+import { T as TokenGuidance, b as CounterpartyType } from '../types-CtBXnWuV.js';
 import '../metadata-capture.js';
 
 /**

package/dist/index.d.mts

@@ -960,6 +960,11 @@ interface CheckoutMetadata {
     /** The kit's own checkout session id (`chk_…` / `cs_…`). */
     kitSessionId?: string;
     protocol?: 'ucp' | 'acp';
+    /**
+     * 5.21.0: the card issuer programme whose cardholder price the cart carries;
+     * AstraSync refuses the purchase unless the buyer is that programme's cardholder.
+     */
+    issuerProgram?: string;
 }
 /** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
 type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
@@ -2323,38 +2328,23 @@ declare class VerificationGatewayClient {
         status: string;
         alreadySettled?: boolean;
     }>;
-    /**
-     * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
-     * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
-     * endpoint's owner, or a personal key of an individual with an active seat
-     * in the owning organisation. Policy (rules, trust floor, challenge, edge
-     * config) stays dashboard-only. `null` clears a field. The owner is alerted
-     * when `eventsUrl` changes.
-     *
-     * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
-     * @returns the endpoint as stored, plus `changed` (the fields that changed)
-     * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
-     */
-    updateEndpoint(endpointId: string | undefined, patch: EndpointOperationalPatch): Promise<Record<string, unknown> & {
-        changed: Array<keyof EndpointOperationalPatch>;
-    }>;
     /**
      * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
      * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
      * Delivered synchronously, outside the event outbox (random `eventId`, no
      * retries), signed with the endpoint's webhook secret like a real event.
-     * Without `approvalId` the payload is synthetic (a kit acknowledges and
-     * ignores it). With the id of a held kit approval at this endpoint the
-     * payload is the real one, so your resume path runs: `approved` makes the
-     * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
-     * `lapsed` release the session.
+     * The payload is synthetic (`approvalId: "test_…"`); a kit acknowledges and
+     * ignores it.
+     *
+     * 5.21.0 (shops' item 48): synthetic only. Sending a real held approval's
+     * payload (which releases or re-drives that checkout) is dashboard-only, so
+     * a leaked API key can't do it.
      *
      * Resolves even when your endpoint refused the event (`delivered: false`,
      * with `responseCode` / `error`).
      */
     sendTestEvent(endpointId: string | undefined, options: {
         type: TestEventType;
-        approvalId?: string;
     }): Promise<TestEventResult>;
     private endpointCall;
     /**
@@ -2396,14 +2386,6 @@ declare class VerificationGatewayClient {
      */
     private executeWithRetry;
 }
-/** 5.20.0: the operational fields `updateEndpoint` may change (`null` clears). */
-interface EndpointOperationalPatch {
-    eventsUrl?: string | null;
-    healthCheckUrl?: string | null;
-    skillUrl?: string | null;
-    catalogUrl?: string | null;
-    checkoutUrl?: string | null;
-}
 /** 5.20.0: the step-up event types `sendTestEvent` can send. */
 type TestEventType = 'step_up.approved' | 'step_up.denied' | 'step_up.expired' | 'step_up.lapsed';
 /** 5.20.0: what `sendTestEvent` reports. */
@@ -2433,7 +2415,6 @@ declare function verifyOnce(options: SDKOptions & {
     action?: string;
 }): Promise<VerificationResult>;
 
-type sdk_EndpointOperationalPatch = EndpointOperationalPatch;
 type sdk_TestEventResult = TestEventResult;
 type sdk_TestEventType = TestEventType;
 type sdk_VerificationGatewayClient = VerificationGatewayClient;
@@ -2442,7 +2423,7 @@ declare const sdk_createClient: typeof createClient;
 declare const sdk_getTrustLevel: typeof getTrustLevel;
 declare const sdk_verifyOnce: typeof verifyOnce;
 declare namespace sdk {
-  export { type sdk_EndpointOperationalPatch as EndpointOperationalPatch, type sdk_TestEventResult as TestEventResult, type sdk_TestEventType as TestEventType, sdk_VerificationGatewayClient as VerificationGatewayClient, sdk_createClient as createClient, sdk_getTrustLevel as getTrustLevel, sdk_verifyOnce as verifyOnce };
+  export { type sdk_TestEventResult as TestEventResult, type sdk_TestEventType as TestEventType, sdk_VerificationGatewayClient as VerificationGatewayClient, sdk_createClient as createClient, sdk_getTrustLevel as getTrustLevel, sdk_verifyOnce as verifyOnce };
 }
 
 /**
@@ -5485,7 +5466,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.20.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.21.1";
 declare const sdkFetch: typeof fetch;
 
 interface LocalPolicy {
@@ -5603,7 +5584,7 @@ declare function parseYaml(yamlContent: string): ParseResult;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.20.0";
+declare const SDK_VERSION = "5.21.1";
 
 /**
  * 5.15.0 — the `UCP-Agent` request header (UCP 2026-08-25): an RFC 8941
@@ -5869,6 +5850,129 @@ declare function sendUcpWebhook(opts: UcpWebhookOptions): Promise<{
     attempts: number;
 }>;
 
+declare const ISSUER_PROGRAM_HEADER = "X-Astra-Issuer-Program";
+interface AgentCommerceProductRule {
+    /** false hides the product from agents. */
+    visible?: boolean;
+    /** Price for agents, in minor units (overrides your catalogue price). */
+    priceMinor?: number;
+    /** The image agents get (one of the product's own image URLs). */
+    imageUrl?: string;
+    /** false keeps this product out of card issuer offers. */
+    issuerEligible?: boolean;
+}
+interface AgentCommerceOffer {
+    /** Issuer programme slug, e.g. "latitude". */
+    program: string;
+    pricePercentOff?: number;
+    interestFreeMonths?: number;
+    minSpendMinor?: number;
+    label: string;
+}
+interface AgentCommerceRules {
+    version: number;
+    /** Store-wide: verified agents get this % off. */
+    verifiedPercentOff?: number;
+    /** Store-wide: unverified (anonymous) agents see nothing. */
+    hideFromUnverified?: boolean;
+    products?: Record<string, AgentCommerceProductRule>;
+    offers?: AgentCommerceOffer[];
+}
+interface PricingContext {
+    /** The caller presented an AstraSync identity (verified when it confirms). */
+    verified: boolean;
+    /** The issuer programme the bridge says the buyer belongs to. */
+    issuerProgram?: string;
+}
+interface PricedForAgent {
+    priceMinor: number;
+    /** The price without the cardholder offer (only when one applied). */
+    regularMinor?: number;
+    /** The programme whose cardholder price applied. */
+    issuerProgram?: string;
+}
+/**
+ * The cardholder price: percent off, rounded half up to the minor unit and
+ * clamped to [0, price]. The same rule as AstraSync's backend and bridge.
+ */
+declare function issuerOfferPrice(priceMinor: number, percentOff: number | undefined): number;
+/** Apply rules to one product's price (pure — used by the catalogue and the kits). */
+declare function priceForAgent(rules: AgentCommerceRules | null, sku: string, basePriceMinor: number, ctx: PricingContext): PricedForAgent;
+/** What your kit reports so the dashboard can suggest your URLs (it never sets them). */
+interface KitReport {
+    catalogUrl?: string;
+    checkoutUrl?: string;
+    eventsUrl?: string;
+    protocols?: Array<'ucp' | 'acp'>;
+}
+interface AgentCommerce {
+    /** The current rules (null until the first fetch succeeds). */
+    rules(): AgentCommerceRules | null;
+    /** Fetch now (also runs every `refreshMs`). */
+    refresh(): Promise<void>;
+    price(sku: string, basePriceMinor: number, ctx: PricingContext): PricedForAgent;
+    visible(sku: string, ctx: PricingContext): boolean;
+    /** Tell AstraSync where your kit lives (shown in the dashboard as suggestions). */
+    report(r: KitReport): void;
+    stop(): void;
+}
+interface CreateAgentCommerceOptions {
+    apiBaseUrl: string;
+    apiKey: string;
+    /** The endpoint's ASTRAE id. */
+    counterpartyId: string;
+    /** Default 5 minutes. 0 disables the timer (call `refresh()` yourself). */
+    refreshMs?: number;
+    fetch?: typeof fetch;
+}
+declare function createAgentCommerce(opts: CreateAgentCommerceOptions): AgentCommerce;
+/** The pricing context of an inbound agent request (headers from the AstraSync bridge). */
+declare function pricingContextFrom(headers: {
+    get(name: string): string | null;
+}): PricingContext;
+interface AgentProduct {
+    sku: string;
+    name: string;
+    /** Minor units. */
+    priceMinor: number;
+    currency: string;
+    description?: string;
+    /** All the product's image URLs; the studio picks which one agents get. */
+    imageUrls?: string[];
+    inStock?: boolean;
+    url?: string;
+}
+type ProductSource = () => Promise<AgentProduct[]>;
+/**
+ * Read products from a feed you already have: a Shopify `products.json`, a
+ * Google Merchant feed (XML), a CSV with `id,title,price,image_link,…`, or a
+ * JSON list. Cached for a minute.
+ */
+declare function fromFeed(url: string, options?: {
+    currency?: string;
+    fetch?: typeof fetch;
+}): ProductSource;
+/** Parse a product feed body (exported for tests and the dashboard preview). */
+declare function parseFeed(text: string, currency: string): AgentProduct[];
+/**
+ * The catalogue agents fetch, priced and filtered by your studio rules:
+ * `GET` → `{ products: [{ sku, name, price, currency, image_url, in_stock,
+ * issuer_offer? }] }` (prices in major units). Mount it where your endpoint's
+ * catalogue URL points (the dashboard suggests it once your kit reports it).
+ */
+declare function serveAgentCatalog(opts: {
+    commerce: AgentCommerce;
+    products: ProductSource;
+}): (req: {
+    headers: Record<string, string | string[] | undefined>;
+}, res: {
+    status(code: number): {
+        json(body: unknown): void;
+    };
+    json(body: unknown): void;
+    setHeader?(name: string, value: string): void;
+}) => Promise<void>;
+
 interface IdempotencyRecord {
     state: 'in_progress' | 'done';
     requestHash: string;
@@ -6146,6 +6250,8 @@ interface CheckoutSession {
     _attemptId?: string;
     /** The AstraSync cart id the platform sent (X-Astra-Checkout-Session). */
     _astraCheckoutSessionId?: string;
+    /** 5.21.0: the card issuer programme whose cardholder price these lines carry. */
+    _issuerProgram?: string;
     /** The attached checkout JWS behind the last merchant_authorization sent. */
     _checkoutJwt?: string;
 }
@@ -6266,6 +6372,14 @@ interface UcpCheckoutKitOptions {
      * without calling AstraSync.
      */
     validateCart?: (session: CheckoutSession) => Promise<KitMessage[]>;
+    /**
+     * 5.21.0: your agent commerce studio rules (`createAgentCommerce`). Lines
+     * are priced with them — studio price, verified discount, card issuer
+     * cardholder price — exactly as `serveAgentCatalog` prices your catalogue,
+     * and a cardholder-priced checkout names its programme on the confirm so
+     * AstraSync can check the buyer is a cardholder.
+     */
+    agentCommerce?: AgentCommerce;
     /** AstraSync verification of the purchase (e.g. `client.confirmCheckout`). */
     verifyPurchase: (ctx: {
         session: CheckoutSession;
@@ -6894,6 +7008,8 @@ interface AcpCheckoutSession {
     /** 5.18.0: hashed caller scope (was the raw Authorization header). */
     _caller?: string;
     _astraCheckoutSessionId?: string;
+    /** 5.21.0: the card issuer programme whose cardholder price these lines carry. */
+    _issuerProgram?: string;
     /** 5.18.0: a settlement the processor hasn't confirmed yet (see `resolvePending`). */
     _pending?: {
         orderId?: string;
@@ -6944,6 +7060,12 @@ interface AcpCheckoutKitOptions {
      * session `not_ready_for_payment` (messages are `invalid`, with your path
      * as `param`) and `complete` is refused without calling AstraSync.
      */
+    /**
+     * 5.21.0: your agent commerce studio rules (`createAgentCommerce`) — lines
+     * priced exactly as `serveAgentCatalog` prices your catalogue; a
+     * cardholder-priced checkout names its programme on the confirm.
+     */
+    agentCommerce?: AgentCommerce;
     validateCart?: (session: AcpCheckoutSession) => Promise<KitMessage[]>;
     verifyPurchase: (ctx: {
         session: AcpCheckoutSession;
@@ -7438,4 +7560,4 @@ declare function contentDigest(body: string): string;
  */
 declare function signHttpRequest(req: SignableRequest, opts: SignHttpRequestOptions): Promise<Record<string, string>>;
 
-export { ACP_API_VERSION, ACP_SUPPORTED_API_VERSIONS, AEP_SPEC_VERSION, AP2_VCT, type AcpCheckoutKitOptions, type AcpCheckoutSession, type AcpCheckoutStatus, type AcpCheckoutStore, type AcpWellKnownOptions, type AepActorType, type AepArtifactRecord, type AepArtifactType, AepChain, type AepChainOptions, type AepChainVerification, type AepHashInput, type AgentArtifacts, AgentClient, type AgentCredentials, type AgentProtocol, type AgentProtocolIdentities, type AgentRecord, type Ap2Party, type Ap2VerifyResult, type ApprovalEvent, type ApprovalEventKit, type ApprovalEventsHandlerOptions, type ApprovalEventsResponse, AstraSync, type AstraSyncAepEvidence, type AstraSyncConfig, type AstraSyncCredentials, AstraSyncError, type AstraSyncMandates, type AttemptOutcome, type AttemptReport, AuthenticationError, type BuildGuidanceParams, CAPTURE_SCHEMA_VERSION, type CallerMetadata, ChallengeHandler, type CheckoutMetadata, type CommerceArtifactsPayload, type CommerceContext, type CommercePipelineInput, type CommerceShieldProps, type ConsiderationItem, type ConsiderationSet, type CounterpartyType, DECLARED_SOURCE_MAX, DEFAULT_EDGE_CONFIG, DEFAULT_IDEMPOTENCY_TTL_MS, type DashboardToolRule, type DynamicPlatformFingerprint, type EdgeConfig, type EdgeMode, type EdgePathRule, type EdgeVerificationDepth, type EndpointOperationalPatch, type EnhancedVerificationResult, type ExpressHandlerOptions, type ExpressMiddlewareOptions, type FetchEdgeConfigResult, type FetchEdgeConfigSuccess, type FetchKit, type FiatSettlementBinding, type FrameworkConfig, type FulfilmentInfo, type GatewayConfig, type GuidanceEnvelope, type GuidanceInfo, type HandleApprovalEventsOptions, type HealthResponse, type HttpSignatureAlgorithm, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, KYDRequiredError, type KitExpressRequest, type KitExpressResponse, type KitMessage, type KitRequestContext, type KyaPayIdentity, type KyaPayResult, type KyaPayTokenType, type KyaPayVerifyOptions, type ParseResult as LocalPolicyParseResult, type ValidationError as LocalPolicyValidationError, type ValidationResult as LocalPolicyValidationResult, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, MCP_VERIFIED_HOP_HEADER, MCP_VERIFIED_HOP_MAX_AGE_MS, type McpMiddlewareOptions, MemoryCheckoutStore, MemoryIdempotencyStore, MemoryMppChallengeStore, MemorySeenEvents, type MerchantSettlementToken, type ModelConfig, type MppChallenge, type MppChallengeStore, type MppCredential, type MppReceipt, type MppVerifyOptions, type MppVerifyResult, type NegotiationResult, type NextJsMiddlewareOptions, type ObservedMetadata, type PDLSSConfig$1 as PDLSSConfig, type PDLSSDuration, type PDLSSInfo, type PDLSSLimits, type PDLSSPurpose, type PDLSSScope, type PDLSSSelfInstantiation, PLATFORM_AGENT_SIGNATURES, type PendingRegistrationResponse, type PendingResolution, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, type PlatformSignatureDef, type PollRegistrationResult, type ProtocolTransport, type PurposeSource, RUNTIME_SIGNATURES, RedisIdempotencyStore, type RedisLike, type RegisterOptions, type RegisterResult, RegistrationDeniedError, RegistrationExpiredError, type RegistrationResponse, RegistrationTimeoutError, type ReportAttemptOptions, type ReportRetryOptions, type ResumeOutcome, type ResumeResult, type RootKeyResolver, type RouteAccessConfig, type RoutePolicy, type RuntimeChallengeResult, type RuntimeSignature, type SDKOptions, SDK_USER_AGENT, type SanitizeHeadersResult, type SeenEvents, type SettlementArtifact, type SettlementArtifactBinding, type SettlementArtifactBindingBase, type SettlementDecision, type SettlementOutcomeInfo, SettlementReportError, type SettlementRequest, type SignHttpRequestOptions, type SignableRequest, type StablecoinSettlementBinding, type StepUpApprovalInfo, type StepUpApprovalStatus, type StepUpOutcome, TRUST_LEVEL_RANGES, type TestEventResult, type TestEventType, type TokenGuidance, type ToolGate, type ToolGateConfig, type TrustLevel, UCP_ORDER_CAPABILITY, UCP_VERSION, type UcpAgentBinding, type CatalogItem as UcpCatalogItem, type UcpCheckoutKitOptions, type CheckoutSession as UcpCheckoutSession, type CheckoutStore as UcpCheckoutStore, type UcpLink, type UcpMessage, type UcpOrder, type UcpProfile, type UcpProfileResult, type SettleResult as UcpSettleResult, type UcpSeverity, type UcpSignatureResult, VERIFICATION_STATUS_HEADER, SDK_VERSION as VERSION, type VerificationInterstitialProps, type VerificationRequest, type VerificationResult, type VerificationWarning, type VerifiedAgent, type VerifiedDeveloper, type VerifiedHopMarker, type VerifiedOrganization, type VerifyAp2Options, type VerifyOptions, type VerifyResponse, type WaitForApprovalOptions, type WellKnownAgenticCommerce, type X402PaymentPayload, type X402PaymentRequired, type X402PaymentRequirements, type X402ResourceInfo, type X402SettlementResponse, _resetEdgeConfigCache, abandonIdempotent, acpPaymentHandlers, aepCanonicalJson, aepHash, aepPrivateKeyFromSeed, aepPublicKeyDocument, aepPublicKeyFromBase64, aepRawPublicKey, aepSign, aepTimestamp, aepVerifySignature, index as agent, approvalEventsHandler, astrasyncPaymentHandlers, authorizeSettlement, awaitStepUpApproval, beginIdempotent, buildAcpWellKnown, buildGuidance, buildMpp402Response, buildMppChallenge, buildSdkObservedMetadata, buildUcpOrder, buildUcpProfile, buildVerificationUnavailableBody, buildX402Challenge, canonicalJson, checkUcpAgentBinding, checkoutHash, clearCache, closedCheckoutMandate, closedPaymentMandate, contentDigest, createAcpCheckoutKit, createKbHop, createMcpMiddleware, createUcpCheckoutKit, decodeMppRequest, degradeToObserve, denyStatusFor, deriveConnectionFromHeaders, detectPlatformFingerprint, detectRuntime, encodeMppReceipt, encodeX402SettlementResponse, express, expressHandler, extractApiKeyFormat, extractCredentials, extractMcpCredentials, extractPlatformHeaders, fetchEdgeConfig, fetchRoutes, fetchUcpProfile, finishIdempotent, getCachedWellKnownUrls, getEdgeConfig, getTrustLevel, getWellKnownUrls, handleApprovalEvents, hasCredentials, idempotencyMiddleware, isEdgeConfig, isRejectedIdentityClaim, isRetryableSettlementError, isSharedVerdict, isSpecialUseIp, isVerificationUnavailable, isVerifiedHopValidFor, issueDelegateSdJwt, matchEdgePathRule, matchPlatformSignature, matchRoutePattern, mppBodyDigest, negotiateUcp, nextjs, normalizeDeclaredSource, onVerificationResult, openCheckoutMandate, openPaymentMandate, parseYaml as parseLocalPolicyYaml, parseMppCredential, parseUcpAgentHeader, parseVerifiedHop, parseX402Challenge, parseX402Payment, pollStepUpStatus, prefetchWellKnown, quickVerify, recordDecision, reportAttempt, reportUnregisteredAttempt, requestFingerprint, rootMandateDigest, routePatternToRegExp, routePolicyOf, sanitizeHeaders, sdk, sdkFetch, sendUcpWebhook, serializeVerifiedHop, setMcpMeta, signHttpRequest, signRootMandate, signUcpRequest, signUcpResponse, index$1 as transport, ucpError, ucpEscalation, ucpFailure, ucpProfileHandler, ucpProfileKeys, ucpRequiredComponents, unavailableRetryAfterSeconds, validatePolicy as validateLocalPolicy, verify, verifyAepChain, verifyAp2Mandate, verifyDelegateChain, verifyKyaPayTokens, verifyMppChallenge, verifyUcpRequest, withIdempotency, x402PaymentMatchesOffer };
+export { ACP_API_VERSION, ACP_SUPPORTED_API_VERSIONS, AEP_SPEC_VERSION, AP2_VCT, type AcpCheckoutKitOptions, type AcpCheckoutSession, type AcpCheckoutStatus, type AcpCheckoutStore, type AcpWellKnownOptions, type AepActorType, type AepArtifactRecord, type AepArtifactType, AepChain, type AepChainOptions, type AepChainVerification, type AepHashInput, type AgentArtifacts, AgentClient, type AgentCommerce, type AgentCommerceOffer, type AgentCommerceRules, type AgentCredentials, type AgentProduct, type AgentProtocol, type AgentProtocolIdentities, type AgentRecord, type Ap2Party, type Ap2VerifyResult, type ApprovalEvent, type ApprovalEventKit, type ApprovalEventsHandlerOptions, type ApprovalEventsResponse, AstraSync, type AstraSyncAepEvidence, type AstraSyncConfig, type AstraSyncCredentials, AstraSyncError, type AstraSyncMandates, type AttemptOutcome, type AttemptReport, AuthenticationError, type BuildGuidanceParams, CAPTURE_SCHEMA_VERSION, type CallerMetadata, ChallengeHandler, type CheckoutMetadata, type CommerceArtifactsPayload, type CommerceContext, type CommercePipelineInput, type CommerceShieldProps, type ConsiderationItem, type ConsiderationSet, type CounterpartyType, DECLARED_SOURCE_MAX, DEFAULT_EDGE_CONFIG, DEFAULT_IDEMPOTENCY_TTL_MS, type DashboardToolRule, type DynamicPlatformFingerprint, type EdgeConfig, type EdgeMode, type EdgePathRule, type EdgeVerificationDepth, type EnhancedVerificationResult, type ExpressHandlerOptions, type ExpressMiddlewareOptions, type FetchEdgeConfigResult, type FetchEdgeConfigSuccess, type FetchKit, type FiatSettlementBinding, type FrameworkConfig, type FulfilmentInfo, type GatewayConfig, type GuidanceEnvelope, type GuidanceInfo, type HandleApprovalEventsOptions, type HealthResponse, type HttpSignatureAlgorithm, ISSUER_PROGRAM_HEADER, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, KYDRequiredError, type KitExpressRequest, type KitExpressResponse, type KitMessage, type KitReport, type KitRequestContext, type KyaPayIdentity, type KyaPayResult, type KyaPayTokenType, type KyaPayVerifyOptions, type ParseResult as LocalPolicyParseResult, type ValidationError as LocalPolicyValidationError, type ValidationResult as LocalPolicyValidationResult, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, MCP_VERIFIED_HOP_HEADER, MCP_VERIFIED_HOP_MAX_AGE_MS, type McpMiddlewareOptions, MemoryCheckoutStore, MemoryIdempotencyStore, MemoryMppChallengeStore, MemorySeenEvents, type MerchantSettlementToken, type ModelConfig, type MppChallenge, type MppChallengeStore, type MppCredential, type MppReceipt, type MppVerifyOptions, type MppVerifyResult, type NegotiationResult, type NextJsMiddlewareOptions, type ObservedMetadata, type PDLSSConfig$1 as PDLSSConfig, type PDLSSDuration, type PDLSSInfo, type PDLSSLimits, type PDLSSPurpose, type PDLSSScope, type PDLSSSelfInstantiation, PLATFORM_AGENT_SIGNATURES, type PendingRegistrationResponse, type PendingResolution, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, type PlatformSignatureDef, type PollRegistrationResult, type PricingContext, type ProtocolTransport, type PurposeSource, RUNTIME_SIGNATURES, RedisIdempotencyStore, type RedisLike, type RegisterOptions, type RegisterResult, RegistrationDeniedError, RegistrationExpiredError, type RegistrationResponse, RegistrationTimeoutError, type ReportAttemptOptions, type ReportRetryOptions, type ResumeOutcome, type ResumeResult, type RootKeyResolver, type RouteAccessConfig, type RoutePolicy, type RuntimeChallengeResult, type RuntimeSignature, type SDKOptions, SDK_USER_AGENT, type SanitizeHeadersResult, type SeenEvents, type SettlementArtifact, type SettlementArtifactBinding, type SettlementArtifactBindingBase, type SettlementDecision, type SettlementOutcomeInfo, SettlementReportError, type SettlementRequest, type SignHttpRequestOptions, type SignableRequest, type StablecoinSettlementBinding, type StepUpApprovalInfo, type StepUpApprovalStatus, type StepUpOutcome, TRUST_LEVEL_RANGES, type TestEventResult, type TestEventType, type TokenGuidance, type ToolGate, type ToolGateConfig, type TrustLevel, UCP_ORDER_CAPABILITY, UCP_VERSION, type UcpAgentBinding, type CatalogItem as UcpCatalogItem, type UcpCheckoutKitOptions, type CheckoutSession as UcpCheckoutSession, type CheckoutStore as UcpCheckoutStore, type UcpLink, type UcpMessage, type UcpOrder, type UcpProfile, type UcpProfileResult, type SettleResult as UcpSettleResult, type UcpSeverity, type UcpSignatureResult, VERIFICATION_STATUS_HEADER, SDK_VERSION as VERSION, type VerificationInterstitialProps, type VerificationRequest, type VerificationResult, type VerificationWarning, type VerifiedAgent, type VerifiedDeveloper, type VerifiedHopMarker, type VerifiedOrganization, type VerifyAp2Options, type VerifyOptions, type VerifyResponse, type WaitForApprovalOptions, type WellKnownAgenticCommerce, type X402PaymentPayload, type X402PaymentRequired, type X402PaymentRequirements, type X402ResourceInfo, type X402SettlementResponse, _resetEdgeConfigCache, abandonIdempotent, acpPaymentHandlers, aepCanonicalJson, aepHash, aepPrivateKeyFromSeed, aepPublicKeyDocument, aepPublicKeyFromBase64, aepRawPublicKey, aepSign, aepTimestamp, aepVerifySignature, index as agent, approvalEventsHandler, astrasyncPaymentHandlers, authorizeSettlement, awaitStepUpApproval, beginIdempotent, buildAcpWellKnown, buildGuidance, buildMpp402Response, buildMppChallenge, buildSdkObservedMetadata, buildUcpOrder, buildUcpProfile, buildVerificationUnavailableBody, buildX402Challenge, canonicalJson, checkUcpAgentBinding, checkoutHash, clearCache, closedCheckoutMandate, closedPaymentMandate, contentDigest, createAcpCheckoutKit, createAgentCommerce, createKbHop, createMcpMiddleware, createUcpCheckoutKit, decodeMppRequest, degradeToObserve, denyStatusFor, deriveConnectionFromHeaders, detectPlatformFingerprint, detectRuntime, encodeMppReceipt, encodeX402SettlementResponse, express, expressHandler, extractApiKeyFormat, extractCredentials, extractMcpCredentials, extractPlatformHeaders, fetchEdgeConfig, fetchRoutes, fetchUcpProfile, finishIdempotent, fromFeed, getCachedWellKnownUrls, getEdgeConfig, getTrustLevel, getWellKnownUrls, handleApprovalEvents, hasCredentials, idempotencyMiddleware, isEdgeConfig, isRejectedIdentityClaim, isRetryableSettlementError, isSharedVerdict, isSpecialUseIp, isVerificationUnavailable, isVerifiedHopValidFor, issueDelegateSdJwt, issuerOfferPrice, matchEdgePathRule, matchPlatformSignature, matchRoutePattern, mppBodyDigest, negotiateUcp, nextjs, normalizeDeclaredSource, onVerificationResult, openCheckoutMandate, openPaymentMandate, parseFeed, parseYaml as parseLocalPolicyYaml, parseMppCredential, parseUcpAgentHeader, parseVerifiedHop, parseX402Challenge, parseX402Payment, pollStepUpStatus, prefetchWellKnown, priceForAgent, pricingContextFrom, quickVerify, recordDecision, reportAttempt, reportUnregisteredAttempt, requestFingerprint, rootMandateDigest, routePatternToRegExp, routePolicyOf, sanitizeHeaders, sdk, sdkFetch, sendUcpWebhook, serializeVerifiedHop, serveAgentCatalog, setMcpMeta, signHttpRequest, signRootMandate, signUcpRequest, signUcpResponse, index$1 as transport, ucpError, ucpEscalation, ucpFailure, ucpProfileHandler, ucpProfileKeys, ucpRequiredComponents, unavailableRetryAfterSeconds, validatePolicy as validateLocalPolicy, verify, verifyAepChain, verifyAp2Mandate, verifyDelegateChain, verifyKyaPayTokens, verifyMppChallenge, verifyUcpRequest, withIdempotency, x402PaymentMatchesOffer };

package/dist/index.d.ts

@@ -960,6 +960,11 @@ interface CheckoutMetadata {
     /** The kit's own checkout session id (`chk_…` / `cs_…`). */
     kitSessionId?: string;
     protocol?: 'ucp' | 'acp';
+    /**
+     * 5.21.0: the card issuer programme whose cardholder price the cart carries;
+     * AstraSync refuses the purchase unless the buyer is that programme's cardholder.
+     */
+    issuerProgram?: string;
 }
 /** 5.19.0 — see {@link VerificationRequest.purposeSource}. */
 type PurposeSource = 'route_config' | 'header' | 'body' | 'default';
@@ -2323,38 +2328,23 @@ declare class VerificationGatewayClient {
         status: string;
         alreadySettled?: boolean;
     }>;
-    /**
-     * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
-     * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
-     * endpoint's owner, or a personal key of an individual with an active seat
-     * in the owning organisation. Policy (rules, trust floor, challenge, edge
-     * config) stays dashboard-only. `null` clears a field. The owner is alerted
-     * when `eventsUrl` changes.
-     *
-     * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
-     * @returns the endpoint as stored, plus `changed` (the fields that changed)
-     * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
-     */
-    updateEndpoint(endpointId: string | undefined, patch: EndpointOperationalPatch): Promise<Record<string, unknown> & {
-        changed: Array<keyof EndpointOperationalPatch>;
-    }>;
     /**
      * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
      * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
      * Delivered synchronously, outside the event outbox (random `eventId`, no
      * retries), signed with the endpoint's webhook secret like a real event.
-     * Without `approvalId` the payload is synthetic (a kit acknowledges and
-     * ignores it). With the id of a held kit approval at this endpoint the
-     * payload is the real one, so your resume path runs: `approved` makes the
-     * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
-     * `lapsed` release the session.
+     * The payload is synthetic (`approvalId: "test_…"`); a kit acknowledges and
+     * ignores it.
+     *
+     * 5.21.0 (shops' item 48): synthetic only. Sending a real held approval's
+     * payload (which releases or re-drives that checkout) is dashboard-only, so
+     * a leaked API key can't do it.
      *
      * Resolves even when your endpoint refused the event (`delivered: false`,
      * with `responseCode` / `error`).
      */
     sendTestEvent(endpointId: string | undefined, options: {
         type: TestEventType;
-        approvalId?: string;
     }): Promise<TestEventResult>;
     private endpointCall;
     /**
@@ -2396,14 +2386,6 @@ declare class VerificationGatewayClient {
      */
     private executeWithRetry;
 }
-/** 5.20.0: the operational fields `updateEndpoint` may change (`null` clears). */
-interface EndpointOperationalPatch {
-    eventsUrl?: string | null;
-    healthCheckUrl?: string | null;
-    skillUrl?: string | null;
-    catalogUrl?: string | null;
-    checkoutUrl?: string | null;
-}
 /** 5.20.0: the step-up event types `sendTestEvent` can send. */
 type TestEventType = 'step_up.approved' | 'step_up.denied' | 'step_up.expired' | 'step_up.lapsed';
 /** 5.20.0: what `sendTestEvent` reports. */
@@ -2433,7 +2415,6 @@ declare function verifyOnce(options: SDKOptions & {
     action?: string;
 }): Promise<VerificationResult>;
 
-type sdk_EndpointOperationalPatch = EndpointOperationalPatch;
 type sdk_TestEventResult = TestEventResult;
 type sdk_TestEventType = TestEventType;
 type sdk_VerificationGatewayClient = VerificationGatewayClient;
@@ -2442,7 +2423,7 @@ declare const sdk_createClient: typeof createClient;
 declare const sdk_getTrustLevel: typeof getTrustLevel;
 declare const sdk_verifyOnce: typeof verifyOnce;
 declare namespace sdk {
-  export { type sdk_EndpointOperationalPatch as EndpointOperationalPatch, type sdk_TestEventResult as TestEventResult, type sdk_TestEventType as TestEventType, sdk_VerificationGatewayClient as VerificationGatewayClient, sdk_createClient as createClient, sdk_getTrustLevel as getTrustLevel, sdk_verifyOnce as verifyOnce };
+  export { type sdk_TestEventResult as TestEventResult, type sdk_TestEventType as TestEventType, sdk_VerificationGatewayClient as VerificationGatewayClient, sdk_createClient as createClient, sdk_getTrustLevel as getTrustLevel, sdk_verifyOnce as verifyOnce };
 }
 
 /**
@@ -5485,7 +5466,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.20.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.21.1";
 declare const sdkFetch: typeof fetch;
 
 interface LocalPolicy {
@@ -5603,7 +5584,7 @@ declare function parseYaml(yamlContent: string): ParseResult;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.20.0";
+declare const SDK_VERSION = "5.21.1";
 
 /**
  * 5.15.0 — the `UCP-Agent` request header (UCP 2026-08-25): an RFC 8941
@@ -5869,6 +5850,129 @@ declare function sendUcpWebhook(opts: UcpWebhookOptions): Promise<{
     attempts: number;
 }>;
 
+declare const ISSUER_PROGRAM_HEADER = "X-Astra-Issuer-Program";
+interface AgentCommerceProductRule {
+    /** false hides the product from agents. */
+    visible?: boolean;
+    /** Price for agents, in minor units (overrides your catalogue price). */
+    priceMinor?: number;
+    /** The image agents get (one of the product's own image URLs). */
+    imageUrl?: string;
+    /** false keeps this product out of card issuer offers. */
+    issuerEligible?: boolean;
+}
+interface AgentCommerceOffer {
+    /** Issuer programme slug, e.g. "latitude". */
+    program: string;
+    pricePercentOff?: number;
+    interestFreeMonths?: number;
+    minSpendMinor?: number;
+    label: string;
+}
+interface AgentCommerceRules {
+    version: number;
+    /** Store-wide: verified agents get this % off. */
+    verifiedPercentOff?: number;
+    /** Store-wide: unverified (anonymous) agents see nothing. */
+    hideFromUnverified?: boolean;
+    products?: Record<string, AgentCommerceProductRule>;
+    offers?: AgentCommerceOffer[];
+}
+interface PricingContext {
+    /** The caller presented an AstraSync identity (verified when it confirms). */
+    verified: boolean;
+    /** The issuer programme the bridge says the buyer belongs to. */
+    issuerProgram?: string;
+}
+interface PricedForAgent {
+    priceMinor: number;
+    /** The price without the cardholder offer (only when one applied). */
+    regularMinor?: number;
+    /** The programme whose cardholder price applied. */
+    issuerProgram?: string;
+}
+/**
+ * The cardholder price: percent off, rounded half up to the minor unit and
+ * clamped to [0, price]. The same rule as AstraSync's backend and bridge.
+ */
+declare function issuerOfferPrice(priceMinor: number, percentOff: number | undefined): number;
+/** Apply rules to one product's price (pure — used by the catalogue and the kits). */
+declare function priceForAgent(rules: AgentCommerceRules | null, sku: string, basePriceMinor: number, ctx: PricingContext): PricedForAgent;
+/** What your kit reports so the dashboard can suggest your URLs (it never sets them). */
+interface KitReport {
+    catalogUrl?: string;
+    checkoutUrl?: string;
+    eventsUrl?: string;
+    protocols?: Array<'ucp' | 'acp'>;
+}
+interface AgentCommerce {
+    /** The current rules (null until the first fetch succeeds). */
+    rules(): AgentCommerceRules | null;
+    /** Fetch now (also runs every `refreshMs`). */
+    refresh(): Promise<void>;
+    price(sku: string, basePriceMinor: number, ctx: PricingContext): PricedForAgent;
+    visible(sku: string, ctx: PricingContext): boolean;
+    /** Tell AstraSync where your kit lives (shown in the dashboard as suggestions). */
+    report(r: KitReport): void;
+    stop(): void;
+}
+interface CreateAgentCommerceOptions {
+    apiBaseUrl: string;
+    apiKey: string;
+    /** The endpoint's ASTRAE id. */
+    counterpartyId: string;
+    /** Default 5 minutes. 0 disables the timer (call `refresh()` yourself). */
+    refreshMs?: number;
+    fetch?: typeof fetch;
+}
+declare function createAgentCommerce(opts: CreateAgentCommerceOptions): AgentCommerce;
+/** The pricing context of an inbound agent request (headers from the AstraSync bridge). */
+declare function pricingContextFrom(headers: {
+    get(name: string): string | null;
+}): PricingContext;
+interface AgentProduct {
+    sku: string;
+    name: string;
+    /** Minor units. */
+    priceMinor: number;
+    currency: string;
+    description?: string;
+    /** All the product's image URLs; the studio picks which one agents get. */
+    imageUrls?: string[];
+    inStock?: boolean;
+    url?: string;
+}
+type ProductSource = () => Promise<AgentProduct[]>;
+/**
+ * Read products from a feed you already have: a Shopify `products.json`, a
+ * Google Merchant feed (XML), a CSV with `id,title,price,image_link,…`, or a
+ * JSON list. Cached for a minute.
+ */
+declare function fromFeed(url: string, options?: {
+    currency?: string;
+    fetch?: typeof fetch;
+}): ProductSource;
+/** Parse a product feed body (exported for tests and the dashboard preview). */
+declare function parseFeed(text: string, currency: string): AgentProduct[];
+/**
+ * The catalogue agents fetch, priced and filtered by your studio rules:
+ * `GET` → `{ products: [{ sku, name, price, currency, image_url, in_stock,
+ * issuer_offer? }] }` (prices in major units). Mount it where your endpoint's
+ * catalogue URL points (the dashboard suggests it once your kit reports it).
+ */
+declare function serveAgentCatalog(opts: {
+    commerce: AgentCommerce;
+    products: ProductSource;
+}): (req: {
+    headers: Record<string, string | string[] | undefined>;
+}, res: {
+    status(code: number): {
+        json(body: unknown): void;
+    };
+    json(body: unknown): void;
+    setHeader?(name: string, value: string): void;
+}) => Promise<void>;
+
 interface IdempotencyRecord {
     state: 'in_progress' | 'done';
     requestHash: string;
@@ -6146,6 +6250,8 @@ interface CheckoutSession {
     _attemptId?: string;
     /** The AstraSync cart id the platform sent (X-Astra-Checkout-Session). */
     _astraCheckoutSessionId?: string;
+    /** 5.21.0: the card issuer programme whose cardholder price these lines carry. */
+    _issuerProgram?: string;
     /** The attached checkout JWS behind the last merchant_authorization sent. */
     _checkoutJwt?: string;
 }
@@ -6266,6 +6372,14 @@ interface UcpCheckoutKitOptions {
      * without calling AstraSync.
      */
     validateCart?: (session: CheckoutSession) => Promise<KitMessage[]>;
+    /**
+     * 5.21.0: your agent commerce studio rules (`createAgentCommerce`). Lines
+     * are priced with them — studio price, verified discount, card issuer
+     * cardholder price — exactly as `serveAgentCatalog` prices your catalogue,
+     * and a cardholder-priced checkout names its programme on the confirm so
+     * AstraSync can check the buyer is a cardholder.
+     */
+    agentCommerce?: AgentCommerce;
     /** AstraSync verification of the purchase (e.g. `client.confirmCheckout`). */
     verifyPurchase: (ctx: {
         session: CheckoutSession;
@@ -6894,6 +7008,8 @@ interface AcpCheckoutSession {
     /** 5.18.0: hashed caller scope (was the raw Authorization header). */
     _caller?: string;
     _astraCheckoutSessionId?: string;
+    /** 5.21.0: the card issuer programme whose cardholder price these lines carry. */
+    _issuerProgram?: string;
     /** 5.18.0: a settlement the processor hasn't confirmed yet (see `resolvePending`). */
     _pending?: {
         orderId?: string;
@@ -6944,6 +7060,12 @@ interface AcpCheckoutKitOptions {
      * session `not_ready_for_payment` (messages are `invalid`, with your path
      * as `param`) and `complete` is refused without calling AstraSync.
      */
+    /**
+     * 5.21.0: your agent commerce studio rules (`createAgentCommerce`) — lines
+     * priced exactly as `serveAgentCatalog` prices your catalogue; a
+     * cardholder-priced checkout names its programme on the confirm.
+     */
+    agentCommerce?: AgentCommerce;
     validateCart?: (session: AcpCheckoutSession) => Promise<KitMessage[]>;
     verifyPurchase: (ctx: {
         session: AcpCheckoutSession;
@@ -7438,4 +7560,4 @@ declare function contentDigest(body: string): string;
  */
 declare function signHttpRequest(req: SignableRequest, opts: SignHttpRequestOptions): Promise<Record<string, string>>;
 
-export { ACP_API_VERSION, ACP_SUPPORTED_API_VERSIONS, AEP_SPEC_VERSION, AP2_VCT, type AcpCheckoutKitOptions, type AcpCheckoutSession, type AcpCheckoutStatus, type AcpCheckoutStore, type AcpWellKnownOptions, type AepActorType, type AepArtifactRecord, type AepArtifactType, AepChain, type AepChainOptions, type AepChainVerification, type AepHashInput, type AgentArtifacts, AgentClient, type AgentCredentials, type AgentProtocol, type AgentProtocolIdentities, type AgentRecord, type Ap2Party, type Ap2VerifyResult, type ApprovalEvent, type ApprovalEventKit, type ApprovalEventsHandlerOptions, type ApprovalEventsResponse, AstraSync, type AstraSyncAepEvidence, type AstraSyncConfig, type AstraSyncCredentials, AstraSyncError, type AstraSyncMandates, type AttemptOutcome, type AttemptReport, AuthenticationError, type BuildGuidanceParams, CAPTURE_SCHEMA_VERSION, type CallerMetadata, ChallengeHandler, type CheckoutMetadata, type CommerceArtifactsPayload, type CommerceContext, type CommercePipelineInput, type CommerceShieldProps, type ConsiderationItem, type ConsiderationSet, type CounterpartyType, DECLARED_SOURCE_MAX, DEFAULT_EDGE_CONFIG, DEFAULT_IDEMPOTENCY_TTL_MS, type DashboardToolRule, type DynamicPlatformFingerprint, type EdgeConfig, type EdgeMode, type EdgePathRule, type EdgeVerificationDepth, type EndpointOperationalPatch, type EnhancedVerificationResult, type ExpressHandlerOptions, type ExpressMiddlewareOptions, type FetchEdgeConfigResult, type FetchEdgeConfigSuccess, type FetchKit, type FiatSettlementBinding, type FrameworkConfig, type FulfilmentInfo, type GatewayConfig, type GuidanceEnvelope, type GuidanceInfo, type HandleApprovalEventsOptions, type HealthResponse, type HttpSignatureAlgorithm, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, KYDRequiredError, type KitExpressRequest, type KitExpressResponse, type KitMessage, type KitRequestContext, type KyaPayIdentity, type KyaPayResult, type KyaPayTokenType, type KyaPayVerifyOptions, type ParseResult as LocalPolicyParseResult, type ValidationError as LocalPolicyValidationError, type ValidationResult as LocalPolicyValidationResult, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, MCP_VERIFIED_HOP_HEADER, MCP_VERIFIED_HOP_MAX_AGE_MS, type McpMiddlewareOptions, MemoryCheckoutStore, MemoryIdempotencyStore, MemoryMppChallengeStore, MemorySeenEvents, type MerchantSettlementToken, type ModelConfig, type MppChallenge, type MppChallengeStore, type MppCredential, type MppReceipt, type MppVerifyOptions, type MppVerifyResult, type NegotiationResult, type NextJsMiddlewareOptions, type ObservedMetadata, type PDLSSConfig$1 as PDLSSConfig, type PDLSSDuration, type PDLSSInfo, type PDLSSLimits, type PDLSSPurpose, type PDLSSScope, type PDLSSSelfInstantiation, PLATFORM_AGENT_SIGNATURES, type PendingRegistrationResponse, type PendingResolution, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, type PlatformSignatureDef, type PollRegistrationResult, type ProtocolTransport, type PurposeSource, RUNTIME_SIGNATURES, RedisIdempotencyStore, type RedisLike, type RegisterOptions, type RegisterResult, RegistrationDeniedError, RegistrationExpiredError, type RegistrationResponse, RegistrationTimeoutError, type ReportAttemptOptions, type ReportRetryOptions, type ResumeOutcome, type ResumeResult, type RootKeyResolver, type RouteAccessConfig, type RoutePolicy, type RuntimeChallengeResult, type RuntimeSignature, type SDKOptions, SDK_USER_AGENT, type SanitizeHeadersResult, type SeenEvents, type SettlementArtifact, type SettlementArtifactBinding, type SettlementArtifactBindingBase, type SettlementDecision, type SettlementOutcomeInfo, SettlementReportError, type SettlementRequest, type SignHttpRequestOptions, type SignableRequest, type StablecoinSettlementBinding, type StepUpApprovalInfo, type StepUpApprovalStatus, type StepUpOutcome, TRUST_LEVEL_RANGES, type TestEventResult, type TestEventType, type TokenGuidance, type ToolGate, type ToolGateConfig, type TrustLevel, UCP_ORDER_CAPABILITY, UCP_VERSION, type UcpAgentBinding, type CatalogItem as UcpCatalogItem, type UcpCheckoutKitOptions, type CheckoutSession as UcpCheckoutSession, type CheckoutStore as UcpCheckoutStore, type UcpLink, type UcpMessage, type UcpOrder, type UcpProfile, type UcpProfileResult, type SettleResult as UcpSettleResult, type UcpSeverity, type UcpSignatureResult, VERIFICATION_STATUS_HEADER, SDK_VERSION as VERSION, type VerificationInterstitialProps, type VerificationRequest, type VerificationResult, type VerificationWarning, type VerifiedAgent, type VerifiedDeveloper, type VerifiedHopMarker, type VerifiedOrganization, type VerifyAp2Options, type VerifyOptions, type VerifyResponse, type WaitForApprovalOptions, type WellKnownAgenticCommerce, type X402PaymentPayload, type X402PaymentRequired, type X402PaymentRequirements, type X402ResourceInfo, type X402SettlementResponse, _resetEdgeConfigCache, abandonIdempotent, acpPaymentHandlers, aepCanonicalJson, aepHash, aepPrivateKeyFromSeed, aepPublicKeyDocument, aepPublicKeyFromBase64, aepRawPublicKey, aepSign, aepTimestamp, aepVerifySignature, index as agent, approvalEventsHandler, astrasyncPaymentHandlers, authorizeSettlement, awaitStepUpApproval, beginIdempotent, buildAcpWellKnown, buildGuidance, buildMpp402Response, buildMppChallenge, buildSdkObservedMetadata, buildUcpOrder, buildUcpProfile, buildVerificationUnavailableBody, buildX402Challenge, canonicalJson, checkUcpAgentBinding, checkoutHash, clearCache, closedCheckoutMandate, closedPaymentMandate, contentDigest, createAcpCheckoutKit, createKbHop, createMcpMiddleware, createUcpCheckoutKit, decodeMppRequest, degradeToObserve, denyStatusFor, deriveConnectionFromHeaders, detectPlatformFingerprint, detectRuntime, encodeMppReceipt, encodeX402SettlementResponse, express, expressHandler, extractApiKeyFormat, extractCredentials, extractMcpCredentials, extractPlatformHeaders, fetchEdgeConfig, fetchRoutes, fetchUcpProfile, finishIdempotent, getCachedWellKnownUrls, getEdgeConfig, getTrustLevel, getWellKnownUrls, handleApprovalEvents, hasCredentials, idempotencyMiddleware, isEdgeConfig, isRejectedIdentityClaim, isRetryableSettlementError, isSharedVerdict, isSpecialUseIp, isVerificationUnavailable, isVerifiedHopValidFor, issueDelegateSdJwt, matchEdgePathRule, matchPlatformSignature, matchRoutePattern, mppBodyDigest, negotiateUcp, nextjs, normalizeDeclaredSource, onVerificationResult, openCheckoutMandate, openPaymentMandate, parseYaml as parseLocalPolicyYaml, parseMppCredential, parseUcpAgentHeader, parseVerifiedHop, parseX402Challenge, parseX402Payment, pollStepUpStatus, prefetchWellKnown, quickVerify, recordDecision, reportAttempt, reportUnregisteredAttempt, requestFingerprint, rootMandateDigest, routePatternToRegExp, routePolicyOf, sanitizeHeaders, sdk, sdkFetch, sendUcpWebhook, serializeVerifiedHop, setMcpMeta, signHttpRequest, signRootMandate, signUcpRequest, signUcpResponse, index$1 as transport, ucpError, ucpEscalation, ucpFailure, ucpProfileHandler, ucpProfileKeys, ucpRequiredComponents, unavailableRetryAfterSeconds, validatePolicy as validateLocalPolicy, verify, verifyAepChain, verifyAp2Mandate, verifyDelegateChain, verifyKyaPayTokens, verifyMppChallenge, verifyUcpRequest, withIdempotency, x402PaymentMatchesOffer };
+export { ACP_API_VERSION, ACP_SUPPORTED_API_VERSIONS, AEP_SPEC_VERSION, AP2_VCT, type AcpCheckoutKitOptions, type AcpCheckoutSession, type AcpCheckoutStatus, type AcpCheckoutStore, type AcpWellKnownOptions, type AepActorType, type AepArtifactRecord, type AepArtifactType, AepChain, type AepChainOptions, type AepChainVerification, type AepHashInput, type AgentArtifacts, AgentClient, type AgentCommerce, type AgentCommerceOffer, type AgentCommerceRules, type AgentCredentials, type AgentProduct, type AgentProtocol, type AgentProtocolIdentities, type AgentRecord, type Ap2Party, type Ap2VerifyResult, type ApprovalEvent, type ApprovalEventKit, type ApprovalEventsHandlerOptions, type ApprovalEventsResponse, AstraSync, type AstraSyncAepEvidence, type AstraSyncConfig, type AstraSyncCredentials, AstraSyncError, type AstraSyncMandates, type AttemptOutcome, type AttemptReport, AuthenticationError, type BuildGuidanceParams, CAPTURE_SCHEMA_VERSION, type CallerMetadata, ChallengeHandler, type CheckoutMetadata, type CommerceArtifactsPayload, type CommerceContext, type CommercePipelineInput, type CommerceShieldProps, type ConsiderationItem, type ConsiderationSet, type CounterpartyType, DECLARED_SOURCE_MAX, DEFAULT_EDGE_CONFIG, DEFAULT_IDEMPOTENCY_TTL_MS, type DashboardToolRule, type DynamicPlatformFingerprint, type EdgeConfig, type EdgeMode, type EdgePathRule, type EdgeVerificationDepth, type EnhancedVerificationResult, type ExpressHandlerOptions, type ExpressMiddlewareOptions, type FetchEdgeConfigResult, type FetchEdgeConfigSuccess, type FetchKit, type FiatSettlementBinding, type FrameworkConfig, type FulfilmentInfo, type GatewayConfig, type GuidanceEnvelope, type GuidanceInfo, type HandleApprovalEventsOptions, type HealthResponse, type HttpSignatureAlgorithm, ISSUER_PROGRAM_HEADER, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, KYDRequiredError, type KitExpressRequest, type KitExpressResponse, type KitMessage, type KitReport, type KitRequestContext, type KyaPayIdentity, type KyaPayResult, type KyaPayTokenType, type KyaPayVerifyOptions, type ParseResult as LocalPolicyParseResult, type ValidationError as LocalPolicyValidationError, type ValidationResult as LocalPolicyValidationResult, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, MCP_VERIFIED_HOP_HEADER, MCP_VERIFIED_HOP_MAX_AGE_MS, type McpMiddlewareOptions, MemoryCheckoutStore, MemoryIdempotencyStore, MemoryMppChallengeStore, MemorySeenEvents, type MerchantSettlementToken, type ModelConfig, type MppChallenge, type MppChallengeStore, type MppCredential, type MppReceipt, type MppVerifyOptions, type MppVerifyResult, type NegotiationResult, type NextJsMiddlewareOptions, type ObservedMetadata, type PDLSSConfig$1 as PDLSSConfig, type PDLSSDuration, type PDLSSInfo, type PDLSSLimits, type PDLSSPurpose, type PDLSSScope, type PDLSSSelfInstantiation, PLATFORM_AGENT_SIGNATURES, type PendingRegistrationResponse, type PendingResolution, type PlatformAgentVendor, type PlatformDetectionInput, type PlatformFingerprint, type PlatformSignatureDef, type PollRegistrationResult, type PricingContext, type ProtocolTransport, type PurposeSource, RUNTIME_SIGNATURES, RedisIdempotencyStore, type RedisLike, type RegisterOptions, type RegisterResult, RegistrationDeniedError, RegistrationExpiredError, type RegistrationResponse, RegistrationTimeoutError, type ReportAttemptOptions, type ReportRetryOptions, type ResumeOutcome, type ResumeResult, type RootKeyResolver, type RouteAccessConfig, type RoutePolicy, type RuntimeChallengeResult, type RuntimeSignature, type SDKOptions, SDK_USER_AGENT, type SanitizeHeadersResult, type SeenEvents, type SettlementArtifact, type SettlementArtifactBinding, type SettlementArtifactBindingBase, type SettlementDecision, type SettlementOutcomeInfo, SettlementReportError, type SettlementRequest, type SignHttpRequestOptions, type SignableRequest, type StablecoinSettlementBinding, type StepUpApprovalInfo, type StepUpApprovalStatus, type StepUpOutcome, TRUST_LEVEL_RANGES, type TestEventResult, type TestEventType, type TokenGuidance, type ToolGate, type ToolGateConfig, type TrustLevel, UCP_ORDER_CAPABILITY, UCP_VERSION, type UcpAgentBinding, type CatalogItem as UcpCatalogItem, type UcpCheckoutKitOptions, type CheckoutSession as UcpCheckoutSession, type CheckoutStore as UcpCheckoutStore, type UcpLink, type UcpMessage, type UcpOrder, type UcpProfile, type UcpProfileResult, type SettleResult as UcpSettleResult, type UcpSeverity, type UcpSignatureResult, VERIFICATION_STATUS_HEADER, SDK_VERSION as VERSION, type VerificationInterstitialProps, type VerificationRequest, type VerificationResult, type VerificationWarning, type VerifiedAgent, type VerifiedDeveloper, type VerifiedHopMarker, type VerifiedOrganization, type VerifyAp2Options, type VerifyOptions, type VerifyResponse, type WaitForApprovalOptions, type WellKnownAgenticCommerce, type X402PaymentPayload, type X402PaymentRequired, type X402PaymentRequirements, type X402ResourceInfo, type X402SettlementResponse, _resetEdgeConfigCache, abandonIdempotent, acpPaymentHandlers, aepCanonicalJson, aepHash, aepPrivateKeyFromSeed, aepPublicKeyDocument, aepPublicKeyFromBase64, aepRawPublicKey, aepSign, aepTimestamp, aepVerifySignature, index as agent, approvalEventsHandler, astrasyncPaymentHandlers, authorizeSettlement, awaitStepUpApproval, beginIdempotent, buildAcpWellKnown, buildGuidance, buildMpp402Response, buildMppChallenge, buildSdkObservedMetadata, buildUcpOrder, buildUcpProfile, buildVerificationUnavailableBody, buildX402Challenge, canonicalJson, checkUcpAgentBinding, checkoutHash, clearCache, closedCheckoutMandate, closedPaymentMandate, contentDigest, createAcpCheckoutKit, createAgentCommerce, createKbHop, createMcpMiddleware, createUcpCheckoutKit, decodeMppRequest, degradeToObserve, denyStatusFor, deriveConnectionFromHeaders, detectPlatformFingerprint, detectRuntime, encodeMppReceipt, encodeX402SettlementResponse, express, expressHandler, extractApiKeyFormat, extractCredentials, extractMcpCredentials, extractPlatformHeaders, fetchEdgeConfig, fetchRoutes, fetchUcpProfile, finishIdempotent, fromFeed, getCachedWellKnownUrls, getEdgeConfig, getTrustLevel, getWellKnownUrls, handleApprovalEvents, hasCredentials, idempotencyMiddleware, isEdgeConfig, isRejectedIdentityClaim, isRetryableSettlementError, isSharedVerdict, isSpecialUseIp, isVerificationUnavailable, isVerifiedHopValidFor, issueDelegateSdJwt, issuerOfferPrice, matchEdgePathRule, matchPlatformSignature, matchRoutePattern, mppBodyDigest, negotiateUcp, nextjs, normalizeDeclaredSource, onVerificationResult, openCheckoutMandate, openPaymentMandate, parseFeed, parseYaml as parseLocalPolicyYaml, parseMppCredential, parseUcpAgentHeader, parseVerifiedHop, parseX402Challenge, parseX402Payment, pollStepUpStatus, prefetchWellKnown, priceForAgent, pricingContextFrom, quickVerify, recordDecision, reportAttempt, reportUnregisteredAttempt, requestFingerprint, rootMandateDigest, routePatternToRegExp, routePolicyOf, sanitizeHeaders, sdk, sdkFetch, sendUcpWebhook, serializeVerifiedHop, serveAgentCatalog, setMcpMeta, signHttpRequest, signRootMandate, signUcpRequest, signUcpResponse, index$1 as transport, ucpError, ucpEscalation, ucpFailure, ucpProfileHandler, ucpProfileKeys, ucpRequiredComponents, unavailableRetryAfterSeconds, validatePolicy as validateLocalPolicy, verify, verifyAepChain, verifyAp2Mandate, verifyDelegateChain, verifyKyaPayTokens, verifyMppChallenge, verifyUcpRequest, withIdempotency, x402PaymentMatchesOffer };