@astrasyncai/verification-gateway 5.3.0 → 5.4.1

package/dist/adapter-interface/interface.d.mts

@@ -1,7 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-1urxLCZv.mjs';
-import '../types-eSqHyFFH.mjs';
-import '../metadata-capture.mjs';
+import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-CfBpm3w5.mjs';
+import '../types-BfILnheI.mjs';
 
 /**
  * PlatformAdapter Interface

package/dist/adapter-interface/interface.d.ts

@@ -1,7 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-C1s1z0VD.js';
-import '../types-CA1ZhoaJ.js';
-import '../metadata-capture.js';
+import { A as AgentAction, I as InterceptResult, P as PDLSSContext, V as VerificationDecision } from '../types-BRz2U0Pn.js';
+import '../types-BfILnheI.js';
 
 /**
  * PlatformAdapter Interface

package/dist/adapters/express.d.mts

@@ -1,4 +1,63 @@
-import 'express';
-import '../types-eSqHyFFH.mjs';
-export { c as createMiddleware, a as extractAstraSyncCredentials } from '../express-PLYlCd5k.mjs';
-import '../metadata-capture.mjs';
+import { RequestHandler, Request } from 'express';
+import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-W-A326w3.mjs';
+
+/**
+ * AstraSync Universal Verification Gateway - Express Middleware
+ *
+ * Express.js middleware for verifying AI agents on API endpoints.
+ *
+ * @example
+ * ```typescript
+ * import express from 'express';
+ * import { createMiddleware } from '@astrasyncai/verification-gateway/express';
+ *
+ * const app = express();
+ *
+ * app.use(createMiddleware({
+ *   apiBaseUrl: 'https://astrasync.ai/api',
+ *   apiKey: process.env.ASTRASYNC_API_KEY,
+ *   counterpartyId: 'ASTRAE-...', // your registered endpoint id
+ * }));
+ * ```
+ *
+ * Per-route policy (which paths are gated, trust floors, PDLSS purposes) is
+ * configured in the AstraSync dashboard, not in code — the middleware
+ * fetches it automatically on init and refreshes periodically. There is no
+ * `routes` option; a `routes` key in the config object is ignored (with a
+ * warning) since v2.9.7.
+ */
+
+/**
+ * Extend Express Request with verification result
+ */
+declare global {
+    namespace Express {
+        interface Request {
+            agentVerification?: VerificationResult;
+        }
+    }
+}
+/**
+ * Extract extended AstraSync credentials (X-Astra-* headers) from Express request.
+ * Returns null if no AstraSync headers are present.
+ */
+declare function extractAstraSyncCredentials(req: Request): AstraSyncCredentials | null;
+/**
+ * Create Express middleware for agent verification.
+ *
+ * v2.9.7 moved per-route policy authority out of merchant-side source code
+ * into the AstraSync dashboard. `createMiddleware` no longer accepts a
+ * `routes` array — it fetches the endpoint's stored policy via
+ * `GET /endpoints/:counterpartyId/routes` on init and refreshes
+ * periodically. Policy edits in the dashboard take effect on the next
+ * refresh (or sooner if the operator manually restarts the SDK).
+ *
+ * `counterpartyId` is required: the SDK can't know which endpoint's policy
+ * to fetch without it. Local-development workflows that don't have an
+ * AstraSync endpoint registered can omit it — the middleware logs a
+ * one-time warning and falls through (allows all) until a policy is
+ * fetchable.
+ */
+declare function createMiddleware(options: ExpressMiddlewareOptions): RequestHandler;
+
+export { createMiddleware, extractAstraSyncCredentials };

package/dist/adapters/express.d.ts

@@ -1,4 +1,63 @@
-import 'express';
-import '../types-CA1ZhoaJ.js';
-export { c as createMiddleware, a as extractAstraSyncCredentials } from '../express-DHEz_6Rh.js';
-import '../metadata-capture.js';
+import { RequestHandler, Request } from 'express';
+import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-W-A326w3.js';
+
+/**
+ * AstraSync Universal Verification Gateway - Express Middleware
+ *
+ * Express.js middleware for verifying AI agents on API endpoints.
+ *
+ * @example
+ * ```typescript
+ * import express from 'express';
+ * import { createMiddleware } from '@astrasyncai/verification-gateway/express';
+ *
+ * const app = express();
+ *
+ * app.use(createMiddleware({
+ *   apiBaseUrl: 'https://astrasync.ai/api',
+ *   apiKey: process.env.ASTRASYNC_API_KEY,
+ *   counterpartyId: 'ASTRAE-...', // your registered endpoint id
+ * }));
+ * ```
+ *
+ * Per-route policy (which paths are gated, trust floors, PDLSS purposes) is
+ * configured in the AstraSync dashboard, not in code — the middleware
+ * fetches it automatically on init and refreshes periodically. There is no
+ * `routes` option; a `routes` key in the config object is ignored (with a
+ * warning) since v2.9.7.
+ */
+
+/**
+ * Extend Express Request with verification result
+ */
+declare global {
+    namespace Express {
+        interface Request {
+            agentVerification?: VerificationResult;
+        }
+    }
+}
+/**
+ * Extract extended AstraSync credentials (X-Astra-* headers) from Express request.
+ * Returns null if no AstraSync headers are present.
+ */
+declare function extractAstraSyncCredentials(req: Request): AstraSyncCredentials | null;
+/**
+ * Create Express middleware for agent verification.
+ *
+ * v2.9.7 moved per-route policy authority out of merchant-side source code
+ * into the AstraSync dashboard. `createMiddleware` no longer accepts a
+ * `routes` array — it fetches the endpoint's stored policy via
+ * `GET /endpoints/:counterpartyId/routes` on init and refreshes
+ * periodically. Policy edits in the dashboard take effect on the next
+ * refresh (or sooner if the operator manually restarts the SDK).
+ *
+ * `counterpartyId` is required: the SDK can't know which endpoint's policy
+ * to fetch without it. Local-development workflows that don't have an
+ * AstraSync endpoint registered can omit it — the middleware logs a
+ * one-time warning and falls through (allows all) until a policy is
+ * fetchable.
+ */
+declare function createMiddleware(options: ExpressMiddlewareOptions): RequestHandler;
+
+export { createMiddleware, extractAstraSyncCredentials };

package/dist/adapters/express.js

@@ -26,7 +26,7 @@ __export(express_exports, {
 module.exports = __toCommonJS(express_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.3.0";
+var SDK_VERSION = "5.4.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -273,7 +273,14 @@ function getCacheKey(request, counterpartyId) {
     request.callerMetadata?.sourceIp || "",
     request.callerMetadata?.userAgent || "",
     request.callerMetadata?.forwardedFor || "",
-    request.callerMetadata?.agentCardUrl || ""
+    request.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request.commercePhase || "",
+    request.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {