@astrasyncai/verification-gateway 5.4.0 → 5.4.2

package/dist/adapters/sdk.d.mts

@@ -1,3 +1,157 @@
-import '../types-CD1F9fmp.mjs';
-export { V as VerificationGatewayClient, c as createClient, g as getTrustLevel, v as verifyOnce } from '../sdk-C6_-6D-9.mjs';
-import '../metadata-capture.mjs';
+import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-BU04qAAR.mjs';
+
+/**
+ * AstraSync Universal Verification Gateway — Trust Level helpers.
+ *
+ * SDK 5.0.0: the `accessLevel` band (`none`/`restricted`/`read-only`/`standard`/
+ * `full`/`internal`) was removed entirely — it never gated the access decision
+ * (the server does, from a verified ID + runtime challenge + PDLSS match + trust
+ * score). What remains here is the coarse trust-level badge derived from the
+ * numeric trust score, used only for display.
+ */
+
+/**
+ * Determine trust level from score
+ */
+declare function getTrustLevel(score: number): TrustLevel;
+
+/**
+ * AstraSync Universal Verification Gateway - SDK Adapter
+ *
+ * Direct SDK for verifying agents in any JavaScript/TypeScript environment.
+ * Useful for agent-to-agent verification, serverless functions, or custom integrations.
+ *
+ * @example
+ * ```typescript
+ * import { createClient } from '@astrasyncai/verification-gateway/sdk';
+ *
+ * const gateway = createClient({
+ *   apiBaseUrl: 'https://astrasync.ai/api',
+ * });
+ *
+ * // Verify another agent before interacting
+ * const result = await gateway.verify({
+ *   astraId: 'ASTRA-abc123',
+ *   purpose: 'data-exchange',
+ * });
+ *
+ * if (result.identityVerified && result.policyAllowed) {
+ *   // Safe to interact with this agent
+ * }
+ * ```
+ */
+
+/**
+ * Verification Gateway SDK Client
+ */
+declare class VerificationGatewayClient {
+    private config;
+    private timeout;
+    private retryConfig;
+    constructor(options: SDKOptions);
+    /**
+     * Full verification with all details
+     */
+    verify(options: {
+        astraId?: string;
+        apiKey?: string;
+        jwt?: string;
+        purpose?: string;
+        action?: string;
+        resourceType?: string;
+        resource?: string;
+        jurisdiction?: string;
+        transactionValue?: number;
+        currency?: string;
+        isSubAgentRequest?: boolean;
+        parentAgentId?: string;
+        subAgentDepth?: number;
+        counterpartyUrl?: string;
+        counterpartyType?: string;
+    }): Promise<VerificationResult>;
+    /**
+     * 5.4.0 (astra-pay): confirm-leg of a checkout — the ONLY call that may fire
+     * first-party charge-at-redeem (server-side settlement on the owner's saved
+     * instrument). This is the supported public surface for the confirm leg;
+     * `verify()` deliberately does not expose the checkout fields, so settlement
+     * can never fire by accident from a generic verify.
+     *
+     * Sends `commercePhase: 'confirm'` plus the checkout session id (per-cart
+     * idempotency) and line items (order/receipt plane), and identifies the
+     * merchant via `counterpartyUrl`/`counterpartyType` (required — the backend
+     * only settles a merchant-mediated grant against a first-party storefront).
+     * `purpose`/`action` default to the canonical shopping pair.
+     *
+     * Returns the full `VerificationResult`: read `.settlementOutcome` for the
+     * settled/failed/requires_action/no_instrument outcome (+ `orderId`), and the
+     * identity/policy/`failures` fields for a denial. On any non-`confirm`/first-
+     * party path `settlementOutcome` is simply absent — no money moves.
+     */
+    confirmCheckout(options: {
+        astraId?: string;
+        apiKey?: string;
+        jwt?: string;
+        purpose?: string;
+        action?: string;
+        transactionValue?: number;
+        currency?: string;
+        checkoutSessionId?: string;
+        checkoutItems?: VerificationRequest['checkoutItems'];
+        counterpartyUrl?: string;
+        counterpartyType?: string;
+    }): Promise<VerificationResult>;
+    /**
+     * Quick verification — checks credentials and policy in one call.
+     *
+     * The return shape mirrors `VerificationResult`'s identity/policy
+     * split. Map to HTTP status the same way: `!identityVerified` → 401,
+     * `identityVerified && !policyAllowed` → 403.
+     */
+    quickVerify(credentials: {
+        astraId?: string;
+        apiKey?: string;
+        jwt?: string;
+    }): Promise<{
+        identityVerified: boolean;
+        policyAllowed: boolean;
+        reason?: string;
+    }>;
+    /**
+     * Verify a specific ASTRA-ID
+     */
+    verifyAstraId(astraId: string, options?: {
+        purpose?: string;
+        action?: string;
+    }): Promise<VerificationResult>;
+    /**
+     * Verify using an API key
+     */
+    verifyApiKey(apiKey: string, options?: {
+        purpose?: string;
+        action?: string;
+    }): Promise<VerificationResult>;
+    /**
+     * Clear the verification cache
+     */
+    clearCache(): void;
+    /**
+     * Execute a function with retry logic
+     */
+    private executeWithRetry;
+}
+/**
+ * Create a new SDK client
+ */
+declare function createClient(options: SDKOptions): VerificationGatewayClient;
+/**
+ * One-shot verification without creating a client
+ */
+declare function verifyOnce(options: SDKOptions & {
+    astraId?: string;
+    apiKey?: string;
+    jwt?: string;
+    purpose?: string;
+    action?: string;
+}): Promise<VerificationResult>;
+
+export { VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };

package/dist/adapters/sdk.d.ts

@@ -1,3 +1,157 @@
-import '../types-76TB0fxW.js';
-export { V as VerificationGatewayClient, c as createClient, g as getTrustLevel, v as verifyOnce } from '../sdk-C1IOA5LE.js';
-import '../metadata-capture.js';
+import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-BU04qAAR.js';
+
+/**
+ * AstraSync Universal Verification Gateway — Trust Level helpers.
+ *
+ * SDK 5.0.0: the `accessLevel` band (`none`/`restricted`/`read-only`/`standard`/
+ * `full`/`internal`) was removed entirely — it never gated the access decision
+ * (the server does, from a verified ID + runtime challenge + PDLSS match + trust
+ * score). What remains here is the coarse trust-level badge derived from the
+ * numeric trust score, used only for display.
+ */
+
+/**
+ * Determine trust level from score
+ */
+declare function getTrustLevel(score: number): TrustLevel;
+
+/**
+ * AstraSync Universal Verification Gateway - SDK Adapter
+ *
+ * Direct SDK for verifying agents in any JavaScript/TypeScript environment.
+ * Useful for agent-to-agent verification, serverless functions, or custom integrations.
+ *
+ * @example
+ * ```typescript
+ * import { createClient } from '@astrasyncai/verification-gateway/sdk';
+ *
+ * const gateway = createClient({
+ *   apiBaseUrl: 'https://astrasync.ai/api',
+ * });
+ *
+ * // Verify another agent before interacting
+ * const result = await gateway.verify({
+ *   astraId: 'ASTRA-abc123',
+ *   purpose: 'data-exchange',
+ * });
+ *
+ * if (result.identityVerified && result.policyAllowed) {
+ *   // Safe to interact with this agent
+ * }
+ * ```
+ */
+
+/**
+ * Verification Gateway SDK Client
+ */
+declare class VerificationGatewayClient {
+    private config;
+    private timeout;
+    private retryConfig;
+    constructor(options: SDKOptions);
+    /**
+     * Full verification with all details
+     */
+    verify(options: {
+        astraId?: string;
+        apiKey?: string;
+        jwt?: string;
+        purpose?: string;
+        action?: string;
+        resourceType?: string;
+        resource?: string;
+        jurisdiction?: string;
+        transactionValue?: number;
+        currency?: string;
+        isSubAgentRequest?: boolean;
+        parentAgentId?: string;
+        subAgentDepth?: number;
+        counterpartyUrl?: string;
+        counterpartyType?: string;
+    }): Promise<VerificationResult>;
+    /**
+     * 5.4.0 (astra-pay): confirm-leg of a checkout — the ONLY call that may fire
+     * first-party charge-at-redeem (server-side settlement on the owner's saved
+     * instrument). This is the supported public surface for the confirm leg;
+     * `verify()` deliberately does not expose the checkout fields, so settlement
+     * can never fire by accident from a generic verify.
+     *
+     * Sends `commercePhase: 'confirm'` plus the checkout session id (per-cart
+     * idempotency) and line items (order/receipt plane), and identifies the
+     * merchant via `counterpartyUrl`/`counterpartyType` (required — the backend
+     * only settles a merchant-mediated grant against a first-party storefront).
+     * `purpose`/`action` default to the canonical shopping pair.
+     *
+     * Returns the full `VerificationResult`: read `.settlementOutcome` for the
+     * settled/failed/requires_action/no_instrument outcome (+ `orderId`), and the
+     * identity/policy/`failures` fields for a denial. On any non-`confirm`/first-
+     * party path `settlementOutcome` is simply absent — no money moves.
+     */
+    confirmCheckout(options: {
+        astraId?: string;
+        apiKey?: string;
+        jwt?: string;
+        purpose?: string;
+        action?: string;
+        transactionValue?: number;
+        currency?: string;
+        checkoutSessionId?: string;
+        checkoutItems?: VerificationRequest['checkoutItems'];
+        counterpartyUrl?: string;
+        counterpartyType?: string;
+    }): Promise<VerificationResult>;
+    /**
+     * Quick verification — checks credentials and policy in one call.
+     *
+     * The return shape mirrors `VerificationResult`'s identity/policy
+     * split. Map to HTTP status the same way: `!identityVerified` → 401,
+     * `identityVerified && !policyAllowed` → 403.
+     */
+    quickVerify(credentials: {
+        astraId?: string;
+        apiKey?: string;
+        jwt?: string;
+    }): Promise<{
+        identityVerified: boolean;
+        policyAllowed: boolean;
+        reason?: string;
+    }>;
+    /**
+     * Verify a specific ASTRA-ID
+     */
+    verifyAstraId(astraId: string, options?: {
+        purpose?: string;
+        action?: string;
+    }): Promise<VerificationResult>;
+    /**
+     * Verify using an API key
+     */
+    verifyApiKey(apiKey: string, options?: {
+        purpose?: string;
+        action?: string;
+    }): Promise<VerificationResult>;
+    /**
+     * Clear the verification cache
+     */
+    clearCache(): void;
+    /**
+     * Execute a function with retry logic
+     */
+    private executeWithRetry;
+}
+/**
+ * Create a new SDK client
+ */
+declare function createClient(options: SDKOptions): VerificationGatewayClient;
+/**
+ * One-shot verification without creating a client
+ */
+declare function verifyOnce(options: SDKOptions & {
+    astraId?: string;
+    apiKey?: string;
+    jwt?: string;
+    purpose?: string;
+    action?: string;
+}): Promise<VerificationResult>;
+
+export { VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };

package/dist/adapters/sdk.js

@@ -28,7 +28,7 @@ __export(sdk_exports, {
 module.exports = __toCommonJS(sdk_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.4.0";
+var SDK_VERSION = "5.4.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -165,7 +165,14 @@ function getCacheKey(request, counterpartyId) {
     request.callerMetadata?.sourceIp || "",
     request.callerMetadata?.userAgent || "",
     request.callerMetadata?.forwardedFor || "",
-    request.callerMetadata?.agentCardUrl || ""
+    request.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request.commercePhase || "",
+    request.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {
@@ -581,7 +588,13 @@ var VerificationGatewayClient = class {
       debug: options.debug,
       customHeaders: options.customHeaders,
       counterpartyUrl: options.counterpartyUrl,
-      counterpartyType: options.counterpartyType
+      counterpartyType: options.counterpartyType,
+      // 5.4.1 (UAT2): previously dropped here despite being a typed, documented
+      // GatewayConfig field — a client-driven confirmCheckout() could never
+      // identify its endpoint by ASTRAE id, so merchants with multiple
+      // endpoints on one origin (or a stale row sharing the URL) resolved
+      // non-deterministically by URL and could miss the first-party gate.
+      counterpartyId: options.counterpartyId
     };
     this.timeout = options.timeout || 1e4;
     this.retryConfig = options.retry || { maxRetries: 3, backoffMs: 1e3 };
@@ -638,18 +651,25 @@ var VerificationGatewayClient = class {
       jwt: options.jwt
     };
     return this.executeWithRetry(
-      () => verify(this.config, {
-        credentials,
-        purpose: options.purpose ?? "shopping",
-        action: options.action ?? "shopping.purchase",
-        transactionValue: options.transactionValue,
-        currency: options.currency,
-        commercePhase: "confirm",
-        checkoutSessionId: options.checkoutSessionId,
-        checkoutItems: options.checkoutItems,
-        counterpartyUrl: options.counterpartyUrl,
-        counterpartyType: options.counterpartyType
-      })
+      () => verify(
+        this.config,
+        {
+          credentials,
+          purpose: options.purpose ?? "shopping",
+          action: options.action ?? "shopping.purchase",
+          transactionValue: options.transactionValue,
+          currency: options.currency,
+          commercePhase: "confirm",
+          checkoutSessionId: options.checkoutSessionId,
+          checkoutItems: options.checkoutItems,
+          counterpartyUrl: options.counterpartyUrl,
+          counterpartyType: options.counterpartyType
+        },
+        // 5.4.1 (UAT2 Bug B): the confirm leg must always reach the backend —
+        // a cached quote-leg grant carries no settlementOutcome and would
+        // silently skip settlement.
+        { bypassCache: true }
+      )
     );
   }
   /**