@astrasyncai/verification-gateway 5.4.0 → 5.4.2

package/dist/index-By021oSN.d.mts

@@ -1,1469 +0,0 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-CD1F9fmp.mjs';
-import { JWK } from 'jose';
-
-/**
- * HTTP Transport Adapter
- *
- * Maps AstraSync credentials to/from HTTP headers (X-Astra-* convention).
- */
-
-/**
- * Inject AstraSync credentials into HTTP headers.
- */
-declare function setHttpHeaders(headers: Record<string, string>, credentials: AstraSyncCredentials): Record<string, string>;
-/**
- * Extract AstraSync credentials from HTTP headers.
- */
-declare function extractHttpCredentials(headers: Record<string, string | string[] | undefined>): AstraSyncCredentials | null;
-
-/**
- * A2A (Agent-to-Agent) Transport Adapter
- *
- * Maps AstraSync credentials to/from A2A task metadata.astrasync block.
- */
-
-interface A2ATask {
-    metadata?: Record<string, unknown>;
-    [key: string]: unknown;
-}
-/**
- * Add AstraSync credentials to an A2A task's metadata block.
- */
-declare function setA2AMetadata(task: A2ATask, credentials: AstraSyncCredentials): A2ATask;
-/**
- * Extract AstraSync credentials from an A2A task's metadata block.
- */
-declare function extractA2ACredentials(task: A2ATask): AstraSyncCredentials | null;
-
-/**
- * MCP (Model Context Protocol) Transport Adapter
- *
- * Maps AstraSync credentials to/from MCP params._meta.astrasync block.
- */
-
-interface McpParams {
-    _meta?: Record<string, unknown>;
-    [key: string]: unknown;
-}
-/**
- * Add AstraSync credentials to MCP params' _meta block.
- */
-declare function setMcpMeta(params: McpParams, credentials: AstraSyncCredentials): McpParams;
-/**
- * Extract AstraSync credentials from MCP params' _meta block.
- */
-declare function extractMcpCredentials(params: McpParams): AstraSyncCredentials | null;
-
-/**
- * Protocol request -> AstraSync PDLSS purpose category mapping.
- *
- * Commerce purpose mapping table, extended with MPP + x402
- * entries (April 2026 protocol landscape).
- */
-type CommercePurpose = 'commerce.checkout.create' | 'commerce.checkout.update' | 'commerce.checkout.confirm' | 'commerce.checkout.cancel' | 'commerce.payment.execute' | 'commerce.payment.stream' | 'commerce.delegation.intent' | 'commerce.delegation.checkout' | 'commerce.delegation.payment' | 'commerce.identity_probe' | 'commerce.browsing';
-declare function mapUCPRequestToPurpose(method: string, path: string): CommercePurpose | null;
-declare function mapACPRequestToPurpose(method: string, path: string): CommercePurpose | null;
-type AP2MandateType = 'intent_mandate' | 'cart_mandate' | 'payment_mandate';
-declare function mapAP2MandateToPurpose(mandateType: AP2MandateType): CommercePurpose;
-type VIMandateType = 'checkout' | 'payment' | 'checkout.open' | 'payment.open';
-declare function mapVIMandateToPurpose(mandateType: VIMandateType): CommercePurpose;
-type RFC9421Tag = 'browse' | 'purchase' | undefined;
-declare function mapRFC9421TagToPurpose(tag: RFC9421Tag): CommercePurpose;
-type MPPIntent = 'charge' | 'session';
-declare function mapMPPRequestToPurpose(intent: MPPIntent | undefined, amount: number | undefined): CommercePurpose;
-declare function mapX402RequestToPurpose(amount: number | undefined): CommercePurpose;
-/**
- * Informational Stripe webhook events surfaced as trust signals on
- * `CommerceContext.trustSignals` but NOT routed to a PDLSS purpose.
- */
-declare const STRIPE_WEBHOOK_INFORMATIONAL_EVENTS: readonly ["payment_intent.succeeded", "payment_intent.payment_failed", "charge.refunded", "checkout.session.completed", "customer.subscription.created"];
-type StripeWebhookInformationalEvent = (typeof STRIPE_WEBHOOK_INFORMATIONAL_EVENTS)[number];
-declare function isStripeWebhookInformational(eventType: string): boolean;
-
-/**
- * Per-protocol transaction-value normalization.
- *
- * Each protocol encodes amount/currency differently. This module produces a
- * uniform `TransactionValueContext` with `source` recording the extraction
- * path so trace logs can show where the value came from.
- *
- * Amount unit: "major units" (dollars/euros/etc. for fiat; native unit for
- * tokens — we do NOT convert across currencies). UCP/ACP totals are in
- * cents, so we divide by 100. MPP/x402/VI pass through as declared.
- */
-interface TransactionValueContext {
-    protocol: 'vi' | 'ap2' | 'ucp' | 'acp' | 'mpp' | 'x402' | 'agentpay' | 'tap';
-    amount: number;
-    currency: string;
-    source: string;
-    /** When true, the amount is in raw atomic/minor units and could NOT be
-     *  converted to major units (unknown token decimals). The limit engine
-     *  must fail-closed — never compare raw units against major-unit limits. */
-    rawUnits?: boolean;
-}
-declare function extractUCPTransactionValue(input: {
-    totals?: Array<{
-        type?: string;
-        amount?: number;
-        currency?: string;
-    }>;
-}): TransactionValueContext | null;
-declare function extractACPTransactionValue(input: {
-    totals?: Array<{
-        type?: string;
-        amount?: number;
-        currency?: string;
-    }>;
-}): TransactionValueContext | null;
-interface VIClaimsForValue {
-    constraints?: {
-        paymentAmount?: {
-            currency?: string;
-            min?: number;
-            max?: number;
-        };
-    };
-    l3aPaymentAmount?: {
-        currency?: string;
-        amount?: number;
-    };
-}
-declare function extractVITransactionValue(claims: VIClaimsForValue): TransactionValueContext | null;
-interface AP2PaymentMandateForValue {
-    payment_details_total?: {
-        amount?: {
-            value?: string | number;
-            currency?: string;
-        };
-    };
-}
-declare function extractAP2TransactionValue(mandate: AP2PaymentMandateForValue | undefined): TransactionValueContext | null;
-interface MPPChallengeForValue {
-    method?: string;
-    request?: {
-        amount?: number;
-        currency?: string;
-    } & Record<string, unknown>;
-}
-declare function extractMPPTransactionValue(challenge: MPPChallengeForValue): TransactionValueContext | null;
-interface X402RequestForValue {
-    maxAmountRequired?: number;
-    amount?: number;
-    asset?: string;
-    currency?: string;
-}
-declare function extractX402TransactionValue(req: X402RequestForValue): TransactionValueContext | null;
-
-/**
- * RFC 9421 HTTP Message Signatures parser.
- *
- * Wraps `structured-headers` (transitive dep of http-message-signatures) to
- * parse the Signature-Input and Signature Dictionary headers per RFC 9421
- * Section 2.
- *
- * Produces structured metadata (kid, algorithm, covered components, tag,
- * created/expires/nonce, signature bytes) without verifying the signature —
- * verification lives in rfc9421-verify.ts.
- *
- * Shared by:
- *  - Agent Pay (Mastercard) — kid resolves via Mastercard Agent Registry
- *  - TAP (Visa) — kid resolves via Visa JWKS
- *  - Web Bot Auth (generic transport substrate) — kid resolves via
- *    /.well-known/http-message-signatures-directory
- */
-interface RFC9421SignatureParams {
-    /** The label identifying the signature in the Dictionary header (e.g. "sig1"). */
-    label: string;
-    /** Key ID used to look up the verifying key in the relevant registry. */
-    kid: string;
-    /** Algorithm declared in the Signature-Input params (e.g. "ecdsa-p256-sha256", "ed25519"). */
-    alg?: string;
-    /** Covered components, in order, per RFC 9421 Section 2.1. */
-    covered: string[];
-    /** Base64url-encoded signature bytes extracted from the paired Signature header. */
-    signatureBase64: string;
-    /** Unix seconds when the signature was created. */
-    created?: number;
-    /** Unix seconds when the signature expires. */
-    expires?: number;
-    /** Nonce (opaque string) for replay protection. */
-    nonce?: string;
-    /** Tag parameter. For Agent Pay/TAP this is "browse" or "purchase"; undefined otherwise. */
-    tag?: 'browse' | 'purchase' | string;
-}
-interface ParsedRFC9421 {
-    signatures: RFC9421SignatureParams[];
-}
-/**
- * Parse the RFC 9421 Signature-Input and Signature headers from a request or response.
- * Returns all signatures present (a single message may carry multiple labelled signatures).
- *
- * Returns null if either header is missing or malformed.
- */
-declare function parseRFC9421(headers: Record<string, string | string[] | undefined>): ParsedRFC9421 | null;
-
-type RegistryName = 'mastercard' | 'visa' | 'web-bot-auth';
-interface RegistryResolver {
-    readonly name: RegistryName;
-    resolve(kid: string, context?: ResolveContext): Promise<JWK | null>;
-}
-interface ResolveContext {
-    origin?: string;
-    algorithm?: string;
-}
-
-/**
- * Shared nonce/signature replay-protection store for transport verifiers.
- *
- * Rationale: every transport-signature verifier (RFC9421, VI, AP2, ACP,
- * MPP) validates a created/expires window, but without a seen-nonce
- * cache any captured signed request can be replayed within the (default
- * 300s, now tightened to 60s) tolerance window.
- *
- * This module ships a bounded in-memory LRU as the default. Production
- * deployments with multi-pod horizontal scaling SHOULD pass a shared store
- * (Redis-backed) via the verifier options to make replay protection global
- * rather than per-pod.
- *
- * The store interface is intentionally minimal: a single `seen(key,
- * expiresAt)` method that returns true iff the key was already recorded
- * (i.e. caller should reject as a replay). Callers compose the key from
- * whichever identifiers are unique to the signature (kid + nonce + sig
- * digest, typically).
- */
-interface NonceStore {
-    /**
-     * Record `key` as seen. Returns true iff the key was ALREADY present —
-     * i.e. caller should reject the request as a replay. Returns false on
-     * first sighting (caller should proceed).
-     *
-     * `expiresAtMs` is a hint for the store to evict entries that can no
-     * longer cause harm (their signature window has elapsed).
-     */
-    seen(key: string, expiresAtMs: number): boolean;
-}
-
-/**
- * RFC 9421 HTTP Message Signatures verification.
- *
- * Wraps http-message-signatures (dhensby) verifyMessage() with a RegistryResolver
- * hook for kid → JWK lookup. Library handles canonicalization + ES256/EdDSA/
- * HMAC/RSA verification; we supply the key-finding callback and policy around
- * clock skew.
- *
- * Shared by:
- *  - Agent Pay (Mastercard) — resolver = createMastercardRegistry
- *  - TAP (Visa) — resolver = createVisaRegistry
- *  - Web Bot Auth (generic) — resolver = createWebBotAuthRegistry
- */
-
-interface RFC9421VerifyRequest {
-    method: string;
-    url: string;
-    headers: Record<string, string | string[]>;
-    body?: string;
-}
-interface RFC9421VerifyOptions {
-    resolver: RegistryResolver;
-    /** Seconds of tolerance around created/expires. Default 60 (tightened from 300). */
-    clockSkewSec?: number;
-    /** Injectable for deterministic tests. */
-    now?: () => number;
-    /** Optional replay-protection store. Defaults to in-process LRU. */
-    nonceStore?: NonceStore;
-}
-interface RFC9421VerifyResult {
-    ok: boolean;
-    kid?: string;
-    registry?: RegistryResolver['name'];
-    algorithm?: string;
-    error?: string;
-}
-declare function verifyRFC9421(request: RFC9421VerifyRequest, options: RFC9421VerifyOptions): Promise<RFC9421VerifyResult>;
-
-/**
- * UCP (Universal Commerce Protocol) checkout session extractor.
- *
- * Google + Shopify spec (ucp.dev). Extracts checkout session context from
- * incoming HTTP requests and, at registration time, validates the
- * `/.well-known/ucp` manifest via AJV against the mirrored JSON schema.
- */
-
-interface UCPTotal {
-    type?: string;
-    amount?: number;
-    currency?: string;
-}
-interface UCPCheckoutContext {
-    sessionId?: string;
-    endpoint: string;
-    purpose: CommercePurpose | null;
-    merchantDomain?: string;
-    totals?: UCPTotal[];
-    paymentMethod?: string;
-    manifestUrl?: string;
-}
-interface UCPRequestLike {
-    method: string;
-    url: string;
-    headers?: Record<string, string | string[] | undefined>;
-    body?: unknown;
-}
-declare function extractUCPContext(request: UCPRequestLike): UCPCheckoutContext | null;
-/**
- * Fetch and parse a UCP manifest at registration time. Returns parsed JSON
- * on success, null on any failure (network, parse, timeout). Does NOT throw.
- *
- * Schema validation is a separate step — see `validateUCPManifest`.
- */
-declare function fetchUCPManifest(manifestUrl: string, options?: {
-    timeoutMs?: number;
-}): Promise<unknown | null>;
-/**
- * Validate a UCP manifest against the minimal shape we care about.
- *
- * The full UCP manifest schema lives upstream (ucp.dev) and is out of scope
- * to mirror here exhaustively. This function checks the structural guarantees
- * we depend on: required top-level fields (version, capabilities, endpoints).
- *
- * For full schema validation, consumers can pass their own AJV compiled
- * validator via `options.validator`.
- */
-interface UCPManifestValidationResult {
-    ok: boolean;
-    errors: string[];
-}
-declare function validateUCPManifest(manifest: unknown, options?: {
-    validator?: (m: unknown) => {
-        ok: boolean;
-        errors: string[];
-    };
-}): UCPManifestValidationResult;
-
-/**
- * ACP (Agentic Commerce Protocol) request extractor.
- *
- * Co-maintained by OpenAI + Stripe. Spec at agenticcommerce.dev.
- *
- * Extracts ACP request context from HTTP requests:
- *  - Multi-header parsing: Signature, Timestamp, Idempotency-Key,
- *    Authorization: Bearer, API-Version
- *  - Endpoint classification: Agentic Checkout (checkout_sessions.*) vs
- *    Delegate Payment (agentic_commerce/delegate_payment)
- *  - Payment token detection: spt_* (Stripe SharedPaymentToken),
- *    vt_* (ACP vault token), unknown
- *  - Totals + merchant extraction from body
- *
- * No signature verification here — see acp-verify.ts.
- */
-
-type ACPEndpoint = 'checkout_sessions.create' | 'checkout_sessions.update' | 'checkout_sessions.complete' | 'checkout_sessions.cancel' | 'delegate_payment' | 'unknown';
-type ACPPaymentTokenType = 'stripe-spt' | 'acp-vt' | 'other' | null;
-interface ACPTotal {
-    type?: string;
-    amount?: number;
-    currency?: string;
-}
-interface ACPRequestContext {
-    endpoint: ACPEndpoint;
-    purpose: CommercePurpose | null;
-    sessionId?: string;
-    merchantId?: string;
-    apiVersion?: string;
-    bearer?: string;
-    signatureHeader?: string;
-    timestampHeader?: string;
-    idempotencyKey?: string;
-    paymentToken?: {
-        raw?: string;
-        type: ACPPaymentTokenType;
-        provider?: string;
-    };
-    totals?: ACPTotal[];
-    fulfillmentOption?: string;
-    rawBody?: string;
-}
-interface ACPRequestLike {
-    method: string;
-    url: string;
-    headers?: Record<string, string | string[] | undefined>;
-    body?: unknown;
-    rawBody?: string;
-}
-declare function extractACPContext(request: ACPRequestLike): ACPRequestContext | null;
-
-/**
- * VI (Verifiable Intent) SD-JWT extraction.
- *
- * Open-sourced 5 March 2026 by Mastercard + Google (v0.1-draft).
- * VI is a 3-layer SD-JWT chain:
- *   L1 — issuer → wallet (credential provider)
- *   L2 — user → agent (cnf.jwk binding to L3 agent key)
- *   L3 — agent → merchant (payment or checkout mandate, split into L3a / L3b
- *        cross-referenced via transaction_id)
- *
- * This module does EXTRACTION ONLY — it decodes SD-JWT structure and pulls
- * out the mandate type, kid, executionMode, 8 constraint types, checkoutHash
- * (constraint type 8), transactionId, and raw layers for later verification.
- *
- * Signature verification lives in vi-verify.ts; this module uses @sd-jwt's
- * sync decoder with a SHA-256 hasher for structural parsing only.
- */
-
-type VIExecutionMode = 'Immediate' | 'Autonomous' | 'Both';
-interface VIAllowedParty {
-    id?: string;
-    name?: string;
-    website?: string;
-}
-interface VILineItem {
-    id?: string;
-    acceptableItems?: string[];
-    quantity?: number;
-}
-interface VIPaymentAmount {
-    currency?: string;
-    min?: number;
-    max?: number;
-}
-interface VIBudgetLimit {
-    currency?: string;
-    max?: number;
-}
-interface VIRecurrence {
-    frequency?: string;
-    startDate?: string;
-    endDate?: string;
-    maxOccurrences?: number;
-}
-interface VIConstraints {
-    allowedMerchants?: VIAllowedParty[];
-    allowedPayees?: VIAllowedParty[];
-    lineItems?: VILineItem[];
-    paymentAmount?: VIPaymentAmount;
-    budgetLimit?: VIBudgetLimit;
-    recurrence?: VIRecurrence;
-    agentRecurrence?: VIRecurrence;
-}
-interface VIExtractedClaims {
-    mandateType: VIMandateType;
-    kid?: string;
-    executionMode?: VIExecutionMode;
-    credentialProvider?: string;
-    constraints: VIConstraints;
-    /** VI constraint type 8 — SHA-256 of the paired L2 checkout disclosure. */
-    checkoutHash?: string;
-    transactionId?: string;
-    rawLayers: {
-        l1?: string;
-        l2?: string;
-        l3?: string;
-    };
-}
-/**
- * Extract VI claims from a compact SD-JWT string.
- *
- * Input shape:
- *   <jwt>~<disclosure1>~<disclosure2>~...~<kbJwt?>
- *
- * Returns null if parsing fails at any layer. Does not verify signatures.
- */
-declare function extractVIClaims(sdJwtCompact: string): VIExtractedClaims | null;
-
-/**
- * Stripe webhook HMAC-SHA256 verifier (inline).
- *
- * Stripe-Signature header format: "t=TIMESTAMP,v1=HEX_SIGNATURE"
- *   - t: unix seconds when Stripe signed the webhook
- *   - v1: HMAC-SHA256(webhook_secret, `${t}.${payload}`) as hex
- *
- * Multiple v1 signatures can coexist during secret rotation; any match wins.
- * Default tolerance on timestamp age: 300s (matches Stripe's own default).
- *
- * Documented at docs.stripe.com — we intentionally inline ~25 LOC rather
- * than pull in the full stripe npm package (MIT but 600KB+ with deps).
- */
-interface VerifyStripeWebhookResult {
-    ok: boolean;
-    timestamp?: number;
-    error?: string;
-}
-interface VerifyStripeWebhookOptions {
-    toleranceSec?: number;
-    /** Injectable for deterministic tests. */
-    now?: () => number;
-}
-declare function verifyStripeWebhook(payload: string, signatureHeader: string | undefined, secret: string, options?: VerifyStripeWebhookOptions): VerifyStripeWebhookResult;
-
-/**
- * PDLSS constraint evaluation.
- *
- * Evaluates VI constraint types 1-4 (merchant/payee allowlists, line items,
- * payment amount) + MPP/x402 payment-method allowlist + spending-limit
- * against a transaction context.
- *
- * Types 5/6/7 (budget, recurrence, agent_recurrence) extract through but
- * enforcement is deferred to the cross-merchant budget service.
- * This module returns per-constraint {ok, reason} results
- * so a policy layer can decide hard-deny vs trust-signal.
- */
-
-interface TransactionContext {
-    amount?: number;
-    currency?: string;
-    merchant?: {
-        id?: string;
-        website?: string;
-    };
-    payee?: {
-        id?: string;
-        website?: string;
-    };
-    lineItems?: Array<{
-        id?: string;
-        quantity?: number;
-    }>;
-    /** For MPP / x402 payment-method enforcement. */
-    paymentMethod?: string;
-}
-type ConstraintKey = 'merchant' | 'payee' | 'lineItems' | 'amount' | 'paymentMethod';
-interface ConstraintResult {
-    ok: boolean;
-    reason?: string;
-}
-interface ConstraintEvalResult {
-    ok: boolean;
-    results: Record<string, ConstraintResult>;
-    reasons: string[];
-}
-interface VIConstraintEvalInput {
-    constraints: VIConstraints;
-    transaction: TransactionContext;
-}
-declare function evaluateVIConstraints(input: VIConstraintEvalInput): ConstraintEvalResult;
-interface PaymentMethodAllowlistInput {
-    allowedMethods?: string[];
-    requestedMethod?: string;
-}
-declare function evaluatePaymentMethodAllowlist(input: PaymentMethodAllowlistInput): ConstraintResult;
-interface SpendingLimitInput {
-    limit?: {
-        amount?: number;
-        currency?: string;
-    };
-    requested?: {
-        amount?: number;
-        currency?: string;
-    };
-}
-declare function evaluateSpendingLimit(input: SpendingLimitInput): ConstraintResult;
-
-/**
- * Cross-protocol agent identity binding.
- *
- * Every commerce layer claims an agent identity differently:
- *   - VI L3 kid (SD-JWT header)
- *   - AP2 agent_id (mandate payload)
- *   - ACP Authorization: Bearer token (merchant-issued pre-shared)
- *   - MPP Credential `source` field (DID or chain-native key)
- *   - x402 client wallet address
- *   - RFC 9421 kid (Agent Pay / TAP / Web Bot Auth)
- *
- * This module maps any such claim to a single AstraSync agent via a
- * caller-supplied resolver (typically delegates to the counterparty service),
- * then flags whether multiple claims on the same request resolve to different
- * agents (a trust signal for PDLSS).
- *
- * This is AstraSync whitespace — no vendor owns multi-protocol identity
- * unification.
- */
-interface IdentityClaim {
-    /** Originating protocol label: 'vi' | 'ap2' | 'acp' | 'mpp' | 'x402' | 'agentpay' | 'tap' | 'webbotauth' */
-    protocol: string;
-    /** Claim field name, e.g. 'kid', 'agent_id', 'source', 'bearer'. */
-    field: string;
-    /** Claim value as presented on the wire. */
-    value: string;
-}
-interface IdentityBindingResult {
-    claims: IdentityClaim[];
-    mappedAstraSyncAgentId?: string;
-    /**
-     * True when two or more claims resolve to different AstraSync agents.
-     * Surfaced as a trust signal rather than an auto-deny — legitimate flows
-     * (e.g. delegate payments) can legitimately carry multiple identities.
-     */
-    mismatchAcrossLayers: boolean;
-    /** Per-claim resolution result for audit / debugging. */
-    resolutions: Array<{
-        claim: IdentityClaim;
-        agentId: string | null;
-    }>;
-}
-type IdentityResolver = (claim: IdentityClaim) => Promise<string | null>;
-declare function bindIdentity(claims: IdentityClaim[], resolver: IdentityResolver): Promise<IdentityBindingResult>;
-/**
- * Helper constructors — keep protocol/field strings consistent across the
- * codebase and make tests readable.
- */
-declare const claim: {
-    viKid: (value: string) => IdentityClaim;
-    ap2AgentId: (value: string) => IdentityClaim;
-    acpBearer: (value: string) => IdentityClaim;
-    mppSource: (value: string) => IdentityClaim;
-    x402Wallet: (value: string) => IdentityClaim;
-    agentPayKid: (value: string) => IdentityClaim;
-    tapKid: (value: string) => IdentityClaim;
-    webBotAuthKid: (value: string) => IdentityClaim;
-};
-
-/**
- * AP2 (Agent Payments Protocol) mandate extraction.
- *
- * Google-led, launched 3 April 2026 with 60+ partners (Mastercard, PayPal,
- * Coinbase, AmEx, Revolut, UnionPay, ...). AP2 ships three mandate types as
- * SD-JWTs in series:
- *   - intent_mandate — user declares intent (amount, merchant category, etc.)
- *   - cart_mandate — user approves a cart (specific items, totals)
- *   - payment_mandate — authorizes the actual payment rail
- *
- * Mandates are cross-referenced via ids; each is an SD-JWT over ES256 (or
- * equivalent). We decode via @sd-jwt/core and extract the AP2-specific
- * shape — verification lives in ap2-verify.ts.
- */
-
-interface AP2PaymentDetailsTotal {
-    amount?: {
-        value?: string | number;
-        currency?: string;
-    };
-    label?: string;
-}
-interface AP2IntentMandateClaims {
-    type: 'intent_mandate';
-    agent_id?: string;
-    user_id?: string;
-    merchant_category?: string;
-    allowedMerchantDomains?: string[];
-    paymentMethods?: string[];
-    expires?: string;
-    payment_details_total?: AP2PaymentDetailsTotal;
-    raw: Record<string, unknown>;
-}
-interface AP2CartMandateClaims {
-    type: 'cart_mandate';
-    agent_id?: string;
-    intent_mandate_id?: string;
-    merchant_id?: string;
-    line_items?: Array<{
-        id?: string;
-        quantity?: number;
-        price?: {
-            value?: string | number;
-            currency?: string;
-        };
-    }>;
-    payment_details_total?: AP2PaymentDetailsTotal;
-    expires?: string;
-    raw: Record<string, unknown>;
-}
-interface AP2PaymentMandateClaims {
-    type: 'payment_mandate';
-    agent_id?: string;
-    cart_mandate_id?: string;
-    payment_method?: string;
-    payment_details_total?: AP2PaymentDetailsTotal;
-    credential_provider?: string;
-    raw: Record<string, unknown>;
-}
-type AP2MandateClaims = AP2IntentMandateClaims | AP2CartMandateClaims | AP2PaymentMandateClaims;
-interface AP2MandateTriple {
-    intent?: AP2IntentMandateClaims;
-    cart?: AP2CartMandateClaims;
-    payment?: AP2PaymentMandateClaims;
-    rawLayers: {
-        intentJwt?: string;
-        cartJwt?: string;
-        paymentJwt?: string;
-    };
-}
-/**
- * Extract a single AP2 mandate from a compact SD-JWT.
- * Returns null if the SD-JWT is malformed or lacks a recognized type field.
- */
-declare function extractAP2Mandate(sdJwtCompact: string): AP2MandateClaims | null;
-interface AP2MandateTripleInput {
-    intent?: string;
-    cart?: string;
-    payment?: string;
-}
-/**
- * Extract an intent / cart / payment triple, returning whichever are present.
- * Does NOT enforce cross-reference consistency — that's ap2-verify.ts's job.
- */
-declare function extractAP2Mandates(input: AP2MandateTripleInput): AP2MandateTriple;
-
-/**
- * AP2 mandate chain verification.
- *
- * Checks the cross-reference consistency of an intent → cart → payment
- * triple. Does NOT verify cryptographic signatures here (that's a call to
- * @sd-jwt/core which needs the agent's / CP's public key; expose via a
- * verifier callback so pipeline can plug in the right resolver).
- *
- * Rules (per AP2 spec v0.1-draft):
- *  - cart.intent_mandate_id must equal the intent mandate's canonical id (if present)
- *  - payment.cart_mandate_id must equal the cart mandate's canonical id (if present)
- *  - agent_id must match across all three layers
- *  - payment_method in payment mandate must be in intent.paymentMethods (if declared)
- *  - cart totals must not exceed intent totals (if both declared in same currency)
- *  - no mandate may be expired (beyond clock skew)
- */
-
-interface AP2VerifyInput {
-    triple: AP2MandateTriple;
-    /**
-     * Clock skew tolerance in seconds for expiry checks. Default 60s
-     * (tightened from the previous 300s default).
-     */
-    clockSkewSec?: number;
-    now?: () => number;
-    /**
-     * Optional replay-protection store. Defaults to in-process LRU. When the
-     * payment mandate carries an id, this verifier registers it as seen so
-     * the same payment mandate replayed within the expiry window is rejected.
-     */
-    nonceStore?: NonceStore;
-}
-interface AP2ChainResult {
-    ok: boolean;
-    checks: {
-        intentPresent: boolean;
-        cartRefOk: boolean;
-        paymentRefOk: boolean;
-        agentIdContinuity: boolean;
-        paymentMethodAllowed: boolean;
-        totalsConsistent: boolean;
-        expiryOk: boolean;
-    };
-    agentId?: string;
-    errors: string[];
-}
-declare function verifyAP2Chain(input: AP2VerifyInput): AP2ChainResult;
-
-/**
- * ACP detached-JSON-signature verifier.
- *
- * ACP (Agentic Commerce Protocol, OpenAI + Stripe) uses detached JSON
- * signatures over request bodies. The public signature algorithm is NOT
- * specified in open docs as of April 2026 (docs.stripe.com/agentic-commerce/*
- * is Private Preview). We implement Ed25519 and ES256 candidates against
- * whichever public key the caller supplies, and report algorithm-unsupported
- * as a trust signal rather than a hard fail so policy can weight it.
- *
- * Timestamp freshness (>300s default) IS a hard fail — prevents replay.
- *
- * Bearer-token → AstraSync agent binding is delegated to caller-supplied
- * resolver (typically the counterparty service).
- */
-
-type ACPSignatureAlgorithm = 'ed25519' | 'es256' | 'unsupported';
-interface ACPVerifyInput {
-    /** Raw request body over which the signature was computed. */
-    rawBody: string;
-    /** Value of the Signature header. Expected to be base64 (either standard or url). */
-    signatureHeader?: string;
-    /** Value of the Timestamp header (unix seconds as string, or ISO 8601). */
-    timestampHeader?: string;
-    /** Candidate public keys to try. First matching algorithm wins. */
-    candidateKeys: Array<{
-        jwk: JWK;
-        alg?: ACPSignatureAlgorithm | string;
-    }>;
-    /** Clock skew tolerance in seconds (default 60, tightened from 300). */
-    clockSkewSec?: number;
-    /** Injectable now for tests. */
-    now?: () => number;
-    /** Optional replay-protection store. Defaults to in-process LRU. */
-    nonceStore?: NonceStore;
-}
-interface ACPVerifyResult {
-    ok: boolean;
-    algorithm?: ACPSignatureAlgorithm;
-    error?: string;
-    /** True when timestamp is outside tolerance. */
-    timestampStale?: boolean;
-}
-declare function verifyACPSignature(input: ACPVerifyInput): Promise<ACPVerifyResult>;
-
-/**
- * MPP (Machine Payments Protocol) extractor.
- *
- * Wraps mppx (wevm) — pinned to 0.5.13, wrapped behind this adapter so
- * upgrades localise here. MPP launched March 18 2026 (Stripe + Tempo +
- * Paradigm), IETF draft-ryan-httpauth-payment-01.
- *
- * Flow:
- *   Client → GET /resource
- *   Server → 402 + WWW-Authenticate: Payment id=..., realm=..., method=tempo|stripe|...
- *   Client → GET /resource with Authorization: Payment <base64url-json credential>
- *   Server → 200 + Payment-Receipt: <base64url-json receipt>
- *
- * What we extract:
- *  - Challenge: id, realm, method, intent, request{amount,currency,...}, expires, digest
- *  - Credential: challenge + source (DID/chain-key) + payload (method-specific)
- *  - Receipt: challengeId, method, reference (tx hash / pi_... ID), settlement
- *  - Multi-method 402 offers (may be multiple WWW-Authenticate headers)
- *
- * What we do NOT verify here (pass-through):
- *  - HMAC challenge binding (requires merchant's MPP_SECRET_KEY)
- *  - Payment proof cryptography (Tempo tx sig, Stripe SPT, Lightning preimage)
- *    — each requires upstream connectivity
- *
- * Verification (expiry + BodyDigest + source extraction) in mpp-verify.ts.
- */
-interface MPPChallengeSummary {
-    id: string;
-    realm: string;
-    method: string;
-    intent: string;
-    /** Method-specific request data (amount, currency, recipient, etc.) */
-    request: Record<string, unknown>;
-    expires?: string;
-    digest?: string;
-    description?: string;
-    opaque?: Record<string, string>;
-}
-interface MPPCredentialSummary {
-    challenge: MPPChallengeSummary;
-    /** DID or chain-native key identifying the payer. */
-    source?: string;
-    /** Method-specific payment proof (Tempo tx, SPT, Lightning preimage, etc.). */
-    payload: unknown;
-}
-interface MPPReceiptSummary {
-    method?: string;
-    reference?: string;
-    externalId?: string;
-    status?: string;
-    timestamp?: string;
-    raw: Record<string, unknown>;
-}
-type MPPKind = 'challenge' | 'credential' | 'receipt' | 'error' | 'unknown';
-interface MPPRequestContext {
-    kind: MPPKind;
-    /** For 402 responses: one or more challenge offers. */
-    challenges?: MPPChallengeSummary[];
-    /** For requests with Authorization: Payment header. */
-    credential?: MPPCredentialSummary;
-    /** For 200 responses with Payment-Receipt header. */
-    receipt?: MPPReceiptSummary;
-    /** For problem+json error responses. */
-    error?: {
-        type?: string;
-        title?: string;
-        detail?: string;
-    };
-    /** Detected payment methods offered (for multi-method 402). */
-    offeredMethods?: string[];
-    /** Raw body captured for BodyDigest verification in mpp-verify.ts. */
-    rawBody?: string;
-}
-interface MPPRequestLike {
-    method: string;
-    url: string;
-    headers: Record<string, string | string[] | undefined>;
-    body?: unknown;
-    rawBody?: string;
-}
-interface MPPResponseLike {
-    status: number;
-    headers: Record<string, string | string[] | undefined>;
-    body?: unknown;
-    rawBody?: string;
-}
-/**
- * Extract MPP context from an agent → merchant request.
- * Looks for `Authorization: Payment <credential>` header.
- */
-declare function extractMPPFromRequest(request: MPPRequestLike): MPPRequestContext | null;
-/**
- * Extract MPP context from a merchant → agent response.
- * Handles 402 (challenge offers), 200 (receipt), 4xx (problem+json errors).
- */
-declare function extractMPPFromResponse(response: MPPResponseLike): MPPRequestContext | null;
-/**
- * Extract from either a request OR a response, auto-detecting which has MPP
- * artifacts. Convenience for pipeline callers.
- */
-declare function extractMPPContext(message: {
-    request: MPPRequestLike;
-} | {
-    response: MPPResponseLike;
-} | (MPPRequestLike & Partial<MPPResponseLike>)): MPPRequestContext | null;
-
-/**
- * MPP verification — expiry + optional BodyDigest + source extraction.
- *
- * We do NOT verify the challenge's HMAC binding (needs merchant's secret)
- * or the cryptographic payment proof (per-method, requires upstream
- * connectivity). Those are the merchant's / settlement layer's job.
- *
- * Our job: structural correctness, expiry policy, tamper detection via
- * optional BodyDigest, and identity extraction for PDLSS binding.
- */
-
-interface MPPVerifyInput {
-    context: MPPRequestContext;
-    /** Raw request body to validate BodyDigest against, if the challenge declares one. */
-    rawBody?: string;
-    /** Seconds of clock-skew tolerance on challenge.expires. Default 60. */
-    clockSkewSec?: number;
-    /** Injectable for deterministic tests. */
-    now?: () => number;
-    /** Optional replay-protection store. Defaults to in-process LRU. */
-    nonceStore?: NonceStore;
-}
-interface MPPVerifyResult {
-    ok: boolean;
-    expiryOk: boolean;
-    bodyDigestOk: boolean | null;
-    source?: string;
-    method?: string;
-    error?: string;
-}
-declare function verifyMPP(input: MPPVerifyInput): MPPVerifyResult;
-
-/**
- * x402 (Coinbase / Linux Foundation x402 Foundation) extractor.
- *
- * Wraps @x402/core's schema parsers. x402 Foundation launched April 2 2026
- * with v2 adding network-agnostic identifiers + multiple facilitators +
- * Bazaar discovery. MPP (Machine Payments Protocol) is the IETF-formalised
- * superset of x402; this module normalizes x402 output to MPP-shape so
- * downstream pipeline code is uniform.
- *
- * Where x402 lives on the wire:
- *  - 402 response body (v2) OR `X-PAYMENT-REQUIRED` header (v1) — PaymentRequired
- *  - Request body (v2) OR `X-PAYMENT` header (v1, base64) — PaymentPayload
- */
-type X402Kind = 'required' | 'payload' | 'error' | 'unknown';
-interface X402RequirementsSummary {
-    scheme: string;
-    network: string;
-    asset: string;
-    /** Normalized to string for v1/v2 compat — v1 uses maxAmountRequired, v2 uses amount. */
-    amount: string;
-    payTo: string;
-    maxTimeoutSeconds?: number;
-    resource?: string;
-    description?: string;
-}
-interface X402RequestContext {
-    kind: X402Kind;
-    version: 1 | 2 | null;
-    /** For 402 responses: the PaymentRequired body. */
-    paymentRequired?: {
-        resource: string;
-        accepts: X402RequirementsSummary[];
-        extensions?: Record<string, unknown>;
-        error?: string;
-    };
-    /** For request body (v2) or X-PAYMENT header (v1 base64): the PaymentPayload. */
-    paymentPayload?: {
-        scheme: string;
-        network: string;
-        /** Free-form per-scheme payload (e.g. EIP-3009 authorization, Solana tx). */
-        payload: Record<string, unknown>;
-        extensions?: Record<string, unknown>;
-    };
-    error?: {
-        type: string;
-        detail?: string;
-    };
-    /** Whether this was parsed from a header (v1 back-compat) or body (v2). */
-    source: 'header' | 'body' | null;
-}
-interface X402RequestLike {
-    method?: string;
-    url?: string;
-    headers?: Record<string, string | string[] | undefined>;
-    body?: unknown;
-}
-interface X402ResponseLike {
-    status?: number;
-    headers?: Record<string, string | string[] | undefined>;
-    body?: unknown;
-}
-/**
- * Extract x402 PaymentPayload from an agent → merchant request.
- * Checks v2 body (if it parses as PaymentPayload) and v1 X-PAYMENT header.
- */
-declare function extractX402FromRequest(request: X402RequestLike): X402RequestContext | null;
-/**
- * Extract x402 PaymentRequired from a merchant → agent 402 response.
- */
-declare function extractX402FromResponse(response: X402ResponseLike): X402RequestContext | null;
-declare function extractX402Context(message: {
-    request: X402RequestLike;
-} | {
-    response: X402ResponseLike;
-} | (X402RequestLike & Partial<X402ResponseLike>)): X402RequestContext | null;
-
-/**
- * VI (Verifiable Intent) 3-layer SD-JWT chain verification.
- *
- * VI chains: L1 (credential provider → wallet) → L2 (user → agent) → L3
- * (agent → merchant). L3 itself can split into L3a (payment mandate) + L3b
- * (checkout mandate) cross-referenced via transaction_id, with L3b carrying
- * a checkout_hash (VI constraint type 8) that must match SHA-256 of the L2
- * checkout disclosure.
- *
- * Signature primitives are delegated to @sd-jwt/core (via our extractor);
- * cnf.jwk chain-walking + cross-references + checkout_hash binding is
- * AstraSync-specific composition logic — that's the whitespace here.
- *
- * This module does NOT re-verify selective-disclosure hashes (the extractor
- * already applied them via @sd-jwt/core). It DOES verify:
- *  - cnf.jwk in L1 payload points to L2's signing key (thumbprint match)
- *  - cnf.jwk in L2 payload points to L3's signing key
- *  - L3a.transaction_id === L3b.transaction_id (when both present)
- *  - L3b.checkout_hash === SHA-256(L2 canonical checkout disclosure) — type 8
- *  - mandate-level `exp` is not in the past (beyond clock skew)
- *
- * Cryptographic signature verification on each layer uses the verifier
- * callback the caller supplies (e.g. resolves via @sd-jwt/core with the
- * right JWK from the L1 issuer's JWKS).
- */
-
-interface VILayer {
-    /** Compact SD-JWT / JWS for this layer. */
-    compact: string;
-    /** Decoded JWT payload (already disclosure-merged). */
-    payload: Record<string, unknown>;
-    /** Decoded JWT header. */
-    header: Record<string, unknown>;
-}
-interface VIVerifyInput {
-    /**
-     * Layers in chain order. L1 is REQUIRED by default —
-     * without L1 there is no chain root and L2 can be verified against any
-     * attacker-supplied key. Callers who have resolved L2's signing key by
-     * a trusted out-of-band mechanism (wallet binding, prior protocol step)
-     * MUST set `allowUnboundChain: true` AND supply `expectedL2Key`.
-     */
-    layers: {
-        l1?: VILayer;
-        l2: VILayer;
-        l3a?: VILayer;
-        l3b?: VILayer;
-    };
-    /**
-     * Verifier callback invoked per layer. Should return true iff the layer's
-     * JWS signature verifies against the resolved public key (for L2 this is
-     * L1's cnf.jwk; for L3 this is L2's cnf.jwk; for L1 this is the issuer's
-     * JWKS per `iss` claim).
-     */
-    verifySignature: (layer: VILayer, expectedKey: JWK | null) => Promise<boolean>;
-    /**
-     * Clock skew tolerance in seconds for expiry checks. Default 60s
-     * (tightened from the previous 300s default).
-     */
-    clockSkewSec?: number;
-    now?: () => number;
-    /**
-     * Explicit opt-in to verify a chain with L1 omitted.
-     * Defaults to false. When true, `expectedL2Key` MUST also be supplied
-     * (used as the expected signing key for L2 verification).
-     */
-    allowUnboundChain?: boolean;
-    /** Required when allowUnboundChain === true. */
-    expectedL2Key?: JWK;
-    /** Optional replay-protection store. Defaults to in-process LRU. */
-    nonceStore?: NonceStore;
-}
-interface VIVerifyResult {
-    ok: boolean;
-    checks: {
-        l1SigOk: boolean | null;
-        l2SigOk: boolean;
-        l3aSigOk: boolean | null;
-        l3bSigOk: boolean | null;
-        l1BindsL2: boolean;
-        l2BindsL3: boolean;
-        l3aL3bTxnIdMatch: boolean | null;
-        checkoutHashOk: boolean | null;
-        expiryOk: boolean;
-    };
-    errors: string[];
-}
-declare function verifyVIChain(input: VIVerifyInput): Promise<VIVerifyResult>;
-
-/**
- * Commerce pipeline orchestrator.
- *
- * Ties together extractors + verifiers + identity binding + constraint
- * evaluation + trust signals into a single CommerceContext result.
- *
- * This is AstraSync whitespace: the orchestration over the library-backed
- * primitives. The backend verify-access service is the sole per-request
- * caller — the edge adapters forward raw artifacts to verify-access and
- * never call this module directly. The admin transport playground also
- * calls it ad-hoc.
- *
- * Policy:
- *  - Hard-deny (ok=false) on bad signatures, expired mandates, constraint
- *    failures, identity cannot be bound.
- *  - Trust signal (ok remains policy-driven) on ACP algorithm unsupported,
- *    Stripe webhook HMAC fail, payment-token type unknown, cross-layer
- *    identity mismatch.
- */
-
-type CommerceProtocol = 'vi' | 'ap2' | 'ucp' | 'acp' | 'agentpay' | 'tap' | 'mpp' | 'x402';
-interface CommercePipelineInput {
-    protocol: CommerceProtocol;
-    vi?: {
-        claims: VIExtractedClaims;
-        verifyInput?: VIVerifyInput;
-    };
-    ap2?: {
-        triple: AP2MandateTriple;
-    };
-    ucp?: UCPCheckoutContext;
-    acp?: {
-        context: ACPRequestContext;
-        verifyInput?: Parameters<typeof verifyACPSignature>[0];
-    };
-    rfc9421?: {
-        request: RFC9421VerifyRequest;
-        tag?: 'browse' | 'purchase' | string;
-        verifyOptions: Parameters<typeof verifyRFC9421>[1];
-    };
-    mpp?: {
-        context: MPPRequestContext;
-        rawBody?: string;
-    };
-    x402?: X402RequestContext;
-    stripeWebhook?: {
-        payload: string;
-        signatureHeader: string;
-        secret: string;
-    };
-    transaction?: TransactionContext;
-    registeredConstraints?: {
-        allowedPaymentMethods?: string[];
-        spendingLimit?: {
-            amount?: number;
-            currency?: string;
-        };
-    };
-    identityResolver?: IdentityResolver;
-    clockSkewSec?: number;
-    now?: () => number;
-}
-interface CommerceSignatureStack {
-    vi?: VIVerifyResult;
-    ap2?: AP2ChainResult;
-    acp?: ACPVerifyResult;
-    rfc9421?: RFC9421VerifyResult;
-    mpp?: MPPVerifyResult;
-    stripeWebhook?: VerifyStripeWebhookResult;
-}
-interface CommerceContext {
-    protocol: CommerceProtocol;
-    purpose: CommercePurpose | null;
-    transactionValue?: TransactionValueContext;
-    signatures: CommerceSignatureStack;
-    identity?: {
-        claims: IdentityClaim[];
-        mappedAstraSyncAgentId?: string;
-        mismatchAcrossLayers: boolean;
-    };
-    paymentToken?: {
-        present: boolean;
-        type: 'stripe-spt' | 'acp-vt' | 'tempo-tx' | 'other' | null;
-    };
-    mppMethodsOffered?: string[];
-    constraints?: ConstraintEvalResult;
-    receipt?: {
-        method?: string;
-        reference?: string;
-        status?: string;
-        timestamp?: string;
-    };
-    trustSignals: string[];
-    timings: {
-        extractMs: number;
-        verifyMs: number;
-        evalMs: number;
-    };
-    /** False when any hard-deny rule fires. */
-    ok: boolean;
-}
-declare function runCommercePipeline(input: CommercePipelineInput): Promise<CommerceContext>;
-
-/**
- * Pluggable extractor registry for the Trusted Agent Gateway edge
- * adapters and other callers that need a curated extractor set.
- *
- * Built-in extractors (VI, UCP, ACP, RFC 9421, MPP, x402, Stripe webhook)
- * are NOT auto-registered. A caller imports this module, picks the set
- * it wants, and calls registerTransportExtractor() for each.
- *
- * Re-registering by name replaces the prior extractor (idempotent).
- */
-interface ExtractorRequestLike {
-    method?: string;
-    url?: string;
-    headers?: Record<string, string | string[] | undefined>;
-    body?: unknown;
-}
-interface TransportExtractor<T = unknown> {
-    readonly name: string;
-    match(request: ExtractorRequestLike): boolean;
-    extract(request: ExtractorRequestLike): T | Promise<T> | null;
-}
-declare function registerTransportExtractor<T>(extractor: TransportExtractor<T>): void;
-declare function getTransportExtractors(): ReadonlyArray<TransportExtractor>;
-declare function getTransportExtractor(name: string): TransportExtractor | undefined;
-declare function clearTransportExtractors(): void;
-/**
- * Helper: run all matching extractors against a request and return their
- * extracted contexts keyed by extractor name. Skips extractors whose
- * `match()` returns false.
- */
-declare function runMatchingExtractors(request: ExtractorRequestLike): Promise<Record<string, unknown>>;
-
-/**
- * Visa JWKS registry resolver.
- *
- * Default endpoint: https://mcp.visa.com/.well-known/jwks (per Visa TAP spec).
- * Wraps jose.createRemoteJWKSet which handles caching + rotation natively.
- */
-
-interface VisaRegistryOptions {
-    jwksUrl?: string;
-    cacheMaxAge?: number;
-    cooldownDuration?: number;
-}
-declare function createVisaRegistry(options?: VisaRegistryOptions): RegistryResolver;
-
-/**
- * Mastercard Agent Registry resolver — STUB.
- *
- * Mastercard Agent Pay is behind partnership (pilots Feb 2026, GA Q2 2026).
- * No public Agent Registry URL or open-source resolver exists as of April
- * 2026. This resolver accepts an optional `registryUrl` and, when absent,
- * returns null with a single one-time console.warn so callers can plumb
- * the flow end-to-end without a live registry.
- *
- * When Mastercard ships a public resolver or when a commercial relationship
- * provides a registry URL, pass it via `MastercardRegistryOptions.registryUrl`.
- * Response shape expected: { keys: JWK[] } (JWKS-style).
- */
-
-interface MastercardRegistryOptions {
-    /** Partnership-provided registry URL. Without it, the resolver is inert. */
-    registryUrl?: string;
-    /** Cache TTL in seconds. Default 3600. */
-    cacheTtlSec?: number;
-    /** Fetch fn override for testing. */
-    fetch?: typeof fetch;
-    /** Silence the one-time warn (testing only). */
-    silent?: boolean;
-}
-declare function createMastercardRegistry(options?: MastercardRegistryOptions): RegistryResolver;
-
-/**
- * Web Bot Auth registry resolver.
- *
- * IETF draft-meunier-web-bot-auth-architecture-05 + draft-meunier-http-
- * message-signatures-directory-01. Shared transport substrate under TAP,
- * Agent Pay, and Cloudflare Pay Per Crawl.
- *
- * Fetches a Web Bot Auth signature directory
- * (default: `<origin>/.well-known/http-message-signatures-directory`).
- * Shape per spec is a JWKS with Ed25519 keys.
- *
- * Wraps Cloudflare's `web-bot-auth` npm package where feasible; for raw
- * directory fetch + kid matching we use fetch + JSON since web-bot-auth's
- * higher-level API assumes a full request to verify.
- */
-
-interface WebBotAuthRegistryOptions {
-    /**
-     * Optional explicit directory URL. When omitted, the resolver derives one
-     * from `ResolveContext.origin` (e.g. the request URL's origin at verify time).
-     */
-    directoryUrl?: string;
-    cacheTtlSec?: number;
-    fetch?: typeof fetch;
-}
-declare function createWebBotAuthRegistry(options?: WebBotAuthRegistryOptions): RegistryResolver;
-
-/**
- * Cross-Protocol Transport Module
- *
- * Provides adapters for injecting/extracting AstraSync credentials
- * across HTTP, A2A, and MCP protocols.
- */
-
-/**
- * Auto-detect protocol from request/context shape.
- */
-declare function detectProtocol(context: Record<string, unknown>): ProtocolTransport;
-/**
- * Apply credentials to any protocol target.
- */
-declare function applyCredentials(protocol: ProtocolTransport, target: Record<string, unknown>, credentials: AstraSyncCredentials): Record<string, unknown>;
-/**
- * Extract credentials from any protocol context.
- */
-declare function extractCredentialsFromProtocol(protocol: ProtocolTransport, context: Record<string, unknown>): AstraSyncCredentials | null;
-
-type index_ACPEndpoint = ACPEndpoint;
-type index_ACPPaymentTokenType = ACPPaymentTokenType;
-type index_ACPRequestContext = ACPRequestContext;
-type index_ACPRequestLike = ACPRequestLike;
-type index_ACPSignatureAlgorithm = ACPSignatureAlgorithm;
-type index_ACPTotal = ACPTotal;
-type index_ACPVerifyInput = ACPVerifyInput;
-type index_ACPVerifyResult = ACPVerifyResult;
-type index_AP2CartMandateClaims = AP2CartMandateClaims;
-type index_AP2ChainResult = AP2ChainResult;
-type index_AP2IntentMandateClaims = AP2IntentMandateClaims;
-type index_AP2MandateClaims = AP2MandateClaims;
-type index_AP2MandateTriple = AP2MandateTriple;
-type index_AP2MandateTripleInput = AP2MandateTripleInput;
-type index_AP2MandateType = AP2MandateType;
-type index_AP2PaymentDetailsTotal = AP2PaymentDetailsTotal;
-type index_AP2PaymentMandateClaims = AP2PaymentMandateClaims;
-type index_AP2PaymentMandateForValue = AP2PaymentMandateForValue;
-type index_AP2VerifyInput = AP2VerifyInput;
-type index_CommerceContext = CommerceContext;
-type index_CommercePipelineInput = CommercePipelineInput;
-type index_CommerceProtocol = CommerceProtocol;
-type index_CommercePurpose = CommercePurpose;
-type index_CommerceSignatureStack = CommerceSignatureStack;
-type index_ConstraintEvalResult = ConstraintEvalResult;
-type index_ConstraintKey = ConstraintKey;
-type index_ConstraintResult = ConstraintResult;
-type index_ExtractorRequestLike = ExtractorRequestLike;
-type index_IdentityBindingResult = IdentityBindingResult;
-type index_IdentityClaim = IdentityClaim;
-type index_IdentityResolver = IdentityResolver;
-type index_MPPChallengeForValue = MPPChallengeForValue;
-type index_MPPChallengeSummary = MPPChallengeSummary;
-type index_MPPCredentialSummary = MPPCredentialSummary;
-type index_MPPIntent = MPPIntent;
-type index_MPPKind = MPPKind;
-type index_MPPReceiptSummary = MPPReceiptSummary;
-type index_MPPRequestContext = MPPRequestContext;
-type index_MPPRequestLike = MPPRequestLike;
-type index_MPPResponseLike = MPPResponseLike;
-type index_MPPVerifyInput = MPPVerifyInput;
-type index_MPPVerifyResult = MPPVerifyResult;
-type index_ParsedRFC9421 = ParsedRFC9421;
-type index_PaymentMethodAllowlistInput = PaymentMethodAllowlistInput;
-type index_RFC9421SignatureParams = RFC9421SignatureParams;
-type index_RFC9421Tag = RFC9421Tag;
-type index_RFC9421VerifyOptions = RFC9421VerifyOptions;
-type index_RFC9421VerifyRequest = RFC9421VerifyRequest;
-type index_RFC9421VerifyResult = RFC9421VerifyResult;
-type index_RegistryName = RegistryName;
-type index_RegistryResolver = RegistryResolver;
-type index_ResolveContext = ResolveContext;
-declare const index_STRIPE_WEBHOOK_INFORMATIONAL_EVENTS: typeof STRIPE_WEBHOOK_INFORMATIONAL_EVENTS;
-type index_SpendingLimitInput = SpendingLimitInput;
-type index_StripeWebhookInformationalEvent = StripeWebhookInformationalEvent;
-type index_TransactionContext = TransactionContext;
-type index_TransactionValueContext = TransactionValueContext;
-type index_TransportExtractor<T = unknown> = TransportExtractor<T>;
-type index_UCPCheckoutContext = UCPCheckoutContext;
-type index_UCPManifestValidationResult = UCPManifestValidationResult;
-type index_UCPRequestLike = UCPRequestLike;
-type index_UCPTotal = UCPTotal;
-type index_VIAllowedParty = VIAllowedParty;
-type index_VIBudgetLimit = VIBudgetLimit;
-type index_VIClaimsForValue = VIClaimsForValue;
-type index_VIConstraintEvalInput = VIConstraintEvalInput;
-type index_VIConstraints = VIConstraints;
-type index_VIExecutionMode = VIExecutionMode;
-type index_VIExtractedClaims = VIExtractedClaims;
-type index_VILayer = VILayer;
-type index_VILineItem = VILineItem;
-type index_VIMandateType = VIMandateType;
-type index_VIPaymentAmount = VIPaymentAmount;
-type index_VIRecurrence = VIRecurrence;
-type index_VIVerifyInput = VIVerifyInput;
-type index_VIVerifyResult = VIVerifyResult;
-type index_VerifyStripeWebhookOptions = VerifyStripeWebhookOptions;
-type index_VerifyStripeWebhookResult = VerifyStripeWebhookResult;
-type index_X402Kind = X402Kind;
-type index_X402RequestContext = X402RequestContext;
-type index_X402RequestForValue = X402RequestForValue;
-type index_X402RequestLike = X402RequestLike;
-type index_X402RequirementsSummary = X402RequirementsSummary;
-type index_X402ResponseLike = X402ResponseLike;
-declare const index_applyCredentials: typeof applyCredentials;
-declare const index_bindIdentity: typeof bindIdentity;
-declare const index_claim: typeof claim;
-declare const index_clearTransportExtractors: typeof clearTransportExtractors;
-declare const index_createMastercardRegistry: typeof createMastercardRegistry;
-declare const index_createVisaRegistry: typeof createVisaRegistry;
-declare const index_createWebBotAuthRegistry: typeof createWebBotAuthRegistry;
-declare const index_detectProtocol: typeof detectProtocol;
-declare const index_evaluatePaymentMethodAllowlist: typeof evaluatePaymentMethodAllowlist;
-declare const index_evaluateSpendingLimit: typeof evaluateSpendingLimit;
-declare const index_evaluateVIConstraints: typeof evaluateVIConstraints;
-declare const index_extractA2ACredentials: typeof extractA2ACredentials;
-declare const index_extractACPContext: typeof extractACPContext;
-declare const index_extractACPTransactionValue: typeof extractACPTransactionValue;
-declare const index_extractAP2Mandate: typeof extractAP2Mandate;
-declare const index_extractAP2Mandates: typeof extractAP2Mandates;
-declare const index_extractAP2TransactionValue: typeof extractAP2TransactionValue;
-declare const index_extractCredentialsFromProtocol: typeof extractCredentialsFromProtocol;
-declare const index_extractHttpCredentials: typeof extractHttpCredentials;
-declare const index_extractMPPContext: typeof extractMPPContext;
-declare const index_extractMPPFromRequest: typeof extractMPPFromRequest;
-declare const index_extractMPPFromResponse: typeof extractMPPFromResponse;
-declare const index_extractMPPTransactionValue: typeof extractMPPTransactionValue;
-declare const index_extractMcpCredentials: typeof extractMcpCredentials;
-declare const index_extractUCPContext: typeof extractUCPContext;
-declare const index_extractUCPTransactionValue: typeof extractUCPTransactionValue;
-declare const index_extractVIClaims: typeof extractVIClaims;
-declare const index_extractVITransactionValue: typeof extractVITransactionValue;
-declare const index_extractX402Context: typeof extractX402Context;
-declare const index_extractX402FromRequest: typeof extractX402FromRequest;
-declare const index_extractX402FromResponse: typeof extractX402FromResponse;
-declare const index_extractX402TransactionValue: typeof extractX402TransactionValue;
-declare const index_fetchUCPManifest: typeof fetchUCPManifest;
-declare const index_getTransportExtractor: typeof getTransportExtractor;
-declare const index_getTransportExtractors: typeof getTransportExtractors;
-declare const index_isStripeWebhookInformational: typeof isStripeWebhookInformational;
-declare const index_mapACPRequestToPurpose: typeof mapACPRequestToPurpose;
-declare const index_mapAP2MandateToPurpose: typeof mapAP2MandateToPurpose;
-declare const index_mapMPPRequestToPurpose: typeof mapMPPRequestToPurpose;
-declare const index_mapRFC9421TagToPurpose: typeof mapRFC9421TagToPurpose;
-declare const index_mapUCPRequestToPurpose: typeof mapUCPRequestToPurpose;
-declare const index_mapVIMandateToPurpose: typeof mapVIMandateToPurpose;
-declare const index_mapX402RequestToPurpose: typeof mapX402RequestToPurpose;
-declare const index_parseRFC9421: typeof parseRFC9421;
-declare const index_registerTransportExtractor: typeof registerTransportExtractor;
-declare const index_runCommercePipeline: typeof runCommercePipeline;
-declare const index_runMatchingExtractors: typeof runMatchingExtractors;
-declare const index_setA2AMetadata: typeof setA2AMetadata;
-declare const index_setHttpHeaders: typeof setHttpHeaders;
-declare const index_setMcpMeta: typeof setMcpMeta;
-declare const index_validateUCPManifest: typeof validateUCPManifest;
-declare const index_verifyACPSignature: typeof verifyACPSignature;
-declare const index_verifyAP2Chain: typeof verifyAP2Chain;
-declare const index_verifyMPP: typeof verifyMPP;
-declare const index_verifyRFC9421: typeof verifyRFC9421;
-declare const index_verifyStripeWebhook: typeof verifyStripeWebhook;
-declare const index_verifyVIChain: typeof verifyVIChain;
-declare namespace index {
-  export { type index_ACPEndpoint as ACPEndpoint, type index_ACPPaymentTokenType as ACPPaymentTokenType, type index_ACPRequestContext as ACPRequestContext, type index_ACPRequestLike as ACPRequestLike, type index_ACPSignatureAlgorithm as ACPSignatureAlgorithm, type index_ACPTotal as ACPTotal, type index_ACPVerifyInput as ACPVerifyInput, type index_ACPVerifyResult as ACPVerifyResult, type index_AP2CartMandateClaims as AP2CartMandateClaims, type index_AP2ChainResult as AP2ChainResult, type index_AP2IntentMandateClaims as AP2IntentMandateClaims, type index_AP2MandateClaims as AP2MandateClaims, type index_AP2MandateTriple as AP2MandateTriple, type index_AP2MandateTripleInput as AP2MandateTripleInput, type index_AP2MandateType as AP2MandateType, type index_AP2PaymentDetailsTotal as AP2PaymentDetailsTotal, type index_AP2PaymentMandateClaims as AP2PaymentMandateClaims, type index_AP2PaymentMandateForValue as AP2PaymentMandateForValue, type index_AP2VerifyInput as AP2VerifyInput, type index_CommerceContext as CommerceContext, type index_CommercePipelineInput as CommercePipelineInput, type index_CommerceProtocol as CommerceProtocol, type index_CommercePurpose as CommercePurpose, type index_CommerceSignatureStack as CommerceSignatureStack, type index_ConstraintEvalResult as ConstraintEvalResult, type index_ConstraintKey as ConstraintKey, type index_ConstraintResult as ConstraintResult, type index_ExtractorRequestLike as ExtractorRequestLike, type index_IdentityBindingResult as IdentityBindingResult, type index_IdentityClaim as IdentityClaim, type index_IdentityResolver as IdentityResolver, type index_MPPChallengeForValue as MPPChallengeForValue, type index_MPPChallengeSummary as MPPChallengeSummary, type index_MPPCredentialSummary as MPPCredentialSummary, type index_MPPIntent as MPPIntent, type index_MPPKind as MPPKind, type index_MPPReceiptSummary as MPPReceiptSummary, type index_MPPRequestContext as MPPRequestContext, type index_MPPRequestLike as MPPRequestLike, type index_MPPResponseLike as MPPResponseLike, type index_MPPVerifyInput as MPPVerifyInput, type index_MPPVerifyResult as MPPVerifyResult, type index_ParsedRFC9421 as ParsedRFC9421, type index_PaymentMethodAllowlistInput as PaymentMethodAllowlistInput, type index_RFC9421SignatureParams as RFC9421SignatureParams, type index_RFC9421Tag as RFC9421Tag, type index_RFC9421VerifyOptions as RFC9421VerifyOptions, type index_RFC9421VerifyRequest as RFC9421VerifyRequest, type index_RFC9421VerifyResult as RFC9421VerifyResult, type index_RegistryName as RegistryName, type index_RegistryResolver as RegistryResolver, type index_ResolveContext as ResolveContext, index_STRIPE_WEBHOOK_INFORMATIONAL_EVENTS as STRIPE_WEBHOOK_INFORMATIONAL_EVENTS, type index_SpendingLimitInput as SpendingLimitInput, type index_StripeWebhookInformationalEvent as StripeWebhookInformationalEvent, type index_TransactionContext as TransactionContext, type index_TransactionValueContext as TransactionValueContext, type index_TransportExtractor as TransportExtractor, type index_UCPCheckoutContext as UCPCheckoutContext, type index_UCPManifestValidationResult as UCPManifestValidationResult, type index_UCPRequestLike as UCPRequestLike, type index_UCPTotal as UCPTotal, type index_VIAllowedParty as VIAllowedParty, type index_VIBudgetLimit as VIBudgetLimit, type index_VIClaimsForValue as VIClaimsForValue, type index_VIConstraintEvalInput as VIConstraintEvalInput, type index_VIConstraints as VIConstraints, type index_VIExecutionMode as VIExecutionMode, type index_VIExtractedClaims as VIExtractedClaims, type index_VILayer as VILayer, type index_VILineItem as VILineItem, type index_VIMandateType as VIMandateType, type index_VIPaymentAmount as VIPaymentAmount, type index_VIRecurrence as VIRecurrence, type index_VIVerifyInput as VIVerifyInput, type index_VIVerifyResult as VIVerifyResult, type index_VerifyStripeWebhookOptions as VerifyStripeWebhookOptions, type index_VerifyStripeWebhookResult as VerifyStripeWebhookResult, type index_X402Kind as X402Kind, type index_X402RequestContext as X402RequestContext, type index_X402RequestForValue as X402RequestForValue, type index_X402RequestLike as X402RequestLike, type index_X402RequirementsSummary as X402RequirementsSummary, type index_X402ResponseLike as X402ResponseLike, index_applyCredentials as applyCredentials, index_bindIdentity as bindIdentity, index_claim as claim, index_clearTransportExtractors as clearTransportExtractors, index_createMastercardRegistry as createMastercardRegistry, index_createVisaRegistry as createVisaRegistry, index_createWebBotAuthRegistry as createWebBotAuthRegistry, index_detectProtocol as detectProtocol, index_evaluatePaymentMethodAllowlist as evaluatePaymentMethodAllowlist, index_evaluateSpendingLimit as evaluateSpendingLimit, index_evaluateVIConstraints as evaluateVIConstraints, index_extractA2ACredentials as extractA2ACredentials, index_extractACPContext as extractACPContext, index_extractACPTransactionValue as extractACPTransactionValue, index_extractAP2Mandate as extractAP2Mandate, index_extractAP2Mandates as extractAP2Mandates, index_extractAP2TransactionValue as extractAP2TransactionValue, index_extractCredentialsFromProtocol as extractCredentialsFromProtocol, index_extractHttpCredentials as extractHttpCredentials, index_extractMPPContext as extractMPPContext, index_extractMPPFromRequest as extractMPPFromRequest, index_extractMPPFromResponse as extractMPPFromResponse, index_extractMPPTransactionValue as extractMPPTransactionValue, index_extractMcpCredentials as extractMcpCredentials, index_extractUCPContext as extractUCPContext, index_extractUCPTransactionValue as extractUCPTransactionValue, index_extractVIClaims as extractVIClaims, index_extractVITransactionValue as extractVITransactionValue, index_extractX402Context as extractX402Context, index_extractX402FromRequest as extractX402FromRequest, index_extractX402FromResponse as extractX402FromResponse, index_extractX402TransactionValue as extractX402TransactionValue, index_fetchUCPManifest as fetchUCPManifest, index_getTransportExtractor as getTransportExtractor, index_getTransportExtractors as getTransportExtractors, index_isStripeWebhookInformational as isStripeWebhookInformational, index_mapACPRequestToPurpose as mapACPRequestToPurpose, index_mapAP2MandateToPurpose as mapAP2MandateToPurpose, index_mapMPPRequestToPurpose as mapMPPRequestToPurpose, index_mapRFC9421TagToPurpose as mapRFC9421TagToPurpose, index_mapUCPRequestToPurpose as mapUCPRequestToPurpose, index_mapVIMandateToPurpose as mapVIMandateToPurpose, index_mapX402RequestToPurpose as mapX402RequestToPurpose, index_parseRFC9421 as parseRFC9421, index_registerTransportExtractor as registerTransportExtractor, index_runCommercePipeline as runCommercePipeline, index_runMatchingExtractors as runMatchingExtractors, index_setA2AMetadata as setA2AMetadata, index_setHttpHeaders as setHttpHeaders, index_setMcpMeta as setMcpMeta, index_validateUCPManifest as validateUCPManifest, index_verifyACPSignature as verifyACPSignature, index_verifyAP2Chain as verifyAP2Chain, index_verifyMPP as verifyMPP, index_verifyRFC9421 as verifyRFC9421, index_verifyStripeWebhook as verifyStripeWebhook, index_verifyVIChain as verifyVIChain };
-}
-
-export { type SpendingLimitInput as $, type ACPEndpoint as A, type IdentityResolver as B, type CommerceContext as C, type MPPChallengeSummary as D, type ExtractorRequestLike as E, type MPPCredentialSummary as F, type MPPIntent as G, type MPPKind as H, type IdentityBindingResult as I, type MPPReceiptSummary as J, type MPPRequestContext as K, type MPPRequestLike as L, type MPPChallengeForValue as M, type MPPResponseLike as N, type MPPVerifyInput as O, type MPPVerifyResult as P, type ParsedRFC9421 as Q, type PaymentMethodAllowlistInput as R, type RFC9421SignatureParams as S, type RFC9421Tag as T, type RFC9421VerifyOptions as U, type RFC9421VerifyRequest as V, type RFC9421VerifyResult as W, type RegistryName as X, type RegistryResolver as Y, type ResolveContext as Z, STRIPE_WEBHOOK_INFORMATIONAL_EVENTS as _, type ACPPaymentTokenType as a, getTransportExtractor as a$, type StripeWebhookInformationalEvent as a0, type TransactionContext as a1, type TransactionValueContext as a2, type TransportExtractor as a3, type UCPCheckoutContext as a4, type UCPManifestValidationResult as a5, type UCPRequestLike as a6, type UCPTotal as a7, type VIAllowedParty as a8, type VIBudgetLimit as a9, createWebBotAuthRegistry as aA, detectProtocol as aB, evaluatePaymentMethodAllowlist as aC, evaluateSpendingLimit as aD, evaluateVIConstraints as aE, extractA2ACredentials as aF, extractACPContext as aG, extractACPTransactionValue as aH, extractAP2Mandate as aI, extractAP2Mandates as aJ, extractAP2TransactionValue as aK, extractCredentialsFromProtocol as aL, extractHttpCredentials as aM, extractMPPContext as aN, extractMPPFromRequest as aO, extractMPPFromResponse as aP, extractMPPTransactionValue as aQ, extractMcpCredentials as aR, extractUCPContext as aS, extractUCPTransactionValue as aT, extractVIClaims as aU, extractVITransactionValue as aV, extractX402Context as aW, extractX402FromRequest as aX, extractX402FromResponse as aY, extractX402TransactionValue as aZ, fetchUCPManifest as a_, type VIClaimsForValue as aa, type VIConstraintEvalInput as ab, type VIConstraints as ac, type VIExecutionMode as ad, type VIExtractedClaims as ae, type VILayer as af, type VILineItem as ag, type VIMandateType as ah, type VIPaymentAmount as ai, type VIRecurrence as aj, type VIVerifyInput as ak, type VIVerifyResult as al, type VerifyStripeWebhookOptions as am, type VerifyStripeWebhookResult as an, type X402Kind as ao, type X402RequestContext as ap, type X402RequestForValue as aq, type X402RequestLike as ar, type X402RequirementsSummary as as, type X402ResponseLike as at, applyCredentials as au, bindIdentity as av, claim as aw, clearTransportExtractors as ax, createMastercardRegistry as ay, createVisaRegistry as az, type ACPRequestContext as b, getTransportExtractors as b0, index as b1, isStripeWebhookInformational as b2, mapACPRequestToPurpose as b3, mapAP2MandateToPurpose as b4, mapMPPRequestToPurpose as b5, mapRFC9421TagToPurpose as b6, mapUCPRequestToPurpose as b7, mapVIMandateToPurpose as b8, mapX402RequestToPurpose as b9, parseRFC9421 as ba, registerTransportExtractor as bb, runCommercePipeline as bc, runMatchingExtractors as bd, setA2AMetadata as be, setHttpHeaders as bf, setMcpMeta as bg, validateUCPManifest as bh, verifyACPSignature as bi, verifyAP2Chain as bj, verifyMPP as bk, verifyRFC9421 as bl, verifyStripeWebhook as bm, verifyVIChain as bn, type ACPRequestLike as c, type ACPSignatureAlgorithm as d, type ACPTotal as e, type ACPVerifyInput as f, type ACPVerifyResult as g, type AP2CartMandateClaims as h, type AP2ChainResult as i, type AP2IntentMandateClaims as j, type AP2MandateClaims as k, type AP2MandateTriple as l, type AP2MandateTripleInput as m, type AP2MandateType as n, type AP2PaymentDetailsTotal as o, type AP2PaymentMandateClaims as p, type AP2PaymentMandateForValue as q, type AP2VerifyInput as r, type CommercePipelineInput as s, type CommerceProtocol as t, type CommercePurpose as u, type CommerceSignatureStack as v, type ConstraintEvalResult as w, type ConstraintKey as x, type ConstraintResult as y, type IdentityClaim as z };