@astrasyncai/verification-gateway 5.8.0 → 5.10.0

package/dist/{types-BK_pRNSs.d.mts → types-CTmUpNpS.d.mts}

@@ -42,6 +42,14 @@ interface ObservedMetadata {
      * by the edge path, which sees the raw query string.
      */
     queryKeys?: string[];
+    /**
+     * Query-string VALUES for parameter names the endpoint owner explicitly
+     * allow-listed (`EdgeConfig.queryValueAllowlist`, seeded `utm_*` — VI
+     * uplift Part 4). The default remains NO value capture; this exists so
+     * campaign attribution (utm_source/medium/campaign) can be reported
+     * without widening the privacy stance. Bounded 16 entries × 256 chars.
+     */
+    queryParams?: Record<string, string>;
     /**
      * Version of the capture semantics this object was produced under — see
      * {@link CAPTURE_SCHEMA_VERSION}. Optional for backward compatibility with
@@ -215,8 +223,8 @@ interface VerifiedAgent {
     trustScore: number;
     /** Trust level tier */
     trustLevel: TrustLevel;
-    /** Whether agent is blockchain-verified */
-    blockchainVerified: boolean;
+    /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
+    blockchainAnchored: boolean;
     /** Agent status */
     status: 'active' | 'inactive' | 'suspended' | 'migrating' | 'terminated' | 'retired';
 }
@@ -589,6 +597,21 @@ interface CallerMetadata {
     forwardedFor?: string;
     /** Published agent card URL, if the agent advertised one (future: from agent headers). */
     agentCardUrl?: string;
+    /**
+     * Transport marker for the hop that relayed this call (e.g.
+     * `mcp-bridge/<version>`, or an `astrasync-sdk/<v>` UA demoted out of the
+     * userAgent slot). Attribution only — never the caller's UA and never a
+     * trust signal; kept outside the self-traffic filter so relayed buyer
+     * traffic stays merchant-visible.
+     */
+    via?: string;
+    /**
+     * Self-declared platform from the `X-Astra-Source` header (VI uplift
+     * Part 2), normalised via `normalizeDeclaredSource`. Spoofable by design —
+     * surfaces as the distinct "declared · unverified" evidence class, never
+     * as fingerprint/verified evidence, and never enters an access decision.
+     */
+    declaredSource?: string;
     /**
      * The full sanitised view of the agent's inbound request headers + connection
      * signals (maximal metadata capture: every signal legitimately visible on

package/dist/{types-BK_pRNSs.d.ts → types-CTmUpNpS.d.ts}

@@ -42,6 +42,14 @@ interface ObservedMetadata {
      * by the edge path, which sees the raw query string.
      */
     queryKeys?: string[];
+    /**
+     * Query-string VALUES for parameter names the endpoint owner explicitly
+     * allow-listed (`EdgeConfig.queryValueAllowlist`, seeded `utm_*` — VI
+     * uplift Part 4). The default remains NO value capture; this exists so
+     * campaign attribution (utm_source/medium/campaign) can be reported
+     * without widening the privacy stance. Bounded 16 entries × 256 chars.
+     */
+    queryParams?: Record<string, string>;
     /**
      * Version of the capture semantics this object was produced under — see
      * {@link CAPTURE_SCHEMA_VERSION}. Optional for backward compatibility with
@@ -215,8 +223,8 @@ interface VerifiedAgent {
     trustScore: number;
     /** Trust level tier */
     trustLevel: TrustLevel;
-    /** Whether agent is blockchain-verified */
-    blockchainVerified: boolean;
+    /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
+    blockchainAnchored: boolean;
     /** Agent status */
     status: 'active' | 'inactive' | 'suspended' | 'migrating' | 'terminated' | 'retired';
 }
@@ -589,6 +597,21 @@ interface CallerMetadata {
     forwardedFor?: string;
     /** Published agent card URL, if the agent advertised one (future: from agent headers). */
     agentCardUrl?: string;
+    /**
+     * Transport marker for the hop that relayed this call (e.g.
+     * `mcp-bridge/<version>`, or an `astrasync-sdk/<v>` UA demoted out of the
+     * userAgent slot). Attribution only — never the caller's UA and never a
+     * trust signal; kept outside the self-traffic filter so relayed buyer
+     * traffic stays merchant-visible.
+     */
+    via?: string;
+    /**
+     * Self-declared platform from the `X-Astra-Source` header (VI uplift
+     * Part 2), normalised via `normalizeDeclaredSource`. Spoofable by design —
+     * surfaces as the distinct "declared · unverified" evidence class, never
+     * as fingerprint/verified evidence, and never enters an access decision.
+     */
+    declaredSource?: string;
     /**
      * The full sanitised view of the agent's inbound request headers + connection
      * signals (maximal metadata capture: every signal legitimately visible on

package/dist/{types-CwY5IY-0.d.ts → types-CtFXmDzm.d.ts}

@@ -165,8 +165,8 @@ interface VerifiedAgent {
     trustScore: number;
     /** Trust level tier */
     trustLevel: TrustLevel;
-    /** Whether agent is blockchain-verified */
-    blockchainVerified: boolean;
+    /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
+    blockchainAnchored: boolean;
     /** Agent status */
     status: 'active' | 'inactive' | 'suspended' | 'migrating' | 'terminated' | 'retired';
 }
@@ -539,6 +539,21 @@ interface CallerMetadata {
     forwardedFor?: string;
     /** Published agent card URL, if the agent advertised one (future: from agent headers). */
     agentCardUrl?: string;
+    /**
+     * Transport marker for the hop that relayed this call (e.g.
+     * `mcp-bridge/<version>`, or an `astrasync-sdk/<v>` UA demoted out of the
+     * userAgent slot). Attribution only — never the caller's UA and never a
+     * trust signal; kept outside the self-traffic filter so relayed buyer
+     * traffic stays merchant-visible.
+     */
+    via?: string;
+    /**
+     * Self-declared platform from the `X-Astra-Source` header (VI uplift
+     * Part 2), normalised via `normalizeDeclaredSource`. Spoofable by design —
+     * surfaces as the distinct "declared · unverified" evidence class, never
+     * as fingerprint/verified evidence, and never enters an access decision.
+     */
+    declaredSource?: string;
     /**
      * The full sanitised view of the agent's inbound request headers + connection
      * signals (maximal metadata capture: every signal legitimately visible on

package/dist/{types-BCmHFdkJ.d.mts → types-DQrn_kei.d.mts}

@@ -165,8 +165,8 @@ interface VerifiedAgent {
     trustScore: number;
     /** Trust level tier */
     trustLevel: TrustLevel;
-    /** Whether agent is blockchain-verified */
-    blockchainVerified: boolean;
+    /** Whether the agent's identity record is anchored on-chain (5.9.0: was `blockchainVerified`) */
+    blockchainAnchored: boolean;
     /** Agent status */
     status: 'active' | 'inactive' | 'suspended' | 'migrating' | 'terminated' | 'retired';
 }
@@ -539,6 +539,21 @@ interface CallerMetadata {
     forwardedFor?: string;
     /** Published agent card URL, if the agent advertised one (future: from agent headers). */
     agentCardUrl?: string;
+    /**
+     * Transport marker for the hop that relayed this call (e.g.
+     * `mcp-bridge/<version>`, or an `astrasync-sdk/<v>` UA demoted out of the
+     * userAgent slot). Attribution only — never the caller's UA and never a
+     * trust signal; kept outside the self-traffic filter so relayed buyer
+     * traffic stays merchant-visible.
+     */
+    via?: string;
+    /**
+     * Self-declared platform from the `X-Astra-Source` header (VI uplift
+     * Part 2), normalised via `normalizeDeclaredSource`. Spoofable by design —
+     * surfaces as the distinct "declared · unverified" evidence class, never
+     * as fingerprint/verified evidence, and never enters an access decision.
+     */
+    declaredSource?: string;
     /**
      * The full sanitised view of the agent's inbound request headers + connection
      * signals (maximal metadata capture: every signal legitimately visible on

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-BK_pRNSs.mjs';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-CTmUpNpS.mjs';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-BK_pRNSs.js';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-CTmUpNpS.js';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-BCmHFdkJ.mjs';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-DQrn_kei.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**
@@ -112,6 +112,18 @@ declare function reportUnregisteredAttempt(config: GatewayConfig, data: {
     userAgent?: string;
     requestPath?: string;
     requestMethod?: string;
+    /**
+     * VI uplift Part 3 — attempt-chain handle (`att_<32hex>`, from the
+     * X-Astra-Attempt-Id header or an `?astra_attempt=` deep link). Joins
+     * the beacon into the agent's research chain. Attribution only.
+     */
+    attemptId?: string;
+    /** First-class referer (traffic-source reporting). */
+    referer?: string;
+    /** The caller's Accept header (surface-classifier input). */
+    accept?: string;
+    /** Self-declared platform from X-Astra-Source (attribution, never trust). */
+    declaredSource?: string;
     /**
      * 3.9.0 — edge-adapter evidence fields, persisted into the
      * event's eventData by the backend: `protocol` = detected transport/

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-CwY5IY-0.js';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-CtFXmDzm.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**
@@ -112,6 +112,18 @@ declare function reportUnregisteredAttempt(config: GatewayConfig, data: {
     userAgent?: string;
     requestPath?: string;
     requestMethod?: string;
+    /**
+     * VI uplift Part 3 — attempt-chain handle (`att_<32hex>`, from the
+     * X-Astra-Attempt-Id header or an `?astra_attempt=` deep link). Joins
+     * the beacon into the agent's research chain. Attribution only.
+     */
+    attemptId?: string;
+    /** First-class referer (traffic-source reporting). */
+    referer?: string;
+    /** The caller's Accept header (surface-classifier input). */
+    accept?: string;
+    /** Self-declared platform from X-Astra-Source (attribution, never trust). */
+    declaredSource?: string;
     /**
      * 3.9.0 — edge-adapter evidence fields, persisted into the
      * event's eventData by the backend: `protocol` = detected transport/

package/dist/verify.js

@@ -36,7 +36,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.8.0";
+var SDK_VERSION = "5.10.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -406,6 +406,24 @@ async function callVerifyAccessAPI(config, request) {
         }
       };
     }
+    if (response.status === 400 && data?.error === "INVALID_AGENT_ID") {
+      const message = typeof data?.message === "string" ? data.message : "Agent identifier must be a canonical ASTRA-* id.";
+      return {
+        success: true,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
+        access: {
+          allowed: false,
+          reason: "invalid_agent_id",
+          failures: [
+            {
+              dimension: "identity.invalid_agent_id",
+              message,
+              guidance: typeof data?.guidance === "string" ? data.guidance : "Present your canonical ASTRA-* id (discover it via GET /api/agents/request-registration/{requestId} after owner approval)."
+            }
+          ]
+        }
+      };
+    }
     if (!response.ok) {
       if (response.status === 401) {
         return {
@@ -545,7 +563,7 @@ async function verify(config, request, options) {
     name: apiResponse.agent.name,
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
-    blockchainVerified: apiResponse.agent.blockchainStatus === "verified",
+    blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
     status: apiResponse.agent.agentStatus
   } : void 0;
   const developer = apiResponse.developer ? {