@astrasyncai/verification-gateway 1.0.0

package/dist/adapters/express.mjs

@@ -0,0 +1,486 @@
+// src/access-levels.ts
+var ACCESS_LEVEL_HIERARCHY = {
+  none: 0,
+  guidance: 1,
+  "read-only": 2,
+  standard: 3,
+  full: 4,
+  internal: 5
+};
+var DEFAULT_TRUST_THRESHOLDS = {
+  none: 0,
+  guidance: 0,
+  "read-only": 20,
+  standard: 40,
+  full: 70,
+  internal: 0
+  // Internal is based on org membership, not score
+};
+function getTrustLevel(score) {
+  if (score >= 80) return "PLATINUM";
+  if (score >= 60) return "GOLD";
+  if (score >= 40) return "SILVER";
+  return "BRONZE";
+}
+function hasMinimumAccess(actual, required) {
+  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];
+}
+function getAccessLevelForScore(trustScore, thresholds = DEFAULT_TRUST_THRESHOLDS) {
+  if (trustScore >= thresholds.full) return "full";
+  if (trustScore >= thresholds.standard) return "standard";
+  if (trustScore >= thresholds["read-only"]) return "read-only";
+  return "guidance";
+}
+function determineAccessLevel(verified, trustScore, isOrgMember, customThresholds) {
+  if (!verified) {
+    return "guidance";
+  }
+  if (isOrgMember) {
+    return "internal";
+  }
+  const thresholds = {
+    ...DEFAULT_TRUST_THRESHOLDS,
+    ...customThresholds
+  };
+  return getAccessLevelForScore(trustScore, thresholds);
+}
+
+// src/verify.ts
+var DEFAULT_CONFIG = {
+  apiBaseUrl: "https://api.astrasync.ai",
+  defaultAccessLevel: "guidance",
+  minTrustScore: 40,
+  minTrustScoreForFull: 70,
+  cacheTtl: 300,
+  // 5 minutes
+  debug: false
+};
+var verificationCache = /* @__PURE__ */ new Map();
+function getCacheKey(credentials) {
+  return `${credentials.astraId || ""}-${credentials.apiKey || ""}-${credentials.jwt || ""}`;
+}
+function getCachedResult(credentials) {
+  const key = getCacheKey(credentials);
+  const cached = verificationCache.get(key);
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.result;
+  }
+  if (cached) {
+    verificationCache.delete(key);
+  }
+  return null;
+}
+function cacheResult(credentials, result, ttlSeconds) {
+  const key = getCacheKey(credentials);
+  verificationCache.set(key, {
+    result,
+    expiresAt: Date.now() + ttlSeconds * 1e3
+  });
+}
+function extractCredentials(headers, query) {
+  const credentials = {};
+  const astraIdHeader = headers["x-astra-id"] || headers["X-Astra-Id"] || headers["X-ASTRA-ID"];
+  if (astraIdHeader) {
+    credentials.astraId = Array.isArray(astraIdHeader) ? astraIdHeader[0] : astraIdHeader;
+  }
+  const apiKeyHeader = headers["x-api-key"] || headers["X-Api-Key"] || headers["X-API-KEY"];
+  if (apiKeyHeader) {
+    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;
+  }
+  const authHeader = headers["authorization"] || headers["Authorization"];
+  if (authHeader) {
+    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+    credentials.authorizationHeader = authValue;
+    if (authValue.startsWith("Bearer ")) {
+      credentials.jwt = authValue.slice(7);
+    }
+  }
+  if (query) {
+    if (query.astraId && !credentials.astraId) {
+      credentials.astraId = query.astraId;
+    }
+    if (query.apiKey && !credentials.apiKey) {
+      credentials.apiKey = query.apiKey;
+    }
+  }
+  return credentials;
+}
+function hasCredentials(credentials) {
+  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);
+}
+function createGuidanceResponse(config, reason) {
+  const guidance = {
+    message: "This service verifies AI agents before granting access. Please register your agent with AstraSync.",
+    registrationUrl: `${config.apiBaseUrl.replace("/api", "")}/register`,
+    documentationUrl: `${config.apiBaseUrl.replace("/api", "")}/docs/agent-access`,
+    steps: [
+      "Register for an AstraSync account",
+      "Create and register your agent",
+      "Add your ASTRA-ID to request headers",
+      "Retry your request"
+    ]
+  };
+  return {
+    verified: false,
+    accessLevel: "guidance",
+    guidance,
+    denialReasons: reason ? [reason] : ["No valid agent credentials provided"],
+    verifiedAt: /* @__PURE__ */ new Date()
+  };
+}
+async function callVerifyAccessAPI(config, request) {
+  const { credentials, ...requestData } = request;
+  const body = {
+    agentId: credentials.astraId,
+    purpose: requestData.purpose || "general"
+  };
+  if (requestData.action) body.action = requestData.action;
+  if (requestData.resourceType) body.resourceType = requestData.resourceType;
+  if (requestData.resource) body.resource = requestData.resource;
+  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;
+  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;
+  if (requestData.currency) body.currency = requestData.currency;
+  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;
+  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;
+  if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
+  if (requestData.enableRuntimeChallenge) body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.createSession) body.createSession = requestData.createSession;
+  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
+  if (requestData.runtimeChallengeOptions) body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
+  const headers = {
+    "Content-Type": "application/json",
+    ...config.customHeaders
+  };
+  if (config.apiKey) {
+    headers["X-API-Key"] = config.apiKey;
+  }
+  if (credentials.authorizationHeader) {
+    headers["Authorization"] = credentials.authorizationHeader;
+  }
+  try {
+    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+    const data = await response.json();
+    if (!response.ok) {
+      return {
+        success: false,
+        error: data.message || data.error || `API returned ${response.status}`
+      };
+    }
+    return data;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return {
+      success: false,
+      error: `Failed to call verify-access API: ${message}`
+    };
+  }
+}
+async function verify(config, request) {
+  const mergedConfig = { ...DEFAULT_CONFIG, ...config };
+  if (!hasCredentials(request.credentials)) {
+    return createGuidanceResponse(mergedConfig, "No agent credentials provided");
+  }
+  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {
+    const cached = getCachedResult(request.credentials);
+    if (cached) {
+      if (mergedConfig.debug) {
+        console.log("[VerificationGateway] Returning cached result");
+      }
+      return cached;
+    }
+  }
+  if (mergedConfig.debug) {
+    console.log("[VerificationGateway] Calling verify-access API");
+  }
+  const apiResponse = await callVerifyAccessAPI(mergedConfig, request);
+  if (!apiResponse.success) {
+    return createGuidanceResponse(mergedConfig, apiResponse.error);
+  }
+  if (!apiResponse.access?.allowed) {
+    const result2 = {
+      verified: false,
+      accessLevel: "guidance",
+      denialReasons: apiResponse.access?.reason ? [apiResponse.access.reason] : ["Access denied"],
+      requiresStepUp: apiResponse.access?.requiresStepUp,
+      requiresApproval: apiResponse.access?.requiresApproval,
+      guidance: {
+        message: apiResponse.access?.reason || "Access denied by PDLSS policy",
+        registrationUrl: `${mergedConfig.apiBaseUrl?.replace("/api", "")}/register`,
+        documentationUrl: `${mergedConfig.apiBaseUrl?.replace("/api", "")}/docs/pdlss`
+      },
+      verifiedAt: /* @__PURE__ */ new Date()
+    };
+    return result2;
+  }
+  const agent = apiResponse.agent ? {
+    astraId: apiResponse.agent.astraId,
+    name: apiResponse.agent.name,
+    trustScore: apiResponse.agent.trustScore,
+    trustLevel: getTrustLevel(apiResponse.agent.trustScore),
+    blockchainVerified: apiResponse.agent.blockchainStatus === "verified",
+    status: apiResponse.agent.agentStatus
+  } : void 0;
+  const developer = apiResponse.developer ? {
+    astradId: apiResponse.developer.kyaOwnerId,
+    name: apiResponse.developer.fullName,
+    trustScore: apiResponse.developer.trustScore || 0,
+    verified: apiResponse.developer.identityVerified
+  } : void 0;
+  const organization = apiResponse.organization ? {
+    name: apiResponse.organization.name,
+    verified: apiResponse.organization.verified,
+    trustScore: apiResponse.organization.trustScore
+  } : void 0;
+  const pdlss = apiResponse.access?.pdlss ? {
+    purposeAllowed: apiResponse.access.pdlss.purposeAllowed,
+    withinDuration: apiResponse.access.pdlss.withinDuration,
+    withinLimits: apiResponse.access.pdlss.withinLimits,
+    scopeAllowed: apiResponse.access.pdlss.scopeAllowed,
+    selfInstantiationAllowed: apiResponse.access.pdlss.selfInstantiationAllowed,
+    appliedPolicy: apiResponse.access.appliedPolicy
+  } : void 0;
+  const trustScore = agent?.trustScore || 0;
+  const isOrgMember = false;
+  const accessLevel = determineAccessLevel(
+    true,
+    trustScore,
+    isOrgMember,
+    {
+      "read-only": 20,
+      standard: mergedConfig.minTrustScore || 40,
+      full: mergedConfig.minTrustScoreForFull || 70
+    }
+  );
+  const result = {
+    verified: true,
+    accessLevel,
+    agent,
+    developer,
+    organization,
+    pdlss,
+    requiresStepUp: apiResponse.access?.requiresStepUp,
+    requiresApproval: apiResponse.access?.requiresApproval,
+    verifiedAt: /* @__PURE__ */ new Date(),
+    cacheTtl: mergedConfig.cacheTtl,
+    // Handshake Protocol v10 enhanced fields (present when backend returns them)
+    sessionId: apiResponse.sessionId,
+    runtimeChallenge: apiResponse.runtimeChallenge,
+    tokenGuidance: apiResponse.tokenGuidance,
+    recommendation: apiResponse.recommendation,
+    recommendationReasons: apiResponse.recommendationReasons
+  };
+  if (result.recommendation === "deny") {
+    result.verified = false;
+    result.accessLevel = "none";
+    result.denialReasons = result.recommendationReasons || ["Access denied by AstraSync recommendation"];
+    if (result.runtimeChallenge) {
+      result.guidance = {
+        message: `Verification failed: ${result.runtimeChallenge.reason || "runtime challenge failed"}`,
+        registrationUrl: `${mergedConfig.apiBaseUrl?.replace("/api", "")}/register`,
+        documentationUrl: `${mergedConfig.apiBaseUrl?.replace("/api", "")}/docs/runtime-challenge`
+      };
+    }
+  } else if (result.recommendation === "step_up_required") {
+    result.requiresStepUp = true;
+    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY["read-only"]) {
+      result.accessLevel = "read-only";
+    }
+    result.denialReasons = result.recommendationReasons || ["Step-up verification required"];
+  }
+  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== "deny") {
+    cacheResult(request.credentials, result, mergedConfig.cacheTtl);
+  }
+  return result;
+}
+
+// src/transport/http.ts
+var HEADER_PREFIX = "X-Astra-";
+function extractHttpCredentials(headers) {
+  const getValue = (key) => {
+    const v = headers[key] ?? headers[key.toLowerCase()];
+    return Array.isArray(v) ? v[0] : v;
+  };
+  const agentId = getValue(`${HEADER_PREFIX}ID`) ?? getValue("x-astra-id");
+  if (!agentId) return null;
+  const credentials = { agentId };
+  const verifyUrl = getValue(`${HEADER_PREFIX}Verify`) ?? getValue("x-astra-verify");
+  if (verifyUrl) credentials.verifyUrl = verifyUrl;
+  const challengeUrl = getValue(`${HEADER_PREFIX}Challenge`) ?? getValue("x-astra-challenge");
+  if (challengeUrl) credentials.challengeUrl = challengeUrl;
+  const purpose = getValue(`${HEADER_PREFIX}Purpose`) ?? getValue("x-astra-purpose");
+  if (purpose) {
+    const [category, action] = purpose.split(":");
+    credentials.pdlss = {
+      ...credentials.pdlss,
+      purpose: { category, action }
+    };
+  }
+  const duration = getValue(`${HEADER_PREFIX}Duration`) ?? getValue("x-astra-duration");
+  if (duration) {
+    credentials.pdlss = {
+      ...credentials.pdlss,
+      duration: { maxSessionDuration: parseInt(duration, 10) }
+    };
+  }
+  const scope = getValue(`${HEADER_PREFIX}Scope`) ?? getValue("x-astra-scope");
+  if (scope) {
+    credentials.pdlss = {
+      ...credentials.pdlss,
+      scope: { jurisdiction: scope }
+    };
+  }
+  return credentials;
+}
+
+// src/adapters/express.ts
+function defaultExtractCredentials(req) {
+  return extractCredentials(
+    req.headers,
+    req.query
+  );
+}
+function extractAstraSyncCredentials(req) {
+  return extractHttpCredentials(req.headers);
+}
+function defaultExtractPurpose(req) {
+  const purposeHeader = req.headers["x-purpose"] || req.headers["X-Purpose"];
+  if (purposeHeader) {
+    return Array.isArray(purposeHeader) ? purposeHeader[0] : purposeHeader;
+  }
+  if (req.query.purpose && typeof req.query.purpose === "string") {
+    return req.query.purpose;
+  }
+  switch (req.method) {
+    case "GET":
+      return "read";
+    case "POST":
+      return "create";
+    case "PUT":
+    case "PATCH":
+      return "update";
+    case "DELETE":
+      return "delete";
+    default:
+      return "general";
+  }
+}
+function matchRoute(pattern, path) {
+  const regexPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
+  const regex = new RegExp(`^${regexPattern}$`);
+  return regex.test(path);
+}
+function findRouteConfig(routes, path, method) {
+  return routes.find((route) => {
+    const methodMatches = route.method === "*" || route.method.toUpperCase() === method.toUpperCase();
+    const pathMatches = matchRoute(route.pattern, path);
+    return methodMatches && pathMatches;
+  });
+}
+function defaultOnDenied(result, _req, res) {
+  const statusCode = result.verified ? 403 : 401;
+  res.status(statusCode).json({
+    success: false,
+    error: {
+      code: result.verified ? "INSUFFICIENT_ACCESS" : "UNAUTHORIZED",
+      message: result.denialReasons?.[0] || "Access denied",
+      accessLevel: result.accessLevel,
+      guidance: result.guidance
+    }
+  });
+}
+function createMiddleware(options) {
+  const {
+    routes = [],
+    extractCredentials: customExtractCredentials,
+    extractPurpose: customExtractPurpose,
+    skipPaths = [],
+    onDenied = defaultOnDenied,
+    ...config
+  } = options;
+  return async (req, res, next) => {
+    try {
+      const shouldSkip = skipPaths.some((pattern) => matchRoute(pattern, req.path));
+      if (shouldSkip) {
+        return next();
+      }
+      const routeConfig = findRouteConfig(routes, req.path, req.method);
+      if (!routeConfig) {
+        return next();
+      }
+      if (routeConfig.minAccessLevel === "none") {
+        return next();
+      }
+      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
+      if (!hasCredentials(credentials) && routeConfig.minAccessLevel !== "guidance") {
+        const result2 = {
+          verified: false,
+          accessLevel: "none",
+          denialReasons: ["No agent credentials provided"],
+          guidance: {
+            message: "This endpoint requires agent verification. Please provide your ASTRA-ID.",
+            registrationUrl: `${config.apiBaseUrl?.replace("/api", "")}/register`,
+            documentationUrl: `${config.apiBaseUrl?.replace("/api", "")}/docs/agent-access`
+          },
+          verifiedAt: /* @__PURE__ */ new Date()
+        };
+        req.agentVerification = result2;
+        onDenied(result2, req, res);
+        return;
+      }
+      const purpose = customExtractPurpose ? customExtractPurpose(req) : defaultExtractPurpose(req);
+      const result = await verify(config, {
+        credentials,
+        purpose,
+        action: req.method.toLowerCase(),
+        resource: req.path,
+        clientIp: req.ip,
+        userAgent: req.headers["user-agent"]
+      });
+      req.agentVerification = result;
+      if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {
+        onDenied(result, req, res);
+        return;
+      }
+      if (routeConfig.minTrustScore && result.agent) {
+        if (result.agent.trustScore < routeConfig.minTrustScore) {
+          result.denialReasons = [
+            `Trust score ${result.agent.trustScore} is below required ${routeConfig.minTrustScore}`
+          ];
+          onDenied(result, req, res);
+          return;
+        }
+      }
+      next();
+    } catch (error) {
+      console.error("[VerificationGateway] Middleware error:", error);
+      next();
+    }
+  };
+}
+function requireAccess(minAccessLevel, options) {
+  return createMiddleware({
+    ...options,
+    routes: [
+      { pattern: "*", method: "*", minAccessLevel }
+    ]
+  });
+}
+function verifyOnly(options) {
+  return createMiddleware({
+    ...options,
+    routes: [
+      { pattern: "*", method: "*", minAccessLevel: "none" }
+    ]
+  });
+}
+export {
+  createMiddleware,
+  extractAstraSyncCredentials,
+  requireAccess,
+  verifyOnly
+};
+//# sourceMappingURL=express.mjs.map

package/dist/adapters/express.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/access-levels.ts","../../src/verify.ts","../../src/transport/http.ts","../../src/adapters/express.ts"],"sourcesContent":["/**\n * AstraSync Universal Verification Gateway - Access Level Definitions\n *\n * Defines the hierarchy and capabilities of each access level.\n */\n\nimport type { AccessLevel, TrustLevel } from './types';\n\n/**\n * Access level hierarchy (higher number = more access)\n */\nexport const ACCESS_LEVEL_HIERARCHY: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 1,\n  'read-only': 2,\n  standard: 3,\n  full: 4,\n  internal: 5,\n};\n\n/**\n * Access level descriptions for UI\n */\nexport const ACCESS_LEVEL_DESCRIPTIONS: Record<AccessLevel, string> = {\n  none: 'No access - credentials required',\n  guidance: 'Guidance mode - registration information provided',\n  'read-only': 'Read-only access - can browse but not modify',\n  standard: 'Standard access - normal operations per PDLSS policy',\n  full: 'Full access - all operations for high-trust agents',\n  internal: 'Internal access - organization member privileges',\n};\n\n/**\n * Default trust score thresholds for access levels\n */\nexport const DEFAULT_TRUST_THRESHOLDS: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 0,\n  'read-only': 20,\n  standard: 40,\n  full: 70,\n  internal: 0, // Internal is based on org membership, not score\n};\n\n/**\n * Trust level score ranges\n */\nexport const TRUST_LEVEL_RANGES: Record<TrustLevel, { min: number; max: number }> = {\n  BRONZE: { min: 0, max: 39 },\n  SILVER: { min: 40, max: 59 },\n  GOLD: { min: 60, max: 79 },\n  PLATINUM: { min: 80, max: 100 },\n};\n\n/**\n * Determine trust level from score\n */\nexport function getTrustLevel(score: number): TrustLevel {\n  if (score >= 80) return 'PLATINUM';\n  if (score >= 60) return 'GOLD';\n  if (score >= 40) return 'SILVER';\n  return 'BRONZE';\n}\n\n/**\n * Check if access level A is greater than or equal to access level B\n */\nexport function hasMinimumAccess(actual: AccessLevel, required: AccessLevel): boolean {\n  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];\n}\n\n/**\n * Get the highest access level for a given trust score\n */\nexport function getAccessLevelForScore(\n  trustScore: number,\n  thresholds: Record<AccessLevel, number> = DEFAULT_TRUST_THRESHOLDS\n): AccessLevel {\n  if (trustScore >= thresholds.full) return 'full';\n  if (trustScore >= thresholds.standard) return 'standard';\n  if (trustScore >= thresholds['read-only']) return 'read-only';\n  return 'guidance';\n}\n\n/**\n * Determine access level from verification result\n */\nexport function determineAccessLevel(\n  verified: boolean,\n  trustScore: number,\n  isOrgMember: boolean,\n  customThresholds?: Partial<Record<AccessLevel, number>>\n): AccessLevel {\n  if (!verified) {\n    return 'guidance';\n  }\n\n  if (isOrgMember) {\n    return 'internal';\n  }\n\n  const thresholds = {\n    ...DEFAULT_TRUST_THRESHOLDS,\n    ...customThresholds,\n  };\n\n  return getAccessLevelForScore(trustScore, thresholds);\n}\n\n/**\n * Access capabilities per level\n */\nexport interface AccessCapabilities {\n  canRead: boolean;\n  canWrite: boolean;\n  canDelete: boolean;\n  canAdmin: boolean;\n  canAccessInternal: boolean;\n  maxTransactionValue?: number;\n  allowedPurposes?: string[];\n}\n\n/**\n * Get capabilities for an access level\n */\nexport function getCapabilities(accessLevel: AccessLevel): AccessCapabilities {\n  switch (accessLevel) {\n    case 'none':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'guidance':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'read-only':\n      return {\n        canRead: true,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'standard':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'full':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'internal':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: true,\n        canAccessInternal: true,\n      };\n    default:\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n  }\n}\n","/**\n * AstraSync Universal Verification Gateway - Core Verification Logic\n *\n * This module handles the core verification logic, calling the AstraSync API\n * and processing the response into a standardized VerificationResult.\n */\n\nimport type {\n  GatewayConfig,\n  AgentCredentials,\n  VerificationRequest,\n  VerificationResult,\n  VerifiedAgent,\n  VerifiedDeveloper,\n  VerifiedOrganization,\n  PDLSSInfo,\n  GuidanceInfo,\n  AccessLevel,\n  EnhancedVerificationResult,\n  TokenGuidance,\n  RuntimeChallengeResult,\n} from './types';\nimport { determineAccessLevel, getTrustLevel, ACCESS_LEVEL_HIERARCHY } from './access-levels';\n\n/**\n * Default configuration values\n */\nconst DEFAULT_CONFIG: Partial<GatewayConfig> = {\n  apiBaseUrl: 'https://api.astrasync.ai',\n  defaultAccessLevel: 'guidance',\n  minTrustScore: 40,\n  minTrustScoreForFull: 70,\n  cacheTtl: 300, // 5 minutes\n  debug: false,\n};\n\n/**\n * Simple in-memory cache for verification results\n */\nconst verificationCache = new Map<string, { result: VerificationResult; expiresAt: number }>();\n\n/**\n * Generate cache key from credentials\n */\nfunction getCacheKey(credentials: AgentCredentials): string {\n  return `${credentials.astraId || ''}-${credentials.apiKey || ''}-${credentials.jwt || ''}`;\n}\n\n/**\n * Check if cached result is still valid\n */\nfunction getCachedResult(credentials: AgentCredentials): VerificationResult | null {\n  const key = getCacheKey(credentials);\n  const cached = verificationCache.get(key);\n\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.result;\n  }\n\n  if (cached) {\n    verificationCache.delete(key);\n  }\n\n  return null;\n}\n\n/**\n * Cache a verification result\n */\nfunction cacheResult(credentials: AgentCredentials, result: VerificationResult, ttlSeconds: number): void {\n  const key = getCacheKey(credentials);\n  verificationCache.set(key, {\n    result,\n    expiresAt: Date.now() + ttlSeconds * 1000,\n  });\n}\n\n/**\n * Clear the verification cache\n */\nexport function clearCache(): void {\n  verificationCache.clear();\n}\n\n/**\n * Extract agent credentials from various sources\n */\nexport function extractCredentials(\n  headers: Record<string, string | string[] | undefined>,\n  query?: Record<string, string | undefined>\n): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers (case-insensitive)\n  const astraIdHeader = headers['x-astra-id'] || headers['X-Astra-Id'] || headers['X-ASTRA-ID'];\n  if (astraIdHeader) {\n    credentials.astraId = Array.isArray(astraIdHeader) ? astraIdHeader[0] : astraIdHeader;\n  }\n\n  // Check for API key in headers\n  const apiKeyHeader = headers['x-api-key'] || headers['X-Api-Key'] || headers['X-API-KEY'];\n  if (apiKeyHeader) {\n    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;\n  }\n\n  // Check Authorization header for Bearer token\n  const authHeader = headers['authorization'] || headers['Authorization'];\n  if (authHeader) {\n    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n    credentials.authorizationHeader = authValue;\n\n    if (authValue.startsWith('Bearer ')) {\n      credentials.jwt = authValue.slice(7);\n    }\n  }\n\n  // Check query parameters as fallback\n  if (query) {\n    if (query.astraId && !credentials.astraId) {\n      credentials.astraId = query.astraId;\n    }\n    if (query.apiKey && !credentials.apiKey) {\n      credentials.apiKey = query.apiKey;\n    }\n  }\n\n  return credentials;\n}\n\n/**\n * Check if credentials are present\n */\nexport function hasCredentials(credentials: AgentCredentials): boolean {\n  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);\n}\n\n/**\n * Create guidance response for unverified agents\n */\nfunction createGuidanceResponse(config: GatewayConfig, reason?: string): VerificationResult {\n  const guidance: GuidanceInfo = {\n    message: 'This service verifies AI agents before granting access. Please register your agent with AstraSync.',\n    registrationUrl: `${config.apiBaseUrl.replace('/api', '')}/register`,\n    documentationUrl: `${config.apiBaseUrl.replace('/api', '')}/docs/agent-access`,\n    steps: [\n      'Register for an AstraSync account',\n      'Create and register your agent',\n      'Add your ASTRA-ID to request headers',\n      'Retry your request',\n    ],\n  };\n\n  return {\n    verified: false,\n    accessLevel: 'guidance',\n    guidance,\n    denialReasons: reason ? [reason] : ['No valid agent credentials provided'],\n    verifiedAt: new Date(),\n  };\n}\n\n/**\n * Call the AstraSync verify-access API\n */\nasync function callVerifyAccessAPI(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<{\n  success: boolean;\n  access?: {\n    allowed: boolean;\n    reason?: string;\n    requiresStepUp?: boolean;\n    requiresApproval?: boolean;\n    appliedPolicy?: {\n      boundaryId: string;\n      boundaryName: string;\n      policyId: string;\n      policyVersion: string;\n    };\n    pdlss?: {\n      purposeAllowed: boolean;\n      withinDuration: boolean;\n      withinLimits: boolean;\n      scopeAllowed: boolean;\n      selfInstantiationAllowed: boolean;\n    };\n    counterparty?: {\n      id: string;\n      name: string;\n      trustScoreRequirement: number;\n    };\n  };\n  agent?: {\n    kyaAgentId: string;\n    astraId: string;\n    name: string;\n    trustScore: number;\n    trustLevel: string;\n    agentStatus: string;\n    blockchainStatus: string;\n  };\n  developer?: {\n    kyaOwnerId: string;\n    fullName: string;\n    email: string;\n    identityVerified: boolean;\n    trustScore: number;\n  };\n  organization?: {\n    name: string;\n    verified: boolean;\n    trustScore: number;\n  };\n  error?: string;\n}> {\n  const { credentials, ...requestData } = request;\n\n  // Build the request body\n  const body: Record<string, unknown> = {\n    agentId: credentials.astraId,\n    purpose: requestData.purpose || 'general',\n  };\n\n  // Add optional fields\n  if (requestData.action) body.action = requestData.action;\n  if (requestData.resourceType) body.resourceType = requestData.resourceType;\n  if (requestData.resource) body.resource = requestData.resource;\n  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;\n  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;\n  if (requestData.currency) body.currency = requestData.currency;\n  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;\n  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;\n  if (requestData.subAgentDepth !== undefined) body.subAgentDepth = requestData.subAgentDepth;\n  // Handshake Protocol v10 additions\n  if (requestData.enableRuntimeChallenge) body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;\n  if (requestData.createSession) body.createSession = requestData.createSession;\n  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;\n  if (requestData.runtimeChallengeOptions) body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;\n\n  // Build headers\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    ...config.customHeaders,\n  };\n\n  if (config.apiKey) {\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  if (credentials.authorizationHeader) {\n    headers['Authorization'] = credentials.authorizationHeader;\n  }\n\n  try {\n    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: data.message || data.error || `API returned ${response.status}`,\n      };\n    }\n\n    return data;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return {\n      success: false,\n      error: `Failed to call verify-access API: ${message}`,\n    };\n  }\n}\n\n/**\n * Main verification function\n */\nexport async function verify(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n\n  // Check for credentials\n  if (!hasCredentials(request.credentials)) {\n    return createGuidanceResponse(mergedConfig, 'No agent credentials provided');\n  }\n\n  // Check cache first\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {\n    const cached = getCachedResult(request.credentials);\n    if (cached) {\n      if (mergedConfig.debug) {\n        console.log('[VerificationGateway] Returning cached result');\n      }\n      return cached;\n    }\n  }\n\n  // Call the API\n  if (mergedConfig.debug) {\n    console.log('[VerificationGateway] Calling verify-access API');\n  }\n\n  const apiResponse = await callVerifyAccessAPI(mergedConfig, request);\n\n  // Handle API errors\n  if (!apiResponse.success) {\n    return createGuidanceResponse(mergedConfig, apiResponse.error);\n  }\n\n  // Check access result\n  if (!apiResponse.access?.allowed) {\n    const result: VerificationResult = {\n      verified: false,\n      accessLevel: 'guidance',\n      denialReasons: apiResponse.access?.reason ? [apiResponse.access.reason] : ['Access denied'],\n      requiresStepUp: apiResponse.access?.requiresStepUp,\n      requiresApproval: apiResponse.access?.requiresApproval,\n      guidance: {\n        message: apiResponse.access?.reason || 'Access denied by PDLSS policy',\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/pdlss`,\n      },\n      verifiedAt: new Date(),\n    };\n\n    return result;\n  }\n\n  // Build successful result\n  const agent: VerifiedAgent | undefined = apiResponse.agent\n    ? {\n        astraId: apiResponse.agent.astraId,\n        name: apiResponse.agent.name,\n        trustScore: apiResponse.agent.trustScore,\n        trustLevel: getTrustLevel(apiResponse.agent.trustScore),\n        blockchainVerified: apiResponse.agent.blockchainStatus === 'verified',\n        status: apiResponse.agent.agentStatus as VerifiedAgent['status'],\n      }\n    : undefined;\n\n  const developer: VerifiedDeveloper | undefined = apiResponse.developer\n    ? {\n        astradId: apiResponse.developer.kyaOwnerId,\n        name: apiResponse.developer.fullName,\n        trustScore: apiResponse.developer.trustScore || 0,\n        verified: apiResponse.developer.identityVerified,\n      }\n    : undefined;\n\n  const organization: VerifiedOrganization | undefined = apiResponse.organization\n    ? {\n        name: apiResponse.organization.name,\n        verified: apiResponse.organization.verified,\n        trustScore: apiResponse.organization.trustScore,\n      }\n    : undefined;\n\n  const pdlss: PDLSSInfo | undefined = apiResponse.access?.pdlss\n    ? {\n        purposeAllowed: apiResponse.access.pdlss.purposeAllowed,\n        withinDuration: apiResponse.access.pdlss.withinDuration,\n        withinLimits: apiResponse.access.pdlss.withinLimits,\n        scopeAllowed: apiResponse.access.pdlss.scopeAllowed,\n        selfInstantiationAllowed: apiResponse.access.pdlss.selfInstantiationAllowed,\n        appliedPolicy: apiResponse.access.appliedPolicy,\n      }\n    : undefined;\n\n  // Determine access level based on trust score\n  const trustScore = agent?.trustScore || 0;\n  const isOrgMember = false; // TODO: Check if agent belongs to same org as counterparty\n  const accessLevel: AccessLevel = determineAccessLevel(\n    true,\n    trustScore,\n    isOrgMember,\n    {\n      'read-only': 20,\n      standard: mergedConfig.minTrustScore || 40,\n      full: mergedConfig.minTrustScoreForFull || 70,\n    }\n  );\n\n  const result: EnhancedVerificationResult = {\n    verified: true,\n    accessLevel,\n    agent,\n    developer,\n    organization,\n    pdlss,\n    requiresStepUp: apiResponse.access?.requiresStepUp,\n    requiresApproval: apiResponse.access?.requiresApproval,\n    verifiedAt: new Date(),\n    cacheTtl: mergedConfig.cacheTtl,\n    // Handshake Protocol v10 enhanced fields (present when backend returns them)\n    sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n    runtimeChallenge: (apiResponse as Record<string, unknown>).runtimeChallenge as RuntimeChallengeResult | undefined,\n    tokenGuidance: (apiResponse as Record<string, unknown>).tokenGuidance as TokenGuidance | undefined,\n    recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n    recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n  };\n\n  // Enforce AstraSync recommendation\n  if (result.recommendation === 'deny') {\n    result.verified = false;\n    result.accessLevel = 'none';\n    result.denialReasons = result.recommendationReasons || ['Access denied by AstraSync recommendation'];\n    if (result.runtimeChallenge) {\n      result.guidance = {\n        message: `Verification failed: ${result.runtimeChallenge.reason || 'runtime challenge failed'}`,\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/runtime-challenge`,\n      };\n    }\n  } else if (result.recommendation === 'step_up_required') {\n    result.requiresStepUp = true;\n    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY['read-only']) {\n      result.accessLevel = 'read-only';\n    }\n    result.denialReasons = result.recommendationReasons || ['Step-up verification required'];\n  }\n\n  // Cache the result (skip caching denials — agent may fix challenge endpoint and retry)\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== 'deny') {\n    cacheResult(request.credentials, result, mergedConfig.cacheTtl);\n  }\n\n  return result;\n}\n\n/**\n * Quick verification - just check if credentials are valid\n */\nexport async function quickVerify(\n  config: GatewayConfig,\n  credentials: AgentCredentials\n): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n  const result = await verify(config, {\n    credentials,\n    purpose: 'verification',\n  });\n\n  return {\n    verified: result.verified,\n    accessLevel: result.accessLevel,\n    reason: result.denialReasons?.[0],\n  };\n}\n","/**\n * HTTP Transport Adapter\n *\n * Maps AstraSync credentials to/from HTTP headers (X-Astra-* convention).\n */\n\nimport type { AstraSyncCredentials } from '../types';\n\nconst HEADER_PREFIX = 'X-Astra-';\n\n/**\n * Inject AstraSync credentials into HTTP headers.\n */\nexport function setHttpHeaders(\n  headers: Record<string, string>,\n  credentials: AstraSyncCredentials,\n): Record<string, string> {\n  const result = { ...headers };\n\n  result[`${HEADER_PREFIX}ID`] = credentials.agentId;\n\n  if (credentials.verifyUrl) {\n    result[`${HEADER_PREFIX}Verify`] = credentials.verifyUrl;\n  }\n\n  if (credentials.challengeUrl) {\n    result[`${HEADER_PREFIX}Challenge`] = credentials.challengeUrl;\n  }\n\n  if (credentials.pdlss?.purpose) {\n    const purposeValue = credentials.pdlss.purpose.action\n      ? `${credentials.pdlss.purpose.category}:${credentials.pdlss.purpose.action}`\n      : credentials.pdlss.purpose.category;\n    result[`${HEADER_PREFIX}Purpose`] = purposeValue;\n  }\n\n  if (credentials.pdlss?.duration?.maxSessionDuration) {\n    result[`${HEADER_PREFIX}Duration`] = String(credentials.pdlss.duration.maxSessionDuration);\n  }\n\n  if (credentials.pdlss?.scope?.jurisdiction) {\n    result[`${HEADER_PREFIX}Scope`] = credentials.pdlss.scope.jurisdiction;\n  }\n\n  return result;\n}\n\n/**\n * Extract AstraSync credentials from HTTP headers.\n */\nexport function extractHttpCredentials(\n  headers: Record<string, string | string[] | undefined>,\n): AstraSyncCredentials | null {\n  const getValue = (key: string): string | undefined => {\n    const v = headers[key] ?? headers[key.toLowerCase()];\n    return Array.isArray(v) ? v[0] : v;\n  };\n\n  const agentId = getValue(`${HEADER_PREFIX}ID`) ?? getValue('x-astra-id');\n  if (!agentId) return null;\n\n  const credentials: AstraSyncCredentials = { agentId };\n\n  const verifyUrl = getValue(`${HEADER_PREFIX}Verify`) ?? getValue('x-astra-verify');\n  if (verifyUrl) credentials.verifyUrl = verifyUrl;\n\n  const challengeUrl = getValue(`${HEADER_PREFIX}Challenge`) ?? getValue('x-astra-challenge');\n  if (challengeUrl) credentials.challengeUrl = challengeUrl;\n\n  const purpose = getValue(`${HEADER_PREFIX}Purpose`) ?? getValue('x-astra-purpose');\n  if (purpose) {\n    const [category, action] = purpose.split(':');\n    credentials.pdlss = {\n      ...credentials.pdlss,\n      purpose: { category, action },\n    };\n  }\n\n  const duration = getValue(`${HEADER_PREFIX}Duration`) ?? getValue('x-astra-duration');\n  if (duration) {\n    credentials.pdlss = {\n      ...credentials.pdlss,\n      duration: { maxSessionDuration: parseInt(duration, 10) },\n    };\n  }\n\n  const scope = getValue(`${HEADER_PREFIX}Scope`) ?? getValue('x-astra-scope');\n  if (scope) {\n    credentials.pdlss = {\n      ...credentials.pdlss,\n      scope: { jurisdiction: scope },\n    };\n  }\n\n  return credentials;\n}\n","/**\n * AstraSync Universal Verification Gateway - Express Middleware\n *\n * Express.js middleware for verifying AI agents on API endpoints.\n *\n * @example\n * ```typescript\n * import express from 'express';\n * import { createMiddleware } from '@astrasyncai/verification-gateway/express';\n *\n * const app = express();\n *\n * app.use(createMiddleware({\n *   apiBaseUrl: 'https://api.astrasync.ai',\n *   routes: [\n *     { pattern: '/api/public/*', method: '*', minAccessLevel: 'none' },\n *     { pattern: '/api/data/*', method: 'GET', minAccessLevel: 'read-only' },\n *     { pattern: '/api/data/*', method: '*', minAccessLevel: 'standard' },\n *     { pattern: '/api/admin/*', method: '*', minAccessLevel: 'internal' },\n *   ],\n * }));\n * ```\n */\n\nimport type { Request, Response, NextFunction, RequestHandler } from 'express';\nimport type {\n  ExpressMiddlewareOptions,\n  AgentCredentials,\n  VerificationResult,\n  RouteAccessConfig,\n  AccessLevel,\n  AstraSyncCredentials,\n} from '../types';\nimport { verify, extractCredentials, hasCredentials } from '../verify';\nimport { hasMinimumAccess } from '../access-levels';\nimport { extractHttpCredentials } from '../transport/http';\n\n/**\n * Extend Express Request with verification result\n */\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      agentVerification?: VerificationResult;\n    }\n  }\n}\n\n/**\n * Default credential extractor\n */\nfunction defaultExtractCredentials(req: Request): AgentCredentials {\n  return extractCredentials(\n    req.headers as Record<string, string | string[] | undefined>,\n    req.query as Record<string, string | undefined>\n  );\n}\n\n/**\n * Extract extended AstraSync credentials (X-Astra-* headers) from Express request.\n * Returns null if no AstraSync headers are present.\n */\nexport function extractAstraSyncCredentials(req: Request): AstraSyncCredentials | null {\n  return extractHttpCredentials(req.headers as Record<string, string | string[] | undefined>);\n}\n\n/**\n * Default purpose extractor\n */\nfunction defaultExtractPurpose(req: Request): string | undefined {\n  // Try to get purpose from header\n  const purposeHeader = req.headers['x-purpose'] || req.headers['X-Purpose'];\n  if (purposeHeader) {\n    return Array.isArray(purposeHeader) ? purposeHeader[0] : purposeHeader;\n  }\n\n  // Try to get from query\n  if (req.query.purpose && typeof req.query.purpose === 'string') {\n    return req.query.purpose;\n  }\n\n  // Infer from method\n  switch (req.method) {\n    case 'GET':\n      return 'read';\n    case 'POST':\n      return 'create';\n    case 'PUT':\n    case 'PATCH':\n      return 'update';\n    case 'DELETE':\n      return 'delete';\n    default:\n      return 'general';\n  }\n}\n\n/**\n * Match a route pattern against a path\n */\nfunction matchRoute(pattern: string, path: string): boolean {\n  // Convert pattern to regex\n  const regexPattern = pattern\n    .replace(/\\*/g, '.*')\n    .replace(/\\//g, '\\\\/');\n\n  const regex = new RegExp(`^${regexPattern}$`);\n  return regex.test(path);\n}\n\n/**\n * Find the route configuration for a request\n */\nfunction findRouteConfig(\n  routes: RouteAccessConfig[],\n  path: string,\n  method: string\n): RouteAccessConfig | undefined {\n  return routes.find((route) => {\n    const methodMatches = route.method === '*' || route.method.toUpperCase() === method.toUpperCase();\n    const pathMatches = matchRoute(route.pattern, path);\n    return methodMatches && pathMatches;\n  });\n}\n\n/**\n * Default denied handler\n */\nfunction defaultOnDenied(\n  result: VerificationResult,\n  _req: Request,\n  res: Response\n): void {\n  const statusCode = result.verified ? 403 : 401;\n\n  res.status(statusCode).json({\n    success: false,\n    error: {\n      code: result.verified ? 'INSUFFICIENT_ACCESS' : 'UNAUTHORIZED',\n      message: result.denialReasons?.[0] || 'Access denied',\n      accessLevel: result.accessLevel,\n      guidance: result.guidance,\n    },\n  });\n}\n\n/**\n * Create Express middleware for agent verification\n */\nexport function createMiddleware(options: ExpressMiddlewareOptions): RequestHandler {\n  const {\n    routes = [],\n    extractCredentials: customExtractCredentials,\n    extractPurpose: customExtractPurpose,\n    skipPaths = [],\n    onDenied = defaultOnDenied,\n    ...config\n  } = options;\n\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      // Check if path should be skipped\n      const shouldSkip = skipPaths.some((pattern) => matchRoute(pattern, req.path));\n      if (shouldSkip) {\n        return next();\n      }\n\n      // Find route configuration\n      const routeConfig = findRouteConfig(routes, req.path, req.method);\n\n      // If no route config, skip verification (allow through)\n      if (!routeConfig) {\n        return next();\n      }\n\n      // If route requires 'none' access, skip verification\n      if (routeConfig.minAccessLevel === 'none') {\n        return next();\n      }\n\n      // Extract credentials\n      const credentials = customExtractCredentials\n        ? customExtractCredentials(req)\n        : defaultExtractCredentials(req);\n\n      // If no credentials and access required, deny\n      if (!hasCredentials(credentials) && routeConfig.minAccessLevel !== 'guidance') {\n        const result: VerificationResult = {\n          verified: false,\n          accessLevel: 'none',\n          denialReasons: ['No agent credentials provided'],\n          guidance: {\n            message: 'This endpoint requires agent verification. Please provide your ASTRA-ID.',\n            registrationUrl: `${config.apiBaseUrl?.replace('/api', '')}/register`,\n            documentationUrl: `${config.apiBaseUrl?.replace('/api', '')}/docs/agent-access`,\n          },\n          verifiedAt: new Date(),\n        };\n\n        req.agentVerification = result;\n        onDenied(result, req, res);\n        return;\n      }\n\n      // Extract purpose\n      const purpose = customExtractPurpose\n        ? customExtractPurpose(req)\n        : defaultExtractPurpose(req);\n\n      // Verify the agent\n      const result = await verify(config, {\n        credentials,\n        purpose,\n        action: req.method.toLowerCase(),\n        resource: req.path,\n        clientIp: req.ip,\n        userAgent: req.headers['user-agent'],\n      });\n\n      // Attach result to request\n      req.agentVerification = result;\n\n      // Check if access level is sufficient\n      if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {\n        onDenied(result, req, res);\n        return;\n      }\n\n      // Check trust score requirement if specified\n      if (routeConfig.minTrustScore && result.agent) {\n        if (result.agent.trustScore < routeConfig.minTrustScore) {\n          result.denialReasons = [\n            `Trust score ${result.agent.trustScore} is below required ${routeConfig.minTrustScore}`,\n          ];\n          onDenied(result, req, res);\n          return;\n        }\n      }\n\n      // All checks passed\n      next();\n    } catch (error) {\n      // Log error and continue (fail open by default)\n      console.error('[VerificationGateway] Middleware error:', error);\n      next();\n    }\n  };\n}\n\n/**\n * Create a middleware that requires a specific access level\n */\nexport function requireAccess(minAccessLevel: AccessLevel, options: ExpressMiddlewareOptions): RequestHandler {\n  return createMiddleware({\n    ...options,\n    routes: [\n      { pattern: '*', method: '*', minAccessLevel },\n    ],\n  });\n}\n\n/**\n * Create a middleware that only verifies (doesn't block)\n */\nexport function verifyOnly(options: Omit<ExpressMiddlewareOptions, 'routes' | 'onDenied'>): RequestHandler {\n  return createMiddleware({\n    ...options,\n    routes: [\n      { pattern: '*', method: '*', minAccessLevel: 'none' },\n    ],\n  });\n}\n"],"mappings":";AAWO,IAAM,yBAAsD;AAAA,EACjE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AACZ;AAiBO,IAAM,2BAAwD;AAAA,EACnE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA;AACZ;AAeO,SAAS,cAAc,OAA2B;AACvD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAKO,SAAS,iBAAiB,QAAqB,UAAgC;AACpF,SAAO,uBAAuB,MAAM,KAAK,uBAAuB,QAAQ;AAC1E;AAKO,SAAS,uBACd,YACA,aAA0C,0BAC7B;AACb,MAAI,cAAc,WAAW,KAAM,QAAO;AAC1C,MAAI,cAAc,WAAW,SAAU,QAAO;AAC9C,MAAI,cAAc,WAAW,WAAW,EAAG,QAAO;AAClD,SAAO;AACT;AAKO,SAAS,qBACd,UACA,YACA,aACA,kBACa;AACb,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AAEA,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,uBAAuB,YAAY,UAAU;AACtD;;;AChFA,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AAAA;AAAA,EACV,OAAO;AACT;AAKA,IAAM,oBAAoB,oBAAI,IAA+D;AAK7F,SAAS,YAAY,aAAuC;AAC1D,SAAO,GAAG,YAAY,WAAW,EAAE,IAAI,YAAY,UAAU,EAAE,IAAI,YAAY,OAAO,EAAE;AAC1F;AAKA,SAAS,gBAAgB,aAA0D;AACjF,QAAM,MAAM,YAAY,WAAW;AACnC,QAAM,SAAS,kBAAkB,IAAI,GAAG;AAExC,MAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,QAAQ;AACV,sBAAkB,OAAO,GAAG;AAAA,EAC9B;AAEA,SAAO;AACT;AAKA,SAAS,YAAY,aAA+B,QAA4B,YAA0B;AACxG,QAAM,MAAM,YAAY,WAAW;AACnC,oBAAkB,IAAI,KAAK;AAAA,IACzB;AAAA,IACA,WAAW,KAAK,IAAI,IAAI,aAAa;AAAA,EACvC,CAAC;AACH;AAYO,SAAS,mBACd,SACA,OACkB;AAClB,QAAM,cAAgC,CAAC;AAGvC,QAAM,gBAAgB,QAAQ,YAAY,KAAK,QAAQ,YAAY,KAAK,QAAQ,YAAY;AAC5F,MAAI,eAAe;AACjB,gBAAY,UAAU,MAAM,QAAQ,aAAa,IAAI,cAAc,CAAC,IAAI;AAAA,EAC1E;AAGA,QAAM,eAAe,QAAQ,WAAW,KAAK,QAAQ,WAAW,KAAK,QAAQ,WAAW;AACxF,MAAI,cAAc;AAChB,gBAAY,SAAS,MAAM,QAAQ,YAAY,IAAI,aAAa,CAAC,IAAI;AAAA,EACvE;AAGA,QAAM,aAAa,QAAQ,eAAe,KAAK,QAAQ,eAAe;AACtE,MAAI,YAAY;AACd,UAAM,YAAY,MAAM,QAAQ,UAAU,IAAI,WAAW,CAAC,IAAI;AAC9D,gBAAY,sBAAsB;AAElC,QAAI,UAAU,WAAW,SAAS,GAAG;AACnC,kBAAY,MAAM,UAAU,MAAM,CAAC;AAAA,IACrC;AAAA,EACF;AAGA,MAAI,OAAO;AACT,QAAI,MAAM,WAAW,CAAC,YAAY,SAAS;AACzC,kBAAY,UAAU,MAAM;AAAA,IAC9B;AACA,QAAI,MAAM,UAAU,CAAC,YAAY,QAAQ;AACvC,kBAAY,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,eAAe,aAAwC;AACrE,SAAO,CAAC,EAAE,YAAY,WAAW,YAAY,UAAU,YAAY;AACrE;AAKA,SAAS,uBAAuB,QAAuB,QAAqC;AAC1F,QAAM,WAAyB;AAAA,IAC7B,SAAS;AAAA,IACT,iBAAiB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IACzD,kBAAkB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,aAAa;AAAA,IACb;AAAA,IACA,eAAe,SAAS,CAAC,MAAM,IAAI,CAAC,qCAAqC;AAAA,IACzE,YAAY,oBAAI,KAAK;AAAA,EACvB;AACF;AAKA,eAAe,oBACb,QACA,SAiDC;AACD,QAAM,EAAE,aAAa,GAAG,YAAY,IAAI;AAGxC,QAAM,OAAgC;AAAA,IACpC,SAAS,YAAY;AAAA,IACrB,SAAS,YAAY,WAAW;AAAA,EAClC;AAGA,MAAI,YAAY,OAAQ,MAAK,SAAS,YAAY;AAClD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,kBAAmB,MAAK,oBAAoB,YAAY;AACxE,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,kBAAkB,OAAW,MAAK,gBAAgB,YAAY;AAE9E,MAAI,YAAY,uBAAwB,MAAK,yBAAyB,YAAY;AAClF,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,wBAAyB,MAAK,0BAA0B,YAAY;AAGpF,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAG,OAAO;AAAA,EACZ;AAEA,MAAI,OAAO,QAAQ;AACjB,YAAQ,WAAW,IAAI,OAAO;AAAA,EAChC;AAEA,MAAI,YAAY,qBAAqB;AACnC,YAAQ,eAAe,IAAI,YAAY;AAAA,EACzC;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAG,OAAO,UAAU,yBAAyB;AAAA,MACxE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,WAAW,KAAK,SAAS,gBAAgB,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,qCAAqC,OAAO;AAAA,IACrD;AAAA,EACF;AACF;AAKA,eAAsB,OACpB,QACA,SAC6B;AAC7B,QAAM,eAAe,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAGpD,MAAI,CAAC,eAAe,QAAQ,WAAW,GAAG;AACxC,WAAO,uBAAuB,cAAc,+BAA+B;AAAA,EAC7E;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,GAAG;AACtD,UAAM,SAAS,gBAAgB,QAAQ,WAAW;AAClD,QAAI,QAAQ;AACV,UAAI,aAAa,OAAO;AACtB,gBAAQ,IAAI,+CAA+C;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI,aAAa,OAAO;AACtB,YAAQ,IAAI,iDAAiD;AAAA,EAC/D;AAEA,QAAM,cAAc,MAAM,oBAAoB,cAAc,OAAO;AAGnE,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,uBAAuB,cAAc,YAAY,KAAK;AAAA,EAC/D;AAGA,MAAI,CAAC,YAAY,QAAQ,SAAS;AAChC,UAAMA,UAA6B;AAAA,MACjC,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,YAAY,QAAQ,SAAS,CAAC,YAAY,OAAO,MAAM,IAAI,CAAC,eAAe;AAAA,MAC1F,gBAAgB,YAAY,QAAQ;AAAA,MACpC,kBAAkB,YAAY,QAAQ;AAAA,MACtC,UAAU;AAAA,QACR,SAAS,YAAY,QAAQ,UAAU;AAAA,QACvC,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA,IACvB;AAEA,WAAOA;AAAA,EACT;AAGA,QAAM,QAAmC,YAAY,QACjD;AAAA,IACE,SAAS,YAAY,MAAM;AAAA,IAC3B,MAAM,YAAY,MAAM;AAAA,IACxB,YAAY,YAAY,MAAM;AAAA,IAC9B,YAAY,cAAc,YAAY,MAAM,UAAU;AAAA,IACtD,oBAAoB,YAAY,MAAM,qBAAqB;AAAA,IAC3D,QAAQ,YAAY,MAAM;AAAA,EAC5B,IACA;AAEJ,QAAM,YAA2C,YAAY,YACzD;AAAA,IACE,UAAU,YAAY,UAAU;AAAA,IAChC,MAAM,YAAY,UAAU;AAAA,IAC5B,YAAY,YAAY,UAAU,cAAc;AAAA,IAChD,UAAU,YAAY,UAAU;AAAA,EAClC,IACA;AAEJ,QAAM,eAAiD,YAAY,eAC/D;AAAA,IACE,MAAM,YAAY,aAAa;AAAA,IAC/B,UAAU,YAAY,aAAa;AAAA,IACnC,YAAY,YAAY,aAAa;AAAA,EACvC,IACA;AAEJ,QAAM,QAA+B,YAAY,QAAQ,QACrD;AAAA,IACE,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,0BAA0B,YAAY,OAAO,MAAM;AAAA,IACnD,eAAe,YAAY,OAAO;AAAA,EACpC,IACA;AAGJ,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc;AACpB,QAAM,cAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,UAAU,aAAa,iBAAiB;AAAA,MACxC,MAAM,aAAa,wBAAwB;AAAA,IAC7C;AAAA,EACF;AAEA,QAAM,SAAqC;AAAA,IACzC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,YAAY,QAAQ;AAAA,IACpC,kBAAkB,YAAY,QAAQ;AAAA,IACtC,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,aAAa;AAAA;AAAA,IAEvB,WAAY,YAAwC;AAAA,IACpD,kBAAmB,YAAwC;AAAA,IAC3D,eAAgB,YAAwC;AAAA,IACxD,gBAAiB,YAAwC;AAAA,IACzD,uBAAwB,YAAwC;AAAA,EAClE;AAGA,MAAI,OAAO,mBAAmB,QAAQ;AACpC,WAAO,WAAW;AAClB,WAAO,cAAc;AACrB,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,2CAA2C;AACnG,QAAI,OAAO,kBAAkB;AAC3B,aAAO,WAAW;AAAA,QAChB,SAAS,wBAAwB,OAAO,iBAAiB,UAAU,0BAA0B;AAAA,QAC7F,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF,WAAW,OAAO,mBAAmB,oBAAoB;AACvD,WAAO,iBAAiB;AACxB,QAAI,uBAAuB,OAAO,WAAW,IAAI,uBAAuB,WAAW,GAAG;AACpF,aAAO,cAAc;AAAA,IACvB;AACA,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,+BAA+B;AAAA,EACzF;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,KAAK,OAAO,mBAAmB,QAAQ;AAC1F,gBAAY,QAAQ,aAAa,QAAQ,aAAa,QAAQ;AAAA,EAChE;AAEA,SAAO;AACT;;;AC3aA,IAAM,gBAAgB;AA0Cf,SAAS,uBACd,SAC6B;AAC7B,QAAM,WAAW,CAAC,QAAoC;AACpD,UAAM,IAAI,QAAQ,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC;AACnD,WAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AAAA,EACnC;AAEA,QAAM,UAAU,SAAS,GAAG,aAAa,IAAI,KAAK,SAAS,YAAY;AACvE,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,cAAoC,EAAE,QAAQ;AAEpD,QAAM,YAAY,SAAS,GAAG,aAAa,QAAQ,KAAK,SAAS,gBAAgB;AACjF,MAAI,UAAW,aAAY,YAAY;AAEvC,QAAM,eAAe,SAAS,GAAG,aAAa,WAAW,KAAK,SAAS,mBAAmB;AAC1F,MAAI,aAAc,aAAY,eAAe;AAE7C,QAAM,UAAU,SAAS,GAAG,aAAa,SAAS,KAAK,SAAS,iBAAiB;AACjF,MAAI,SAAS;AACX,UAAM,CAAC,UAAU,MAAM,IAAI,QAAQ,MAAM,GAAG;AAC5C,gBAAY,QAAQ;AAAA,MAClB,GAAG,YAAY;AAAA,MACf,SAAS,EAAE,UAAU,OAAO;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,WAAW,SAAS,GAAG,aAAa,UAAU,KAAK,SAAS,kBAAkB;AACpF,MAAI,UAAU;AACZ,gBAAY,QAAQ;AAAA,MAClB,GAAG,YAAY;AAAA,MACf,UAAU,EAAE,oBAAoB,SAAS,UAAU,EAAE,EAAE;AAAA,IACzD;AAAA,EACF;AAEA,QAAM,QAAQ,SAAS,GAAG,aAAa,OAAO,KAAK,SAAS,eAAe;AAC3E,MAAI,OAAO;AACT,gBAAY,QAAQ;AAAA,MAClB,GAAG,YAAY;AAAA,MACf,OAAO,EAAE,cAAc,MAAM;AAAA,IAC/B;AAAA,EACF;AAEA,SAAO;AACT;;;AC3CA,SAAS,0BAA0B,KAAgC;AACjE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,IAAI;AAAA,EACN;AACF;AAMO,SAAS,4BAA4B,KAA2C;AACrF,SAAO,uBAAuB,IAAI,OAAwD;AAC5F;AAKA,SAAS,sBAAsB,KAAkC;AAE/D,QAAM,gBAAgB,IAAI,QAAQ,WAAW,KAAK,IAAI,QAAQ,WAAW;AACzE,MAAI,eAAe;AACjB,WAAO,MAAM,QAAQ,aAAa,IAAI,cAAc,CAAC,IAAI;AAAA,EAC3D;AAGA,MAAI,IAAI,MAAM,WAAW,OAAO,IAAI,MAAM,YAAY,UAAU;AAC9D,WAAO,IAAI,MAAM;AAAA,EACnB;AAGA,UAAQ,IAAI,QAAQ;AAAA,IAClB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,WAAW,SAAiB,MAAuB;AAE1D,QAAM,eAAe,QAClB,QAAQ,OAAO,IAAI,EACnB,QAAQ,OAAO,KAAK;AAEvB,QAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAKA,SAAS,gBACP,QACA,MACA,QAC+B;AAC/B,SAAO,OAAO,KAAK,CAAC,UAAU;AAC5B,UAAM,gBAAgB,MAAM,WAAW,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO,YAAY;AAChG,UAAM,cAAc,WAAW,MAAM,SAAS,IAAI;AAClD,WAAO,iBAAiB;AAAA,EAC1B,CAAC;AACH;AAKA,SAAS,gBACP,QACA,MACA,KACM;AACN,QAAM,aAAa,OAAO,WAAW,MAAM;AAE3C,MAAI,OAAO,UAAU,EAAE,KAAK;AAAA,IAC1B,SAAS;AAAA,IACT,OAAO;AAAA,MACL,MAAM,OAAO,WAAW,wBAAwB;AAAA,MAChD,SAAS,OAAO,gBAAgB,CAAC,KAAK;AAAA,MACtC,aAAa,OAAO;AAAA,MACpB,UAAU,OAAO;AAAA,IACnB;AAAA,EACF,CAAC;AACH;AAKO,SAAS,iBAAiB,SAAmD;AAClF,QAAM;AAAA,IACJ,SAAS,CAAC;AAAA,IACV,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,IAChB,YAAY,CAAC;AAAA,IACb,WAAW;AAAA,IACX,GAAG;AAAA,EACL,IAAI;AAEJ,SAAO,OAAO,KAAc,KAAe,SAAsC;AAC/E,QAAI;AAEF,YAAM,aAAa,UAAU,KAAK,CAAC,YAAY,WAAW,SAAS,IAAI,IAAI,CAAC;AAC5E,UAAI,YAAY;AACd,eAAO,KAAK;AAAA,MACd;AAGA,YAAM,cAAc,gBAAgB,QAAQ,IAAI,MAAM,IAAI,MAAM;AAGhE,UAAI,CAAC,aAAa;AAChB,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,YAAY,mBAAmB,QAAQ;AACzC,eAAO,KAAK;AAAA,MACd;AAGA,YAAM,cAAc,2BAChB,yBAAyB,GAAG,IAC5B,0BAA0B,GAAG;AAGjC,UAAI,CAAC,eAAe,WAAW,KAAK,YAAY,mBAAmB,YAAY;AAC7E,cAAMC,UAA6B;AAAA,UACjC,UAAU;AAAA,UACV,aAAa;AAAA,UACb,eAAe,CAAC,+BAA+B;AAAA,UAC/C,UAAU;AAAA,YACR,SAAS;AAAA,YACT,iBAAiB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,YAC1D,kBAAkB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,UAC7D;AAAA,UACA,YAAY,oBAAI,KAAK;AAAA,QACvB;AAEA,YAAI,oBAAoBA;AACxB,iBAASA,SAAQ,KAAK,GAAG;AACzB;AAAA,MACF;AAGA,YAAM,UAAU,uBACZ,qBAAqB,GAAG,IACxB,sBAAsB,GAAG;AAG7B,YAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,QAClC;AAAA,QACA;AAAA,QACA,QAAQ,IAAI,OAAO,YAAY;AAAA,QAC/B,UAAU,IAAI;AAAA,QACd,UAAU,IAAI;AAAA,QACd,WAAW,IAAI,QAAQ,YAAY;AAAA,MACrC,CAAC;AAGD,UAAI,oBAAoB;AAGxB,UAAI,CAAC,iBAAiB,OAAO,aAAa,YAAY,cAAc,GAAG;AACrE,iBAAS,QAAQ,KAAK,GAAG;AACzB;AAAA,MACF;AAGA,UAAI,YAAY,iBAAiB,OAAO,OAAO;AAC7C,YAAI,OAAO,MAAM,aAAa,YAAY,eAAe;AACvD,iBAAO,gBAAgB;AAAA,YACrB,eAAe,OAAO,MAAM,UAAU,sBAAsB,YAAY,aAAa;AAAA,UACvF;AACA,mBAAS,QAAQ,KAAK,GAAG;AACzB;AAAA,QACF;AAAA,MACF;AAGA,WAAK;AAAA,IACP,SAAS,OAAO;AAEd,cAAQ,MAAM,2CAA2C,KAAK;AAC9D,WAAK;AAAA,IACP;AAAA,EACF;AACF;AAKO,SAAS,cAAc,gBAA6B,SAAmD;AAC5G,SAAO,iBAAiB;AAAA,IACtB,GAAG;AAAA,IACH,QAAQ;AAAA,MACN,EAAE,SAAS,KAAK,QAAQ,KAAK,eAAe;AAAA,IAC9C;AAAA,EACF,CAAC;AACH;AAKO,SAAS,WAAW,SAAgF;AACzG,SAAO,iBAAiB;AAAA,IACtB,GAAG;AAAA,IACH,QAAQ;AAAA,MACN,EAAE,SAAS,KAAK,QAAQ,KAAK,gBAAgB,OAAO;AAAA,IACtD;AAAA,EACF,CAAC;AACH;","names":["result","result"]}

package/dist/adapters/nextjs.d.mts

@@ -0,0 +1,3 @@
+import 'next/server';
+import '../types-CS6v75-d.mjs';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-BtqyLSVQ.mjs';

package/dist/adapters/nextjs.d.ts

@@ -0,0 +1,3 @@
+import 'next/server';
+import '../types-CS6v75-d.js';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-C9FPOjSh.js';