@astrasyncai/verification-gateway 1.1.0 → 2.0.0

package/dist/adapters/nextjs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/nextjs.ts","../../src/access-levels.ts","../../src/verify.ts"],"sourcesContent":["/**\n * AstraSync Universal Verification Gateway - Next.js Middleware\n *\n * Next.js middleware for verifying AI agents on web applications.\n * Supports Commerce Shield overlay for unverified agents.\n *\n * @example\n * ```typescript\n * // middleware.ts\n * import { createMiddleware } from '@astrasyncai/verification-gateway/nextjs';\n *\n * export const middleware = createMiddleware({\n *   apiBaseUrl: 'https://api.astrasync.ai',\n *   showCommerceShield: true,\n *   routes: [\n *     { pattern: '/api/public/*', method: '*', minAccessLevel: 'none' },\n *     { pattern: '/api/*', method: '*', minAccessLevel: 'standard' },\n *     { pattern: '/dashboard/*', method: '*', minAccessLevel: 'read-only' },\n *   ],\n * });\n *\n * export const config = {\n *   matcher: ['/api/:path*', '/dashboard/:path*'],\n * };\n * ```\n */\n\nimport type { NextRequest } from 'next/server';\nimport type {\n  NextJsMiddlewareOptions,\n  AgentCredentials,\n  VerificationResult,\n  RouteAccessConfig,\n} from '../types';\nimport { verify, hasCredentials } from '../verify';\nimport { hasMinimumAccess } from '../access-levels';\n\n/**\n * Extract credentials from Next.js request\n */\nfunction extractCredentialsFromNextRequest(request: NextRequest): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers\n  const astraId = request.headers.get('x-astra-id') || request.headers.get('X-Astra-Id');\n  if (astraId) {\n    credentials.astraId = astraId;\n  }\n\n  // Check for API key\n  const apiKey = request.headers.get('x-api-key') || request.headers.get('X-Api-Key');\n  if (apiKey) {\n    credentials.apiKey = apiKey;\n  }\n\n  // Check Authorization header\n  const authHeader = request.headers.get('authorization');\n  if (authHeader) {\n    credentials.authorizationHeader = authHeader;\n    if (authHeader.startsWith('Bearer ')) {\n      credentials.jwt = authHeader.slice(7);\n    }\n  }\n\n  // Check query parameters\n  const url = new URL(request.url);\n  const astraIdParam = url.searchParams.get('astraId');\n  const apiKeyParam = url.searchParams.get('apiKey');\n\n  if (astraIdParam && !credentials.astraId) {\n    credentials.astraId = astraIdParam;\n  }\n  if (apiKeyParam && !credentials.apiKey) {\n    credentials.apiKey = apiKeyParam;\n  }\n\n  return credentials;\n}\n\n/**\n * Match a route pattern against a path\n */\nfunction matchRoute(pattern: string, path: string): boolean {\n  const regexPattern = pattern\n    .replace(/\\*/g, '.*')\n    .replace(/\\//g, '\\\\/');\n\n  const regex = new RegExp(`^${regexPattern}$`);\n  return regex.test(path);\n}\n\n/**\n * Find the route configuration for a request\n */\nfunction findRouteConfig(\n  routes: RouteAccessConfig[],\n  path: string,\n  method: string\n): RouteAccessConfig | undefined {\n  return routes.find((route) => {\n    const methodMatches = route.method === '*' || route.method.toUpperCase() === method.toUpperCase();\n    const pathMatches = matchRoute(route.pattern, path);\n    return methodMatches && pathMatches;\n  });\n}\n\n/**\n * Infer purpose from request method\n */\nfunction inferPurpose(method: string): string {\n  switch (method.toUpperCase()) {\n    case 'GET':\n      return 'read';\n    case 'POST':\n      return 'create';\n    case 'PUT':\n    case 'PATCH':\n      return 'update';\n    case 'DELETE':\n      return 'delete';\n    default:\n      return 'general';\n  }\n}\n\n/**\n * Generate Commerce Shield HTML response\n */\nfunction generateCommerceShieldHtml(\n  result: VerificationResult,\n  options: NextJsMiddlewareOptions\n): string {\n  const title = options.commerceShield?.title || 'AstraSync Agent Verification';\n  const message = options.commerceShield?.message ||\n    result.guidance?.message ||\n    'This site verifies AI agents before granting access. We noticed you\\'re visiting without AstraSync credentials.';\n  const registrationUrl = result.guidance?.registrationUrl || 'https://astrasync.ai/register';\n  const docsUrl = result.guidance?.documentationUrl || 'https://astrasync.ai/docs/agent-access';\n  const allowGuest = options.commerceShield?.allowGuestAccess ?? true;\n\n  return `\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>${title}</title>\n  <style>\n    * {\n      box-sizing: border-box;\n      margin: 0;\n      padding: 0;\n    }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;\n      background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .shield-container {\n      background: rgba(255, 255, 255, 0.95);\n      border-radius: 16px;\n      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);\n      max-width: 480px;\n      width: 100%;\n      padding: 40px;\n      text-align: center;\n    }\n    .shield-icon {\n      font-size: 48px;\n      margin-bottom: 20px;\n    }\n    .shield-title {\n      font-size: 24px;\n      font-weight: 700;\n      color: #1a1a2e;\n      margin-bottom: 16px;\n    }\n    .shield-message {\n      color: #4a5568;\n      line-height: 1.6;\n      margin-bottom: 24px;\n    }\n    .shield-steps {\n      text-align: left;\n      background: #f7fafc;\n      border-radius: 8px;\n      padding: 20px;\n      margin-bottom: 24px;\n    }\n    .shield-steps h3 {\n      font-size: 14px;\n      font-weight: 600;\n      color: #2d3748;\n      margin-bottom: 12px;\n    }\n    .shield-steps ol {\n      padding-left: 20px;\n      color: #4a5568;\n    }\n    .shield-steps li {\n      margin-bottom: 8px;\n    }\n    .shield-buttons {\n      display: flex;\n      flex-direction: column;\n      gap: 12px;\n    }\n    .btn {\n      display: inline-block;\n      padding: 14px 24px;\n      border-radius: 8px;\n      font-weight: 600;\n      text-decoration: none;\n      transition: all 0.2s;\n      cursor: pointer;\n      border: none;\n      font-size: 16px;\n    }\n    .btn-primary {\n      background: linear-gradient(135deg, #6366f1 0%, #4f46e5 100%);\n      color: white;\n    }\n    .btn-primary:hover {\n      transform: translateY(-2px);\n      box-shadow: 0 4px 12px rgba(99, 102, 241, 0.4);\n    }\n    .btn-secondary {\n      background: #e2e8f0;\n      color: #4a5568;\n    }\n    .btn-secondary:hover {\n      background: #cbd5e0;\n    }\n    .shield-footer {\n      margin-top: 24px;\n      font-size: 14px;\n      color: #718096;\n    }\n    .shield-footer a {\n      color: #6366f1;\n      text-decoration: none;\n    }\n    .shield-footer a:hover {\n      text-decoration: underline;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"shield-container\">\n    <div class=\"shield-icon\">🛡️</div>\n    <h1 class=\"shield-title\">${title}</h1>\n    <p class=\"shield-message\">${message}</p>\n\n    <div class=\"shield-steps\">\n      <h3>To get verified access:</h3>\n      <ol>\n        <li>Register at <a href=\"${registrationUrl}\">astrasync.ai/register</a></li>\n        <li>Create and register your agent</li>\n        <li>Add your ASTRA-ID to request headers</li>\n        <li>Refresh this page</li>\n      </ol>\n    </div>\n\n    <div class=\"shield-buttons\">\n      <a href=\"${registrationUrl}\" class=\"btn btn-primary\">Register Now</a>\n      ${allowGuest ? '<button onclick=\"window.location.reload()\" class=\"btn btn-secondary\">Continue as Guest (Limited)</button>' : ''}\n    </div>\n\n    <p class=\"shield-footer\">\n      Learn more: <a href=\"${docsUrl}\">Agent Access Documentation</a>\n    </p>\n  </div>\n</body>\n</html>\n  `.trim();\n}\n\n/**\n * Create Next.js middleware for agent verification\n */\nexport function createMiddleware(options: NextJsMiddlewareOptions) {\n  const {\n    routes = [],\n    skipPaths = [],\n    showCommerceShield = true,\n    ...config\n  } = options;\n\n  return async function middleware(request: NextRequest) {\n    // Dynamic import NextResponse to avoid build issues\n    const { NextResponse } = await import('next/server');\n\n    const pathname = request.nextUrl.pathname;\n\n    // Check if path should be skipped\n    const shouldSkip = skipPaths.some((pattern) => matchRoute(pattern, pathname));\n    if (shouldSkip) {\n      return NextResponse.next();\n    }\n\n    // Find route configuration\n    const routeConfig = findRouteConfig(routes, pathname, request.method);\n\n    // If no route config, allow through\n    if (!routeConfig) {\n      return NextResponse.next();\n    }\n\n    // If route requires 'none' access, allow through\n    if (routeConfig.minAccessLevel === 'none') {\n      return NextResponse.next();\n    }\n\n    // Extract credentials\n    const credentials = extractCredentialsFromNextRequest(request);\n\n    // If no credentials and not just guidance level\n    if (!hasCredentials(credentials) && routeConfig.minAccessLevel !== 'guidance') {\n      const result: VerificationResult = {\n        verified: false,\n        accessLevel: 'none',\n        denialReasons: ['No agent credentials provided'],\n        guidance: {\n          message: 'This page requires agent verification.',\n          registrationUrl: `${config.apiBaseUrl?.replace('/api', '')}/register`,\n          documentationUrl: `${config.apiBaseUrl?.replace('/api', '')}/docs/agent-access`,\n        },\n        verifiedAt: new Date(),\n      };\n\n      // For API routes, return JSON\n      if (pathname.startsWith('/api/')) {\n        return NextResponse.json(\n          {\n            success: false,\n            error: {\n              code: 'UNAUTHORIZED',\n              message: 'No agent credentials provided',\n              guidance: result.guidance,\n            },\n          },\n          { status: 401 }\n        );\n      }\n\n      // For web pages, show Commerce Shield\n      if (showCommerceShield) {\n        return new NextResponse(generateCommerceShieldHtml(result, options), {\n          status: 200,\n          headers: {\n            'Content-Type': 'text/html',\n            'X-AstraSync-Verification': 'commerce-shield',\n          },\n        });\n      }\n\n      // Otherwise redirect to login/register\n      const registerUrl = result.guidance?.registrationUrl || '/register';\n      return NextResponse.redirect(new URL(registerUrl, request.url));\n    }\n\n    // Verify the agent\n    const purpose = request.headers.get('x-purpose') || inferPurpose(request.method);\n    const result = await verify(config, {\n      credentials,\n      purpose,\n      action: request.method.toLowerCase(),\n      resource: pathname,\n      clientIp: request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || undefined,\n      userAgent: request.headers.get('user-agent') || undefined,\n    });\n\n    // Check if access level is sufficient\n    if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {\n      // For API routes, return JSON\n      if (pathname.startsWith('/api/')) {\n        return NextResponse.json(\n          {\n            success: false,\n            error: {\n              code: result.verified ? 'INSUFFICIENT_ACCESS' : 'UNAUTHORIZED',\n              message: result.denialReasons?.[0] || 'Access denied',\n              accessLevel: result.accessLevel,\n              required: routeConfig.minAccessLevel,\n              guidance: result.guidance,\n            },\n          },\n          { status: result.verified ? 403 : 401 }\n        );\n      }\n\n      // For web pages, show Commerce Shield\n      if (showCommerceShield) {\n        return new NextResponse(generateCommerceShieldHtml(result, options), {\n          status: 200,\n          headers: {\n            'Content-Type': 'text/html',\n            'X-AstraSync-Verification': 'commerce-shield',\n          },\n        });\n      }\n\n      // Redirect to unauthorized page\n      return NextResponse.redirect(new URL('/unauthorized', request.url));\n    }\n\n    // All checks passed - continue with verification info in headers\n    const response = NextResponse.next();\n\n    // Add verification info to response headers\n    response.headers.set('X-AstraSync-Verified', result.verified.toString());\n    response.headers.set('X-AstraSync-Access-Level', result.accessLevel);\n\n    if (result.agent) {\n      response.headers.set('X-AstraSync-Agent-Id', result.agent.astraId);\n      response.headers.set('X-AstraSync-Trust-Score', result.agent.trustScore.toString());\n    }\n\n    return response;\n  };\n}\n\n/**\n * Helper to create matcher config\n */\nexport function createMatcherConfig(paths: string[]): { matcher: string[] } {\n  return { matcher: paths };\n}\n","/**\n * AstraSync Universal Verification Gateway - Access Level Definitions\n *\n * Defines the hierarchy and capabilities of each access level.\n */\n\nimport type { AccessLevel, TrustLevel } from './types';\n\n/**\n * Access level hierarchy (higher number = more access)\n */\nexport const ACCESS_LEVEL_HIERARCHY: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 1,\n  'read-only': 2,\n  standard: 3,\n  full: 4,\n  internal: 5,\n};\n\n/**\n * Access level descriptions for UI\n */\nexport const ACCESS_LEVEL_DESCRIPTIONS: Record<AccessLevel, string> = {\n  none: 'No access - credentials required',\n  guidance: 'Guidance mode - registration information provided',\n  'read-only': 'Read-only access - can browse but not modify',\n  standard: 'Standard access - normal operations per PDLSS policy',\n  full: 'Full access - all operations for high-trust agents',\n  internal: 'Internal access - organization member privileges',\n};\n\n/**\n * Default trust score thresholds for access levels\n */\nexport const DEFAULT_TRUST_THRESHOLDS: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 0,\n  'read-only': 20,\n  standard: 40,\n  full: 70,\n  internal: 0, // Internal is based on org membership, not score\n};\n\n/**\n * Trust level score ranges\n */\nexport const TRUST_LEVEL_RANGES: Record<TrustLevel, { min: number; max: number }> = {\n  BRONZE: { min: 0, max: 39 },\n  SILVER: { min: 40, max: 59 },\n  GOLD: { min: 60, max: 79 },\n  PLATINUM: { min: 80, max: 100 },\n};\n\n/**\n * Determine trust level from score\n */\nexport function getTrustLevel(score: number): TrustLevel {\n  if (score >= 80) return 'PLATINUM';\n  if (score >= 60) return 'GOLD';\n  if (score >= 40) return 'SILVER';\n  return 'BRONZE';\n}\n\n/**\n * Check if access level A is greater than or equal to access level B\n */\nexport function hasMinimumAccess(actual: AccessLevel, required: AccessLevel): boolean {\n  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];\n}\n\n/**\n * Get the highest access level for a given trust score\n */\nexport function getAccessLevelForScore(\n  trustScore: number,\n  thresholds: Record<AccessLevel, number> = DEFAULT_TRUST_THRESHOLDS\n): AccessLevel {\n  if (trustScore >= thresholds.full) return 'full';\n  if (trustScore >= thresholds.standard) return 'standard';\n  if (trustScore >= thresholds['read-only']) return 'read-only';\n  return 'guidance';\n}\n\n/**\n * Determine access level from verification result\n */\nexport function determineAccessLevel(\n  verified: boolean,\n  trustScore: number,\n  isOrgMember: boolean,\n  customThresholds?: Partial<Record<AccessLevel, number>>\n): AccessLevel {\n  if (!verified) {\n    return 'guidance';\n  }\n\n  if (isOrgMember) {\n    return 'internal';\n  }\n\n  const thresholds = {\n    ...DEFAULT_TRUST_THRESHOLDS,\n    ...customThresholds,\n  };\n\n  return getAccessLevelForScore(trustScore, thresholds);\n}\n\n/**\n * Access capabilities per level\n */\nexport interface AccessCapabilities {\n  canRead: boolean;\n  canWrite: boolean;\n  canDelete: boolean;\n  canAdmin: boolean;\n  canAccessInternal: boolean;\n  maxTransactionValue?: number;\n  allowedPurposes?: string[];\n}\n\n/**\n * Get capabilities for an access level\n */\nexport function getCapabilities(accessLevel: AccessLevel): AccessCapabilities {\n  switch (accessLevel) {\n    case 'none':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'guidance':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'read-only':\n      return {\n        canRead: true,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'standard':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'full':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'internal':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: true,\n        canAccessInternal: true,\n      };\n    default:\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n  }\n}\n","/**\n * AstraSync Universal Verification Gateway - Core Verification Logic\n *\n * This module handles the core verification logic, calling the AstraSync API\n * and processing the response into a standardized VerificationResult.\n */\n\nimport type {\n  GatewayConfig,\n  AgentCredentials,\n  VerificationRequest,\n  VerificationResult,\n  VerifiedAgent,\n  VerifiedDeveloper,\n  VerifiedOrganization,\n  PDLSSInfo,\n  GuidanceInfo,\n  AccessLevel,\n  EnhancedVerificationResult,\n  TokenGuidance,\n  RuntimeChallengeResult,\n} from './types';\nimport { determineAccessLevel, getTrustLevel, ACCESS_LEVEL_HIERARCHY } from './access-levels';\n\n/**\n * Default configuration values\n */\nconst DEFAULT_CONFIG: Partial<GatewayConfig> = {\n  apiBaseUrl: 'https://api.astrasync.ai',\n  defaultAccessLevel: 'guidance',\n  minTrustScore: 40,\n  minTrustScoreForFull: 70,\n  cacheTtl: 300, // 5 minutes\n  debug: false,\n};\n\n/**\n * Simple in-memory cache for verification results\n */\nconst verificationCache = new Map<string, { result: VerificationResult; expiresAt: number }>();\n\n/**\n * Generate cache key from credentials\n */\nfunction getCacheKey(credentials: AgentCredentials): string {\n  return `${credentials.astraId || ''}-${credentials.apiKey || ''}-${credentials.jwt || ''}`;\n}\n\n/**\n * Check if cached result is still valid\n */\nfunction getCachedResult(credentials: AgentCredentials): VerificationResult | null {\n  const key = getCacheKey(credentials);\n  const cached = verificationCache.get(key);\n\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.result;\n  }\n\n  if (cached) {\n    verificationCache.delete(key);\n  }\n\n  return null;\n}\n\n/**\n * Cache a verification result\n */\nfunction cacheResult(credentials: AgentCredentials, result: VerificationResult, ttlSeconds: number): void {\n  const key = getCacheKey(credentials);\n  verificationCache.set(key, {\n    result,\n    expiresAt: Date.now() + ttlSeconds * 1000,\n  });\n}\n\n/**\n * Clear the verification cache\n */\nexport function clearCache(): void {\n  verificationCache.clear();\n}\n\n/**\n * Extract agent credentials from various sources\n */\nexport function extractCredentials(\n  headers: Record<string, string | string[] | undefined>,\n  query?: Record<string, string | undefined>\n): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers (case-insensitive)\n  const astraIdHeader = headers['x-astra-id'] || headers['X-Astra-Id'] || headers['X-ASTRA-ID'];\n  if (astraIdHeader) {\n    credentials.astraId = Array.isArray(astraIdHeader) ? astraIdHeader[0] : astraIdHeader;\n  }\n\n  // Check for API key in headers\n  const apiKeyHeader = headers['x-api-key'] || headers['X-Api-Key'] || headers['X-API-KEY'];\n  if (apiKeyHeader) {\n    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;\n  }\n\n  // Check Authorization header for Bearer token\n  const authHeader = headers['authorization'] || headers['Authorization'];\n  if (authHeader) {\n    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n    credentials.authorizationHeader = authValue;\n\n    if (authValue.startsWith('Bearer ')) {\n      credentials.jwt = authValue.slice(7);\n    }\n  }\n\n  // Check query parameters as fallback\n  if (query) {\n    if (query.astraId && !credentials.astraId) {\n      credentials.astraId = query.astraId;\n    }\n    if (query.apiKey && !credentials.apiKey) {\n      credentials.apiKey = query.apiKey;\n    }\n  }\n\n  return credentials;\n}\n\n/**\n * Check if credentials are present\n */\nexport function hasCredentials(credentials: AgentCredentials): boolean {\n  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);\n}\n\n/**\n * Create guidance response for unverified agents\n */\nfunction createGuidanceResponse(config: GatewayConfig, reason?: string): VerificationResult {\n  const guidance: GuidanceInfo = {\n    message: 'This service verifies AI agents before granting access. Please register your agent with AstraSync.',\n    registrationUrl: `${config.apiBaseUrl.replace('/api', '')}/register`,\n    documentationUrl: `${config.apiBaseUrl.replace('/api', '')}/docs/agent-access`,\n    steps: [\n      'Register for an AstraSync account',\n      'Create and register your agent',\n      'Add your ASTRA-ID to request headers',\n      'Retry your request',\n    ],\n  };\n\n  return {\n    verified: false,\n    accessLevel: 'guidance',\n    guidance,\n    denialReasons: reason ? [reason] : ['No valid agent credentials provided'],\n    verifiedAt: new Date(),\n  };\n}\n\n/**\n * Call the AstraSync verify-access API\n */\nasync function callVerifyAccessAPI(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<{\n  success: boolean;\n  access?: {\n    allowed: boolean;\n    reason?: string;\n    requiresStepUp?: boolean;\n    requiresApproval?: boolean;\n    appliedPolicy?: {\n      boundaryId: string;\n      boundaryName: string;\n      policyId: string;\n      policyVersion: string;\n    };\n    pdlss?: {\n      purposeAllowed: boolean;\n      withinDuration: boolean;\n      withinLimits: boolean;\n      scopeAllowed: boolean;\n      selfInstantiationAllowed: boolean;\n    };\n    counterparty?: {\n      id: string;\n      name: string;\n      trustScoreRequirement: number;\n    };\n  };\n  agent?: {\n    kyaAgentId: string;\n    astraId: string;\n    name: string;\n    trustScore: number;\n    trustLevel: string;\n    agentStatus: string;\n    blockchainStatus: string;\n  };\n  developer?: {\n    kyaOwnerId: string;\n    fullName: string;\n    email: string;\n    identityVerified: boolean;\n    trustScore: number;\n  };\n  organization?: {\n    name: string;\n    verified: boolean;\n    trustScore: number;\n  };\n  error?: string;\n}> {\n  const { credentials, ...requestData } = request;\n\n  // Build the request body\n  const body: Record<string, unknown> = {\n    agentId: credentials.astraId,\n    purpose: requestData.purpose || 'general',\n  };\n\n  // Add optional fields\n  if (requestData.action) body.action = requestData.action;\n  if (requestData.resourceType) body.resourceType = requestData.resourceType;\n  if (requestData.resource) body.resource = requestData.resource;\n  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;\n  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;\n  if (requestData.currency) body.currency = requestData.currency;\n  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;\n  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;\n  if (requestData.subAgentDepth !== undefined) body.subAgentDepth = requestData.subAgentDepth;\n  // Handshake Protocol v10 additions\n  if (requestData.enableRuntimeChallenge) body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;\n  if (requestData.createSession) body.createSession = requestData.createSession;\n  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;\n  if (requestData.counterpartyUrl) body.counterpartyUrl = requestData.counterpartyUrl;\n  if (requestData.runtimeChallengeOptions) body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;\n\n  // Build headers\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    ...config.customHeaders,\n  };\n\n  if (config.apiKey) {\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  if (credentials.authorizationHeader) {\n    headers['Authorization'] = credentials.authorizationHeader;\n  }\n\n  try {\n    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: data.message || data.error || `API returned ${response.status}`,\n      };\n    }\n\n    return data;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return {\n      success: false,\n      error: `Failed to call verify-access API: ${message}`,\n    };\n  }\n}\n\n/**\n * Main verification function\n */\nexport async function verify(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n\n  // Check for credentials\n  if (!hasCredentials(request.credentials)) {\n    return createGuidanceResponse(mergedConfig, 'No agent credentials provided');\n  }\n\n  // Check cache first\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {\n    const cached = getCachedResult(request.credentials);\n    if (cached) {\n      if (mergedConfig.debug) {\n        console.log('[VerificationGateway] Returning cached result');\n      }\n      return cached;\n    }\n  }\n\n  // Inject counterparty info from config if not already set in request\n  const enrichedRequest = { ...request };\n  if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {\n    enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;\n  }\n  if (!enrichedRequest.counterpartyType && mergedConfig.counterpartyType) {\n    enrichedRequest.counterpartyType = mergedConfig.counterpartyType;\n  }\n\n  // Call the API\n  if (mergedConfig.debug) {\n    console.log('[VerificationGateway] Calling verify-access API');\n  }\n\n  const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);\n\n  // Handle API errors\n  if (!apiResponse.success) {\n    return createGuidanceResponse(mergedConfig, apiResponse.error);\n  }\n\n  // Check access result\n  if (!apiResponse.access?.allowed) {\n    const result: EnhancedVerificationResult = {\n      verified: false,\n      accessLevel: 'guidance',\n      denialReasons: apiResponse.access?.reason ? [apiResponse.access.reason] : ['Access denied'],\n      requiresStepUp: apiResponse.access?.requiresStepUp,\n      requiresApproval: apiResponse.access?.requiresApproval,\n      guidance: {\n        message: apiResponse.access?.reason || 'Access denied by PDLSS policy',\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/pdlss`,\n      },\n      verifiedAt: new Date(),\n      // Extract sessionId so decisions can be recorded for denials too\n      sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n      recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n      recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n    };\n\n    return result;\n  }\n\n  // Build successful result\n  const agent: VerifiedAgent | undefined = apiResponse.agent\n    ? {\n        astraId: apiResponse.agent.astraId,\n        name: apiResponse.agent.name,\n        trustScore: apiResponse.agent.trustScore,\n        trustLevel: getTrustLevel(apiResponse.agent.trustScore),\n        blockchainVerified: apiResponse.agent.blockchainStatus === 'verified',\n        status: apiResponse.agent.agentStatus as VerifiedAgent['status'],\n      }\n    : undefined;\n\n  const developer: VerifiedDeveloper | undefined = apiResponse.developer\n    ? {\n        astradId: apiResponse.developer.kyaOwnerId,\n        name: apiResponse.developer.fullName,\n        trustScore: apiResponse.developer.trustScore || 0,\n        verified: apiResponse.developer.identityVerified,\n      }\n    : undefined;\n\n  const organization: VerifiedOrganization | undefined = apiResponse.organization\n    ? {\n        name: apiResponse.organization.name,\n        verified: apiResponse.organization.verified,\n        trustScore: apiResponse.organization.trustScore,\n      }\n    : undefined;\n\n  const pdlss: PDLSSInfo | undefined = apiResponse.access?.pdlss\n    ? {\n        purposeAllowed: apiResponse.access.pdlss.purposeAllowed,\n        withinDuration: apiResponse.access.pdlss.withinDuration,\n        withinLimits: apiResponse.access.pdlss.withinLimits,\n        scopeAllowed: apiResponse.access.pdlss.scopeAllowed,\n        selfInstantiationAllowed: apiResponse.access.pdlss.selfInstantiationAllowed,\n        appliedPolicy: apiResponse.access.appliedPolicy,\n      }\n    : undefined;\n\n  // Determine access level based on trust score\n  const trustScore = agent?.trustScore || 0;\n  const isOrgMember = false; // TODO: Check if agent belongs to same org as counterparty\n  const accessLevel: AccessLevel = determineAccessLevel(\n    true,\n    trustScore,\n    isOrgMember,\n    {\n      'read-only': 20,\n      standard: mergedConfig.minTrustScore || 40,\n      full: mergedConfig.minTrustScoreForFull || 70,\n    }\n  );\n\n  const result: EnhancedVerificationResult = {\n    verified: true,\n    accessLevel,\n    agent,\n    developer,\n    organization,\n    pdlss,\n    requiresStepUp: apiResponse.access?.requiresStepUp,\n    requiresApproval: apiResponse.access?.requiresApproval,\n    verifiedAt: new Date(),\n    cacheTtl: mergedConfig.cacheTtl,\n    // Handshake Protocol v10 enhanced fields (present when backend returns them)\n    sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n    runtimeChallenge: (apiResponse as Record<string, unknown>).runtimeChallenge as RuntimeChallengeResult | undefined,\n    tokenGuidance: (apiResponse as Record<string, unknown>).tokenGuidance as TokenGuidance | undefined,\n    recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n    recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n  };\n\n  // Enforce AstraSync recommendation\n  if (result.recommendation === 'deny') {\n    result.verified = false;\n    result.accessLevel = 'none';\n    result.denialReasons = result.recommendationReasons || ['Access denied by AstraSync recommendation'];\n    if (result.runtimeChallenge) {\n      result.guidance = {\n        message: `Verification failed: ${result.runtimeChallenge.reason || 'runtime challenge failed'}`,\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/runtime-challenge`,\n      };\n    }\n  } else if (result.recommendation === 'step_up_required') {\n    result.requiresStepUp = true;\n    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY['read-only']) {\n      result.accessLevel = 'read-only';\n    }\n    result.denialReasons = result.recommendationReasons || ['Step-up verification required'];\n  }\n\n  // Cache the result (skip caching denials — agent may fix challenge endpoint and retry)\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== 'deny') {\n    cacheResult(request.credentials, result, mergedConfig.cacheTtl);\n  }\n\n  return result;\n}\n\n/**\n * Record a counterparty's grant/deny decision for a verification session.\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function recordDecision(\n  config: GatewayConfig,\n  sessionId: string,\n  decision: 'granted' | 'denied',\n  reason?: string,\n): Promise<void> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) headers['X-API-Key'] = config.apiKey;\n\n  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {\n    method: 'POST',\n    headers,\n    body: JSON.stringify({ decision, reason }),\n  }).catch(() => { /* fire-and-forget */ });\n}\n\n/**\n * Verify an agent AND automatically record the grant/deny decision.\n *\n * This is the recommended entry point for counterparties that call verify()\n * directly (e.g. MCP servers) rather than using createMiddleware().\n * It adds createSession: true, then fire-and-forgets the decision.\n */\nexport async function verifyAndRecord(\n  config: GatewayConfig,\n  request: VerificationRequest,\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n  const result = await verify(mergedConfig, { ...request, createSession: true });\n  const sessionId = (result as EnhancedVerificationResult).sessionId;\n\n  if (sessionId) {\n    if (result.verified) {\n      recordDecision(mergedConfig, sessionId, 'granted').catch(() => {});\n    } else {\n      recordDecision(mergedConfig, sessionId, 'denied', result.denialReasons?.[0]).catch(() => {});\n    }\n  }\n\n  return result;\n}\n\n/**\n * Quick verification - just check if credentials are valid\n */\nexport async function quickVerify(\n  config: GatewayConfig,\n  credentials: AgentCredentials\n): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n  const result = await verify(config, {\n    credentials,\n    purpose: 'verification',\n  });\n\n  return {\n    verified: result.verified,\n    accessLevel: result.accessLevel,\n    reason: result.denialReasons?.[0],\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACWO,IAAM,yBAAsD;AAAA,EACjE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AACZ;AAiBO,IAAM,2BAAwD;AAAA,EACnE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA;AACZ;AAeO,SAAS,cAAc,OAA2B;AACvD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAKO,SAAS,iBAAiB,QAAqB,UAAgC;AACpF,SAAO,uBAAuB,MAAM,KAAK,uBAAuB,QAAQ;AAC1E;AAKO,SAAS,uBACd,YACA,aAA0C,0BAC7B;AACb,MAAI,cAAc,WAAW,KAAM,QAAO;AAC1C,MAAI,cAAc,WAAW,SAAU,QAAO;AAC9C,MAAI,cAAc,WAAW,WAAW,EAAG,QAAO;AAClD,SAAO;AACT;AAKO,SAAS,qBACd,UACA,YACA,aACA,kBACa;AACb,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AAEA,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,uBAAuB,YAAY,UAAU;AACtD;;;AChFA,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AAAA;AAAA,EACV,OAAO;AACT;AAKA,IAAM,oBAAoB,oBAAI,IAA+D;AAK7F,SAAS,YAAY,aAAuC;AAC1D,SAAO,GAAG,YAAY,WAAW,EAAE,IAAI,YAAY,UAAU,EAAE,IAAI,YAAY,OAAO,EAAE;AAC1F;AAKA,SAAS,gBAAgB,aAA0D;AACjF,QAAM,MAAM,YAAY,WAAW;AACnC,QAAM,SAAS,kBAAkB,IAAI,GAAG;AAExC,MAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,QAAQ;AACV,sBAAkB,OAAO,GAAG;AAAA,EAC9B;AAEA,SAAO;AACT;AAKA,SAAS,YAAY,aAA+B,QAA4B,YAA0B;AACxG,QAAM,MAAM,YAAY,WAAW;AACnC,oBAAkB,IAAI,KAAK;AAAA,IACzB;AAAA,IACA,WAAW,KAAK,IAAI,IAAI,aAAa;AAAA,EACvC,CAAC;AACH;AAyDO,SAAS,eAAe,aAAwC;AACrE,SAAO,CAAC,EAAE,YAAY,WAAW,YAAY,UAAU,YAAY;AACrE;AAKA,SAAS,uBAAuB,QAAuB,QAAqC;AAC1F,QAAM,WAAyB;AAAA,IAC7B,SAAS;AAAA,IACT,iBAAiB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IACzD,kBAAkB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,aAAa;AAAA,IACb;AAAA,IACA,eAAe,SAAS,CAAC,MAAM,IAAI,CAAC,qCAAqC;AAAA,IACzE,YAAY,oBAAI,KAAK;AAAA,EACvB;AACF;AAKA,eAAe,oBACb,QACA,SAiDC;AACD,QAAM,EAAE,aAAa,GAAG,YAAY,IAAI;AAGxC,QAAM,OAAgC;AAAA,IACpC,SAAS,YAAY;AAAA,IACrB,SAAS,YAAY,WAAW;AAAA,EAClC;AAGA,MAAI,YAAY,OAAQ,MAAK,SAAS,YAAY;AAClD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,kBAAmB,MAAK,oBAAoB,YAAY;AACxE,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,kBAAkB,OAAW,MAAK,gBAAgB,YAAY;AAE9E,MAAI,YAAY,uBAAwB,MAAK,yBAAyB,YAAY;AAClF,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,gBAAiB,MAAK,kBAAkB,YAAY;AACpE,MAAI,YAAY,wBAAyB,MAAK,0BAA0B,YAAY;AAGpF,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAG,OAAO;AAAA,EACZ;AAEA,MAAI,OAAO,QAAQ;AACjB,YAAQ,WAAW,IAAI,OAAO;AAAA,EAChC;AAEA,MAAI,YAAY,qBAAqB;AACnC,YAAQ,eAAe,IAAI,YAAY;AAAA,EACzC;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAG,OAAO,UAAU,yBAAyB;AAAA,MACxE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,WAAW,KAAK,SAAS,gBAAgB,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,qCAAqC,OAAO;AAAA,IACrD;AAAA,EACF;AACF;AAKA,eAAsB,OACpB,QACA,SAC6B;AAC7B,QAAM,eAAe,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAGpD,MAAI,CAAC,eAAe,QAAQ,WAAW,GAAG;AACxC,WAAO,uBAAuB,cAAc,+BAA+B;AAAA,EAC7E;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,GAAG;AACtD,UAAM,SAAS,gBAAgB,QAAQ,WAAW;AAClD,QAAI,QAAQ;AACV,UAAI,aAAa,OAAO;AACtB,gBAAQ,IAAI,+CAA+C;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAI,CAAC,gBAAgB,mBAAmB,aAAa,iBAAiB;AACpE,oBAAgB,kBAAkB,aAAa;AAAA,EACjD;AACA,MAAI,CAAC,gBAAgB,oBAAoB,aAAa,kBAAkB;AACtE,oBAAgB,mBAAmB,aAAa;AAAA,EAClD;AAGA,MAAI,aAAa,OAAO;AACtB,YAAQ,IAAI,iDAAiD;AAAA,EAC/D;AAEA,QAAM,cAAc,MAAM,oBAAoB,cAAc,eAAe;AAG3E,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,uBAAuB,cAAc,YAAY,KAAK;AAAA,EAC/D;AAGA,MAAI,CAAC,YAAY,QAAQ,SAAS;AAChC,UAAMA,UAAqC;AAAA,MACzC,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,YAAY,QAAQ,SAAS,CAAC,YAAY,OAAO,MAAM,IAAI,CAAC,eAAe;AAAA,MAC1F,gBAAgB,YAAY,QAAQ;AAAA,MACpC,kBAAkB,YAAY,QAAQ;AAAA,MACtC,UAAU;AAAA,QACR,SAAS,YAAY,QAAQ,UAAU;AAAA,QACvC,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA;AAAA,MAErB,WAAY,YAAwC;AAAA,MACpD,gBAAiB,YAAwC;AAAA,MACzD,uBAAwB,YAAwC;AAAA,IAClE;AAEA,WAAOA;AAAA,EACT;AAGA,QAAM,QAAmC,YAAY,QACjD;AAAA,IACE,SAAS,YAAY,MAAM;AAAA,IAC3B,MAAM,YAAY,MAAM;AAAA,IACxB,YAAY,YAAY,MAAM;AAAA,IAC9B,YAAY,cAAc,YAAY,MAAM,UAAU;AAAA,IACtD,oBAAoB,YAAY,MAAM,qBAAqB;AAAA,IAC3D,QAAQ,YAAY,MAAM;AAAA,EAC5B,IACA;AAEJ,QAAM,YAA2C,YAAY,YACzD;AAAA,IACE,UAAU,YAAY,UAAU;AAAA,IAChC,MAAM,YAAY,UAAU;AAAA,IAC5B,YAAY,YAAY,UAAU,cAAc;AAAA,IAChD,UAAU,YAAY,UAAU;AAAA,EAClC,IACA;AAEJ,QAAM,eAAiD,YAAY,eAC/D;AAAA,IACE,MAAM,YAAY,aAAa;AAAA,IAC/B,UAAU,YAAY,aAAa;AAAA,IACnC,YAAY,YAAY,aAAa;AAAA,EACvC,IACA;AAEJ,QAAM,QAA+B,YAAY,QAAQ,QACrD;AAAA,IACE,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,0BAA0B,YAAY,OAAO,MAAM;AAAA,IACnD,eAAe,YAAY,OAAO;AAAA,EACpC,IACA;AAGJ,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc;AACpB,QAAM,cAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,UAAU,aAAa,iBAAiB;AAAA,MACxC,MAAM,aAAa,wBAAwB;AAAA,IAC7C;AAAA,EACF;AAEA,QAAM,SAAqC;AAAA,IACzC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,YAAY,QAAQ;AAAA,IACpC,kBAAkB,YAAY,QAAQ;AAAA,IACtC,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,aAAa;AAAA;AAAA,IAEvB,WAAY,YAAwC;AAAA,IACpD,kBAAmB,YAAwC;AAAA,IAC3D,eAAgB,YAAwC;AAAA,IACxD,gBAAiB,YAAwC;AAAA,IACzD,uBAAwB,YAAwC;AAAA,EAClE;AAGA,MAAI,OAAO,mBAAmB,QAAQ;AACpC,WAAO,WAAW;AAClB,WAAO,cAAc;AACrB,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,2CAA2C;AACnG,QAAI,OAAO,kBAAkB;AAC3B,aAAO,WAAW;AAAA,QAChB,SAAS,wBAAwB,OAAO,iBAAiB,UAAU,0BAA0B;AAAA,QAC7F,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF,WAAW,OAAO,mBAAmB,oBAAoB;AACvD,WAAO,iBAAiB;AACxB,QAAI,uBAAuB,OAAO,WAAW,IAAI,uBAAuB,WAAW,GAAG;AACpF,aAAO,cAAc;AAAA,IACvB;AACA,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,+BAA+B;AAAA,EACzF;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,KAAK,OAAO,mBAAmB,QAAQ;AAC1F,gBAAY,QAAQ,aAAa,QAAQ,aAAa,QAAQ;AAAA,EAChE;AAEA,SAAO;AACT;;;AFzZA,SAAS,kCAAkC,SAAwC;AACjF,QAAM,cAAgC,CAAC;AAGvC,QAAM,UAAU,QAAQ,QAAQ,IAAI,YAAY,KAAK,QAAQ,QAAQ,IAAI,YAAY;AACrF,MAAI,SAAS;AACX,gBAAY,UAAU;AAAA,EACxB;AAGA,QAAM,SAAS,QAAQ,QAAQ,IAAI,WAAW,KAAK,QAAQ,QAAQ,IAAI,WAAW;AAClF,MAAI,QAAQ;AACV,gBAAY,SAAS;AAAA,EACvB;AAGA,QAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,MAAI,YAAY;AACd,gBAAY,sBAAsB;AAClC,QAAI,WAAW,WAAW,SAAS,GAAG;AACpC,kBAAY,MAAM,WAAW,MAAM,CAAC;AAAA,IACtC;AAAA,EACF;AAGA,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,eAAe,IAAI,aAAa,IAAI,SAAS;AACnD,QAAM,cAAc,IAAI,aAAa,IAAI,QAAQ;AAEjD,MAAI,gBAAgB,CAAC,YAAY,SAAS;AACxC,gBAAY,UAAU;AAAA,EACxB;AACA,MAAI,eAAe,CAAC,YAAY,QAAQ;AACtC,gBAAY,SAAS;AAAA,EACvB;AAEA,SAAO;AACT;AAKA,SAAS,WAAW,SAAiB,MAAuB;AAC1D,QAAM,eAAe,QAClB,QAAQ,OAAO,IAAI,EACnB,QAAQ,OAAO,KAAK;AAEvB,QAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAKA,SAAS,gBACP,QACA,MACA,QAC+B;AAC/B,SAAO,OAAO,KAAK,CAAC,UAAU;AAC5B,UAAM,gBAAgB,MAAM,WAAW,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO,YAAY;AAChG,UAAM,cAAc,WAAW,MAAM,SAAS,IAAI;AAClD,WAAO,iBAAiB;AAAA,EAC1B,CAAC;AACH;AAKA,SAAS,aAAa,QAAwB;AAC5C,UAAQ,OAAO,YAAY,GAAG;AAAA,IAC5B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,2BACP,QACA,SACQ;AACR,QAAM,QAAQ,QAAQ,gBAAgB,SAAS;AAC/C,QAAM,UAAU,QAAQ,gBAAgB,WACtC,OAAO,UAAU,WACjB;AACF,QAAM,kBAAkB,OAAO,UAAU,mBAAmB;AAC5D,QAAM,UAAU,OAAO,UAAU,oBAAoB;AACrD,QAAM,aAAa,QAAQ,gBAAgB,oBAAoB;AAE/D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAME,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BA4Ge,KAAK;AAAA,gCACJ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,mCAKJ,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAQjC,eAAe;AAAA,QACxB,aAAa,8GAA8G,EAAE;AAAA;AAAA;AAAA;AAAA,6BAIxG,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhC,KAAK;AACT;AAKO,SAAS,iBAAiB,SAAkC;AACjE,QAAM;AAAA,IACJ,SAAS,CAAC;AAAA,IACV,YAAY,CAAC;AAAA,IACb,qBAAqB;AAAA,IACrB,GAAG;AAAA,EACL,IAAI;AAEJ,SAAO,eAAe,WAAW,SAAsB;AAErD,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,aAAa;AAEnD,UAAM,WAAW,QAAQ,QAAQ;AAGjC,UAAM,aAAa,UAAU,KAAK,CAAC,YAAY,WAAW,SAAS,QAAQ,CAAC;AAC5E,QAAI,YAAY;AACd,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,cAAc,gBAAgB,QAAQ,UAAU,QAAQ,MAAM;AAGpE,QAAI,CAAC,aAAa;AAChB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,YAAY,mBAAmB,QAAQ;AACzC,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,cAAc,kCAAkC,OAAO;AAG7D,QAAI,CAAC,eAAe,WAAW,KAAK,YAAY,mBAAmB,YAAY;AAC7E,YAAMC,UAA6B;AAAA,QACjC,UAAU;AAAA,QACV,aAAa;AAAA,QACb,eAAe,CAAC,+BAA+B;AAAA,QAC/C,UAAU;AAAA,UACR,SAAS;AAAA,UACT,iBAAiB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,UAC1D,kBAAkB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAC7D;AAAA,QACA,YAAY,oBAAI,KAAK;AAAA,MACvB;AAGA,UAAI,SAAS,WAAW,OAAO,GAAG;AAChC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,UAAUA,QAAO;AAAA,YACnB;AAAA,UACF;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAGA,UAAI,oBAAoB;AACtB,eAAO,IAAI,aAAa,2BAA2BA,SAAQ,OAAO,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,4BAA4B;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAGA,YAAM,cAAcA,QAAO,UAAU,mBAAmB;AACxD,aAAO,aAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAAA,IAChE;AAGA,UAAM,UAAU,QAAQ,QAAQ,IAAI,WAAW,KAAK,aAAa,QAAQ,MAAM;AAC/E,UAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,MAClC;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ,OAAO,YAAY;AAAA,MACnC,UAAU;AAAA,MACV,UAAU,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAAA,MAC3E,WAAW,QAAQ,QAAQ,IAAI,YAAY,KAAK;AAAA,IAClD,CAAC;AAGD,QAAI,CAAC,iBAAiB,OAAO,aAAa,YAAY,cAAc,GAAG;AAErE,UAAI,SAAS,WAAW,OAAO,GAAG;AAChC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM,OAAO,WAAW,wBAAwB;AAAA,cAChD,SAAS,OAAO,gBAAgB,CAAC,KAAK;AAAA,cACtC,aAAa,OAAO;AAAA,cACpB,UAAU,YAAY;AAAA,cACtB,UAAU,OAAO;AAAA,YACnB;AAAA,UACF;AAAA,UACA,EAAE,QAAQ,OAAO,WAAW,MAAM,IAAI;AAAA,QACxC;AAAA,MACF;AAGA,UAAI,oBAAoB;AACtB,eAAO,IAAI,aAAa,2BAA2B,QAAQ,OAAO,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,4BAA4B;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAGA,aAAO,aAAa,SAAS,IAAI,IAAI,iBAAiB,QAAQ,GAAG,CAAC;AAAA,IACpE;AAGA,UAAM,WAAW,aAAa,KAAK;AAGnC,aAAS,QAAQ,IAAI,wBAAwB,OAAO,SAAS,SAAS,CAAC;AACvE,aAAS,QAAQ,IAAI,4BAA4B,OAAO,WAAW;AAEnE,QAAI,OAAO,OAAO;AAChB,eAAS,QAAQ,IAAI,wBAAwB,OAAO,MAAM,OAAO;AACjE,eAAS,QAAQ,IAAI,2BAA2B,OAAO,MAAM,WAAW,SAAS,CAAC;AAAA,IACpF;AAEA,WAAO;AAAA,EACT;AACF;AAKO,SAAS,oBAAoB,OAAwC;AAC1E,SAAO,EAAE,SAAS,MAAM;AAC1B;","names":["result","result"]}
+{"version":3,"sources":["../../src/adapters/nextjs.ts","../../src/access-levels.ts","../../src/verify.ts"],"sourcesContent":["/**\n * AstraSync Universal Verification Gateway - Next.js Middleware\n *\n * Next.js middleware for verifying AI agents on web applications.\n * Supports Commerce Shield overlay for unverified agents.\n *\n * @example\n * ```typescript\n * // middleware.ts\n * import { createMiddleware } from '@astrasyncai/verification-gateway/nextjs';\n *\n * export const middleware = createMiddleware({\n *   apiBaseUrl: 'https://api.astrasync.ai',\n *   showCommerceShield: true,\n *   routes: [\n *     { pattern: '/api/public/*', method: '*', minAccessLevel: 'none' },\n *     { pattern: '/api/*', method: '*', minAccessLevel: 'standard' },\n *     { pattern: '/dashboard/*', method: '*', minAccessLevel: 'read-only' },\n *   ],\n * });\n *\n * export const config = {\n *   matcher: ['/api/:path*', '/dashboard/:path*'],\n * };\n * ```\n */\n\nimport type { NextRequest } from 'next/server';\nimport type {\n  NextJsMiddlewareOptions,\n  AgentCredentials,\n  VerificationResult,\n  RouteAccessConfig,\n} from '../types';\nimport { verify, hasCredentials } from '../verify';\nimport { hasMinimumAccess } from '../access-levels';\n\n/**\n * Extract credentials from Next.js request\n */\nfunction extractCredentialsFromNextRequest(request: NextRequest): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers\n  const astraId = request.headers.get('x-astra-id') || request.headers.get('X-Astra-Id');\n  if (astraId) {\n    credentials.astraId = astraId;\n  }\n\n  // Check for API key\n  const apiKey = request.headers.get('x-api-key') || request.headers.get('X-Api-Key');\n  if (apiKey) {\n    credentials.apiKey = apiKey;\n  }\n\n  // Check Authorization header\n  const authHeader = request.headers.get('authorization');\n  if (authHeader) {\n    credentials.authorizationHeader = authHeader;\n    if (authHeader.startsWith('Bearer ')) {\n      credentials.jwt = authHeader.slice(7);\n    }\n  }\n\n  // Check query parameters\n  const url = new URL(request.url);\n  const astraIdParam = url.searchParams.get('astraId');\n  const apiKeyParam = url.searchParams.get('apiKey');\n\n  if (astraIdParam && !credentials.astraId) {\n    credentials.astraId = astraIdParam;\n  }\n  if (apiKeyParam && !credentials.apiKey) {\n    credentials.apiKey = apiKeyParam;\n  }\n\n  return credentials;\n}\n\n/**\n * Match a route pattern against a path\n */\nfunction matchRoute(pattern: string, path: string): boolean {\n  const regexPattern = pattern.replace(/\\*/g, '.*').replace(/\\//g, '\\\\/');\n\n  const regex = new RegExp(`^${regexPattern}$`);\n  return regex.test(path);\n}\n\n/**\n * Find the route configuration for a request\n */\nfunction findRouteConfig(\n  routes: RouteAccessConfig[],\n  path: string,\n  method: string\n): RouteAccessConfig | undefined {\n  return routes.find((route) => {\n    const methodMatches =\n      route.method === '*' || route.method.toUpperCase() === method.toUpperCase();\n    const pathMatches = matchRoute(route.pattern, path);\n    return methodMatches && pathMatches;\n  });\n}\n\n/**\n * Infer purpose from request method\n */\nfunction inferPurpose(method: string): string {\n  switch (method.toUpperCase()) {\n    case 'GET':\n      return 'read';\n    case 'POST':\n      return 'create';\n    case 'PUT':\n    case 'PATCH':\n      return 'update';\n    case 'DELETE':\n      return 'delete';\n    default:\n      return 'general';\n  }\n}\n\n/**\n * Generate Commerce Shield HTML response\n */\nfunction generateCommerceShieldHtml(\n  result: VerificationResult,\n  options: NextJsMiddlewareOptions\n): string {\n  const title = options.commerceShield?.title || 'AstraSync Agent Verification';\n  const message =\n    options.commerceShield?.message ||\n    result.guidance?.message ||\n    \"This site verifies AI agents before granting access. We noticed you're visiting without AstraSync credentials.\";\n  const registrationUrl = result.guidance?.registrationUrl || 'https://astrasync.ai/register';\n  const docsUrl = result.guidance?.documentationUrl || 'https://astrasync.ai/docs/agent-access';\n  const allowGuest = options.commerceShield?.allowGuestAccess ?? true;\n\n  return `\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>${title}</title>\n  <style>\n    * {\n      box-sizing: border-box;\n      margin: 0;\n      padding: 0;\n    }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;\n      background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .shield-container {\n      background: rgba(255, 255, 255, 0.95);\n      border-radius: 16px;\n      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);\n      max-width: 480px;\n      width: 100%;\n      padding: 40px;\n      text-align: center;\n    }\n    .shield-icon {\n      font-size: 48px;\n      margin-bottom: 20px;\n    }\n    .shield-title {\n      font-size: 24px;\n      font-weight: 700;\n      color: #1a1a2e;\n      margin-bottom: 16px;\n    }\n    .shield-message {\n      color: #4a5568;\n      line-height: 1.6;\n      margin-bottom: 24px;\n    }\n    .shield-steps {\n      text-align: left;\n      background: #f7fafc;\n      border-radius: 8px;\n      padding: 20px;\n      margin-bottom: 24px;\n    }\n    .shield-steps h3 {\n      font-size: 14px;\n      font-weight: 600;\n      color: #2d3748;\n      margin-bottom: 12px;\n    }\n    .shield-steps ol {\n      padding-left: 20px;\n      color: #4a5568;\n    }\n    .shield-steps li {\n      margin-bottom: 8px;\n    }\n    .shield-buttons {\n      display: flex;\n      flex-direction: column;\n      gap: 12px;\n    }\n    .btn {\n      display: inline-block;\n      padding: 14px 24px;\n      border-radius: 8px;\n      font-weight: 600;\n      text-decoration: none;\n      transition: all 0.2s;\n      cursor: pointer;\n      border: none;\n      font-size: 16px;\n    }\n    .btn-primary {\n      background: linear-gradient(135deg, #6366f1 0%, #4f46e5 100%);\n      color: white;\n    }\n    .btn-primary:hover {\n      transform: translateY(-2px);\n      box-shadow: 0 4px 12px rgba(99, 102, 241, 0.4);\n    }\n    .btn-secondary {\n      background: #e2e8f0;\n      color: #4a5568;\n    }\n    .btn-secondary:hover {\n      background: #cbd5e0;\n    }\n    .shield-footer {\n      margin-top: 24px;\n      font-size: 14px;\n      color: #718096;\n    }\n    .shield-footer a {\n      color: #6366f1;\n      text-decoration: none;\n    }\n    .shield-footer a:hover {\n      text-decoration: underline;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"shield-container\">\n    <div class=\"shield-icon\">🛡️</div>\n    <h1 class=\"shield-title\">${title}</h1>\n    <p class=\"shield-message\">${message}</p>\n\n    <div class=\"shield-steps\">\n      <h3>To get verified access:</h3>\n      <ol>\n        <li>Register at <a href=\"${registrationUrl}\">astrasync.ai/register</a></li>\n        <li>Create and register your agent</li>\n        <li>Add your ASTRA-ID to request headers</li>\n        <li>Refresh this page</li>\n      </ol>\n    </div>\n\n    <div class=\"shield-buttons\">\n      <a href=\"${registrationUrl}\" class=\"btn btn-primary\">Register Now</a>\n      ${allowGuest ? '<button onclick=\"window.location.reload()\" class=\"btn btn-secondary\">Continue as Guest (Limited)</button>' : ''}\n    </div>\n\n    <p class=\"shield-footer\">\n      Learn more: <a href=\"${docsUrl}\">Agent Access Documentation</a>\n    </p>\n  </div>\n</body>\n</html>\n  `.trim();\n}\n\n/**\n * Create Next.js middleware for agent verification\n */\nexport function createMiddleware(options: NextJsMiddlewareOptions) {\n  const { routes = [], skipPaths = [], showCommerceShield = true, ...config } = options;\n\n  return async function middleware(request: NextRequest) {\n    // Dynamic import NextResponse to avoid build issues\n    const { NextResponse } = await import('next/server');\n\n    const pathname = request.nextUrl.pathname;\n\n    // Check if path should be skipped\n    const shouldSkip = skipPaths.some((pattern) => matchRoute(pattern, pathname));\n    if (shouldSkip) {\n      return NextResponse.next();\n    }\n\n    // Find route configuration\n    const routeConfig = findRouteConfig(routes, pathname, request.method);\n\n    // If no route config, allow through\n    if (!routeConfig) {\n      return NextResponse.next();\n    }\n\n    // If route requires 'none' access, allow through\n    if (routeConfig.minAccessLevel === 'none') {\n      return NextResponse.next();\n    }\n\n    // Extract credentials\n    const credentials = extractCredentialsFromNextRequest(request);\n\n    // If no credentials and not just guidance level\n    if (!hasCredentials(credentials) && routeConfig.minAccessLevel !== 'guidance') {\n      const result: VerificationResult = {\n        verified: false,\n        accessLevel: 'none',\n        denialReasons: ['No agent credentials provided'],\n        guidance: {\n          message: 'This page requires agent verification.',\n          registrationUrl: `${config.apiBaseUrl?.replace('/api', '')}/register`,\n          documentationUrl: `${config.apiBaseUrl?.replace('/api', '')}/docs/agent-access`,\n        },\n        verifiedAt: new Date(),\n      };\n\n      // For API routes, return JSON\n      if (pathname.startsWith('/api/')) {\n        return NextResponse.json(\n          {\n            success: false,\n            error: {\n              code: 'UNAUTHORIZED',\n              message: 'No agent credentials provided',\n              guidance: result.guidance,\n            },\n          },\n          { status: 401 }\n        );\n      }\n\n      // For web pages, show Commerce Shield\n      if (showCommerceShield) {\n        return new NextResponse(generateCommerceShieldHtml(result, options), {\n          status: 200,\n          headers: {\n            'Content-Type': 'text/html',\n            'X-AstraSync-Verification': 'commerce-shield',\n          },\n        });\n      }\n\n      // Otherwise redirect to login/register\n      const registerUrl = result.guidance?.registrationUrl || '/register';\n      return NextResponse.redirect(new URL(registerUrl, request.url));\n    }\n\n    // Auto-detect counterparty URL from the request if not explicitly configured.\n    // Since the SDK is installed at this endpoint, we always know the origin.\n    const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;\n\n    // Verify the agent\n    const purpose = request.headers.get('x-purpose') || inferPurpose(request.method);\n    const result = await verify(config, {\n      credentials,\n      purpose,\n      action: request.method.toLowerCase(),\n      resource: pathname,\n      clientIp: request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || undefined,\n      userAgent: request.headers.get('user-agent') || undefined,\n      counterpartyUrl,\n      counterpartyType: config.counterpartyType || 'website',\n    });\n\n    // Check if access level is sufficient\n    if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {\n      // For API routes, return JSON\n      if (pathname.startsWith('/api/')) {\n        return NextResponse.json(\n          {\n            success: false,\n            error: {\n              code: result.verified ? 'INSUFFICIENT_ACCESS' : 'UNAUTHORIZED',\n              message: result.denialReasons?.[0] || 'Access denied',\n              accessLevel: result.accessLevel,\n              required: routeConfig.minAccessLevel,\n              guidance: result.guidance,\n            },\n          },\n          { status: result.verified ? 403 : 401 }\n        );\n      }\n\n      // For web pages, show Commerce Shield\n      if (showCommerceShield) {\n        return new NextResponse(generateCommerceShieldHtml(result, options), {\n          status: 200,\n          headers: {\n            'Content-Type': 'text/html',\n            'X-AstraSync-Verification': 'commerce-shield',\n          },\n        });\n      }\n\n      // Redirect to unauthorized page\n      return NextResponse.redirect(new URL('/unauthorized', request.url));\n    }\n\n    // All checks passed - continue with verification info in headers\n    const response = NextResponse.next();\n\n    // Add verification info to response headers\n    response.headers.set('X-AstraSync-Verified', result.verified.toString());\n    response.headers.set('X-AstraSync-Access-Level', result.accessLevel);\n\n    if (result.agent) {\n      response.headers.set('X-AstraSync-Agent-Id', result.agent.astraId);\n      response.headers.set('X-AstraSync-Trust-Score', result.agent.trustScore.toString());\n    }\n\n    return response;\n  };\n}\n\n/**\n * Helper to create matcher config\n */\nexport function createMatcherConfig(paths: string[]): { matcher: string[] } {\n  return { matcher: paths };\n}\n","/**\n * AstraSync Universal Verification Gateway - Access Level Definitions\n *\n * Defines the hierarchy and capabilities of each access level.\n */\n\nimport type { AccessLevel, TrustLevel } from './types';\n\n/**\n * Access level hierarchy (higher number = more access)\n */\nexport const ACCESS_LEVEL_HIERARCHY: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 1,\n  'read-only': 2,\n  standard: 3,\n  full: 4,\n  internal: 5,\n};\n\n/**\n * Access level descriptions for UI\n */\nexport const ACCESS_LEVEL_DESCRIPTIONS: Record<AccessLevel, string> = {\n  none: 'No access - credentials required',\n  guidance: 'Guidance mode - registration information provided',\n  'read-only': 'Read-only access - can browse but not modify',\n  standard: 'Standard access - normal operations per PDLSS policy',\n  full: 'Full access - all operations for high-trust agents',\n  internal: 'Internal access - organization member privileges',\n};\n\n/**\n * Default trust score thresholds for access levels\n */\nexport const DEFAULT_TRUST_THRESHOLDS: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 0,\n  'read-only': 20,\n  standard: 40,\n  full: 70,\n  internal: 0, // Internal is based on org membership, not score\n};\n\n/**\n * Trust level score ranges\n */\nexport const TRUST_LEVEL_RANGES: Record<TrustLevel, { min: number; max: number }> = {\n  BRONZE: { min: 0, max: 39 },\n  SILVER: { min: 40, max: 59 },\n  GOLD: { min: 60, max: 79 },\n  PLATINUM: { min: 80, max: 100 },\n};\n\n/**\n * Determine trust level from score\n */\nexport function getTrustLevel(score: number): TrustLevel {\n  if (score >= 80) return 'PLATINUM';\n  if (score >= 60) return 'GOLD';\n  if (score >= 40) return 'SILVER';\n  return 'BRONZE';\n}\n\n/**\n * Check if access level A is greater than or equal to access level B\n */\nexport function hasMinimumAccess(actual: AccessLevel, required: AccessLevel): boolean {\n  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];\n}\n\n/**\n * Get the highest access level for a given trust score\n */\nexport function getAccessLevelForScore(\n  trustScore: number,\n  thresholds: Record<AccessLevel, number> = DEFAULT_TRUST_THRESHOLDS\n): AccessLevel {\n  if (trustScore >= thresholds.full) return 'full';\n  if (trustScore >= thresholds.standard) return 'standard';\n  if (trustScore >= thresholds['read-only']) return 'read-only';\n  return 'guidance';\n}\n\n/**\n * Determine access level from verification result\n */\nexport function determineAccessLevel(\n  verified: boolean,\n  trustScore: number,\n  isOrgMember: boolean,\n  customThresholds?: Partial<Record<AccessLevel, number>>\n): AccessLevel {\n  if (!verified) {\n    return 'guidance';\n  }\n\n  if (isOrgMember) {\n    return 'internal';\n  }\n\n  const thresholds = {\n    ...DEFAULT_TRUST_THRESHOLDS,\n    ...customThresholds,\n  };\n\n  return getAccessLevelForScore(trustScore, thresholds);\n}\n\n/**\n * Access capabilities per level\n */\nexport interface AccessCapabilities {\n  canRead: boolean;\n  canWrite: boolean;\n  canDelete: boolean;\n  canAdmin: boolean;\n  canAccessInternal: boolean;\n  maxTransactionValue?: number;\n  allowedPurposes?: string[];\n}\n\n/**\n * Get capabilities for an access level\n */\nexport function getCapabilities(accessLevel: AccessLevel): AccessCapabilities {\n  switch (accessLevel) {\n    case 'none':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'guidance':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'read-only':\n      return {\n        canRead: true,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'standard':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'full':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'internal':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: true,\n        canAccessInternal: true,\n      };\n    default:\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n  }\n}\n","/**\n * AstraSync Universal Verification Gateway - Core Verification Logic\n *\n * This module handles the core verification logic, calling the AstraSync API\n * and processing the response into a standardized VerificationResult.\n */\n\nimport type {\n  GatewayConfig,\n  AgentCredentials,\n  VerificationRequest,\n  VerificationResult,\n  VerifiedAgent,\n  VerifiedDeveloper,\n  VerifiedOrganization,\n  PDLSSInfo,\n  GuidanceInfo,\n  AccessLevel,\n  EnhancedVerificationResult,\n  TokenGuidance,\n  RuntimeChallengeResult,\n} from './types';\nimport { determineAccessLevel, getTrustLevel, ACCESS_LEVEL_HIERARCHY } from './access-levels';\n\n/**\n * Default configuration values\n */\nconst DEFAULT_CONFIG: Partial<GatewayConfig> = {\n  apiBaseUrl: 'https://api.astrasync.ai',\n  defaultAccessLevel: 'guidance',\n  minTrustScore: 40,\n  minTrustScoreForFull: 70,\n  cacheTtl: 300, // 5 minutes\n  debug: false,\n};\n\n/**\n * Simple in-memory cache for verification results\n */\nconst verificationCache = new Map<string, { result: VerificationResult; expiresAt: number }>();\n\n/**\n * Generate cache key from credentials\n */\nfunction getCacheKey(credentials: AgentCredentials): string {\n  return `${credentials.astraId || ''}-${credentials.apiKey || ''}-${credentials.jwt || ''}`;\n}\n\n/**\n * Check if cached result is still valid\n */\nfunction getCachedResult(credentials: AgentCredentials): VerificationResult | null {\n  const key = getCacheKey(credentials);\n  const cached = verificationCache.get(key);\n\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.result;\n  }\n\n  if (cached) {\n    verificationCache.delete(key);\n  }\n\n  return null;\n}\n\n/**\n * Cache a verification result\n */\nfunction cacheResult(credentials: AgentCredentials, result: VerificationResult, ttlSeconds: number): void {\n  const key = getCacheKey(credentials);\n  verificationCache.set(key, {\n    result,\n    expiresAt: Date.now() + ttlSeconds * 1000,\n  });\n}\n\n/**\n * Clear the verification cache\n */\nexport function clearCache(): void {\n  verificationCache.clear();\n}\n\n/**\n * Extract agent credentials from various sources\n */\nexport function extractCredentials(\n  headers: Record<string, string | string[] | undefined>,\n  query?: Record<string, string | undefined>\n): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers (case-insensitive)\n  const astraIdHeader = headers['x-astra-id'] || headers['X-Astra-Id'] || headers['X-ASTRA-ID'];\n  if (astraIdHeader) {\n    credentials.astraId = Array.isArray(astraIdHeader) ? astraIdHeader[0] : astraIdHeader;\n  }\n\n  // Check for API key in headers\n  const apiKeyHeader = headers['x-api-key'] || headers['X-Api-Key'] || headers['X-API-KEY'];\n  if (apiKeyHeader) {\n    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;\n  }\n\n  // Check Authorization header for Bearer token\n  const authHeader = headers['authorization'] || headers['Authorization'];\n  if (authHeader) {\n    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n    credentials.authorizationHeader = authValue;\n\n    if (authValue.startsWith('Bearer ')) {\n      credentials.jwt = authValue.slice(7);\n    }\n  }\n\n  // Check query parameters as fallback\n  if (query) {\n    if (query.astraId && !credentials.astraId) {\n      credentials.astraId = query.astraId;\n    }\n    if (query.apiKey && !credentials.apiKey) {\n      credentials.apiKey = query.apiKey;\n    }\n  }\n\n  return credentials;\n}\n\n/**\n * Check if credentials are present\n */\nexport function hasCredentials(credentials: AgentCredentials): boolean {\n  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);\n}\n\n/**\n * Create guidance response for unverified agents\n */\nfunction createGuidanceResponse(config: GatewayConfig, reason?: string): VerificationResult {\n  const guidance: GuidanceInfo = {\n    message: 'This service verifies AI agents before granting access. Please register your agent with AstraSync.',\n    registrationUrl: `${config.apiBaseUrl.replace('/api', '')}/register`,\n    documentationUrl: `${config.apiBaseUrl.replace('/api', '')}/docs/agent-access`,\n    steps: [\n      'Register for an AstraSync account',\n      'Create and register your agent',\n      'Add your ASTRA-ID to request headers',\n      'Retry your request',\n    ],\n  };\n\n  return {\n    verified: false,\n    accessLevel: 'guidance',\n    guidance,\n    denialReasons: reason ? [reason] : ['No valid agent credentials provided'],\n    verifiedAt: new Date(),\n  };\n}\n\n/**\n * Call the AstraSync verify-access API\n */\nasync function callVerifyAccessAPI(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<{\n  success: boolean;\n  access?: {\n    allowed: boolean;\n    reason?: string;\n    requiresStepUp?: boolean;\n    requiresApproval?: boolean;\n    appliedPolicy?: {\n      boundaryId: string;\n      boundaryName: string;\n      policyId: string;\n      policyVersion: string;\n    };\n    pdlss?: {\n      purposeAllowed: boolean;\n      withinDuration: boolean;\n      withinLimits: boolean;\n      scopeAllowed: boolean;\n      selfInstantiationAllowed: boolean;\n    };\n    counterparty?: {\n      id: string;\n      name: string;\n      trustScoreRequirement: number;\n    };\n  };\n  agent?: {\n    kyaAgentId: string;\n    astraId: string;\n    name: string;\n    trustScore: number;\n    trustLevel: string;\n    agentStatus: string;\n    blockchainStatus: string;\n  };\n  developer?: {\n    kyaOwnerId: string;\n    fullName: string;\n    email: string;\n    identityVerified: boolean;\n    trustScore: number;\n  };\n  organization?: {\n    name: string;\n    verified: boolean;\n    trustScore: number;\n  };\n  error?: string;\n}> {\n  const { credentials, ...requestData } = request;\n\n  // Build the request body\n  const body: Record<string, unknown> = {\n    agentId: credentials.astraId,\n    purpose: requestData.purpose || 'general',\n  };\n\n  // Add optional fields\n  if (requestData.action) body.action = requestData.action;\n  if (requestData.resourceType) body.resourceType = requestData.resourceType;\n  if (requestData.resource) body.resource = requestData.resource;\n  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;\n  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;\n  if (requestData.currency) body.currency = requestData.currency;\n  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;\n  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;\n  if (requestData.subAgentDepth !== undefined) body.subAgentDepth = requestData.subAgentDepth;\n  // Handshake Protocol v10 additions\n  if (requestData.enableRuntimeChallenge) body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;\n  if (requestData.createSession) body.createSession = requestData.createSession;\n  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;\n  if (requestData.counterpartyUrl) body.counterpartyUrl = requestData.counterpartyUrl;\n  if (requestData.runtimeChallengeOptions) body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;\n\n  // Build headers\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    ...config.customHeaders,\n  };\n\n  if (config.apiKey) {\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  if (credentials.authorizationHeader) {\n    headers['Authorization'] = credentials.authorizationHeader;\n  }\n\n  try {\n    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: data.message || data.error || `API returned ${response.status}`,\n      };\n    }\n\n    return data;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return {\n      success: false,\n      error: `Failed to call verify-access API: ${message}`,\n    };\n  }\n}\n\n/**\n * Main verification function\n */\nexport async function verify(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n\n  // Check for credentials\n  if (!hasCredentials(request.credentials)) {\n    return createGuidanceResponse(mergedConfig, 'No agent credentials provided');\n  }\n\n  // Check cache first\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {\n    const cached = getCachedResult(request.credentials);\n    if (cached) {\n      if (mergedConfig.debug) {\n        console.log('[VerificationGateway] Returning cached result');\n      }\n      return cached;\n    }\n  }\n\n  // Inject counterparty info from config if not already set in request\n  const enrichedRequest = { ...request };\n  if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {\n    enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;\n  }\n  if (!enrichedRequest.counterpartyType && mergedConfig.counterpartyType) {\n    enrichedRequest.counterpartyType = mergedConfig.counterpartyType;\n  }\n\n  // Call the API\n  if (mergedConfig.debug) {\n    console.log('[VerificationGateway] Calling verify-access API');\n  }\n\n  const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);\n\n  // Handle API errors\n  if (!apiResponse.success) {\n    return createGuidanceResponse(mergedConfig, apiResponse.error);\n  }\n\n  // Check access result\n  if (!apiResponse.access?.allowed) {\n    const result: EnhancedVerificationResult = {\n      verified: false,\n      accessLevel: 'guidance',\n      denialReasons: apiResponse.access?.reason ? [apiResponse.access.reason] : ['Access denied'],\n      requiresStepUp: apiResponse.access?.requiresStepUp,\n      requiresApproval: apiResponse.access?.requiresApproval,\n      guidance: {\n        message: apiResponse.access?.reason || 'Access denied by PDLSS policy',\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/pdlss`,\n      },\n      verifiedAt: new Date(),\n      // Extract sessionId so decisions can be recorded for denials too\n      sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n      recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n      recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n    };\n\n    return result;\n  }\n\n  // Build successful result\n  const agent: VerifiedAgent | undefined = apiResponse.agent\n    ? {\n        astraId: apiResponse.agent.astraId,\n        name: apiResponse.agent.name,\n        trustScore: apiResponse.agent.trustScore,\n        trustLevel: getTrustLevel(apiResponse.agent.trustScore),\n        blockchainVerified: apiResponse.agent.blockchainStatus === 'verified',\n        status: apiResponse.agent.agentStatus as VerifiedAgent['status'],\n      }\n    : undefined;\n\n  const developer: VerifiedDeveloper | undefined = apiResponse.developer\n    ? {\n        astradId: apiResponse.developer.kyaOwnerId,\n        name: apiResponse.developer.fullName,\n        trustScore: apiResponse.developer.trustScore || 0,\n        verified: apiResponse.developer.identityVerified,\n      }\n    : undefined;\n\n  const organization: VerifiedOrganization | undefined = apiResponse.organization\n    ? {\n        name: apiResponse.organization.name,\n        verified: apiResponse.organization.verified,\n        trustScore: apiResponse.organization.trustScore,\n      }\n    : undefined;\n\n  const pdlss: PDLSSInfo | undefined = apiResponse.access?.pdlss\n    ? {\n        purposeAllowed: apiResponse.access.pdlss.purposeAllowed,\n        withinDuration: apiResponse.access.pdlss.withinDuration,\n        withinLimits: apiResponse.access.pdlss.withinLimits,\n        scopeAllowed: apiResponse.access.pdlss.scopeAllowed,\n        selfInstantiationAllowed: apiResponse.access.pdlss.selfInstantiationAllowed,\n        appliedPolicy: apiResponse.access.appliedPolicy,\n      }\n    : undefined;\n\n  // Determine access level based on trust score\n  const trustScore = agent?.trustScore || 0;\n  const isOrgMember = false; // TODO: Check if agent belongs to same org as counterparty\n  const accessLevel: AccessLevel = determineAccessLevel(\n    true,\n    trustScore,\n    isOrgMember,\n    {\n      'read-only': 20,\n      standard: mergedConfig.minTrustScore || 40,\n      full: mergedConfig.minTrustScoreForFull || 70,\n    }\n  );\n\n  const result: EnhancedVerificationResult = {\n    verified: true,\n    accessLevel,\n    agent,\n    developer,\n    organization,\n    pdlss,\n    requiresStepUp: apiResponse.access?.requiresStepUp,\n    requiresApproval: apiResponse.access?.requiresApproval,\n    verifiedAt: new Date(),\n    cacheTtl: mergedConfig.cacheTtl,\n    // Handshake Protocol v10 enhanced fields (present when backend returns them)\n    sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n    runtimeChallenge: (apiResponse as Record<string, unknown>).runtimeChallenge as RuntimeChallengeResult | undefined,\n    tokenGuidance: (apiResponse as Record<string, unknown>).tokenGuidance as TokenGuidance | undefined,\n    recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n    recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n  };\n\n  // Enforce AstraSync recommendation\n  if (result.recommendation === 'deny') {\n    result.verified = false;\n    result.accessLevel = 'none';\n    result.denialReasons = result.recommendationReasons || ['Access denied by AstraSync recommendation'];\n    if (result.runtimeChallenge) {\n      result.guidance = {\n        message: `Verification failed: ${result.runtimeChallenge.reason || 'runtime challenge failed'}`,\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/runtime-challenge`,\n      };\n    }\n  } else if (result.recommendation === 'step_up_required') {\n    result.requiresStepUp = true;\n    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY['read-only']) {\n      result.accessLevel = 'read-only';\n    }\n    result.denialReasons = result.recommendationReasons || ['Step-up verification required'];\n  }\n\n  // Cache the result (skip caching denials — agent may fix challenge endpoint and retry)\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== 'deny') {\n    cacheResult(request.credentials, result, mergedConfig.cacheTtl);\n  }\n\n  return result;\n}\n\n/**\n * Record a counterparty's grant/deny decision for a verification session.\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function recordDecision(\n  config: GatewayConfig,\n  sessionId: string,\n  decision: 'granted' | 'denied',\n  reason?: string,\n): Promise<void> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) headers['X-API-Key'] = config.apiKey;\n\n  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {\n    method: 'POST',\n    headers,\n    body: JSON.stringify({ decision, reason }),\n  }).catch(() => { /* fire-and-forget */ });\n}\n\n/**\n * Verify an agent AND automatically record the grant/deny decision.\n *\n * This is the recommended entry point for counterparties that call verify()\n * directly (e.g. MCP servers) rather than using createMiddleware().\n * It adds createSession: true, then fire-and-forgets the decision.\n */\nexport async function verifyAndRecord(\n  config: GatewayConfig,\n  request: VerificationRequest,\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n  const result = await verify(mergedConfig, { ...request, createSession: true });\n  const sessionId = (result as EnhancedVerificationResult).sessionId;\n\n  if (sessionId) {\n    if (result.verified) {\n      recordDecision(mergedConfig, sessionId, 'granted').catch(() => {});\n    } else {\n      recordDecision(mergedConfig, sessionId, 'denied', result.denialReasons?.[0]).catch(() => {});\n    }\n  }\n\n  return result;\n}\n\n/**\n * Quick verification - just check if credentials are valid\n */\nexport async function quickVerify(\n  config: GatewayConfig,\n  credentials: AgentCredentials\n): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n  const result = await verify(config, {\n    credentials,\n    purpose: 'verification',\n  });\n\n  return {\n    verified: result.verified,\n    accessLevel: result.accessLevel,\n    reason: result.denialReasons?.[0],\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACWO,IAAM,yBAAsD;AAAA,EACjE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AACZ;AAiBO,IAAM,2BAAwD;AAAA,EACnE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA;AACZ;AAeO,SAAS,cAAc,OAA2B;AACvD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAKO,SAAS,iBAAiB,QAAqB,UAAgC;AACpF,SAAO,uBAAuB,MAAM,KAAK,uBAAuB,QAAQ;AAC1E;AAKO,SAAS,uBACd,YACA,aAA0C,0BAC7B;AACb,MAAI,cAAc,WAAW,KAAM,QAAO;AAC1C,MAAI,cAAc,WAAW,SAAU,QAAO;AAC9C,MAAI,cAAc,WAAW,WAAW,EAAG,QAAO;AAClD,SAAO;AACT;AAKO,SAAS,qBACd,UACA,YACA,aACA,kBACa;AACb,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AAEA,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,uBAAuB,YAAY,UAAU;AACtD;;;AChFA,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AAAA;AAAA,EACV,OAAO;AACT;AAKA,IAAM,oBAAoB,oBAAI,IAA+D;AAK7F,SAAS,YAAY,aAAuC;AAC1D,SAAO,GAAG,YAAY,WAAW,EAAE,IAAI,YAAY,UAAU,EAAE,IAAI,YAAY,OAAO,EAAE;AAC1F;AAKA,SAAS,gBAAgB,aAA0D;AACjF,QAAM,MAAM,YAAY,WAAW;AACnC,QAAM,SAAS,kBAAkB,IAAI,GAAG;AAExC,MAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,QAAQ;AACV,sBAAkB,OAAO,GAAG;AAAA,EAC9B;AAEA,SAAO;AACT;AAKA,SAAS,YAAY,aAA+B,QAA4B,YAA0B;AACxG,QAAM,MAAM,YAAY,WAAW;AACnC,oBAAkB,IAAI,KAAK;AAAA,IACzB;AAAA,IACA,WAAW,KAAK,IAAI,IAAI,aAAa;AAAA,EACvC,CAAC;AACH;AAyDO,SAAS,eAAe,aAAwC;AACrE,SAAO,CAAC,EAAE,YAAY,WAAW,YAAY,UAAU,YAAY;AACrE;AAKA,SAAS,uBAAuB,QAAuB,QAAqC;AAC1F,QAAM,WAAyB;AAAA,IAC7B,SAAS;AAAA,IACT,iBAAiB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IACzD,kBAAkB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,aAAa;AAAA,IACb;AAAA,IACA,eAAe,SAAS,CAAC,MAAM,IAAI,CAAC,qCAAqC;AAAA,IACzE,YAAY,oBAAI,KAAK;AAAA,EACvB;AACF;AAKA,eAAe,oBACb,QACA,SAiDC;AACD,QAAM,EAAE,aAAa,GAAG,YAAY,IAAI;AAGxC,QAAM,OAAgC;AAAA,IACpC,SAAS,YAAY;AAAA,IACrB,SAAS,YAAY,WAAW;AAAA,EAClC;AAGA,MAAI,YAAY,OAAQ,MAAK,SAAS,YAAY;AAClD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,kBAAmB,MAAK,oBAAoB,YAAY;AACxE,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,kBAAkB,OAAW,MAAK,gBAAgB,YAAY;AAE9E,MAAI,YAAY,uBAAwB,MAAK,yBAAyB,YAAY;AAClF,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,gBAAiB,MAAK,kBAAkB,YAAY;AACpE,MAAI,YAAY,wBAAyB,MAAK,0BAA0B,YAAY;AAGpF,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAG,OAAO;AAAA,EACZ;AAEA,MAAI,OAAO,QAAQ;AACjB,YAAQ,WAAW,IAAI,OAAO;AAAA,EAChC;AAEA,MAAI,YAAY,qBAAqB;AACnC,YAAQ,eAAe,IAAI,YAAY;AAAA,EACzC;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAG,OAAO,UAAU,yBAAyB;AAAA,MACxE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,WAAW,KAAK,SAAS,gBAAgB,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,qCAAqC,OAAO;AAAA,IACrD;AAAA,EACF;AACF;AAKA,eAAsB,OACpB,QACA,SAC6B;AAC7B,QAAM,eAAe,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAGpD,MAAI,CAAC,eAAe,QAAQ,WAAW,GAAG;AACxC,WAAO,uBAAuB,cAAc,+BAA+B;AAAA,EAC7E;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,GAAG;AACtD,UAAM,SAAS,gBAAgB,QAAQ,WAAW;AAClD,QAAI,QAAQ;AACV,UAAI,aAAa,OAAO;AACtB,gBAAQ,IAAI,+CAA+C;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAI,CAAC,gBAAgB,mBAAmB,aAAa,iBAAiB;AACpE,oBAAgB,kBAAkB,aAAa;AAAA,EACjD;AACA,MAAI,CAAC,gBAAgB,oBAAoB,aAAa,kBAAkB;AACtE,oBAAgB,mBAAmB,aAAa;AAAA,EAClD;AAGA,MAAI,aAAa,OAAO;AACtB,YAAQ,IAAI,iDAAiD;AAAA,EAC/D;AAEA,QAAM,cAAc,MAAM,oBAAoB,cAAc,eAAe;AAG3E,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,uBAAuB,cAAc,YAAY,KAAK;AAAA,EAC/D;AAGA,MAAI,CAAC,YAAY,QAAQ,SAAS;AAChC,UAAMA,UAAqC;AAAA,MACzC,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,YAAY,QAAQ,SAAS,CAAC,YAAY,OAAO,MAAM,IAAI,CAAC,eAAe;AAAA,MAC1F,gBAAgB,YAAY,QAAQ;AAAA,MACpC,kBAAkB,YAAY,QAAQ;AAAA,MACtC,UAAU;AAAA,QACR,SAAS,YAAY,QAAQ,UAAU;AAAA,QACvC,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA;AAAA,MAErB,WAAY,YAAwC;AAAA,MACpD,gBAAiB,YAAwC;AAAA,MACzD,uBAAwB,YAAwC;AAAA,IAClE;AAEA,WAAOA;AAAA,EACT;AAGA,QAAM,QAAmC,YAAY,QACjD;AAAA,IACE,SAAS,YAAY,MAAM;AAAA,IAC3B,MAAM,YAAY,MAAM;AAAA,IACxB,YAAY,YAAY,MAAM;AAAA,IAC9B,YAAY,cAAc,YAAY,MAAM,UAAU;AAAA,IACtD,oBAAoB,YAAY,MAAM,qBAAqB;AAAA,IAC3D,QAAQ,YAAY,MAAM;AAAA,EAC5B,IACA;AAEJ,QAAM,YAA2C,YAAY,YACzD;AAAA,IACE,UAAU,YAAY,UAAU;AAAA,IAChC,MAAM,YAAY,UAAU;AAAA,IAC5B,YAAY,YAAY,UAAU,cAAc;AAAA,IAChD,UAAU,YAAY,UAAU;AAAA,EAClC,IACA;AAEJ,QAAM,eAAiD,YAAY,eAC/D;AAAA,IACE,MAAM,YAAY,aAAa;AAAA,IAC/B,UAAU,YAAY,aAAa;AAAA,IACnC,YAAY,YAAY,aAAa;AAAA,EACvC,IACA;AAEJ,QAAM,QAA+B,YAAY,QAAQ,QACrD;AAAA,IACE,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,0BAA0B,YAAY,OAAO,MAAM;AAAA,IACnD,eAAe,YAAY,OAAO;AAAA,EACpC,IACA;AAGJ,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc;AACpB,QAAM,cAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,UAAU,aAAa,iBAAiB;AAAA,MACxC,MAAM,aAAa,wBAAwB;AAAA,IAC7C;AAAA,EACF;AAEA,QAAM,SAAqC;AAAA,IACzC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,YAAY,QAAQ;AAAA,IACpC,kBAAkB,YAAY,QAAQ;AAAA,IACtC,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,aAAa;AAAA;AAAA,IAEvB,WAAY,YAAwC;AAAA,IACpD,kBAAmB,YAAwC;AAAA,IAC3D,eAAgB,YAAwC;AAAA,IACxD,gBAAiB,YAAwC;AAAA,IACzD,uBAAwB,YAAwC;AAAA,EAClE;AAGA,MAAI,OAAO,mBAAmB,QAAQ;AACpC,WAAO,WAAW;AAClB,WAAO,cAAc;AACrB,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,2CAA2C;AACnG,QAAI,OAAO,kBAAkB;AAC3B,aAAO,WAAW;AAAA,QAChB,SAAS,wBAAwB,OAAO,iBAAiB,UAAU,0BAA0B;AAAA,QAC7F,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF,WAAW,OAAO,mBAAmB,oBAAoB;AACvD,WAAO,iBAAiB;AACxB,QAAI,uBAAuB,OAAO,WAAW,IAAI,uBAAuB,WAAW,GAAG;AACpF,aAAO,cAAc;AAAA,IACvB;AACA,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,+BAA+B;AAAA,EACzF;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,KAAK,OAAO,mBAAmB,QAAQ;AAC1F,gBAAY,QAAQ,aAAa,QAAQ,aAAa,QAAQ;AAAA,EAChE;AAEA,SAAO;AACT;;;AFzZA,SAAS,kCAAkC,SAAwC;AACjF,QAAM,cAAgC,CAAC;AAGvC,QAAM,UAAU,QAAQ,QAAQ,IAAI,YAAY,KAAK,QAAQ,QAAQ,IAAI,YAAY;AACrF,MAAI,SAAS;AACX,gBAAY,UAAU;AAAA,EACxB;AAGA,QAAM,SAAS,QAAQ,QAAQ,IAAI,WAAW,KAAK,QAAQ,QAAQ,IAAI,WAAW;AAClF,MAAI,QAAQ;AACV,gBAAY,SAAS;AAAA,EACvB;AAGA,QAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,MAAI,YAAY;AACd,gBAAY,sBAAsB;AAClC,QAAI,WAAW,WAAW,SAAS,GAAG;AACpC,kBAAY,MAAM,WAAW,MAAM,CAAC;AAAA,IACtC;AAAA,EACF;AAGA,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,eAAe,IAAI,aAAa,IAAI,SAAS;AACnD,QAAM,cAAc,IAAI,aAAa,IAAI,QAAQ;AAEjD,MAAI,gBAAgB,CAAC,YAAY,SAAS;AACxC,gBAAY,UAAU;AAAA,EACxB;AACA,MAAI,eAAe,CAAC,YAAY,QAAQ;AACtC,gBAAY,SAAS;AAAA,EACvB;AAEA,SAAO;AACT;AAKA,SAAS,WAAW,SAAiB,MAAuB;AAC1D,QAAM,eAAe,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK;AAEtE,QAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAKA,SAAS,gBACP,QACA,MACA,QAC+B;AAC/B,SAAO,OAAO,KAAK,CAAC,UAAU;AAC5B,UAAM,gBACJ,MAAM,WAAW,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO,YAAY;AAC5E,UAAM,cAAc,WAAW,MAAM,SAAS,IAAI;AAClD,WAAO,iBAAiB;AAAA,EAC1B,CAAC;AACH;AAKA,SAAS,aAAa,QAAwB;AAC5C,UAAQ,OAAO,YAAY,GAAG;AAAA,IAC5B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,2BACP,QACA,SACQ;AACR,QAAM,QAAQ,QAAQ,gBAAgB,SAAS;AAC/C,QAAM,UACJ,QAAQ,gBAAgB,WACxB,OAAO,UAAU,WACjB;AACF,QAAM,kBAAkB,OAAO,UAAU,mBAAmB;AAC5D,QAAM,UAAU,OAAO,UAAU,oBAAoB;AACrD,QAAM,aAAa,QAAQ,gBAAgB,oBAAoB;AAE/D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAME,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BA4Ge,KAAK;AAAA,gCACJ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,mCAKJ,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAQjC,eAAe;AAAA,QACxB,aAAa,8GAA8G,EAAE;AAAA;AAAA;AAAA;AAAA,6BAIxG,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhC,KAAK;AACT;AAKO,SAAS,iBAAiB,SAAkC;AACjE,QAAM,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,qBAAqB,MAAM,GAAG,OAAO,IAAI;AAE9E,SAAO,eAAe,WAAW,SAAsB;AAErD,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,aAAa;AAEnD,UAAM,WAAW,QAAQ,QAAQ;AAGjC,UAAM,aAAa,UAAU,KAAK,CAAC,YAAY,WAAW,SAAS,QAAQ,CAAC;AAC5E,QAAI,YAAY;AACd,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,cAAc,gBAAgB,QAAQ,UAAU,QAAQ,MAAM;AAGpE,QAAI,CAAC,aAAa;AAChB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,YAAY,mBAAmB,QAAQ;AACzC,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,cAAc,kCAAkC,OAAO;AAG7D,QAAI,CAAC,eAAe,WAAW,KAAK,YAAY,mBAAmB,YAAY;AAC7E,YAAMC,UAA6B;AAAA,QACjC,UAAU;AAAA,QACV,aAAa;AAAA,QACb,eAAe,CAAC,+BAA+B;AAAA,QAC/C,UAAU;AAAA,UACR,SAAS;AAAA,UACT,iBAAiB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,UAC1D,kBAAkB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAC7D;AAAA,QACA,YAAY,oBAAI,KAAK;AAAA,MACvB;AAGA,UAAI,SAAS,WAAW,OAAO,GAAG;AAChC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,UAAUA,QAAO;AAAA,YACnB;AAAA,UACF;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAGA,UAAI,oBAAoB;AACtB,eAAO,IAAI,aAAa,2BAA2BA,SAAQ,OAAO,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,4BAA4B;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAGA,YAAM,cAAcA,QAAO,UAAU,mBAAmB;AACxD,aAAO,aAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAAA,IAChE;AAIA,UAAM,kBAAkB,OAAO,mBAAmB,QAAQ,QAAQ;AAGlE,UAAM,UAAU,QAAQ,QAAQ,IAAI,WAAW,KAAK,aAAa,QAAQ,MAAM;AAC/E,UAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,MAClC;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ,OAAO,YAAY;AAAA,MACnC,UAAU;AAAA,MACV,UAAU,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAAA,MAC3E,WAAW,QAAQ,QAAQ,IAAI,YAAY,KAAK;AAAA,MAChD;AAAA,MACA,kBAAkB,OAAO,oBAAoB;AAAA,IAC/C,CAAC;AAGD,QAAI,CAAC,iBAAiB,OAAO,aAAa,YAAY,cAAc,GAAG;AAErE,UAAI,SAAS,WAAW,OAAO,GAAG;AAChC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM,OAAO,WAAW,wBAAwB;AAAA,cAChD,SAAS,OAAO,gBAAgB,CAAC,KAAK;AAAA,cACtC,aAAa,OAAO;AAAA,cACpB,UAAU,YAAY;AAAA,cACtB,UAAU,OAAO;AAAA,YACnB;AAAA,UACF;AAAA,UACA,EAAE,QAAQ,OAAO,WAAW,MAAM,IAAI;AAAA,QACxC;AAAA,MACF;AAGA,UAAI,oBAAoB;AACtB,eAAO,IAAI,aAAa,2BAA2B,QAAQ,OAAO,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,4BAA4B;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAGA,aAAO,aAAa,SAAS,IAAI,IAAI,iBAAiB,QAAQ,GAAG,CAAC;AAAA,IACpE;AAGA,UAAM,WAAW,aAAa,KAAK;AAGnC,aAAS,QAAQ,IAAI,wBAAwB,OAAO,SAAS,SAAS,CAAC;AACvE,aAAS,QAAQ,IAAI,4BAA4B,OAAO,WAAW;AAEnE,QAAI,OAAO,OAAO;AAChB,eAAS,QAAQ,IAAI,wBAAwB,OAAO,MAAM,OAAO;AACjE,eAAS,QAAQ,IAAI,2BAA2B,OAAO,MAAM,WAAW,SAAS,CAAC;AAAA,IACpF;AAEA,WAAO;AAAA,EACT;AACF;AAKO,SAAS,oBAAoB,OAAwC;AAC1E,SAAO,EAAE,SAAS,MAAM;AAC1B;","names":["result","result"]}

package/dist/adapters/nextjs.mjs

@@ -484,12 +484,7 @@ function generateCommerceShieldHtml(result, options) {
   `.trim();
 }
 function createMiddleware(options) {
-  const {
-    routes = [],
-    skipPaths = [],
-    showCommerceShield = true,
-    ...config
-  } = options;
+  const { routes = [], skipPaths = [], showCommerceShield = true, ...config } = options;
   return async function middleware(request) {
     const { NextResponse } = await import("next/server");
     const pathname = request.nextUrl.pathname;
@@ -542,6 +537,7 @@ function createMiddleware(options) {
       const registerUrl = result2.guidance?.registrationUrl || "/register";
       return NextResponse.redirect(new URL(registerUrl, request.url));
     }
+    const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;
     const purpose = request.headers.get("x-purpose") || inferPurpose(request.method);
     const result = await verify(config, {
       credentials,
@@ -549,7 +545,9 @@ function createMiddleware(options) {
       action: request.method.toLowerCase(),
       resource: pathname,
       clientIp: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || void 0,
-      userAgent: request.headers.get("user-agent") || void 0
+      userAgent: request.headers.get("user-agent") || void 0,
+      counterpartyUrl,
+      counterpartyType: config.counterpartyType || "website"
     });
     if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {
       if (pathname.startsWith("/api/")) {

package/dist/adapters/nextjs.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/access-levels.ts","../../src/verify.ts","../../src/adapters/nextjs.ts"],"sourcesContent":["/**\n * AstraSync Universal Verification Gateway - Access Level Definitions\n *\n * Defines the hierarchy and capabilities of each access level.\n */\n\nimport type { AccessLevel, TrustLevel } from './types';\n\n/**\n * Access level hierarchy (higher number = more access)\n */\nexport const ACCESS_LEVEL_HIERARCHY: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 1,\n  'read-only': 2,\n  standard: 3,\n  full: 4,\n  internal: 5,\n};\n\n/**\n * Access level descriptions for UI\n */\nexport const ACCESS_LEVEL_DESCRIPTIONS: Record<AccessLevel, string> = {\n  none: 'No access - credentials required',\n  guidance: 'Guidance mode - registration information provided',\n  'read-only': 'Read-only access - can browse but not modify',\n  standard: 'Standard access - normal operations per PDLSS policy',\n  full: 'Full access - all operations for high-trust agents',\n  internal: 'Internal access - organization member privileges',\n};\n\n/**\n * Default trust score thresholds for access levels\n */\nexport const DEFAULT_TRUST_THRESHOLDS: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 0,\n  'read-only': 20,\n  standard: 40,\n  full: 70,\n  internal: 0, // Internal is based on org membership, not score\n};\n\n/**\n * Trust level score ranges\n */\nexport const TRUST_LEVEL_RANGES: Record<TrustLevel, { min: number; max: number }> = {\n  BRONZE: { min: 0, max: 39 },\n  SILVER: { min: 40, max: 59 },\n  GOLD: { min: 60, max: 79 },\n  PLATINUM: { min: 80, max: 100 },\n};\n\n/**\n * Determine trust level from score\n */\nexport function getTrustLevel(score: number): TrustLevel {\n  if (score >= 80) return 'PLATINUM';\n  if (score >= 60) return 'GOLD';\n  if (score >= 40) return 'SILVER';\n  return 'BRONZE';\n}\n\n/**\n * Check if access level A is greater than or equal to access level B\n */\nexport function hasMinimumAccess(actual: AccessLevel, required: AccessLevel): boolean {\n  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];\n}\n\n/**\n * Get the highest access level for a given trust score\n */\nexport function getAccessLevelForScore(\n  trustScore: number,\n  thresholds: Record<AccessLevel, number> = DEFAULT_TRUST_THRESHOLDS\n): AccessLevel {\n  if (trustScore >= thresholds.full) return 'full';\n  if (trustScore >= thresholds.standard) return 'standard';\n  if (trustScore >= thresholds['read-only']) return 'read-only';\n  return 'guidance';\n}\n\n/**\n * Determine access level from verification result\n */\nexport function determineAccessLevel(\n  verified: boolean,\n  trustScore: number,\n  isOrgMember: boolean,\n  customThresholds?: Partial<Record<AccessLevel, number>>\n): AccessLevel {\n  if (!verified) {\n    return 'guidance';\n  }\n\n  if (isOrgMember) {\n    return 'internal';\n  }\n\n  const thresholds = {\n    ...DEFAULT_TRUST_THRESHOLDS,\n    ...customThresholds,\n  };\n\n  return getAccessLevelForScore(trustScore, thresholds);\n}\n\n/**\n * Access capabilities per level\n */\nexport interface AccessCapabilities {\n  canRead: boolean;\n  canWrite: boolean;\n  canDelete: boolean;\n  canAdmin: boolean;\n  canAccessInternal: boolean;\n  maxTransactionValue?: number;\n  allowedPurposes?: string[];\n}\n\n/**\n * Get capabilities for an access level\n */\nexport function getCapabilities(accessLevel: AccessLevel): AccessCapabilities {\n  switch (accessLevel) {\n    case 'none':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'guidance':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'read-only':\n      return {\n        canRead: true,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'standard':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'full':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'internal':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: true,\n        canAccessInternal: true,\n      };\n    default:\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n  }\n}\n","/**\n * AstraSync Universal Verification Gateway - Core Verification Logic\n *\n * This module handles the core verification logic, calling the AstraSync API\n * and processing the response into a standardized VerificationResult.\n */\n\nimport type {\n  GatewayConfig,\n  AgentCredentials,\n  VerificationRequest,\n  VerificationResult,\n  VerifiedAgent,\n  VerifiedDeveloper,\n  VerifiedOrganization,\n  PDLSSInfo,\n  GuidanceInfo,\n  AccessLevel,\n  EnhancedVerificationResult,\n  TokenGuidance,\n  RuntimeChallengeResult,\n} from './types';\nimport { determineAccessLevel, getTrustLevel, ACCESS_LEVEL_HIERARCHY } from './access-levels';\n\n/**\n * Default configuration values\n */\nconst DEFAULT_CONFIG: Partial<GatewayConfig> = {\n  apiBaseUrl: 'https://api.astrasync.ai',\n  defaultAccessLevel: 'guidance',\n  minTrustScore: 40,\n  minTrustScoreForFull: 70,\n  cacheTtl: 300, // 5 minutes\n  debug: false,\n};\n\n/**\n * Simple in-memory cache for verification results\n */\nconst verificationCache = new Map<string, { result: VerificationResult; expiresAt: number }>();\n\n/**\n * Generate cache key from credentials\n */\nfunction getCacheKey(credentials: AgentCredentials): string {\n  return `${credentials.astraId || ''}-${credentials.apiKey || ''}-${credentials.jwt || ''}`;\n}\n\n/**\n * Check if cached result is still valid\n */\nfunction getCachedResult(credentials: AgentCredentials): VerificationResult | null {\n  const key = getCacheKey(credentials);\n  const cached = verificationCache.get(key);\n\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.result;\n  }\n\n  if (cached) {\n    verificationCache.delete(key);\n  }\n\n  return null;\n}\n\n/**\n * Cache a verification result\n */\nfunction cacheResult(credentials: AgentCredentials, result: VerificationResult, ttlSeconds: number): void {\n  const key = getCacheKey(credentials);\n  verificationCache.set(key, {\n    result,\n    expiresAt: Date.now() + ttlSeconds * 1000,\n  });\n}\n\n/**\n * Clear the verification cache\n */\nexport function clearCache(): void {\n  verificationCache.clear();\n}\n\n/**\n * Extract agent credentials from various sources\n */\nexport function extractCredentials(\n  headers: Record<string, string | string[] | undefined>,\n  query?: Record<string, string | undefined>\n): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers (case-insensitive)\n  const astraIdHeader = headers['x-astra-id'] || headers['X-Astra-Id'] || headers['X-ASTRA-ID'];\n  if (astraIdHeader) {\n    credentials.astraId = Array.isArray(astraIdHeader) ? astraIdHeader[0] : astraIdHeader;\n  }\n\n  // Check for API key in headers\n  const apiKeyHeader = headers['x-api-key'] || headers['X-Api-Key'] || headers['X-API-KEY'];\n  if (apiKeyHeader) {\n    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;\n  }\n\n  // Check Authorization header for Bearer token\n  const authHeader = headers['authorization'] || headers['Authorization'];\n  if (authHeader) {\n    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n    credentials.authorizationHeader = authValue;\n\n    if (authValue.startsWith('Bearer ')) {\n      credentials.jwt = authValue.slice(7);\n    }\n  }\n\n  // Check query parameters as fallback\n  if (query) {\n    if (query.astraId && !credentials.astraId) {\n      credentials.astraId = query.astraId;\n    }\n    if (query.apiKey && !credentials.apiKey) {\n      credentials.apiKey = query.apiKey;\n    }\n  }\n\n  return credentials;\n}\n\n/**\n * Check if credentials are present\n */\nexport function hasCredentials(credentials: AgentCredentials): boolean {\n  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);\n}\n\n/**\n * Create guidance response for unverified agents\n */\nfunction createGuidanceResponse(config: GatewayConfig, reason?: string): VerificationResult {\n  const guidance: GuidanceInfo = {\n    message: 'This service verifies AI agents before granting access. Please register your agent with AstraSync.',\n    registrationUrl: `${config.apiBaseUrl.replace('/api', '')}/register`,\n    documentationUrl: `${config.apiBaseUrl.replace('/api', '')}/docs/agent-access`,\n    steps: [\n      'Register for an AstraSync account',\n      'Create and register your agent',\n      'Add your ASTRA-ID to request headers',\n      'Retry your request',\n    ],\n  };\n\n  return {\n    verified: false,\n    accessLevel: 'guidance',\n    guidance,\n    denialReasons: reason ? [reason] : ['No valid agent credentials provided'],\n    verifiedAt: new Date(),\n  };\n}\n\n/**\n * Call the AstraSync verify-access API\n */\nasync function callVerifyAccessAPI(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<{\n  success: boolean;\n  access?: {\n    allowed: boolean;\n    reason?: string;\n    requiresStepUp?: boolean;\n    requiresApproval?: boolean;\n    appliedPolicy?: {\n      boundaryId: string;\n      boundaryName: string;\n      policyId: string;\n      policyVersion: string;\n    };\n    pdlss?: {\n      purposeAllowed: boolean;\n      withinDuration: boolean;\n      withinLimits: boolean;\n      scopeAllowed: boolean;\n      selfInstantiationAllowed: boolean;\n    };\n    counterparty?: {\n      id: string;\n      name: string;\n      trustScoreRequirement: number;\n    };\n  };\n  agent?: {\n    kyaAgentId: string;\n    astraId: string;\n    name: string;\n    trustScore: number;\n    trustLevel: string;\n    agentStatus: string;\n    blockchainStatus: string;\n  };\n  developer?: {\n    kyaOwnerId: string;\n    fullName: string;\n    email: string;\n    identityVerified: boolean;\n    trustScore: number;\n  };\n  organization?: {\n    name: string;\n    verified: boolean;\n    trustScore: number;\n  };\n  error?: string;\n}> {\n  const { credentials, ...requestData } = request;\n\n  // Build the request body\n  const body: Record<string, unknown> = {\n    agentId: credentials.astraId,\n    purpose: requestData.purpose || 'general',\n  };\n\n  // Add optional fields\n  if (requestData.action) body.action = requestData.action;\n  if (requestData.resourceType) body.resourceType = requestData.resourceType;\n  if (requestData.resource) body.resource = requestData.resource;\n  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;\n  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;\n  if (requestData.currency) body.currency = requestData.currency;\n  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;\n  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;\n  if (requestData.subAgentDepth !== undefined) body.subAgentDepth = requestData.subAgentDepth;\n  // Handshake Protocol v10 additions\n  if (requestData.enableRuntimeChallenge) body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;\n  if (requestData.createSession) body.createSession = requestData.createSession;\n  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;\n  if (requestData.counterpartyUrl) body.counterpartyUrl = requestData.counterpartyUrl;\n  if (requestData.runtimeChallengeOptions) body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;\n\n  // Build headers\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    ...config.customHeaders,\n  };\n\n  if (config.apiKey) {\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  if (credentials.authorizationHeader) {\n    headers['Authorization'] = credentials.authorizationHeader;\n  }\n\n  try {\n    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: data.message || data.error || `API returned ${response.status}`,\n      };\n    }\n\n    return data;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return {\n      success: false,\n      error: `Failed to call verify-access API: ${message}`,\n    };\n  }\n}\n\n/**\n * Main verification function\n */\nexport async function verify(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n\n  // Check for credentials\n  if (!hasCredentials(request.credentials)) {\n    return createGuidanceResponse(mergedConfig, 'No agent credentials provided');\n  }\n\n  // Check cache first\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {\n    const cached = getCachedResult(request.credentials);\n    if (cached) {\n      if (mergedConfig.debug) {\n        console.log('[VerificationGateway] Returning cached result');\n      }\n      return cached;\n    }\n  }\n\n  // Inject counterparty info from config if not already set in request\n  const enrichedRequest = { ...request };\n  if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {\n    enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;\n  }\n  if (!enrichedRequest.counterpartyType && mergedConfig.counterpartyType) {\n    enrichedRequest.counterpartyType = mergedConfig.counterpartyType;\n  }\n\n  // Call the API\n  if (mergedConfig.debug) {\n    console.log('[VerificationGateway] Calling verify-access API');\n  }\n\n  const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);\n\n  // Handle API errors\n  if (!apiResponse.success) {\n    return createGuidanceResponse(mergedConfig, apiResponse.error);\n  }\n\n  // Check access result\n  if (!apiResponse.access?.allowed) {\n    const result: EnhancedVerificationResult = {\n      verified: false,\n      accessLevel: 'guidance',\n      denialReasons: apiResponse.access?.reason ? [apiResponse.access.reason] : ['Access denied'],\n      requiresStepUp: apiResponse.access?.requiresStepUp,\n      requiresApproval: apiResponse.access?.requiresApproval,\n      guidance: {\n        message: apiResponse.access?.reason || 'Access denied by PDLSS policy',\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/pdlss`,\n      },\n      verifiedAt: new Date(),\n      // Extract sessionId so decisions can be recorded for denials too\n      sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n      recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n      recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n    };\n\n    return result;\n  }\n\n  // Build successful result\n  const agent: VerifiedAgent | undefined = apiResponse.agent\n    ? {\n        astraId: apiResponse.agent.astraId,\n        name: apiResponse.agent.name,\n        trustScore: apiResponse.agent.trustScore,\n        trustLevel: getTrustLevel(apiResponse.agent.trustScore),\n        blockchainVerified: apiResponse.agent.blockchainStatus === 'verified',\n        status: apiResponse.agent.agentStatus as VerifiedAgent['status'],\n      }\n    : undefined;\n\n  const developer: VerifiedDeveloper | undefined = apiResponse.developer\n    ? {\n        astradId: apiResponse.developer.kyaOwnerId,\n        name: apiResponse.developer.fullName,\n        trustScore: apiResponse.developer.trustScore || 0,\n        verified: apiResponse.developer.identityVerified,\n      }\n    : undefined;\n\n  const organization: VerifiedOrganization | undefined = apiResponse.organization\n    ? {\n        name: apiResponse.organization.name,\n        verified: apiResponse.organization.verified,\n        trustScore: apiResponse.organization.trustScore,\n      }\n    : undefined;\n\n  const pdlss: PDLSSInfo | undefined = apiResponse.access?.pdlss\n    ? {\n        purposeAllowed: apiResponse.access.pdlss.purposeAllowed,\n        withinDuration: apiResponse.access.pdlss.withinDuration,\n        withinLimits: apiResponse.access.pdlss.withinLimits,\n        scopeAllowed: apiResponse.access.pdlss.scopeAllowed,\n        selfInstantiationAllowed: apiResponse.access.pdlss.selfInstantiationAllowed,\n        appliedPolicy: apiResponse.access.appliedPolicy,\n      }\n    : undefined;\n\n  // Determine access level based on trust score\n  const trustScore = agent?.trustScore || 0;\n  const isOrgMember = false; // TODO: Check if agent belongs to same org as counterparty\n  const accessLevel: AccessLevel = determineAccessLevel(\n    true,\n    trustScore,\n    isOrgMember,\n    {\n      'read-only': 20,\n      standard: mergedConfig.minTrustScore || 40,\n      full: mergedConfig.minTrustScoreForFull || 70,\n    }\n  );\n\n  const result: EnhancedVerificationResult = {\n    verified: true,\n    accessLevel,\n    agent,\n    developer,\n    organization,\n    pdlss,\n    requiresStepUp: apiResponse.access?.requiresStepUp,\n    requiresApproval: apiResponse.access?.requiresApproval,\n    verifiedAt: new Date(),\n    cacheTtl: mergedConfig.cacheTtl,\n    // Handshake Protocol v10 enhanced fields (present when backend returns them)\n    sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n    runtimeChallenge: (apiResponse as Record<string, unknown>).runtimeChallenge as RuntimeChallengeResult | undefined,\n    tokenGuidance: (apiResponse as Record<string, unknown>).tokenGuidance as TokenGuidance | undefined,\n    recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n    recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n  };\n\n  // Enforce AstraSync recommendation\n  if (result.recommendation === 'deny') {\n    result.verified = false;\n    result.accessLevel = 'none';\n    result.denialReasons = result.recommendationReasons || ['Access denied by AstraSync recommendation'];\n    if (result.runtimeChallenge) {\n      result.guidance = {\n        message: `Verification failed: ${result.runtimeChallenge.reason || 'runtime challenge failed'}`,\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/runtime-challenge`,\n      };\n    }\n  } else if (result.recommendation === 'step_up_required') {\n    result.requiresStepUp = true;\n    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY['read-only']) {\n      result.accessLevel = 'read-only';\n    }\n    result.denialReasons = result.recommendationReasons || ['Step-up verification required'];\n  }\n\n  // Cache the result (skip caching denials — agent may fix challenge endpoint and retry)\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== 'deny') {\n    cacheResult(request.credentials, result, mergedConfig.cacheTtl);\n  }\n\n  return result;\n}\n\n/**\n * Record a counterparty's grant/deny decision for a verification session.\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function recordDecision(\n  config: GatewayConfig,\n  sessionId: string,\n  decision: 'granted' | 'denied',\n  reason?: string,\n): Promise<void> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) headers['X-API-Key'] = config.apiKey;\n\n  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {\n    method: 'POST',\n    headers,\n    body: JSON.stringify({ decision, reason }),\n  }).catch(() => { /* fire-and-forget */ });\n}\n\n/**\n * Verify an agent AND automatically record the grant/deny decision.\n *\n * This is the recommended entry point for counterparties that call verify()\n * directly (e.g. MCP servers) rather than using createMiddleware().\n * It adds createSession: true, then fire-and-forgets the decision.\n */\nexport async function verifyAndRecord(\n  config: GatewayConfig,\n  request: VerificationRequest,\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n  const result = await verify(mergedConfig, { ...request, createSession: true });\n  const sessionId = (result as EnhancedVerificationResult).sessionId;\n\n  if (sessionId) {\n    if (result.verified) {\n      recordDecision(mergedConfig, sessionId, 'granted').catch(() => {});\n    } else {\n      recordDecision(mergedConfig, sessionId, 'denied', result.denialReasons?.[0]).catch(() => {});\n    }\n  }\n\n  return result;\n}\n\n/**\n * Quick verification - just check if credentials are valid\n */\nexport async function quickVerify(\n  config: GatewayConfig,\n  credentials: AgentCredentials\n): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n  const result = await verify(config, {\n    credentials,\n    purpose: 'verification',\n  });\n\n  return {\n    verified: result.verified,\n    accessLevel: result.accessLevel,\n    reason: result.denialReasons?.[0],\n  };\n}\n","/**\n * AstraSync Universal Verification Gateway - Next.js Middleware\n *\n * Next.js middleware for verifying AI agents on web applications.\n * Supports Commerce Shield overlay for unverified agents.\n *\n * @example\n * ```typescript\n * // middleware.ts\n * import { createMiddleware } from '@astrasyncai/verification-gateway/nextjs';\n *\n * export const middleware = createMiddleware({\n *   apiBaseUrl: 'https://api.astrasync.ai',\n *   showCommerceShield: true,\n *   routes: [\n *     { pattern: '/api/public/*', method: '*', minAccessLevel: 'none' },\n *     { pattern: '/api/*', method: '*', minAccessLevel: 'standard' },\n *     { pattern: '/dashboard/*', method: '*', minAccessLevel: 'read-only' },\n *   ],\n * });\n *\n * export const config = {\n *   matcher: ['/api/:path*', '/dashboard/:path*'],\n * };\n * ```\n */\n\nimport type { NextRequest } from 'next/server';\nimport type {\n  NextJsMiddlewareOptions,\n  AgentCredentials,\n  VerificationResult,\n  RouteAccessConfig,\n} from '../types';\nimport { verify, hasCredentials } from '../verify';\nimport { hasMinimumAccess } from '../access-levels';\n\n/**\n * Extract credentials from Next.js request\n */\nfunction extractCredentialsFromNextRequest(request: NextRequest): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers\n  const astraId = request.headers.get('x-astra-id') || request.headers.get('X-Astra-Id');\n  if (astraId) {\n    credentials.astraId = astraId;\n  }\n\n  // Check for API key\n  const apiKey = request.headers.get('x-api-key') || request.headers.get('X-Api-Key');\n  if (apiKey) {\n    credentials.apiKey = apiKey;\n  }\n\n  // Check Authorization header\n  const authHeader = request.headers.get('authorization');\n  if (authHeader) {\n    credentials.authorizationHeader = authHeader;\n    if (authHeader.startsWith('Bearer ')) {\n      credentials.jwt = authHeader.slice(7);\n    }\n  }\n\n  // Check query parameters\n  const url = new URL(request.url);\n  const astraIdParam = url.searchParams.get('astraId');\n  const apiKeyParam = url.searchParams.get('apiKey');\n\n  if (astraIdParam && !credentials.astraId) {\n    credentials.astraId = astraIdParam;\n  }\n  if (apiKeyParam && !credentials.apiKey) {\n    credentials.apiKey = apiKeyParam;\n  }\n\n  return credentials;\n}\n\n/**\n * Match a route pattern against a path\n */\nfunction matchRoute(pattern: string, path: string): boolean {\n  const regexPattern = pattern\n    .replace(/\\*/g, '.*')\n    .replace(/\\//g, '\\\\/');\n\n  const regex = new RegExp(`^${regexPattern}$`);\n  return regex.test(path);\n}\n\n/**\n * Find the route configuration for a request\n */\nfunction findRouteConfig(\n  routes: RouteAccessConfig[],\n  path: string,\n  method: string\n): RouteAccessConfig | undefined {\n  return routes.find((route) => {\n    const methodMatches = route.method === '*' || route.method.toUpperCase() === method.toUpperCase();\n    const pathMatches = matchRoute(route.pattern, path);\n    return methodMatches && pathMatches;\n  });\n}\n\n/**\n * Infer purpose from request method\n */\nfunction inferPurpose(method: string): string {\n  switch (method.toUpperCase()) {\n    case 'GET':\n      return 'read';\n    case 'POST':\n      return 'create';\n    case 'PUT':\n    case 'PATCH':\n      return 'update';\n    case 'DELETE':\n      return 'delete';\n    default:\n      return 'general';\n  }\n}\n\n/**\n * Generate Commerce Shield HTML response\n */\nfunction generateCommerceShieldHtml(\n  result: VerificationResult,\n  options: NextJsMiddlewareOptions\n): string {\n  const title = options.commerceShield?.title || 'AstraSync Agent Verification';\n  const message = options.commerceShield?.message ||\n    result.guidance?.message ||\n    'This site verifies AI agents before granting access. We noticed you\\'re visiting without AstraSync credentials.';\n  const registrationUrl = result.guidance?.registrationUrl || 'https://astrasync.ai/register';\n  const docsUrl = result.guidance?.documentationUrl || 'https://astrasync.ai/docs/agent-access';\n  const allowGuest = options.commerceShield?.allowGuestAccess ?? true;\n\n  return `\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>${title}</title>\n  <style>\n    * {\n      box-sizing: border-box;\n      margin: 0;\n      padding: 0;\n    }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;\n      background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .shield-container {\n      background: rgba(255, 255, 255, 0.95);\n      border-radius: 16px;\n      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);\n      max-width: 480px;\n      width: 100%;\n      padding: 40px;\n      text-align: center;\n    }\n    .shield-icon {\n      font-size: 48px;\n      margin-bottom: 20px;\n    }\n    .shield-title {\n      font-size: 24px;\n      font-weight: 700;\n      color: #1a1a2e;\n      margin-bottom: 16px;\n    }\n    .shield-message {\n      color: #4a5568;\n      line-height: 1.6;\n      margin-bottom: 24px;\n    }\n    .shield-steps {\n      text-align: left;\n      background: #f7fafc;\n      border-radius: 8px;\n      padding: 20px;\n      margin-bottom: 24px;\n    }\n    .shield-steps h3 {\n      font-size: 14px;\n      font-weight: 600;\n      color: #2d3748;\n      margin-bottom: 12px;\n    }\n    .shield-steps ol {\n      padding-left: 20px;\n      color: #4a5568;\n    }\n    .shield-steps li {\n      margin-bottom: 8px;\n    }\n    .shield-buttons {\n      display: flex;\n      flex-direction: column;\n      gap: 12px;\n    }\n    .btn {\n      display: inline-block;\n      padding: 14px 24px;\n      border-radius: 8px;\n      font-weight: 600;\n      text-decoration: none;\n      transition: all 0.2s;\n      cursor: pointer;\n      border: none;\n      font-size: 16px;\n    }\n    .btn-primary {\n      background: linear-gradient(135deg, #6366f1 0%, #4f46e5 100%);\n      color: white;\n    }\n    .btn-primary:hover {\n      transform: translateY(-2px);\n      box-shadow: 0 4px 12px rgba(99, 102, 241, 0.4);\n    }\n    .btn-secondary {\n      background: #e2e8f0;\n      color: #4a5568;\n    }\n    .btn-secondary:hover {\n      background: #cbd5e0;\n    }\n    .shield-footer {\n      margin-top: 24px;\n      font-size: 14px;\n      color: #718096;\n    }\n    .shield-footer a {\n      color: #6366f1;\n      text-decoration: none;\n    }\n    .shield-footer a:hover {\n      text-decoration: underline;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"shield-container\">\n    <div class=\"shield-icon\">🛡️</div>\n    <h1 class=\"shield-title\">${title}</h1>\n    <p class=\"shield-message\">${message}</p>\n\n    <div class=\"shield-steps\">\n      <h3>To get verified access:</h3>\n      <ol>\n        <li>Register at <a href=\"${registrationUrl}\">astrasync.ai/register</a></li>\n        <li>Create and register your agent</li>\n        <li>Add your ASTRA-ID to request headers</li>\n        <li>Refresh this page</li>\n      </ol>\n    </div>\n\n    <div class=\"shield-buttons\">\n      <a href=\"${registrationUrl}\" class=\"btn btn-primary\">Register Now</a>\n      ${allowGuest ? '<button onclick=\"window.location.reload()\" class=\"btn btn-secondary\">Continue as Guest (Limited)</button>' : ''}\n    </div>\n\n    <p class=\"shield-footer\">\n      Learn more: <a href=\"${docsUrl}\">Agent Access Documentation</a>\n    </p>\n  </div>\n</body>\n</html>\n  `.trim();\n}\n\n/**\n * Create Next.js middleware for agent verification\n */\nexport function createMiddleware(options: NextJsMiddlewareOptions) {\n  const {\n    routes = [],\n    skipPaths = [],\n    showCommerceShield = true,\n    ...config\n  } = options;\n\n  return async function middleware(request: NextRequest) {\n    // Dynamic import NextResponse to avoid build issues\n    const { NextResponse } = await import('next/server');\n\n    const pathname = request.nextUrl.pathname;\n\n    // Check if path should be skipped\n    const shouldSkip = skipPaths.some((pattern) => matchRoute(pattern, pathname));\n    if (shouldSkip) {\n      return NextResponse.next();\n    }\n\n    // Find route configuration\n    const routeConfig = findRouteConfig(routes, pathname, request.method);\n\n    // If no route config, allow through\n    if (!routeConfig) {\n      return NextResponse.next();\n    }\n\n    // If route requires 'none' access, allow through\n    if (routeConfig.minAccessLevel === 'none') {\n      return NextResponse.next();\n    }\n\n    // Extract credentials\n    const credentials = extractCredentialsFromNextRequest(request);\n\n    // If no credentials and not just guidance level\n    if (!hasCredentials(credentials) && routeConfig.minAccessLevel !== 'guidance') {\n      const result: VerificationResult = {\n        verified: false,\n        accessLevel: 'none',\n        denialReasons: ['No agent credentials provided'],\n        guidance: {\n          message: 'This page requires agent verification.',\n          registrationUrl: `${config.apiBaseUrl?.replace('/api', '')}/register`,\n          documentationUrl: `${config.apiBaseUrl?.replace('/api', '')}/docs/agent-access`,\n        },\n        verifiedAt: new Date(),\n      };\n\n      // For API routes, return JSON\n      if (pathname.startsWith('/api/')) {\n        return NextResponse.json(\n          {\n            success: false,\n            error: {\n              code: 'UNAUTHORIZED',\n              message: 'No agent credentials provided',\n              guidance: result.guidance,\n            },\n          },\n          { status: 401 }\n        );\n      }\n\n      // For web pages, show Commerce Shield\n      if (showCommerceShield) {\n        return new NextResponse(generateCommerceShieldHtml(result, options), {\n          status: 200,\n          headers: {\n            'Content-Type': 'text/html',\n            'X-AstraSync-Verification': 'commerce-shield',\n          },\n        });\n      }\n\n      // Otherwise redirect to login/register\n      const registerUrl = result.guidance?.registrationUrl || '/register';\n      return NextResponse.redirect(new URL(registerUrl, request.url));\n    }\n\n    // Verify the agent\n    const purpose = request.headers.get('x-purpose') || inferPurpose(request.method);\n    const result = await verify(config, {\n      credentials,\n      purpose,\n      action: request.method.toLowerCase(),\n      resource: pathname,\n      clientIp: request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || undefined,\n      userAgent: request.headers.get('user-agent') || undefined,\n    });\n\n    // Check if access level is sufficient\n    if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {\n      // For API routes, return JSON\n      if (pathname.startsWith('/api/')) {\n        return NextResponse.json(\n          {\n            success: false,\n            error: {\n              code: result.verified ? 'INSUFFICIENT_ACCESS' : 'UNAUTHORIZED',\n              message: result.denialReasons?.[0] || 'Access denied',\n              accessLevel: result.accessLevel,\n              required: routeConfig.minAccessLevel,\n              guidance: result.guidance,\n            },\n          },\n          { status: result.verified ? 403 : 401 }\n        );\n      }\n\n      // For web pages, show Commerce Shield\n      if (showCommerceShield) {\n        return new NextResponse(generateCommerceShieldHtml(result, options), {\n          status: 200,\n          headers: {\n            'Content-Type': 'text/html',\n            'X-AstraSync-Verification': 'commerce-shield',\n          },\n        });\n      }\n\n      // Redirect to unauthorized page\n      return NextResponse.redirect(new URL('/unauthorized', request.url));\n    }\n\n    // All checks passed - continue with verification info in headers\n    const response = NextResponse.next();\n\n    // Add verification info to response headers\n    response.headers.set('X-AstraSync-Verified', result.verified.toString());\n    response.headers.set('X-AstraSync-Access-Level', result.accessLevel);\n\n    if (result.agent) {\n      response.headers.set('X-AstraSync-Agent-Id', result.agent.astraId);\n      response.headers.set('X-AstraSync-Trust-Score', result.agent.trustScore.toString());\n    }\n\n    return response;\n  };\n}\n\n/**\n * Helper to create matcher config\n */\nexport function createMatcherConfig(paths: string[]): { matcher: string[] } {\n  return { matcher: paths };\n}\n"],"mappings":";AAWO,IAAM,yBAAsD;AAAA,EACjE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AACZ;AAiBO,IAAM,2BAAwD;AAAA,EACnE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA;AACZ;AAeO,SAAS,cAAc,OAA2B;AACvD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAKO,SAAS,iBAAiB,QAAqB,UAAgC;AACpF,SAAO,uBAAuB,MAAM,KAAK,uBAAuB,QAAQ;AAC1E;AAKO,SAAS,uBACd,YACA,aAA0C,0BAC7B;AACb,MAAI,cAAc,WAAW,KAAM,QAAO;AAC1C,MAAI,cAAc,WAAW,SAAU,QAAO;AAC9C,MAAI,cAAc,WAAW,WAAW,EAAG,QAAO;AAClD,SAAO;AACT;AAKO,SAAS,qBACd,UACA,YACA,aACA,kBACa;AACb,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AAEA,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,uBAAuB,YAAY,UAAU;AACtD;;;AChFA,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AAAA;AAAA,EACV,OAAO;AACT;AAKA,IAAM,oBAAoB,oBAAI,IAA+D;AAK7F,SAAS,YAAY,aAAuC;AAC1D,SAAO,GAAG,YAAY,WAAW,EAAE,IAAI,YAAY,UAAU,EAAE,IAAI,YAAY,OAAO,EAAE;AAC1F;AAKA,SAAS,gBAAgB,aAA0D;AACjF,QAAM,MAAM,YAAY,WAAW;AACnC,QAAM,SAAS,kBAAkB,IAAI,GAAG;AAExC,MAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,QAAQ;AACV,sBAAkB,OAAO,GAAG;AAAA,EAC9B;AAEA,SAAO;AACT;AAKA,SAAS,YAAY,aAA+B,QAA4B,YAA0B;AACxG,QAAM,MAAM,YAAY,WAAW;AACnC,oBAAkB,IAAI,KAAK;AAAA,IACzB;AAAA,IACA,WAAW,KAAK,IAAI,IAAI,aAAa;AAAA,EACvC,CAAC;AACH;AAyDO,SAAS,eAAe,aAAwC;AACrE,SAAO,CAAC,EAAE,YAAY,WAAW,YAAY,UAAU,YAAY;AACrE;AAKA,SAAS,uBAAuB,QAAuB,QAAqC;AAC1F,QAAM,WAAyB;AAAA,IAC7B,SAAS;AAAA,IACT,iBAAiB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IACzD,kBAAkB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,aAAa;AAAA,IACb;AAAA,IACA,eAAe,SAAS,CAAC,MAAM,IAAI,CAAC,qCAAqC;AAAA,IACzE,YAAY,oBAAI,KAAK;AAAA,EACvB;AACF;AAKA,eAAe,oBACb,QACA,SAiDC;AACD,QAAM,EAAE,aAAa,GAAG,YAAY,IAAI;AAGxC,QAAM,OAAgC;AAAA,IACpC,SAAS,YAAY;AAAA,IACrB,SAAS,YAAY,WAAW;AAAA,EAClC;AAGA,MAAI,YAAY,OAAQ,MAAK,SAAS,YAAY;AAClD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,kBAAmB,MAAK,oBAAoB,YAAY;AACxE,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,kBAAkB,OAAW,MAAK,gBAAgB,YAAY;AAE9E,MAAI,YAAY,uBAAwB,MAAK,yBAAyB,YAAY;AAClF,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,gBAAiB,MAAK,kBAAkB,YAAY;AACpE,MAAI,YAAY,wBAAyB,MAAK,0BAA0B,YAAY;AAGpF,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAG,OAAO;AAAA,EACZ;AAEA,MAAI,OAAO,QAAQ;AACjB,YAAQ,WAAW,IAAI,OAAO;AAAA,EAChC;AAEA,MAAI,YAAY,qBAAqB;AACnC,YAAQ,eAAe,IAAI,YAAY;AAAA,EACzC;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAG,OAAO,UAAU,yBAAyB;AAAA,MACxE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,WAAW,KAAK,SAAS,gBAAgB,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,qCAAqC,OAAO;AAAA,IACrD;AAAA,EACF;AACF;AAKA,eAAsB,OACpB,QACA,SAC6B;AAC7B,QAAM,eAAe,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAGpD,MAAI,CAAC,eAAe,QAAQ,WAAW,GAAG;AACxC,WAAO,uBAAuB,cAAc,+BAA+B;AAAA,EAC7E;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,GAAG;AACtD,UAAM,SAAS,gBAAgB,QAAQ,WAAW;AAClD,QAAI,QAAQ;AACV,UAAI,aAAa,OAAO;AACtB,gBAAQ,IAAI,+CAA+C;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAI,CAAC,gBAAgB,mBAAmB,aAAa,iBAAiB;AACpE,oBAAgB,kBAAkB,aAAa;AAAA,EACjD;AACA,MAAI,CAAC,gBAAgB,oBAAoB,aAAa,kBAAkB;AACtE,oBAAgB,mBAAmB,aAAa;AAAA,EAClD;AAGA,MAAI,aAAa,OAAO;AACtB,YAAQ,IAAI,iDAAiD;AAAA,EAC/D;AAEA,QAAM,cAAc,MAAM,oBAAoB,cAAc,eAAe;AAG3E,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,uBAAuB,cAAc,YAAY,KAAK;AAAA,EAC/D;AAGA,MAAI,CAAC,YAAY,QAAQ,SAAS;AAChC,UAAMA,UAAqC;AAAA,MACzC,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,YAAY,QAAQ,SAAS,CAAC,YAAY,OAAO,MAAM,IAAI,CAAC,eAAe;AAAA,MAC1F,gBAAgB,YAAY,QAAQ;AAAA,MACpC,kBAAkB,YAAY,QAAQ;AAAA,MACtC,UAAU;AAAA,QACR,SAAS,YAAY,QAAQ,UAAU;AAAA,QACvC,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA;AAAA,MAErB,WAAY,YAAwC;AAAA,MACpD,gBAAiB,YAAwC;AAAA,MACzD,uBAAwB,YAAwC;AAAA,IAClE;AAEA,WAAOA;AAAA,EACT;AAGA,QAAM,QAAmC,YAAY,QACjD;AAAA,IACE,SAAS,YAAY,MAAM;AAAA,IAC3B,MAAM,YAAY,MAAM;AAAA,IACxB,YAAY,YAAY,MAAM;AAAA,IAC9B,YAAY,cAAc,YAAY,MAAM,UAAU;AAAA,IACtD,oBAAoB,YAAY,MAAM,qBAAqB;AAAA,IAC3D,QAAQ,YAAY,MAAM;AAAA,EAC5B,IACA;AAEJ,QAAM,YAA2C,YAAY,YACzD;AAAA,IACE,UAAU,YAAY,UAAU;AAAA,IAChC,MAAM,YAAY,UAAU;AAAA,IAC5B,YAAY,YAAY,UAAU,cAAc;AAAA,IAChD,UAAU,YAAY,UAAU;AAAA,EAClC,IACA;AAEJ,QAAM,eAAiD,YAAY,eAC/D;AAAA,IACE,MAAM,YAAY,aAAa;AAAA,IAC/B,UAAU,YAAY,aAAa;AAAA,IACnC,YAAY,YAAY,aAAa;AAAA,EACvC,IACA;AAEJ,QAAM,QAA+B,YAAY,QAAQ,QACrD;AAAA,IACE,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,0BAA0B,YAAY,OAAO,MAAM;AAAA,IACnD,eAAe,YAAY,OAAO;AAAA,EACpC,IACA;AAGJ,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc;AACpB,QAAM,cAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,UAAU,aAAa,iBAAiB;AAAA,MACxC,MAAM,aAAa,wBAAwB;AAAA,IAC7C;AAAA,EACF;AAEA,QAAM,SAAqC;AAAA,IACzC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,YAAY,QAAQ;AAAA,IACpC,kBAAkB,YAAY,QAAQ;AAAA,IACtC,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,aAAa;AAAA;AAAA,IAEvB,WAAY,YAAwC;AAAA,IACpD,kBAAmB,YAAwC;AAAA,IAC3D,eAAgB,YAAwC;AAAA,IACxD,gBAAiB,YAAwC;AAAA,IACzD,uBAAwB,YAAwC;AAAA,EAClE;AAGA,MAAI,OAAO,mBAAmB,QAAQ;AACpC,WAAO,WAAW;AAClB,WAAO,cAAc;AACrB,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,2CAA2C;AACnG,QAAI,OAAO,kBAAkB;AAC3B,aAAO,WAAW;AAAA,QAChB,SAAS,wBAAwB,OAAO,iBAAiB,UAAU,0BAA0B;AAAA,QAC7F,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF,WAAW,OAAO,mBAAmB,oBAAoB;AACvD,WAAO,iBAAiB;AACxB,QAAI,uBAAuB,OAAO,WAAW,IAAI,uBAAuB,WAAW,GAAG;AACpF,aAAO,cAAc;AAAA,IACvB;AACA,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,+BAA+B;AAAA,EACzF;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,KAAK,OAAO,mBAAmB,QAAQ;AAC1F,gBAAY,QAAQ,aAAa,QAAQ,aAAa,QAAQ;AAAA,EAChE;AAEA,SAAO;AACT;;;ACzZA,SAAS,kCAAkC,SAAwC;AACjF,QAAM,cAAgC,CAAC;AAGvC,QAAM,UAAU,QAAQ,QAAQ,IAAI,YAAY,KAAK,QAAQ,QAAQ,IAAI,YAAY;AACrF,MAAI,SAAS;AACX,gBAAY,UAAU;AAAA,EACxB;AAGA,QAAM,SAAS,QAAQ,QAAQ,IAAI,WAAW,KAAK,QAAQ,QAAQ,IAAI,WAAW;AAClF,MAAI,QAAQ;AACV,gBAAY,SAAS;AAAA,EACvB;AAGA,QAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,MAAI,YAAY;AACd,gBAAY,sBAAsB;AAClC,QAAI,WAAW,WAAW,SAAS,GAAG;AACpC,kBAAY,MAAM,WAAW,MAAM,CAAC;AAAA,IACtC;AAAA,EACF;AAGA,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,eAAe,IAAI,aAAa,IAAI,SAAS;AACnD,QAAM,cAAc,IAAI,aAAa,IAAI,QAAQ;AAEjD,MAAI,gBAAgB,CAAC,YAAY,SAAS;AACxC,gBAAY,UAAU;AAAA,EACxB;AACA,MAAI,eAAe,CAAC,YAAY,QAAQ;AACtC,gBAAY,SAAS;AAAA,EACvB;AAEA,SAAO;AACT;AAKA,SAAS,WAAW,SAAiB,MAAuB;AAC1D,QAAM,eAAe,QAClB,QAAQ,OAAO,IAAI,EACnB,QAAQ,OAAO,KAAK;AAEvB,QAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAKA,SAAS,gBACP,QACA,MACA,QAC+B;AAC/B,SAAO,OAAO,KAAK,CAAC,UAAU;AAC5B,UAAM,gBAAgB,MAAM,WAAW,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO,YAAY;AAChG,UAAM,cAAc,WAAW,MAAM,SAAS,IAAI;AAClD,WAAO,iBAAiB;AAAA,EAC1B,CAAC;AACH;AAKA,SAAS,aAAa,QAAwB;AAC5C,UAAQ,OAAO,YAAY,GAAG;AAAA,IAC5B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,2BACP,QACA,SACQ;AACR,QAAM,QAAQ,QAAQ,gBAAgB,SAAS;AAC/C,QAAM,UAAU,QAAQ,gBAAgB,WACtC,OAAO,UAAU,WACjB;AACF,QAAM,kBAAkB,OAAO,UAAU,mBAAmB;AAC5D,QAAM,UAAU,OAAO,UAAU,oBAAoB;AACrD,QAAM,aAAa,QAAQ,gBAAgB,oBAAoB;AAE/D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAME,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BA4Ge,KAAK;AAAA,gCACJ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,mCAKJ,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAQjC,eAAe;AAAA,QACxB,aAAa,8GAA8G,EAAE;AAAA;AAAA;AAAA;AAAA,6BAIxG,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhC,KAAK;AACT;AAKO,SAAS,iBAAiB,SAAkC;AACjE,QAAM;AAAA,IACJ,SAAS,CAAC;AAAA,IACV,YAAY,CAAC;AAAA,IACb,qBAAqB;AAAA,IACrB,GAAG;AAAA,EACL,IAAI;AAEJ,SAAO,eAAe,WAAW,SAAsB;AAErD,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,aAAa;AAEnD,UAAM,WAAW,QAAQ,QAAQ;AAGjC,UAAM,aAAa,UAAU,KAAK,CAAC,YAAY,WAAW,SAAS,QAAQ,CAAC;AAC5E,QAAI,YAAY;AACd,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,cAAc,gBAAgB,QAAQ,UAAU,QAAQ,MAAM;AAGpE,QAAI,CAAC,aAAa;AAChB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,YAAY,mBAAmB,QAAQ;AACzC,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,cAAc,kCAAkC,OAAO;AAG7D,QAAI,CAAC,eAAe,WAAW,KAAK,YAAY,mBAAmB,YAAY;AAC7E,YAAMC,UAA6B;AAAA,QACjC,UAAU;AAAA,QACV,aAAa;AAAA,QACb,eAAe,CAAC,+BAA+B;AAAA,QAC/C,UAAU;AAAA,UACR,SAAS;AAAA,UACT,iBAAiB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,UAC1D,kBAAkB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAC7D;AAAA,QACA,YAAY,oBAAI,KAAK;AAAA,MACvB;AAGA,UAAI,SAAS,WAAW,OAAO,GAAG;AAChC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,UAAUA,QAAO;AAAA,YACnB;AAAA,UACF;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAGA,UAAI,oBAAoB;AACtB,eAAO,IAAI,aAAa,2BAA2BA,SAAQ,OAAO,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,4BAA4B;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAGA,YAAM,cAAcA,QAAO,UAAU,mBAAmB;AACxD,aAAO,aAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAAA,IAChE;AAGA,UAAM,UAAU,QAAQ,QAAQ,IAAI,WAAW,KAAK,aAAa,QAAQ,MAAM;AAC/E,UAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,MAClC;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ,OAAO,YAAY;AAAA,MACnC,UAAU;AAAA,MACV,UAAU,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAAA,MAC3E,WAAW,QAAQ,QAAQ,IAAI,YAAY,KAAK;AAAA,IAClD,CAAC;AAGD,QAAI,CAAC,iBAAiB,OAAO,aAAa,YAAY,cAAc,GAAG;AAErE,UAAI,SAAS,WAAW,OAAO,GAAG;AAChC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM,OAAO,WAAW,wBAAwB;AAAA,cAChD,SAAS,OAAO,gBAAgB,CAAC,KAAK;AAAA,cACtC,aAAa,OAAO;AAAA,cACpB,UAAU,YAAY;AAAA,cACtB,UAAU,OAAO;AAAA,YACnB;AAAA,UACF;AAAA,UACA,EAAE,QAAQ,OAAO,WAAW,MAAM,IAAI;AAAA,QACxC;AAAA,MACF;AAGA,UAAI,oBAAoB;AACtB,eAAO,IAAI,aAAa,2BAA2B,QAAQ,OAAO,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,4BAA4B;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAGA,aAAO,aAAa,SAAS,IAAI,IAAI,iBAAiB,QAAQ,GAAG,CAAC;AAAA,IACpE;AAGA,UAAM,WAAW,aAAa,KAAK;AAGnC,aAAS,QAAQ,IAAI,wBAAwB,OAAO,SAAS,SAAS,CAAC;AACvE,aAAS,QAAQ,IAAI,4BAA4B,OAAO,WAAW;AAEnE,QAAI,OAAO,OAAO;AAChB,eAAS,QAAQ,IAAI,wBAAwB,OAAO,MAAM,OAAO;AACjE,eAAS,QAAQ,IAAI,2BAA2B,OAAO,MAAM,WAAW,SAAS,CAAC;AAAA,IACpF;AAEA,WAAO;AAAA,EACT;AACF;AAKO,SAAS,oBAAoB,OAAwC;AAC1E,SAAO,EAAE,SAAS,MAAM;AAC1B;","names":["result","result"]}
+{"version":3,"sources":["../../src/access-levels.ts","../../src/verify.ts","../../src/adapters/nextjs.ts"],"sourcesContent":["/**\n * AstraSync Universal Verification Gateway - Access Level Definitions\n *\n * Defines the hierarchy and capabilities of each access level.\n */\n\nimport type { AccessLevel, TrustLevel } from './types';\n\n/**\n * Access level hierarchy (higher number = more access)\n */\nexport const ACCESS_LEVEL_HIERARCHY: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 1,\n  'read-only': 2,\n  standard: 3,\n  full: 4,\n  internal: 5,\n};\n\n/**\n * Access level descriptions for UI\n */\nexport const ACCESS_LEVEL_DESCRIPTIONS: Record<AccessLevel, string> = {\n  none: 'No access - credentials required',\n  guidance: 'Guidance mode - registration information provided',\n  'read-only': 'Read-only access - can browse but not modify',\n  standard: 'Standard access - normal operations per PDLSS policy',\n  full: 'Full access - all operations for high-trust agents',\n  internal: 'Internal access - organization member privileges',\n};\n\n/**\n * Default trust score thresholds for access levels\n */\nexport const DEFAULT_TRUST_THRESHOLDS: Record<AccessLevel, number> = {\n  none: 0,\n  guidance: 0,\n  'read-only': 20,\n  standard: 40,\n  full: 70,\n  internal: 0, // Internal is based on org membership, not score\n};\n\n/**\n * Trust level score ranges\n */\nexport const TRUST_LEVEL_RANGES: Record<TrustLevel, { min: number; max: number }> = {\n  BRONZE: { min: 0, max: 39 },\n  SILVER: { min: 40, max: 59 },\n  GOLD: { min: 60, max: 79 },\n  PLATINUM: { min: 80, max: 100 },\n};\n\n/**\n * Determine trust level from score\n */\nexport function getTrustLevel(score: number): TrustLevel {\n  if (score >= 80) return 'PLATINUM';\n  if (score >= 60) return 'GOLD';\n  if (score >= 40) return 'SILVER';\n  return 'BRONZE';\n}\n\n/**\n * Check if access level A is greater than or equal to access level B\n */\nexport function hasMinimumAccess(actual: AccessLevel, required: AccessLevel): boolean {\n  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];\n}\n\n/**\n * Get the highest access level for a given trust score\n */\nexport function getAccessLevelForScore(\n  trustScore: number,\n  thresholds: Record<AccessLevel, number> = DEFAULT_TRUST_THRESHOLDS\n): AccessLevel {\n  if (trustScore >= thresholds.full) return 'full';\n  if (trustScore >= thresholds.standard) return 'standard';\n  if (trustScore >= thresholds['read-only']) return 'read-only';\n  return 'guidance';\n}\n\n/**\n * Determine access level from verification result\n */\nexport function determineAccessLevel(\n  verified: boolean,\n  trustScore: number,\n  isOrgMember: boolean,\n  customThresholds?: Partial<Record<AccessLevel, number>>\n): AccessLevel {\n  if (!verified) {\n    return 'guidance';\n  }\n\n  if (isOrgMember) {\n    return 'internal';\n  }\n\n  const thresholds = {\n    ...DEFAULT_TRUST_THRESHOLDS,\n    ...customThresholds,\n  };\n\n  return getAccessLevelForScore(trustScore, thresholds);\n}\n\n/**\n * Access capabilities per level\n */\nexport interface AccessCapabilities {\n  canRead: boolean;\n  canWrite: boolean;\n  canDelete: boolean;\n  canAdmin: boolean;\n  canAccessInternal: boolean;\n  maxTransactionValue?: number;\n  allowedPurposes?: string[];\n}\n\n/**\n * Get capabilities for an access level\n */\nexport function getCapabilities(accessLevel: AccessLevel): AccessCapabilities {\n  switch (accessLevel) {\n    case 'none':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'guidance':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'read-only':\n      return {\n        canRead: true,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'standard':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'full':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'internal':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: true,\n        canAccessInternal: true,\n      };\n    default:\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n  }\n}\n","/**\n * AstraSync Universal Verification Gateway - Core Verification Logic\n *\n * This module handles the core verification logic, calling the AstraSync API\n * and processing the response into a standardized VerificationResult.\n */\n\nimport type {\n  GatewayConfig,\n  AgentCredentials,\n  VerificationRequest,\n  VerificationResult,\n  VerifiedAgent,\n  VerifiedDeveloper,\n  VerifiedOrganization,\n  PDLSSInfo,\n  GuidanceInfo,\n  AccessLevel,\n  EnhancedVerificationResult,\n  TokenGuidance,\n  RuntimeChallengeResult,\n} from './types';\nimport { determineAccessLevel, getTrustLevel, ACCESS_LEVEL_HIERARCHY } from './access-levels';\n\n/**\n * Default configuration values\n */\nconst DEFAULT_CONFIG: Partial<GatewayConfig> = {\n  apiBaseUrl: 'https://api.astrasync.ai',\n  defaultAccessLevel: 'guidance',\n  minTrustScore: 40,\n  minTrustScoreForFull: 70,\n  cacheTtl: 300, // 5 minutes\n  debug: false,\n};\n\n/**\n * Simple in-memory cache for verification results\n */\nconst verificationCache = new Map<string, { result: VerificationResult; expiresAt: number }>();\n\n/**\n * Generate cache key from credentials\n */\nfunction getCacheKey(credentials: AgentCredentials): string {\n  return `${credentials.astraId || ''}-${credentials.apiKey || ''}-${credentials.jwt || ''}`;\n}\n\n/**\n * Check if cached result is still valid\n */\nfunction getCachedResult(credentials: AgentCredentials): VerificationResult | null {\n  const key = getCacheKey(credentials);\n  const cached = verificationCache.get(key);\n\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.result;\n  }\n\n  if (cached) {\n    verificationCache.delete(key);\n  }\n\n  return null;\n}\n\n/**\n * Cache a verification result\n */\nfunction cacheResult(credentials: AgentCredentials, result: VerificationResult, ttlSeconds: number): void {\n  const key = getCacheKey(credentials);\n  verificationCache.set(key, {\n    result,\n    expiresAt: Date.now() + ttlSeconds * 1000,\n  });\n}\n\n/**\n * Clear the verification cache\n */\nexport function clearCache(): void {\n  verificationCache.clear();\n}\n\n/**\n * Extract agent credentials from various sources\n */\nexport function extractCredentials(\n  headers: Record<string, string | string[] | undefined>,\n  query?: Record<string, string | undefined>\n): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers (case-insensitive)\n  const astraIdHeader = headers['x-astra-id'] || headers['X-Astra-Id'] || headers['X-ASTRA-ID'];\n  if (astraIdHeader) {\n    credentials.astraId = Array.isArray(astraIdHeader) ? astraIdHeader[0] : astraIdHeader;\n  }\n\n  // Check for API key in headers\n  const apiKeyHeader = headers['x-api-key'] || headers['X-Api-Key'] || headers['X-API-KEY'];\n  if (apiKeyHeader) {\n    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;\n  }\n\n  // Check Authorization header for Bearer token\n  const authHeader = headers['authorization'] || headers['Authorization'];\n  if (authHeader) {\n    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n    credentials.authorizationHeader = authValue;\n\n    if (authValue.startsWith('Bearer ')) {\n      credentials.jwt = authValue.slice(7);\n    }\n  }\n\n  // Check query parameters as fallback\n  if (query) {\n    if (query.astraId && !credentials.astraId) {\n      credentials.astraId = query.astraId;\n    }\n    if (query.apiKey && !credentials.apiKey) {\n      credentials.apiKey = query.apiKey;\n    }\n  }\n\n  return credentials;\n}\n\n/**\n * Check if credentials are present\n */\nexport function hasCredentials(credentials: AgentCredentials): boolean {\n  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);\n}\n\n/**\n * Create guidance response for unverified agents\n */\nfunction createGuidanceResponse(config: GatewayConfig, reason?: string): VerificationResult {\n  const guidance: GuidanceInfo = {\n    message: 'This service verifies AI agents before granting access. Please register your agent with AstraSync.',\n    registrationUrl: `${config.apiBaseUrl.replace('/api', '')}/register`,\n    documentationUrl: `${config.apiBaseUrl.replace('/api', '')}/docs/agent-access`,\n    steps: [\n      'Register for an AstraSync account',\n      'Create and register your agent',\n      'Add your ASTRA-ID to request headers',\n      'Retry your request',\n    ],\n  };\n\n  return {\n    verified: false,\n    accessLevel: 'guidance',\n    guidance,\n    denialReasons: reason ? [reason] : ['No valid agent credentials provided'],\n    verifiedAt: new Date(),\n  };\n}\n\n/**\n * Call the AstraSync verify-access API\n */\nasync function callVerifyAccessAPI(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<{\n  success: boolean;\n  access?: {\n    allowed: boolean;\n    reason?: string;\n    requiresStepUp?: boolean;\n    requiresApproval?: boolean;\n    appliedPolicy?: {\n      boundaryId: string;\n      boundaryName: string;\n      policyId: string;\n      policyVersion: string;\n    };\n    pdlss?: {\n      purposeAllowed: boolean;\n      withinDuration: boolean;\n      withinLimits: boolean;\n      scopeAllowed: boolean;\n      selfInstantiationAllowed: boolean;\n    };\n    counterparty?: {\n      id: string;\n      name: string;\n      trustScoreRequirement: number;\n    };\n  };\n  agent?: {\n    kyaAgentId: string;\n    astraId: string;\n    name: string;\n    trustScore: number;\n    trustLevel: string;\n    agentStatus: string;\n    blockchainStatus: string;\n  };\n  developer?: {\n    kyaOwnerId: string;\n    fullName: string;\n    email: string;\n    identityVerified: boolean;\n    trustScore: number;\n  };\n  organization?: {\n    name: string;\n    verified: boolean;\n    trustScore: number;\n  };\n  error?: string;\n}> {\n  const { credentials, ...requestData } = request;\n\n  // Build the request body\n  const body: Record<string, unknown> = {\n    agentId: credentials.astraId,\n    purpose: requestData.purpose || 'general',\n  };\n\n  // Add optional fields\n  if (requestData.action) body.action = requestData.action;\n  if (requestData.resourceType) body.resourceType = requestData.resourceType;\n  if (requestData.resource) body.resource = requestData.resource;\n  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;\n  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;\n  if (requestData.currency) body.currency = requestData.currency;\n  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;\n  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;\n  if (requestData.subAgentDepth !== undefined) body.subAgentDepth = requestData.subAgentDepth;\n  // Handshake Protocol v10 additions\n  if (requestData.enableRuntimeChallenge) body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;\n  if (requestData.createSession) body.createSession = requestData.createSession;\n  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;\n  if (requestData.counterpartyUrl) body.counterpartyUrl = requestData.counterpartyUrl;\n  if (requestData.runtimeChallengeOptions) body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;\n\n  // Build headers\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    ...config.customHeaders,\n  };\n\n  if (config.apiKey) {\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  if (credentials.authorizationHeader) {\n    headers['Authorization'] = credentials.authorizationHeader;\n  }\n\n  try {\n    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: data.message || data.error || `API returned ${response.status}`,\n      };\n    }\n\n    return data;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return {\n      success: false,\n      error: `Failed to call verify-access API: ${message}`,\n    };\n  }\n}\n\n/**\n * Main verification function\n */\nexport async function verify(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n\n  // Check for credentials\n  if (!hasCredentials(request.credentials)) {\n    return createGuidanceResponse(mergedConfig, 'No agent credentials provided');\n  }\n\n  // Check cache first\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {\n    const cached = getCachedResult(request.credentials);\n    if (cached) {\n      if (mergedConfig.debug) {\n        console.log('[VerificationGateway] Returning cached result');\n      }\n      return cached;\n    }\n  }\n\n  // Inject counterparty info from config if not already set in request\n  const enrichedRequest = { ...request };\n  if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {\n    enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;\n  }\n  if (!enrichedRequest.counterpartyType && mergedConfig.counterpartyType) {\n    enrichedRequest.counterpartyType = mergedConfig.counterpartyType;\n  }\n\n  // Call the API\n  if (mergedConfig.debug) {\n    console.log('[VerificationGateway] Calling verify-access API');\n  }\n\n  const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);\n\n  // Handle API errors\n  if (!apiResponse.success) {\n    return createGuidanceResponse(mergedConfig, apiResponse.error);\n  }\n\n  // Check access result\n  if (!apiResponse.access?.allowed) {\n    const result: EnhancedVerificationResult = {\n      verified: false,\n      accessLevel: 'guidance',\n      denialReasons: apiResponse.access?.reason ? [apiResponse.access.reason] : ['Access denied'],\n      requiresStepUp: apiResponse.access?.requiresStepUp,\n      requiresApproval: apiResponse.access?.requiresApproval,\n      guidance: {\n        message: apiResponse.access?.reason || 'Access denied by PDLSS policy',\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/pdlss`,\n      },\n      verifiedAt: new Date(),\n      // Extract sessionId so decisions can be recorded for denials too\n      sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n      recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n      recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n    };\n\n    return result;\n  }\n\n  // Build successful result\n  const agent: VerifiedAgent | undefined = apiResponse.agent\n    ? {\n        astraId: apiResponse.agent.astraId,\n        name: apiResponse.agent.name,\n        trustScore: apiResponse.agent.trustScore,\n        trustLevel: getTrustLevel(apiResponse.agent.trustScore),\n        blockchainVerified: apiResponse.agent.blockchainStatus === 'verified',\n        status: apiResponse.agent.agentStatus as VerifiedAgent['status'],\n      }\n    : undefined;\n\n  const developer: VerifiedDeveloper | undefined = apiResponse.developer\n    ? {\n        astradId: apiResponse.developer.kyaOwnerId,\n        name: apiResponse.developer.fullName,\n        trustScore: apiResponse.developer.trustScore || 0,\n        verified: apiResponse.developer.identityVerified,\n      }\n    : undefined;\n\n  const organization: VerifiedOrganization | undefined = apiResponse.organization\n    ? {\n        name: apiResponse.organization.name,\n        verified: apiResponse.organization.verified,\n        trustScore: apiResponse.organization.trustScore,\n      }\n    : undefined;\n\n  const pdlss: PDLSSInfo | undefined = apiResponse.access?.pdlss\n    ? {\n        purposeAllowed: apiResponse.access.pdlss.purposeAllowed,\n        withinDuration: apiResponse.access.pdlss.withinDuration,\n        withinLimits: apiResponse.access.pdlss.withinLimits,\n        scopeAllowed: apiResponse.access.pdlss.scopeAllowed,\n        selfInstantiationAllowed: apiResponse.access.pdlss.selfInstantiationAllowed,\n        appliedPolicy: apiResponse.access.appliedPolicy,\n      }\n    : undefined;\n\n  // Determine access level based on trust score\n  const trustScore = agent?.trustScore || 0;\n  const isOrgMember = false; // TODO: Check if agent belongs to same org as counterparty\n  const accessLevel: AccessLevel = determineAccessLevel(\n    true,\n    trustScore,\n    isOrgMember,\n    {\n      'read-only': 20,\n      standard: mergedConfig.minTrustScore || 40,\n      full: mergedConfig.minTrustScoreForFull || 70,\n    }\n  );\n\n  const result: EnhancedVerificationResult = {\n    verified: true,\n    accessLevel,\n    agent,\n    developer,\n    organization,\n    pdlss,\n    requiresStepUp: apiResponse.access?.requiresStepUp,\n    requiresApproval: apiResponse.access?.requiresApproval,\n    verifiedAt: new Date(),\n    cacheTtl: mergedConfig.cacheTtl,\n    // Handshake Protocol v10 enhanced fields (present when backend returns them)\n    sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n    runtimeChallenge: (apiResponse as Record<string, unknown>).runtimeChallenge as RuntimeChallengeResult | undefined,\n    tokenGuidance: (apiResponse as Record<string, unknown>).tokenGuidance as TokenGuidance | undefined,\n    recommendation: (apiResponse as Record<string, unknown>).recommendation as EnhancedVerificationResult['recommendation'],\n    recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as string[] | undefined,\n  };\n\n  // Enforce AstraSync recommendation\n  if (result.recommendation === 'deny') {\n    result.verified = false;\n    result.accessLevel = 'none';\n    result.denialReasons = result.recommendationReasons || ['Access denied by AstraSync recommendation'];\n    if (result.runtimeChallenge) {\n      result.guidance = {\n        message: `Verification failed: ${result.runtimeChallenge.reason || 'runtime challenge failed'}`,\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/runtime-challenge`,\n      };\n    }\n  } else if (result.recommendation === 'step_up_required') {\n    result.requiresStepUp = true;\n    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY['read-only']) {\n      result.accessLevel = 'read-only';\n    }\n    result.denialReasons = result.recommendationReasons || ['Step-up verification required'];\n  }\n\n  // Cache the result (skip caching denials — agent may fix challenge endpoint and retry)\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== 'deny') {\n    cacheResult(request.credentials, result, mergedConfig.cacheTtl);\n  }\n\n  return result;\n}\n\n/**\n * Record a counterparty's grant/deny decision for a verification session.\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function recordDecision(\n  config: GatewayConfig,\n  sessionId: string,\n  decision: 'granted' | 'denied',\n  reason?: string,\n): Promise<void> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) headers['X-API-Key'] = config.apiKey;\n\n  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {\n    method: 'POST',\n    headers,\n    body: JSON.stringify({ decision, reason }),\n  }).catch(() => { /* fire-and-forget */ });\n}\n\n/**\n * Verify an agent AND automatically record the grant/deny decision.\n *\n * This is the recommended entry point for counterparties that call verify()\n * directly (e.g. MCP servers) rather than using createMiddleware().\n * It adds createSession: true, then fire-and-forgets the decision.\n */\nexport async function verifyAndRecord(\n  config: GatewayConfig,\n  request: VerificationRequest,\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n  const result = await verify(mergedConfig, { ...request, createSession: true });\n  const sessionId = (result as EnhancedVerificationResult).sessionId;\n\n  if (sessionId) {\n    if (result.verified) {\n      recordDecision(mergedConfig, sessionId, 'granted').catch(() => {});\n    } else {\n      recordDecision(mergedConfig, sessionId, 'denied', result.denialReasons?.[0]).catch(() => {});\n    }\n  }\n\n  return result;\n}\n\n/**\n * Quick verification - just check if credentials are valid\n */\nexport async function quickVerify(\n  config: GatewayConfig,\n  credentials: AgentCredentials\n): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n  const result = await verify(config, {\n    credentials,\n    purpose: 'verification',\n  });\n\n  return {\n    verified: result.verified,\n    accessLevel: result.accessLevel,\n    reason: result.denialReasons?.[0],\n  };\n}\n","/**\n * AstraSync Universal Verification Gateway - Next.js Middleware\n *\n * Next.js middleware for verifying AI agents on web applications.\n * Supports Commerce Shield overlay for unverified agents.\n *\n * @example\n * ```typescript\n * // middleware.ts\n * import { createMiddleware } from '@astrasyncai/verification-gateway/nextjs';\n *\n * export const middleware = createMiddleware({\n *   apiBaseUrl: 'https://api.astrasync.ai',\n *   showCommerceShield: true,\n *   routes: [\n *     { pattern: '/api/public/*', method: '*', minAccessLevel: 'none' },\n *     { pattern: '/api/*', method: '*', minAccessLevel: 'standard' },\n *     { pattern: '/dashboard/*', method: '*', minAccessLevel: 'read-only' },\n *   ],\n * });\n *\n * export const config = {\n *   matcher: ['/api/:path*', '/dashboard/:path*'],\n * };\n * ```\n */\n\nimport type { NextRequest } from 'next/server';\nimport type {\n  NextJsMiddlewareOptions,\n  AgentCredentials,\n  VerificationResult,\n  RouteAccessConfig,\n} from '../types';\nimport { verify, hasCredentials } from '../verify';\nimport { hasMinimumAccess } from '../access-levels';\n\n/**\n * Extract credentials from Next.js request\n */\nfunction extractCredentialsFromNextRequest(request: NextRequest): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers\n  const astraId = request.headers.get('x-astra-id') || request.headers.get('X-Astra-Id');\n  if (astraId) {\n    credentials.astraId = astraId;\n  }\n\n  // Check for API key\n  const apiKey = request.headers.get('x-api-key') || request.headers.get('X-Api-Key');\n  if (apiKey) {\n    credentials.apiKey = apiKey;\n  }\n\n  // Check Authorization header\n  const authHeader = request.headers.get('authorization');\n  if (authHeader) {\n    credentials.authorizationHeader = authHeader;\n    if (authHeader.startsWith('Bearer ')) {\n      credentials.jwt = authHeader.slice(7);\n    }\n  }\n\n  // Check query parameters\n  const url = new URL(request.url);\n  const astraIdParam = url.searchParams.get('astraId');\n  const apiKeyParam = url.searchParams.get('apiKey');\n\n  if (astraIdParam && !credentials.astraId) {\n    credentials.astraId = astraIdParam;\n  }\n  if (apiKeyParam && !credentials.apiKey) {\n    credentials.apiKey = apiKeyParam;\n  }\n\n  return credentials;\n}\n\n/**\n * Match a route pattern against a path\n */\nfunction matchRoute(pattern: string, path: string): boolean {\n  const regexPattern = pattern.replace(/\\*/g, '.*').replace(/\\//g, '\\\\/');\n\n  const regex = new RegExp(`^${regexPattern}$`);\n  return regex.test(path);\n}\n\n/**\n * Find the route configuration for a request\n */\nfunction findRouteConfig(\n  routes: RouteAccessConfig[],\n  path: string,\n  method: string\n): RouteAccessConfig | undefined {\n  return routes.find((route) => {\n    const methodMatches =\n      route.method === '*' || route.method.toUpperCase() === method.toUpperCase();\n    const pathMatches = matchRoute(route.pattern, path);\n    return methodMatches && pathMatches;\n  });\n}\n\n/**\n * Infer purpose from request method\n */\nfunction inferPurpose(method: string): string {\n  switch (method.toUpperCase()) {\n    case 'GET':\n      return 'read';\n    case 'POST':\n      return 'create';\n    case 'PUT':\n    case 'PATCH':\n      return 'update';\n    case 'DELETE':\n      return 'delete';\n    default:\n      return 'general';\n  }\n}\n\n/**\n * Generate Commerce Shield HTML response\n */\nfunction generateCommerceShieldHtml(\n  result: VerificationResult,\n  options: NextJsMiddlewareOptions\n): string {\n  const title = options.commerceShield?.title || 'AstraSync Agent Verification';\n  const message =\n    options.commerceShield?.message ||\n    result.guidance?.message ||\n    \"This site verifies AI agents before granting access. We noticed you're visiting without AstraSync credentials.\";\n  const registrationUrl = result.guidance?.registrationUrl || 'https://astrasync.ai/register';\n  const docsUrl = result.guidance?.documentationUrl || 'https://astrasync.ai/docs/agent-access';\n  const allowGuest = options.commerceShield?.allowGuestAccess ?? true;\n\n  return `\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>${title}</title>\n  <style>\n    * {\n      box-sizing: border-box;\n      margin: 0;\n      padding: 0;\n    }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;\n      background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .shield-container {\n      background: rgba(255, 255, 255, 0.95);\n      border-radius: 16px;\n      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);\n      max-width: 480px;\n      width: 100%;\n      padding: 40px;\n      text-align: center;\n    }\n    .shield-icon {\n      font-size: 48px;\n      margin-bottom: 20px;\n    }\n    .shield-title {\n      font-size: 24px;\n      font-weight: 700;\n      color: #1a1a2e;\n      margin-bottom: 16px;\n    }\n    .shield-message {\n      color: #4a5568;\n      line-height: 1.6;\n      margin-bottom: 24px;\n    }\n    .shield-steps {\n      text-align: left;\n      background: #f7fafc;\n      border-radius: 8px;\n      padding: 20px;\n      margin-bottom: 24px;\n    }\n    .shield-steps h3 {\n      font-size: 14px;\n      font-weight: 600;\n      color: #2d3748;\n      margin-bottom: 12px;\n    }\n    .shield-steps ol {\n      padding-left: 20px;\n      color: #4a5568;\n    }\n    .shield-steps li {\n      margin-bottom: 8px;\n    }\n    .shield-buttons {\n      display: flex;\n      flex-direction: column;\n      gap: 12px;\n    }\n    .btn {\n      display: inline-block;\n      padding: 14px 24px;\n      border-radius: 8px;\n      font-weight: 600;\n      text-decoration: none;\n      transition: all 0.2s;\n      cursor: pointer;\n      border: none;\n      font-size: 16px;\n    }\n    .btn-primary {\n      background: linear-gradient(135deg, #6366f1 0%, #4f46e5 100%);\n      color: white;\n    }\n    .btn-primary:hover {\n      transform: translateY(-2px);\n      box-shadow: 0 4px 12px rgba(99, 102, 241, 0.4);\n    }\n    .btn-secondary {\n      background: #e2e8f0;\n      color: #4a5568;\n    }\n    .btn-secondary:hover {\n      background: #cbd5e0;\n    }\n    .shield-footer {\n      margin-top: 24px;\n      font-size: 14px;\n      color: #718096;\n    }\n    .shield-footer a {\n      color: #6366f1;\n      text-decoration: none;\n    }\n    .shield-footer a:hover {\n      text-decoration: underline;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"shield-container\">\n    <div class=\"shield-icon\">🛡️</div>\n    <h1 class=\"shield-title\">${title}</h1>\n    <p class=\"shield-message\">${message}</p>\n\n    <div class=\"shield-steps\">\n      <h3>To get verified access:</h3>\n      <ol>\n        <li>Register at <a href=\"${registrationUrl}\">astrasync.ai/register</a></li>\n        <li>Create and register your agent</li>\n        <li>Add your ASTRA-ID to request headers</li>\n        <li>Refresh this page</li>\n      </ol>\n    </div>\n\n    <div class=\"shield-buttons\">\n      <a href=\"${registrationUrl}\" class=\"btn btn-primary\">Register Now</a>\n      ${allowGuest ? '<button onclick=\"window.location.reload()\" class=\"btn btn-secondary\">Continue as Guest (Limited)</button>' : ''}\n    </div>\n\n    <p class=\"shield-footer\">\n      Learn more: <a href=\"${docsUrl}\">Agent Access Documentation</a>\n    </p>\n  </div>\n</body>\n</html>\n  `.trim();\n}\n\n/**\n * Create Next.js middleware for agent verification\n */\nexport function createMiddleware(options: NextJsMiddlewareOptions) {\n  const { routes = [], skipPaths = [], showCommerceShield = true, ...config } = options;\n\n  return async function middleware(request: NextRequest) {\n    // Dynamic import NextResponse to avoid build issues\n    const { NextResponse } = await import('next/server');\n\n    const pathname = request.nextUrl.pathname;\n\n    // Check if path should be skipped\n    const shouldSkip = skipPaths.some((pattern) => matchRoute(pattern, pathname));\n    if (shouldSkip) {\n      return NextResponse.next();\n    }\n\n    // Find route configuration\n    const routeConfig = findRouteConfig(routes, pathname, request.method);\n\n    // If no route config, allow through\n    if (!routeConfig) {\n      return NextResponse.next();\n    }\n\n    // If route requires 'none' access, allow through\n    if (routeConfig.minAccessLevel === 'none') {\n      return NextResponse.next();\n    }\n\n    // Extract credentials\n    const credentials = extractCredentialsFromNextRequest(request);\n\n    // If no credentials and not just guidance level\n    if (!hasCredentials(credentials) && routeConfig.minAccessLevel !== 'guidance') {\n      const result: VerificationResult = {\n        verified: false,\n        accessLevel: 'none',\n        denialReasons: ['No agent credentials provided'],\n        guidance: {\n          message: 'This page requires agent verification.',\n          registrationUrl: `${config.apiBaseUrl?.replace('/api', '')}/register`,\n          documentationUrl: `${config.apiBaseUrl?.replace('/api', '')}/docs/agent-access`,\n        },\n        verifiedAt: new Date(),\n      };\n\n      // For API routes, return JSON\n      if (pathname.startsWith('/api/')) {\n        return NextResponse.json(\n          {\n            success: false,\n            error: {\n              code: 'UNAUTHORIZED',\n              message: 'No agent credentials provided',\n              guidance: result.guidance,\n            },\n          },\n          { status: 401 }\n        );\n      }\n\n      // For web pages, show Commerce Shield\n      if (showCommerceShield) {\n        return new NextResponse(generateCommerceShieldHtml(result, options), {\n          status: 200,\n          headers: {\n            'Content-Type': 'text/html',\n            'X-AstraSync-Verification': 'commerce-shield',\n          },\n        });\n      }\n\n      // Otherwise redirect to login/register\n      const registerUrl = result.guidance?.registrationUrl || '/register';\n      return NextResponse.redirect(new URL(registerUrl, request.url));\n    }\n\n    // Auto-detect counterparty URL from the request if not explicitly configured.\n    // Since the SDK is installed at this endpoint, we always know the origin.\n    const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;\n\n    // Verify the agent\n    const purpose = request.headers.get('x-purpose') || inferPurpose(request.method);\n    const result = await verify(config, {\n      credentials,\n      purpose,\n      action: request.method.toLowerCase(),\n      resource: pathname,\n      clientIp: request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || undefined,\n      userAgent: request.headers.get('user-agent') || undefined,\n      counterpartyUrl,\n      counterpartyType: config.counterpartyType || 'website',\n    });\n\n    // Check if access level is sufficient\n    if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {\n      // For API routes, return JSON\n      if (pathname.startsWith('/api/')) {\n        return NextResponse.json(\n          {\n            success: false,\n            error: {\n              code: result.verified ? 'INSUFFICIENT_ACCESS' : 'UNAUTHORIZED',\n              message: result.denialReasons?.[0] || 'Access denied',\n              accessLevel: result.accessLevel,\n              required: routeConfig.minAccessLevel,\n              guidance: result.guidance,\n            },\n          },\n          { status: result.verified ? 403 : 401 }\n        );\n      }\n\n      // For web pages, show Commerce Shield\n      if (showCommerceShield) {\n        return new NextResponse(generateCommerceShieldHtml(result, options), {\n          status: 200,\n          headers: {\n            'Content-Type': 'text/html',\n            'X-AstraSync-Verification': 'commerce-shield',\n          },\n        });\n      }\n\n      // Redirect to unauthorized page\n      return NextResponse.redirect(new URL('/unauthorized', request.url));\n    }\n\n    // All checks passed - continue with verification info in headers\n    const response = NextResponse.next();\n\n    // Add verification info to response headers\n    response.headers.set('X-AstraSync-Verified', result.verified.toString());\n    response.headers.set('X-AstraSync-Access-Level', result.accessLevel);\n\n    if (result.agent) {\n      response.headers.set('X-AstraSync-Agent-Id', result.agent.astraId);\n      response.headers.set('X-AstraSync-Trust-Score', result.agent.trustScore.toString());\n    }\n\n    return response;\n  };\n}\n\n/**\n * Helper to create matcher config\n */\nexport function createMatcherConfig(paths: string[]): { matcher: string[] } {\n  return { matcher: paths };\n}\n"],"mappings":";AAWO,IAAM,yBAAsD;AAAA,EACjE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AACZ;AAiBO,IAAM,2BAAwD;AAAA,EACnE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA;AACZ;AAeO,SAAS,cAAc,OAA2B;AACvD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAKO,SAAS,iBAAiB,QAAqB,UAAgC;AACpF,SAAO,uBAAuB,MAAM,KAAK,uBAAuB,QAAQ;AAC1E;AAKO,SAAS,uBACd,YACA,aAA0C,0BAC7B;AACb,MAAI,cAAc,WAAW,KAAM,QAAO;AAC1C,MAAI,cAAc,WAAW,SAAU,QAAO;AAC9C,MAAI,cAAc,WAAW,WAAW,EAAG,QAAO;AAClD,SAAO;AACT;AAKO,SAAS,qBACd,UACA,YACA,aACA,kBACa;AACb,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AAEA,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,uBAAuB,YAAY,UAAU;AACtD;;;AChFA,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AAAA;AAAA,EACV,OAAO;AACT;AAKA,IAAM,oBAAoB,oBAAI,IAA+D;AAK7F,SAAS,YAAY,aAAuC;AAC1D,SAAO,GAAG,YAAY,WAAW,EAAE,IAAI,YAAY,UAAU,EAAE,IAAI,YAAY,OAAO,EAAE;AAC1F;AAKA,SAAS,gBAAgB,aAA0D;AACjF,QAAM,MAAM,YAAY,WAAW;AACnC,QAAM,SAAS,kBAAkB,IAAI,GAAG;AAExC,MAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,QAAQ;AACV,sBAAkB,OAAO,GAAG;AAAA,EAC9B;AAEA,SAAO;AACT;AAKA,SAAS,YAAY,aAA+B,QAA4B,YAA0B;AACxG,QAAM,MAAM,YAAY,WAAW;AACnC,oBAAkB,IAAI,KAAK;AAAA,IACzB;AAAA,IACA,WAAW,KAAK,IAAI,IAAI,aAAa;AAAA,EACvC,CAAC;AACH;AAyDO,SAAS,eAAe,aAAwC;AACrE,SAAO,CAAC,EAAE,YAAY,WAAW,YAAY,UAAU,YAAY;AACrE;AAKA,SAAS,uBAAuB,QAAuB,QAAqC;AAC1F,QAAM,WAAyB;AAAA,IAC7B,SAAS;AAAA,IACT,iBAAiB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IACzD,kBAAkB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,aAAa;AAAA,IACb;AAAA,IACA,eAAe,SAAS,CAAC,MAAM,IAAI,CAAC,qCAAqC;AAAA,IACzE,YAAY,oBAAI,KAAK;AAAA,EACvB;AACF;AAKA,eAAe,oBACb,QACA,SAiDC;AACD,QAAM,EAAE,aAAa,GAAG,YAAY,IAAI;AAGxC,QAAM,OAAgC;AAAA,IACpC,SAAS,YAAY;AAAA,IACrB,SAAS,YAAY,WAAW;AAAA,EAClC;AAGA,MAAI,YAAY,OAAQ,MAAK,SAAS,YAAY;AAClD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,kBAAmB,MAAK,oBAAoB,YAAY;AACxE,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,kBAAkB,OAAW,MAAK,gBAAgB,YAAY;AAE9E,MAAI,YAAY,uBAAwB,MAAK,yBAAyB,YAAY;AAClF,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,gBAAiB,MAAK,kBAAkB,YAAY;AACpE,MAAI,YAAY,wBAAyB,MAAK,0BAA0B,YAAY;AAGpF,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAG,OAAO;AAAA,EACZ;AAEA,MAAI,OAAO,QAAQ;AACjB,YAAQ,WAAW,IAAI,OAAO;AAAA,EAChC;AAEA,MAAI,YAAY,qBAAqB;AACnC,YAAQ,eAAe,IAAI,YAAY;AAAA,EACzC;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAG,OAAO,UAAU,yBAAyB;AAAA,MACxE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,WAAW,KAAK,SAAS,gBAAgB,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,qCAAqC,OAAO;AAAA,IACrD;AAAA,EACF;AACF;AAKA,eAAsB,OACpB,QACA,SAC6B;AAC7B,QAAM,eAAe,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAGpD,MAAI,CAAC,eAAe,QAAQ,WAAW,GAAG;AACxC,WAAO,uBAAuB,cAAc,+BAA+B;AAAA,EAC7E;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,GAAG;AACtD,UAAM,SAAS,gBAAgB,QAAQ,WAAW;AAClD,QAAI,QAAQ;AACV,UAAI,aAAa,OAAO;AACtB,gBAAQ,IAAI,+CAA+C;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAI,CAAC,gBAAgB,mBAAmB,aAAa,iBAAiB;AACpE,oBAAgB,kBAAkB,aAAa;AAAA,EACjD;AACA,MAAI,CAAC,gBAAgB,oBAAoB,aAAa,kBAAkB;AACtE,oBAAgB,mBAAmB,aAAa;AAAA,EAClD;AAGA,MAAI,aAAa,OAAO;AACtB,YAAQ,IAAI,iDAAiD;AAAA,EAC/D;AAEA,QAAM,cAAc,MAAM,oBAAoB,cAAc,eAAe;AAG3E,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,uBAAuB,cAAc,YAAY,KAAK;AAAA,EAC/D;AAGA,MAAI,CAAC,YAAY,QAAQ,SAAS;AAChC,UAAMA,UAAqC;AAAA,MACzC,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,YAAY,QAAQ,SAAS,CAAC,YAAY,OAAO,MAAM,IAAI,CAAC,eAAe;AAAA,MAC1F,gBAAgB,YAAY,QAAQ;AAAA,MACpC,kBAAkB,YAAY,QAAQ;AAAA,MACtC,UAAU;AAAA,QACR,SAAS,YAAY,QAAQ,UAAU;AAAA,QACvC,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA;AAAA,MAErB,WAAY,YAAwC;AAAA,MACpD,gBAAiB,YAAwC;AAAA,MACzD,uBAAwB,YAAwC;AAAA,IAClE;AAEA,WAAOA;AAAA,EACT;AAGA,QAAM,QAAmC,YAAY,QACjD;AAAA,IACE,SAAS,YAAY,MAAM;AAAA,IAC3B,MAAM,YAAY,MAAM;AAAA,IACxB,YAAY,YAAY,MAAM;AAAA,IAC9B,YAAY,cAAc,YAAY,MAAM,UAAU;AAAA,IACtD,oBAAoB,YAAY,MAAM,qBAAqB;AAAA,IAC3D,QAAQ,YAAY,MAAM;AAAA,EAC5B,IACA;AAEJ,QAAM,YAA2C,YAAY,YACzD;AAAA,IACE,UAAU,YAAY,UAAU;AAAA,IAChC,MAAM,YAAY,UAAU;AAAA,IAC5B,YAAY,YAAY,UAAU,cAAc;AAAA,IAChD,UAAU,YAAY,UAAU;AAAA,EAClC,IACA;AAEJ,QAAM,eAAiD,YAAY,eAC/D;AAAA,IACE,MAAM,YAAY,aAAa;AAAA,IAC/B,UAAU,YAAY,aAAa;AAAA,IACnC,YAAY,YAAY,aAAa;AAAA,EACvC,IACA;AAEJ,QAAM,QAA+B,YAAY,QAAQ,QACrD;AAAA,IACE,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,gBAAgB,YAAY,OAAO,MAAM;AAAA,IACzC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,cAAc,YAAY,OAAO,MAAM;AAAA,IACvC,0BAA0B,YAAY,OAAO,MAAM;AAAA,IACnD,eAAe,YAAY,OAAO;AAAA,EACpC,IACA;AAGJ,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc;AACpB,QAAM,cAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,UAAU,aAAa,iBAAiB;AAAA,MACxC,MAAM,aAAa,wBAAwB;AAAA,IAC7C;AAAA,EACF;AAEA,QAAM,SAAqC;AAAA,IACzC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,YAAY,QAAQ;AAAA,IACpC,kBAAkB,YAAY,QAAQ;AAAA,IACtC,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,aAAa;AAAA;AAAA,IAEvB,WAAY,YAAwC;AAAA,IACpD,kBAAmB,YAAwC;AAAA,IAC3D,eAAgB,YAAwC;AAAA,IACxD,gBAAiB,YAAwC;AAAA,IACzD,uBAAwB,YAAwC;AAAA,EAClE;AAGA,MAAI,OAAO,mBAAmB,QAAQ;AACpC,WAAO,WAAW;AAClB,WAAO,cAAc;AACrB,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,2CAA2C;AACnG,QAAI,OAAO,kBAAkB;AAC3B,aAAO,WAAW;AAAA,QAChB,SAAS,wBAAwB,OAAO,iBAAiB,UAAU,0BAA0B;AAAA,QAC7F,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF,WAAW,OAAO,mBAAmB,oBAAoB;AACvD,WAAO,iBAAiB;AACxB,QAAI,uBAAuB,OAAO,WAAW,IAAI,uBAAuB,WAAW,GAAG;AACpF,aAAO,cAAc;AAAA,IACvB;AACA,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,+BAA+B;AAAA,EACzF;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,KAAK,OAAO,mBAAmB,QAAQ;AAC1F,gBAAY,QAAQ,aAAa,QAAQ,aAAa,QAAQ;AAAA,EAChE;AAEA,SAAO;AACT;;;ACzZA,SAAS,kCAAkC,SAAwC;AACjF,QAAM,cAAgC,CAAC;AAGvC,QAAM,UAAU,QAAQ,QAAQ,IAAI,YAAY,KAAK,QAAQ,QAAQ,IAAI,YAAY;AACrF,MAAI,SAAS;AACX,gBAAY,UAAU;AAAA,EACxB;AAGA,QAAM,SAAS,QAAQ,QAAQ,IAAI,WAAW,KAAK,QAAQ,QAAQ,IAAI,WAAW;AAClF,MAAI,QAAQ;AACV,gBAAY,SAAS;AAAA,EACvB;AAGA,QAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,MAAI,YAAY;AACd,gBAAY,sBAAsB;AAClC,QAAI,WAAW,WAAW,SAAS,GAAG;AACpC,kBAAY,MAAM,WAAW,MAAM,CAAC;AAAA,IACtC;AAAA,EACF;AAGA,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,eAAe,IAAI,aAAa,IAAI,SAAS;AACnD,QAAM,cAAc,IAAI,aAAa,IAAI,QAAQ;AAEjD,MAAI,gBAAgB,CAAC,YAAY,SAAS;AACxC,gBAAY,UAAU;AAAA,EACxB;AACA,MAAI,eAAe,CAAC,YAAY,QAAQ;AACtC,gBAAY,SAAS;AAAA,EACvB;AAEA,SAAO;AACT;AAKA,SAAS,WAAW,SAAiB,MAAuB;AAC1D,QAAM,eAAe,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK;AAEtE,QAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAKA,SAAS,gBACP,QACA,MACA,QAC+B;AAC/B,SAAO,OAAO,KAAK,CAAC,UAAU;AAC5B,UAAM,gBACJ,MAAM,WAAW,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO,YAAY;AAC5E,UAAM,cAAc,WAAW,MAAM,SAAS,IAAI;AAClD,WAAO,iBAAiB;AAAA,EAC1B,CAAC;AACH;AAKA,SAAS,aAAa,QAAwB;AAC5C,UAAQ,OAAO,YAAY,GAAG;AAAA,IAC5B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,2BACP,QACA,SACQ;AACR,QAAM,QAAQ,QAAQ,gBAAgB,SAAS;AAC/C,QAAM,UACJ,QAAQ,gBAAgB,WACxB,OAAO,UAAU,WACjB;AACF,QAAM,kBAAkB,OAAO,UAAU,mBAAmB;AAC5D,QAAM,UAAU,OAAO,UAAU,oBAAoB;AACrD,QAAM,aAAa,QAAQ,gBAAgB,oBAAoB;AAE/D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAME,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BA4Ge,KAAK;AAAA,gCACJ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,mCAKJ,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAQjC,eAAe;AAAA,QACxB,aAAa,8GAA8G,EAAE;AAAA;AAAA;AAAA;AAAA,6BAIxG,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhC,KAAK;AACT;AAKO,SAAS,iBAAiB,SAAkC;AACjE,QAAM,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,qBAAqB,MAAM,GAAG,OAAO,IAAI;AAE9E,SAAO,eAAe,WAAW,SAAsB;AAErD,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,aAAa;AAEnD,UAAM,WAAW,QAAQ,QAAQ;AAGjC,UAAM,aAAa,UAAU,KAAK,CAAC,YAAY,WAAW,SAAS,QAAQ,CAAC;AAC5E,QAAI,YAAY;AACd,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,cAAc,gBAAgB,QAAQ,UAAU,QAAQ,MAAM;AAGpE,QAAI,CAAC,aAAa;AAChB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,YAAY,mBAAmB,QAAQ;AACzC,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,cAAc,kCAAkC,OAAO;AAG7D,QAAI,CAAC,eAAe,WAAW,KAAK,YAAY,mBAAmB,YAAY;AAC7E,YAAMC,UAA6B;AAAA,QACjC,UAAU;AAAA,QACV,aAAa;AAAA,QACb,eAAe,CAAC,+BAA+B;AAAA,QAC/C,UAAU;AAAA,UACR,SAAS;AAAA,UACT,iBAAiB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,UAC1D,kBAAkB,GAAG,OAAO,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAC7D;AAAA,QACA,YAAY,oBAAI,KAAK;AAAA,MACvB;AAGA,UAAI,SAAS,WAAW,OAAO,GAAG;AAChC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS;AAAA,cACT,UAAUA,QAAO;AAAA,YACnB;AAAA,UACF;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAGA,UAAI,oBAAoB;AACtB,eAAO,IAAI,aAAa,2BAA2BA,SAAQ,OAAO,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,4BAA4B;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAGA,YAAM,cAAcA,QAAO,UAAU,mBAAmB;AACxD,aAAO,aAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAAA,IAChE;AAIA,UAAM,kBAAkB,OAAO,mBAAmB,QAAQ,QAAQ;AAGlE,UAAM,UAAU,QAAQ,QAAQ,IAAI,WAAW,KAAK,aAAa,QAAQ,MAAM;AAC/E,UAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,MAClC;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ,OAAO,YAAY;AAAA,MACnC,UAAU;AAAA,MACV,UAAU,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAAA,MAC3E,WAAW,QAAQ,QAAQ,IAAI,YAAY,KAAK;AAAA,MAChD;AAAA,MACA,kBAAkB,OAAO,oBAAoB;AAAA,IAC/C,CAAC;AAGD,QAAI,CAAC,iBAAiB,OAAO,aAAa,YAAY,cAAc,GAAG;AAErE,UAAI,SAAS,WAAW,OAAO,GAAG;AAChC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM,OAAO,WAAW,wBAAwB;AAAA,cAChD,SAAS,OAAO,gBAAgB,CAAC,KAAK;AAAA,cACtC,aAAa,OAAO;AAAA,cACpB,UAAU,YAAY;AAAA,cACtB,UAAU,OAAO;AAAA,YACnB;AAAA,UACF;AAAA,UACA,EAAE,QAAQ,OAAO,WAAW,MAAM,IAAI;AAAA,QACxC;AAAA,MACF;AAGA,UAAI,oBAAoB;AACtB,eAAO,IAAI,aAAa,2BAA2B,QAAQ,OAAO,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,4BAA4B;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH;AAGA,aAAO,aAAa,SAAS,IAAI,IAAI,iBAAiB,QAAQ,GAAG,CAAC;AAAA,IACpE;AAGA,UAAM,WAAW,aAAa,KAAK;AAGnC,aAAS,QAAQ,IAAI,wBAAwB,OAAO,SAAS,SAAS,CAAC;AACvE,aAAS,QAAQ,IAAI,4BAA4B,OAAO,WAAW;AAEnE,QAAI,OAAO,OAAO;AAChB,eAAS,QAAQ,IAAI,wBAAwB,OAAO,MAAM,OAAO;AACjE,eAAS,QAAQ,IAAI,2BAA2B,OAAO,MAAM,WAAW,SAAS,CAAC;AAAA,IACpF;AAEA,WAAO;AAAA,EACT;AACF;AAKO,SAAS,oBAAoB,OAAwC;AAC1E,SAAO,EAAE,SAAS,MAAM;AAC1B;","names":["result","result"]}

package/dist/adapters/sdk.d.mts

@@ -1,2 +1,2 @@
-import '../types-cA_xfFU7.mjs';
-export { V as VerificationGatewayClient, f as createClient, c as getCapabilities, e as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-VAFRmdt7.mjs';
+import '../types-Bf8pML07.mjs';
+export { V as VerificationGatewayClient, f as createClient, c as getCapabilities, e as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-DAJahT3p.mjs';

package/dist/adapters/sdk.d.ts

@@ -1,2 +1,2 @@
-import '../types-cA_xfFU7.js';
-export { V as VerificationGatewayClient, f as createClient, c as getCapabilities, e as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-9TKZzhxE.js';
+import '../types-Bf8pML07.js';
+export { V as VerificationGatewayClient, f as createClient, c as getCapabilities, e as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-CMPDFUjo.js';

package/dist/adapters/sdk.js

@@ -397,7 +397,9 @@ var VerificationGatewayClient = class {
       minTrustScoreForFull: options.minTrustScoreForFull,
       cacheTtl: options.cacheTtl,
       debug: options.debug,
-      customHeaders: options.customHeaders
+      customHeaders: options.customHeaders,
+      counterpartyUrl: options.counterpartyUrl,
+      counterpartyType: options.counterpartyType
     };
     this.timeout = options.timeout || 1e4;
     this.retryConfig = options.retry || { maxRetries: 3, backoffMs: 1e3 };
@@ -423,7 +425,9 @@ var VerificationGatewayClient = class {
         currency: options.currency,
         isSubAgentRequest: options.isSubAgentRequest,
         parentAgentId: options.parentAgentId,
-        subAgentDepth: options.subAgentDepth
+        subAgentDepth: options.subAgentDepth,
+        counterpartyUrl: options.counterpartyUrl,
+        counterpartyType: options.counterpartyType
       })
     );
   }