@astrasyncai/verification-gateway 2.3.8 → 2.3.9

package/dist/browser/browser-adapter.d.mts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-z-QVnG4b.mjs';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-CKafuHDn.mjs';
 import '../gateway/gateway.mjs';
-import '../types-D_tmbDA_.mjs';
+import '../types-UYT4GdPW.mjs';
 
 /**
  * @astrasyncai/adapter-openclaw-browser

package/dist/browser/browser-adapter.d.ts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bzp1SMaD.js';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-ppkhdldJ.js';
 import '../gateway/gateway.js';
-import '../types-D_tmbDA_.js';
+import '../types-UYT4GdPW.js';
 
 /**
  * @astrasyncai/adapter-openclaw-browser

package/dist/cli/index.d.mts

@@ -1,6 +1,6 @@
-import { a as LocalPurposeRule, c as LocalScope, d as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-z-QVnG4b.mjs';
+import { a as LocalPurposeRule, c as LocalScope, d as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-CKafuHDn.mjs';
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import '../types-D_tmbDA_.mjs';
+import '../types-UYT4GdPW.mjs';
 import '../gateway/gateway.mjs';
 
 /**

package/dist/cli/index.d.ts

@@ -1,6 +1,6 @@
-import { a as LocalPurposeRule, c as LocalScope, d as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bzp1SMaD.js';
+import { a as LocalPurposeRule, c as LocalScope, d as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-ppkhdldJ.js';
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import '../types-D_tmbDA_.js';
+import '../types-UYT4GdPW.js';
 import '../gateway/gateway.js';
 
 /**

package/dist/cursor/cursor-adapter.d.mts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-z-QVnG4b.mjs';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-CKafuHDn.mjs';
 import '../gateway/gateway.mjs';
-import '../types-D_tmbDA_.mjs';
+import '../types-UYT4GdPW.mjs';
 
 /**
  * @astrasyncai/adapter-cursor

package/dist/cursor/cursor-adapter.d.ts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bzp1SMaD.js';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-ppkhdldJ.js';
 import '../gateway/gateway.js';
-import '../types-D_tmbDA_.js';
+import '../types-UYT4GdPW.js';
 
 /**
  * @astrasyncai/adapter-cursor

package/dist/cursor/extension.d.mts

@@ -1,8 +1,8 @@
 import { VSCodeAPI } from './cursor-adapter.mjs';
 import '../adapter-interface/interface.mjs';
 import '../gateway/gateway.mjs';
-import '../types-z-QVnG4b.mjs';
-import '../types-D_tmbDA_.mjs';
+import '../types-CKafuHDn.mjs';
+import '../types-UYT4GdPW.mjs';
 
 /**
  * VS Code Extension entry point for AstraSync Local Guard (Cursor/VS Code).

package/dist/cursor/extension.d.ts

@@ -1,8 +1,8 @@
 import { VSCodeAPI } from './cursor-adapter.js';
 import '../adapter-interface/interface.js';
 import '../gateway/gateway.js';
-import '../types-Bzp1SMaD.js';
-import '../types-D_tmbDA_.js';
+import '../types-ppkhdldJ.js';
+import '../types-UYT4GdPW.js';
 
 /**
  * VS Code Extension entry point for AstraSync Local Guard (Cursor/VS Code).

package/dist/cursor/extension.js

@@ -3285,7 +3285,7 @@ function verifyLocal(evaluator, context) {
 // src/access-levels.ts
 var ACCESS_LEVEL_HIERARCHY = {
   none: 0,
-  guidance: 1,
+  restricted: 1,
   "read-only": 2,
   standard: 3,
   full: 4,
@@ -3301,7 +3301,11 @@ function getTrustLevel(score) {
 // src/verify.ts
 var DEFAULT_CONFIG = {
   apiBaseUrl: "https://astrasync.ai/api",
-  defaultAccessLevel: "guidance",
+  // v2.3.9 (defect #30): default for unconfigured callers is `'none'` (no
+  // access). Pre-rename this defaulted to `'guidance'`, which combined with
+  // a route gated at `'guidance'` to silently let unverified traffic
+  // through (`hasMinimumAccess('guidance', 'guidance') === true`).
+  defaultAccessLevel: "none",
   // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
   cacheTtl: 300,
   // 5 minutes
@@ -3366,7 +3370,12 @@ function createGuidanceResponse(config, reason) {
   };
   return {
     verified: false,
-    accessLevel: "guidance",
+    // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
+    // Adapters additionally short-circuit on `verified === false` before
+    // the gate check, but the access level still has to be honest at the
+    // data layer so downstream consumers (SDK adapters in other languages,
+    // custom integrations) inherit the correct semantics.
+    accessLevel: "none",
     guidance,
     denialReasons: reason ? [reason] : ["No valid agent credentials provided"],
     verifiedAt: /* @__PURE__ */ new Date()
@@ -3493,7 +3502,14 @@ async function verify(config, request) {
     const aggregatedFailures = apiResponse.access?.failures;
     const result2 = {
       verified: false,
-      accessLevel: "guidance",
+      // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
+      // Pre-rename this hardcoded `'guidance'`, which conflated with the
+      // colocated `guidance: {...}` help-payload object below and let
+      // denied requests pass any route gated at `'guidance'` because
+      // `hasMinimumAccess('guidance', 'guidance') === true`. Adapters now
+      // ALSO short-circuit on `verified === false` before the gate check —
+      // belt-and-braces.
+      accessLevel: "none",
       denialReasons: aggregatedFailures && aggregatedFailures.length > 0 ? aggregatedFailures.map((f) => f.message) : apiResponse.access?.reason ? [apiResponse.access.reason] : ["Access denied"],
       failures: aggregatedFailures,
       requiresStepUp: apiResponse.access?.requiresStepUp,