@astrasyncai/verification-gateway 2.4.0 → 2.4.2

package/dist/adapters/sdk.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/access-levels.ts","../../src/verify.ts","../../src/adapters/sdk.ts"],"sourcesContent":["/**\n * AstraSync Universal Verification Gateway - Access Level Definitions\n *\n * Defines the hierarchy and capabilities of each access level.\n *\n * v2.3.9 (defect #30): renamed `'guidance'` band → `'restricted'`. See\n * `types.ts` AccessLevel for the rationale (value-name collision with the\n * `guidance: {...}` help-payload object on VerificationResult).\n */\n\nimport type { AccessLevel, TrustLevel } from './types';\n\n/**\n * Access level hierarchy (higher number = more access)\n */\nexport const ACCESS_LEVEL_HIERARCHY: Record<AccessLevel, number> = {\n  none: 0,\n  restricted: 1,\n  'read-only': 2,\n  standard: 3,\n  full: 4,\n  internal: 5,\n};\n\n/**\n * Access level descriptions for UI\n */\nexport const ACCESS_LEVEL_DESCRIPTIONS: Record<AccessLevel, string> = {\n  none: 'No access - credentials required',\n  restricted: 'Restricted access - registration prompt only',\n  'read-only': 'Read-only access - can browse but not modify',\n  standard: 'Standard access - normal operations per PDLSS policy',\n  full: 'Full access - all operations for high-trust agents',\n  internal: 'Internal access - organization member privileges',\n};\n\n/**\n * Default trust score thresholds for access levels\n */\nexport const DEFAULT_TRUST_THRESHOLDS: Record<AccessLevel, number> = {\n  none: 0,\n  restricted: 0,\n  'read-only': 20,\n  standard: 40,\n  full: 70,\n  internal: 0, // Internal is based on org membership, not score\n};\n\n/**\n * Trust level score ranges\n */\nexport const TRUST_LEVEL_RANGES: Record<TrustLevel, { min: number; max: number }> = {\n  BRONZE: { min: 0, max: 39 },\n  SILVER: { min: 40, max: 59 },\n  GOLD: { min: 60, max: 79 },\n  PLATINUM: { min: 80, max: 100 },\n};\n\n/**\n * Determine trust level from score\n */\nexport function getTrustLevel(score: number): TrustLevel {\n  if (score >= 80) return 'PLATINUM';\n  if (score >= 60) return 'GOLD';\n  if (score >= 40) return 'SILVER';\n  return 'BRONZE';\n}\n\n/**\n * Check if access level A is greater than or equal to access level B\n */\nexport function hasMinimumAccess(actual: AccessLevel, required: AccessLevel): boolean {\n  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];\n}\n\n/**\n * Get the highest access level for a given trust score\n */\nexport function getAccessLevelForScore(\n  trustScore: number,\n  thresholds: Record<AccessLevel, number> = DEFAULT_TRUST_THRESHOLDS\n): AccessLevel {\n  if (trustScore >= thresholds.full) return 'full';\n  if (trustScore >= thresholds.standard) return 'standard';\n  if (trustScore >= thresholds['read-only']) return 'read-only';\n  return 'restricted';\n}\n\n/**\n * Determine access level from verification result.\n *\n * v2.3.9 (defect #30): unverified callers now return `'none'` (was\n * `'guidance'`). Denials grant zero — never a positive band.\n */\nexport function determineAccessLevel(\n  verified: boolean,\n  trustScore: number,\n  isOrgMember: boolean,\n  customThresholds?: Partial<Record<AccessLevel, number>>\n): AccessLevel {\n  if (!verified) {\n    return 'none';\n  }\n\n  if (isOrgMember) {\n    return 'internal';\n  }\n\n  const thresholds = {\n    ...DEFAULT_TRUST_THRESHOLDS,\n    ...customThresholds,\n  };\n\n  return getAccessLevelForScore(trustScore, thresholds);\n}\n\n/**\n * Access capabilities per level\n */\nexport interface AccessCapabilities {\n  canRead: boolean;\n  canWrite: boolean;\n  canDelete: boolean;\n  canAdmin: boolean;\n  canAccessInternal: boolean;\n  maxTransactionValue?: number;\n  allowedPurposes?: string[];\n}\n\n/**\n * Get capabilities for an access level\n */\nexport function getCapabilities(accessLevel: AccessLevel): AccessCapabilities {\n  switch (accessLevel) {\n    case 'none':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'restricted':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'read-only':\n      return {\n        canRead: true,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'standard':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'full':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'internal':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: true,\n        canAccessInternal: true,\n      };\n    default:\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n  }\n}\n","/**\n * AstraSync Universal Verification Gateway - Core Verification Logic\n *\n * This module handles the core verification logic, calling the AstraSync API\n * and processing the response into a standardized VerificationResult.\n */\n\nimport type {\n  GatewayConfig,\n  AgentCredentials,\n  VerificationRequest,\n  VerificationResult,\n  VerifiedAgent,\n  VerifiedDeveloper,\n  VerifiedOrganization,\n  GuidanceInfo,\n  AccessLevel,\n  EnhancedVerificationResult,\n  TokenGuidance,\n  RuntimeChallengeResult,\n} from './types';\nimport { getTrustLevel, ACCESS_LEVEL_HIERARCHY } from './access-levels';\n\n/**\n * Default configuration values\n *\n * apiBaseUrl matches the OpenAPI authoritative server (https://astrasync.ai/api\n * for prod, https://staging.astrasync.ai/api for staging). Always include the\n * /api path prefix when overriding — registration / docs URLs are derived by\n * stripping it.\n */\nconst DEFAULT_CONFIG: Partial<GatewayConfig> = {\n  apiBaseUrl: 'https://astrasync.ai/api',\n  // v2.3.9 (defect #30): default for unconfigured callers is `'none'` (no\n  // access). Pre-rename this defaulted to `'guidance'`, which combined with\n  // a route gated at `'guidance'` to silently let unverified traffic\n  // through (`hasMinimumAccess('guidance', 'guidance') === true`).\n  defaultAccessLevel: 'none',\n  // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.\n  cacheTtl: 300, // 5 minutes\n  debug: false,\n};\n\n/**\n * Init self-test state. Fires once per process on first verify() call to warn\n * if apiBaseUrl is pointing at the wrong host (e.g. a marketing site that\n * 200s with text/html instead of the API).\n */\nlet initCheckPerformed = false;\n\n/** One-shot guard for v2.3.0 deprecation warning. */\nlet deprecationWarningShown = false;\n\nasync function performInitCheck(apiBaseUrl: string, debug?: boolean): Promise<void> {\n  initCheckPerformed = true;\n  try {\n    const probeUrl = `${apiBaseUrl}/agents/verify-access`;\n    // HEAD mirrors GET semantics (running the full request pipeline without a\n    // body) so the response carries the same content-type the marketing 404\n    // would return. OPTIONS often gets short-circuited by CORS-preflight\n    // handlers and returns no content-type, defeating the check.\n    const response = await fetch(probeUrl, { method: 'HEAD' });\n    const contentType = response.headers.get('content-type') ?? '';\n    if (contentType.startsWith('text/html')) {\n      console.warn(\n        `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). ` +\n          `This usually means apiBaseUrl is pointing at a marketing site instead of the API. ` +\n          `Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging). ` +\n          `Set disableInitChecks: true on GatewayConfig to silence this warning.`\n      );\n    } else if (debug) {\n      console.log(\n        `[VerificationGateway] init check passed for ${apiBaseUrl} (content-type: ${contentType})`\n      );\n    }\n  } catch (err) {\n    if (debug) {\n      console.log(`[VerificationGateway] init check failed (non-blocking): ${String(err)}`);\n    }\n  }\n}\n\n/**\n * Simple in-memory cache for verification results\n */\nconst verificationCache = new Map<string, { result: VerificationResult; expiresAt: number }>();\n\n/**\n * Generate cache key from credentials\n */\nfunction getCacheKey(credentials: AgentCredentials): string {\n  return `${credentials.astraId || ''}-${credentials.apiKey || ''}-${credentials.jwt || ''}`;\n}\n\n/**\n * Check if cached result is still valid\n */\nfunction getCachedResult(credentials: AgentCredentials): VerificationResult | null {\n  const key = getCacheKey(credentials);\n  const cached = verificationCache.get(key);\n\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.result;\n  }\n\n  if (cached) {\n    verificationCache.delete(key);\n  }\n\n  return null;\n}\n\n/**\n * Cache a verification result\n */\nfunction cacheResult(\n  credentials: AgentCredentials,\n  result: VerificationResult,\n  ttlSeconds: number\n): void {\n  const key = getCacheKey(credentials);\n  verificationCache.set(key, {\n    result,\n    expiresAt: Date.now() + ttlSeconds * 1000,\n  });\n}\n\n/**\n * Clear the verification cache\n */\nexport function clearCache(): void {\n  verificationCache.clear();\n}\n\n/**\n * Extract agent credentials from various sources\n */\nexport function extractCredentials(\n  headers: Record<string, string | string[] | undefined>,\n  query?: Record<string, string | undefined>\n): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers (case-insensitive). Accepts the historical\n  // X-Astra-Id name plus the X-Astra-AgentId / x-astra-agent-id alias the\n  // partner asked for in #9a — both surface the same field.\n  const astraIdHeader =\n    headers['x-astra-id'] ||\n    headers['X-Astra-Id'] ||\n    headers['X-ASTRA-ID'] ||\n    headers['x-astra-agentid'] ||\n    headers['X-Astra-AgentId'] ||\n    headers['x-astra-agent-id'] ||\n    headers['X-Astra-Agent-Id'] ||\n    headers['X-ASTRA-AGENT-ID'];\n  if (astraIdHeader) {\n    credentials.astraId = Array.isArray(astraIdHeader) ? astraIdHeader[0] : astraIdHeader;\n  }\n\n  // Check for API key in headers\n  const apiKeyHeader = headers['x-api-key'] || headers['X-Api-Key'] || headers['X-API-KEY'];\n  if (apiKeyHeader) {\n    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;\n  }\n\n  // Check Authorization header for Bearer token\n  const authHeader = headers['authorization'] || headers['Authorization'];\n  if (authHeader) {\n    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n    credentials.authorizationHeader = authValue;\n\n    if (authValue.startsWith('Bearer ')) {\n      credentials.jwt = authValue.slice(7);\n    }\n  }\n\n  // Check query parameters as fallback\n  if (query) {\n    if (query.astraId && !credentials.astraId) {\n      credentials.astraId = query.astraId;\n    }\n    if (query.apiKey && !credentials.apiKey) {\n      credentials.apiKey = query.apiKey;\n    }\n  }\n\n  return credentials;\n}\n\n/**\n * Check if credentials are present\n */\nexport function hasCredentials(credentials: AgentCredentials): boolean {\n  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);\n}\n\n/**\n * Create guidance response for unverified agents\n */\nfunction createGuidanceResponse(config: GatewayConfig, reason?: string): VerificationResult {\n  const guidance: GuidanceInfo = {\n    message:\n      'This service verifies AI agents before granting access. Please register your agent with AstraSync.',\n    registrationUrl: `${config.apiBaseUrl.replace('/api', '')}/register`,\n    documentationUrl: `${config.apiBaseUrl.replace('/api', '')}/docs/agent-access`,\n    steps: [\n      'Register for an AstraSync account',\n      'Create and register your agent',\n      'Add your ASTRA-ID to request headers',\n      'Retry your request',\n    ],\n  };\n\n  return {\n    verified: false,\n    // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.\n    // Adapters additionally short-circuit on `verified === false` before\n    // the gate check, but the access level still has to be honest at the\n    // data layer so downstream consumers (SDK adapters in other languages,\n    // custom integrations) inherit the correct semantics.\n    accessLevel: 'none',\n    guidance,\n    denialReasons: reason ? [reason] : ['No valid agent credentials provided'],\n    verifiedAt: new Date(),\n  };\n}\n\n/**\n * Call the AstraSync verify-access API\n */\nasync function callVerifyAccessAPI(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<{\n  success: boolean;\n  access?: {\n    allowed: boolean;\n    /**\n     * Server-decided access level. Read verbatim — do NOT remap client-side.\n     * The server resolves this from endpoint policy + agent trust score using\n     * the canonical thresholds (see backend `apps/backend/src/utils/access-levels.ts`).\n     */\n    accessLevel?: AccessLevel;\n    reason?: string;\n    /**\n     * Aggregated denial failures (v2.9.8+). Empty / absent when allowed.\n     * Each entry is `{ dimension, message, guidance? }` — see\n     * `AccessFailure` for the contract.\n     */\n    failures?: Array<{ dimension: string; message: string; guidance?: string }>;\n    requiresStepUp?: boolean;\n    requiresApproval?: boolean;\n    appliedPolicy?: {\n      boundaryName: string;\n      policyVersion: string;\n    };\n    counterparty?: {\n      id: string;\n      name: string;\n      trustScoreRequirement: number;\n    };\n  };\n  agent?: {\n    kyaAgentId: string;\n    astraId: string;\n    name: string;\n    trustScore: number;\n    trustLevel: string;\n    agentStatus: string;\n    blockchainStatus: string;\n  };\n  developer?: {\n    kyaOwnerId: string;\n    fullName: string;\n    email: string;\n    identityVerified: boolean;\n    trustScore: number;\n  };\n  organization?: {\n    name: string;\n    verified: boolean;\n    trustScore: number;\n  };\n  /**\n   * Structured explanation of the verification decision. Tells the merchant\n   * WHY (id verified? challenge passed? request within PDLSS? trust score?)\n   * without exposing thresholds, scope lists, or other-tenant counterparty\n   * membership. Empty `attestations` unless the endpoint's access policy\n   * declared `required_attestations`.\n   */\n  verificationContext?: {\n    idVerified: boolean;\n    runtimeChallenge: {\n      status: 'passed' | 'skipped' | 'failed' | 'timeout' | 'not_supported';\n      checkedAt: string | null;\n    };\n    pdlssCheck: {\n      result: 'within' | 'exceeded' | 'denied' | 'not_evaluated';\n      purpose: 'approved' | 'denied';\n      scope: 'approved' | 'denied';\n    };\n    dynamicTrustScore: number;\n    attestations: Array<{\n      type: string;\n      status: 'passed' | 'failed';\n      validUntil?: string;\n      proofType: 'reference' | 'zkp';\n      proof: string;\n    }>;\n  };\n  error?: string;\n}> {\n  const { credentials, ...requestData } = request;\n\n  // Build the request body. agentId is omitted when not provided so the\n  // server treats it as an anonymous canonical-flow call (Branch A/B/C).\n  const body: Record<string, unknown> = {\n    ...(credentials.astraId && { agentId: credentials.astraId }),\n    purpose: requestData.purpose || 'general',\n  };\n\n  // Add optional fields\n  if (requestData.action) body.action = requestData.action;\n  if (requestData.resourceType) body.resourceType = requestData.resourceType;\n  if (requestData.resource) body.resource = requestData.resource;\n  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;\n  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;\n  if (requestData.currency) body.currency = requestData.currency;\n  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;\n  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;\n  if (requestData.subAgentDepth !== undefined) body.subAgentDepth = requestData.subAgentDepth;\n  // Handshake Protocol v10 additions\n  if (requestData.enableRuntimeChallenge)\n    body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;\n  if (requestData.createSession) body.createSession = requestData.createSession;\n  if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;\n  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;\n  if (requestData.counterpartyUrl) body.counterpartyUrl = requestData.counterpartyUrl;\n  if (config.counterpartyId) body.counterpartyId = config.counterpartyId;\n  if (requestData.runtimeChallengeOptions)\n    body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;\n\n  // Forward caller metadata when present. Merges the legacy top-level\n  // clientIp/userAgent into the nested block for backward compatibility.\n  if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {\n    const meta = {\n      ...(requestData.clientIp && { sourceIp: requestData.clientIp }),\n      ...(requestData.userAgent && { userAgent: requestData.userAgent }),\n      ...requestData.callerMetadata,\n    };\n    if (Object.keys(meta).length > 0) body.callerMetadata = meta;\n  }\n\n  // Build headers\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    ...config.customHeaders,\n  };\n\n  // verify-access requires authentication. The backend's authenticate middleware\n  // accepts either a JWT or an API key (starts with kya_) via `Authorization: Bearer <token>`.\n  // Credential-supplied auth header (e.g. the agent's own token) takes priority.\n  if (credentials.authorizationHeader) {\n    headers['Authorization'] = credentials.authorizationHeader;\n  } else if (config.apiKey) {\n    headers['Authorization'] = `Bearer ${config.apiKey}`;\n  }\n  // Legacy header kept for compatibility with any middleware that reads it directly.\n  if (config.apiKey) {\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  try {\n    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    const data = await response.json();\n\n    // v2.3.8 (defect #29): treat 410 Gone as a deterministic deactivated-endpoint\n    // signal. Older SDKs may treat any non-2xx as transient and retry; v2.3.8+\n    // surfaces it as a structured denial with `reason: 'endpoint_deactivated'`\n    // so callers can distinguish \"endpoint gone\" from \"endpoint denied this\".\n    if (response.status === 410) {\n      return {\n        success: true,\n        access: {\n          allowed: false,\n          accessLevel: 'none',\n          reason: 'endpoint_deactivated',\n          failures: [\n            {\n              dimension: 'endpoint.deactivated',\n              message:\n                typeof data?.message === 'string' ? data.message : 'Endpoint has been deactivated',\n              guidance:\n                typeof data?.guidance === 'string'\n                  ? data.guidance\n                  : 'Reactivate via POST /api/endpoints/{id}/reactivate, or update the URL on the calling agent.',\n            },\n          ],\n        },\n      };\n    }\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: data.message || data.error || `API returned ${response.status}`,\n      };\n    }\n\n    return data;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return {\n      success: false,\n      error: `Failed to call verify-access API: ${message}`,\n    };\n  }\n}\n\n/**\n * Main verification function\n */\nexport async function verify(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n\n  // One-time init self-test — fire-and-forget, never blocks verify().\n  if (!initCheckPerformed && !mergedConfig.disableInitChecks && mergedConfig.apiBaseUrl) {\n    void performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug);\n  }\n\n  // Deprecation warning for v2.3.0 removed config fields. Fires once per process.\n  if (\n    !deprecationWarningShown &&\n    (config.minTrustScore !== undefined || config.minTrustScoreForFull !== undefined)\n  ) {\n    deprecationWarningShown = true;\n    console.warn(\n      '[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 ' +\n        'and have no effect. Server is now the single source of truth for access-level decisions ' +\n        '(the SDK reads access.accessLevel from the verify-access response). To gate access ' +\n        \"to an endpoint, configure the endpoint's trust_score_requirement server-side.\"\n    );\n  }\n\n  // v2.3.0: anonymous traffic no longer short-circuits here. We forward the\n  // request to the server with no agentId; the server applies the endpoint's\n  // unverifiedAgentPolicy and returns advisory. createGuidanceResponse remains\n  // as the offline fallback if the API itself fails (handled below).\n\n  // Check cache first\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {\n    const cached = getCachedResult(request.credentials);\n    if (cached) {\n      if (mergedConfig.debug) {\n        console.log('[VerificationGateway] Returning cached result');\n      }\n      return cached;\n    }\n  }\n\n  // Inject counterparty info from config if not already set in request\n  const enrichedRequest = { ...request };\n  if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {\n    enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;\n  }\n  if (!enrichedRequest.counterpartyType && mergedConfig.counterpartyType) {\n    enrichedRequest.counterpartyType = mergedConfig.counterpartyType;\n  }\n\n  // Call the API\n  if (mergedConfig.debug) {\n    console.log('[VerificationGateway] Calling verify-access API');\n  }\n\n  const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);\n\n  // Handle API errors\n  if (!apiResponse.success) {\n    return createGuidanceResponse(mergedConfig, apiResponse.error);\n  }\n\n  // Check access result\n  if (!apiResponse.access?.allowed) {\n    // v2.9.8 (defect M1): aggregated failures across every gate that\n    // denied. Surface them on the result so the integrator can see every\n    // blocker in one go instead of the previous fail-fast cascade.\n    const aggregatedFailures = (apiResponse.access as Record<string, unknown> | undefined)\n      ?.failures as Array<{ dimension: string; message: string; guidance?: string }> | undefined;\n    const result: EnhancedVerificationResult = {\n      verified: false,\n      // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.\n      // Pre-rename this hardcoded `'guidance'`, which conflated with the\n      // colocated `guidance: {...}` help-payload object below and let\n      // denied requests pass any route gated at `'guidance'` because\n      // `hasMinimumAccess('guidance', 'guidance') === true`. Adapters now\n      // ALSO short-circuit on `verified === false` before the gate check —\n      // belt-and-braces.\n      accessLevel: 'none',\n      denialReasons:\n        aggregatedFailures && aggregatedFailures.length > 0\n          ? aggregatedFailures.map((f) => f.message)\n          : apiResponse.access?.reason\n            ? [apiResponse.access.reason]\n            : ['Access denied'],\n      failures: aggregatedFailures,\n      requiresStepUp: apiResponse.access?.requiresStepUp,\n      requiresApproval: apiResponse.access?.requiresApproval,\n      guidance: {\n        message: apiResponse.access?.reason || 'Access denied by PDLSS policy',\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/pdlss`,\n      },\n      verifiedAt: new Date(),\n      // Extract sessionId so decisions can be recorded for denials too\n      sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n      // v2.3.10 (defect #34, round-4): anonymous traffic has no session →\n      // correlationId is the linking key for paired local_override events.\n      correlationId: (apiResponse as Record<string, unknown>).correlationId as string | undefined,\n      recommendation: (apiResponse as Record<string, unknown>)\n        .recommendation as EnhancedVerificationResult['recommendation'],\n      recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as\n        | string[]\n        | undefined,\n    };\n\n    return result;\n  }\n\n  // Build successful result\n  const agent: VerifiedAgent | undefined = apiResponse.agent\n    ? {\n        astraId: apiResponse.agent.astraId,\n        name: apiResponse.agent.name,\n        trustScore: apiResponse.agent.trustScore,\n        trustLevel: getTrustLevel(apiResponse.agent.trustScore),\n        blockchainVerified: apiResponse.agent.blockchainStatus === 'verified',\n        status: apiResponse.agent.agentStatus as VerifiedAgent['status'],\n      }\n    : undefined;\n\n  const developer: VerifiedDeveloper | undefined = apiResponse.developer\n    ? {\n        astradId: apiResponse.developer.kyaOwnerId,\n        name: apiResponse.developer.fullName,\n        trustScore: apiResponse.developer.trustScore || 0,\n        verified: apiResponse.developer.identityVerified,\n      }\n    : undefined;\n\n  const organization: VerifiedOrganization | undefined = apiResponse.organization\n    ? {\n        name: apiResponse.organization.name,\n        verified: apiResponse.organization.verified,\n        trustScore: apiResponse.organization.trustScore,\n      }\n    : undefined;\n\n  // Verification context — structured \"why\" the merchant gets in v2.2.4+.\n  // Carries appliedPolicy (no UUIDs), pdlssCheck summary, dynamic trust score,\n  // and policy-driven attestations. Replaces the old over-sharing `pdlss` block.\n  const verificationContext = apiResponse.verificationContext;\n\n  // Server is the single source of truth for access level. SDK reads\n  // apiResponse.access.accessLevel verbatim — no client-side trust-score remap.\n  // Fallback to 'standard' if the server response is missing the field (older\n  // backend without the v2.3.0 contract); it covers the verified-access case.\n  const accessLevel: AccessLevel = apiResponse.access?.accessLevel ?? 'standard';\n\n  const result: EnhancedVerificationResult = {\n    verified: true,\n    accessLevel,\n    agent,\n    developer,\n    organization,\n    appliedPolicy: apiResponse.access?.appliedPolicy,\n    verificationContext,\n    requiresStepUp: apiResponse.access?.requiresStepUp,\n    requiresApproval: apiResponse.access?.requiresApproval,\n    verifiedAt: new Date(),\n    cacheTtl: mergedConfig.cacheTtl,\n    // Handshake Protocol v10 enhanced fields (present when backend returns them)\n    sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n    // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId\n    // (no session row exists for unverified callers).\n    correlationId: (apiResponse as Record<string, unknown>).correlationId as string | undefined,\n    runtimeChallenge: (apiResponse as Record<string, unknown>).runtimeChallenge as\n      | RuntimeChallengeResult\n      | undefined,\n    tokenGuidance: (apiResponse as Record<string, unknown>).tokenGuidance as\n      | TokenGuidance\n      | undefined,\n    recommendation: (apiResponse as Record<string, unknown>)\n      .recommendation as EnhancedVerificationResult['recommendation'],\n    recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as\n      | string[]\n      | undefined,\n    warningHeader: (apiResponse as Record<string, unknown>).warningHeader as\n      | { name: string; value: string }\n      | undefined,\n  };\n\n  // Enforce AstraSync recommendation\n  if (result.recommendation === 'deny') {\n    result.verified = false;\n    result.accessLevel = 'none';\n    result.denialReasons = result.recommendationReasons || [\n      'Access denied by AstraSync recommendation',\n    ];\n    if (result.runtimeChallenge) {\n      result.guidance = {\n        message: `Verification failed: ${result.runtimeChallenge.reason || 'runtime challenge failed'}`,\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/runtime-challenge`,\n      };\n    }\n  } else if (result.recommendation === 'step_up_required') {\n    result.requiresStepUp = true;\n    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY['read-only']) {\n      result.accessLevel = 'read-only';\n    }\n    result.denialReasons = result.recommendationReasons || ['Step-up verification required'];\n  }\n\n  // Cache the result (skip caching denials — agent may fix challenge endpoint and retry)\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== 'deny') {\n    cacheResult(request.credentials, result, mergedConfig.cacheTtl);\n  }\n\n  return result;\n}\n\n/**\n * Record a counterparty's grant/deny decision for a verification session.\n * Fire-and-forget — errors are silently swallowed.\n */\n/**\n * v2.3.9 (defect #34): optional override metadata. Set when the SDK's\n * local enforcement (toolGate / methodGate / trustScore floor) rejected\n * a request the SERVER had granted. Backend emits a distinct\n * `verification.local_override` event so the activity feed surfaces the\n * divergence as a separate row.\n */\nexport interface DecisionOverride {\n  overriddenBy: 'toolGate' | 'methodGate' | 'trustScore' | 'other';\n  toolName?: string;\n  requestedLevel?: AccessLevel;\n  grantedLevel?: AccessLevel;\n}\n\nexport async function recordDecision(\n  config: GatewayConfig,\n  sessionId: string,\n  decision: 'granted' | 'denied',\n  reason?: string,\n  override?: DecisionOverride\n): Promise<void> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) {\n    headers['Authorization'] = `Bearer ${config.apiKey}`;\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {\n    method: 'POST',\n    headers,\n    body: JSON.stringify({\n      decision,\n      reason,\n      ...(override && {\n        overriddenBy: override.overriddenBy,\n        toolName: override.toolName,\n        requestedLevel: override.requestedLevel,\n        grantedLevel: override.grantedLevel,\n      }),\n    }),\n  }).catch(() => {\n    /* fire-and-forget */\n  });\n}\n\n/**\n * v2.3.10 (defect #34, round-4): record a SDK-side local override for an\n * anonymous verify-access response. Anonymous traffic has no session row, so\n * `recordDecision` (above) doesn't apply — but we still need to surface the\n * dashboard-vs-runtime divergence (e.g. server granted with audit warning\n * but local toolGate floor denied) on the activity feed.\n *\n * Backend ties the resulting `verification.local_override` event back to the\n * original `verification.unverified_audit` event via `correlationId`. The\n * endpoint is sessionless — see the docstring on the backend route for the\n * abuse-mitigation rationale (rate-limited per IP).\n *\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function recordAnonymousLocalOverride(\n  config: GatewayConfig,\n  correlationId: string,\n  override: DecisionOverride,\n  reason?: string\n): Promise<void> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) {\n    headers['Authorization'] = `Bearer ${config.apiKey}`;\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  await fetch(`${config.apiBaseUrl}/agents/verify-access/local-override`, {\n    method: 'POST',\n    headers,\n    body: JSON.stringify({\n      correlationId,\n      reason,\n      overriddenBy: override.overriddenBy,\n      toolName: override.toolName,\n      requestedLevel: override.requestedLevel,\n      grantedLevel: override.grantedLevel,\n    }),\n  }).catch(() => {\n    /* fire-and-forget */\n  });\n}\n\n/**\n * Fetch the per-route policy for an endpoint from the AstraSync backend.\n * v2.9.7 moved policy authority into the dashboard — the SDK no longer\n * accepts `routes` from merchant-side source code, it fetches them from\n * here on init (and refreshes periodically).\n *\n * Returns `null` when the request fails for any reason — the caller decides\n * how to fall back (the middleware allows-all when no policy is loaded so\n * a misconfigured init doesn't take down the merchant's API).\n */\nexport async function fetchRoutes(\n  config: GatewayConfig,\n  counterpartyId: string\n): Promise<RouteAccessConfigShape[] | null> {\n  if (!counterpartyId) return null;\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) {\n    headers['Authorization'] = `Bearer ${config.apiKey}`;\n    headers['X-API-Key'] = config.apiKey;\n  }\n  try {\n    const response = await fetch(\n      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes`,\n      { method: 'GET', headers }\n    );\n    if (!response.ok) return null;\n    const body = (await response.json()) as { data?: { routes?: RouteAccessConfigShape[] } };\n    return body.data?.routes ?? [];\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the\n * server's `EndpointRoute` type and the SDK's `RouteAccessConfig` — same\n * JSON moves between server and SDK unchanged.\n */\nexport interface RouteAccessConfigShape {\n  pattern: string;\n  method: string;\n  minAccessLevel: 'none' | 'restricted' | 'read-only' | 'standard' | 'full' | 'internal';\n  minTrustScore?: number;\n  requiredPurposes?: string[];\n  allowedPurposes?: string[];\n  allowedJurisdictions?: string[];\n  maxDuration?: number;\n  maxTransactionValue?: number;\n}\n\n/**\n * Verify an agent AND automatically record the grant/deny decision.\n *\n * This is the recommended entry point for counterparties that call verify()\n * directly (e.g. MCP servers) rather than using createMiddleware().\n * It adds createSession: true, then fire-and-forgets the decision.\n */\nexport async function verifyAndRecord(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n  const result = await verify(mergedConfig, { ...request, createSession: true });\n  const sessionId = (result as EnhancedVerificationResult).sessionId;\n\n  if (sessionId) {\n    if (result.verified) {\n      recordDecision(mergedConfig, sessionId, 'granted').catch(() => {});\n    } else {\n      recordDecision(mergedConfig, sessionId, 'denied', result.denialReasons?.[0]).catch(() => {});\n    }\n  }\n\n  return result;\n}\n\n/**\n * Report an unregistered agent attempt (no AstraSync credentials).\n * Called by SDK adapters when an agent is redirected to /docs/agent-access.\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function reportUnregisteredAttempt(\n  config: GatewayConfig,\n  data: {\n    counterpartyUrl: string;\n    counterpartyType?: string;\n    sourceIp?: string;\n    userAgent?: string;\n    requestPath?: string;\n    requestMethod?: string;\n  }\n): Promise<void> {\n  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl!;\n\n  await fetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(data),\n  }).catch(() => {\n    /* fire-and-forget */\n  });\n}\n\n/**\n * Report a counterparty-side PDLSS pre-check failure.\n * Called by SDK adapters when the agent's requested PDLSS exceeds\n * counterparty-defined maximums BEFORE calling verify-access.\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function reportCounterpartyPreCheckFailure(\n  config: GatewayConfig,\n  data: {\n    agentId: string;\n    counterpartyUrl: string;\n    counterpartyType?: string;\n    failures: Array<{\n      field: string;\n      requested: string | number;\n      limit: string | number | string[];\n      message: string;\n    }>;\n    requestPath?: string;\n    requestMethod?: string;\n  }\n): Promise<void> {\n  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl!;\n\n  await fetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(data),\n  }).catch(() => {\n    /* fire-and-forget */\n  });\n}\n\n/**\n * Quick verification - just check if credentials are valid\n */\nexport async function quickVerify(\n  config: GatewayConfig,\n  credentials: AgentCredentials\n): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n  const result = await verify(config, {\n    credentials,\n    purpose: 'verification',\n  });\n\n  return {\n    verified: result.verified,\n    accessLevel: result.accessLevel,\n    reason: result.denialReasons?.[0],\n  };\n}\n","/**\n * AstraSync Universal Verification Gateway - SDK Adapter\n *\n * Direct SDK for verifying agents in any JavaScript/TypeScript environment.\n * Useful for agent-to-agent verification, serverless functions, or custom integrations.\n *\n * @example\n * ```typescript\n * import { createClient } from '@astrasyncai/verification-gateway/sdk';\n *\n * const gateway = createClient({\n *   apiBaseUrl: 'https://astrasync.ai/api',\n * });\n *\n * // Verify another agent before interacting\n * const result = await gateway.verify({\n *   astraId: 'ASTRA-abc123',\n *   purpose: 'data-exchange',\n * });\n *\n * if (result.verified && result.accessLevel !== 'none') {\n *   // Safe to interact with this agent\n * }\n * ```\n */\n\nimport type {\n  SDKOptions,\n  AgentCredentials,\n  VerificationResult,\n  VerificationRequest,\n  AccessLevel,\n  GatewayConfig,\n} from '../types';\nimport { verify as coreVerify, quickVerify as coreQuickVerify, clearCache } from '../verify';\nimport { getTrustLevel, hasMinimumAccess, getCapabilities } from '../access-levels';\nimport type { AccessCapabilities } from '../access-levels';\n\n/**\n * Verification Gateway SDK Client\n */\nexport class VerificationGatewayClient {\n  private config: GatewayConfig;\n  private timeout: number;\n  private retryConfig: { maxRetries: number; backoffMs: number };\n\n  constructor(options: SDKOptions) {\n    this.config = {\n      apiBaseUrl: options.apiBaseUrl,\n      apiKey: options.apiKey,\n      defaultAccessLevel: options.defaultAccessLevel,\n      minTrustScore: options.minTrustScore,\n      minTrustScoreForFull: options.minTrustScoreForFull,\n      cacheTtl: options.cacheTtl,\n      debug: options.debug,\n      customHeaders: options.customHeaders,\n      counterpartyUrl: options.counterpartyUrl,\n      counterpartyType: options.counterpartyType,\n    };\n\n    this.timeout = options.timeout || 10000;\n    this.retryConfig = options.retry || { maxRetries: 3, backoffMs: 1000 };\n  }\n\n  /**\n   * Full verification with all details\n   */\n  async verify(options: {\n    astraId?: string;\n    apiKey?: string;\n    jwt?: string;\n    purpose?: string;\n    action?: string;\n    resourceType?: string;\n    resource?: string;\n    jurisdiction?: string;\n    transactionValue?: number;\n    currency?: string;\n    isSubAgentRequest?: boolean;\n    parentAgentId?: string;\n    subAgentDepth?: number;\n    counterpartyUrl?: string;\n    counterpartyType?: string;\n  }): Promise<VerificationResult> {\n    const credentials: AgentCredentials = {\n      astraId: options.astraId,\n      apiKey: options.apiKey,\n      jwt: options.jwt,\n    };\n\n    return this.executeWithRetry(() =>\n      coreVerify(this.config, {\n        credentials,\n        purpose: options.purpose,\n        action: options.action,\n        resourceType: options.resourceType,\n        resource: options.resource,\n        jurisdiction: options.jurisdiction,\n        transactionValue: options.transactionValue,\n        currency: options.currency,\n        isSubAgentRequest: options.isSubAgentRequest,\n        parentAgentId: options.parentAgentId,\n        subAgentDepth: options.subAgentDepth,\n        counterpartyUrl: options.counterpartyUrl,\n        counterpartyType: options.counterpartyType as VerificationRequest['counterpartyType'],\n      })\n    );\n  }\n\n  /**\n   * Quick verification - just check if credentials are valid\n   */\n  async quickVerify(credentials: {\n    astraId?: string;\n    apiKey?: string;\n    jwt?: string;\n  }): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n    return this.executeWithRetry(() => coreQuickVerify(this.config, credentials));\n  }\n\n  /**\n   * Check if an agent has a specific access level\n   */\n  async hasAccess(\n    credentials: { astraId?: string; apiKey?: string; jwt?: string },\n    requiredLevel: AccessLevel\n  ): Promise<boolean> {\n    const result = await this.quickVerify(credentials);\n    return hasMinimumAccess(result.accessLevel, requiredLevel);\n  }\n\n  /**\n   * Get capabilities for a verified agent\n   */\n  async getCapabilities(credentials: {\n    astraId?: string;\n    apiKey?: string;\n    jwt?: string;\n  }): Promise<AccessCapabilities> {\n    const result = await this.quickVerify(credentials);\n    return getCapabilities(result.accessLevel);\n  }\n\n  /**\n   * Verify a specific ASTRA-ID\n   */\n  async verifyAstraId(\n    astraId: string,\n    options?: {\n      purpose?: string;\n      action?: string;\n    }\n  ): Promise<VerificationResult> {\n    return this.verify({\n      astraId,\n      purpose: options?.purpose,\n      action: options?.action,\n    });\n  }\n\n  /**\n   * Verify using an API key\n   */\n  async verifyApiKey(\n    apiKey: string,\n    options?: {\n      purpose?: string;\n      action?: string;\n    }\n  ): Promise<VerificationResult> {\n    return this.verify({\n      apiKey,\n      purpose: options?.purpose,\n      action: options?.action,\n    });\n  }\n\n  /**\n   * Clear the verification cache\n   */\n  clearCache(): void {\n    clearCache();\n  }\n\n  /**\n   * Execute a function with retry logic\n   */\n  private async executeWithRetry<T>(fn: () => Promise<T>): Promise<T> {\n    let lastError: Error | null = null;\n\n    for (let attempt = 0; attempt <= this.retryConfig.maxRetries; attempt++) {\n      try {\n        // Add timeout\n        const result = await Promise.race([\n          fn(),\n          new Promise<never>((_, reject) =>\n            setTimeout(() => reject(new Error('Request timeout')), this.timeout)\n          ),\n        ]);\n\n        return result;\n      } catch (error) {\n        lastError = error instanceof Error ? error : new Error(String(error));\n\n        // Don't retry on last attempt\n        if (attempt < this.retryConfig.maxRetries) {\n          // Exponential backoff\n          const backoff = this.retryConfig.backoffMs * Math.pow(2, attempt);\n          await new Promise((resolve) => setTimeout(resolve, backoff));\n        }\n      }\n    }\n\n    throw lastError || new Error('Verification failed after retries');\n  }\n}\n\n/**\n * Create a new SDK client\n */\nexport function createClient(options: SDKOptions): VerificationGatewayClient {\n  return new VerificationGatewayClient(options);\n}\n\n/**\n * One-shot verification without creating a client\n */\nexport async function verifyOnce(\n  options: SDKOptions & {\n    astraId?: string;\n    apiKey?: string;\n    jwt?: string;\n    purpose?: string;\n    action?: string;\n  }\n): Promise<VerificationResult> {\n  const client = createClient(options);\n  return client.verify(options);\n}\n\n// Re-export utilities for convenience\nexport { getTrustLevel, hasMinimumAccess, getCapabilities };\n"],"mappings":";AAeO,IAAM,yBAAsD;AAAA,EACjE,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AACZ;AAuCO,SAAS,cAAc,OAA2B;AACvD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAKO,SAAS,iBAAiB,QAAqB,UAAgC;AACpF,SAAO,uBAAuB,MAAM,KAAK,uBAAuB,QAAQ;AAC1E;AA2DO,SAAS,gBAAgB,aAA8C;AAC5E,UAAQ,aAAa;AAAA,IACnB,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF;AACE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,EACJ;AACF;;;AChKA,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKZ,oBAAoB;AAAA;AAAA,EAEpB,UAAU;AAAA;AAAA,EACV,OAAO;AACT;AAOA,IAAI,qBAAqB;AAGzB,IAAI,0BAA0B;AAE9B,eAAe,iBAAiB,YAAoB,OAAgC;AAClF,uBAAqB;AACrB,MAAI;AACF,UAAM,WAAW,GAAG,UAAU;AAK9B,UAAM,WAAW,MAAM,MAAM,UAAU,EAAE,QAAQ,OAAO,CAAC;AACzD,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,QAAI,YAAY,WAAW,WAAW,GAAG;AACvC,cAAQ;AAAA,QACN,qCAAqC,UAAU,kCAAkC,WAAW;AAAA,MAI9F;AAAA,IACF,WAAW,OAAO;AAChB,cAAQ;AAAA,QACN,+CAA+C,UAAU,mBAAmB,WAAW;AAAA,MACzF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,OAAO;AACT,cAAQ,IAAI,2DAA2D,OAAO,GAAG,CAAC,EAAE;AAAA,IACtF;AAAA,EACF;AACF;AAKA,IAAM,oBAAoB,oBAAI,IAA+D;AAK7F,SAAS,YAAY,aAAuC;AAC1D,SAAO,GAAG,YAAY,WAAW,EAAE,IAAI,YAAY,UAAU,EAAE,IAAI,YAAY,OAAO,EAAE;AAC1F;AAKA,SAAS,gBAAgB,aAA0D;AACjF,QAAM,MAAM,YAAY,WAAW;AACnC,QAAM,SAAS,kBAAkB,IAAI,GAAG;AAExC,MAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,QAAQ;AACV,sBAAkB,OAAO,GAAG;AAAA,EAC9B;AAEA,SAAO;AACT;AAKA,SAAS,YACP,aACA,QACA,YACM;AACN,QAAM,MAAM,YAAY,WAAW;AACnC,oBAAkB,IAAI,KAAK;AAAA,IACzB;AAAA,IACA,WAAW,KAAK,IAAI,IAAI,aAAa;AAAA,EACvC,CAAC;AACH;AAKO,SAAS,aAAmB;AACjC,oBAAkB,MAAM;AAC1B;AAmEA,SAAS,uBAAuB,QAAuB,QAAqC;AAC1F,QAAM,WAAyB;AAAA,IAC7B,SACE;AAAA,IACF,iBAAiB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IACzD,kBAAkB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMV,aAAa;AAAA,IACb;AAAA,IACA,eAAe,SAAS,CAAC,MAAM,IAAI,CAAC,qCAAqC;AAAA,IACzE,YAAY,oBAAI,KAAK;AAAA,EACvB;AACF;AAKA,eAAe,oBACb,QACA,SA+EC;AACD,QAAM,EAAE,aAAa,GAAG,YAAY,IAAI;AAIxC,QAAM,OAAgC;AAAA,IACpC,GAAI,YAAY,WAAW,EAAE,SAAS,YAAY,QAAQ;AAAA,IAC1D,SAAS,YAAY,WAAW;AAAA,EAClC;AAGA,MAAI,YAAY,OAAQ,MAAK,SAAS,YAAY;AAClD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,kBAAmB,MAAK,oBAAoB,YAAY;AACxE,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,kBAAkB,OAAW,MAAK,gBAAgB,YAAY;AAE9E,MAAI,YAAY;AACd,SAAK,yBAAyB,YAAY;AAC5C,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,gBAAiB,MAAK,kBAAkB,YAAY;AACpE,MAAI,OAAO,eAAgB,MAAK,iBAAiB,OAAO;AACxD,MAAI,YAAY;AACd,SAAK,0BAA0B,YAAY;AAI7C,MAAI,YAAY,kBAAkB,YAAY,YAAY,YAAY,WAAW;AAC/E,UAAM,OAAO;AAAA,MACX,GAAI,YAAY,YAAY,EAAE,UAAU,YAAY,SAAS;AAAA,MAC7D,GAAI,YAAY,aAAa,EAAE,WAAW,YAAY,UAAU;AAAA,MAChE,GAAG,YAAY;AAAA,IACjB;AACA,QAAI,OAAO,KAAK,IAAI,EAAE,SAAS,EAAG,MAAK,iBAAiB;AAAA,EAC1D;AAGA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAG,OAAO;AAAA,EACZ;AAKA,MAAI,YAAY,qBAAqB;AACnC,YAAQ,eAAe,IAAI,YAAY;AAAA,EACzC,WAAW,OAAO,QAAQ;AACxB,YAAQ,eAAe,IAAI,UAAU,OAAO,MAAM;AAAA,EACpD;AAEA,MAAI,OAAO,QAAQ;AACjB,YAAQ,WAAW,IAAI,OAAO;AAAA,EAChC;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAG,OAAO,UAAU,yBAAyB;AAAA,MACxE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAMjC,QAAI,SAAS,WAAW,KAAK;AAC3B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,UACN,SAAS;AAAA,UACT,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,UAAU;AAAA,YACR;AAAA,cACE,WAAW;AAAA,cACX,SACE,OAAO,MAAM,YAAY,WAAW,KAAK,UAAU;AAAA,cACrD,UACE,OAAO,MAAM,aAAa,WACtB,KAAK,WACL;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,WAAW,KAAK,SAAS,gBAAgB,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,qCAAqC,OAAO;AAAA,IACrD;AAAA,EACF;AACF;AAKA,eAAsB,OACpB,QACA,SAC6B;AAC7B,QAAM,eAAe,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAGpD,MAAI,CAAC,sBAAsB,CAAC,aAAa,qBAAqB,aAAa,YAAY;AACrF,SAAK,iBAAiB,aAAa,YAAY,aAAa,KAAK;AAAA,EACnE;AAGA,MACE,CAAC,4BACA,OAAO,kBAAkB,UAAa,OAAO,yBAAyB,SACvE;AACA,8BAA0B;AAC1B,YAAQ;AAAA,MACN;AAAA,IAIF;AAAA,EACF;AAQA,MAAI,aAAa,YAAY,aAAa,WAAW,GAAG;AACtD,UAAM,SAAS,gBAAgB,QAAQ,WAAW;AAClD,QAAI,QAAQ;AACV,UAAI,aAAa,OAAO;AACtB,gBAAQ,IAAI,+CAA+C;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAI,CAAC,gBAAgB,mBAAmB,aAAa,iBAAiB;AACpE,oBAAgB,kBAAkB,aAAa;AAAA,EACjD;AACA,MAAI,CAAC,gBAAgB,oBAAoB,aAAa,kBAAkB;AACtE,oBAAgB,mBAAmB,aAAa;AAAA,EAClD;AAGA,MAAI,aAAa,OAAO;AACtB,YAAQ,IAAI,iDAAiD;AAAA,EAC/D;AAEA,QAAM,cAAc,MAAM,oBAAoB,cAAc,eAAe;AAG3E,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,uBAAuB,cAAc,YAAY,KAAK;AAAA,EAC/D;AAGA,MAAI,CAAC,YAAY,QAAQ,SAAS;AAIhC,UAAM,qBAAsB,YAAY,QACpC;AACJ,UAAMA,UAAqC;AAAA,MACzC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQV,aAAa;AAAA,MACb,eACE,sBAAsB,mBAAmB,SAAS,IAC9C,mBAAmB,IAAI,CAAC,MAAM,EAAE,OAAO,IACvC,YAAY,QAAQ,SAClB,CAAC,YAAY,OAAO,MAAM,IAC1B,CAAC,eAAe;AAAA,MACxB,UAAU;AAAA,MACV,gBAAgB,YAAY,QAAQ;AAAA,MACpC,kBAAkB,YAAY,QAAQ;AAAA,MACtC,UAAU;AAAA,QACR,SAAS,YAAY,QAAQ,UAAU;AAAA,QACvC,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA;AAAA,MAErB,WAAY,YAAwC;AAAA;AAAA;AAAA,MAGpD,eAAgB,YAAwC;AAAA,MACxD,gBAAiB,YACd;AAAA,MACH,uBAAwB,YAAwC;AAAA,IAGlE;AAEA,WAAOA;AAAA,EACT;AAGA,QAAM,QAAmC,YAAY,QACjD;AAAA,IACE,SAAS,YAAY,MAAM;AAAA,IAC3B,MAAM,YAAY,MAAM;AAAA,IACxB,YAAY,YAAY,MAAM;AAAA,IAC9B,YAAY,cAAc,YAAY,MAAM,UAAU;AAAA,IACtD,oBAAoB,YAAY,MAAM,qBAAqB;AAAA,IAC3D,QAAQ,YAAY,MAAM;AAAA,EAC5B,IACA;AAEJ,QAAM,YAA2C,YAAY,YACzD;AAAA,IACE,UAAU,YAAY,UAAU;AAAA,IAChC,MAAM,YAAY,UAAU;AAAA,IAC5B,YAAY,YAAY,UAAU,cAAc;AAAA,IAChD,UAAU,YAAY,UAAU;AAAA,EAClC,IACA;AAEJ,QAAM,eAAiD,YAAY,eAC/D;AAAA,IACE,MAAM,YAAY,aAAa;AAAA,IAC/B,UAAU,YAAY,aAAa;AAAA,IACnC,YAAY,YAAY,aAAa;AAAA,EACvC,IACA;AAKJ,QAAM,sBAAsB,YAAY;AAMxC,QAAM,cAA2B,YAAY,QAAQ,eAAe;AAEpE,QAAM,SAAqC;AAAA,IACzC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe,YAAY,QAAQ;AAAA,IACnC;AAAA,IACA,gBAAgB,YAAY,QAAQ;AAAA,IACpC,kBAAkB,YAAY,QAAQ;AAAA,IACtC,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,aAAa;AAAA;AAAA,IAEvB,WAAY,YAAwC;AAAA;AAAA;AAAA,IAGpD,eAAgB,YAAwC;AAAA,IACxD,kBAAmB,YAAwC;AAAA,IAG3D,eAAgB,YAAwC;AAAA,IAGxD,gBAAiB,YACd;AAAA,IACH,uBAAwB,YAAwC;AAAA,IAGhE,eAAgB,YAAwC;AAAA,EAG1D;AAGA,MAAI,OAAO,mBAAmB,QAAQ;AACpC,WAAO,WAAW;AAClB,WAAO,cAAc;AACrB,WAAO,gBAAgB,OAAO,yBAAyB;AAAA,MACrD;AAAA,IACF;AACA,QAAI,OAAO,kBAAkB;AAC3B,aAAO,WAAW;AAAA,QAChB,SAAS,wBAAwB,OAAO,iBAAiB,UAAU,0BAA0B;AAAA,QAC7F,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF,WAAW,OAAO,mBAAmB,oBAAoB;AACvD,WAAO,iBAAiB;AACxB,QAAI,uBAAuB,OAAO,WAAW,IAAI,uBAAuB,WAAW,GAAG;AACpF,aAAO,cAAc;AAAA,IACvB;AACA,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,+BAA+B;AAAA,EACzF;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,KAAK,OAAO,mBAAmB,QAAQ;AAC1F,gBAAY,QAAQ,aAAa,QAAQ,aAAa,QAAQ;AAAA,EAChE;AAEA,SAAO;AACT;AAwOA,eAAsB,YACpB,QACA,aAC2E;AAC3E,QAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,IAClC;AAAA,IACA,SAAS;AAAA,EACX,CAAC;AAED,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,aAAa,OAAO;AAAA,IACpB,QAAQ,OAAO,gBAAgB,CAAC;AAAA,EAClC;AACF;;;AC10BO,IAAM,4BAAN,MAAgC;AAAA,EAKrC,YAAY,SAAqB;AAC/B,SAAK,SAAS;AAAA,MACZ,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,MAChB,oBAAoB,QAAQ;AAAA,MAC5B,eAAe,QAAQ;AAAA,MACvB,sBAAsB,QAAQ;AAAA,MAC9B,UAAU,QAAQ;AAAA,MAClB,OAAO,QAAQ;AAAA,MACf,eAAe,QAAQ;AAAA,MACvB,iBAAiB,QAAQ;AAAA,MACzB,kBAAkB,QAAQ;AAAA,IAC5B;AAEA,SAAK,UAAU,QAAQ,WAAW;AAClC,SAAK,cAAc,QAAQ,SAAS,EAAE,YAAY,GAAG,WAAW,IAAK;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAgBmB;AAC9B,UAAM,cAAgC;AAAA,MACpC,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,KAAK,QAAQ;AAAA,IACf;AAEA,WAAO,KAAK;AAAA,MAAiB,MAC3B,OAAW,KAAK,QAAQ;AAAA,QACtB;AAAA,QACA,SAAS,QAAQ;AAAA,QACjB,QAAQ,QAAQ;AAAA,QAChB,cAAc,QAAQ;AAAA,QACtB,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,QACtB,kBAAkB,QAAQ;AAAA,QAC1B,UAAU,QAAQ;AAAA,QAClB,mBAAmB,QAAQ;AAAA,QAC3B,eAAe,QAAQ;AAAA,QACvB,eAAe,QAAQ;AAAA,QACvB,iBAAiB,QAAQ;AAAA,QACzB,kBAAkB,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAI4D;AAC5E,WAAO,KAAK,iBAAiB,MAAM,YAAgB,KAAK,QAAQ,WAAW,CAAC;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UACJ,aACA,eACkB;AAClB,UAAM,SAAS,MAAM,KAAK,YAAY,WAAW;AACjD,WAAO,iBAAiB,OAAO,aAAa,aAAa;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,aAIU;AAC9B,UAAM,SAAS,MAAM,KAAK,YAAY,WAAW;AACjD,WAAO,gBAAgB,OAAO,WAAW;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACJ,SACA,SAI6B;AAC7B,WAAO,KAAK,OAAO;AAAA,MACjB;AAAA,MACA,SAAS,SAAS;AAAA,MAClB,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aACJ,QACA,SAI6B;AAC7B,WAAO,KAAK,OAAO;AAAA,MACjB;AAAA,MACA,SAAS,SAAS;AAAA,MAClB,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,aAAmB;AACjB,eAAW;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAoB,IAAkC;AAClE,QAAI,YAA0B;AAE9B,aAAS,UAAU,GAAG,WAAW,KAAK,YAAY,YAAY,WAAW;AACvE,UAAI;AAEF,cAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,UAChC,GAAG;AAAA,UACH,IAAI;AAAA,YAAe,CAAC,GAAG,WACrB,WAAW,MAAM,OAAO,IAAI,MAAM,iBAAiB,CAAC,GAAG,KAAK,OAAO;AAAA,UACrE;AAAA,QACF,CAAC;AAED,eAAO;AAAA,MACT,SAAS,OAAO;AACd,oBAAY,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAGpE,YAAI,UAAU,KAAK,YAAY,YAAY;AAEzC,gBAAM,UAAU,KAAK,YAAY,YAAY,KAAK,IAAI,GAAG,OAAO;AAChE,gBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,MAAM,mCAAmC;AAAA,EAClE;AACF;AAKO,SAAS,aAAa,SAAgD;AAC3E,SAAO,IAAI,0BAA0B,OAAO;AAC9C;AAKA,eAAsB,WACpB,SAO6B;AAC7B,QAAM,SAAS,aAAa,OAAO;AACnC,SAAO,OAAO,OAAO,OAAO;AAC9B;","names":["result"]}
+{"version":3,"sources":["../../src/access-levels.ts","../../src/verify.ts","../../src/adapters/sdk.ts"],"sourcesContent":["/**\n * AstraSync Universal Verification Gateway - Access Level Definitions\n *\n * Defines the hierarchy and capabilities of each access level.\n *\n * v2.3.9 (defect #30): renamed `'guidance'` band → `'restricted'`. See\n * `types.ts` AccessLevel for the rationale (value-name collision with the\n * `guidance: {...}` help-payload object on VerificationResult).\n */\n\nimport type { AccessLevel, TrustLevel } from './types';\n\n/**\n * Access level hierarchy (higher number = more access)\n */\nexport const ACCESS_LEVEL_HIERARCHY: Record<AccessLevel, number> = {\n  none: 0,\n  restricted: 1,\n  'read-only': 2,\n  standard: 3,\n  full: 4,\n  internal: 5,\n};\n\n/**\n * Access level descriptions for UI\n */\nexport const ACCESS_LEVEL_DESCRIPTIONS: Record<AccessLevel, string> = {\n  none: 'No access - credentials required',\n  restricted: 'Restricted access - registration prompt only',\n  'read-only': 'Read-only access - can browse but not modify',\n  standard: 'Standard access - normal operations per PDLSS policy',\n  full: 'Full access - all operations for high-trust agents',\n  internal: 'Internal access - organization member privileges',\n};\n\n/**\n * Default trust score thresholds for access levels\n */\nexport const DEFAULT_TRUST_THRESHOLDS: Record<AccessLevel, number> = {\n  none: 0,\n  restricted: 0,\n  'read-only': 20,\n  standard: 40,\n  full: 70,\n  internal: 0, // Internal is based on org membership, not score\n};\n\n/**\n * Trust level score ranges\n */\nexport const TRUST_LEVEL_RANGES: Record<TrustLevel, { min: number; max: number }> = {\n  BRONZE: { min: 0, max: 39 },\n  SILVER: { min: 40, max: 59 },\n  GOLD: { min: 60, max: 79 },\n  PLATINUM: { min: 80, max: 100 },\n};\n\n/**\n * Determine trust level from score\n */\nexport function getTrustLevel(score: number): TrustLevel {\n  if (score >= 80) return 'PLATINUM';\n  if (score >= 60) return 'GOLD';\n  if (score >= 40) return 'SILVER';\n  return 'BRONZE';\n}\n\n/**\n * Check if access level A is greater than or equal to access level B\n */\nexport function hasMinimumAccess(actual: AccessLevel, required: AccessLevel): boolean {\n  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];\n}\n\n/**\n * Get the highest access level for a given trust score\n */\nexport function getAccessLevelForScore(\n  trustScore: number,\n  thresholds: Record<AccessLevel, number> = DEFAULT_TRUST_THRESHOLDS\n): AccessLevel {\n  if (trustScore >= thresholds.full) return 'full';\n  if (trustScore >= thresholds.standard) return 'standard';\n  if (trustScore >= thresholds['read-only']) return 'read-only';\n  return 'restricted';\n}\n\n/**\n * Determine access level from verification result.\n *\n * v2.3.9 (defect #30): unverified callers now return `'none'` (was\n * `'guidance'`). Denials grant zero — never a positive band.\n */\nexport function determineAccessLevel(\n  verified: boolean,\n  trustScore: number,\n  isOrgMember: boolean,\n  customThresholds?: Partial<Record<AccessLevel, number>>\n): AccessLevel {\n  if (!verified) {\n    return 'none';\n  }\n\n  if (isOrgMember) {\n    return 'internal';\n  }\n\n  const thresholds = {\n    ...DEFAULT_TRUST_THRESHOLDS,\n    ...customThresholds,\n  };\n\n  return getAccessLevelForScore(trustScore, thresholds);\n}\n\n/**\n * Access capabilities per level\n */\nexport interface AccessCapabilities {\n  canRead: boolean;\n  canWrite: boolean;\n  canDelete: boolean;\n  canAdmin: boolean;\n  canAccessInternal: boolean;\n  maxTransactionValue?: number;\n  allowedPurposes?: string[];\n}\n\n/**\n * Get capabilities for an access level\n */\nexport function getCapabilities(accessLevel: AccessLevel): AccessCapabilities {\n  switch (accessLevel) {\n    case 'none':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'restricted':\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'read-only':\n      return {\n        canRead: true,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'standard':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'full':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n    case 'internal':\n      return {\n        canRead: true,\n        canWrite: true,\n        canDelete: true,\n        canAdmin: true,\n        canAccessInternal: true,\n      };\n    default:\n      return {\n        canRead: false,\n        canWrite: false,\n        canDelete: false,\n        canAdmin: false,\n        canAccessInternal: false,\n      };\n  }\n}\n","/**\n * AstraSync Universal Verification Gateway - Core Verification Logic\n *\n * This module handles the core verification logic, calling the AstraSync API\n * and processing the response into a standardized VerificationResult.\n */\n\nimport type {\n  GatewayConfig,\n  AgentCredentials,\n  VerificationRequest,\n  VerificationResult,\n  VerifiedAgent,\n  VerifiedDeveloper,\n  VerifiedOrganization,\n  GuidanceInfo,\n  AccessLevel,\n  EnhancedVerificationResult,\n  TokenGuidance,\n  RuntimeChallengeResult,\n} from './types';\nimport { getTrustLevel, ACCESS_LEVEL_HIERARCHY } from './access-levels';\n\n/**\n * Default configuration values\n *\n * apiBaseUrl matches the OpenAPI authoritative server (https://astrasync.ai/api\n * for prod, https://staging.astrasync.ai/api for staging). Always include the\n * /api path prefix when overriding — registration / docs URLs are derived by\n * stripping it.\n */\nconst DEFAULT_CONFIG: Partial<GatewayConfig> = {\n  apiBaseUrl: 'https://astrasync.ai/api',\n  // v2.3.9 (defect #30): default for unconfigured callers is `'none'` (no\n  // access). Pre-rename this defaulted to `'guidance'`, which combined with\n  // a route gated at `'guidance'` to silently let unverified traffic\n  // through (`hasMinimumAccess('guidance', 'guidance') === true`).\n  defaultAccessLevel: 'none',\n  // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.\n  cacheTtl: 300, // 5 minutes\n  debug: false,\n};\n\n/**\n * Init self-test state. Fires once per process on first verify() call to warn\n * if apiBaseUrl is pointing at the wrong host (e.g. a marketing site that\n * 200s with text/html instead of the API).\n */\nlet initCheckPerformed = false;\n\n/** One-shot guard for v2.3.0 deprecation warning. */\nlet deprecationWarningShown = false;\n\nasync function performInitCheck(apiBaseUrl: string, debug?: boolean): Promise<void> {\n  initCheckPerformed = true;\n  try {\n    const probeUrl = `${apiBaseUrl}/agents/verify-access`;\n    // HEAD mirrors GET semantics (running the full request pipeline without a\n    // body) so the response carries the same content-type the marketing 404\n    // would return. OPTIONS often gets short-circuited by CORS-preflight\n    // handlers and returns no content-type, defeating the check.\n    const response = await fetch(probeUrl, { method: 'HEAD' });\n    const contentType = response.headers.get('content-type') ?? '';\n    if (contentType.startsWith('text/html')) {\n      console.warn(\n        `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). ` +\n          `This usually means apiBaseUrl is pointing at a marketing site instead of the API. ` +\n          `Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging). ` +\n          `Set disableInitChecks: true on GatewayConfig to silence this warning.`\n      );\n    } else if (debug) {\n      console.log(\n        `[VerificationGateway] init check passed for ${apiBaseUrl} (content-type: ${contentType})`\n      );\n    }\n  } catch (err) {\n    if (debug) {\n      console.log(`[VerificationGateway] init check failed (non-blocking): ${String(err)}`);\n    }\n  }\n}\n\n/**\n * Simple in-memory cache for verification results\n */\nconst verificationCache = new Map<string, { result: VerificationResult; expiresAt: number }>();\n\n/**\n * Generate cache key from credentials\n */\nfunction getCacheKey(credentials: AgentCredentials): string {\n  return `${credentials.astraId || ''}-${credentials.apiKey || ''}-${credentials.jwt || ''}`;\n}\n\n/**\n * Check if cached result is still valid\n */\nfunction getCachedResult(credentials: AgentCredentials): VerificationResult | null {\n  const key = getCacheKey(credentials);\n  const cached = verificationCache.get(key);\n\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.result;\n  }\n\n  if (cached) {\n    verificationCache.delete(key);\n  }\n\n  return null;\n}\n\n/**\n * Cache a verification result\n */\nfunction cacheResult(\n  credentials: AgentCredentials,\n  result: VerificationResult,\n  ttlSeconds: number\n): void {\n  const key = getCacheKey(credentials);\n  verificationCache.set(key, {\n    result,\n    expiresAt: Date.now() + ttlSeconds * 1000,\n  });\n}\n\n/**\n * Clear the verification cache\n */\nexport function clearCache(): void {\n  verificationCache.clear();\n}\n\n/**\n * Extract agent credentials from various sources\n */\nexport function extractCredentials(\n  headers: Record<string, string | string[] | undefined>,\n  query?: Record<string, string | undefined>\n): AgentCredentials {\n  const credentials: AgentCredentials = {};\n\n  // Check for ASTRA-ID in headers (case-insensitive). Accepts the historical\n  // X-Astra-Id name plus the X-Astra-AgentId / x-astra-agent-id alias the\n  // partner asked for in #9a — both surface the same field.\n  const astraIdHeader =\n    headers['x-astra-id'] ||\n    headers['X-Astra-Id'] ||\n    headers['X-ASTRA-ID'] ||\n    headers['x-astra-agentid'] ||\n    headers['X-Astra-AgentId'] ||\n    headers['x-astra-agent-id'] ||\n    headers['X-Astra-Agent-Id'] ||\n    headers['X-ASTRA-AGENT-ID'];\n  if (astraIdHeader) {\n    credentials.astraId = Array.isArray(astraIdHeader) ? astraIdHeader[0] : astraIdHeader;\n  }\n\n  // Check for API key in headers\n  const apiKeyHeader = headers['x-api-key'] || headers['X-Api-Key'] || headers['X-API-KEY'];\n  if (apiKeyHeader) {\n    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;\n  }\n\n  // Check Authorization header for Bearer token\n  const authHeader = headers['authorization'] || headers['Authorization'];\n  if (authHeader) {\n    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n    credentials.authorizationHeader = authValue;\n\n    if (authValue.startsWith('Bearer ')) {\n      credentials.jwt = authValue.slice(7);\n    }\n  }\n\n  // Check query parameters as fallback\n  if (query) {\n    if (query.astraId && !credentials.astraId) {\n      credentials.astraId = query.astraId;\n    }\n    if (query.apiKey && !credentials.apiKey) {\n      credentials.apiKey = query.apiKey;\n    }\n  }\n\n  return credentials;\n}\n\n/**\n * Check if credentials are present\n */\nexport function hasCredentials(credentials: AgentCredentials): boolean {\n  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);\n}\n\n/**\n * Source of a synthesised guidance response. Round-10 split — the\n * `'no_credentials'` shape is the original (caller has no AstraSync\n * credentials, suggest registration). The `'api_error'` shape is for when\n * the verify-access HTTP call itself failed (5xx, network, etc.) — DON'T\n * tell a verified-but-currently-blocked partner to \"register your agent\".\n */\ntype GuidanceSource = 'no_credentials' | 'api_error';\n\n/**\n * Create guidance response for unverified agents or for API-error fallback.\n *\n * Round-10 (#47, O5): split source so the `register your agent` template\n * doesn't fire on transient backend failures. Also threads `correlationId`\n * through so adapter `onDenied` handlers can surface it on the merchant's\n * response body for log correlation.\n */\nfunction createGuidanceResponse(\n  config: GatewayConfig,\n  reason?: string,\n  options: { source?: GuidanceSource; correlationId?: string } = {}\n): VerificationResult {\n  const source = options.source ?? 'no_credentials';\n  const isApiError = source === 'api_error';\n\n  const guidance: GuidanceInfo = isApiError\n    ? {\n        message:\n          'Verification is temporarily unavailable. Retry with exponential backoff; if the issue persists, contact support with the correlationId.',\n        registrationUrl: `${config.apiBaseUrl.replace('/api', '')}/register`,\n        documentationUrl: `${config.apiBaseUrl.replace('/api', '')}/docs/agent-access`,\n        steps: [\n          'Retry the request with exponential backoff',\n          'If failures persist, share the correlationId with support',\n        ],\n      }\n    : {\n        message:\n          'This service verifies AI agents before granting access. Please register your agent with AstraSync.',\n        registrationUrl: `${config.apiBaseUrl.replace('/api', '')}/register`,\n        documentationUrl: `${config.apiBaseUrl.replace('/api', '')}/docs/agent-access`,\n        steps: [\n          'Register for an AstraSync account',\n          'Create and register your agent',\n          'Add your ASTRA-ID to request headers',\n          'Retry your request',\n        ],\n      };\n\n  return {\n    verified: false,\n    // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.\n    // Adapters additionally short-circuit on `verified === false` before\n    // the gate check, but the access level still has to be honest at the\n    // data layer so downstream consumers (SDK adapters in other languages,\n    // custom integrations) inherit the correct semantics.\n    accessLevel: 'none',\n    guidance,\n    denialReasons: reason ? [reason] : ['No valid agent credentials provided'],\n    // Round-10 (#47, O5): on API-error fallback, surface a typed failure so\n    // partners (and their custom onDenied handlers) can branch on\n    // dimension. Without this, the synthesised stub was indistinguishable\n    // from a real policy deny.\n    failures: isApiError\n      ? [\n          {\n            dimension: 'verify_access.api_error',\n            message: reason ?? 'Verification temporarily unavailable',\n            guidance: guidance.message,\n          },\n        ]\n      : undefined,\n    correlationId: options.correlationId,\n    verifiedAt: new Date(),\n  };\n}\n\n/**\n * Call the AstraSync verify-access API\n */\nasync function callVerifyAccessAPI(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<{\n  success: boolean;\n  access?: {\n    allowed: boolean;\n    /**\n     * Server-decided access level. Read verbatim — do NOT remap client-side.\n     * The server resolves this from endpoint policy + agent trust score using\n     * the canonical thresholds (see backend `apps/backend/src/utils/access-levels.ts`).\n     */\n    accessLevel?: AccessLevel;\n    reason?: string;\n    /**\n     * Aggregated denial failures (v2.9.8+). Empty / absent when allowed.\n     * Each entry is `{ dimension, message, guidance? }` — see\n     * `AccessFailure` for the contract.\n     */\n    failures?: Array<{ dimension: string; message: string; guidance?: string }>;\n    requiresStepUp?: boolean;\n    requiresApproval?: boolean;\n    appliedPolicy?: {\n      boundaryName: string;\n      policyVersion: string;\n    };\n    counterparty?: {\n      id: string;\n      name: string;\n      trustScoreRequirement: number;\n    };\n  };\n  agent?: {\n    kyaAgentId: string;\n    astraId: string;\n    name: string;\n    trustScore: number;\n    trustLevel: string;\n    agentStatus: string;\n    blockchainStatus: string;\n  };\n  developer?: {\n    kyaOwnerId: string;\n    fullName: string;\n    email: string;\n    identityVerified: boolean;\n    trustScore: number;\n  };\n  organization?: {\n    name: string;\n    verified: boolean;\n    trustScore: number;\n  };\n  /**\n   * Structured explanation of the verification decision. Tells the merchant\n   * WHY (id verified? challenge passed? request within PDLSS? trust score?)\n   * without exposing thresholds, scope lists, or other-tenant counterparty\n   * membership. Empty `attestations` unless the endpoint's access policy\n   * declared `required_attestations`.\n   */\n  verificationContext?: {\n    idVerified: boolean;\n    runtimeChallenge: {\n      status: 'passed' | 'skipped' | 'failed' | 'timeout' | 'not_supported';\n      checkedAt: string | null;\n    };\n    pdlssCheck: {\n      result: 'within' | 'exceeded' | 'denied' | 'not_evaluated';\n      purpose: 'approved' | 'denied';\n      scope: 'approved' | 'denied';\n    };\n    dynamicTrustScore: number;\n    attestations: Array<{\n      type: string;\n      status: 'passed' | 'failed';\n      validUntil?: string;\n      proofType: 'reference' | 'zkp';\n      proof: string;\n    }>;\n  };\n  error?: string;\n  /**\n   * Round-10 (#47, O5): when the verify-access server response carries a\n   * correlationId on an error envelope, propagate it so the SDK can thread\n   * it through createGuidanceResponse → adapter onDenied → merchant body.\n   */\n  correlationId?: string;\n}> {\n  const { credentials, ...requestData } = request;\n\n  // Build the request body. agentId is omitted when not provided so the\n  // server treats it as an anonymous canonical-flow call (Branch A/B/C).\n  const body: Record<string, unknown> = {\n    ...(credentials.astraId && { agentId: credentials.astraId }),\n    purpose: requestData.purpose || 'general',\n  };\n\n  // Add optional fields\n  if (requestData.action) body.action = requestData.action;\n  if (requestData.resourceType) body.resourceType = requestData.resourceType;\n  if (requestData.resource) body.resource = requestData.resource;\n  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;\n  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;\n  if (requestData.currency) body.currency = requestData.currency;\n  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;\n  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;\n  if (requestData.subAgentDepth !== undefined) body.subAgentDepth = requestData.subAgentDepth;\n  // Handshake Protocol v10 additions\n  if (requestData.enableRuntimeChallenge)\n    body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;\n  if (requestData.createSession) body.createSession = requestData.createSession;\n  if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;\n  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;\n  if (requestData.counterpartyUrl) body.counterpartyUrl = requestData.counterpartyUrl;\n  if (config.counterpartyId) body.counterpartyId = config.counterpartyId;\n  if (requestData.runtimeChallengeOptions)\n    body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;\n\n  // Forward caller metadata when present. Merges the legacy top-level\n  // clientIp/userAgent into the nested block for backward compatibility.\n  if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {\n    const meta = {\n      ...(requestData.clientIp && { sourceIp: requestData.clientIp }),\n      ...(requestData.userAgent && { userAgent: requestData.userAgent }),\n      ...requestData.callerMetadata,\n    };\n    if (Object.keys(meta).length > 0) body.callerMetadata = meta;\n  }\n\n  // Build headers\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    ...config.customHeaders,\n  };\n\n  // verify-access requires authentication. The backend's authenticate middleware\n  // accepts either a JWT or an API key (starts with kya_) via `Authorization: Bearer <token>`.\n  // Credential-supplied auth header (e.g. the agent's own token) takes priority.\n  if (credentials.authorizationHeader) {\n    headers['Authorization'] = credentials.authorizationHeader;\n  } else if (config.apiKey) {\n    headers['Authorization'] = `Bearer ${config.apiKey}`;\n  }\n  // Legacy header kept for compatibility with any middleware that reads it directly.\n  if (config.apiKey) {\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  try {\n    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    const data = await response.json();\n\n    // v2.3.8 (defect #29): treat 410 Gone as a deterministic deactivated-endpoint\n    // signal. Older SDKs may treat any non-2xx as transient and retry; v2.3.8+\n    // surfaces it as a structured denial with `reason: 'endpoint_deactivated'`\n    // so callers can distinguish \"endpoint gone\" from \"endpoint denied this\".\n    if (response.status === 410) {\n      return {\n        success: true,\n        access: {\n          allowed: false,\n          accessLevel: 'none',\n          reason: 'endpoint_deactivated',\n          failures: [\n            {\n              dimension: 'endpoint.deactivated',\n              message:\n                typeof data?.message === 'string' ? data.message : 'Endpoint has been deactivated',\n              guidance:\n                typeof data?.guidance === 'string'\n                  ? data.guidance\n                  : 'Reactivate via POST /api/endpoints/{id}/reactivate, or update the URL on the calling agent.',\n            },\n          ],\n        },\n      };\n    }\n\n    if (!response.ok) {\n      // Round-10 (#47, O5): propagate correlationId on the error path too if\n      // the server happened to include one (some 5xx error envelopes carry\n      // it). Lets the SDK pass it through to the adapter onDenied handler.\n      return {\n        success: false,\n        error: data.message || data.error || `API returned ${response.status}`,\n        correlationId: typeof data?.correlationId === 'string' ? data.correlationId : undefined,\n      };\n    }\n\n    return data;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return {\n      success: false,\n      error: `Failed to call verify-access API: ${message}`,\n    };\n  }\n}\n\n/**\n * Main verification function\n */\nexport async function verify(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n\n  // One-time init self-test — fire-and-forget, never blocks verify().\n  if (!initCheckPerformed && !mergedConfig.disableInitChecks && mergedConfig.apiBaseUrl) {\n    void performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug);\n  }\n\n  // Deprecation warning for v2.3.0 removed config fields. Fires once per process.\n  if (\n    !deprecationWarningShown &&\n    (config.minTrustScore !== undefined || config.minTrustScoreForFull !== undefined)\n  ) {\n    deprecationWarningShown = true;\n    console.warn(\n      '[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 ' +\n        'and have no effect. Server is now the single source of truth for access-level decisions ' +\n        '(the SDK reads access.accessLevel from the verify-access response). To gate access ' +\n        \"to an endpoint, configure the endpoint's trust_score_requirement server-side.\"\n    );\n  }\n\n  // v2.3.0: anonymous traffic no longer short-circuits here. We forward the\n  // request to the server with no agentId; the server applies the endpoint's\n  // unverifiedAgentPolicy and returns advisory. createGuidanceResponse remains\n  // as the offline fallback if the API itself fails (handled below).\n\n  // Check cache first\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {\n    const cached = getCachedResult(request.credentials);\n    if (cached) {\n      if (mergedConfig.debug) {\n        console.log('[VerificationGateway] Returning cached result');\n      }\n      return cached;\n    }\n  }\n\n  // Inject counterparty info from config if not already set in request\n  const enrichedRequest = { ...request };\n  if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {\n    enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;\n  }\n  if (!enrichedRequest.counterpartyType && mergedConfig.counterpartyType) {\n    enrichedRequest.counterpartyType = mergedConfig.counterpartyType;\n  }\n\n  // Call the API\n  if (mergedConfig.debug) {\n    console.log('[VerificationGateway] Calling verify-access API');\n  }\n\n  const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);\n\n  // Handle API errors\n  if (!apiResponse.success) {\n    // Round-10 (#47, O5): distinguish API errors from missing-credentials.\n    // The previous default tagged any failure with the \"register your\n    // agent\" template, which is misleading to a verified partner whose\n    // verify-access call hit a 500. The `api_error` source surfaces a\n    // typed `verify_access.api_error` failure entry instead.\n    return createGuidanceResponse(mergedConfig, apiResponse.error, {\n      source: 'api_error',\n      correlationId: (apiResponse as { correlationId?: string }).correlationId,\n    });\n  }\n\n  // Check access result\n  if (!apiResponse.access?.allowed) {\n    // v2.9.8 (defect M1): aggregated failures across every gate that\n    // denied. Surface them on the result so the integrator can see every\n    // blocker in one go instead of the previous fail-fast cascade.\n    const aggregatedFailures = (apiResponse.access as Record<string, unknown> | undefined)\n      ?.failures as Array<{ dimension: string; message: string; guidance?: string }> | undefined;\n    const result: EnhancedVerificationResult = {\n      verified: false,\n      // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.\n      // Pre-rename this hardcoded `'guidance'`, which conflated with the\n      // colocated `guidance: {...}` help-payload object below and let\n      // denied requests pass any route gated at `'guidance'` because\n      // `hasMinimumAccess('guidance', 'guidance') === true`. Adapters now\n      // ALSO short-circuit on `verified === false` before the gate check —\n      // belt-and-braces.\n      accessLevel: 'none',\n      denialReasons:\n        aggregatedFailures && aggregatedFailures.length > 0\n          ? aggregatedFailures.map((f) => f.message)\n          : apiResponse.access?.reason\n            ? [apiResponse.access.reason]\n            : ['Access denied'],\n      failures: aggregatedFailures,\n      requiresStepUp: apiResponse.access?.requiresStepUp,\n      requiresApproval: apiResponse.access?.requiresApproval,\n      guidance: {\n        message: apiResponse.access?.reason || 'Access denied by PDLSS policy',\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/pdlss`,\n      },\n      verifiedAt: new Date(),\n      // Extract sessionId so decisions can be recorded for denials too\n      sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n      // v2.3.10 (defect #34, round-4): anonymous traffic has no session →\n      // correlationId is the linking key for paired local_override events.\n      correlationId: (apiResponse as Record<string, unknown>).correlationId as string | undefined,\n      recommendation: (apiResponse as Record<string, unknown>)\n        .recommendation as EnhancedVerificationResult['recommendation'],\n      recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as\n        | string[]\n        | undefined,\n    };\n\n    return result;\n  }\n\n  // Build successful result\n  const agent: VerifiedAgent | undefined = apiResponse.agent\n    ? {\n        astraId: apiResponse.agent.astraId,\n        name: apiResponse.agent.name,\n        trustScore: apiResponse.agent.trustScore,\n        trustLevel: getTrustLevel(apiResponse.agent.trustScore),\n        blockchainVerified: apiResponse.agent.blockchainStatus === 'verified',\n        status: apiResponse.agent.agentStatus as VerifiedAgent['status'],\n      }\n    : undefined;\n\n  const developer: VerifiedDeveloper | undefined = apiResponse.developer\n    ? {\n        astradId: apiResponse.developer.kyaOwnerId,\n        name: apiResponse.developer.fullName,\n        trustScore: apiResponse.developer.trustScore || 0,\n        verified: apiResponse.developer.identityVerified,\n      }\n    : undefined;\n\n  const organization: VerifiedOrganization | undefined = apiResponse.organization\n    ? {\n        name: apiResponse.organization.name,\n        verified: apiResponse.organization.verified,\n        trustScore: apiResponse.organization.trustScore,\n      }\n    : undefined;\n\n  // Verification context — structured \"why\" the merchant gets in v2.2.4+.\n  // Carries appliedPolicy (no UUIDs), pdlssCheck summary, dynamic trust score,\n  // and policy-driven attestations. Replaces the old over-sharing `pdlss` block.\n  const verificationContext = apiResponse.verificationContext;\n\n  // Server is the single source of truth for access level. SDK reads\n  // apiResponse.access.accessLevel verbatim — no client-side trust-score remap.\n  // Fallback to 'standard' if the server response is missing the field (older\n  // backend without the v2.3.0 contract); it covers the verified-access case.\n  const accessLevel: AccessLevel = apiResponse.access?.accessLevel ?? 'standard';\n\n  const result: EnhancedVerificationResult = {\n    verified: true,\n    accessLevel,\n    agent,\n    developer,\n    organization,\n    appliedPolicy: apiResponse.access?.appliedPolicy,\n    verificationContext,\n    requiresStepUp: apiResponse.access?.requiresStepUp,\n    requiresApproval: apiResponse.access?.requiresApproval,\n    verifiedAt: new Date(),\n    cacheTtl: mergedConfig.cacheTtl,\n    // Handshake Protocol v10 enhanced fields (present when backend returns them)\n    sessionId: (apiResponse as Record<string, unknown>).sessionId as string | undefined,\n    // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId\n    // (no session row exists for unverified callers).\n    correlationId: (apiResponse as Record<string, unknown>).correlationId as string | undefined,\n    runtimeChallenge: (apiResponse as Record<string, unknown>).runtimeChallenge as\n      | RuntimeChallengeResult\n      | undefined,\n    tokenGuidance: (apiResponse as Record<string, unknown>).tokenGuidance as\n      | TokenGuidance\n      | undefined,\n    recommendation: (apiResponse as Record<string, unknown>)\n      .recommendation as EnhancedVerificationResult['recommendation'],\n    recommendationReasons: (apiResponse as Record<string, unknown>).recommendationReasons as\n      | string[]\n      | undefined,\n    warningHeader: (apiResponse as Record<string, unknown>).warningHeader as\n      | { name: string; value: string }\n      | undefined,\n  };\n\n  // Enforce AstraSync recommendation\n  if (result.recommendation === 'deny') {\n    result.verified = false;\n    result.accessLevel = 'none';\n    result.denialReasons = result.recommendationReasons || [\n      'Access denied by AstraSync recommendation',\n    ];\n    if (result.runtimeChallenge) {\n      result.guidance = {\n        message: `Verification failed: ${result.runtimeChallenge.reason || 'runtime challenge failed'}`,\n        registrationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/register`,\n        documentationUrl: `${mergedConfig.apiBaseUrl?.replace('/api', '')}/docs/runtime-challenge`,\n      };\n    }\n  } else if (result.recommendation === 'step_up_required') {\n    result.requiresStepUp = true;\n    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY['read-only']) {\n      result.accessLevel = 'read-only';\n    }\n    result.denialReasons = result.recommendationReasons || ['Step-up verification required'];\n  }\n\n  // Cache the result (skip caching denials — agent may fix challenge endpoint and retry)\n  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== 'deny') {\n    cacheResult(request.credentials, result, mergedConfig.cacheTtl);\n  }\n\n  return result;\n}\n\n/**\n * Record a counterparty's grant/deny decision for a verification session.\n * Fire-and-forget — errors are silently swallowed.\n */\n/**\n * v2.3.9 (defect #34): optional override metadata. Set when the SDK's\n * local enforcement (toolGate / methodGate / trustScore floor) rejected\n * a request the SERVER had granted. Backend emits a distinct\n * `verification.local_override` event so the activity feed surfaces the\n * divergence as a separate row.\n */\nexport interface DecisionOverride {\n  overriddenBy: 'toolGate' | 'methodGate' | 'trustScore' | 'other';\n  toolName?: string;\n  requestedLevel?: AccessLevel;\n  grantedLevel?: AccessLevel;\n}\n\nexport async function recordDecision(\n  config: GatewayConfig,\n  sessionId: string,\n  decision: 'granted' | 'denied',\n  reason?: string,\n  override?: DecisionOverride\n): Promise<void> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) {\n    headers['Authorization'] = `Bearer ${config.apiKey}`;\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {\n    method: 'POST',\n    headers,\n    body: JSON.stringify({\n      decision,\n      reason,\n      ...(override && {\n        overriddenBy: override.overriddenBy,\n        toolName: override.toolName,\n        requestedLevel: override.requestedLevel,\n        grantedLevel: override.grantedLevel,\n      }),\n    }),\n  }).catch(() => {\n    /* fire-and-forget */\n  });\n}\n\n/**\n * v2.3.10 (defect #34, round-4): record a SDK-side local override for an\n * anonymous verify-access response. Anonymous traffic has no session row, so\n * `recordDecision` (above) doesn't apply — but we still need to surface the\n * dashboard-vs-runtime divergence (e.g. server granted with audit warning\n * but local toolGate floor denied) on the activity feed.\n *\n * Backend ties the resulting `verification.local_override` event back to the\n * original `verification.unverified_audit` event via `correlationId`. The\n * endpoint is sessionless — see the docstring on the backend route for the\n * abuse-mitigation rationale (rate-limited per IP).\n *\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function recordAnonymousLocalOverride(\n  config: GatewayConfig,\n  correlationId: string,\n  override: DecisionOverride,\n  reason?: string\n): Promise<void> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) {\n    headers['Authorization'] = `Bearer ${config.apiKey}`;\n    headers['X-API-Key'] = config.apiKey;\n  }\n\n  await fetch(`${config.apiBaseUrl}/agents/verify-access/local-override`, {\n    method: 'POST',\n    headers,\n    body: JSON.stringify({\n      correlationId,\n      reason,\n      overriddenBy: override.overriddenBy,\n      toolName: override.toolName,\n      requestedLevel: override.requestedLevel,\n      grantedLevel: override.grantedLevel,\n    }),\n  }).catch(() => {\n    /* fire-and-forget */\n  });\n}\n\n/**\n * Fetch the per-route policy for an endpoint from the AstraSync backend.\n * v2.9.7 moved policy authority into the dashboard — the SDK no longer\n * accepts `routes` from merchant-side source code, it fetches them from\n * here on init (and refreshes periodically).\n *\n * Returns `null` when the request fails for any reason — the caller decides\n * how to fall back (the middleware allows-all when no policy is loaded so\n * a misconfigured init doesn't take down the merchant's API).\n */\nexport async function fetchRoutes(\n  config: GatewayConfig,\n  counterpartyId: string\n): Promise<RouteAccessConfigShape[] | null> {\n  if (!counterpartyId) return null;\n  const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n  if (config.apiKey) {\n    headers['Authorization'] = `Bearer ${config.apiKey}`;\n    headers['X-API-Key'] = config.apiKey;\n  }\n  try {\n    const response = await fetch(\n      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes`,\n      { method: 'GET', headers }\n    );\n    if (!response.ok) return null;\n    const body = (await response.json()) as { data?: { routes?: RouteAccessConfigShape[] } };\n    return body.data?.routes ?? [];\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Minimal shape of an EndpointRoute as the SDK consumes it. Mirrors the\n * server's `EndpointRoute` type and the SDK's `RouteAccessConfig` — same\n * JSON moves between server and SDK unchanged.\n */\nexport interface RouteAccessConfigShape {\n  pattern: string;\n  method: string;\n  minAccessLevel: 'none' | 'restricted' | 'read-only' | 'standard' | 'full' | 'internal';\n  minTrustScore?: number;\n  requiredPurposes?: string[];\n  allowedPurposes?: string[];\n  allowedJurisdictions?: string[];\n  maxDuration?: number;\n  maxTransactionValue?: number;\n}\n\n/**\n * Verify an agent AND automatically record the grant/deny decision.\n *\n * This is the recommended entry point for counterparties that call verify()\n * directly (e.g. MCP servers) rather than using createMiddleware().\n * It adds createSession: true, then fire-and-forgets the decision.\n */\nexport async function verifyAndRecord(\n  config: GatewayConfig,\n  request: VerificationRequest\n): Promise<VerificationResult> {\n  const mergedConfig = { ...DEFAULT_CONFIG, ...config };\n  const result = await verify(mergedConfig, { ...request, createSession: true });\n  const sessionId = (result as EnhancedVerificationResult).sessionId;\n\n  if (sessionId) {\n    if (result.verified) {\n      recordDecision(mergedConfig, sessionId, 'granted').catch(() => {});\n    } else {\n      recordDecision(mergedConfig, sessionId, 'denied', result.denialReasons?.[0]).catch(() => {});\n    }\n  }\n\n  return result;\n}\n\n/**\n * Report an unregistered agent attempt (no AstraSync credentials).\n * Called by SDK adapters when an agent is redirected to /docs/agent-access.\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function reportUnregisteredAttempt(\n  config: GatewayConfig,\n  data: {\n    counterpartyUrl: string;\n    counterpartyType?: string;\n    sourceIp?: string;\n    userAgent?: string;\n    requestPath?: string;\n    requestMethod?: string;\n  }\n): Promise<void> {\n  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl!;\n\n  await fetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(data),\n  }).catch(() => {\n    /* fire-and-forget */\n  });\n}\n\n/**\n * Report a counterparty-side PDLSS pre-check failure.\n * Called by SDK adapters when the agent's requested PDLSS exceeds\n * counterparty-defined maximums BEFORE calling verify-access.\n * Fire-and-forget — errors are silently swallowed.\n */\nexport async function reportCounterpartyPreCheckFailure(\n  config: GatewayConfig,\n  data: {\n    agentId: string;\n    counterpartyUrl: string;\n    counterpartyType?: string;\n    failures: Array<{\n      field: string;\n      requested: string | number;\n      limit: string | number | string[];\n      message: string;\n    }>;\n    requestPath?: string;\n    requestMethod?: string;\n  }\n): Promise<void> {\n  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl!;\n\n  await fetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(data),\n  }).catch(() => {\n    /* fire-and-forget */\n  });\n}\n\n/**\n * Quick verification - just check if credentials are valid\n */\nexport async function quickVerify(\n  config: GatewayConfig,\n  credentials: AgentCredentials\n): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n  const result = await verify(config, {\n    credentials,\n    purpose: 'verification',\n  });\n\n  return {\n    verified: result.verified,\n    accessLevel: result.accessLevel,\n    reason: result.denialReasons?.[0],\n  };\n}\n","/**\n * AstraSync Universal Verification Gateway - SDK Adapter\n *\n * Direct SDK for verifying agents in any JavaScript/TypeScript environment.\n * Useful for agent-to-agent verification, serverless functions, or custom integrations.\n *\n * @example\n * ```typescript\n * import { createClient } from '@astrasyncai/verification-gateway/sdk';\n *\n * const gateway = createClient({\n *   apiBaseUrl: 'https://astrasync.ai/api',\n * });\n *\n * // Verify another agent before interacting\n * const result = await gateway.verify({\n *   astraId: 'ASTRA-abc123',\n *   purpose: 'data-exchange',\n * });\n *\n * if (result.verified && result.accessLevel !== 'none') {\n *   // Safe to interact with this agent\n * }\n * ```\n */\n\nimport type {\n  SDKOptions,\n  AgentCredentials,\n  VerificationResult,\n  VerificationRequest,\n  AccessLevel,\n  GatewayConfig,\n} from '../types';\nimport { verify as coreVerify, quickVerify as coreQuickVerify, clearCache } from '../verify';\nimport { getTrustLevel, hasMinimumAccess, getCapabilities } from '../access-levels';\nimport type { AccessCapabilities } from '../access-levels';\n\n/**\n * Verification Gateway SDK Client\n */\nexport class VerificationGatewayClient {\n  private config: GatewayConfig;\n  private timeout: number;\n  private retryConfig: { maxRetries: number; backoffMs: number };\n\n  constructor(options: SDKOptions) {\n    this.config = {\n      apiBaseUrl: options.apiBaseUrl,\n      apiKey: options.apiKey,\n      defaultAccessLevel: options.defaultAccessLevel,\n      minTrustScore: options.minTrustScore,\n      minTrustScoreForFull: options.minTrustScoreForFull,\n      cacheTtl: options.cacheTtl,\n      debug: options.debug,\n      customHeaders: options.customHeaders,\n      counterpartyUrl: options.counterpartyUrl,\n      counterpartyType: options.counterpartyType,\n    };\n\n    this.timeout = options.timeout || 10000;\n    this.retryConfig = options.retry || { maxRetries: 3, backoffMs: 1000 };\n  }\n\n  /**\n   * Full verification with all details\n   */\n  async verify(options: {\n    astraId?: string;\n    apiKey?: string;\n    jwt?: string;\n    purpose?: string;\n    action?: string;\n    resourceType?: string;\n    resource?: string;\n    jurisdiction?: string;\n    transactionValue?: number;\n    currency?: string;\n    isSubAgentRequest?: boolean;\n    parentAgentId?: string;\n    subAgentDepth?: number;\n    counterpartyUrl?: string;\n    counterpartyType?: string;\n  }): Promise<VerificationResult> {\n    const credentials: AgentCredentials = {\n      astraId: options.astraId,\n      apiKey: options.apiKey,\n      jwt: options.jwt,\n    };\n\n    return this.executeWithRetry(() =>\n      coreVerify(this.config, {\n        credentials,\n        purpose: options.purpose,\n        action: options.action,\n        resourceType: options.resourceType,\n        resource: options.resource,\n        jurisdiction: options.jurisdiction,\n        transactionValue: options.transactionValue,\n        currency: options.currency,\n        isSubAgentRequest: options.isSubAgentRequest,\n        parentAgentId: options.parentAgentId,\n        subAgentDepth: options.subAgentDepth,\n        counterpartyUrl: options.counterpartyUrl,\n        counterpartyType: options.counterpartyType as VerificationRequest['counterpartyType'],\n      })\n    );\n  }\n\n  /**\n   * Quick verification - just check if credentials are valid\n   */\n  async quickVerify(credentials: {\n    astraId?: string;\n    apiKey?: string;\n    jwt?: string;\n  }): Promise<{ verified: boolean; accessLevel: AccessLevel; reason?: string }> {\n    return this.executeWithRetry(() => coreQuickVerify(this.config, credentials));\n  }\n\n  /**\n   * Check if an agent has a specific access level\n   */\n  async hasAccess(\n    credentials: { astraId?: string; apiKey?: string; jwt?: string },\n    requiredLevel: AccessLevel\n  ): Promise<boolean> {\n    const result = await this.quickVerify(credentials);\n    return hasMinimumAccess(result.accessLevel, requiredLevel);\n  }\n\n  /**\n   * Get capabilities for a verified agent\n   */\n  async getCapabilities(credentials: {\n    astraId?: string;\n    apiKey?: string;\n    jwt?: string;\n  }): Promise<AccessCapabilities> {\n    const result = await this.quickVerify(credentials);\n    return getCapabilities(result.accessLevel);\n  }\n\n  /**\n   * Verify a specific ASTRA-ID\n   */\n  async verifyAstraId(\n    astraId: string,\n    options?: {\n      purpose?: string;\n      action?: string;\n    }\n  ): Promise<VerificationResult> {\n    return this.verify({\n      astraId,\n      purpose: options?.purpose,\n      action: options?.action,\n    });\n  }\n\n  /**\n   * Verify using an API key\n   */\n  async verifyApiKey(\n    apiKey: string,\n    options?: {\n      purpose?: string;\n      action?: string;\n    }\n  ): Promise<VerificationResult> {\n    return this.verify({\n      apiKey,\n      purpose: options?.purpose,\n      action: options?.action,\n    });\n  }\n\n  /**\n   * Clear the verification cache\n   */\n  clearCache(): void {\n    clearCache();\n  }\n\n  /**\n   * Execute a function with retry logic\n   */\n  private async executeWithRetry<T>(fn: () => Promise<T>): Promise<T> {\n    let lastError: Error | null = null;\n\n    for (let attempt = 0; attempt <= this.retryConfig.maxRetries; attempt++) {\n      try {\n        // Add timeout\n        const result = await Promise.race([\n          fn(),\n          new Promise<never>((_, reject) =>\n            setTimeout(() => reject(new Error('Request timeout')), this.timeout)\n          ),\n        ]);\n\n        return result;\n      } catch (error) {\n        lastError = error instanceof Error ? error : new Error(String(error));\n\n        // Don't retry on last attempt\n        if (attempt < this.retryConfig.maxRetries) {\n          // Exponential backoff\n          const backoff = this.retryConfig.backoffMs * Math.pow(2, attempt);\n          await new Promise((resolve) => setTimeout(resolve, backoff));\n        }\n      }\n    }\n\n    throw lastError || new Error('Verification failed after retries');\n  }\n}\n\n/**\n * Create a new SDK client\n */\nexport function createClient(options: SDKOptions): VerificationGatewayClient {\n  return new VerificationGatewayClient(options);\n}\n\n/**\n * One-shot verification without creating a client\n */\nexport async function verifyOnce(\n  options: SDKOptions & {\n    astraId?: string;\n    apiKey?: string;\n    jwt?: string;\n    purpose?: string;\n    action?: string;\n  }\n): Promise<VerificationResult> {\n  const client = createClient(options);\n  return client.verify(options);\n}\n\n// Re-export utilities for convenience\nexport { getTrustLevel, hasMinimumAccess, getCapabilities };\n"],"mappings":";AAeO,IAAM,yBAAsD;AAAA,EACjE,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AACZ;AAuCO,SAAS,cAAc,OAA2B;AACvD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAKO,SAAS,iBAAiB,QAAqB,UAAgC;AACpF,SAAO,uBAAuB,MAAM,KAAK,uBAAuB,QAAQ;AAC1E;AA2DO,SAAS,gBAAgB,aAA8C;AAC5E,UAAQ,aAAa;AAAA,IACnB,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,IACF;AACE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,UAAU;AAAA,QACV,mBAAmB;AAAA,MACrB;AAAA,EACJ;AACF;;;AChKA,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKZ,oBAAoB;AAAA;AAAA,EAEpB,UAAU;AAAA;AAAA,EACV,OAAO;AACT;AAOA,IAAI,qBAAqB;AAGzB,IAAI,0BAA0B;AAE9B,eAAe,iBAAiB,YAAoB,OAAgC;AAClF,uBAAqB;AACrB,MAAI;AACF,UAAM,WAAW,GAAG,UAAU;AAK9B,UAAM,WAAW,MAAM,MAAM,UAAU,EAAE,QAAQ,OAAO,CAAC;AACzD,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,QAAI,YAAY,WAAW,WAAW,GAAG;AACvC,cAAQ;AAAA,QACN,qCAAqC,UAAU,kCAAkC,WAAW;AAAA,MAI9F;AAAA,IACF,WAAW,OAAO;AAChB,cAAQ;AAAA,QACN,+CAA+C,UAAU,mBAAmB,WAAW;AAAA,MACzF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,OAAO;AACT,cAAQ,IAAI,2DAA2D,OAAO,GAAG,CAAC,EAAE;AAAA,IACtF;AAAA,EACF;AACF;AAKA,IAAM,oBAAoB,oBAAI,IAA+D;AAK7F,SAAS,YAAY,aAAuC;AAC1D,SAAO,GAAG,YAAY,WAAW,EAAE,IAAI,YAAY,UAAU,EAAE,IAAI,YAAY,OAAO,EAAE;AAC1F;AAKA,SAAS,gBAAgB,aAA0D;AACjF,QAAM,MAAM,YAAY,WAAW;AACnC,QAAM,SAAS,kBAAkB,IAAI,GAAG;AAExC,MAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,QAAQ;AACV,sBAAkB,OAAO,GAAG;AAAA,EAC9B;AAEA,SAAO;AACT;AAKA,SAAS,YACP,aACA,QACA,YACM;AACN,QAAM,MAAM,YAAY,WAAW;AACnC,oBAAkB,IAAI,KAAK;AAAA,IACzB;AAAA,IACA,WAAW,KAAK,IAAI,IAAI,aAAa;AAAA,EACvC,CAAC;AACH;AAKO,SAAS,aAAmB;AACjC,oBAAkB,MAAM;AAC1B;AAiFA,SAAS,uBACP,QACA,QACA,UAA+D,CAAC,GAC5C;AACpB,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,WAAW;AAE9B,QAAM,WAAyB,aAC3B;AAAA,IACE,SACE;AAAA,IACF,iBAAiB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IACzD,kBAAkB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF,IACA;AAAA,IACE,SACE;AAAA,IACF,iBAAiB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IACzD,kBAAkB,GAAG,OAAO,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEJ,SAAO;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMV,aAAa;AAAA,IACb;AAAA,IACA,eAAe,SAAS,CAAC,MAAM,IAAI,CAAC,qCAAqC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKzE,UAAU,aACN;AAAA,MACE;AAAA,QACE,WAAW;AAAA,QACX,SAAS,UAAU;AAAA,QACnB,UAAU,SAAS;AAAA,MACrB;AAAA,IACF,IACA;AAAA,IACJ,eAAe,QAAQ;AAAA,IACvB,YAAY,oBAAI,KAAK;AAAA,EACvB;AACF;AAKA,eAAe,oBACb,QACA,SAqFC;AACD,QAAM,EAAE,aAAa,GAAG,YAAY,IAAI;AAIxC,QAAM,OAAgC;AAAA,IACpC,GAAI,YAAY,WAAW,EAAE,SAAS,YAAY,QAAQ;AAAA,IAC1D,SAAS,YAAY,WAAW;AAAA,EAClC;AAGA,MAAI,YAAY,OAAQ,MAAK,SAAS,YAAY;AAClD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,aAAc,MAAK,eAAe,YAAY;AAC9D,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,SAAU,MAAK,WAAW,YAAY;AACtD,MAAI,YAAY,kBAAmB,MAAK,oBAAoB,YAAY;AACxE,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,kBAAkB,OAAW,MAAK,gBAAgB,YAAY;AAE9E,MAAI,YAAY;AACd,SAAK,yBAAyB,YAAY;AAC5C,MAAI,YAAY,cAAe,MAAK,gBAAgB,YAAY;AAChE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,iBAAkB,MAAK,mBAAmB,YAAY;AACtE,MAAI,YAAY,gBAAiB,MAAK,kBAAkB,YAAY;AACpE,MAAI,OAAO,eAAgB,MAAK,iBAAiB,OAAO;AACxD,MAAI,YAAY;AACd,SAAK,0BAA0B,YAAY;AAI7C,MAAI,YAAY,kBAAkB,YAAY,YAAY,YAAY,WAAW;AAC/E,UAAM,OAAO;AAAA,MACX,GAAI,YAAY,YAAY,EAAE,UAAU,YAAY,SAAS;AAAA,MAC7D,GAAI,YAAY,aAAa,EAAE,WAAW,YAAY,UAAU;AAAA,MAChE,GAAG,YAAY;AAAA,IACjB;AACA,QAAI,OAAO,KAAK,IAAI,EAAE,SAAS,EAAG,MAAK,iBAAiB;AAAA,EAC1D;AAGA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAG,OAAO;AAAA,EACZ;AAKA,MAAI,YAAY,qBAAqB;AACnC,YAAQ,eAAe,IAAI,YAAY;AAAA,EACzC,WAAW,OAAO,QAAQ;AACxB,YAAQ,eAAe,IAAI,UAAU,OAAO,MAAM;AAAA,EACpD;AAEA,MAAI,OAAO,QAAQ;AACjB,YAAQ,WAAW,IAAI,OAAO;AAAA,EAChC;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAG,OAAO,UAAU,yBAAyB;AAAA,MACxE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAMjC,QAAI,SAAS,WAAW,KAAK;AAC3B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,UACN,SAAS;AAAA,UACT,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,UAAU;AAAA,YACR;AAAA,cACE,WAAW;AAAA,cACX,SACE,OAAO,MAAM,YAAY,WAAW,KAAK,UAAU;AAAA,cACrD,UACE,OAAO,MAAM,aAAa,WACtB,KAAK,WACL;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAIhB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,WAAW,KAAK,SAAS,gBAAgB,SAAS,MAAM;AAAA,QACpE,eAAe,OAAO,MAAM,kBAAkB,WAAW,KAAK,gBAAgB;AAAA,MAChF;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,qCAAqC,OAAO;AAAA,IACrD;AAAA,EACF;AACF;AAKA,eAAsB,OACpB,QACA,SAC6B;AAC7B,QAAM,eAAe,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAGpD,MAAI,CAAC,sBAAsB,CAAC,aAAa,qBAAqB,aAAa,YAAY;AACrF,SAAK,iBAAiB,aAAa,YAAY,aAAa,KAAK;AAAA,EACnE;AAGA,MACE,CAAC,4BACA,OAAO,kBAAkB,UAAa,OAAO,yBAAyB,SACvE;AACA,8BAA0B;AAC1B,YAAQ;AAAA,MACN;AAAA,IAIF;AAAA,EACF;AAQA,MAAI,aAAa,YAAY,aAAa,WAAW,GAAG;AACtD,UAAM,SAAS,gBAAgB,QAAQ,WAAW;AAClD,QAAI,QAAQ;AACV,UAAI,aAAa,OAAO;AACtB,gBAAQ,IAAI,+CAA+C;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAI,CAAC,gBAAgB,mBAAmB,aAAa,iBAAiB;AACpE,oBAAgB,kBAAkB,aAAa;AAAA,EACjD;AACA,MAAI,CAAC,gBAAgB,oBAAoB,aAAa,kBAAkB;AACtE,oBAAgB,mBAAmB,aAAa;AAAA,EAClD;AAGA,MAAI,aAAa,OAAO;AACtB,YAAQ,IAAI,iDAAiD;AAAA,EAC/D;AAEA,QAAM,cAAc,MAAM,oBAAoB,cAAc,eAAe;AAG3E,MAAI,CAAC,YAAY,SAAS;AAMxB,WAAO,uBAAuB,cAAc,YAAY,OAAO;AAAA,MAC7D,QAAQ;AAAA,MACR,eAAgB,YAA2C;AAAA,IAC7D,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,YAAY,QAAQ,SAAS;AAIhC,UAAM,qBAAsB,YAAY,QACpC;AACJ,UAAMA,UAAqC;AAAA,MACzC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQV,aAAa;AAAA,MACb,eACE,sBAAsB,mBAAmB,SAAS,IAC9C,mBAAmB,IAAI,CAAC,MAAM,EAAE,OAAO,IACvC,YAAY,QAAQ,SAClB,CAAC,YAAY,OAAO,MAAM,IAC1B,CAAC,eAAe;AAAA,MACxB,UAAU;AAAA,MACV,gBAAgB,YAAY,QAAQ;AAAA,MACpC,kBAAkB,YAAY,QAAQ;AAAA,MACtC,UAAU;AAAA,QACR,SAAS,YAAY,QAAQ,UAAU;AAAA,QACvC,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA;AAAA,MAErB,WAAY,YAAwC;AAAA;AAAA;AAAA,MAGpD,eAAgB,YAAwC;AAAA,MACxD,gBAAiB,YACd;AAAA,MACH,uBAAwB,YAAwC;AAAA,IAGlE;AAEA,WAAOA;AAAA,EACT;AAGA,QAAM,QAAmC,YAAY,QACjD;AAAA,IACE,SAAS,YAAY,MAAM;AAAA,IAC3B,MAAM,YAAY,MAAM;AAAA,IACxB,YAAY,YAAY,MAAM;AAAA,IAC9B,YAAY,cAAc,YAAY,MAAM,UAAU;AAAA,IACtD,oBAAoB,YAAY,MAAM,qBAAqB;AAAA,IAC3D,QAAQ,YAAY,MAAM;AAAA,EAC5B,IACA;AAEJ,QAAM,YAA2C,YAAY,YACzD;AAAA,IACE,UAAU,YAAY,UAAU;AAAA,IAChC,MAAM,YAAY,UAAU;AAAA,IAC5B,YAAY,YAAY,UAAU,cAAc;AAAA,IAChD,UAAU,YAAY,UAAU;AAAA,EAClC,IACA;AAEJ,QAAM,eAAiD,YAAY,eAC/D;AAAA,IACE,MAAM,YAAY,aAAa;AAAA,IAC/B,UAAU,YAAY,aAAa;AAAA,IACnC,YAAY,YAAY,aAAa;AAAA,EACvC,IACA;AAKJ,QAAM,sBAAsB,YAAY;AAMxC,QAAM,cAA2B,YAAY,QAAQ,eAAe;AAEpE,QAAM,SAAqC;AAAA,IACzC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe,YAAY,QAAQ;AAAA,IACnC;AAAA,IACA,gBAAgB,YAAY,QAAQ;AAAA,IACpC,kBAAkB,YAAY,QAAQ;AAAA,IACtC,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,aAAa;AAAA;AAAA,IAEvB,WAAY,YAAwC;AAAA;AAAA;AAAA,IAGpD,eAAgB,YAAwC;AAAA,IACxD,kBAAmB,YAAwC;AAAA,IAG3D,eAAgB,YAAwC;AAAA,IAGxD,gBAAiB,YACd;AAAA,IACH,uBAAwB,YAAwC;AAAA,IAGhE,eAAgB,YAAwC;AAAA,EAG1D;AAGA,MAAI,OAAO,mBAAmB,QAAQ;AACpC,WAAO,WAAW;AAClB,WAAO,cAAc;AACrB,WAAO,gBAAgB,OAAO,yBAAyB;AAAA,MACrD;AAAA,IACF;AACA,QAAI,OAAO,kBAAkB;AAC3B,aAAO,WAAW;AAAA,QAChB,SAAS,wBAAwB,OAAO,iBAAiB,UAAU,0BAA0B;AAAA,QAC7F,iBAAiB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAChE,kBAAkB,GAAG,aAAa,YAAY,QAAQ,QAAQ,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF,WAAW,OAAO,mBAAmB,oBAAoB;AACvD,WAAO,iBAAiB;AACxB,QAAI,uBAAuB,OAAO,WAAW,IAAI,uBAAuB,WAAW,GAAG;AACpF,aAAO,cAAc;AAAA,IACvB;AACA,WAAO,gBAAgB,OAAO,yBAAyB,CAAC,+BAA+B;AAAA,EACzF;AAGA,MAAI,aAAa,YAAY,aAAa,WAAW,KAAK,OAAO,mBAAmB,QAAQ;AAC1F,gBAAY,QAAQ,aAAa,QAAQ,aAAa,QAAQ;AAAA,EAChE;AAEA,SAAO;AACT;AAwOA,eAAsB,YACpB,QACA,aAC2E;AAC3E,QAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,IAClC;AAAA,IACA,SAAS;AAAA,EACX,CAAC;AAED,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,aAAa,OAAO;AAAA,IACpB,QAAQ,OAAO,gBAAgB,CAAC;AAAA,EAClC;AACF;;;AC14BO,IAAM,4BAAN,MAAgC;AAAA,EAKrC,YAAY,SAAqB;AAC/B,SAAK,SAAS;AAAA,MACZ,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,MAChB,oBAAoB,QAAQ;AAAA,MAC5B,eAAe,QAAQ;AAAA,MACvB,sBAAsB,QAAQ;AAAA,MAC9B,UAAU,QAAQ;AAAA,MAClB,OAAO,QAAQ;AAAA,MACf,eAAe,QAAQ;AAAA,MACvB,iBAAiB,QAAQ;AAAA,MACzB,kBAAkB,QAAQ;AAAA,IAC5B;AAEA,SAAK,UAAU,QAAQ,WAAW;AAClC,SAAK,cAAc,QAAQ,SAAS,EAAE,YAAY,GAAG,WAAW,IAAK;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAgBmB;AAC9B,UAAM,cAAgC;AAAA,MACpC,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,KAAK,QAAQ;AAAA,IACf;AAEA,WAAO,KAAK;AAAA,MAAiB,MAC3B,OAAW,KAAK,QAAQ;AAAA,QACtB;AAAA,QACA,SAAS,QAAQ;AAAA,QACjB,QAAQ,QAAQ;AAAA,QAChB,cAAc,QAAQ;AAAA,QACtB,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,QACtB,kBAAkB,QAAQ;AAAA,QAC1B,UAAU,QAAQ;AAAA,QAClB,mBAAmB,QAAQ;AAAA,QAC3B,eAAe,QAAQ;AAAA,QACvB,eAAe,QAAQ;AAAA,QACvB,iBAAiB,QAAQ;AAAA,QACzB,kBAAkB,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAI4D;AAC5E,WAAO,KAAK,iBAAiB,MAAM,YAAgB,KAAK,QAAQ,WAAW,CAAC;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UACJ,aACA,eACkB;AAClB,UAAM,SAAS,MAAM,KAAK,YAAY,WAAW;AACjD,WAAO,iBAAiB,OAAO,aAAa,aAAa;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,aAIU;AAC9B,UAAM,SAAS,MAAM,KAAK,YAAY,WAAW;AACjD,WAAO,gBAAgB,OAAO,WAAW;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACJ,SACA,SAI6B;AAC7B,WAAO,KAAK,OAAO;AAAA,MACjB;AAAA,MACA,SAAS,SAAS;AAAA,MAClB,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aACJ,QACA,SAI6B;AAC7B,WAAO,KAAK,OAAO;AAAA,MACjB;AAAA,MACA,SAAS,SAAS;AAAA,MAClB,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,aAAmB;AACjB,eAAW;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAoB,IAAkC;AAClE,QAAI,YAA0B;AAE9B,aAAS,UAAU,GAAG,WAAW,KAAK,YAAY,YAAY,WAAW;AACvE,UAAI;AAEF,cAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,UAChC,GAAG;AAAA,UACH,IAAI;AAAA,YAAe,CAAC,GAAG,WACrB,WAAW,MAAM,OAAO,IAAI,MAAM,iBAAiB,CAAC,GAAG,KAAK,OAAO;AAAA,UACrE;AAAA,QACF,CAAC;AAED,eAAO;AAAA,MACT,SAAS,OAAO;AACd,oBAAY,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAGpE,YAAI,UAAU,KAAK,YAAY,YAAY;AAEzC,gBAAM,UAAU,KAAK,YAAY,YAAY,KAAK,IAAI,GAAG,OAAO;AAChE,gBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,MAAM,mCAAmC;AAAA,EAClE;AACF;AAKO,SAAS,aAAa,SAAgD;AAC3E,SAAO,IAAI,0BAA0B,OAAO;AAC9C;AAKA,eAAsB,WACpB,SAO6B;AAC7B,QAAM,SAAS,aAAa,OAAO;AACnC,SAAO,OAAO,OAAO,OAAO;AAC9B;","names":["result"]}

package/dist/agent/index.d.mts

@@ -1,2 +1,2 @@
-export { A as AgentClient, a as AstraSyncSdkError, C as ChallengeHandler, O as OwnershipMismatchError, P as PDLSSConfig, T as TransportPDLSS, f as formatPDLSSForTransport, p as parsePDLSSFromTransport, r as recordDecision } from '../index-DiToN8gh.mjs';
-import '../types-BVp22KkN.mjs';
+export { A as AgentClient, a as AstraSyncSdkError, C as ChallengeHandler, O as OwnershipMismatchError, P as PDLSSConfig, T as TransportPDLSS, f as formatPDLSSForTransport, p as parsePDLSSFromTransport, r as recordDecision } from '../index-DAGm-Sgf.mjs';
+import '../types-DLai3jly.mjs';

package/dist/agent/index.d.ts

@@ -1,2 +1,2 @@
-export { A as AgentClient, a as AstraSyncSdkError, C as ChallengeHandler, O as OwnershipMismatchError, P as PDLSSConfig, T as TransportPDLSS, f as formatPDLSSForTransport, p as parsePDLSSFromTransport, r as recordDecision } from '../index-B-EovXnY.js';
-import '../types-BVp22KkN.js';
+export { A as AgentClient, a as AstraSyncSdkError, C as ChallengeHandler, O as OwnershipMismatchError, P as PDLSSConfig, T as TransportPDLSS, f as formatPDLSSForTransport, p as parsePDLSSFromTransport, r as recordDecision } from '../index-Dd4alF0l.js';
+import '../types-DLai3jly.js';

package/dist/bin/astrasync.js

@@ -52,15 +52,59 @@ var AuthenticationError = class extends AstraSyncError {
     this.name = "AuthenticationError";
   }
 };
+var RegistrationDeniedError = class extends AstraSyncError {
+  constructor(requestId, reason) {
+    super(
+      `Registration request ${requestId} was denied by the account owner.${reason ? ` Reason: ${reason}` : ""}`,
+      403,
+      "REGISTRATION_DENIED"
+    );
+    this.name = "RegistrationDeniedError";
+    this.requestId = requestId;
+    this.reason = reason;
+  }
+};
+var RegistrationExpiredError = class extends AstraSyncError {
+  constructor(requestId) {
+    super(
+      `Registration request ${requestId} expired before the owner approved it. Submit a new registration request.`,
+      410,
+      "REGISTRATION_EXPIRED"
+    );
+    this.name = "RegistrationExpiredError";
+    this.requestId = requestId;
+  }
+};
+var RegistrationTimeoutError = class extends AstraSyncError {
+  constructor(requestId) {
+    super(
+      `Timed out waiting for owner approval of registration request ${requestId}. The request is still active server-side; poll the request to resume waiting.`,
+      408,
+      "REGISTRATION_TIMEOUT"
+    );
+    this.name = "RegistrationTimeoutError";
+    this.requestId = requestId;
+  }
+};
 
 // src/registration/api.ts
 var DEFAULT_BASE_URL = "https://astrasync.ai";
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 var AstraSync = class {
   constructor(config = {}) {
-    this.baseUrl = (config.baseUrl || process.env.ASTRASYNC_API_URL || DEFAULT_BASE_URL).replace(
+    let raw = (config.baseUrl || process.env.ASTRASYNC_API_URL || DEFAULT_BASE_URL).replace(
       /\/+$/,
       ""
     );
+    if (raw.toLowerCase().endsWith("/api")) {
+      raw = raw.slice(0, -"/api".length);
+      if (config.baseUrl && !config.silent) {
+        console.warn(
+          `[AstraSync] baseUrl '${config.baseUrl}' had a trailing /api \u2014 stripped to '${raw}'. Pass the bare origin (e.g. 'https://astrasync.ai' or 'https://staging.astrasync.ai') to AstraSync(). The /api suffix is the verify-gateway (GatewayConfig.apiBaseUrl) convention.`
+        );
+      }
+    }
+    this.baseUrl = raw;
     this.apiKey = config.apiKey || process.env.ASTRASYNC_API_KEY;
     this.email = config.email;
     this.password = config.password;
@@ -76,7 +120,36 @@ var AstraSync = class {
   }
   /**
    * Register a new AI agent on the AstraSync KYA Platform.
-   * Sends full payload including model, framework, PDLSS, and metadata.
+   *
+   * The backend response depends on auth context:
+   * - **Crypto-keypair signed** (`privateKey` configured): synchronous 201,
+   *   returns `{ status: 'active', agent }`.
+   * - **API-key only** (no signature): 202 pending, returns
+   *   `{ status: 'pending_approval', requestId, pollUrl, expiresAt }`. The
+   *   owner is notified by email and a dashboard alert is emitted; the agent
+   *   becomes active only after the owner approves.
+   *
+   * Blocking mode: pass `{ waitForApproval: true }` to have the SDK poll the
+   * request until it resolves, then return the live agent record. The promise
+   * rejects with `RegistrationDeniedError`, `RegistrationExpiredError`, or
+   * `RegistrationTimeoutError` on the corresponding terminal states.
+   *
+   * @example Non-blocking (default — best for serverless / scheduled agents):
+   * ```typescript
+   * const result = await sdk.register({ name, pdlss });
+   * if (result.status === 'pending_approval') {
+   *   storeRequestId(result.requestId);
+   *   return; // function exits; resume later via pollRegistration()
+   * }
+   * ```
+   *
+   * @example Blocking (best for long-running services + CLI):
+   * ```typescript
+   * const agent = await sdk.register({
+   *   name, pdlss, waitForApproval: true, timeoutMs: 600_000,
+   *   onPending: ({ ageMs }) => console.log(`waiting ${ageMs}ms`),
+   * });
+   * ```
    */
   async register(options) {
     const body = {
@@ -90,7 +163,84 @@ var AstraSync = class {
       ...options.metadata && { metadata: options.metadata },
       ...options.pdlss && { pdlss: options.pdlss }
     };
-    return this.request("POST", "/api/agents/register", body);
+    const { status, body: raw } = await this.requestWithStatus("POST", "/api/agents/register", body);
+    if (status === 201) {
+      const active = {
+        status: "active",
+        agent: raw.data.agent
+      };
+      return active;
+    }
+    const pendingBody = raw;
+    const pending = {
+      status: "pending_approval",
+      requestId: pendingBody.requestId,
+      expiresAt: pendingBody.expiresAt,
+      pollUrl: pendingBody.pollUrl,
+      message: pendingBody.message
+    };
+    if (!options.waitForApproval) return pending;
+    return this.waitForApproval(pendingBody.requestId, options);
+  }
+  /**
+   * Poll the current state of a pending-approval registration request.
+   *
+   * Useful for caller-driven polling when `waitForApproval: false` (the
+   * default). The endpoint is unauthenticated — pass the `requestId` that
+   * was returned from the 202 response.
+   *
+   * @returns `state: 'pending'` while awaiting; `'approved'` carries the
+   *          minted agent in `agent`; `'denied'` may carry the owner's
+   *          `reason`; `'expired'` is terminal after 14 days.
+   */
+  async pollRegistration(requestId) {
+    const url = `${this.baseUrl}/api/agents/request-registration/${requestId}`;
+    const res = await fetch(url, { headers: { Accept: "application/json" } });
+    if (!res.ok) {
+      const errBody = await res.json().catch(() => ({}));
+      throw new AstraSyncError(
+        errBody.error || `pollRegistration failed: ${res.status}`,
+        res.status,
+        errBody.code
+      );
+    }
+    return await res.json();
+  }
+  /**
+   * Block until a pending registration request resolves to a terminal state.
+   * Resolves to the live `AgentRecord` on approval; rejects with the matching
+   * Registration*Error on deny/expire/timeout. Usually called via
+   * `register({ waitForApproval: true })`, but exposed for callers that want
+   * to fire-and-forget the initial register call and resume waiting later
+   * (e.g. after restoring a stored `requestId` on cold start).
+   */
+  async waitForApproval(requestId, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 10 * 60 * 1e3;
+    const pollIntervalMs = options.pollIntervalMs ?? 5e3;
+    const start = Date.now();
+    const deadline = start + timeoutMs;
+    while (Date.now() < deadline) {
+      const result = await this.pollRegistration(requestId);
+      const ageMs = Date.now() - start;
+      options.onPending?.({ requestId, ageMs });
+      if (result.state === "approved") {
+        if (!result.agent) {
+          throw new AstraSyncError(
+            `Registration ${requestId} reported approved but no agent payload returned.`,
+            500
+          );
+        }
+        return result.agent;
+      }
+      if (result.state === "denied") {
+        throw new RegistrationDeniedError(requestId, result.reason);
+      }
+      if (result.state === "expired") {
+        throw new RegistrationExpiredError(requestId);
+      }
+      await sleep(pollIntervalMs);
+    }
+    throw new RegistrationTimeoutError(requestId);
   }
   /**
    * Look up an agent's public profile by ASTRA ID or UUID.
@@ -110,6 +260,15 @@ var AstraSync = class {
   }
   // ── Private helpers ──────────────────────────────────────────────
   async request(method, endpoint, body) {
+    const { body: parsed } = await this.requestWithStatus(method, endpoint, body);
+    return parsed;
+  }
+  /**
+   * Variant of {@link request} that also returns the HTTP status code, so
+   * callers can branch on 201 vs 202 (or other success codes) without losing
+   * type information about the response body.
+   */
+  async requestWithStatus(method, endpoint, body) {
     const url = `${this.baseUrl}${endpoint}`;
     const headers = {
       "Content-Type": "application/json"
@@ -136,7 +295,7 @@ var AstraSync = class {
         errorBody.code
       );
     }
-    return res.json();
+    return { status: res.status, body: await res.json() };
   }
   async getAuthToken() {
     if (this.apiKey) {

package/dist/browser/background.js

@@ -3352,8 +3352,18 @@ function cacheResult(credentials, result, ttlSeconds) {
     expiresAt: Date.now() + ttlSeconds * 1e3
   });
 }
-function createGuidanceResponse(config, reason) {
-  const guidance = {
+function createGuidanceResponse(config, reason, options = {}) {
+  const source = options.source ?? "no_credentials";
+  const isApiError = source === "api_error";
+  const guidance = isApiError ? {
+    message: "Verification is temporarily unavailable. Retry with exponential backoff; if the issue persists, contact support with the correlationId.",
+    registrationUrl: `${config.apiBaseUrl.replace("/api", "")}/register`,
+    documentationUrl: `${config.apiBaseUrl.replace("/api", "")}/docs/agent-access`,
+    steps: [
+      "Retry the request with exponential backoff",
+      "If failures persist, share the correlationId with support"
+    ]
+  } : {
     message: "This service verifies AI agents before granting access. Please register your agent with AstraSync.",
     registrationUrl: `${config.apiBaseUrl.replace("/api", "")}/register`,
     documentationUrl: `${config.apiBaseUrl.replace("/api", "")}/docs/agent-access`,
@@ -3374,6 +3384,18 @@ function createGuidanceResponse(config, reason) {
     accessLevel: "none",
     guidance,
     denialReasons: reason ? [reason] : ["No valid agent credentials provided"],
+    // Round-10 (#47, O5): on API-error fallback, surface a typed failure so
+    // partners (and their custom onDenied handlers) can branch on
+    // dimension. Without this, the synthesised stub was indistinguishable
+    // from a real policy deny.
+    failures: isApiError ? [
+      {
+        dimension: "verify_access.api_error",
+        message: reason ?? "Verification temporarily unavailable",
+        guidance: guidance.message
+      }
+    ] : void 0,
+    correlationId: options.correlationId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
@@ -3448,7 +3470,8 @@ async function callVerifyAccessAPI(config, request) {
     if (!response.ok) {
       return {
         success: false,
-        error: data.message || data.error || `API returned ${response.status}`
+        error: data.message || data.error || `API returned ${response.status}`,
+        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0
       };
     }
     return data;
@@ -3492,7 +3515,10 @@ async function verify(config, request) {
   }
   const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);
   if (!apiResponse.success) {
-    return createGuidanceResponse(mergedConfig, apiResponse.error);
+    return createGuidanceResponse(mergedConfig, apiResponse.error, {
+      source: "api_error",
+      correlationId: apiResponse.correlationId
+    });
   }
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;