@astrasyncai/verification-gateway 2.4.2 → 2.4.4

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-C_e1IZdU.mjs';
-import '../types-DLai3jly.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-y13mmzbA.mjs';
+import '../types-CVT-sorC.mjs';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-IUzu-A4u.js';
-import '../types-DLai3jly.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-CLP_TDu5.js';
+import '../types-CVT-sorC.js';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/{index-NZiKvrtE.d.ts → index-6Jus6yWU.d.ts}

@@ -1,4 +1,4 @@
-import { A as AstraSyncCredentials, g as ProtocolTransport } from './types-DLai3jly.js';
+import { A as AstraSyncCredentials, g as ProtocolTransport } from './types-CVT-sorC.js';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-DAGm-Sgf.d.mts → index-BZZTOfrI.d.mts}

@@ -1,4 +1,4 @@
-import { A as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-DLai3jly.mjs';
+import { A as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-CVT-sorC.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-Dd4alF0l.d.ts → index-BgKghi19.d.ts}

@@ -1,4 +1,4 @@
-import { A as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-DLai3jly.js';
+import { A as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-CVT-sorC.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-C9yWlQ2Y.d.mts → index-D698fDOk.d.mts}

@@ -1,4 +1,4 @@
-import { A as AstraSyncCredentials, g as ProtocolTransport } from './types-DLai3jly.mjs';
+import { A as AstraSyncCredentials, g as ProtocolTransport } from './types-CVT-sorC.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/index.d.mts

@@ -1,10 +1,10 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, c as VerificationRequest, V as VerificationResult } from './types-DLai3jly.mjs';
-export { A as AstraSyncCredentials, d as CommerceShieldProps, C as CounterpartyType, e as EnhancedVerificationResult, E as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, i as TrustLevel, j as VerifiedAgent, k as VerifiedDeveloper, l as VerifiedOrganization } from './types-DLai3jly.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, c as getCapabilities, e as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Cixo6pTV.mjs';
-export { e as express } from './express-DneHiMhu.mjs';
-export { n as nextjs } from './nextjs-vUuVCaBP.mjs';
-export { i as transport } from './index-C9yWlQ2Y.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DAGm-Sgf.mjs';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, c as VerificationRequest, V as VerificationResult } from './types-CVT-sorC.mjs';
+export { A as AstraSyncCredentials, d as CommerceShieldProps, C as CounterpartyType, e as EnhancedVerificationResult, E as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, i as TrustLevel, j as VerifiedAgent, k as VerifiedDeveloper, l as VerifiedOrganization } from './types-CVT-sorC.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, c as getCapabilities, e as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-BFwzjYjl.mjs';
+export { e as express } from './express-Ck2RHZLT.mjs';
+export { n as nextjs } from './nextjs-93PHcE-i.mjs';
+export { i as transport } from './index-D698fDOk.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BZZTOfrI.mjs';
 import 'express';
 import 'next/server';
 import 'jose';

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, c as VerificationRequest, V as VerificationResult } from './types-DLai3jly.js';
-export { A as AstraSyncCredentials, d as CommerceShieldProps, C as CounterpartyType, e as EnhancedVerificationResult, E as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, i as TrustLevel, j as VerifiedAgent, k as VerifiedDeveloper, l as VerifiedOrganization } from './types-DLai3jly.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, c as getCapabilities, e as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-BvWp4q2q.js';
-export { e as express } from './express-DsiaQRFt.js';
-export { n as nextjs } from './nextjs-B4WmoiVm.js';
-export { i as transport } from './index-NZiKvrtE.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-Dd4alF0l.js';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, c as VerificationRequest, V as VerificationResult } from './types-CVT-sorC.js';
+export { A as AstraSyncCredentials, d as CommerceShieldProps, C as CounterpartyType, e as EnhancedVerificationResult, E as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, i as TrustLevel, j as VerifiedAgent, k as VerifiedDeveloper, l as VerifiedOrganization } from './types-CVT-sorC.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, c as getCapabilities, e as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Chq02d82.js';
+export { e as express } from './express-DZmEzCgo.js';
+export { n as nextjs } from './nextjs-t_ix2zQZ.js';
+export { i as transport } from './index-6Jus6yWU.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BgKghi19.js';
 import 'express';
 import 'next/server';
 import 'jose';

package/dist/index.js

@@ -340,6 +340,7 @@ async function callVerifyAccessAPI(config, request) {
   if (config.counterpartyId) body.counterpartyId = config.counterpartyId;
   if (requestData.runtimeChallengeOptions)
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
+  if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
       ...requestData.clientIp && { sourceIp: requestData.clientIp },
@@ -850,14 +851,15 @@ function createMiddleware(options) {
         }
         return next();
       }
-      if (routeConfig.minAccessLevel === "none") {
+      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
+      const shouldEnforce = routeConfig.minAccessLevel !== "none";
+      if (routeConfig.minAccessLevel === "none" && (!config.evaluateAlwaysIfCredentialed || !credentials.astraId)) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "unenforced");
           res.setHeader("X-Astra-Gateway-Reason", "route-none");
         }
         return next();
       }
-      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
       const purpose = customExtractPurpose ? customExtractPurpose(req) : defaultExtractPurpose(req);
       const astraCreds = extractAstraSyncCredentials(req);
       const counterpartyUrl = config.counterpartyUrl || `${req.protocol}://${req.get("host")}`;
@@ -921,9 +923,27 @@ function createMiddleware(options) {
         onDenied(result, req, res);
         return;
       }
+      if (!shouldEnforce) {
+        if (config.setPassThroughHeader) {
+          res.setHeader("X-Astra-Gateway-Mode", "enforced");
+          res.setHeader("X-Astra-Gateway-Reason", "evaluated-not-enforced");
+        }
+        if (shouldRecordDecisions && sessionId) {
+          recordDecision(config, sessionId, "granted").catch(() => {
+          });
+        }
+        return next();
+      }
       if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {
+        const insufficientFailure = {
+          dimension: "access_level.insufficient",
+          message: `Endpoint requires accessLevel '${routeConfig.minAccessLevel}'; agent has '${result.accessLevel}'.`,
+          guidance: "Request elevated access via step-up verification (coming soon \u2014 ships this month). Step-up lets the agent owner approve a one-time elevation for this specific counterparty + purpose without changing the agent's baseline trust score."
+        };
+        result.failures = [...result.failures ?? [], insufficientFailure];
+        result.denialReasons = [...result.denialReasons ?? [], insufficientFailure.message];
         if (shouldRecordDecisions && sessionId) {
-          recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
+          recordDecision(config, sessionId, "denied", insufficientFailure.message).catch(() => {
           });
         }
         onDenied(result, req, res);
@@ -931,11 +951,15 @@ function createMiddleware(options) {
       }
       if (routeConfig.minTrustScore && result.agent) {
         if (result.agent.trustScore < routeConfig.minTrustScore) {
-          result.denialReasons = [
-            `Trust score ${result.agent.trustScore} is below required ${routeConfig.minTrustScore}`
-          ];
+          const trustFailure = {
+            dimension: "access_level.insufficient",
+            message: `Trust score ${result.agent.trustScore} is below required ${routeConfig.minTrustScore} for this route.`,
+            guidance: "Request elevated access via step-up verification (coming soon \u2014 ships this month). Step-up lets the agent owner approve a one-time elevation for this specific counterparty + purpose without changing the agent's baseline trust score."
+          };
+          result.failures = [...result.failures ?? [], trustFailure];
+          result.denialReasons = [trustFailure.message];
           if (shouldRecordDecisions && sessionId) {
-            recordDecision(config, sessionId, "denied", result.denialReasons[0]).catch(() => {
+            recordDecision(config, sessionId, "denied", trustFailure.message).catch(() => {
             });
           }
           onDenied(result, req, res);