@astrasyncai/verification-gateway 3.0.0 → 3.1.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-CgDCUfo8.mjs';
-import '../types-B3USs-Kx.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-CyFwZ_Yu.mjs';
+import '../types-Cuh7ELfr.mjs';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-R5N4ET6x.js';
-import '../types-B3USs-Kx.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-WIRp_BP_.js';
+import '../types-Cuh7ELfr.js';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/{index-B5e2IDWU.d.mts → index-BVxantdv.d.mts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, f as ProtocolTransport, G as GatewayConfig } from './types-B3USs-Kx.mjs';
+import { b as AstraSyncCredentials, f as ProtocolTransport, G as GatewayConfig } from './types-Cuh7ELfr.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-DC5f8eoQ.d.ts → index-BhEgEiJL.d.ts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, f as ProtocolTransport, G as GatewayConfig } from './types-B3USs-Kx.js';
+import { b as AstraSyncCredentials, f as ProtocolTransport, G as GatewayConfig } from './types-Cuh7ELfr.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-CEg_WG6y.d.mts → index-BhL2R65s.d.mts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, f as ProtocolTransport } from './types-B3USs-Kx.mjs';
+import { b as AstraSyncCredentials, f as ProtocolTransport } from './types-Cuh7ELfr.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-CCdZxvAr.d.ts → index-Dk2nIA4w.d.ts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, f as ProtocolTransport } from './types-B3USs-Kx.js';
+import { b as AstraSyncCredentials, f as ProtocolTransport } from './types-Cuh7ELfr.js';
 import { JWK } from 'jose';
 
 /**

package/dist/index.d.mts

@@ -1,12 +1,12 @@
-import { a as AgentCredentials, G as GatewayConfig, A as AccessLevel, V as VerificationRequest, i as VerificationResult } from './types-B3USs-Kx.mjs';
-export { b as AstraSyncCredentials, C as CommerceShieldProps, c as CounterpartyType, E as EnhancedVerificationResult, d as ExpressMiddlewareOptions, e as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, f as ProtocolTransport, R as RouteAccessConfig, g as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, h as TrustLevel, j as VerifiedAgent, k as VerifiedDeveloper, l as VerifiedOrganization } from './types-B3USs-Kx.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-5U_CBRpr.mjs';
-export { e as express } from './express-ienhAXps.mjs';
-export { n as nextjs } from './nextjs-DSpisQst.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-CEg_WG6y.mjs';
+import { a as AgentCredentials, G as GatewayConfig, A as AccessLevel, V as VerificationRequest, i as VerificationResult } from './types-Cuh7ELfr.mjs';
+export { b as AstraSyncCredentials, C as CommerceShieldProps, c as CounterpartyType, E as EnhancedVerificationResult, d as ExpressMiddlewareOptions, e as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, f as ProtocolTransport, R as RouteAccessConfig, g as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, h as TrustLevel, j as VerifiedAgent, k as VerifiedDeveloper, l as VerifiedOrganization } from './types-Cuh7ELfr.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-767LaEP8.mjs';
+export { e as express } from './express-DFVBlXr_.mjs';
+export { n as nextjs } from './nextjs-D-maqrNz.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-BhL2R65s.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-B5e2IDWU.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BVxantdv.mjs';
 import 'express';
 import 'next/server';
 import 'jose';

package/dist/index.d.ts

@@ -1,12 +1,12 @@
-import { a as AgentCredentials, G as GatewayConfig, A as AccessLevel, V as VerificationRequest, i as VerificationResult } from './types-B3USs-Kx.js';
-export { b as AstraSyncCredentials, C as CommerceShieldProps, c as CounterpartyType, E as EnhancedVerificationResult, d as ExpressMiddlewareOptions, e as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, f as ProtocolTransport, R as RouteAccessConfig, g as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, h as TrustLevel, j as VerifiedAgent, k as VerifiedDeveloper, l as VerifiedOrganization } from './types-B3USs-Kx.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Bm8np66n.js';
-export { e as express } from './express-CrfwoNAR.js';
-export { n as nextjs } from './nextjs-66R1KW8e.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-CCdZxvAr.js';
+import { a as AgentCredentials, G as GatewayConfig, A as AccessLevel, V as VerificationRequest, i as VerificationResult } from './types-Cuh7ELfr.js';
+export { b as AstraSyncCredentials, C as CommerceShieldProps, c as CounterpartyType, E as EnhancedVerificationResult, d as ExpressMiddlewareOptions, e as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, f as ProtocolTransport, R as RouteAccessConfig, g as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, h as TrustLevel, j as VerifiedAgent, k as VerifiedDeveloper, l as VerifiedOrganization } from './types-Cuh7ELfr.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-K8IgssHI.js';
+export { e as express } from './express-DavQ76oF.js';
+export { n as nextjs } from './nextjs-BXLH1hJj.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-Dk2nIA4w.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DC5f8eoQ.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BhEgEiJL.js';
 import 'express';
 import 'next/server';
 import 'jose';

package/dist/index.js

@@ -192,7 +192,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.0.0";
+var SDK_VERSION = "3.1.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -787,6 +787,9 @@ function setHttpHeaders(headers, credentials) {
   if (credentials.pdlss?.purpose) {
     const purposeValue = credentials.pdlss.purpose.action ? `${credentials.pdlss.purpose.category}:${credentials.pdlss.purpose.action}` : credentials.pdlss.purpose.category;
     result[`${HEADER_PREFIX}Purpose`] = purposeValue;
+    if (credentials.pdlss.purpose.action) {
+      result[`${HEADER_PREFIX}Action`] = credentials.pdlss.purpose.action;
+    }
   }
   if (credentials.pdlss?.duration?.maxSessionDuration) {
     result[`${HEADER_PREFIX}Duration`] = String(credentials.pdlss.duration.maxSessionDuration);
@@ -816,6 +819,13 @@ function extractHttpCredentials(headers) {
       purpose: { category, action }
     };
   }
+  const astraAction = getValue(`${HEADER_PREFIX}Action`) ?? getValue("x-astra-action");
+  if (astraAction) {
+    credentials.pdlss = {
+      ...credentials.pdlss,
+      purpose: { category: credentials.pdlss?.purpose?.category ?? "", action: astraAction }
+    };
+  }
   const duration = getValue(`${HEADER_PREFIX}Duration`) ?? getValue("x-astra-duration");
   if (duration) {
     credentials.pdlss = {
@@ -833,6 +843,85 @@ function extractHttpCredentials(headers) {
   return credentials;
 }
 
+// src/adapters/http-pdlss.ts
+var HTTP_METHOD_ACTION_TABLE = {
+  GET: "data.read",
+  HEAD: "data.read",
+  OPTIONS: "data.read",
+  POST: "data.write",
+  PUT: "data.write",
+  PATCH: "data.write",
+  DELETE: "data.delete"
+};
+var DEFAULT_HTTP_ACTION = "data.write";
+var DEFAULT_HTTP_PURPOSE = "data";
+function actionForHttpMethod(method) {
+  return HTTP_METHOD_ACTION_TABLE[method.toUpperCase()] ?? DEFAULT_HTTP_ACTION;
+}
+function normalizePurposeHeader(value) {
+  const colon = value.indexOf(":");
+  if (colon >= 0) {
+    return { purpose: value.slice(0, colon) };
+  }
+  const dot = value.indexOf(".");
+  if (dot > 0 && dot < value.length - 1) {
+    return { purpose: value.slice(0, dot), actionCandidate: value };
+  }
+  return { purpose: value };
+}
+function resolveHttpPdlss(input) {
+  const fromHeader = input.astraPurpose ? normalizePurposeHeader(input.astraPurpose) : void 0;
+  let action;
+  let actionSource;
+  if (input.routeAction) {
+    action = input.routeAction;
+    actionSource = "route_config";
+  } else if (input.hasCustomActionExtractor && input.customAction) {
+    action = input.customAction;
+    actionSource = "custom_extractor";
+  } else if (!input.hasCustomActionExtractor && input.astraAction) {
+    action = input.astraAction;
+    actionSource = "header";
+  } else if (!input.hasCustomActionExtractor && fromHeader?.actionCandidate) {
+    action = fromHeader.actionCandidate;
+    actionSource = "purpose_header_derived";
+  } else {
+    action = actionForHttpMethod(input.method);
+    actionSource = "method_table";
+  }
+  let purpose;
+  let purposeSource;
+  if (input.routePurpose) {
+    purpose = input.routePurpose;
+    purposeSource = "route_config";
+  } else if (input.hasCustomPurposeExtractor) {
+    if (input.customPurpose) {
+      purpose = input.customPurpose;
+      purposeSource = "custom_extractor";
+    }
+  } else if (fromHeader) {
+    purpose = fromHeader.purpose;
+    purposeSource = "header";
+  } else if (input.legacyPurpose) {
+    purpose = input.legacyPurpose;
+    purposeSource = "legacy_header";
+  } else if (input.queryPurpose) {
+    purpose = input.queryPurpose;
+    purposeSource = "query";
+  }
+  if (!purpose) {
+    const dot = action.indexOf(".");
+    if (dot > 0) {
+      purpose = action.slice(0, dot);
+      purposeSource = "action_derived";
+    } else {
+      purpose = DEFAULT_HTTP_PURPOSE;
+      purposeSource = "transport_default";
+    }
+  }
+  return { purpose, action, purposeSource, actionSource };
+}
+
 // src/pdlss-pre-check.ts
 function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   const failures = [];
@@ -891,33 +980,25 @@ function defaultExtractCredentials(req) {
 function extractAstraSyncCredentials(req) {
   return extractHttpCredentials(req.headers);
 }
-function defaultExtractPurpose(req) {
-  const astraPurpose = req.headers["x-astra-purpose"];
-  if (astraPurpose) {
-    const value = Array.isArray(astraPurpose) ? astraPurpose[0] : astraPurpose;
-    const category = value.split(":")[0];
-    return category;
-  }
-  const purposeHeader = req.headers["x-purpose"] || req.headers["X-Purpose"];
-  if (purposeHeader) {
-    return Array.isArray(purposeHeader) ? purposeHeader[0] : purposeHeader;
-  }
-  if (req.query.purpose && typeof req.query.purpose === "string") {
-    return req.query.purpose;
-  }
-  switch (req.method) {
-    case "GET":
-      return "read_data";
-    case "POST":
-      return "write_data";
-    case "PUT":
-    case "PATCH":
-      return "write_data";
-    case "DELETE":
-      return "delete_data";
-    default:
-      return "general";
-  }
+function headerValue(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[0];
+  return void 0;
+}
+function resolveRequestPdlss(req, routeConfig, customExtractPurpose, customExtractAction) {
+  return resolveHttpPdlss({
+    method: req.method,
+    astraPurpose: headerValue(req.headers["x-astra-purpose"]),
+    astraAction: headerValue(req.headers["x-astra-action"]),
+    legacyPurpose: headerValue(req.headers["x-purpose"] ?? req.headers["X-Purpose"]),
+    queryPurpose: typeof req.query.purpose === "string" ? req.query.purpose : void 0,
+    routePurpose: routeConfig?.purpose,
+    routeAction: routeConfig?.action,
+    hasCustomPurposeExtractor: !!customExtractPurpose,
+    customPurpose: customExtractPurpose?.(req),
+    hasCustomActionExtractor: !!customExtractAction,
+    customAction: customExtractAction?.(req)
+  });
 }
 function matchRoute(pattern, path, opts) {
   const regexPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
@@ -977,6 +1058,7 @@ function createMiddleware(options) {
   const {
     extractCredentials: customExtractCredentials,
     extractPurpose: customExtractPurpose,
+    extractAction: customExtractAction,
     skipPaths = [],
     onDenied = defaultOnDenied,
     recordDecisions,
@@ -1062,7 +1144,21 @@ function createMiddleware(options) {
         }
         return next();
       }
-      const purpose = customExtractPurpose ? customExtractPurpose(req) : defaultExtractPurpose(req);
+      const pdlssPair = resolveRequestPdlss(
+        req,
+        routeConfig,
+        customExtractPurpose,
+        customExtractAction
+      );
+      const purpose = pdlssPair.purpose;
+      if (config.debug) {
+        console.debug("[express-middleware] pdlss resolved", {
+          purpose_source: pdlssPair.purposeSource,
+          resolved_purpose: pdlssPair.purpose,
+          action_source: pdlssPair.actionSource,
+          resolved_action: pdlssPair.action
+        });
+      }
       const astraCreds = extractAstraSyncCredentials(req);
       const counterpartyUrl = config.counterpartyUrl || `${req.protocol}://${req.get("host")}`;
       const preCheckFailures = performCounterpartyPreCheck(routeConfig, astraCreds, purpose);
@@ -1106,10 +1202,7 @@ function createMiddleware(options) {
       const result = await verify(config, {
         credentials,
         purpose,
-        // RFC 7230 § 3.1.1 — HTTP method tokens uppercase by IANA convention.
-        // Backend evaluator tolerates either case as defense-in-depth
-        // (round-18.6 batch 2); SDK emits canonical form.
-        action: req.method.toUpperCase(),
+        action: pdlssPair.action,
         resource: req.path,
         createSession: shouldRecordDecisions,
         counterpartyUrl,
@@ -1307,28 +1400,15 @@ function extractAstraSyncCredentialsFromNextRequest(request) {
   });
   return extractHttpCredentials(headers);
 }
-function extractPurpose(request) {
-  const astraPurpose = request.headers.get("x-astra-purpose");
-  if (astraPurpose) {
-    return astraPurpose.split(":")[0];
-  }
-  const purposeHeader = request.headers.get("x-purpose");
-  if (purposeHeader) {
-    return purposeHeader;
-  }
-  switch (request.method.toUpperCase()) {
-    case "GET":
-      return "read_data";
-    case "POST":
-      return "write_data";
-    case "PUT":
-    case "PATCH":
-      return "write_data";
-    case "DELETE":
-      return "delete_data";
-    default:
-      return "general";
-  }
+function resolveNextPdlss(request, routeConfig) {
+  return resolveHttpPdlss({
+    method: request.method,
+    astraPurpose: request.headers.get("x-astra-purpose") ?? void 0,
+    astraAction: request.headers.get("x-astra-action") ?? void 0,
+    legacyPurpose: request.headers.get("x-purpose") ?? void 0,
+    routePurpose: routeConfig?.purpose,
+    routeAction: routeConfig?.action
+  });
 }
 function generateCommerceShieldHtml(result, options) {
   const title = escapeHtml(options.commerceShield?.title || "AstraSync Agent Verification");
@@ -1541,7 +1621,16 @@ function createMiddleware2(options) {
     }
     const credentials = extractCredentialsFromNextRequest(request);
     const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;
-    const purpose = extractPurpose(request);
+    const pdlssPair = resolveNextPdlss(request, routeConfig);
+    const purpose = pdlssPair.purpose;
+    if (config.debug) {
+      console.debug("[nextjs-middleware] pdlss resolved", {
+        purpose_source: pdlssPair.purposeSource,
+        resolved_purpose: pdlssPair.purpose,
+        action_source: pdlssPair.actionSource,
+        resolved_action: pdlssPair.action
+      });
+    }
     const astraCreds = extractAstraSyncCredentialsFromNextRequest(request);
     const preCheckFailures = performCounterpartyPreCheck(routeConfig, astraCreds, purpose);
     if (preCheckFailures.length > 0) {
@@ -1595,10 +1684,7 @@ function createMiddleware2(options) {
     const result = await verify(config, {
       credentials,
       purpose,
-      // RFC 7230 § 3.1.1 — HTTP method tokens uppercase by IANA convention.
-      // Backend evaluator tolerates either case as defense-in-depth
-      // (round-18.6 batch 2); SDK emits canonical form.
-      action: request.method.toUpperCase(),
+      action: pdlssPair.action,
       resource: pathname,
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",
@@ -3353,9 +3439,9 @@ function toBuf(bytes) {
   new Uint8Array(out).set(bytes);
   return out;
 }
-function checkTimestamp(headerValue, toleranceSec, nowFn) {
-  if (!headerValue) return { ok: false, error: "missing Timestamp header" };
-  const ts = parseTimestamp(headerValue);
+function checkTimestamp(headerValue2, toleranceSec, nowFn) {
+  if (!headerValue2) return { ok: false, error: "missing Timestamp header" };
+  const ts = parseTimestamp(headerValue2);
   if (ts === null) return { ok: false, error: "unparseable Timestamp header" };
   const now = nowFn ? nowFn() : Math.floor(Date.now() / 1e3);
   if (Math.abs(now - ts) > toleranceSec) {
@@ -3587,14 +3673,14 @@ function verifyMPP(input) {
 var import_schemas = require("@x402/core/schemas");
 var import_utils = require("@x402/core/utils");
 function extractX402FromRequest(request) {
-  const headerValue = readHeader4(request.headers, "x-payment");
+  const headerValue2 = readHeader4(request.headers, "x-payment");
   if (request.body && typeof request.body === "object") {
     const parsed = tryParsePayload(request.body);
     if (parsed) return buildPayloadContext(parsed, "body");
   }
-  if (headerValue) {
+  if (headerValue2) {
     try {
-      const decoded = (0, import_utils.safeBase64Decode)(headerValue);
+      const decoded = (0, import_utils.safeBase64Decode)(headerValue2);
       if (decoded) {
         const json = JSON.parse(decoded);
         const parsed = tryParsePayload(json);
@@ -3617,10 +3703,10 @@ function extractX402FromResponse(response) {
     const parsed = tryParseRequired(response.body);
     if (parsed) return buildRequiredContext(parsed, "body");
   }
-  const headerValue = readHeader4(response.headers, "x-payment-required");
-  if (headerValue) {
+  const headerValue2 = readHeader4(response.headers, "x-payment-required");
+  if (headerValue2) {
     try {
-      const decoded = (0, import_utils.safeBase64Decode)(headerValue);
+      const decoded = (0, import_utils.safeBase64Decode)(headerValue2);
       if (decoded) {
         const json = JSON.parse(decoded);
         const parsed = tryParseRequired(json);
@@ -4456,7 +4542,10 @@ function mcpToPdlss(parsed, requestPath, headerPurpose, headerAction, toolGate)
   }
   let action;
   let actionSource;
-  if (headerAction) {
+  if (toolGate?.action !== void 0) {
+    action = toolGate.action;
+    actionSource = "tool_gate";
+  } else if (headerAction) {
     action = headerAction;
     actionSource = "header";
   } else if (parsed.actionFromBody && parsed.actionSourceFromBody) {
@@ -4630,7 +4719,7 @@ function createMcpMiddleware(options) {
         req.path,
         headerPurpose,
         headerAction,
-        gate ? { purpose: gate.purpose, resource: gate.resource } : void 0
+        gate ? { purpose: gate.purpose, action: gate.action, resource: gate.resource } : void 0
       );
       if (config.debug) {
         console.debug("[mcp-middleware] pdlss resolved", {