@astrasyncai/verification-gateway 3.10.1 → 3.11.0

package/dist/gateway/gateway.mjs

@@ -3661,7 +3661,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.10.1";
+var SDK_VERSION = "3.11.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -4179,10 +4179,12 @@ function toGatewayConfig(config) {
   };
 }
 function toVerificationRequest(context, astraId) {
+  const dotIndex = context.purpose.indexOf(".");
+  const dotted = dotIndex > 0;
   return {
     credentials: { astraId },
-    purpose: context.purpose,
-    action: context.action,
+    purpose: dotted ? context.purpose.slice(0, dotIndex) : context.purpose,
+    action: dotted ? context.purpose : context.action,
     resourceType: context.resourceType,
     resource: context.target,
     transactionValue: context.transactionValue,
@@ -4434,6 +4436,20 @@ var TraceLogger = class {
       decision: redactDeep(decision)
     });
   }
+  /**
+   * Log a tool call the guard saw but did not govern. One line per skip
+   * keeps coverage holes (unmapped platform tools) visible in the traces
+   * instead of silently indistinguishable from ALLOW.
+   */
+  logSkipped(toolName, reason) {
+    if (!this.enabled) return;
+    this.write({
+      id: this.generateId(),
+      timestamp: /* @__PURE__ */ new Date(),
+      type: "skipped",
+      metadata: { toolName, reason }
+    });
+  }
   /**
    * Log a mode switch event.
    */
@@ -4631,6 +4647,13 @@ var AstraSyncGateway = class {
   getSyncStatus() {
     return this.syncQueue?.getStatus() || null;
   }
+  /**
+   * Record a tool call the calling adapter saw but did not govern
+   * (unmapped tool, skipTools, MCP with governMcp off). Trace-only.
+   */
+  logSkippedTool(toolName, reason) {
+    this.traceLogger?.logSkipped(toolName, reason);
+  }
 };
 export {
   AstraSyncGateway