@astrasyncai/verification-gateway 3.12.0 → 4.0.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-Djw4GLtz.mjs';
-import '../types-BntuzEEn.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-DfnP7JiM.mjs';
+import '../types-BcDf9Kk0.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-DHu7m9HI.js';
-import '../types-SDu4Llbe.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-CHKCgDFC.js';
+import '../types-fTQD448H.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{index-DME3w3lf.d.mts → index-B0cyMZDL.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-BntuzEEn.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-BcDf9Kk0.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-CqydB4ks.d.mts → index-BRYteOqO.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-BntuzEEn.mjs';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-BcDf9Kk0.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-BG62SXso.d.ts → index-BZQdVqNw.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-SDu4Llbe.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport, G as GatewayConfig } from './types-fTQD448H.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-CLHdqs2M.d.ts → index-adgKhujR.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-SDu4Llbe.js';
+import { c as AstraSyncCredentials, m as ProtocolTransport } from './types-fTQD448H.js';
 import { JWK } from 'jose';
 
 /**

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-BntuzEEn.mjs';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-BntuzEEn.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-Bn6bj7kt.mjs';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-BcDf9Kk0.mjs';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-BcDf9Kk0.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-_il1Q41f.mjs';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.mjs';
-export { e as express } from './express-B39o89gf.mjs';
-export { n as nextjs } from './nextjs-D74W7wt-.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-DME3w3lf.mjs';
+export { e as express } from './express-BZajRs4i.mjs';
+export { n as nextjs } from './nextjs-DeUTnOBd.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-B0cyMZDL.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CqydB4ks.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BRYteOqO.mjs';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.mjs';
 export { MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.mjs';
@@ -145,6 +145,6 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "3.12.0";
+declare const SDK_VERSION = "4.0.0";
 
 export { EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown };

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-SDu4Llbe.js';
-export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-SDu4Llbe.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-CT7gdkfR.js';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-fTQD448H.js';
+export { a as AccessLevel, b as AgentCredentials, c as AstraSyncCredentials, d as AttemptOutcome, e as AttemptReport, C as CallerMetadata, f as CommerceArtifactsPayload, g as CommerceShieldProps, h as ConsiderationItem, i as ConsiderationSet, j as CounterpartyType, k as ExpressMiddlewareOptions, F as FiatSettlementBinding, l as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, m as ProtocolTransport, R as RouteAccessConfig, n as RuntimeChallengeResult, S as SDKOptions, o as SettlementArtifact, p as SettlementArtifactBinding, q as SettlementArtifactBindingBase, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-fTQD448H.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-BM3mwEAq.js';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.js';
-export { e as express } from './express-BuxKNO_q.js';
-export { n as nextjs } from './nextjs-Ddlw_J1J.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-CLHdqs2M.js';
+export { e as express } from './express-CjCUB1k7.js';
+export { n as nextjs } from './nextjs-D_iFf5k-.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-adgKhujR.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BG62SXso.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BZQdVqNw.js';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.js';
 export { MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.js';
@@ -145,6 +145,6 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "3.12.0";
+declare const SDK_VERSION = "4.0.0";
 
 export { EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown };

package/dist/index.js

@@ -214,7 +214,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.12.0";
+var SDK_VERSION = "4.0.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -292,7 +292,7 @@ var DEFAULT_CONFIG = {
 };
 var initCheckPerformed = false;
 var deprecationWarningShown = false;
-async function performInitCheck(apiBaseUrl, debug, strictInit) {
+async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
@@ -309,6 +309,28 @@ async function performInitCheck(apiBaseUrl, debug, strictInit) {
         `[VerificationGateway] init check passed for ${apiBaseUrl} (content-type: ${contentType})`
       );
     }
+    if (apiKey) {
+      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+        headers: { Authorization: `Bearer ${apiKey}` }
+      });
+      if (selfCheck.status === 401) {
+        const body = await selfCheck.json().catch(() => ({}));
+        const message = `[VerificationGateway] the configured AstraSync API key was REJECTED at startup (${body.code ?? "api_key_invalid"}: ${body.message ?? "invalid key"}). Every inbound agent will be turned away until the key is rotated` + (body.remediation?.manageUrl ? ` at ${body.remediation.manageUrl}` : "") + `.`;
+        if (strictInit) {
+          throw new Error(`${message} (strictInit=true)`);
+        }
+        console.error(message);
+      } else if (selfCheck.ok) {
+        const body = await selfCheck.json().catch(() => ({}));
+        if (typeof body.daysToExpiry === "number" && body.daysToExpiry <= 7) {
+          console.warn(
+            `[VerificationGateway] the configured AstraSync API key expires in ${body.daysToExpiry} day(s) \u2014 rotate it at Settings \u2192 Developer Tools before integrations start failing.`
+          );
+        } else if (debug) {
+          console.log("[VerificationGateway] API key self-check passed");
+        }
+      }
+    }
   } catch (err) {
     if (strictInit) {
       throw err;
@@ -426,8 +448,17 @@ function hasCredentials(credentials) {
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
+  const isMisconfig = source === "merchant_misconfig";
   const urls = options.urls;
-  const guidance = isApiError ? {
+  const guidance = isMisconfig ? {
+    message: "This site's AstraSync integration is misconfigured (its API key was revoked, expired, or rotated). Your identity and the AstraSync platform are fine \u2014 contact the site operator. Retrying will not help.",
+    registrationUrl: urls?.registrationUrl ?? "",
+    documentationUrl: options.remediation?.docsUrl ?? urls?.documentationUrl ?? "",
+    steps: [
+      "Report the failure to the site operator \u2014 their AstraSync API key needs rotating",
+      "Do not retry: the failure is deterministic until the operator updates their key"
+    ]
+  } : isApiError ? {
     message: "Verification is temporarily unavailable. Retry with exponential backoff; if the issue persists, contact support with the correlationId.",
     registrationUrl: urls?.registrationUrl ?? "",
     documentationUrl: urls?.documentationUrl ?? "",
@@ -465,13 +496,22 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // partners (and their custom onDenied handlers) can branch on
     // dimension. Without this, the synthesised stub was indistinguishable
     // from a real policy deny.
-    failures: isApiError ? [
+    failures: isMisconfig ? [
+      {
+        dimension: "verify_access.merchant_misconfigured",
+        message: reason ?? "The integration API key was rejected by AstraSync",
+        guidance: guidance.message
+      }
+    ] : isApiError ? [
       {
         dimension: "verify_access.api_error",
         message: reason ?? "Verification temporarily unavailable",
         guidance: guidance.message
       }
     ] : void 0,
+    // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
+    // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
+    ...isMisconfig && { misconfigured: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -526,7 +566,8 @@ async function callVerifyAccessAPI(config, request) {
     const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
-      body: JSON.stringify(body)
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(config.verifyTimeoutMs ?? 1e4)
     });
     const data = await response.json();
     if (response.status === 410) {
@@ -550,6 +591,17 @@ async function callVerifyAccessAPI(config, request) {
       };
     }
     if (!response.ok) {
+      if (response.status === 401) {
+        return {
+          success: false,
+          error: data.message || data.error || "Integration API key rejected",
+          misconfig: true,
+          misconfigCode: typeof data?.code === "string" ? data.code : void 0,
+          remediation: data?.remediation && typeof data.remediation === "object" ? data.remediation : void 0,
+          correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
+          attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
+        };
+      }
       return {
         success: false,
         error: data.message || data.error || `API returned ${response.status}`,
@@ -571,9 +623,19 @@ async function verify(config, request, options) {
   const urls = mergedConfig.apiBaseUrl ? getCachedWellKnownUrls(mergedConfig.apiBaseUrl) : void 0;
   if (!initCheckPerformed && !mergedConfig.disableInitChecks && mergedConfig.apiBaseUrl) {
     if (mergedConfig.strictInit) {
-      await performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug, true);
+      await performInitCheck(
+        mergedConfig.apiBaseUrl,
+        mergedConfig.debug,
+        true,
+        mergedConfig.apiKey
+      );
     } else {
-      void performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug, false);
+      void performInitCheck(
+        mergedConfig.apiBaseUrl,
+        mergedConfig.debug,
+        false,
+        mergedConfig.apiKey
+      );
     }
   }
   if (!deprecationWarningShown && (config.minTrustScore !== void 0 || config.minTrustScoreForFull !== void 0)) {
@@ -612,9 +674,10 @@ async function verify(config, request, options) {
   const serverDenialReasons = Array.isArray(rawServerDenialReasons) && rawServerDenialReasons.length > 0 ? rawServerDenialReasons : void 0;
   if (!apiResponse.success) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
-      source: "api_error",
+      source: apiResponse.misconfig ? "merchant_misconfig" : "api_error",
       correlationId: apiResponse.correlationId,
       attemptId: apiResponse.attemptId,
+      remediation: apiResponse.remediation,
       urls
     });
   }
@@ -1362,6 +1425,20 @@ function dedupeFailures(result) {
   }
 }
 function defaultOnDenied(result, _req, res) {
+  if (result.misconfigured) {
+    res.setHeader("X-Astra-Gateway-Mode", "enforced");
+    res.status(503).json({
+      success: false,
+      error: {
+        code: "MERCHANT_VERIFICATION_MISCONFIGURED",
+        message: result.denialReasons?.[0] || "This site's AstraSync integration is misconfigured",
+        guidance: result.guidance,
+        failures: result.failures,
+        correlationId: result.correlationId
+      }
+    });
+    return;
+  }
   const statusCode = !result.identityVerified ? 401 : 403;
   res.setHeader("X-Astra-Gateway-Mode", "enforced");
   res.status(statusCode).json({
@@ -2078,6 +2155,21 @@ function createMiddleware2(options) {
     const approvalRequired = result.identityVerified && result.policyAllowed && requiresHumanApproval(result);
     if (approvalRequired) annotateApprovalRequired(result);
     if (!result.identityVerified || !result.policyAllowed || approvalRequired) {
+      if (result.misconfigured && pathname.startsWith("/api/")) {
+        return NextResponse.json(
+          {
+            success: false,
+            error: {
+              code: "MERCHANT_VERIFICATION_MISCONFIGURED",
+              message: result.denialReasons?.[0] || "This site's AstraSync integration is misconfigured",
+              guidance: result.guidance,
+              failures: result.failures,
+              correlationId: result.correlationId
+            }
+          },
+          { status: 503 }
+        );
+      }
       if (pathname.startsWith("/api/")) {
         return NextResponse.json(
           {
@@ -5001,6 +5093,24 @@ function dedupeFailures2(result) {
 }
 function defaultMcpDenied(result, req, res) {
   const id = req.body?.id ?? null;
+  if (result.misconfigured) {
+    res.setHeader("X-Astra-Gateway-Mode", "enforced");
+    res.status(503).json({
+      jsonrpc: "2.0",
+      id,
+      error: {
+        // -32002 → merchant verification misconfigured (see -32000/-32001 below)
+        code: -32002,
+        message: result.denialReasons?.[0] ?? "This server's AstraSync integration is misconfigured",
+        data: {
+          guidance: result.guidance,
+          failures: result.failures,
+          correlationId: result.correlationId
+        }
+      }
+    });
+    return;
+  }
   const status = !result.identityVerified ? 401 : 403;
   res.setHeader("X-Astra-Gateway-Mode", "enforced");
   res.status(status).json({
@@ -5010,6 +5120,7 @@ function defaultMcpDenied(result, req, res) {
       // JSON-RPC error codes:
       //   -32000 → unauthorized (no identity resolved)
       //   -32001 → insufficient access (identity OK, policy denied)
+      //   -32002 → merchant verification misconfigured (handled above)
       code: !result.identityVerified ? -32e3 : -32001,
       message: result.denialReasons?.[0] ?? "Access denied",
       data: {