@astrasyncai/verification-gateway 3.2.0 → 3.3.0

package/dist/index.mjs

@@ -126,7 +126,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.2.0";
+var SDK_VERSION = "3.3.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -676,6 +676,67 @@ async function quickVerify(config, credentials) {
   };
 }
 
+// src/adapters/approval-gate.ts
+var APPROVAL_REASON = "Transaction is above the autonomous limit and requires human approval, which is not yet available - it cannot be completed automatically.";
+function requiresHumanApproval(result) {
+  return result.requiresStepUp === true || result.requiresApproval === true;
+}
+function annotateApprovalRequired(result) {
+  result.failures = [
+    ...result.failures ?? [],
+    { dimension: "commerce.intent.approval_required", message: APPROVAL_REASON }
+  ];
+  result.denialReasons = [APPROVAL_REASON, ...result.denialReasons ?? []];
+}
+
+// src/settlement.ts
+async function authorizeSettlement(config, req) {
+  if (typeof req.value !== "number" || !Number.isFinite(req.value) || req.value <= 0) {
+    return {
+      authorized: false,
+      recommendation: "deny",
+      reason: "No valid transaction value supplied to authorizeSettlement; settlement refused (fail-closed). Pass the merchant-priced cart total as `value`.",
+      failures: [
+        {
+          dimension: "commerce.settlement.value_missing",
+          message: "A positive, authoritative transaction value is required to authorize settlement."
+        }
+      ]
+    };
+  }
+  let result;
+  try {
+    result = await verify(config, {
+      credentials: { astraId: req.agentId },
+      purpose: req.purpose ?? "shopping",
+      action: req.action ?? "shopping.purchase",
+      transactionValue: req.value,
+      currency: req.currency
+    });
+  } catch (err) {
+    return {
+      authorized: false,
+      recommendation: "deny",
+      reason: `Settlement verification failed (${err instanceof Error ? err.message : String(err)}); settlement refused (fail-closed).`,
+      failures: [
+        {
+          dimension: "commerce.settlement.verify_error",
+          message: "verify-access could not be reached or returned an error; settlement is refused."
+        }
+      ]
+    };
+  }
+  const recommendation = result.recommendation;
+  const authorized = result.identityVerified === true && result.policyAllowed === true && !requiresHumanApproval(result) && (recommendation === void 0 || recommendation === "grant");
+  return {
+    authorized,
+    recommendation,
+    reason: authorized ? void 0 : result.denialReasons?.[0] ?? (requiresHumanApproval(result) ? "Transaction is above the autonomous limit and requires human approval; settlement cannot be authorized automatically." : "Settlement not authorized by the agent's PDLSS limits."),
+    failures: result.failures,
+    correlationId: result.correlationId
+  };
+}
+
 // src/adapters/express.ts
 var express_exports = {};
 __export(express_exports, {
@@ -1139,6 +1200,16 @@ function createMiddleware(options) {
         onDenied(result, req, res);
         return;
       }
+      if (requiresHumanApproval(result)) {
+        annotateApprovalRequired(result);
+        if (shouldRecordDecisions && sessionId) {
+          recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
+          });
+        }
+        dedupeFailures(result);
+        onDenied(result, req, res);
+        return;
+      }
       if (!shouldEnforce) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "enforced");
@@ -1586,7 +1657,9 @@ function createMiddleware2(options) {
         agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0
       }
     });
-    if (!result.identityVerified || !result.policyAllowed) {
+    const approvalRequired = result.identityVerified && result.policyAllowed && requiresHumanApproval(result);
+    if (approvalRequired) annotateApprovalRequired(result);
+    if (!result.identityVerified || !result.policyAllowed || approvalRequired) {
       if (pathname.startsWith("/api/")) {
         return NextResponse.json(
           {
@@ -1596,7 +1669,8 @@ function createMiddleware2(options) {
               // OK, policy denied (update PDLSS / step up).
               code: !result.identityVerified ? "UNAUTHORIZED" : "POLICY_DENIED",
               message: result.denialReasons?.[0] || "Access denied",
-              guidance: result.guidance
+              guidance: result.guidance,
+              failures: result.failures
             }
           },
           { status: !result.identityVerified ? 401 : 403 }
@@ -4670,6 +4744,16 @@ function createMcpMiddleware(options) {
         onDenied(result, req, res);
         return;
       }
+      if (requiresHumanApproval(result)) {
+        annotateApprovalRequired(result);
+        if (shouldRecordDecisions && sessionId) {
+          recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
+          });
+        }
+        dedupeFailures2(result);
+        onDenied(result, req, res);
+        return;
+      }
       if (!shouldEnforce) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "enforced");
@@ -5434,6 +5518,7 @@ export {
   TRUST_LEVEL_RANGES,
   VERSION,
   agent_exports as agent,
+  authorizeSettlement,
   buildGuidance,
   clearCache,
   createMcpMiddleware,