@astrasyncai/verification-gateway 3.2.0 → 3.3.0

package/dist/adapters/mcp.mjs

@@ -7,7 +7,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.2.0";
+var SDK_VERSION = "3.3.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -511,6 +511,19 @@ async function recordDecision(config, sessionId, decision, reason) {
   });
 }
 
+// src/adapters/approval-gate.ts
+var APPROVAL_REASON = "Transaction is above the autonomous limit and requires human approval, which is not yet available - it cannot be completed automatically.";
+function requiresHumanApproval(result) {
+  return result.requiresStepUp === true || result.requiresApproval === true;
+}
+function annotateApprovalRequired(result) {
+  result.failures = [
+    ...result.failures ?? [],
+    { dimension: "commerce.intent.approval_required", message: APPROVAL_REASON }
+  ];
+  result.denialReasons = [APPROVAL_REASON, ...result.denialReasons ?? []];
+}
+
 // src/transport/mcp-server.ts
 var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
 var MCP_VERIFIED_HOP_MAX_AGE_MS = 6e4;
@@ -844,6 +857,16 @@ function createMcpMiddleware(options) {
         onDenied(result, req, res);
         return;
       }
+      if (requiresHumanApproval(result)) {
+        annotateApprovalRequired(result);
+        if (shouldRecordDecisions && sessionId) {
+          recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
+          });
+        }
+        dedupeFailures(result);
+        onDenied(result, req, res);
+        return;
+      }
       if (!shouldEnforce) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "enforced");