@astrasyncai/verification-gateway 3.2.0 → 3.3.0

package/dist/adapters/nextjs.d.mts

@@ -1,3 +1,3 @@
 import 'next/server';
-import '../types-rFh4VMH4.mjs';
-export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-BW1rzr1I.mjs';
+import '../types-B_wnd7ZX.mjs';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-CFQ_KDFf.mjs';

package/dist/adapters/nextjs.d.ts

@@ -1,3 +1,3 @@
 import 'next/server';
-import '../types-rFh4VMH4.js';
-export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-V_K0qlAQ.js';
+import '../types-B_wnd7ZX.js';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-BXK0nD73.js';

package/dist/adapters/nextjs.js

@@ -44,7 +44,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.2.0";
+var SDK_VERSION = "3.3.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -650,6 +650,19 @@ function resolveHttpPdlss(input) {
   return { purpose, action, purposeSource, actionSource };
 }
 
+// src/adapters/approval-gate.ts
+var APPROVAL_REASON = "Transaction is above the autonomous limit and requires human approval, which is not yet available - it cannot be completed automatically.";
+function requiresHumanApproval(result) {
+  return result.requiresStepUp === true || result.requiresApproval === true;
+}
+function annotateApprovalRequired(result) {
+  result.failures = [
+    ...result.failures ?? [],
+    { dimension: "commerce.intent.approval_required", message: APPROVAL_REASON }
+  ];
+  result.denialReasons = [APPROVAL_REASON, ...result.denialReasons ?? []];
+}
+
 // src/adapters/nextjs.ts
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -1009,7 +1022,9 @@ function createMiddleware(options) {
         agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0
       }
     });
-    if (!result.identityVerified || !result.policyAllowed) {
+    const approvalRequired = result.identityVerified && result.policyAllowed && requiresHumanApproval(result);
+    if (approvalRequired) annotateApprovalRequired(result);
+    if (!result.identityVerified || !result.policyAllowed || approvalRequired) {
       if (pathname.startsWith("/api/")) {
         return NextResponse.json(
           {
@@ -1019,7 +1034,8 @@ function createMiddleware(options) {
               // OK, policy denied (update PDLSS / step up).
               code: !result.identityVerified ? "UNAUTHORIZED" : "POLICY_DENIED",
               message: result.denialReasons?.[0] || "Access denied",
-              guidance: result.guidance
+              guidance: result.guidance,
+              failures: result.failures
             }
           },
           { status: !result.identityVerified ? 401 : 403 }