@astrasyncai/verification-gateway 3.3.0 → 3.5.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-ClvUqrEm.mjs';
-import '../types-B_wnd7ZX.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-C8HyQEaz.mjs';
+import '../types-DrDIouvO.mjs';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-B6uD4jAI.js';
-import '../types-B_wnd7ZX.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-xofemo0G.js';
+import '../types-DrDIouvO.js';
 
 /**
  * Git Trigger — Enterprise git push / PR verification

package/dist/{index-kxLJ873R.d.mts → index-BR2nmxBU.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-B_wnd7ZX.mjs';
+import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-DrDIouvO.mjs';
 import { JWK } from 'jose';
 
 /**
@@ -96,6 +96,10 @@ interface TransactionValueContext {
     amount: number;
     currency: string;
     source: string;
+    /** When true, the amount is in raw atomic/minor units and could NOT be
+     *  converted to major units (unknown token decimals). The limit engine
+     *  must fail-closed — never compare raw units against major-unit limits. */
+    rawUnits?: boolean;
 }
 declare function extractUCPTransactionValue(input: {
     totals?: Array<{

package/dist/{index-E3fAidVt.d.ts → index-DEixUCu0.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-B_wnd7ZX.js';
+import { c as AstraSyncCredentials, g as ProtocolTransport } from './types-DrDIouvO.js';
 import { JWK } from 'jose';
 
 /**
@@ -96,6 +96,10 @@ interface TransactionValueContext {
     amount: number;
     currency: string;
     source: string;
+    /** When true, the amount is in raw atomic/minor units and could NOT be
+     *  converted to major units (unknown token decimals). The limit engine
+     *  must fail-closed — never compare raw units against major-unit limits. */
+    rawUnits?: boolean;
 }
 declare function extractUCPTransactionValue(input: {
     totals?: Array<{

package/dist/{index-DFwfHOGj.d.ts → index-DlCnmpJH.d.ts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-B_wnd7ZX.js';
+import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-DrDIouvO.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-BLeiWFLu.d.mts → index-aZHAWujT.d.mts}

@@ -1,4 +1,4 @@
-import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-B_wnd7ZX.mjs';
+import { c as AstraSyncCredentials, g as ProtocolTransport, G as GatewayConfig } from './types-DrDIouvO.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/index.d.mts

@@ -1,12 +1,12 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, j as VerificationResult, E as EnhancedVerificationResult, A as AccessFailure } from './types-B_wnd7ZX.mjs';
-export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, i as TrustLevel, k as VerifiedAgent, l as VerifiedDeveloper, m as VerifiedOrganization } from './types-B_wnd7ZX.mjs';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-D1MuiiNz.mjs';
-export { e as express } from './express-DAOTESQo.mjs';
-export { n as nextjs } from './nextjs-CFQ_KDFf.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-kxLJ873R.mjs';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, l as VerificationResult, E as EnhancedVerificationResult, A as AccessFailure, j as StepUpApprovalInfo } from './types-DrDIouvO.mjs';
+export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, T as TokenGuidance, k as TrustLevel, m as VerifiedAgent, n as VerifiedDeveloper, o as VerifiedOrganization } from './types-DrDIouvO.mjs';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-DKhwVL9X.mjs';
+export { e as express } from './express-BH5ADAyb.mjs';
+export { n as nextjs } from './nextjs-LTeoPqMH.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-BR2nmxBU.mjs';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BLeiWFLu.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-aZHAWujT.mjs';
 import 'express';
 import 'next/server';
 import 'jose';
@@ -87,6 +87,8 @@ interface SettlementDecision {
     reason?: string;
     failures?: AccessFailure[];
     correlationId?: string;
+    /** Present when the transaction is in the human-approval band — the owner can approve via the poll URL. */
+    stepUpApproval?: StepUpApprovalInfo;
 }
 /**
  * Authorize a settlement of `value` for `agentId` against the agent's PDLSS
@@ -152,6 +154,6 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
  * @packageDocumentation
  */
 
-declare const VERSION = "2.0.0";
+declare const VERSION = "3.4.0";
 
-export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, VERSION, VerificationRequest, VerificationResult, type WellKnownAgenticCommerce, authorizeSettlement, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, prefetchWellKnown, quickVerify, verify };
+export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, VERSION, VerificationRequest, VerificationResult, type WellKnownAgenticCommerce, authorizeSettlement, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, prefetchWellKnown, quickVerify, verify };

package/dist/index.d.ts

@@ -1,12 +1,12 @@
-import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, j as VerificationResult, E as EnhancedVerificationResult, A as AccessFailure } from './types-B_wnd7ZX.js';
-export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, T as TokenGuidance, i as TrustLevel, k as VerifiedAgent, l as VerifiedDeveloper, m as VerifiedOrganization } from './types-B_wnd7ZX.js';
-export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-C7qAfpGB.js';
-export { e as express } from './express-Lb8-Ybio.js';
-export { n as nextjs } from './nextjs-BXK0nD73.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-E3fAidVt.js';
+import { b as AgentCredentials, G as GatewayConfig, a as AccessLevel, V as VerificationRequest, l as VerificationResult, E as EnhancedVerificationResult, A as AccessFailure, j as StepUpApprovalInfo } from './types-DrDIouvO.js';
+export { c as AstraSyncCredentials, C as CommerceShieldProps, d as CounterpartyType, e as ExpressMiddlewareOptions, f as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, g as ProtocolTransport, R as RouteAccessConfig, h as RuntimeChallengeResult, S as SDKOptions, i as SettlementArtifact, T as TokenGuidance, k as TrustLevel, m as VerifiedAgent, n as VerifiedDeveloper, o as VerifiedOrganization } from './types-DrDIouvO.js';
+export { A as ACCESS_LEVEL_DESCRIPTIONS, a as ACCESS_LEVEL_HIERARCHY, b as AccessCapabilities, D as DEFAULT_TRUST_THRESHOLDS, T as TRUST_LEVEL_RANGES, d as determineAccessLevel, g as getAccessLevelForScore, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, s as sdk } from './sdk-LmvyDVpL.js';
+export { e as express } from './express-jUzLIoep.js';
+export { n as nextjs } from './nextjs-DfXOd0Au.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-DEixUCu0.js';
 export { McpMiddlewareOptions, ToolGateConfig, createMcpMiddleware } from './adapters/mcp.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DFwfHOGj.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DlCnmpJH.js';
 import 'express';
 import 'next/server';
 import 'jose';
@@ -87,6 +87,8 @@ interface SettlementDecision {
     reason?: string;
     failures?: AccessFailure[];
     correlationId?: string;
+    /** Present when the transaction is in the human-approval band — the owner can approve via the poll URL. */
+    stepUpApproval?: StepUpApprovalInfo;
 }
 /**
  * Authorize a settlement of `value` for `agentId` against the agent's PDLSS
@@ -152,6 +154,6 @@ declare function getCachedWellKnownUrls(apiBaseUrl: string): WellKnownAgenticCom
  * @packageDocumentation
  */
 
-declare const VERSION = "2.0.0";
+declare const VERSION = "3.4.0";
 
-export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, VERSION, VerificationRequest, VerificationResult, type WellKnownAgenticCommerce, authorizeSettlement, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, prefetchWellKnown, quickVerify, verify };
+export { AccessLevel, AgentCredentials, EnhancedVerificationResult, GatewayConfig, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, VERSION, VerificationRequest, VerificationResult, type WellKnownAgenticCommerce, authorizeSettlement, clearCache, extractCredentials, getCachedWellKnownUrls, getWellKnownUrls, hasCredentials, prefetchWellKnown, quickVerify, verify };

package/dist/index.js

@@ -193,7 +193,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.3.0";
+var SDK_VERSION = "3.5.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -611,7 +611,9 @@ async function verify(config, request) {
       // linking key (the sessionId-equivalent for anonymous callers).
       correlationId: apiResponse.correlationId,
       recommendation: apiResponse.recommendation,
-      recommendationReasons: apiResponse.recommendationReasons
+      recommendationReasons: apiResponse.recommendationReasons,
+      stepUpApproval: apiResponse.stepUpApproval,
+      settlement: apiResponse.settlement
     };
     return result2;
   }
@@ -663,7 +665,9 @@ async function verify(config, request) {
     tokenGuidance: apiResponse.tokenGuidance,
     recommendation: apiResponse.recommendation,
     recommendationReasons: apiResponse.recommendationReasons,
-    warningHeader: apiResponse.warningHeader
+    warningHeader: apiResponse.warningHeader,
+    stepUpApproval: apiResponse.stepUpApproval,
+    settlement: apiResponse.settlement
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -744,7 +748,7 @@ async function quickVerify(config, credentials) {
 }
 
 // src/adapters/approval-gate.ts
-var APPROVAL_REASON = "Transaction is above the autonomous limit and requires human approval, which is not yet available - it cannot be completed automatically.";
+var APPROVAL_REASON = "Transaction is above the autonomous limit and requires human approval. The agent owner can approve or deny this transaction in the AstraSync dashboard.";
 function requiresHumanApproval(result) {
   return result.requiresStepUp === true || result.requiresApproval === true;
 }
@@ -800,7 +804,8 @@ async function authorizeSettlement(config, req) {
     recommendation,
     reason: authorized ? void 0 : result.denialReasons?.[0] ?? (requiresHumanApproval(result) ? "Transaction is above the autonomous limit and requires human approval; settlement cannot be authorized automatically." : "Settlement not authorized by the agent's PDLSS limits."),
     failures: result.failures,
-    correlationId: result.correlationId
+    correlationId: result.correlationId,
+    stepUpApproval: requiresHumanApproval(result) ? result.stepUpApproval : void 0
   };
 }
 
@@ -1087,7 +1092,8 @@ function defaultOnDenied(result, _req, res) {
       guidance: result.guidance,
       // Round-10: aggregated per-dimension detail + correlation handle.
       failures: result.failures,
-      correlationId: result.correlationId
+      correlationId: result.correlationId,
+      stepUpApproval: result.stepUpApproval
     }
   });
 }
@@ -1237,6 +1243,21 @@ function createMiddleware(options) {
         );
       }
       const agentCardUrl = typeof req.headers["x-astrasync-agent-card"] === "string" ? req.headers["x-astrasync-agent-card"] : void 0;
+      let txValue;
+      let txCurrency;
+      if (config.extractTransactionValue) {
+        try {
+          const extracted = config.extractTransactionValue(req);
+          if (extracted) {
+            txValue = extracted.value;
+            txCurrency = extracted.currency;
+          }
+        } catch (e) {
+          if (config.debug) {
+            console.warn("[VerificationGateway] extractTransactionValue threw:", e);
+          }
+        }
+      }
       const result = await verify(config, {
         credentials,
         purpose,
@@ -1247,6 +1268,8 @@ function createMiddleware(options) {
         counterpartyType: config.counterpartyType || "api",
         enableRuntimeChallenge,
         durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
+        ...txValue !== void 0 && { transactionValue: txValue },
+        ...txCurrency && { currency: txCurrency },
         callerMetadata: {
           sourceIp: originalClientIp,
           userAgent: req.headers["user-agent"],
@@ -1737,7 +1760,8 @@ function createMiddleware2(options) {
               code: !result.identityVerified ? "UNAUTHORIZED" : "POLICY_DENIED",
               message: result.denialReasons?.[0] || "Access denied",
               guidance: result.guidance,
-              failures: result.failures
+              failures: result.failures,
+              stepUpApproval: result.stepUpApproval
             }
           },
           { status: !result.identityVerified ? 401 : 403 }
@@ -2226,15 +2250,33 @@ function extractMPPTransactionValue(challenge) {
     source: `challenge.request.amount (method=${challenge.method ?? "unknown"})`
   };
 }
+var KNOWN_TOKEN_DECIMALS = {
+  USDC: 6,
+  USDT: 6,
+  DAI: 18,
+  ETH: 18,
+  WETH: 18
+};
 function extractX402TransactionValue(req) {
-  const amount = req.maxAmountRequired ?? req.amount;
+  const rawAmount = req.maxAmountRequired ?? req.amount;
   const currency = req.currency ?? req.asset;
-  if (typeof amount !== "number" || !currency) return null;
+  if (typeof rawAmount !== "number" || !currency) return null;
+  const source = req.maxAmountRequired !== void 0 ? "maxAmountRequired" : "amount";
+  const decimals = KNOWN_TOKEN_DECIMALS[currency.toUpperCase()];
+  if (decimals !== void 0) {
+    return {
+      protocol: "x402",
+      amount: rawAmount / Math.pow(10, decimals),
+      currency,
+      source
+    };
+  }
   return {
     protocol: "x402",
-    amount,
+    amount: rawAmount,
     currency,
-    source: req.maxAmountRequired !== void 0 ? "maxAmountRequired" : "amount"
+    source,
+    rawUnits: true
   };
 }
 
@@ -4637,7 +4679,8 @@ function defaultMcpDenied(result, req, res) {
         guidance: result.guidance,
         // Round-10: aggregated per-dimension detail + correlation handle.
         failures: result.failures,
-        correlationId: result.correlationId
+        correlationId: result.correlationId,
+        stepUpApproval: result.stepUpApproval
       }
     }
   });
@@ -5565,7 +5608,7 @@ async function recordDecision2(config, params) {
 }
 
 // src/index.ts
-var VERSION = "2.0.0";
+var VERSION = "3.4.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACCESS_LEVEL_DESCRIPTIONS,