@astrasyncai/verification-gateway 3.4.0 → 3.6.0

package/dist/browser/browser-adapter.d.mts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Cj92yKeA.mjs';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-B-ubjHER.mjs';
 import '../gateway/gateway.mjs';
-import '../types-Cwrvo30g.mjs';
+import '../types-CKe8O0lR.mjs';
 
 /**
  * @astrasyncai/adapter-openclaw-browser

package/dist/browser/browser-adapter.d.ts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-DOeL-dIw.js';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bgn5gxHQ.js';
 import '../gateway/gateway.js';
-import '../types-Cwrvo30g.js';
+import '../types-CKe8O0lR.js';
 
 /**
  * @astrasyncai/adapter-openclaw-browser

package/dist/cli/index.d.mts

@@ -1,6 +1,6 @@
-import { b as LocalPurposeRule, d as LocalScope, c as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Cj92yKeA.mjs';
+import { b as LocalPurposeRule, d as LocalScope, c as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-B-ubjHER.mjs';
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import '../types-Cwrvo30g.mjs';
+import '../types-CKe8O0lR.mjs';
 import '../gateway/gateway.mjs';
 
 /**

package/dist/cli/index.d.ts

@@ -1,6 +1,6 @@
-import { b as LocalPurposeRule, d as LocalScope, c as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-DOeL-dIw.js';
+import { b as LocalPurposeRule, d as LocalScope, c as LocalRiskThresholds, L as LocalPolicy, P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bgn5gxHQ.js';
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import '../types-Cwrvo30g.js';
+import '../types-CKe8O0lR.js';
 import '../gateway/gateway.js';
 
 /**

package/dist/cursor/cursor-adapter.d.mts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.mjs';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Cj92yKeA.mjs';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-B-ubjHER.mjs';
 import '../gateway/gateway.mjs';
-import '../types-Cwrvo30g.mjs';
+import '../types-CKe8O0lR.mjs';
 
 /**
  * @astrasyncai/adapter-cursor

package/dist/cursor/cursor-adapter.d.ts

@@ -1,7 +1,7 @@
 import { PlatformAdapter, AdapterConfig } from '../adapter-interface/interface.js';
-import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-DOeL-dIw.js';
+import { P as PDLSSContext, V as VerificationDecision, A as AgentAction, I as InterceptResult } from '../types-Bgn5gxHQ.js';
 import '../gateway/gateway.js';
-import '../types-Cwrvo30g.js';
+import '../types-CKe8O0lR.js';
 
 /**
  * @astrasyncai/adapter-cursor

package/dist/cursor/extension.d.mts

@@ -1,8 +1,8 @@
 import { VSCodeAPI } from './cursor-adapter.mjs';
 import '../adapter-interface/interface.mjs';
 import '../gateway/gateway.mjs';
-import '../types-Cj92yKeA.mjs';
-import '../types-Cwrvo30g.mjs';
+import '../types-B-ubjHER.mjs';
+import '../types-CKe8O0lR.mjs';
 
 /**
  * VS Code Extension entry point for AstraSync Local Guard (Cursor/VS Code).

package/dist/cursor/extension.d.ts

@@ -1,8 +1,8 @@
 import { VSCodeAPI } from './cursor-adapter.js';
 import '../adapter-interface/interface.js';
 import '../gateway/gateway.js';
-import '../types-DOeL-dIw.js';
-import '../types-Cwrvo30g.js';
+import '../types-Bgn5gxHQ.js';
+import '../types-CKe8O0lR.js';
 
 /**
  * VS Code Extension entry point for AstraSync Local Guard (Cursor/VS Code).

package/dist/cursor/extension.js

@@ -3773,7 +3773,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.3.0";
+var SDK_VERSION = "3.6.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -3791,10 +3791,10 @@ var DEFAULT_CONFIG = {
   // through (`hasMinimumAccess('guidance', 'guidance') === true`).
   defaultAccessLevel: "none",
   // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
-  // Round-18.5 F4: cacheTtl deliberately unset. When undefined, cacheResult
-  // applies the split default (60s autonomous / 300s step-up). When the
-  // caller sets cacheTtl explicitly, that value is honoured uniformly.
-  // Set cacheTtl: 0 to disable caching entirely.
+  // cacheTtl deliberately unset. When undefined, cacheResult applies the 60s
+  // default; the caller's explicit value is honoured for cacheable results.
+  // Denials and step-up escalations are NEVER cached (3.6.0) regardless of
+  // cacheTtl. Set cacheTtl: 0 to disable caching entirely.
   debug: false
 };
 var initCheckPerformed = false;
@@ -3881,10 +3881,9 @@ function getCachedResult(request, counterpartyId) {
   }
   return null;
 }
-var DEFAULT_AUTONOMOUS_TTL_SECONDS = 60;
-var DEFAULT_STEP_UP_TTL_SECONDS = 300;
+var DEFAULT_CACHE_TTL_SECONDS = 60;
 function cacheResult(request, result, configuredTtl, counterpartyId) {
-  const ttlSeconds = configuredTtl && configuredTtl > 0 ? configuredTtl : result.requiresStepUp ? DEFAULT_STEP_UP_TTL_SECONDS : DEFAULT_AUTONOMOUS_TTL_SECONDS;
+  const ttlSeconds = configuredTtl && configuredTtl > 0 ? configuredTtl : DEFAULT_CACHE_TTL_SECONDS;
   const key = getCacheKey(request, counterpartyId);
   verificationCache.set(key, {
     result,
@@ -4026,7 +4025,7 @@ async function callVerifyAccessAPI(config, request) {
     };
   }
 }
-async function verify(config, request) {
+async function verify(config, request, options) {
   const mergedConfig = { ...DEFAULT_CONFIG, ...config };
   const urls = mergedConfig.apiBaseUrl ? getCachedWellKnownUrls(mergedConfig.apiBaseUrl) : void 0;
   if (!initCheckPerformed && !mergedConfig.disableInitChecks && mergedConfig.apiBaseUrl) {
@@ -4042,7 +4041,7 @@ async function verify(config, request) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0) {
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -4062,6 +4061,8 @@ async function verify(config, request) {
     console.log("[VerificationGateway] Calling verify-access API");
   }
   const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);
+  const rawServerDenialReasons = apiResponse.denialReasons;
+  const serverDenialReasons = Array.isArray(rawServerDenialReasons) && rawServerDenialReasons.length > 0 ? rawServerDenialReasons : void 0;
   if (!apiResponse.success) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
       source: "api_error",
@@ -4083,7 +4084,10 @@ async function verify(config, request) {
       // ALSO short-circuit on `!identityVerified || !policyAllowed` before
       // the gate check — belt-and-braces.
       accessLevel: "none",
-      denialReasons: aggregatedFailures && aggregatedFailures.length > 0 ? aggregatedFailures.map((f) => f.message) : apiResponse.access?.reason ? [apiResponse.access.reason] : ["Access denied"],
+      // 3.6.0: the server now emits top-level denialReasons on every deny
+      // path — prefer it verbatim; the failure-message reconstruction remains
+      // as the fallback for older backends.
+      denialReasons: serverDenialReasons ?? (aggregatedFailures && aggregatedFailures.length > 0 ? aggregatedFailures.map((f) => f.message) : apiResponse.access?.reason ? [apiResponse.access.reason] : ["Access denied"]),
       failures: aggregatedFailures,
       requiresStepUp: apiResponse.access?.requiresStepUp,
       requiresApproval: apiResponse.access?.requiresApproval,
@@ -4160,9 +4164,7 @@ async function verify(config, request) {
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
     result.accessLevel = "none";
-    result.denialReasons = result.recommendationReasons || [
-      "Access denied by AstraSync recommendation"
-    ];
+    result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Access denied by AstraSync recommendation"];
     result.guidance = result.runtimeChallenge ? {
       message: `Verification failed: ${result.runtimeChallenge.reason || "runtime challenge failed"}`,
       registrationUrl: urls?.registrationUrl ?? "",
@@ -4174,14 +4176,18 @@ async function verify(config, request) {
     };
   } else if (result.recommendation === "step_up_required") {
     result.requiresStepUp = true;
-    result.denialReasons = result.recommendationReasons || ["Step-up verification required"];
+    result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
   }
-  if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny") {
+  const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
+  if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
     cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
   }
   return result;
 }
 
+// src/adapters/stepup-poll.ts
+var FALLBACK_MAX_WAIT_MS = 5 * 60 * 1e3;
+
 // src/adapters/express.ts
 var DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;