@astrasyncai/verification-gateway 3.7.1 → 3.9.0

package/dist/verify.js

@@ -0,0 +1,593 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/verify.ts
+var verify_exports = {};
+__export(verify_exports, {
+  clearCache: () => clearCache,
+  extractCredentials: () => extractCredentials,
+  fetchRoutes: () => fetchRoutes,
+  hasCredentials: () => hasCredentials,
+  quickVerify: () => quickVerify,
+  recordDecision: () => recordDecision,
+  reportCounterpartyPreCheckFailure: () => reportCounterpartyPreCheckFailure,
+  reportUnregisteredAttempt: () => reportUnregisteredAttempt,
+  verify: () => verify,
+  verifyAndRecord: () => verifyAndRecord
+});
+module.exports = __toCommonJS(verify_exports);
+
+// src/access-levels.ts
+function getTrustLevel(score) {
+  if (score >= 80) return "PLATINUM";
+  if (score >= 60) return "GOLD";
+  if (score >= 40) return "SILVER";
+  return "BRONZE";
+}
+
+// src/version.ts
+var SDK_VERSION = "3.9.0";
+
+// src/well-known.ts
+var CACHE_TTL_MS = 60 * 60 * 1e3;
+var cache = /* @__PURE__ */ new Map();
+function getCachedWellKnownUrls(apiBaseUrl) {
+  return cache.get(apiBaseUrl)?.data;
+}
+
+// src/verify.ts
+var DEFAULT_CONFIG = {
+  apiBaseUrl: "https://astrasync.ai/api",
+  // v2.3.9 (defect #30): default for unconfigured callers is `'none'` (no
+  // access). Pre-rename this defaulted to `'guidance'`, which combined with
+  // a route gated at `'guidance'` to silently let unverified traffic
+  // through (`hasMinimumAccess('guidance', 'guidance') === true`).
+  defaultAccessLevel: "none",
+  // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
+  // cacheTtl deliberately unset. When undefined, cacheResult applies the 60s
+  // default; the caller's explicit value is honoured for cacheable results.
+  // Denials and step-up escalations are NEVER cached (3.6.0) regardless of
+  // cacheTtl. Set cacheTtl: 0 to disable caching entirely.
+  debug: false
+};
+var initCheckPerformed = false;
+var deprecationWarningShown = false;
+async function performInitCheck(apiBaseUrl, debug, strictInit) {
+  initCheckPerformed = true;
+  try {
+    const probeUrl = `${apiBaseUrl}/agents/verify-access`;
+    const response = await fetch(probeUrl, { method: "HEAD" });
+    const contentType = response.headers.get("content-type") ?? "";
+    if (contentType.startsWith("text/html")) {
+      const message = `[VerificationGateway] apiBaseUrl '${apiBaseUrl}' returned HTML (content-type: ${contentType}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;
+      if (strictInit) {
+        throw new Error(`${message} (strictInit=true)`);
+      }
+      console.warn(`${message} Set disableInitChecks: true on GatewayConfig to silence.`);
+    } else if (debug) {
+      console.log(
+        `[VerificationGateway] init check passed for ${apiBaseUrl} (content-type: ${contentType})`
+      );
+    }
+  } catch (err) {
+    if (strictInit) {
+      throw err;
+    }
+    if (debug) {
+      console.log(`[VerificationGateway] init check failed (non-blocking): ${String(err)}`);
+    }
+  }
+}
+var verificationCache = /* @__PURE__ */ new Map();
+function getCacheKey(request, counterpartyId) {
+  const c = request.credentials;
+  return [
+    c.astraId || "",
+    c.apiKey || "",
+    c.jwt || "",
+    request.purpose || "",
+    request.action || "",
+    request.resourceType || "",
+    request.resource || "",
+    request.jurisdiction || "",
+    request.transactionValue ?? "",
+    request.currency || "",
+    // SECURITY (cross-merchant cache leak): the merchant identity is sent via
+    // `config.counterpartyId`, NOT on the request, so it was previously absent
+    // from the key — two verifies for the SAME agent/purpose/action/value but
+    // DIFFERENT merchants collided, and a grant at a permissive merchant (low
+    // trust floor) was served for a stricter one. Same bug class as the
+    // duration omission (F-A1-07). counterpartyId affects the backend verdict
+    // (trust floor / per-route policy), so it MUST key the cache.
+    counterpartyId || "",
+    request.counterpartyUrl || "",
+    request.counterpartyType || "",
+    request.isSubAgentRequest ? "1" : "0",
+    request.parentAgentId || "",
+    request.subAgentDepth ?? "",
+    // Audit F-A1-07: previously-missing dimensions that DO affect the
+    // backend verdict. Without these, two requests with different
+    // durations (e.g. 60s vs 86400s) collided on the same cache key and
+    // the shorter-duration allow served the longer-duration request.
+    request.durationRequired ?? "",
+    request.invocationProtocol || "",
+    request.enableRuntimeChallenge ? "1" : "0",
+    // callerMetadata fields contribute to risk model; include the ones
+    // backend reads. sourceIp/userAgent/forwardedFor change per-request
+    // so their inclusion effectively forces a re-check for any varying
+    // client (the right behavior — IP-driven anomaly scoring shouldn't
+    // be cached across IPs).
+    request.callerMetadata?.sourceIp || "",
+    request.callerMetadata?.userAgent || "",
+    request.callerMetadata?.forwardedFor || "",
+    request.callerMetadata?.agentCardUrl || ""
+  ].join("|");
+}
+function getCachedResult(request, counterpartyId) {
+  const key = getCacheKey(request, counterpartyId);
+  const cached = verificationCache.get(key);
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.result;
+  }
+  if (cached) {
+    verificationCache.delete(key);
+  }
+  return null;
+}
+var DEFAULT_CACHE_TTL_SECONDS = 60;
+function cacheResult(request, result, configuredTtl, counterpartyId) {
+  const ttlSeconds = configuredTtl && configuredTtl > 0 ? configuredTtl : DEFAULT_CACHE_TTL_SECONDS;
+  const key = getCacheKey(request, counterpartyId);
+  verificationCache.set(key, {
+    result,
+    expiresAt: Date.now() + ttlSeconds * 1e3
+  });
+}
+function clearCache() {
+  verificationCache.clear();
+}
+function extractCredentials(headers, query) {
+  const credentials = {};
+  const ASTRA_ID_PATTERN = /^ASTRAE?-[A-Za-z0-9_-]{1,64}$/;
+  const astraIdHeader = headers["x-astra-id"] || headers["X-Astra-Id"] || headers["X-ASTRA-ID"] || headers["x-astra-agentid"] || headers["X-Astra-AgentId"] || headers["x-astra-agent-id"] || headers["X-Astra-Agent-Id"] || headers["X-ASTRA-AGENT-ID"];
+  if (astraIdHeader) {
+    const raw = Array.isArray(astraIdHeader) ? astraIdHeader[0] : typeof astraIdHeader === "string" ? astraIdHeader : void 0;
+    if (typeof raw === "string" && ASTRA_ID_PATTERN.test(raw)) {
+      credentials.astraId = raw;
+    }
+  }
+  const apiKeyHeader = headers["x-api-key"] || headers["X-Api-Key"] || headers["X-API-KEY"];
+  if (apiKeyHeader) {
+    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;
+  }
+  const authHeader = headers["authorization"] || headers["Authorization"];
+  if (authHeader) {
+    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+    if (typeof authValue === "string") {
+      credentials.authorizationHeader = authValue;
+      if (authValue.startsWith("Bearer ")) {
+        credentials.jwt = authValue.slice(7);
+      }
+    }
+  }
+  if (query) {
+    if (query.astraId && !credentials.astraId) {
+      credentials.astraId = query.astraId;
+    }
+    if (query.apiKey && !credentials.apiKey) {
+      credentials.apiKey = query.apiKey;
+    }
+  }
+  return credentials;
+}
+function hasCredentials(credentials) {
+  return !!(credentials.astraId || credentials.apiKey || credentials.jwt);
+}
+function createGuidanceResponse(_config, reason, options = {}) {
+  const source = options.source ?? "no_credentials";
+  const isApiError = source === "api_error";
+  const urls = options.urls;
+  const guidance = isApiError ? {
+    message: "Verification is temporarily unavailable. Retry with exponential backoff; if the issue persists, contact support with the correlationId.",
+    registrationUrl: urls?.registrationUrl ?? "",
+    documentationUrl: urls?.documentationUrl ?? "",
+    steps: [
+      "Retry the request with exponential backoff",
+      "If failures persist, share the correlationId with support"
+    ]
+  } : {
+    message: "This service verifies AI agents before granting access. Please register your agent with AstraSync.",
+    registrationUrl: urls?.registrationUrl ?? "",
+    documentationUrl: urls?.documentationUrl ?? "",
+    steps: [
+      "Register for an AstraSync account",
+      "Create and register your agent",
+      "Add your ASTRA-ID to request headers",
+      "Retry your request"
+    ]
+  };
+  return {
+    // Round-18 G4: createGuidanceResponse fires for unverified-agent path or
+    // API-error fallback. Identity is not verified (no agent resolved);
+    // policy is not evaluated (we never reached the gate).
+    identityVerified: false,
+    policyAllowed: false,
+    // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
+    // Adapters additionally short-circuit on `!identityVerified ||
+    // !policyAllowed` before the gate check, but the access level still has
+    // to be honest at the data layer so downstream consumers (SDK adapters
+    // in other languages, custom integrations) inherit the correct
+    // semantics.
+    accessLevel: "none",
+    guidance,
+    denialReasons: reason ? [reason] : ["No valid agent credentials provided"],
+    // Round-10 (#47, O5): on API-error fallback, surface a typed failure so
+    // partners (and their custom onDenied handlers) can branch on
+    // dimension. Without this, the synthesised stub was indistinguishable
+    // from a real policy deny.
+    failures: isApiError ? [
+      {
+        dimension: "verify_access.api_error",
+        message: reason ?? "Verification temporarily unavailable",
+        guidance: guidance.message
+      }
+    ] : void 0,
+    correlationId: options.correlationId,
+    verifiedAt: /* @__PURE__ */ new Date()
+  };
+}
+async function callVerifyAccessAPI(config, request) {
+  const { credentials, ...requestData } = request;
+  const body = {
+    ...credentials.astraId && { agentId: credentials.astraId },
+    ...requestData.purpose && { purpose: requestData.purpose }
+  };
+  if (requestData.action) body.action = requestData.action;
+  if (requestData.resourceType) body.resourceType = requestData.resourceType;
+  if (requestData.resource) body.resource = requestData.resource;
+  if (requestData.jurisdiction) body.jurisdiction = requestData.jurisdiction;
+  if (requestData.transactionValue) body.transactionValue = requestData.transactionValue;
+  if (requestData.currency) body.currency = requestData.currency;
+  if (requestData.isSubAgentRequest) body.isSubAgentRequest = requestData.isSubAgentRequest;
+  if (requestData.parentAgentId) body.parentAgentId = requestData.parentAgentId;
+  if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
+  if (requestData.enableRuntimeChallenge)
+    body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.createSession) body.createSession = requestData.createSession;
+  if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
+  if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
+  if (requestData.counterpartyUrl) body.counterpartyUrl = requestData.counterpartyUrl;
+  if (config.counterpartyId) body.counterpartyId = config.counterpartyId;
+  if (requestData.runtimeChallengeOptions)
+    body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
+  if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
+  if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
+  body.sdkVersion = SDK_VERSION;
+  if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
+    const meta = {
+      ...requestData.clientIp && { sourceIp: requestData.clientIp },
+      ...requestData.userAgent && { userAgent: requestData.userAgent },
+      ...requestData.callerMetadata
+    };
+    if (Object.keys(meta).length > 0) body.callerMetadata = meta;
+  }
+  const headers = {
+    "Content-Type": "application/json",
+    ...config.customHeaders
+  };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  try {
+    const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+    const data = await response.json();
+    if (response.status === 410) {
+      return {
+        success: true,
+        access: {
+          allowed: false,
+          accessLevel: "none",
+          reason: "endpoint_deactivated",
+          failures: [
+            {
+              dimension: "endpoint.deactivated",
+              message: typeof data?.message === "string" ? data.message : "Endpoint has been deactivated",
+              guidance: typeof data?.guidance === "string" ? data.guidance : "Reactivate via POST /api/endpoints/{id}/reactivate, or update the URL on the calling agent."
+            }
+          ]
+        }
+      };
+    }
+    if (!response.ok) {
+      return {
+        success: false,
+        error: data.message || data.error || `API returned ${response.status}`,
+        correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0
+      };
+    }
+    return data;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return {
+      success: false,
+      error: `Failed to call verify-access API: ${message}`
+    };
+  }
+}
+async function verify(config, request, options) {
+  const mergedConfig = { ...DEFAULT_CONFIG, ...config };
+  const urls = mergedConfig.apiBaseUrl ? getCachedWellKnownUrls(mergedConfig.apiBaseUrl) : void 0;
+  if (!initCheckPerformed && !mergedConfig.disableInitChecks && mergedConfig.apiBaseUrl) {
+    if (mergedConfig.strictInit) {
+      await performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug, true);
+    } else {
+      void performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug, false);
+    }
+  }
+  if (!deprecationWarningShown && (config.minTrustScore !== void 0 || config.minTrustScoreForFull !== void 0)) {
+    deprecationWarningShown = true;
+    console.warn(
+      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
+    );
+  }
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+    const cached = getCachedResult(request, mergedConfig.counterpartyId);
+    if (cached) {
+      if (mergedConfig.debug) {
+        console.log("[VerificationGateway] Returning cached result");
+      }
+      return cached;
+    }
+  }
+  const enrichedRequest = { ...request };
+  if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {
+    enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;
+  }
+  if (!enrichedRequest.counterpartyType && mergedConfig.counterpartyType) {
+    enrichedRequest.counterpartyType = mergedConfig.counterpartyType;
+  }
+  if (mergedConfig.debug) {
+    console.log("[VerificationGateway] Calling verify-access API");
+  }
+  const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);
+  const rawServerDenialReasons = apiResponse.denialReasons;
+  const serverDenialReasons = Array.isArray(rawServerDenialReasons) && rawServerDenialReasons.length > 0 ? rawServerDenialReasons : void 0;
+  if (!apiResponse.success) {
+    return createGuidanceResponse(mergedConfig, apiResponse.error, {
+      source: "api_error",
+      correlationId: apiResponse.correlationId,
+      urls
+    });
+  }
+  if (!apiResponse.access?.allowed) {
+    const aggregatedFailures = apiResponse.access?.failures;
+    const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true;
+    const result2 = {
+      identityVerified: idVerifiedFromBackend,
+      policyAllowed: false,
+      // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
+      // Pre-rename this hardcoded `'guidance'`, which conflated with the
+      // colocated `guidance: {...}` help-payload object below and let
+      // denied requests pass any route gated at `'guidance'` because
+      // `hasMinimumAccess('guidance', 'guidance') === true`. Adapters now
+      // ALSO short-circuit on `!identityVerified || !policyAllowed` before
+      // the gate check — belt-and-braces.
+      accessLevel: "none",
+      // 3.6.0: the server now emits top-level denialReasons on every deny
+      // path — prefer it verbatim; the failure-message reconstruction remains
+      // as the fallback for older backends.
+      denialReasons: serverDenialReasons ?? (aggregatedFailures && aggregatedFailures.length > 0 ? aggregatedFailures.map((f) => f.message) : apiResponse.access?.reason ? [apiResponse.access.reason] : ["Access denied"]),
+      failures: aggregatedFailures,
+      requiresStepUp: apiResponse.access?.requiresStepUp,
+      requiresApproval: apiResponse.access?.requiresApproval,
+      guidance: {
+        message: apiResponse.access?.reason || "Access denied by PDLSS policy",
+        registrationUrl: urls?.registrationUrl ?? "",
+        documentationUrl: urls?.documentationUrl ?? ""
+      },
+      verifiedAt: /* @__PURE__ */ new Date(),
+      // Extract sessionId so decisions can be recorded for denials too
+      sessionId: apiResponse.sessionId,
+      // Anonymous traffic has no session → correlationId is the per-attempt
+      // linking key (the sessionId-equivalent for anonymous callers).
+      correlationId: apiResponse.correlationId,
+      recommendation: apiResponse.recommendation,
+      recommendationReasons: apiResponse.recommendationReasons,
+      stepUpApproval: apiResponse.stepUpApproval,
+      settlement: apiResponse.settlement
+    };
+    return result2;
+  }
+  const agent = apiResponse.agent ? {
+    astraId: apiResponse.agent.astraId,
+    name: apiResponse.agent.name,
+    trustScore: apiResponse.agent.trustScore,
+    trustLevel: getTrustLevel(apiResponse.agent.trustScore),
+    blockchainVerified: apiResponse.agent.blockchainStatus === "verified",
+    status: apiResponse.agent.agentStatus
+  } : void 0;
+  const developer = apiResponse.developer ? {
+    astradId: apiResponse.developer.kyaOwnerId,
+    name: apiResponse.developer.fullName,
+    trustScore: apiResponse.developer.trustScore || 0,
+    verified: apiResponse.developer.identityVerified
+  } : void 0;
+  const organization = apiResponse.organization ? {
+    name: apiResponse.organization.name,
+    verified: apiResponse.organization.verified,
+    trustScore: apiResponse.organization.trustScore
+  } : void 0;
+  const verificationContext = apiResponse.verificationContext;
+  const accessLevel = apiResponse.access?.accessLevel ?? "standard";
+  const result = {
+    // Round-18 G4: backend allowed access. Identity is verified (we resolved
+    // the caller to an agent) and policy passed all gates. Read idVerified
+    // from verificationContext for symmetry with the deny branch; default true
+    // on success path since `access.allowed === true` implies identity was
+    // resolvable (anonymous-allow paths flow through createGuidanceResponse).
+    identityVerified: apiResponse.verificationContext?.idVerified !== false,
+    policyAllowed: true,
+    accessLevel,
+    agent,
+    developer,
+    organization,
+    appliedPolicy: apiResponse.access?.appliedPolicy,
+    verificationContext,
+    requiresStepUp: apiResponse.access?.requiresStepUp,
+    requiresApproval: apiResponse.access?.requiresApproval,
+    verifiedAt: /* @__PURE__ */ new Date(),
+    cacheTtl: mergedConfig.cacheTtl,
+    // Handshake Protocol v10 enhanced fields (present when backend returns them)
+    sessionId: apiResponse.sessionId,
+    // v2.3.10 (defect #34, round-4): anonymous responses surface correlationId
+    // (no session row exists for unverified callers).
+    correlationId: apiResponse.correlationId,
+    runtimeChallenge: apiResponse.runtimeChallenge,
+    tokenGuidance: apiResponse.tokenGuidance,
+    recommendation: apiResponse.recommendation,
+    recommendationReasons: apiResponse.recommendationReasons,
+    warningHeader: apiResponse.warningHeader,
+    stepUpApproval: apiResponse.stepUpApproval,
+    settlement: apiResponse.settlement
+  };
+  if (result.recommendation === "deny") {
+    result.policyAllowed = false;
+    result.accessLevel = "none";
+    result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Access denied by AstraSync recommendation"];
+    result.guidance = result.runtimeChallenge ? {
+      message: `Verification failed: ${result.runtimeChallenge.reason || "runtime challenge failed"}`,
+      registrationUrl: urls?.registrationUrl ?? "",
+      documentationUrl: urls?.documentationUrl ?? ""
+    } : {
+      message: result.recommendationReasons?.[0] || "Access denied by AstraSync recommendation",
+      registrationUrl: urls?.registrationUrl ?? "",
+      documentationUrl: urls?.documentationUrl ?? ""
+    };
+  } else if (result.recommendation === "step_up_required") {
+    result.requiresStepUp = true;
+    result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
+  }
+  const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
+  if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
+    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+  }
+  return result;
+}
+async function recordDecision(config, sessionId, decision, reason) {
+  const headers = { "Content-Type": "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ decision, reason })
+  }).catch(() => {
+  });
+}
+async function fetchRoutes(config, counterpartyId) {
+  if (!counterpartyId) return null;
+  const headers = { "Content-Type": "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  try {
+    const response = await fetch(
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes`,
+      { method: "GET", headers }
+    );
+    if (!response.ok) return null;
+    const body = await response.json();
+    return body.data?.routes ?? [];
+  } catch {
+    return null;
+  }
+}
+async function verifyAndRecord(config, request, options) {
+  const mergedConfig = { ...DEFAULT_CONFIG, ...config };
+  const result = await verify(mergedConfig, { ...request, createSession: true }, options);
+  const sessionId = result.sessionId;
+  if (sessionId) {
+    if (result.identityVerified && result.policyAllowed) {
+      recordDecision(mergedConfig, sessionId, "granted").catch(() => {
+      });
+    } else {
+      recordDecision(mergedConfig, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
+      });
+    }
+  }
+  return result;
+}
+async function reportUnregisteredAttempt(config, data) {
+  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
+  const { counterpartyUrl, ...rest } = data;
+  const body = {
+    ...rest,
+    ...counterpartyUrl && { counterpartyUrl },
+    ...config.counterpartyId && { counterpartyId: config.counterpartyId }
+  };
+  await fetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  }).catch(() => {
+  });
+}
+async function reportCounterpartyPreCheckFailure(config, data) {
+  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
+  await fetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(data)
+  }).catch(() => {
+  });
+}
+async function quickVerify(config, credentials) {
+  const result = await verify(config, {
+    credentials,
+    purpose: "verification"
+  });
+  return {
+    identityVerified: result.identityVerified,
+    policyAllowed: result.policyAllowed,
+    accessLevel: result.accessLevel,
+    reason: result.denialReasons?.[0]
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  clearCache,
+  extractCredentials,
+  fetchRoutes,
+  hasCredentials,
+  quickVerify,
+  recordDecision,
+  reportCounterpartyPreCheckFailure,
+  reportUnregisteredAttempt,
+  verify,
+  verifyAndRecord
+});
+//# sourceMappingURL=verify.js.map