@astrasyncai/verification-gateway 4.4.0 → 4.5.1

package/dist/edge-core/index.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "4.4.0";
+var SDK_VERSION = "4.5.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -789,12 +789,15 @@ async function verify(config, request, options) {
   const verificationContext = apiResponse.verificationContext;
   const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
-    // Round-18 G4: backend allowed access. Identity is verified (we resolved
-    // the caller to an agent) and policy passed all gates. Read idVerified
-    // from verificationContext for symmetry with the deny branch; default true
-    // on success path since `access.allowed === true` implies identity was
-    // resolvable (anonymous-allow paths flow through createGuidanceResponse).
-    identityVerified: apiResponse.verificationContext?.idVerified !== false,
+    // 4.5.0 (probe F1): read idVerified from verificationContext with the
+    // SAME absent⇒false default as the deny branch. The previous `!== false`
+    // default manufactured `identityVerified: true` for anonymous
+    // allow_full/allow_partial/audit responses (which allow access but omit
+    // verificationContext entirely) — the "anonymous caller labelled
+    // verified" defect. Every authenticated success response has carried
+    // `verificationContext.idVerified: true` since v2.2.4, so a truth claim
+    // this load-bearing must never be defaulted on.
+    identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
     accessLevel,
     agent,
@@ -1045,6 +1048,7 @@ function detectCommerce(req, host) {
 
 // src/edge-core/classify.ts
 var STATIC_EXTENSIONS = /\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|pdf|txt|xml)$/i;
+var SELF_UA_PATTERN = /^astrasync-sdk\//i;
 var BOT_UA_PATTERN = /curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i;
 var BROWSER_UA_PATTERN = /mozilla\/\d/i;
 function resolvePolicy(config, path) {
@@ -1061,6 +1065,9 @@ function resolvePolicy(config, path) {
 }
 function classify(req, host, depth) {
   const userAgent = headerValue(req, "user-agent") ?? "";
+  if (SELF_UA_PATTERN.test(userAgent)) {
+    return { tier: "self" };
+  }
   const credentials = extractCredentials(req.headers, {});
   if (credentials.astraId || credentials.apiKey || credentials.jwt) {
     return { tier: "verified", protocol: "x-astra" };
@@ -1091,7 +1098,7 @@ function classify(req, host, depth) {
   }
   return { tier: "human" };
 }
-var _patterns = { STATIC_EXTENSIONS, BOT_UA_PATTERN, BROWSER_UA_PATTERN };
+var _patterns = { STATIC_EXTENSIONS, BOT_UA_PATTERN, BROWSER_UA_PATTERN, SELF_UA_PATTERN };
 
 // src/edge-core/messaging.ts
 var PROTOCOL_MESSAGES = {
@@ -1131,6 +1138,20 @@ function buildDenyBody(outcome, apiBaseUrl) {
     }
   };
 }
+function buildUnavailableBody(outcome) {
+  return {
+    success: false,
+    error: {
+      code: "VERIFICATION_UNAVAILABLE",
+      message: "Agent verification is temporarily unavailable and this path enforces verification. Your identity was not evaluated and no denial was recorded \u2014 retry with exponential backoff.",
+      failures: outcome.reasons,
+      ...outcome.correlationId && { correlationId: outcome.correlationId },
+      guidance: {
+        message: "Retry the request with exponential backoff; the condition is transient."
+      }
+    }
+  };
+}
 function buildManualReviewBody(outcome) {
   return {
     success: false,
@@ -1173,6 +1194,14 @@ function applyOutcome(options, outcome, policy) {
   }
   switch (outcome.decision) {
     case "deny":
+      if (outcome.unavailable) {
+        return {
+          action: "respond",
+          status: 503,
+          headers: { "Retry-After": "30" },
+          bodyJson: buildUnavailableBody(outcome)
+        };
+      }
       return {
         action: "respond",
         status: 403,
@@ -1411,6 +1440,17 @@ function outcomeFromVerifyResult(classification, result) {
   };
   return outcome;
 }
+function unavailableOutcome(classification, policy, reason, correlationId) {
+  const outcome = baseOutcome(classification);
+  outcome.unavailable = true;
+  outcome.reasons = [reason];
+  if (correlationId) outcome.correlationId = correlationId;
+  if (policy.mode === "enforce") outcome.decision = "deny";
+  return outcome;
+}
+function isApiErrorResult(result) {
+  return (result.failures ?? []).some((f) => f.dimension === "verify_access.api_error") === true && !result.misconfigured;
+}
 async function runTier(options, req, classification, policy, apiKey, sampling) {
   const budgets = options.budgets ?? {};
   const beaconMs = budgets.beaconMs ?? 300;
@@ -1437,9 +1477,19 @@ async function runTier(options, req, classification, policy, apiKey, sampling) {
           verifyMs
         );
         if (!result) {
-          const outcome = baseOutcome(classification);
-          outcome.reasons = ["verify-access unreachable within budget \u2014 fail-open"];
-          return outcome;
+          return unavailableOutcome(
+            classification,
+            policy,
+            "verify-access unreachable within budget"
+          );
+        }
+        if (isApiErrorResult(result)) {
+          return unavailableOutcome(
+            classification,
+            policy,
+            result.denialReasons?.[0] ?? "verify-access api error",
+            result.correlationId
+          );
         }
         return outcomeFromVerifyResult(classification, result);
       }
@@ -1450,9 +1500,19 @@ async function runTier(options, req, classification, policy, apiKey, sampling) {
             verifyMs
           );
           if (!result) {
-            const outcome2 = baseOutcome(classification);
-            outcome2.reasons = ["verify-access unreachable within budget \u2014 fail-open"];
-            return outcome2;
+            return unavailableOutcome(
+              classification,
+              policy,
+              "verify-access unreachable within budget"
+            );
+          }
+          if (isApiErrorResult(result)) {
+            return unavailableOutcome(
+              classification,
+              policy,
+              result.denialReasons?.[0] ?? "verify-access api error",
+              result.correlationId
+            );
           }
           return outcomeFromVerifyResult(classification, result);
         }
@@ -1494,7 +1554,7 @@ async function evaluateEdgeRequest(options, req, config, apiKey) {
     if (policy.skip) return { policy, application: passUntouched() };
     const host = headerValue(req, "x-forwarded-host") ?? headerValue(req, "host") ?? new URL(options.counterpartyUrl).host;
     const classification = classify(req, host, policy.depth);
-    if (classification.tier === "human") {
+    if (classification.tier === "human" || classification.tier === "self") {
       return { policy, classification, application: passUntouched() };
     }
     const outcome = await runTier(options, req, classification, policy, apiKey, config.sampling);