@astrasyncai/verification-gateway 4.5.0 → 4.6.0

package/dist/{express-DaqL11tx.d.ts → express-D-8Ks2Uo.d.ts}

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { x as VerificationResult, k as ExpressMiddlewareOptions, c as AstraSyncCredentials } from './types-DwSfO7Sb.js';
+import { x as VerificationResult, k as ExpressMiddlewareOptions, c as AstraSyncCredentials } from './types-CGPU7HLi.js';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/{express-CR6F3njD.d.mts → express-DBtPKXOL.d.mts}

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { x as VerificationResult, k as ExpressMiddlewareOptions, c as AstraSyncCredentials } from './types-C0zfSXMB.mjs';
+import { x as VerificationResult, k as ExpressMiddlewareOptions, c as AstraSyncCredentials } from './types-Cx9hTpKI.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/gateway/gateway.d.mts

@@ -1,5 +1,5 @@
-import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-C7Rb-w0d.mjs';
-import '../types-C0zfSXMB.mjs';
+import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-CfSJLS4i.mjs';
+import '../types-Cx9hTpKI.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/gateway/gateway.d.ts

@@ -1,5 +1,5 @@
-import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-nIh3HtuA.js';
-import '../types-DwSfO7Sb.js';
+import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-DhhJxKIC.js';
+import '../types-CGPU7HLi.js';
 import '../metadata-capture.js';
 
 /**

package/dist/gateway/gateway.js

@@ -257,9 +257,9 @@ var LocalEvaluator = class {
     if (scopeBlock) {
       return { recommendation: "DENY", reason: scopeBlock };
     }
-    const limitViolation = this.checkLimits(context);
-    if (limitViolation) {
-      return { recommendation: "DENY", reason: limitViolation };
+    const limitDecision = this.checkLimits(context);
+    if (limitDecision) {
+      return limitDecision;
     }
     if (context.purpose === "sub_agent.spawn" && this.policy.selfInstantiation) {
       if (!this.policy.selfInstantiation.allowed) {
@@ -324,9 +324,21 @@ var LocalEvaluator = class {
   checkLimits(context) {
     const limits = this.policy.limits;
     if (!limits) return null;
-    if (limits.maxTransactionAmount !== void 0 && context.transactionValue !== void 0) {
-      if (context.transactionValue > limits.maxTransactionAmount) {
-        return `Transaction value ${context.transactionValue} exceeds limit ${limits.maxTransactionAmount}`;
+    const value = context.transactionValue;
+    if (value !== void 0 && value > 0 && (limits.autonomousThreshold !== void 0 || limits.maxTransactionAmount !== void 0)) {
+      const autonomousThreshold = limits.autonomousThreshold ?? 0;
+      const hardLimit = limits.maxTransactionAmount ?? limits.autonomousThreshold ?? 0;
+      if (value > autonomousThreshold) {
+        if (value >= hardLimit) {
+          return {
+            recommendation: "DENY",
+            reason: `Transaction value ${value} at or above Hard Limit ${hardLimit}`
+          };
+        }
+        return {
+          recommendation: "MANUAL_REVIEW",
+          reason: `Transaction value ${value} is in the human-approval band (${autonomousThreshold}, ${hardLimit})`
+        };
       }
     }
     if (limits.maxRequestsPerHour !== void 0) {
@@ -339,7 +351,10 @@ var LocalEvaluator = class {
       } else {
         entry.count++;
         if (entry.count > limits.maxRequestsPerHour) {
-          return `Rate limit exceeded: ${entry.count}/${limits.maxRequestsPerHour} requests per hour`;
+          return {
+            recommendation: "DENY",
+            reason: `Rate limit exceeded: ${entry.count}/${limits.maxRequestsPerHour} requests per hour`
+          };
         }
       }
     }
@@ -3548,10 +3563,16 @@ function validatePurpose(purpose, path) {
     errors.push({ path: `${path}.targets`, message: "targets must be an array of strings" });
   }
   if (p.blockedPatterns !== void 0 && !isStringArray(p.blockedPatterns)) {
-    errors.push({ path: `${path}.blockedPatterns`, message: "blockedPatterns must be an array of strings" });
+    errors.push({
+      path: `${path}.blockedPatterns`,
+      message: "blockedPatterns must be an array of strings"
+    });
   }
   if (p.requiresApproval !== void 0 && typeof p.requiresApproval !== "boolean") {
-    errors.push({ path: `${path}.requiresApproval`, message: "requiresApproval must be a boolean" });
+    errors.push({
+      path: `${path}.requiresApproval`,
+      message: "requiresApproval must be a boolean"
+    });
   }
   return errors;
 }
@@ -3574,11 +3595,29 @@ function validateLimits(limits, path) {
     return [{ path, message: "limits must be an object" }];
   }
   const l = limits;
+  if (l.autonomousThreshold !== void 0 && typeof l.autonomousThreshold !== "number") {
+    errors.push({
+      path: `${path}.autonomousThreshold`,
+      message: "autonomousThreshold must be a number"
+    });
+  }
   if (l.maxTransactionAmount !== void 0 && typeof l.maxTransactionAmount !== "number") {
-    errors.push({ path: `${path}.maxTransactionAmount`, message: "maxTransactionAmount must be a number" });
+    errors.push({
+      path: `${path}.maxTransactionAmount`,
+      message: "maxTransactionAmount must be a number"
+    });
+  }
+  if (typeof l.autonomousThreshold === "number" && typeof l.maxTransactionAmount === "number" && l.autonomousThreshold > l.maxTransactionAmount) {
+    errors.push({
+      path: `${path}.autonomousThreshold`,
+      message: "autonomousThreshold (Autonomous Limit) must be <= maxTransactionAmount (Hard Limit)"
+    });
   }
   if (l.maxRequestsPerHour !== void 0 && typeof l.maxRequestsPerHour !== "number") {
-    errors.push({ path: `${path}.maxRequestsPerHour`, message: "maxRequestsPerHour must be a number" });
+    errors.push({
+      path: `${path}.maxRequestsPerHour`,
+      message: "maxRequestsPerHour must be a number"
+    });
   }
   if (l.currency !== void 0 && typeof l.currency !== "string") {
     errors.push({ path: `${path}.currency`, message: "currency must be a string" });
@@ -3593,7 +3632,10 @@ function validateRiskThresholds(thresholds, path) {
   const t = thresholds;
   for (const range of ["autoAllow", "requireApproval", "autoBlock"]) {
     if (!t[range] || typeof t[range] !== "object") {
-      errors.push({ path: `${path}.${range}`, message: `${range} is required and must be an object with min and max` });
+      errors.push({
+        path: `${path}.${range}`,
+        message: `${range} is required and must be an object with min and max`
+      });
       continue;
     }
     const r = t[range];
@@ -3698,7 +3740,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.5.0";
+var SDK_VERSION = "4.6.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -3922,6 +3964,11 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
     // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
     ...isMisconfig && { misconfigured: true },
+    // 4.6.0: a transient api_error is retryable — mark it so consumers surface
+    // "temporarily unavailable, retry" (recommendation 'error') instead of
+    // coercing the absent recommendation to a policy 'deny'. Misconfig is
+    // deterministic and intentionally NOT marked retryable.
+    ...isApiError && { retryable: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()