@astrasyncai/verification-gateway 4.5.1 → 5.0.0

package/dist/adapters/sdk.d.mts

@@ -1,3 +1,3 @@
-import '../types-C0zfSXMB.mjs';
-export { V as VerificationGatewayClient, c as createClient, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-Bbh9B_dw.mjs';
+import '../types-CJjZvPr9.mjs';
+export { V as VerificationGatewayClient, c as createClient, g as getTrustLevel, v as verifyOnce } from '../sdk-B83N3xKc.mjs';
 import '../metadata-capture.mjs';

package/dist/adapters/sdk.d.ts

@@ -1,3 +1,3 @@
-import '../types-DwSfO7Sb.js';
-export { V as VerificationGatewayClient, c as createClient, e as getCapabilities, f as getTrustLevel, h as hasMinimumAccess, v as verifyOnce } from '../sdk-C6SASmsh.js';
+import '../types-BK2POWNc.js';
+export { V as VerificationGatewayClient, c as createClient, g as getTrustLevel, v as verifyOnce } from '../sdk-H_9BTNBS.js';
 import '../metadata-capture.js';

package/dist/adapters/sdk.js

@@ -22,15 +22,13 @@ var sdk_exports = {};
 __export(sdk_exports, {
   VerificationGatewayClient: () => VerificationGatewayClient,
   createClient: () => createClient,
-  getCapabilities: () => getCapabilities,
   getTrustLevel: () => getTrustLevel,
-  hasMinimumAccess: () => hasMinimumAccess,
   verifyOnce: () => verifyOnce
 });
 module.exports = __toCommonJS(sdk_exports);
 
 // src/version.ts
-var SDK_VERSION = "4.5.1";
+var SDK_VERSION = "5.0.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -50,84 +48,13 @@ function withUserAgent(initHeaders) {
 }
 var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
-// src/access-levels.ts
-var ACCESS_LEVEL_HIERARCHY = {
-  none: 0,
-  restricted: 1,
-  "read-only": 2,
-  standard: 3,
-  full: 4,
-  internal: 5
-};
+// src/trust-levels.ts
 function getTrustLevel(score) {
   if (score >= 80) return "PLATINUM";
   if (score >= 60) return "GOLD";
   if (score >= 40) return "SILVER";
   return "BRONZE";
 }
-function hasMinimumAccess(actual, required) {
-  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];
-}
-function getCapabilities(accessLevel) {
-  switch (accessLevel) {
-    case "none":
-      return {
-        canRead: false,
-        canWrite: false,
-        canDelete: false,
-        canAdmin: false,
-        canAccessInternal: false
-      };
-    case "restricted":
-      return {
-        canRead: false,
-        canWrite: false,
-        canDelete: false,
-        canAdmin: false,
-        canAccessInternal: false
-      };
-    case "read-only":
-      return {
-        canRead: true,
-        canWrite: false,
-        canDelete: false,
-        canAdmin: false,
-        canAccessInternal: false
-      };
-    case "standard":
-      return {
-        canRead: true,
-        canWrite: true,
-        canDelete: false,
-        canAdmin: false,
-        canAccessInternal: false
-      };
-    case "full":
-      return {
-        canRead: true,
-        canWrite: true,
-        canDelete: true,
-        canAdmin: false,
-        canAccessInternal: false
-      };
-    case "internal":
-      return {
-        canRead: true,
-        canWrite: true,
-        canDelete: true,
-        canAdmin: true,
-        canAccessInternal: true
-      };
-    default:
-      return {
-        canRead: false,
-        canWrite: false,
-        canDelete: false,
-        canAdmin: false,
-        canAccessInternal: false
-      };
-  }
-}
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -139,11 +66,6 @@ function getCachedWellKnownUrls(apiBaseUrl) {
 // src/verify.ts
 var DEFAULT_CONFIG = {
   apiBaseUrl: "https://astrasync.ai/api",
-  // v2.3.9 (defect #30): default for unconfigured callers is `'none'` (no
-  // access). Pre-rename this defaulted to `'guidance'`, which combined with
-  // a route gated at `'guidance'` to silently let unverified traffic
-  // through (`hasMinimumAccess('guidance', 'guidance') === true`).
-  defaultAccessLevel: "none",
   // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
   // cacheTtl deliberately unset. When undefined, cacheResult applies the 60s
   // default; the caller's explicit value is honoured for cacheable results.
@@ -307,13 +229,6 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // policy is not evaluated (we never reached the gate).
     identityVerified: false,
     policyAllowed: false,
-    // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
-    // Adapters additionally short-circuit on `!identityVerified ||
-    // !policyAllowed` before the gate check, but the access level still has
-    // to be honest at the data layer so downstream consumers (SDK adapters
-    // in other languages, custom integrations) inherit the correct
-    // semantics.
-    accessLevel: "none",
     guidance,
     denialReasons: reason ? [reason] : ["No valid agent credentials provided"],
     // Round-10 (#47, O5): on API-error fallback, surface a typed failure so
@@ -336,6 +251,11 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
     // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
     ...isMisconfig && { misconfigured: true },
+    // 4.6.0: a transient api_error is retryable — mark it so consumers surface
+    // "temporarily unavailable, retry" (recommendation 'error') instead of
+    // coercing the absent recommendation to a policy 'deny'. Misconfig is
+    // deterministic and intentionally NOT marked retryable.
+    ...isApiError && { retryable: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -402,7 +322,6 @@ async function callVerifyAccessAPI(config, request) {
         attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
-          accessLevel: "none",
           reason: "endpoint_deactivated",
           failures: [
             {
@@ -465,7 +384,7 @@ async function verify(config, request, options) {
   if (!deprecationWarningShown && (config.minTrustScore !== void 0 || config.minTrustScoreForFull !== void 0)) {
     deprecationWarningShown = true;
     console.warn(
-      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
+      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
@@ -511,14 +430,6 @@ async function verify(config, request, options) {
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
-      // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
-      // Pre-rename this hardcoded `'guidance'`, which conflated with the
-      // colocated `guidance: {...}` help-payload object below and let
-      // denied requests pass any route gated at `'guidance'` because
-      // `hasMinimumAccess('guidance', 'guidance') === true`. Adapters now
-      // ALSO short-circuit on `!identityVerified || !policyAllowed` before
-      // the gate check — belt-and-braces.
-      accessLevel: "none",
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -567,7 +478,6 @@ async function verify(config, request, options) {
     trustScore: apiResponse.organization.trustScore
   } : void 0;
   const verificationContext = apiResponse.verificationContext;
-  const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
     // 4.5.0 (probe F1): read idVerified from verificationContext with the
     // SAME absent⇒false default as the deny branch. The previous `!== false`
@@ -579,7 +489,6 @@ async function verify(config, request, options) {
     // this load-bearing must never be defaulted on.
     identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
-    accessLevel,
     agent,
     developer,
     organization,
@@ -606,7 +515,6 @@ async function verify(config, request, options) {
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
-    result.accessLevel = "none";
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Access denied by AstraSync recommendation"];
     result.guidance = result.runtimeChallenge ? {
       message: `Verification failed: ${result.runtimeChallenge.reason || "runtime challenge failed"}`,
@@ -635,7 +543,6 @@ async function quickVerify(config, credentials) {
   return {
     identityVerified: result.identityVerified,
     policyAllowed: result.policyAllowed,
-    accessLevel: result.accessLevel,
     reason: result.denialReasons?.[0]
   };
 }
@@ -646,7 +553,6 @@ var VerificationGatewayClient = class {
     this.config = {
       apiBaseUrl: options.apiBaseUrl,
       apiKey: options.apiKey,
-      defaultAccessLevel: options.defaultAccessLevel,
       minTrustScore: options.minTrustScore,
       minTrustScoreForFull: options.minTrustScoreForFull,
       cacheTtl: options.cacheTtl,
@@ -695,26 +601,6 @@ var VerificationGatewayClient = class {
   async quickVerify(credentials) {
     return this.executeWithRetry(() => quickVerify(this.config, credentials));
   }
-  /**
-   * Check if an agent has a specific access level.
-   *
-   * @deprecated 3.2.0 — the access-level band is informational only; it no
-   * longer gates in the middleware adapters (post-3.1.0 feedback #1). This
-   * explicit opt-in query still works, but prefer gating on the server-side
-   * policy decision (identity + policy + trust) or per-route `minTrustScore`.
-   * Explicit per-route condition→constraint rules are the Phase-2 successor.
-   */
-  async hasAccess(credentials, requiredLevel) {
-    const result = await this.quickVerify(credentials);
-    return hasMinimumAccess(result.accessLevel, requiredLevel);
-  }
-  /**
-   * Get capabilities for a verified agent
-   */
-  async getCapabilities(credentials) {
-    const result = await this.quickVerify(credentials);
-    return getCapabilities(result.accessLevel);
-  }
   /**
    * Verify a specific ASTRA-ID
    */
@@ -777,9 +663,7 @@ async function verifyOnce(options) {
 0 && (module.exports = {
   VerificationGatewayClient,
   createClient,
-  getCapabilities,
   getTrustLevel,
-  hasMinimumAccess,
   verifyOnce
 });
 //# sourceMappingURL=sdk.js.map