@astrasyncai/verification-gateway 4.5.1 → 5.0.0

package/dist/bin/astrasync-guard.js

@@ -3137,10 +3137,16 @@ function validatePurpose(purpose, path2) {
     errors.push({ path: `${path2}.targets`, message: "targets must be an array of strings" });
   }
   if (p.blockedPatterns !== void 0 && !isStringArray(p.blockedPatterns)) {
-    errors.push({ path: `${path2}.blockedPatterns`, message: "blockedPatterns must be an array of strings" });
+    errors.push({
+      path: `${path2}.blockedPatterns`,
+      message: "blockedPatterns must be an array of strings"
+    });
   }
   if (p.requiresApproval !== void 0 && typeof p.requiresApproval !== "boolean") {
-    errors.push({ path: `${path2}.requiresApproval`, message: "requiresApproval must be a boolean" });
+    errors.push({
+      path: `${path2}.requiresApproval`,
+      message: "requiresApproval must be a boolean"
+    });
   }
   return errors;
 }
@@ -3163,11 +3169,29 @@ function validateLimits(limits, path2) {
     return [{ path: path2, message: "limits must be an object" }];
   }
   const l = limits;
+  if (l.autonomousThreshold !== void 0 && typeof l.autonomousThreshold !== "number") {
+    errors.push({
+      path: `${path2}.autonomousThreshold`,
+      message: "autonomousThreshold must be a number"
+    });
+  }
   if (l.maxTransactionAmount !== void 0 && typeof l.maxTransactionAmount !== "number") {
-    errors.push({ path: `${path2}.maxTransactionAmount`, message: "maxTransactionAmount must be a number" });
+    errors.push({
+      path: `${path2}.maxTransactionAmount`,
+      message: "maxTransactionAmount must be a number"
+    });
+  }
+  if (typeof l.autonomousThreshold === "number" && typeof l.maxTransactionAmount === "number" && l.autonomousThreshold > l.maxTransactionAmount) {
+    errors.push({
+      path: `${path2}.autonomousThreshold`,
+      message: "autonomousThreshold (Autonomous Limit) must be <= maxTransactionAmount (Hard Limit)"
+    });
   }
   if (l.maxRequestsPerHour !== void 0 && typeof l.maxRequestsPerHour !== "number") {
-    errors.push({ path: `${path2}.maxRequestsPerHour`, message: "maxRequestsPerHour must be a number" });
+    errors.push({
+      path: `${path2}.maxRequestsPerHour`,
+      message: "maxRequestsPerHour must be a number"
+    });
   }
   if (l.currency !== void 0 && typeof l.currency !== "string") {
     errors.push({ path: `${path2}.currency`, message: "currency must be a string" });
@@ -3182,7 +3206,10 @@ function validateRiskThresholds(thresholds, path2) {
   const t = thresholds;
   for (const range of ["autoAllow", "requireApproval", "autoBlock"]) {
     if (!t[range] || typeof t[range] !== "object") {
-      errors.push({ path: `${path2}.${range}`, message: `${range} is required and must be an object with min and max` });
+      errors.push({
+        path: `${path2}.${range}`,
+        message: `${range} is required and must be an object with min and max`
+      });
       continue;
     }
     const r = t[range];
@@ -3678,7 +3705,7 @@ Policy saved to ${outputPath}`);
 };
 
 // src/version.ts
-var SDK_VERSION = "4.5.1";
+var SDK_VERSION = "5.0.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4419,9 +4446,9 @@ var LocalEvaluator = class {
     if (scopeBlock) {
       return { recommendation: "DENY", reason: scopeBlock };
     }
-    const limitViolation = this.checkLimits(context);
-    if (limitViolation) {
-      return { recommendation: "DENY", reason: limitViolation };
+    const limitDecision = this.checkLimits(context);
+    if (limitDecision) {
+      return limitDecision;
     }
     if (context.purpose === "sub_agent.spawn" && this.policy.selfInstantiation) {
       if (!this.policy.selfInstantiation.allowed) {
@@ -4486,9 +4513,21 @@ var LocalEvaluator = class {
   checkLimits(context) {
     const limits = this.policy.limits;
     if (!limits) return null;
-    if (limits.maxTransactionAmount !== void 0 && context.transactionValue !== void 0) {
-      if (context.transactionValue > limits.maxTransactionAmount) {
-        return `Transaction value ${context.transactionValue} exceeds limit ${limits.maxTransactionAmount}`;
+    const value = context.transactionValue;
+    if (value !== void 0 && value > 0 && (limits.autonomousThreshold !== void 0 || limits.maxTransactionAmount !== void 0)) {
+      const autonomousThreshold = limits.autonomousThreshold ?? 0;
+      const hardLimit = limits.maxTransactionAmount ?? limits.autonomousThreshold ?? 0;
+      if (value > autonomousThreshold) {
+        if (value >= hardLimit) {
+          return {
+            recommendation: "DENY",
+            reason: `Transaction value ${value} at or above Hard Limit ${hardLimit}`
+          };
+        }
+        return {
+          recommendation: "MANUAL_REVIEW",
+          reason: `Transaction value ${value} is in the human-approval band (${autonomousThreshold}, ${hardLimit})`
+        };
       }
     }
     if (limits.maxRequestsPerHour !== void 0) {
@@ -4501,7 +4540,10 @@ var LocalEvaluator = class {
       } else {
         entry.count++;
         if (entry.count > limits.maxRequestsPerHour) {
-          return `Rate limit exceeded: ${entry.count}/${limits.maxRequestsPerHour} requests per hour`;
+          return {
+            recommendation: "DENY",
+            reason: `Rate limit exceeded: ${entry.count}/${limits.maxRequestsPerHour} requests per hour`
+          };
         }
       }
     }
@@ -4621,7 +4663,7 @@ function verifyLocal(evaluator, context) {
   return evaluator.evaluate(context);
 }
 
-// src/access-levels.ts
+// src/trust-levels.ts
 function getTrustLevel(score) {
   if (score >= 80) return "PLATINUM";
   if (score >= 60) return "GOLD";
@@ -4639,11 +4681,6 @@ function getCachedWellKnownUrls(apiBaseUrl) {
 // src/verify.ts
 var DEFAULT_CONFIG = {
   apiBaseUrl: "https://astrasync.ai/api",
-  // v2.3.9 (defect #30): default for unconfigured callers is `'none'` (no
-  // access). Pre-rename this defaulted to `'guidance'`, which combined with
-  // a route gated at `'guidance'` to silently let unverified traffic
-  // through (`hasMinimumAccess('guidance', 'guidance') === true`).
-  defaultAccessLevel: "none",
   // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
   // cacheTtl deliberately unset. When undefined, cacheResult applies the 60s
   // default; the caller's explicit value is honoured for cacheable results.
@@ -4804,13 +4841,6 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // policy is not evaluated (we never reached the gate).
     identityVerified: false,
     policyAllowed: false,
-    // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
-    // Adapters additionally short-circuit on `!identityVerified ||
-    // !policyAllowed` before the gate check, but the access level still has
-    // to be honest at the data layer so downstream consumers (SDK adapters
-    // in other languages, custom integrations) inherit the correct
-    // semantics.
-    accessLevel: "none",
     guidance,
     denialReasons: reason ? [reason] : ["No valid agent credentials provided"],
     // Round-10 (#47, O5): on API-error fallback, surface a typed failure so
@@ -4833,6 +4863,11 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
     // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
     ...isMisconfig && { misconfigured: true },
+    // 4.6.0: a transient api_error is retryable — mark it so consumers surface
+    // "temporarily unavailable, retry" (recommendation 'error') instead of
+    // coercing the absent recommendation to a policy 'deny'. Misconfig is
+    // deterministic and intentionally NOT marked retryable.
+    ...isApiError && { retryable: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -4899,7 +4934,6 @@ async function callVerifyAccessAPI(config, request2) {
         attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
-          accessLevel: "none",
           reason: "endpoint_deactivated",
           failures: [
             {
@@ -4962,7 +4996,7 @@ async function verify(config, request2, options) {
   if (!deprecationWarningShown && (config.minTrustScore !== void 0 || config.minTrustScoreForFull !== void 0)) {
     deprecationWarningShown = true;
     console.warn(
-      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
+      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
@@ -5008,14 +5042,6 @@ async function verify(config, request2, options) {
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
-      // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
-      // Pre-rename this hardcoded `'guidance'`, which conflated with the
-      // colocated `guidance: {...}` help-payload object below and let
-      // denied requests pass any route gated at `'guidance'` because
-      // `hasMinimumAccess('guidance', 'guidance') === true`. Adapters now
-      // ALSO short-circuit on `!identityVerified || !policyAllowed` before
-      // the gate check — belt-and-braces.
-      accessLevel: "none",
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -5064,7 +5090,6 @@ async function verify(config, request2, options) {
     trustScore: apiResponse.organization.trustScore
   } : void 0;
   const verificationContext = apiResponse.verificationContext;
-  const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
     // 4.5.0 (probe F1): read idVerified from verificationContext with the
     // SAME absent⇒false default as the deny branch. The previous `!== false`
@@ -5076,7 +5101,6 @@ async function verify(config, request2, options) {
     // this load-bearing must never be defaulted on.
     identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
-    accessLevel,
     agent,
     developer,
     organization,
@@ -5103,7 +5127,6 @@ async function verify(config, request2, options) {
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
-    result.accessLevel = "none";
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Access denied by AstraSync recommendation"];
     result.guidance = result.runtimeChallenge ? {
       message: `Verification failed: ${result.runtimeChallenge.reason || "runtime challenge failed"}`,
@@ -5216,7 +5239,6 @@ function toGatewayConfig(config) {
   return {
     apiBaseUrl: config.apiBaseUrl || "https://api.astrasync.ai",
     apiKey: config.apiKey,
-    defaultAccessLevel: config.defaultAccessLevel,
     minTrustScore: config.minTrustScore,
     minTrustScoreForFull: config.minTrustScoreForFull,
     cacheTtl: config.cacheTtl,
@@ -5244,7 +5266,7 @@ function toDecision(result) {
   if (result.identityVerified && result.policyAllowed) {
     return {
       recommendation: "ALLOW",
-      reason: `Verified with access level: ${result.accessLevel}`,
+      reason: result.agent?.trustScore ? `Verified (trust score ${result.agent.trustScore})` : "Verified",
       trustScore: result.agent?.trustScore,
       sessionId: "sessionId" in result ? result.sessionId : void 0
     };

package/dist/bin/astrasync.js

@@ -6,8 +6,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -31,7 +36,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    SDK_VERSION = "4.5.1";
+    SDK_VERSION = "5.0.0";
   }
 });
 
@@ -3477,10 +3482,16 @@ function validatePurpose(purpose, path2) {
     errors.push({ path: `${path2}.targets`, message: "targets must be an array of strings" });
   }
   if (p.blockedPatterns !== void 0 && !isStringArray(p.blockedPatterns)) {
-    errors.push({ path: `${path2}.blockedPatterns`, message: "blockedPatterns must be an array of strings" });
+    errors.push({
+      path: `${path2}.blockedPatterns`,
+      message: "blockedPatterns must be an array of strings"
+    });
   }
   if (p.requiresApproval !== void 0 && typeof p.requiresApproval !== "boolean") {
-    errors.push({ path: `${path2}.requiresApproval`, message: "requiresApproval must be a boolean" });
+    errors.push({
+      path: `${path2}.requiresApproval`,
+      message: "requiresApproval must be a boolean"
+    });
   }
   return errors;
 }
@@ -3503,11 +3514,29 @@ function validateLimits(limits, path2) {
     return [{ path: path2, message: "limits must be an object" }];
   }
   const l = limits;
+  if (l.autonomousThreshold !== void 0 && typeof l.autonomousThreshold !== "number") {
+    errors.push({
+      path: `${path2}.autonomousThreshold`,
+      message: "autonomousThreshold must be a number"
+    });
+  }
   if (l.maxTransactionAmount !== void 0 && typeof l.maxTransactionAmount !== "number") {
-    errors.push({ path: `${path2}.maxTransactionAmount`, message: "maxTransactionAmount must be a number" });
+    errors.push({
+      path: `${path2}.maxTransactionAmount`,
+      message: "maxTransactionAmount must be a number"
+    });
+  }
+  if (typeof l.autonomousThreshold === "number" && typeof l.maxTransactionAmount === "number" && l.autonomousThreshold > l.maxTransactionAmount) {
+    errors.push({
+      path: `${path2}.autonomousThreshold`,
+      message: "autonomousThreshold (Autonomous Limit) must be <= maxTransactionAmount (Hard Limit)"
+    });
   }
   if (l.maxRequestsPerHour !== void 0 && typeof l.maxRequestsPerHour !== "number") {
-    errors.push({ path: `${path2}.maxRequestsPerHour`, message: "maxRequestsPerHour must be a number" });
+    errors.push({
+      path: `${path2}.maxRequestsPerHour`,
+      message: "maxRequestsPerHour must be a number"
+    });
   }
   if (l.currency !== void 0 && typeof l.currency !== "string") {
     errors.push({ path: `${path2}.currency`, message: "currency must be a string" });
@@ -3522,7 +3551,10 @@ function validateRiskThresholds(thresholds, path2) {
   const t = thresholds;
   for (const range of ["autoAllow", "requireApproval", "autoBlock"]) {
     if (!t[range] || typeof t[range] !== "object") {
-      errors.push({ path: `${path2}.${range}`, message: `${range} is required and must be an object with min and max` });
+      errors.push({
+        path: `${path2}.${range}`,
+        message: `${range} is required and must be an object with min and max`
+      });
       continue;
     }
     const r = t[range];
@@ -4807,9 +4839,9 @@ var init_evaluator = __esm({
         if (scopeBlock) {
           return { recommendation: "DENY", reason: scopeBlock };
         }
-        const limitViolation = this.checkLimits(context);
-        if (limitViolation) {
-          return { recommendation: "DENY", reason: limitViolation };
+        const limitDecision = this.checkLimits(context);
+        if (limitDecision) {
+          return limitDecision;
         }
         if (context.purpose === "sub_agent.spawn" && this.policy.selfInstantiation) {
           if (!this.policy.selfInstantiation.allowed) {
@@ -4874,9 +4906,21 @@ var init_evaluator = __esm({
       checkLimits(context) {
         const limits = this.policy.limits;
         if (!limits) return null;
-        if (limits.maxTransactionAmount !== void 0 && context.transactionValue !== void 0) {
-          if (context.transactionValue > limits.maxTransactionAmount) {
-            return `Transaction value ${context.transactionValue} exceeds limit ${limits.maxTransactionAmount}`;
+        const value = context.transactionValue;
+        if (value !== void 0 && value > 0 && (limits.autonomousThreshold !== void 0 || limits.maxTransactionAmount !== void 0)) {
+          const autonomousThreshold = limits.autonomousThreshold ?? 0;
+          const hardLimit = limits.maxTransactionAmount ?? limits.autonomousThreshold ?? 0;
+          if (value > autonomousThreshold) {
+            if (value >= hardLimit) {
+              return {
+                recommendation: "DENY",
+                reason: `Transaction value ${value} at or above Hard Limit ${hardLimit}`
+              };
+            }
+            return {
+              recommendation: "MANUAL_REVIEW",
+              reason: `Transaction value ${value} is in the human-approval band (${autonomousThreshold}, ${hardLimit})`
+            };
           }
         }
         if (limits.maxRequestsPerHour !== void 0) {
@@ -4889,7 +4933,10 @@ var init_evaluator = __esm({
           } else {
             entry.count++;
             if (entry.count > limits.maxRequestsPerHour) {
-              return `Rate limit exceeded: ${entry.count}/${limits.maxRequestsPerHour} requests per hour`;
+              return {
+                recommendation: "DENY",
+                reason: `Rate limit exceeded: ${entry.count}/${limits.maxRequestsPerHour} requests per hour`
+              };
             }
           }
         }
@@ -5018,15 +5065,15 @@ var init_local = __esm({
   }
 });
 
-// src/access-levels.ts
+// src/trust-levels.ts
 function getTrustLevel(score) {
   if (score >= 80) return "PLATINUM";
   if (score >= 60) return "GOLD";
   if (score >= 40) return "SILVER";
   return "BRONZE";
 }
-var init_access_levels = __esm({
-  "src/access-levels.ts"() {
+var init_trust_levels = __esm({
+  "src/trust-levels.ts"() {
     "use strict";
   }
 });
@@ -5195,13 +5242,6 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // policy is not evaluated (we never reached the gate).
     identityVerified: false,
     policyAllowed: false,
-    // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
-    // Adapters additionally short-circuit on `!identityVerified ||
-    // !policyAllowed` before the gate check, but the access level still has
-    // to be honest at the data layer so downstream consumers (SDK adapters
-    // in other languages, custom integrations) inherit the correct
-    // semantics.
-    accessLevel: "none",
     guidance,
     denialReasons: reason ? [reason] : ["No valid agent credentials provided"],
     // Round-10 (#47, O5): on API-error fallback, surface a typed failure so
@@ -5224,6 +5264,11 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
     // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
     ...isMisconfig && { misconfigured: true },
+    // 4.6.0: a transient api_error is retryable — mark it so consumers surface
+    // "temporarily unavailable, retry" (recommendation 'error') instead of
+    // coercing the absent recommendation to a policy 'deny'. Misconfig is
+    // deterministic and intentionally NOT marked retryable.
+    ...isApiError && { retryable: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -5290,7 +5335,6 @@ async function callVerifyAccessAPI(config, request2) {
         attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
-          accessLevel: "none",
           reason: "endpoint_deactivated",
           failures: [
             {
@@ -5353,7 +5397,7 @@ async function verify(config, request2, options) {
   if (!deprecationWarningShown && (config.minTrustScore !== void 0 || config.minTrustScoreForFull !== void 0)) {
     deprecationWarningShown = true;
     console.warn(
-      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
+      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
@@ -5399,14 +5443,6 @@ async function verify(config, request2, options) {
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
-      // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
-      // Pre-rename this hardcoded `'guidance'`, which conflated with the
-      // colocated `guidance: {...}` help-payload object below and let
-      // denied requests pass any route gated at `'guidance'` because
-      // `hasMinimumAccess('guidance', 'guidance') === true`. Adapters now
-      // ALSO short-circuit on `!identityVerified || !policyAllowed` before
-      // the gate check — belt-and-braces.
-      accessLevel: "none",
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -5455,7 +5491,6 @@ async function verify(config, request2, options) {
     trustScore: apiResponse.organization.trustScore
   } : void 0;
   const verificationContext = apiResponse.verificationContext;
-  const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
     // 4.5.0 (probe F1): read idVerified from verificationContext with the
     // SAME absent⇒false default as the deny branch. The previous `!== false`
@@ -5467,7 +5502,6 @@ async function verify(config, request2, options) {
     // this load-bearing must never be defaulted on.
     identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
-    accessLevel,
     agent,
     developer,
     organization,
@@ -5494,7 +5528,6 @@ async function verify(config, request2, options) {
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
-    result.accessLevel = "none";
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Access denied by AstraSync recommendation"];
     result.guidance = result.runtimeChallenge ? {
       message: `Verification failed: ${result.runtimeChallenge.reason || "runtime challenge failed"}`,
@@ -5520,16 +5553,11 @@ var init_verify = __esm({
   "src/verify.ts"() {
     "use strict";
     init_http();
-    init_access_levels();
+    init_trust_levels();
     init_version();
     init_well_known();
     DEFAULT_CONFIG = {
       apiBaseUrl: "https://astrasync.ai/api",
-      // v2.3.9 (defect #30): default for unconfigured callers is `'none'` (no
-      // access). Pre-rename this defaulted to `'guidance'`, which combined with
-      // a route gated at `'guidance'` to silently let unverified traffic
-      // through (`hasMinimumAccess('guidance', 'guidance') === true`).
-      defaultAccessLevel: "none",
       // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
       // cacheTtl deliberately unset. When undefined, cacheResult applies the 60s
       // default; the caller's explicit value is honoured for cacheable results.
@@ -5726,7 +5754,7 @@ var init_sdk = __esm({
   "src/adapters/sdk.ts"() {
     "use strict";
     init_verify();
-    init_access_levels();
+    init_trust_levels();
   }
 });
 
@@ -6120,7 +6148,7 @@ var init_runtime_signatures = __esm({
 var init_src = __esm({
   "src/index.ts"() {
     "use strict";
-    init_access_levels();
+    init_trust_levels();
     init_verify();
     init_stepup_poll();
     init_settlement();
@@ -6153,7 +6181,6 @@ function toGatewayConfig(config) {
   return {
     apiBaseUrl: config.apiBaseUrl || "https://api.astrasync.ai",
     apiKey: config.apiKey,
-    defaultAccessLevel: config.defaultAccessLevel,
     minTrustScore: config.minTrustScore,
     minTrustScoreForFull: config.minTrustScoreForFull,
     cacheTtl: config.cacheTtl,
@@ -6181,7 +6208,7 @@ function toDecision(result) {
   if (result.identityVerified && result.policyAllowed) {
     return {
       recommendation: "ALLOW",
-      reason: `Verified with access level: ${result.accessLevel}`,
+      reason: result.agent?.trustScore ? `Verified (trust score ${result.agent.trustScore})` : "Verified",
       trustScore: result.agent?.trustScore,
       sessionId: "sessionId" in result ? result.sessionId : void 0
     };