@astrasyncai/verification-gateway 4.5.1 → 5.0.0

package/dist/adapters/mcp.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "4.5.1";
+var SDK_VERSION = "5.0.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -19,7 +19,7 @@ function withUserAgent(initHeaders) {
 }
 var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
-// src/access-levels.ts
+// src/trust-levels.ts
 function getTrustLevel(score) {
   if (score >= 80) return "PLATINUM";
   if (score >= 60) return "GOLD";
@@ -89,11 +89,6 @@ function getCachedWellKnownUrls(apiBaseUrl) {
 // src/verify.ts
 var DEFAULT_CONFIG = {
   apiBaseUrl: "https://astrasync.ai/api",
-  // v2.3.9 (defect #30): default for unconfigured callers is `'none'` (no
-  // access). Pre-rename this defaulted to `'guidance'`, which combined with
-  // a route gated at `'guidance'` to silently let unverified traffic
-  // through (`hasMinimumAccess('guidance', 'guidance') === true`).
-  defaultAccessLevel: "none",
   // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
   // cacheTtl deliberately unset. When undefined, cacheResult applies the 60s
   // default; the caller's explicit value is honoured for cacheable results.
@@ -288,13 +283,6 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // policy is not evaluated (we never reached the gate).
     identityVerified: false,
     policyAllowed: false,
-    // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
-    // Adapters additionally short-circuit on `!identityVerified ||
-    // !policyAllowed` before the gate check, but the access level still has
-    // to be honest at the data layer so downstream consumers (SDK adapters
-    // in other languages, custom integrations) inherit the correct
-    // semantics.
-    accessLevel: "none",
     guidance,
     denialReasons: reason ? [reason] : ["No valid agent credentials provided"],
     // Round-10 (#47, O5): on API-error fallback, surface a typed failure so
@@ -317,6 +305,11 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
     // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
     ...isMisconfig && { misconfigured: true },
+    // 4.6.0: a transient api_error is retryable — mark it so consumers surface
+    // "temporarily unavailable, retry" (recommendation 'error') instead of
+    // coercing the absent recommendation to a policy 'deny'. Misconfig is
+    // deterministic and intentionally NOT marked retryable.
+    ...isApiError && { retryable: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -383,7 +376,6 @@ async function callVerifyAccessAPI(config, request) {
         attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
         access: {
           allowed: false,
-          accessLevel: "none",
           reason: "endpoint_deactivated",
           failures: [
             {
@@ -446,7 +438,7 @@ async function verify(config, request, options) {
   if (!deprecationWarningShown && (config.minTrustScore !== void 0 || config.minTrustScoreForFull !== void 0)) {
     deprecationWarningShown = true;
     console.warn(
-      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
+      "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
@@ -492,14 +484,6 @@ async function verify(config, request, options) {
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
-      // v2.3.9 (defect #30): denials grant `'none'`, NEVER a positive band.
-      // Pre-rename this hardcoded `'guidance'`, which conflated with the
-      // colocated `guidance: {...}` help-payload object below and let
-      // denied requests pass any route gated at `'guidance'` because
-      // `hasMinimumAccess('guidance', 'guidance') === true`. Adapters now
-      // ALSO short-circuit on `!identityVerified || !policyAllowed` before
-      // the gate check — belt-and-braces.
-      accessLevel: "none",
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -548,7 +532,6 @@ async function verify(config, request, options) {
     trustScore: apiResponse.organization.trustScore
   } : void 0;
   const verificationContext = apiResponse.verificationContext;
-  const accessLevel = apiResponse.access?.accessLevel ?? "standard";
   const result = {
     // 4.5.0 (probe F1): read idVerified from verificationContext with the
     // SAME absent⇒false default as the deny branch. The previous `!== false`
@@ -560,7 +543,6 @@ async function verify(config, request, options) {
     // this load-bearing must never be defaulted on.
     identityVerified: apiResponse.verificationContext?.idVerified === true,
     policyAllowed: true,
-    accessLevel,
     agent,
     developer,
     organization,
@@ -587,7 +569,6 @@ async function verify(config, request, options) {
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
-    result.accessLevel = "none";
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Access denied by AstraSync recommendation"];
     result.guidance = result.runtimeChallenge ? {
       message: `Verification failed: ${result.runtimeChallenge.reason || "runtime challenge failed"}`,
@@ -1046,18 +1027,13 @@ function mcpToPdlss(parsed, requestPath, headerPurpose, headerAction, toolGate)
   }
   return { purpose, action, resource, purposeSource, actionSource };
 }
-function mcpRiskTier(parsed) {
-  if (parsed.isInitialize || parsed.method === "notifications/initialized") return "none";
-  if (parsed.isIntrospection) return "none";
-  if (parsed.method === "resources/read") return "read-only";
-  if (parsed.isToolCall) return "standard";
-  return "standard";
+function mcpDefaultEnforced(parsed) {
+  if (parsed.isInitialize || parsed.method === "notifications/initialized") return false;
+  if (parsed.isIntrospection) return false;
+  return true;
 }
 
 // src/adapters/mcp.ts
-function normalizeToolGate(gate) {
-  return typeof gate === "string" ? { minAccessLevel: gate } : gate;
-}
 function readSingleHeader(value) {
   if (typeof value === "string") return value;
   if (Array.isArray(value)) return value[0];
@@ -1110,7 +1086,6 @@ function defaultMcpDenied(result, req, res) {
       code: !result.identityVerified ? -32e3 : -32001,
       message: result.denialReasons?.[0] ?? "Access denied",
       data: {
-        accessLevel: result.accessLevel,
         guidance: result.guidance,
         // Round-10: aggregated per-dimension detail + correlation handle.
         failures: result.failures,
@@ -1123,20 +1098,19 @@ function defaultMcpDenied(result, req, res) {
     }
   });
 }
-function resolveMinAccessLevel(parsed, opts) {
+function resolveGate(parsed, opts) {
   if (!parsed.toolName) {
-    if (opts.methodGates && opts.methodGates[parsed.method] !== void 0) {
-      return { level: opts.methodGates[parsed.method], source: "methodGate" };
+    const methodGate = opts.methodGates?.[parsed.method];
+    if (methodGate !== void 0) {
+      return methodGate === "observe" ? { enforce: false, source: "methodGate" } : { enforce: true, config: methodGate, source: "methodGate" };
     }
-    return { level: "none", source: "discovery_default" };
+    return { enforce: false, source: "discovery_default" };
   }
-  if (opts.toolGates && opts.toolGates[parsed.toolName] !== void 0) {
-    return {
-      level: normalizeToolGate(opts.toolGates[parsed.toolName]).minAccessLevel,
-      source: "toolGate"
-    };
+  const toolGate = opts.toolGates?.[parsed.toolName];
+  if (toolGate !== void 0) {
+    return toolGate === "observe" ? { enforce: false, source: "toolGate" } : { enforce: true, config: toolGate, source: "toolGate" };
   }
-  return { level: mcpRiskTier(parsed), source: "tier" };
+  return { enforce: mcpDefaultEnforced(parsed), source: "tier" };
 }
 function createMcpMiddleware(options) {
   const {
@@ -1156,15 +1130,6 @@ function createMcpMiddleware(options) {
     prefetchWellKnown(config.apiBaseUrl).catch(() => {
     });
   }
-  if (toolGates) {
-    for (const [toolName, gate] of Object.entries(toolGates)) {
-      if (typeof gate === "string") {
-        console.warn(
-          `[VerificationGateway/MCP] toolGates['${toolName}'] uses the bare-string shorthand ('${gate}'). Gated tools need a PDLSS purpose (else PDLSS_PURPOSE_REQUIRED 400) and evaluate purpose-only without a declared action. Use the object form instead: { minAccessLevel: '${gate}', purpose: '...', action: '...' }.`
-        );
-      }
-    }
-  }
   return async (req, res, next) => {
     try {
       if (skip) return next();
@@ -1213,7 +1178,7 @@ function createMcpMiddleware(options) {
           return next();
         }
       }
-      const { level: minAccessLevel } = resolveMinAccessLevel(parsed, {
+      const gateDecision = resolveGate(parsed, {
         toolGates,
         methodGates
       });
@@ -1222,16 +1187,15 @@ function createMcpMiddleware(options) {
         req.query
       );
       if (effectiveAstraId) credentials.astraId = effectiveAstraId;
-      const shouldEnforce = minAccessLevel !== "none";
-      if (minAccessLevel === "none" && (!config.evaluateAlwaysIfCredentialed || !credentials.astraId)) {
+      const shouldEnforce = gateDecision.enforce;
+      if (!shouldEnforce && (!config.evaluateAlwaysIfCredentialed || !credentials.astraId)) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "unenforced");
-          res.setHeader("X-Astra-Gateway-Reason", "mcp-tier-none");
+          res.setHeader("X-Astra-Gateway-Reason", "mcp-observe");
         }
         return next();
       }
-      const rawGate = parsed.toolName && toolGates?.[parsed.toolName];
-      const gate = rawGate ? normalizeToolGate(rawGate) : void 0;
+      const gate = gateDecision.config;
       const headerPurpose = readSingleHeader(req.headers["x-astra-purpose"]);
       const headerAction = readSingleHeader(req.headers["x-astra-action"]);
       const pdlss = mcpToPdlss(
@@ -1367,7 +1331,6 @@ function createMcpMiddleware(options) {
         const result = {
           identityVerified: false,
           policyAllowed: false,
-          accessLevel: "none",
           denialReasons: [`MCP middleware internal error: ${errorClass}`],
           failures: [
             {
@@ -1397,7 +1360,7 @@ export {
   MCP_VERIFIED_HOP_HEADER,
   createMcpMiddleware,
   isVerifiedHopValidFor,
-  mcpRiskTier,
+  mcpDefaultEnforced,
   mcpToPdlss,
   parseMcpJsonRpc,
   parseVerifiedHop,