@astrasyncai/verification-gateway 5.15.0 → 5.17.0

package/dist/adapters/nextjs.mjs

@@ -323,7 +323,7 @@ function detectCommerce(req, host) {
       evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
     };
   }
-  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri)) {
+  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
     return {
       protocol: "ucp",
       artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
@@ -412,8 +412,19 @@ async function detectFetchCommerce(request) {
   );
 }
 
+// src/types.ts
+function routePolicyOf(route) {
+  if (!route) return void 0;
+  const owners = route.allowedOwners?.filter(Boolean) ?? [];
+  const policy = {
+    ...owners.length > 0 && { allowedOwners: owners },
+    ...route.requiresRuntimeChallenge === true && { requiresRuntimeChallenge: true }
+  };
+  return Object.keys(policy).length > 0 ? policy : void 0;
+}
+
 // src/version.ts
-var SDK_VERSION = "5.15.0";
+var SDK_VERSION = "5.17.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -661,6 +672,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -867,6 +880,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -2470,6 +2484,7 @@ function createMiddleware(options) {
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",
       enableRuntimeChallenge,
+      ...routePolicyOf(routeConfig) && { routePolicy: routePolicyOf(routeConfig) },
       durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
       ...inboundAttemptId && { attemptId: inboundAttemptId },
       callerMetadata: {