@astrasyncai/verification-gateway 5.15.0 → 5.17.0

package/dist/adapters/nextjs.d.mts

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from '../types-Dxf9DBpr.mjs';
+import { N as NextJsMiddlewareOptions } from '../types-Blz520bR.mjs';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/adapters/nextjs.d.ts

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from '../types-Dxf9DBpr.js';
+import { N as NextJsMiddlewareOptions } from '../types-Blz520bR.js';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/adapters/nextjs.js

@@ -360,7 +360,7 @@ function detectCommerce(req, host) {
       evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
     };
   }
-  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri)) {
+  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
     return {
       protocol: "ucp",
       artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
@@ -449,8 +449,19 @@ async function detectFetchCommerce(request) {
   );
 }
 
+// src/types.ts
+function routePolicyOf(route) {
+  if (!route) return void 0;
+  const owners = route.allowedOwners?.filter(Boolean) ?? [];
+  const policy = {
+    ...owners.length > 0 && { allowedOwners: owners },
+    ...route.requiresRuntimeChallenge === true && { requiresRuntimeChallenge: true }
+  };
+  return Object.keys(policy).length > 0 ? policy : void 0;
+}
+
 // src/version.ts
-var SDK_VERSION = "5.15.0";
+var SDK_VERSION = "5.17.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -698,6 +709,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -904,6 +917,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -2507,6 +2521,7 @@ function createMiddleware(options) {
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",
       enableRuntimeChallenge,
+      ...routePolicyOf(routeConfig) && { routePolicy: routePolicyOf(routeConfig) },
       durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
       ...inboundAttemptId && { attemptId: inboundAttemptId },
       callerMetadata: {