@astrasyncai/verification-gateway 5.17.0 → 5.17.1

package/dist/{types-Bm1QvGqI.d.ts → types-DA8LzAOB.d.ts}

@@ -717,6 +717,12 @@ interface VerificationRequest {
     enableRuntimeChallenge?: boolean;
     /** 5.16.0: the matched route's policy for verify-access to enforce. */
     routePolicy?: RoutePolicy;
+    /**
+     * 5.17.1: the route itself holds a request that needs the owner's approval
+     * (see ExpressMiddlewareOptions.approvalHeldByRoute), so verify-access
+     * reports the hold but creates no approval of its own.
+     */
+    approvalHeldByRoute?: boolean;
     /** Create a verification session (returns sessionId) */
     createSession?: boolean;
     /** Counterparty type */

package/dist/{types-Blz520bR.d.mts → types-DRb_plOh.d.mts}

@@ -775,6 +775,12 @@ interface VerificationRequest {
     enableRuntimeChallenge?: boolean;
     /** 5.16.0: the matched route's policy for verify-access to enforce. */
     routePolicy?: RoutePolicy;
+    /**
+     * 5.17.1: the route itself holds a request that needs the owner's approval
+     * (see ExpressMiddlewareOptions.approvalHeldByRoute), so verify-access
+     * reports the hold but creates no approval of its own.
+     */
+    approvalHeldByRoute?: boolean;
     /** Create a verification session (returns sessionId) */
     createSession?: boolean;
     /** Counterparty type */
@@ -985,6 +991,14 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
     recordDecisions?: boolean;
     /** Ask for a runtime challenge on every verify-access call (default: false — opt-in, round 27.8) */
     enableRuntimeChallenge?: boolean;
+    /**
+     * 5.17.1: return true for requests whose route asks the owner for approval
+     * itself (it creates its own hold and answers 202 while it waits). For those
+     * requests a result that only needs the owner's approval is passed to the
+     * route instead of refused, and verify-access creates no approval, so the
+     * owner approves once. Any deny is still refused. Default: none.
+     */
+    approvalHeldByRoute?: (req: unknown) => boolean;
     /**
      * Refresh interval (ms) for the remote-fetched route policy. Default:
      * 5 minutes. Operators can shorten this to test policy edits faster, or

package/dist/{types-Blz520bR.d.ts → types-DRb_plOh.d.ts}

@@ -775,6 +775,12 @@ interface VerificationRequest {
     enableRuntimeChallenge?: boolean;
     /** 5.16.0: the matched route's policy for verify-access to enforce. */
     routePolicy?: RoutePolicy;
+    /**
+     * 5.17.1: the route itself holds a request that needs the owner's approval
+     * (see ExpressMiddlewareOptions.approvalHeldByRoute), so verify-access
+     * reports the hold but creates no approval of its own.
+     */
+    approvalHeldByRoute?: boolean;
     /** Create a verification session (returns sessionId) */
     createSession?: boolean;
     /** Counterparty type */
@@ -985,6 +991,14 @@ interface ExpressMiddlewareOptions extends GatewayConfig {
     recordDecisions?: boolean;
     /** Ask for a runtime challenge on every verify-access call (default: false — opt-in, round 27.8) */
     enableRuntimeChallenge?: boolean;
+    /**
+     * 5.17.1: return true for requests whose route asks the owner for approval
+     * itself (it creates its own hold and answers 202 while it waits). For those
+     * requests a result that only needs the owner's approval is passed to the
+     * route instead of refused, and verify-access creates no approval, so the
+     * owner approves once. Any deny is still refused. Default: none.
+     */
+    approvalHeldByRoute?: (req: unknown) => boolean;
     /**
      * Refresh interval (ms) for the remote-fetched route policy. Default:
      * 5 minutes. Operators can shorten this to test policy edits faster, or

package/dist/{types-DBe4hgfT.d.mts → types-vNBvYD7Z.d.mts}

@@ -717,6 +717,12 @@ interface VerificationRequest {
     enableRuntimeChallenge?: boolean;
     /** 5.16.0: the matched route's policy for verify-access to enforce. */
     routePolicy?: RoutePolicy;
+    /**
+     * 5.17.1: the route itself holds a request that needs the owner's approval
+     * (see ExpressMiddlewareOptions.approvalHeldByRoute), so verify-access
+     * reports the hold but creates no approval of its own.
+     */
+    approvalHeldByRoute?: boolean;
     /** Create a verification session (returns sessionId) */
     createSession?: boolean;
     /** Counterparty type */

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-Blz520bR.mjs';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-DRb_plOh.mjs';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-Blz520bR.js';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-DRb_plOh.js';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-DBe4hgfT.mjs';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-vNBvYD7Z.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-Bm1QvGqI.js';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-DA8LzAOB.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**

package/dist/verify.js

@@ -37,7 +37,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.17.0";
+var SDK_VERSION = "5.17.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -202,6 +202,7 @@ function getCacheKey(request, counterpartyId) {
     request.enableRuntimeChallenge ? "1" : "0",
     // 5.16.0: route policy changes the verdict (owners / challenge).
     request.routePolicy ? JSON.stringify(request.routePolicy) : "",
+    request.approvalHeldByRoute ? "1" : "0",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -415,6 +416,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -746,6 +748,8 @@ async function verify(config, request, options) {
   } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
+    const stepUpFailures = apiResponse.access?.failures;
+    if (stepUpFailures?.length) result.failures = stepUpFailures;
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {