@astrasyncai/verification-gateway 5.18.1 → 5.19.0

package/dist/adapters/nextjs.d.mts

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from '../types-Cns4l8gX.mjs';
+import { N as NextJsMiddlewareOptions } from '../types-DqWPkiYl.mjs';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/adapters/nextjs.d.ts

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from '../types-Cns4l8gX.js';
+import { N as NextJsMiddlewareOptions } from '../types-DqWPkiYl.js';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/adapters/nextjs.js

@@ -471,7 +471,7 @@ function routePolicyOf(route) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.18.1";
+var SDK_VERSION = "5.19.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -737,7 +737,12 @@ function getCacheKey(request, counterpartyId) {
     // its start_checkout quote was served the cached quote-leg grant (no
     // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
     request.commercePhase || "",
-    request.checkoutSessionId || ""
+    request.checkoutSessionId || "",
+    // 5.19.0: a route_config purpose claim is checked server-side against
+    // the stored rule for this method + path, so it changes the verdict.
+    request.purposeSource || "",
+    request.requestMethod || "",
+    request.requestPath || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {
@@ -945,6 +950,11 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.purposeSource) body.purposeSource = requestData.purposeSource;
+  if (requestData.agentArtifacts) body.agentArtifacts = requestData.agentArtifacts;
+  if (requestData.metadata) body.metadata = requestData.metadata;
+  if (requestData.requestMethod) body.requestMethod = requestData.requestMethod;
+  if (requestData.requestPath) body.requestPath = requestData.requestPath;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
@@ -1134,9 +1144,18 @@ async function verify(config, request, options) {
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;
     const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true && !aggregatedFailures?.some((f) => REJECTED_IDENTITY_DIMENSIONS.has(f.dimension));
+    const denyAgent = idVerifiedFromBackend && apiResponse.agent ? {
+      astraId: apiResponse.agent.astraId,
+      name: apiResponse.agent.name,
+      trustScore: apiResponse.agent.trustScore,
+      trustLevel: getTrustLevel(apiResponse.agent.trustScore),
+      blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
+      status: apiResponse.agent.agentStatus
+    } : void 0;
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
+      ...denyAgent && { agent: denyAgent },
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -1273,7 +1292,7 @@ async function verify(config, request, options) {
   return result;
 }
 var refusedPolicyReads = /* @__PURE__ */ new Set();
-async function fetchRoutes(config, counterpartyId) {
+async function fetchRoutes(config, counterpartyId, options = {}) {
   if (!counterpartyId) return null;
   const headers = { "Content-Type": "application/json" };
   if (config.apiKey) {
@@ -1282,7 +1301,7 @@ async function fetchRoutes(config, counterpartyId) {
   }
   try {
     const response = await sdkFetch(
-      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes`,
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes` + (options.codeGates?.length ? `?codeGates=${options.codeGates.map(encodeURIComponent).join(",")}` : ""),
       { method: "GET", headers }
     );
     if (!response.ok) {
@@ -2115,6 +2134,20 @@ function resolveHttpPdlss(input) {
   }
   return { purpose, action, purposeSource, actionSource };
 }
+function wirePurposeSource(source) {
+  switch (source) {
+    case "route_config":
+      return "route_config";
+    case "header":
+    case "legacy_header":
+    case "query":
+      return "header";
+    case "custom_extractor":
+      return "body";
+    default:
+      return "default";
+  }
+}
 
 // src/adapters/approval-gate.ts
 var APPROVAL_REASON = "Transaction is above the autonomous limit and requires human approval. The agent owner can approve or deny this transaction in the AstraSync dashboard.";
@@ -2546,6 +2579,10 @@ function createMiddleware(options) {
       ...commerceArtifacts && { commerceArtifacts },
       purpose,
       action: pdlssPair.action,
+      // 5.19.0: route purpose claim + request line (checked server-side).
+      purposeSource: wirePurposeSource(pdlssPair.purposeSource),
+      requestMethod: request.method,
+      requestPath: pathname,
       resource: pathname,
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",