@astrasyncai/verification-gateway 5.18.1 → 5.19.0

package/dist/adapters/express.mjs

@@ -452,7 +452,7 @@ function routePolicyOf(route) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.18.1";
+var SDK_VERSION = "5.19.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -770,7 +770,12 @@ function getCacheKey(request, counterpartyId) {
     // its start_checkout quote was served the cached quote-leg grant (no
     // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
     request.commercePhase || "",
-    request.checkoutSessionId || ""
+    request.checkoutSessionId || "",
+    // 5.19.0: a route_config purpose claim is checked server-side against
+    // the stored rule for this method + path, so it changes the verdict.
+    request.purposeSource || "",
+    request.requestMethod || "",
+    request.requestPath || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {
@@ -978,6 +983,11 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.purposeSource) body.purposeSource = requestData.purposeSource;
+  if (requestData.agentArtifacts) body.agentArtifacts = requestData.agentArtifacts;
+  if (requestData.metadata) body.metadata = requestData.metadata;
+  if (requestData.requestMethod) body.requestMethod = requestData.requestMethod;
+  if (requestData.requestPath) body.requestPath = requestData.requestPath;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
@@ -1167,9 +1177,18 @@ async function verify(config, request, options) {
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;
     const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true && !aggregatedFailures?.some((f) => REJECTED_IDENTITY_DIMENSIONS.has(f.dimension));
+    const denyAgent = idVerifiedFromBackend && apiResponse.agent ? {
+      astraId: apiResponse.agent.astraId,
+      name: apiResponse.agent.name,
+      trustScore: apiResponse.agent.trustScore,
+      trustLevel: getTrustLevel(apiResponse.agent.trustScore),
+      blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
+      status: apiResponse.agent.agentStatus
+    } : void 0;
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
+      ...denyAgent && { agent: denyAgent },
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -1319,7 +1338,7 @@ async function recordDecision(config, sessionId, decision, reason) {
   });
 }
 var refusedPolicyReads = /* @__PURE__ */ new Set();
-async function fetchRoutes(config, counterpartyId) {
+async function fetchRoutes(config, counterpartyId, options = {}) {
   if (!counterpartyId) return null;
   const headers = { "Content-Type": "application/json" };
   if (config.apiKey) {
@@ -1328,7 +1347,7 @@ async function fetchRoutes(config, counterpartyId) {
   }
   try {
     const response = await sdkFetch(
-      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes`,
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes` + (options.codeGates?.length ? `?codeGates=${options.codeGates.map(encodeURIComponent).join(",")}` : ""),
       { method: "GET", headers }
     );
     if (!response.ok) {
@@ -1374,6 +1393,42 @@ async function reportCounterpartyPreCheckFailure(config, data) {
   });
 }
 
+// src/adapters/routes-cache.ts
+var DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
+function createRoutesCache(config, opts = {}) {
+  const refreshMs = opts.refreshMs ?? DEFAULT_ROUTES_REFRESH_MS;
+  let cached = [];
+  let lastFetchAt = 0;
+  let refreshing = null;
+  async function refresh() {
+    if (!config.counterpartyId) {
+      opts.onNoCounterparty?.();
+      return;
+    }
+    const fetched = await fetchRoutes(config, config.counterpartyId, opts.fetchOptions);
+    if (fetched) {
+      cached = fetched;
+      lastFetchAt = Date.now();
+      opts.onFetched?.(fetched);
+    }
+  }
+  function start() {
+    refreshing = refresh().catch(() => void 0).finally(() => {
+      refreshing = null;
+    });
+  }
+  start();
+  return {
+    async current() {
+      if (refreshing) await refreshing.catch(() => {
+      });
+      if (config.counterpartyId && Date.now() - lastFetchAt > refreshMs) start();
+      return cached;
+    },
+    peek: () => cached
+  };
+}
+
 // src/transport/http.ts
 var HEADER_PREFIX = "X-Astra-";
 function extractHttpCredentials(headers) {
@@ -1523,6 +1578,20 @@ function resolveHttpPdlss(input) {
   }
   return { purpose, action, purposeSource, actionSource };
 }
+function wirePurposeSource(source) {
+  switch (source) {
+    case "route_config":
+      return "route_config";
+    case "header":
+    case "legacy_header":
+    case "query":
+      return "header";
+    case "custom_extractor":
+      return "body";
+    default:
+      return "default";
+  }
+}
 
 // src/adapters/approval-gate.ts
 var APPROVAL_REASON = "Transaction is above the autonomous limit and requires human approval. The agent owner can approve or deny this transaction in the AstraSync dashboard.";
@@ -2323,7 +2392,6 @@ function defaultOnDenied(result, _req, res) {
     }
   });
 }
-var DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
 function createMiddleware(options) {
   if ("routes" in options) {
     console.warn(
@@ -2339,7 +2407,7 @@ function createMiddleware(options) {
     recordDecisions,
     enableRuntimeChallenge = true,
     routesRefreshMs = DEFAULT_ROUTES_REFRESH_MS,
-    failOnError = "open",
+    failOnError = "closed",
     caseInsensitiveRouteMatch = false,
     anonymousBeacon = true,
     trustVerifiedHop = false,
@@ -2363,26 +2431,19 @@ function createMiddleware(options) {
       rawHeaders: req.headers
     });
   } : void 0;
-  let cachedRoutes = [];
-  let lastFetchAt = 0;
-  let refreshing = null;
   let warnedNoCounterparty = false;
   let warnedEmptyRoutes = false;
-  async function refreshRoutes() {
-    if (!config.counterpartyId) {
-      if (!warnedNoCounterparty) {
-        console.warn(
-          "[VerificationGateway] No counterpartyId configured \u2014 falling through (allow all). Per-route policy lives in the AstraSync dashboard now; register the endpoint and set counterpartyId in your middleware config to enforce policy."
-        );
-        warnedNoCounterparty = true;
-      }
-      return;
-    }
-    const fetched = await fetchRoutes(config, config.counterpartyId);
-    if (fetched) {
-      cachedRoutes = fetched;
-      lastFetchAt = Date.now();
-      if (cachedRoutes.length === 0 && !warnedEmptyRoutes) {
+  const routesCache = createRoutesCache(config, {
+    refreshMs: routesRefreshMs,
+    onNoCounterparty: () => {
+      if (warnedNoCounterparty) return;
+      console.warn(
+        "[VerificationGateway] No counterpartyId configured \u2014 falling through (allow all). Per-route policy lives in the AstraSync dashboard now; register the endpoint and set counterpartyId in your middleware config to enforce policy."
+      );
+      warnedNoCounterparty = true;
+    },
+    onFetched: (routes) => {
+      if (routes.length === 0 && !warnedEmptyRoutes) {
         const dashboard = config.dashboardUrl ?? "https://astrasync.ai/dashboard";
         console.warn(
           `[VerificationGateway] No route policy configured for ${config.counterpartyId}. Gateway is in pass-through mode for ALL traffic until you add at least one route. Configure at ${dashboard}/dashboard/endpoints/${config.counterpartyId}/routes`
@@ -2390,9 +2451,6 @@ function createMiddleware(options) {
         warnedEmptyRoutes = true;
       }
     }
-  }
-  refreshing = refreshRoutes().finally(() => {
-    refreshing = null;
   });
   return async (req, res, next) => {
     try {
@@ -2400,15 +2458,9 @@ function createMiddleware(options) {
       if (shouldSkip) {
         return next();
       }
-      if (refreshing) {
-        await refreshing.catch(() => {
-        });
-      }
-      if (config.counterpartyId && Date.now() - lastFetchAt > routesRefreshMs) {
-        refreshing = refreshRoutes().finally(() => {
-          refreshing = null;
-        });
-      }
+      const cachedRoutes = (await routesCache.current()).filter(
+        (r) => typeof r.pattern === "string" && !r.tool
+      );
       const correlationId = req.headers["x-request-id"] || req.headers["x-correlation-id"];
       const matchedRoute = findRouteConfig(cachedRoutes, req.path, req.method, {
         caseInsensitive: caseInsensitiveRouteMatch,
@@ -2532,6 +2584,12 @@ function createMiddleware(options) {
         ...commerceArtifacts && { commerceArtifacts },
         purpose,
         action: pdlssPair.action,
+        // 5.19.0: the source + the request line let verify-access check a
+        // route purpose against the stored rule (item 20: an MPP paid leg
+        // keeps `shopping.purchase` instead of `commerce.payment.execute`).
+        purposeSource: wirePurposeSource(pdlssPair.purposeSource),
+        requestMethod: req.method,
+        requestPath: req.path,
         resource: req.path,
         createSession: shouldRecordDecisions,
         counterpartyUrl,
@@ -2609,7 +2667,8 @@ function createMiddleware(options) {
         return;
       }
       if (routeConfig.minTrustScore && result.agent) {
-        if (result.agent.trustScore < routeConfig.minTrustScore) {
+        const score = result.agent.trustScore;
+        if (typeof score !== "number" || score < routeConfig.minTrustScore) {
           const trustFailure = {
             dimension: "endpoint.trust",
             message: "Trust below the route requirement for this endpoint.",