@astrasyncai/verification-gateway 5.18.1 → 5.20.0

package/dist/adapters/mcp.d.ts

@@ -1,5 +1,5 @@
 import { Request, Response, RequestHandler } from 'express';
-import { d as VerificationResult, G as GatewayConfig } from '../types-Cns4l8gX.js';
+import { e as VerificationResult, G as GatewayConfig } from '../types-CxjqmPl-.js';
 
 /**
  * X-Astra-Verified-Hop — cross-hop verify-access dedupe marker.
@@ -378,23 +378,116 @@ interface McpMiddlewareOptions extends GatewayConfig {
     recordDecisions?: boolean;
     /** Forward runtime challenge (default `true`). */
     enableRuntimeChallenge?: boolean;
+    /**
+     * 5.19.0: how a dashboard tool rule combines with a code `toolGates`
+     * entry for the same tool. With `apiKey` + `counterpartyId` set, the
+     * middleware fetches the endpoint's tool rules (`{tool, purpose, action,
+     * resource?, observe?}`, edited in the AstraSync dashboard; refreshed every
+     * `routesRefreshMs`) and turns each into a gate for that tool.
+     *
+     * - `'code'` (default): a dashboard rule can TIGHTEN a code gate but never
+     *   loosen it. For a tool gated in code (object form), a dashboard
+     *   `observe` rule, or one with no purpose, is ignored; a dashboard rule
+     *   whose purpose or action differs is evaluated IN ADDITION — both must
+     *   pass. Tools with no code gate (or a code `'observe'`) follow the
+     *   dashboard rule.
+     * - `'dashboard'`: the dashboard rule wins outright for every tool it
+     *   names (including `observe`).
+     *
+     * Rules flagged `legacy: true` (path rules stored on an MCP endpoint before
+     * tool rules existed) are ignored. The middleware sends its code-gated tool
+     * names on the policy fetch (`?codeGates=`) so the dashboard can mark them.
+     */
+    toolGatePrecedence?: 'code' | 'dashboard';
+    /** 5.19.0: refresh interval (ms) for the dashboard tool rules. Default 5 minutes. */
+    routesRefreshMs?: number;
+    /**
+     * 5.20.0: tools and JSON-RPC methods that pass through with NO verify-access
+     * call at all — not even the audit evaluation `evaluateAlwaysIfCredentialed`
+     * adds for credentialed callers. Applies only while the call is not
+     * enforced (an `'observe'` gate, or a handshake/introspection method with
+     * no `methodGates` entry); a dashboard rule that enforces a listed tool
+     * still verifies.
+     *
+     * Use it for:
+     *   - `methods`: handshake and introspection (`initialize`, `tools/list`,
+     *     `resources/list`, `resources/read`) — nothing to attribute, and a
+     *     backend round trip slows the host's first card fetch;
+     *   - `tools`: observe tools whose handler calls verify-access itself, so
+     *     the gate's evaluation would be a second backend verify for the same
+     *     call (the MCP bridge measured ~3 backend calls per `verify_agent`).
+     *
+     * Listed calls leave `req.agentVerification` unset.
+     */
+    skipEvaluation?: {
+        tools?: readonly string[];
+        methods?: readonly string[];
+    };
     /**
      * Posture when the MCP middleware itself throws an internal error.
-     * Default `'open'` for backward compatibility in SDK 2.4.13. Shadow logs
-     * record what WOULD be denied with `failOnError: 'closed'` so merchants
-     * can grep correlationId for impact analysis during the observation
-     * window. Default flips to `'closed'` in a follow-up release.
      *
-     * 5.12.0: `'closed'` answers the retryable verification-unavailable
-     * JSON-RPC error (HTTP 503 + Retry-After, code -32003) — never an
-     * identity-shaped 401.
+     * 5.19.0 (behaviour change): default `'closed'` — an internal throw answers
+     * the retryable verification-unavailable JSON-RPC error (HTTP 503 +
+     * Retry-After, code -32003; never an identity-shaped 401) and the tool
+     * handler is not called. `'open'` (pass the call through unverified) is
+     * an explicit opt-in. The `[SHADOW] would-have-denied` log line is still
+     * written on every throw, with the correlationId.
      */
     failOnError?: 'open' | 'closed';
 }
+/** 5.19.0: a dashboard tool rule as the MCP middleware evaluates it. */
+interface DashboardToolRule {
+    tool: string;
+    purpose?: string;
+    action?: string;
+    resource?: string;
+    observe?: boolean;
+}
+/** The usable tool rules in a fetched policy (tool key set, not legacy), by tool name. */
+declare function dashboardToolRules(routes: ReadonlyArray<{
+    tool?: string;
+    legacy?: boolean;
+    purpose?: string;
+    action?: string;
+    resource?: string;
+    observe?: boolean;
+}>): Map<string, DashboardToolRule>;
+type GateSource = 'toolGate' | 'methodGate' | 'dashboard' | 'tier' | 'discovery_default';
+/**
+ * Resolve whether a parsed MCP request is enforced, and the gate config to
+ * apply. SDK 5.0.0 removed the access-level band — a gate's only decision is
+ * enforce vs observe.
+ *
+ * Precedence:
+ *   1. Non-tools/call without `methodGates` entry → pass through
+ *      (`discovery_default`). Discovery is open — agents must list tools
+ *      before invoking them.
+ *   2. `methodGates[method]` — per-method override (`'observe'` or a config)
+ *   3. tools/call: the code `toolGates[toolName]` and the dashboard tool rule
+ *      (5.19.0) — see `toolGatePrecedence`. With the default `'code'`, a
+ *      dashboard rule only tightens a code gate: it is ignored when it is
+ *      `observe` or has no purpose, and evaluated as an `additional` gate
+ *      (both must pass) when its purpose/action differ.
+ *   4. `mcpDefaultEnforced` — built-in default (tools/call → enforced)
+ *
+ * The `source` field is logged for forensics / activity-feed attribution.
+ */
+declare function resolveGate(parsed: ParsedMcpRequest, opts: {
+    toolGates?: Record<string, ToolGate>;
+    methodGates?: Record<string, ToolGate>;
+    dashboardRules?: Map<string, DashboardToolRule>;
+    toolGatePrecedence?: 'code' | 'dashboard';
+}): {
+    enforce: boolean;
+    config?: ToolGateConfig;
+    /** 5.19.0: a dashboard gate evaluated in addition to `config` (both must pass). */
+    additional?: ToolGateConfig;
+    source: GateSource;
+};
 /**
  * Create the MCP middleware. Attach AFTER `express.json()` — the body must
  * already be a parsed object.
  */
 declare function createMcpMiddleware(options: McpMiddlewareOptions): RequestHandler;
 
-export { MCP_VERIFIED_HOP_HEADER, type McpMiddlewareOptions, type ParsedMcpRequest, type ToolGate, type ToolGateConfig, createMcpMiddleware, isVerifiedHopValidFor, mcpDefaultEnforced, mcpToPdlss, parseMcpJsonRpc, parseVerifiedHop, serializeVerifiedHop };
+export { type DashboardToolRule, MCP_VERIFIED_HOP_HEADER, type McpMiddlewareOptions, type ParsedMcpRequest, type ToolGate, type ToolGateConfig, createMcpMiddleware, dashboardToolRules, isVerifiedHopValidFor, mcpDefaultEnforced, mcpToPdlss, parseMcpJsonRpc, parseVerifiedHop, resolveGate, serializeVerifiedHop };

package/dist/adapters/mcp.js

@@ -22,17 +22,19 @@ var mcp_exports = {};
 __export(mcp_exports, {
   MCP_VERIFIED_HOP_HEADER: () => MCP_VERIFIED_HOP_HEADER,
   createMcpMiddleware: () => createMcpMiddleware,
+  dashboardToolRules: () => dashboardToolRules,
   isVerifiedHopValidFor: () => isVerifiedHopValidFor,
   mcpDefaultEnforced: () => mcpDefaultEnforced,
   mcpToPdlss: () => mcpToPdlss,
   parseMcpJsonRpc: () => parseMcpJsonRpc,
   parseVerifiedHop: () => parseVerifiedHop,
+  resolveGate: () => resolveGate,
   serializeVerifiedHop: () => serializeVerifiedHop
 });
 module.exports = __toCommonJS(mcp_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.18.1";
+var SDK_VERSION = "5.20.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -274,7 +276,12 @@ function getCacheKey(request, counterpartyId) {
     // its start_checkout quote was served the cached quote-leg grant (no
     // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
     request.commercePhase || "",
-    request.checkoutSessionId || ""
+    request.checkoutSessionId || "",
+    // 5.19.0: a route_config purpose claim is checked server-side against
+    // the stored rule for this method + path, so it changes the verdict.
+    request.purposeSource || "",
+    request.requestMethod || "",
+    request.requestPath || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {
@@ -466,6 +473,9 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
+  if (config.actingProof?.connectorToken) {
+    body.actingProof = { connectorToken: config.actingProof.connectorToken };
+  }
   if (requestData.approvalHeldByRoute) body.approvalHeldByRoute = true;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
@@ -482,6 +492,11 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.purposeSource) body.purposeSource = requestData.purposeSource;
+  if (requestData.agentArtifacts) body.agentArtifacts = requestData.agentArtifacts;
+  if (requestData.metadata) body.metadata = requestData.metadata;
+  if (requestData.requestMethod) body.requestMethod = requestData.requestMethod;
+  if (requestData.requestPath) body.requestPath = requestData.requestPath;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
@@ -628,22 +643,46 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  const uncacheable = Boolean(request.commerceArtifacts);
+  const uncacheable = Boolean(request.commerceArtifacts) || Boolean(mergedConfig.actingProof);
   if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
       }
-      const hit = { ...cached };
-      if (request.attemptId) {
-        hit.attemptId = request.attemptId;
-      } else {
-        delete hit.attemptId;
-      }
-      return hit;
+      return sharedVerdict(cached, request);
+    }
+  }
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
+    const key = getCacheKey(request, mergedConfig.counterpartyId);
+    const pending = inflightVerifies.get(key);
+    if (pending) return sharedVerdict(await pending, request);
+    const flight = verifyViaApi(mergedConfig, request, urls, uncacheable);
+    inflightVerifies.set(key, flight);
+    try {
+      return await flight;
+    } finally {
+      inflightVerifies.delete(key);
     }
   }
+  return verifyViaApi(mergedConfig, request, urls, uncacheable);
+}
+var inflightVerifies = /* @__PURE__ */ new Map();
+var sharedVerdicts = /* @__PURE__ */ new WeakSet();
+function isSharedVerdict(result) {
+  return sharedVerdicts.has(result);
+}
+function sharedVerdict(source, request) {
+  const hit = { ...source };
+  if (request.attemptId) {
+    hit.attemptId = request.attemptId;
+  } else {
+    delete hit.attemptId;
+  }
+  sharedVerdicts.add(hit);
+  return hit;
+}
+async function verifyViaApi(mergedConfig, request, urls, uncacheable) {
   const enrichedRequest = { ...request };
   if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {
     enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;
@@ -671,9 +710,18 @@ async function verify(config, request, options) {
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;
     const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true && !aggregatedFailures?.some((f) => REJECTED_IDENTITY_DIMENSIONS.has(f.dimension));
+    const denyAgent = idVerifiedFromBackend && apiResponse.agent ? {
+      astraId: apiResponse.agent.astraId,
+      name: apiResponse.agent.name,
+      trustScore: apiResponse.agent.trustScore,
+      trustLevel: getTrustLevel(apiResponse.agent.trustScore),
+      blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
+      status: apiResponse.agent.agentStatus
+    } : void 0;
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
+      ...denyAgent && { agent: denyAgent },
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -713,7 +761,9 @@ async function verify(config, request, options) {
       fulfilment: apiResponse.fulfilment,
       mandates: apiResponse.mandates,
       kyaToken: apiResponse.kyaToken,
-      aep: apiResponse.aep
+      aep: apiResponse.aep,
+      // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+      warnings: apiResponse.warnings
     };
     return result2;
   }
@@ -781,7 +831,9 @@ async function verify(config, request, options) {
     // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
     mandates: apiResponse.mandates,
     kyaToken: apiResponse.kyaToken,
-    aep: apiResponse.aep
+    aep: apiResponse.aep,
+    // 5.20.0 (round 29.1): non-fatal integration warnings (e.g. events_url_missing).
+    warnings: apiResponse.warnings
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -807,8 +859,18 @@ async function verify(config, request, options) {
       cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
     }
   }
+  notifyVerificationListeners(request, result);
   return result;
 }
+var verificationListeners = /* @__PURE__ */ new Set();
+function notifyVerificationListeners(request, result) {
+  for (const listener of verificationListeners) {
+    try {
+      listener(result, request);
+    } catch {
+    }
+  }
+}
 async function recordDecision(config, sessionId, decision, reason) {
   const headers = { "Content-Type": "application/json" };
   if (config.apiKey) {
@@ -822,6 +884,42 @@ async function recordDecision(config, sessionId, decision, reason) {
   }).catch(() => {
   });
 }
+var refusedPolicyReads = /* @__PURE__ */ new Set();
+async function fetchRoutes(config, counterpartyId, options = {}) {
+  if (!counterpartyId) return null;
+  const headers = { "Content-Type": "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  try {
+    headers["X-AstraSync-SDK-Version"] = SDK_VERSION;
+    const response = await sdkFetch(
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/routes` + (options.codeGates?.length ? `?codeGates=${options.codeGates.map(encodeURIComponent).join(",")}` : ""),
+      { method: "GET", headers }
+    );
+    if (!response.ok) {
+      if ((response.status === 401 || response.status === 403 || response.status === 404) && !refusedPolicyReads.has(counterpartyId)) {
+        refusedPolicyReads.add(counterpartyId);
+        console.error(
+          `[VerificationGateway] the configured API key cannot read the route policy for ${counterpartyId} (HTTP ${response.status}). The key belongs to an account that does not own this endpoint, or the counterpartyId is wrong. The gateway is in PASS-THROUGH mode: no agent is being verified.`
+        );
+      }
+      return null;
+    }
+    const body = await response.json();
+    const type = body.data?.counterpartyType;
+    if (typeof type === "string" && options.onEndpointType) {
+      try {
+        options.onEndpointType(type);
+      } catch {
+      }
+    }
+    return body.data?.routes ?? [];
+  } catch {
+    return null;
+  }
+}
 
 // src/metadata-capture.ts
 var CAPTURE_SCHEMA_VERSION = 1;
@@ -1144,6 +1242,42 @@ async function awaitStepUpApproval(config, approval) {
   return "timeout";
 }
 
+// src/adapters/routes-cache.ts
+var DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
+function createRoutesCache(config, opts = {}) {
+  const refreshMs = opts.refreshMs ?? DEFAULT_ROUTES_REFRESH_MS;
+  let cached = [];
+  let lastFetchAt = 0;
+  let refreshing = null;
+  async function refresh() {
+    if (!config.counterpartyId) {
+      opts.onNoCounterparty?.();
+      return;
+    }
+    const fetched = await fetchRoutes(config, config.counterpartyId, opts.fetchOptions);
+    if (fetched) {
+      cached = fetched;
+      lastFetchAt = Date.now();
+      opts.onFetched?.(fetched);
+    }
+  }
+  function start() {
+    refreshing = refresh().catch(() => void 0).finally(() => {
+      refreshing = null;
+    });
+  }
+  start();
+  return {
+    async current() {
+      if (refreshing) await refreshing.catch(() => {
+      });
+      if (config.counterpartyId && Date.now() - lastFetchAt > refreshMs) start();
+      return cached;
+    },
+    peek: () => cached
+  };
+}
+
 // src/verified-hop.ts
 var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
 var MCP_VERIFIED_HOP_MAX_AGE_MS = 6e4;
@@ -1364,6 +1498,21 @@ function defaultMcpDenied(result, req, res) {
     }
   });
 }
+function dashboardToolRules(routes) {
+  const out = /* @__PURE__ */ new Map();
+  for (const r of routes) {
+    if (typeof r.tool !== "string" || !r.tool || r.legacy === true) continue;
+    if (out.has(r.tool)) continue;
+    out.set(r.tool, {
+      tool: r.tool,
+      ...r.purpose && { purpose: r.purpose },
+      ...r.action && { action: r.action },
+      ...r.resource && { resource: r.resource },
+      ...r.observe === true && { observe: true }
+    });
+  }
+  return out;
+}
 function resolveGate(parsed, opts) {
   if (!parsed.toolName) {
     const methodGate = opts.methodGates?.[parsed.method];
@@ -1373,8 +1522,30 @@ function resolveGate(parsed, opts) {
     return { enforce: false, source: "discovery_default" };
   }
   const toolGate = opts.toolGates?.[parsed.toolName];
+  const rule = opts.dashboardRules?.get(parsed.toolName);
+  const fromRule = (r) => r.observe ? { enforce: false, source: "dashboard" } : {
+    enforce: true,
+    config: {
+      ...r.purpose && { purpose: r.purpose },
+      ...r.action && { action: r.action },
+      ...r.resource && { resource: r.resource }
+    },
+    source: "dashboard"
+  };
+  const codeGated = toolGate !== void 0 && toolGate !== "observe";
+  if (rule && (opts.toolGatePrecedence === "dashboard" || !codeGated)) return fromRule(rule);
   if (toolGate !== void 0) {
-    return toolGate === "observe" ? { enforce: false, source: "toolGate" } : { enforce: true, config: toolGate, source: "toolGate" };
+    if (toolGate === "observe") return { enforce: false, source: "toolGate" };
+    if (rule && !rule.observe && rule.purpose && (rule.purpose !== toolGate.purpose || rule.action && rule.action !== toolGate.action)) {
+      const extra = fromRule(rule).config;
+      return {
+        enforce: true,
+        config: toolGate,
+        additional: { ...extra, ...!extra.resource && toolGate.resource && { resource: toolGate.resource } },
+        source: "toolGate"
+      };
+    }
+    return { enforce: true, config: toolGate, source: "toolGate" };
   }
   return { enforce: mcpDefaultEnforced(parsed), source: "tier" };
 }
@@ -1389,13 +1560,34 @@ function createMcpMiddleware(options) {
     verifiedHopMaxAgeMs,
     recordDecisions,
     enableRuntimeChallenge = true,
-    failOnError = "open",
+    failOnError = "closed",
+    toolGatePrecedence = "code",
+    routesRefreshMs,
+    skipEvaluation,
     ...config
   } = options;
+  const skipTools = new Set(skipEvaluation?.tools ?? []);
+  const skipMethods = new Set(skipEvaluation?.methods ?? []);
   if (config.apiBaseUrl) {
     prefetchWellKnown(config.apiBaseUrl).catch(() => {
     });
   }
+  const codeGatedTools = Object.entries(toolGates ?? {}).filter(([, g]) => g !== "observe").map(([name]) => name);
+  let warnedEndpointType = false;
+  const onEndpointType = (counterpartyType) => {
+    if (counterpartyType === "mcp_server" || warnedEndpointType) return;
+    warnedEndpointType = true;
+    console.warn(
+      `[VerificationGateway/MCP] counterpartyId ${config.counterpartyId} is a '${counterpartyType}' endpoint, not an 'mcp_server' endpoint. Dashboard tool rules are read from an mcp_server endpoint only: register a separate MCP endpoint for this server (same owner) and use its id here. See https://astrasync.ai/docs/mcp-integration#tool-rules.`
+    );
+  };
+  const rulesCache = config.apiKey && config.counterpartyId ? createRoutesCache(config, {
+    ...routesRefreshMs !== void 0 && { refreshMs: routesRefreshMs },
+    fetchOptions: {
+      ...codeGatedTools.length && { codeGates: codeGatedTools },
+      onEndpointType
+    }
+  }) : void 0;
   return async (req, res, next) => {
     try {
       if (skip) return next();
@@ -1444,10 +1636,19 @@ function createMcpMiddleware(options) {
           return next();
         }
       }
+      if (!parsed.toolName && skipMethods.has(parsed.method) && methodGates?.[parsed.method] === void 0) {
+        return next();
+      }
+      const dashboardRules = rulesCache ? dashboardToolRules(await rulesCache.current()) : void 0;
       const gateDecision = resolveGate(parsed, {
         toolGates,
-        methodGates
+        methodGates,
+        dashboardRules,
+        toolGatePrecedence
       });
+      if (!gateDecision.enforce && (parsed.toolName && skipTools.has(parsed.toolName) || !parsed.toolName && skipMethods.has(parsed.method))) {
+        return next();
+      }
       const credentials = extractCredentials(
         req.headers,
         req.query
@@ -1504,8 +1705,14 @@ function createMcpMiddleware(options) {
       const forwardedFor = req.headers["x-forwarded-for"];
       const forwardedForStr = Array.isArray(forwardedFor) ? forwardedFor.join(", ") : forwardedFor;
       const sourceIp = req.ip ?? (forwardedForStr ? forwardedForStr.split(",")[0].trim() : void 0);
+      const attemptRaw = readSingleHeader(req.headers["x-astra-attempt-id"]);
+      const metaAttempt = req.body?.params?._meta?.astrasync?.attemptId;
+      const attemptId = [attemptRaw, metaAttempt].find(
+        (v) => typeof v === "string" && /^att_[0-9a-f]{32}$/.test(v)
+      );
       const verificationRequest = {
         credentials,
+        ...attemptId && { attemptId },
         purpose: pdlss.purpose,
         action: pdlss.action,
         resource: pdlss.resource,
@@ -1544,6 +1751,20 @@ function createMcpMiddleware(options) {
           result.stepUpOutcome = outcome;
         }
       }
+      if (shouldEnforce && gateDecision.additional?.purpose && result.policyAllowed && !requiresHumanApproval(result)) {
+        const extra = mcpToPdlss(parsed, req.path, void 0, void 0, gateDecision.additional);
+        const extraResult = await verify(config, {
+          ...verificationRequest,
+          purpose: extra.purpose,
+          action: extra.action,
+          resource: extra.resource
+        });
+        if (!extraResult.policyAllowed || requiresHumanApproval(extraResult)) {
+          result = extraResult;
+          req.agentVerification = result;
+          sessionId = result.sessionId;
+        }
+      }
       if (!result.policyAllowed && isVerificationUnavailable(result) && (!shouldEnforce || isReadOnlyMcpMethod(parsed) && !credentials.astraId && !credentials.jwt)) {
         res.setHeader(VERIFICATION_STATUS_HEADER, "unavailable");
         return next();
@@ -1553,14 +1774,14 @@ function createMcpMiddleware(options) {
           res.setHeader("X-Astra-Gateway-Mode", "enforced");
           res.setHeader("X-Astra-Gateway-Reason", "evaluated-not-enforced");
         }
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "granted").catch(() => {
           });
         }
         return next();
       }
       if (!result.policyAllowed) {
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
           });
         }
@@ -1570,7 +1791,7 @@ function createMcpMiddleware(options) {
       }
       if (requiresHumanApproval(result)) {
         annotateApprovalRequired(result);
-        if (shouldRecordDecisions && sessionId) {
+        if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
           recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
           });
         }
@@ -1588,7 +1809,7 @@ function createMcpMiddleware(options) {
           })
         );
       }
-      if (shouldRecordDecisions && sessionId) {
+      if (shouldRecordDecisions && sessionId && !isSharedVerdict(result)) {
         recordDecision(config, sessionId, "granted").catch(() => {
         });
       }
@@ -1629,11 +1850,13 @@ function createMcpMiddleware(options) {
 0 && (module.exports = {
   MCP_VERIFIED_HOP_HEADER,
   createMcpMiddleware,
+  dashboardToolRules,
   isVerifiedHopValidFor,
   mcpDefaultEnforced,
   mcpToPdlss,
   parseMcpJsonRpc,
   parseVerifiedHop,
+  resolveGate,
   serializeVerifiedHop
 });
 //# sourceMappingURL=mcp.js.map