@astrasyncai/adapter-edge 1.9.1 → 1.10.0

package/README.md

@@ -1,7 +1,7 @@
 # @astrasyncai/adapter-edge
 
 **AstraSync Trusted Agent Gateway** — edge adapters for **Vercel Edge**,
-**Cloudflare Workers**, and **Fastly Compute**. The gateway classifies and
+**Cloudflare Workers**, **Fastly Compute**, and **Akamai EdgeWorkers**. The gateway classifies and
 verifies inbound AI-agent traffic in front of your existing site. Zero site
 changes; **observe-only by default**.
 
@@ -18,7 +18,12 @@ only sniffs and forwards raw artifacts.
 falls back to observe + pass-through. An unreachable backend — or a
 misconfigured gateway — can never break your site.
 
-All three adapters share the same engine
+**Where it runs:** after your CDN's own firewall and bot rules. Requests
+those rules block never reach the adapter. To see the agents your edge
+blocks, connect its security logs on the endpoint page (**Edge logs**, see
+<https://astrasync.ai/docs/edge-log-connectors>).
+
+All the adapters share the same engine
 (`@astrasyncai/verification-gateway/edge-core`) as the Lambda@Edge adapter
 (`@astrasyncai/adapter-lambda`); use that package for CloudFront.
 
@@ -52,6 +57,18 @@ Deploy the worker on the routes you want covered. Pass traffic is forwarded
 to your origin with `fetch()`; telemetry runs in `ctx.waitUntil`, off the
 latency path.
 
+Ready-made project: `templates/cloudflare` in this package (`wrangler.toml`,
+worker, and `compose.ts`). If your zone **already runs a Worker on the
+route** (Cloudflare allows one per route), pass your handler as `forward`.
+The gateway runs first, and passed requests go to your code instead of
+straight to the origin:
+
+```ts
+export default {
+  fetch: createGatewayHandler({ forward: (req, env, ctx) => existing.fetch(req, env, ctx) }),
+};
+```
+
 ### Vercel Edge Middleware
 
 This package does not import `next`, so the middleware returns either a
@@ -101,6 +118,30 @@ Optional geolocation enrichment (country/city/ASN) via the Fastly runtime
 is behind the `geo: true` flag; the `fastly:geolocation` import is dynamic,
 so the base build stays runtime-neutral.
 
+### Akamai EdgeWorkers
+
+```js
+// main.js
+import { httpRequest } from 'http-request';
+import { createOnClientRequest } from '@astrasyncai/adapter-edge/akamai';
+
+export const onClientRequest = createOnClientRequest({
+  httpRequest,
+  counterpartyId: 'ASTRAE-…',
+  counterpartyUrl: 'https://www.example.com',
+  apiKey: '…',
+  apiBaseUrl: 'https://www.example.com/.astrasync/api',
+});
+```
+
+Runs in `onClientRequest`, after App & API Protector and Bot Manager.
+Detection is header-only, because request bodies aren't readable at this stage.
+The client IP comes from `True-Client-IP`, so enable that property behaviour.
+Sub-requests go to a hostname on your property: add the rule in
+`templates/akamai/README.md` that routes `/.astrasync/api/*` to `astrasync.ai`.
+EdgeWorkers lacks `fetch`, so the adapter installs minimal shims over the
+`httpRequest` you pass in.
+
 ## Configuration
 
 | Option            | Env var                      | Default                    | Notes                                                                     |
@@ -141,7 +182,10 @@ platform contributes the connection-layer signals it can see:
 | HTTP version       | `request.cf.httpProtocol`                              | —                                       | —                       | viewer headers                    |
 | **JA3 / JA4**      | `request.cf.botManagement` (Bot Management zones only) | `x-vercel-ja4-digest` (BotID; JA4 only) | —                       | **viewer headers (both, 2.2.0+)** |
 | Header structure   | —                                                      | —                                       | —                       | viewer header-order/-count        |
-| PoP/colo, TCP RTT  | `request.cf.colo` / `.clientTcpRtt`                    | —                                       | —                       | —                                 |
+
+**Akamai EdgeWorkers:** client IP (`True-Client-IP`), country, region, city,
+continent and postal code from `request.userLocation`. No TLS fingerprints.
+| PoP/colo, TCP RTT | `request.cf.colo` / `.clientTcpRtt` | — | — | — |
 
 Everything captured surfaces on the endpoint's traffic feed in the
 AstraSync dashboard. For the cross-integration view (edge vs SDK-behind-CDN

package/dist/akamai.d.ts

@@ -0,0 +1,92 @@
+import { NormalizedRequest } from '@astrasyncai/verification-gateway/edge-core';
+import { E as EdgeGatewayOptions } from './types-BhaNxFeN.js';
+import '@astrasyncai/verification-gateway/edge-config';
+
+/**
+ * AstraSync Trusted Agent Gateway — Akamai EdgeWorkers adapter (round 31).
+ *
+ * ```js
+ * // main.js (EdgeWorkers bundle)
+ * import { httpRequest } from 'http-request';
+ * import { createOnClientRequest } from '@astrasyncai/adapter-edge/akamai';
+ *
+ * export const onClientRequest = createOnClientRequest({
+ *   httpRequest,
+ *   counterpartyId: 'ASTRAE-…',
+ *   counterpartyUrl: 'https://www.example.com',
+ *   apiKey: '…', // from an EdgeKV item or a PMUSER variable at bundle time
+ *   apiBaseUrl: 'https://www.example.com/.astrasync/api', // see below
+ * });
+ * ```
+ *
+ * Runs in `onClientRequest`, after Akamai's App & API Protector / Bot
+ * Manager — requests those block never reach it (connect the Akamai SIEM
+ * stream as an edge-log connector to see them). v1 is header-only: the
+ * request body is not readable in `onClientRequest`, so body-borne commerce
+ * protocols are not detected at this edge (headers still are).
+ *
+ * EdgeWorkers has no `fetch` / `Headers` / `AbortSignal.timeout`; the
+ * adapter installs minimal versions backed by the `http-request` module you
+ * pass in, only where the runtime lacks them. Sub-requests may need to target
+ * a hostname served by your Akamai property: route a path such as
+ * `/.astrasync/api/*` to the `astrasync.ai` origin and point `apiBaseUrl`
+ * there.
+ *
+ * Observe never blocks; any internal error passes the request through.
+ */
+
+/** The EdgeWorkers `http-request` module's `httpRequest` (structural). */
+type AkamaiHttpRequest = (url: string, options?: {
+    method?: string;
+    headers?: Record<string, string | string[]>;
+    body?: string;
+    timeout?: number;
+}) => Promise<{
+    status: number;
+    ok?: boolean;
+    getHeader?(name: string): string[] | null | undefined;
+    text(): Promise<string>;
+    json?(): Promise<unknown>;
+}>;
+/** The subset of the EdgeWorkers `Request` the gateway uses (structural). */
+interface AkamaiRequest {
+    method: string;
+    host: string;
+    path: string;
+    query?: string;
+    scheme?: string;
+    getHeaders(): Record<string, string[]>;
+    setHeader(name: string, value: string | string[]): void;
+    removeHeader(name: string): void;
+    respondWith(status: number, headers: Record<string, string | string[]>, body: string, denyReason?: string): void;
+    userLocation?: {
+        country?: string;
+        region?: string;
+        city?: string;
+        continent?: string;
+        zipCode?: string;
+    };
+}
+interface AkamaiGatewayOptions extends EdgeGatewayOptions {
+    /** The EdgeWorkers `httpRequest` from `import { httpRequest } from 'http-request'`. */
+    httpRequest: AkamaiHttpRequest;
+    /** Header carrying the client IP. Default `true-client-ip` (enable it on the property). */
+    clientIpHeader?: string;
+}
+/**
+ * Install fetch-API shims over `httpRequest` where the runtime lacks them.
+ * Exported for tests; idempotent; never replaces a native implementation.
+ */
+declare function installAkamaiFetchShims(httpRequest: AkamaiHttpRequest, timeoutMs?: number): void;
+/** Normalise an EdgeWorkers request into the edge core's shape (header-only). */
+declare function normalizeAkamaiRequest(request: AkamaiRequest, clientIpHeader?: string): NormalizedRequest;
+/**
+ * Create the `onClientRequest` handler. A pass mutates the request in place
+ * (spoofable `x-astrasync-*` headers stripped, trust headers set) and lets
+ * Akamai forward it; an enforce-mode deny answers via `respondWith`.
+ * EdgeWorkers has no `waitUntil`, so telemetry is awaited under the
+ * gateway's beacon budget.
+ */
+declare function createOnClientRequest(options: AkamaiGatewayOptions): (request: AkamaiRequest) => Promise<void>;
+
+export { type AkamaiGatewayOptions, type AkamaiHttpRequest, type AkamaiRequest, EdgeGatewayOptions, createOnClientRequest, installAkamaiFetchShims, normalizeAkamaiRequest };

package/dist/akamai.js

@@ -0,0 +1,176 @@
+// src/akamai.ts
+import { evaluateEdgeRequest } from "@astrasyncai/verification-gateway/edge-core";
+
+// src/config.ts
+import {
+  getEdgeConfig,
+  DEFAULT_EDGE_CONFIG
+} from "@astrasyncai/verification-gateway/edge-config";
+var DEFAULT_API_BASE_URL = "https://astrasync.ai/api";
+function defaultLogger(prefix) {
+  return (level, message, data) => {
+    console[level === "info" ? "log" : level](`[${prefix}] ${message}`, data ?? "");
+  };
+}
+function resolveOptions(options, env, logPrefix) {
+  const e = env ?? {};
+  return {
+    ...options,
+    apiBaseUrl: options.apiBaseUrl ?? e.ASTRASYNC_API_BASE_URL ?? DEFAULT_API_BASE_URL,
+    publicBaseUrl: options.publicBaseUrl ?? e.ASTRASYNC_PUBLIC_BASE_URL,
+    counterpartyId: options.counterpartyId ?? e.ASTRASYNC_COUNTERPARTY_ID,
+    counterpartyUrl: options.counterpartyUrl ?? e.ASTRASYNC_COUNTERPARTY_URL,
+    apiKey: options.apiKey ?? e.ASTRASYNC_API_KEY,
+    log: options.log ?? defaultLogger(logPrefix)
+  };
+}
+function isConfigured(resolved) {
+  if (resolved.counterpartyId && resolved.counterpartyUrl) return true;
+  resolved.log(
+    "error",
+    "counterpartyId/counterpartyUrl are not configured \u2014 passing all traffic through. Set the ASTRASYNC_COUNTERPARTY_ID / ASTRASYNC_COUNTERPARTY_URL environment variables or pass them as options."
+  );
+  return false;
+}
+async function loadConfig(resolved) {
+  try {
+    return await getEdgeConfig(
+      { apiBaseUrl: resolved.apiBaseUrl, apiKey: resolved.apiKey },
+      resolved.counterpartyId,
+      { ttlMs: resolved.configTtlMs }
+    );
+  } catch {
+    return resolved.fallbackConfig ?? DEFAULT_EDGE_CONFIG;
+  }
+}
+
+// src/akamai.ts
+var MiniHeaders = class _MiniHeaders {
+  m = /* @__PURE__ */ new Map();
+  constructor(init) {
+    if (init instanceof _MiniHeaders) init.forEach((v, k) => this.set(k, v));
+    else if (Array.isArray(init)) for (const [k, v] of init) this.set(k, v);
+    else if (init) for (const k of Object.keys(init)) this.set(k, init[k]);
+  }
+  get(name) {
+    return this.m.get(name.toLowerCase()) ?? null;
+  }
+  set(name, value) {
+    this.m.set(name.toLowerCase(), String(value));
+  }
+  has(name) {
+    return this.m.has(name.toLowerCase());
+  }
+  delete(name) {
+    this.m.delete(name.toLowerCase());
+  }
+  forEach(fn) {
+    this.m.forEach((v, k) => fn(v, k));
+  }
+  toObject() {
+    return Object.fromEntries(this.m);
+  }
+};
+function installAkamaiFetchShims(httpRequest, timeoutMs = 3e3) {
+  const g = globalThis;
+  if (typeof g.Headers === "undefined") g.Headers = MiniHeaders;
+  const Abort = g.AbortSignal;
+  if (!Abort) g.AbortSignal = { timeout: () => void 0 };
+  else if (typeof Abort.timeout !== "function") Abort.timeout = () => void 0;
+  if (typeof g.fetch === "function") return;
+  g.fetch = async (input, init = {}) => {
+    const url = typeof input === "string" ? input : String(input.url ?? input);
+    const headers = init.headers instanceof MiniHeaders ? init.headers.toObject() : Array.isArray(init.headers) ? Object.fromEntries(init.headers) : init.headers ?? {};
+    const res = await httpRequest(url, {
+      method: init.method ?? "GET",
+      headers,
+      ...typeof init.body === "string" && { body: init.body },
+      timeout: timeoutMs
+    });
+    const text = await res.text();
+    return {
+      ok: res.ok ?? (res.status >= 200 && res.status < 300),
+      status: res.status,
+      headers: { get: (name) => res.getHeader?.(name)?.[0] ?? null },
+      text: async () => text,
+      json: async () => JSON.parse(text)
+    };
+  };
+}
+function normalizeAkamaiRequest(request, clientIpHeader = "true-client-ip") {
+  const headers = {};
+  for (const [name, values] of Object.entries(request.getHeaders() ?? {})) {
+    headers[name.toLowerCase()] = Array.isArray(values) ? values.join(", ") : String(values);
+  }
+  const loc = request.userLocation ?? {};
+  const connection = {};
+  const clientIp = headers[clientIpHeader.toLowerCase()];
+  if (clientIp) connection.ip = clientIp;
+  if (loc.country) connection.country = loc.country;
+  if (loc.region) connection.region = loc.region;
+  if (loc.city) connection.city = loc.city;
+  if (loc.continent) connection.continent = loc.continent;
+  if (loc.zipCode) connection.postalCode = loc.zipCode;
+  return {
+    method: request.method,
+    uri: request.path,
+    querystring: request.query ?? "",
+    headers,
+    ...clientIp && { clientIp },
+    ...Object.keys(connection).length > 0 && { connection }
+  };
+}
+function createOnClientRequest(options) {
+  return async function onClientRequest(request) {
+    const resolved = resolveOptions(options, void 0, "astrasync-edge/akamai");
+    try {
+      if (!isConfigured(resolved)) return;
+      installAkamaiFetchShims(options.httpRequest, resolved.budgets?.verifyEnforceMs ?? 3e3);
+      const config = await loadConfig(resolved);
+      const normalized = normalizeAkamaiRequest(request, options.clientIpHeader);
+      const { application } = await evaluateEdgeRequest(
+        {
+          apiBaseUrl: resolved.apiBaseUrl,
+          publicBaseUrl: resolved.publicBaseUrl,
+          counterpartyId: resolved.counterpartyId,
+          counterpartyUrl: resolved.counterpartyUrl,
+          budgets: resolved.budgets,
+          adapter: "akamai",
+          random: resolved.random,
+          log: resolved.log
+        },
+        normalized,
+        config,
+        resolved.apiKey
+      );
+      if (application.action === "respond") {
+        request.respondWith(
+          application.status,
+          { "content-type": ["application/json"], ...application.headers },
+          JSON.stringify(application.bodyJson),
+          "astrasync-gateway"
+        );
+        return;
+      }
+      for (const prefix of application.stripHeaderPrefixes) {
+        const p = prefix.toLowerCase();
+        for (const name of Object.keys(normalized.headers)) {
+          if (name.startsWith(p)) request.removeHeader(name);
+        }
+      }
+      for (const [name, value] of Object.entries(application.injectHeaders)) {
+        request.setHeader(name, value);
+      }
+    } catch (err) {
+      resolved.log("error", "gateway error \u2014 passing request through", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  };
+}
+export {
+  createOnClientRequest,
+  installAkamaiFetchShims,
+  normalizeAkamaiRequest
+};
+//# sourceMappingURL=akamai.js.map

package/dist/akamai.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/akamai.ts","../src/config.ts"],"sourcesContent":["/**\n * AstraSync Trusted Agent Gateway — Akamai EdgeWorkers adapter (round 31).\n *\n * ```js\n * // main.js (EdgeWorkers bundle)\n * import { httpRequest } from 'http-request';\n * import { createOnClientRequest } from '@astrasyncai/adapter-edge/akamai';\n *\n * export const onClientRequest = createOnClientRequest({\n *   httpRequest,\n *   counterpartyId: 'ASTRAE-…',\n *   counterpartyUrl: 'https://www.example.com',\n *   apiKey: '…', // from an EdgeKV item or a PMUSER variable at bundle time\n *   apiBaseUrl: 'https://www.example.com/.astrasync/api', // see below\n * });\n * ```\n *\n * Runs in `onClientRequest`, after Akamai's App & API Protector / Bot\n * Manager — requests those block never reach it (connect the Akamai SIEM\n * stream as an edge-log connector to see them). v1 is header-only: the\n * request body is not readable in `onClientRequest`, so body-borne commerce\n * protocols are not detected at this edge (headers still are).\n *\n * EdgeWorkers has no `fetch` / `Headers` / `AbortSignal.timeout`; the\n * adapter installs minimal versions backed by the `http-request` module you\n * pass in, only where the runtime lacks them. Sub-requests may need to target\n * a hostname served by your Akamai property: route a path such as\n * `/.astrasync/api/*` to the `astrasync.ai` origin and point `apiBaseUrl`\n * there.\n *\n * Observe never blocks; any internal error passes the request through.\n */\n\nimport { evaluateEdgeRequest } from '@astrasyncai/verification-gateway/edge-core';\nimport type { NormalizedRequest } from '@astrasyncai/verification-gateway/edge-core';\nimport { resolveOptions, isConfigured, loadConfig } from './config';\nimport type { EdgeGatewayOptions } from './types';\n\n/** The EdgeWorkers `http-request` module's `httpRequest` (structural). */\nexport type AkamaiHttpRequest = (\n  url: string,\n  options?: {\n    method?: string;\n    headers?: Record<string, string | string[]>;\n    body?: string;\n    timeout?: number;\n  }\n) => Promise<{\n  status: number;\n  ok?: boolean;\n  getHeader?(name: string): string[] | null | undefined;\n  text(): Promise<string>;\n  json?(): Promise<unknown>;\n}>;\n\n/** The subset of the EdgeWorkers `Request` the gateway uses (structural). */\nexport interface AkamaiRequest {\n  method: string;\n  host: string;\n  path: string;\n  query?: string;\n  scheme?: string;\n  getHeaders(): Record<string, string[]>;\n  setHeader(name: string, value: string | string[]): void;\n  removeHeader(name: string): void;\n  respondWith(\n    status: number,\n    headers: Record<string, string | string[]>,\n    body: string,\n    denyReason?: string\n  ): void;\n  userLocation?: {\n    country?: string;\n    region?: string;\n    city?: string;\n    continent?: string;\n    zipCode?: string;\n  };\n}\n\nexport interface AkamaiGatewayOptions extends EdgeGatewayOptions {\n  /** The EdgeWorkers `httpRequest` from `import { httpRequest } from 'http-request'`. */\n  httpRequest: AkamaiHttpRequest;\n  /** Header carrying the client IP. Default `true-client-ip` (enable it on the property). */\n  clientIpHeader?: string;\n}\n\n/** Minimal `Headers` for runtimes without one (case-insensitive, string values). */\nclass MiniHeaders {\n  private readonly m = new Map<string, string>();\n  constructor(init?: Record<string, string> | Array<[string, string]> | MiniHeaders) {\n    if (init instanceof MiniHeaders) init.forEach((v, k) => this.set(k, v));\n    else if (Array.isArray(init)) for (const [k, v] of init) this.set(k, v);\n    else if (init) for (const k of Object.keys(init)) this.set(k, init[k]);\n  }\n  get(name: string): string | null {\n    return this.m.get(name.toLowerCase()) ?? null;\n  }\n  set(name: string, value: string): void {\n    this.m.set(name.toLowerCase(), String(value));\n  }\n  has(name: string): boolean {\n    return this.m.has(name.toLowerCase());\n  }\n  delete(name: string): void {\n    this.m.delete(name.toLowerCase());\n  }\n  forEach(fn: (value: string, name: string) => void): void {\n    this.m.forEach((v, k) => fn(v, k));\n  }\n  toObject(): Record<string, string> {\n    return Object.fromEntries(this.m);\n  }\n}\n\n/**\n * Install fetch-API shims over `httpRequest` where the runtime lacks them.\n * Exported for tests; idempotent; never replaces a native implementation.\n */\nexport function installAkamaiFetchShims(httpRequest: AkamaiHttpRequest, timeoutMs = 3000): void {\n  const g = globalThis as Record<string, unknown>;\n  if (typeof g.Headers === 'undefined') g.Headers = MiniHeaders;\n  const Abort = g.AbortSignal as { timeout?: unknown } | undefined;\n  if (!Abort) g.AbortSignal = { timeout: () => undefined };\n  else if (typeof Abort.timeout !== 'function') Abort.timeout = () => undefined;\n  if (typeof g.fetch === 'function') return;\n  g.fetch = async (\n    input: unknown,\n    init: { method?: string; headers?: unknown; body?: unknown } = {}\n  ) => {\n    const url =\n      typeof input === 'string' ? input : String((input as { url?: string }).url ?? input);\n    const headers =\n      init.headers instanceof MiniHeaders\n        ? init.headers.toObject()\n        : Array.isArray(init.headers)\n          ? Object.fromEntries(init.headers as Array<[string, string]>)\n          : ((init.headers as Record<string, string> | undefined) ?? {});\n    const res = await httpRequest(url, {\n      method: init.method ?? 'GET',\n      headers,\n      ...(typeof init.body === 'string' && { body: init.body }),\n      timeout: timeoutMs,\n    });\n    const text = await res.text();\n    return {\n      ok: res.ok ?? (res.status >= 200 && res.status < 300),\n      status: res.status,\n      headers: { get: (name: string) => res.getHeader?.(name)?.[0] ?? null },\n      text: async () => text,\n      json: async () => JSON.parse(text),\n    };\n  };\n}\n\n/** Normalise an EdgeWorkers request into the edge core's shape (header-only). */\nexport function normalizeAkamaiRequest(\n  request: AkamaiRequest,\n  clientIpHeader = 'true-client-ip'\n): NormalizedRequest {\n  const headers: Record<string, string> = {};\n  for (const [name, values] of Object.entries(request.getHeaders() ?? {})) {\n    headers[name.toLowerCase()] = Array.isArray(values) ? values.join(', ') : String(values);\n  }\n  const loc = request.userLocation ?? {};\n  const connection: Record<string, string> = {};\n  const clientIp = headers[clientIpHeader.toLowerCase()];\n  if (clientIp) connection.ip = clientIp;\n  if (loc.country) connection.country = loc.country;\n  if (loc.region) connection.region = loc.region;\n  if (loc.city) connection.city = loc.city;\n  if (loc.continent) connection.continent = loc.continent;\n  if (loc.zipCode) connection.postalCode = loc.zipCode;\n  return {\n    method: request.method,\n    uri: request.path,\n    querystring: request.query ?? '',\n    headers,\n    ...(clientIp && { clientIp }),\n    ...(Object.keys(connection).length > 0 && { connection }),\n  };\n}\n\n/**\n * Create the `onClientRequest` handler. A pass mutates the request in place\n * (spoofable `x-astrasync-*` headers stripped, trust headers set) and lets\n * Akamai forward it; an enforce-mode deny answers via `respondWith`.\n * EdgeWorkers has no `waitUntil`, so telemetry is awaited under the\n * gateway's beacon budget.\n */\nexport function createOnClientRequest(options: AkamaiGatewayOptions) {\n  return async function onClientRequest(request: AkamaiRequest): Promise<void> {\n    const resolved = resolveOptions(options, undefined, 'astrasync-edge/akamai');\n    try {\n      if (!isConfigured(resolved)) return;\n      installAkamaiFetchShims(options.httpRequest, resolved.budgets?.verifyEnforceMs ?? 3000);\n      const config = await loadConfig(resolved);\n      const normalized = normalizeAkamaiRequest(request, options.clientIpHeader);\n      const { application } = await evaluateEdgeRequest(\n        {\n          apiBaseUrl: resolved.apiBaseUrl,\n          publicBaseUrl: resolved.publicBaseUrl,\n          counterpartyId: resolved.counterpartyId,\n          counterpartyUrl: resolved.counterpartyUrl,\n          budgets: resolved.budgets,\n          adapter: 'akamai',\n          random: resolved.random,\n          log: resolved.log,\n        },\n        normalized,\n        config,\n        resolved.apiKey\n      );\n      if (application.action === 'respond') {\n        request.respondWith(\n          application.status,\n          { 'content-type': ['application/json'], ...application.headers },\n          JSON.stringify(application.bodyJson),\n          'astrasync-gateway'\n        );\n        return;\n      }\n      for (const prefix of application.stripHeaderPrefixes) {\n        const p = prefix.toLowerCase();\n        for (const name of Object.keys(normalized.headers)) {\n          if (name.startsWith(p)) request.removeHeader(name);\n        }\n      }\n      for (const [name, value] of Object.entries(application.injectHeaders)) {\n        request.setHeader(name, value);\n      }\n    } catch (err) {\n      // Fail-open, unconditionally: the gateway must never take the site down.\n      resolved.log('error', 'gateway error — passing request through', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  };\n}\n\nexport type { EdgeGatewayOptions } from './types';\n","/**\n * Option/environment resolution and dashboard EdgeConfig loading shared by\n * the platform adapters.\n */\n\nimport {\n  getEdgeConfig,\n  DEFAULT_EDGE_CONFIG,\n  type EdgeConfig,\n} from '@astrasyncai/verification-gateway/edge-config';\nimport type { EdgeLogger } from '@astrasyncai/verification-gateway/edge-core';\nimport type { EdgeGatewayOptions } from './types';\n\nexport const DEFAULT_API_BASE_URL = 'https://astrasync.ai/api';\n\nexport interface ResolvedGatewayOptions extends EdgeGatewayOptions {\n  apiBaseUrl: string;\n  log: EdgeLogger;\n}\n\nexport function defaultLogger(prefix: string): EdgeLogger {\n  return (level, message, data) => {\n    console[level === 'info' ? 'log' : level](`[${prefix}] ${message}`, data ?? '');\n  };\n}\n\n/**\n * Merge explicit options with runtime environment variables (options win)\n * and apply defaults. `env` is the platform's environment map — Cloudflare\n * passes the worker `env` binding object, Vercel passes `process.env`,\n * Fastly Compute has no ambient env map (configure via options).\n */\nexport function resolveOptions(\n  options: EdgeGatewayOptions,\n  env: Record<string, string | undefined> | undefined,\n  logPrefix: string\n): ResolvedGatewayOptions {\n  const e = env ?? {};\n  return {\n    ...options,\n    apiBaseUrl: options.apiBaseUrl ?? e.ASTRASYNC_API_BASE_URL ?? DEFAULT_API_BASE_URL,\n    publicBaseUrl: options.publicBaseUrl ?? e.ASTRASYNC_PUBLIC_BASE_URL,\n    counterpartyId: options.counterpartyId ?? e.ASTRASYNC_COUNTERPARTY_ID,\n    counterpartyUrl: options.counterpartyUrl ?? e.ASTRASYNC_COUNTERPARTY_URL,\n    apiKey: options.apiKey ?? e.ASTRASYNC_API_KEY,\n    log: options.log ?? defaultLogger(logPrefix),\n  };\n}\n\n/**\n * Missing identity means the gateway cannot evaluate anything — it fails\n * OPEN (all traffic passes untouched) and says why, once per request.\n */\nexport function isConfigured(\n  resolved: ResolvedGatewayOptions\n): resolved is ResolvedGatewayOptions & { counterpartyId: string; counterpartyUrl: string } {\n  if (resolved.counterpartyId && resolved.counterpartyUrl) return true;\n  resolved.log(\n    'error',\n    'counterpartyId/counterpartyUrl are not configured — passing all traffic through. ' +\n      'Set the ASTRASYNC_COUNTERPARTY_ID / ASTRASYNC_COUNTERPARTY_URL environment variables ' +\n      'or pass them as options.'\n  );\n  return false;\n}\n\n/**\n * Load the effective EdgeConfig. Delegates caching/fallback/degradation to\n * the SDK (60s TTL, stale-while-revalidate, enforce→observe degradation on\n * prolonged staleness) and never throws.\n */\nexport async function loadConfig(\n  resolved: ResolvedGatewayOptions & { counterpartyId: string }\n): Promise<EdgeConfig> {\n  try {\n    return await getEdgeConfig(\n      { apiBaseUrl: resolved.apiBaseUrl, apiKey: resolved.apiKey },\n      resolved.counterpartyId,\n      { ttlMs: resolved.configTtlMs }\n    );\n  } catch {\n    return resolved.fallbackConfig ?? DEFAULT_EDGE_CONFIG;\n  }\n}\n"],"mappings":";AAiCA,SAAS,2BAA2B;;;AC5BpC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAIA,IAAM,uBAAuB;AAO7B,SAAS,cAAc,QAA4B;AACxD,SAAO,CAAC,OAAO,SAAS,SAAS;AAC/B,YAAQ,UAAU,SAAS,QAAQ,KAAK,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,EAAE;AAAA,EAChF;AACF;AAQO,SAAS,eACd,SACA,KACA,WACwB;AACxB,QAAM,IAAI,OAAO,CAAC;AAClB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,QAAQ,cAAc,EAAE,0BAA0B;AAAA,IAC9D,eAAe,QAAQ,iBAAiB,EAAE;AAAA,IAC1C,gBAAgB,QAAQ,kBAAkB,EAAE;AAAA,IAC5C,iBAAiB,QAAQ,mBAAmB,EAAE;AAAA,IAC9C,QAAQ,QAAQ,UAAU,EAAE;AAAA,IAC5B,KAAK,QAAQ,OAAO,cAAc,SAAS;AAAA,EAC7C;AACF;AAMO,SAAS,aACd,UAC0F;AAC1F,MAAI,SAAS,kBAAkB,SAAS,gBAAiB,QAAO;AAChE,WAAS;AAAA,IACP;AAAA,IACA;AAAA,EAGF;AACA,SAAO;AACT;AAOA,eAAsB,WACpB,UACqB;AACrB,MAAI;AACF,WAAO,MAAM;AAAA,MACX,EAAE,YAAY,SAAS,YAAY,QAAQ,SAAS,OAAO;AAAA,MAC3D,SAAS;AAAA,MACT,EAAE,OAAO,SAAS,YAAY;AAAA,IAChC;AAAA,EACF,QAAQ;AACN,WAAO,SAAS,kBAAkB;AAAA,EACpC;AACF;;;ADKA,IAAM,cAAN,MAAM,aAAY;AAAA,EACC,IAAI,oBAAI,IAAoB;AAAA,EAC7C,YAAY,MAAuE;AACjF,QAAI,gBAAgB,aAAa,MAAK,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,GAAG,CAAC,CAAC;AAAA,aAC7D,MAAM,QAAQ,IAAI,EAAG,YAAW,CAAC,GAAG,CAAC,KAAK,KAAM,MAAK,IAAI,GAAG,CAAC;AAAA,aAC7D,KAAM,YAAW,KAAK,OAAO,KAAK,IAAI,EAAG,MAAK,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,MAA6B;AAC/B,WAAO,KAAK,EAAE,IAAI,KAAK,YAAY,CAAC,KAAK;AAAA,EAC3C;AAAA,EACA,IAAI,MAAc,OAAqB;AACrC,SAAK,EAAE,IAAI,KAAK,YAAY,GAAG,OAAO,KAAK,CAAC;AAAA,EAC9C;AAAA,EACA,IAAI,MAAuB;AACzB,WAAO,KAAK,EAAE,IAAI,KAAK,YAAY,CAAC;AAAA,EACtC;AAAA,EACA,OAAO,MAAoB;AACzB,SAAK,EAAE,OAAO,KAAK,YAAY,CAAC;AAAA,EAClC;AAAA,EACA,QAAQ,IAAiD;AACvD,SAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EACnC;AAAA,EACA,WAAmC;AACjC,WAAO,OAAO,YAAY,KAAK,CAAC;AAAA,EAClC;AACF;AAMO,SAAS,wBAAwB,aAAgC,YAAY,KAAY;AAC9F,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,YAAY,YAAa,GAAE,UAAU;AAClD,QAAM,QAAQ,EAAE;AAChB,MAAI,CAAC,MAAO,GAAE,cAAc,EAAE,SAAS,MAAM,OAAU;AAAA,WAC9C,OAAO,MAAM,YAAY,WAAY,OAAM,UAAU,MAAM;AACpE,MAAI,OAAO,EAAE,UAAU,WAAY;AACnC,IAAE,QAAQ,OACR,OACA,OAA+D,CAAC,MAC7D;AACH,UAAM,MACJ,OAAO,UAAU,WAAW,QAAQ,OAAQ,MAA2B,OAAO,KAAK;AACrF,UAAM,UACJ,KAAK,mBAAmB,cACpB,KAAK,QAAQ,SAAS,IACtB,MAAM,QAAQ,KAAK,OAAO,IACxB,OAAO,YAAY,KAAK,OAAkC,IACxD,KAAK,WAAkD,CAAC;AAClE,UAAM,MAAM,MAAM,YAAY,KAAK;AAAA,MACjC,QAAQ,KAAK,UAAU;AAAA,MACvB;AAAA,MACA,GAAI,OAAO,KAAK,SAAS,YAAY,EAAE,MAAM,KAAK,KAAK;AAAA,MACvD,SAAS;AAAA,IACX,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO;AAAA,MACL,IAAI,IAAI,OAAO,IAAI,UAAU,OAAO,IAAI,SAAS;AAAA,MACjD,QAAQ,IAAI;AAAA,MACZ,SAAS,EAAE,KAAK,CAAC,SAAiB,IAAI,YAAY,IAAI,IAAI,CAAC,KAAK,KAAK;AAAA,MACrE,MAAM,YAAY;AAAA,MAClB,MAAM,YAAY,KAAK,MAAM,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAGO,SAAS,uBACd,SACA,iBAAiB,kBACE;AACnB,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,QAAQ,WAAW,KAAK,CAAC,CAAC,GAAG;AACvE,YAAQ,KAAK,YAAY,CAAC,IAAI,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,MAAM;AAAA,EACzF;AACA,QAAM,MAAM,QAAQ,gBAAgB,CAAC;AACrC,QAAM,aAAqC,CAAC;AAC5C,QAAM,WAAW,QAAQ,eAAe,YAAY,CAAC;AACrD,MAAI,SAAU,YAAW,KAAK;AAC9B,MAAI,IAAI,QAAS,YAAW,UAAU,IAAI;AAC1C,MAAI,IAAI,OAAQ,YAAW,SAAS,IAAI;AACxC,MAAI,IAAI,KAAM,YAAW,OAAO,IAAI;AACpC,MAAI,IAAI,UAAW,YAAW,YAAY,IAAI;AAC9C,MAAI,IAAI,QAAS,YAAW,aAAa,IAAI;AAC7C,SAAO;AAAA,IACL,QAAQ,QAAQ;AAAA,IAChB,KAAK,QAAQ;AAAA,IACb,aAAa,QAAQ,SAAS;AAAA,IAC9B;AAAA,IACA,GAAI,YAAY,EAAE,SAAS;AAAA,IAC3B,GAAI,OAAO,KAAK,UAAU,EAAE,SAAS,KAAK,EAAE,WAAW;AAAA,EACzD;AACF;AASO,SAAS,sBAAsB,SAA+B;AACnE,SAAO,eAAe,gBAAgB,SAAuC;AAC3E,UAAM,WAAW,eAAe,SAAS,QAAW,uBAAuB;AAC3E,QAAI;AACF,UAAI,CAAC,aAAa,QAAQ,EAAG;AAC7B,8BAAwB,QAAQ,aAAa,SAAS,SAAS,mBAAmB,GAAI;AACtF,YAAM,SAAS,MAAM,WAAW,QAAQ;AACxC,YAAM,aAAa,uBAAuB,SAAS,QAAQ,cAAc;AACzE,YAAM,EAAE,YAAY,IAAI,MAAM;AAAA,QAC5B;AAAA,UACE,YAAY,SAAS;AAAA,UACrB,eAAe,SAAS;AAAA,UACxB,gBAAgB,SAAS;AAAA,UACzB,iBAAiB,SAAS;AAAA,UAC1B,SAAS,SAAS;AAAA,UAClB,SAAS;AAAA,UACT,QAAQ,SAAS;AAAA,UACjB,KAAK,SAAS;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,MACX;AACA,UAAI,YAAY,WAAW,WAAW;AACpC,gBAAQ;AAAA,UACN,YAAY;AAAA,UACZ,EAAE,gBAAgB,CAAC,kBAAkB,GAAG,GAAG,YAAY,QAAQ;AAAA,UAC/D,KAAK,UAAU,YAAY,QAAQ;AAAA,UACnC;AAAA,QACF;AACA;AAAA,MACF;AACA,iBAAW,UAAU,YAAY,qBAAqB;AACpD,cAAM,IAAI,OAAO,YAAY;AAC7B,mBAAW,QAAQ,OAAO,KAAK,WAAW,OAAO,GAAG;AAClD,cAAI,KAAK,WAAW,CAAC,EAAG,SAAQ,aAAa,IAAI;AAAA,QACnD;AAAA,MACF;AACA,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,YAAY,aAAa,GAAG;AACrE,gBAAQ,UAAU,MAAM,KAAK;AAAA,MAC/B;AAAA,IACF,SAAS,KAAK;AAEZ,eAAS,IAAI,SAAS,gDAA2C;AAAA,QAC/D,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/cloudflare.d.ts

@@ -24,6 +24,14 @@ interface CloudflareExecutionContext {
     waitUntil(promise: Promise<unknown>): void;
 }
 type CloudflareEnv = Record<string, unknown>;
+interface CloudflareGatewayOptions extends EdgeGatewayOptions {
+    /**
+     * Round 31 — where pass traffic goes. Default `fetch` (your origin). Zones
+     * that already run a Worker on the route (one Worker per route) pass their
+     * existing handler here, so the gateway runs first and their logic second.
+     */
+    forward?: (request: Request, env?: CloudflareEnv, ctx?: CloudflareExecutionContext) => Promise<Response>;
+}
 type CloudflareFetchHandler = (request: Request, env?: CloudflareEnv, ctx?: CloudflareExecutionContext) => Promise<Response>;
 /**
  * Connection-layer signals Cloudflare exposes on `request.cf` plus the
@@ -37,6 +45,6 @@ declare function collectCloudflareConnection(request: Request): Record<string, s
  * machine-readable JSON response. Telemetry beacons are scheduled through
  * `ctx.waitUntil`, so they never add request latency.
  */
-declare function createGatewayHandler(options?: EdgeGatewayOptions): CloudflareFetchHandler;
+declare function createGatewayHandler(options?: CloudflareGatewayOptions): CloudflareFetchHandler;
 
-export { type CloudflareEnv, type CloudflareExecutionContext, type CloudflareFetchHandler, EdgeGatewayOptions, collectCloudflareConnection, createGatewayHandler };
+export { type CloudflareEnv, type CloudflareExecutionContext, type CloudflareFetchHandler, type CloudflareGatewayOptions, EdgeGatewayOptions, collectCloudflareConnection, createGatewayHandler };

package/dist/cloudflare.js

@@ -154,9 +154,10 @@ function envStrings(env) {
 }
 function createGatewayHandler(options = {}) {
   return async function fetchHandler(request, env, ctx) {
+    const forward = (r) => options.forward ? options.forward(r, env, ctx) : fetch(r);
     const resolved = resolveOptions(options, envStrings(env), "astrasync-edge/cloudflare");
     try {
-      if (!isConfigured(resolved)) return fetch(request);
+      if (!isConfigured(resolved)) return forward(request);
       const config = await loadConfig(resolved);
       const normalized = await normalizeWebRequest(request, {
         maxBodyBytes: resolved.maxBodyBytes,
@@ -180,12 +181,12 @@ function createGatewayHandler(options = {}) {
         resolved.apiKey
       );
       if (application.action === "respond") return toJsonResponse(application);
-      return fetch(buildPassRequest(request, application));
+      return forward(buildPassRequest(request, application));
     } catch (err) {
       resolved.log("error", "gateway error \u2014 passing request through", {
         error: err instanceof Error ? err.message : String(err)
       });
-      return fetch(request);
+      return forward(request);
     }
   };
 }

package/dist/cloudflare.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cloudflare.ts","../src/config.ts","../src/web.ts"],"sourcesContent":["/**\n * AstraSync Trusted Agent Gateway — Cloudflare Workers adapter.\n *\n * ```ts\n * import { createGatewayHandler } from '@astrasyncai/adapter-edge/cloudflare';\n *\n * export default { fetch: createGatewayHandler() };\n * ```\n *\n * Configuration comes from the worker's environment bindings\n * (`ASTRASYNC_API_KEY`, `ASTRASYNC_COUNTERPARTY_ID`,\n * `ASTRASYNC_COUNTERPARTY_URL`, optional `ASTRASYNC_API_BASE_URL`) or from\n * explicit options, which win. The handler NEVER blocks traffic outside\n * enforce mode and fails open on any internal error.\n */\n\nimport { evaluateEdgeRequest } from '@astrasyncai/verification-gateway/edge-core';\nimport { resolveOptions, isConfigured, loadConfig } from './config';\nimport type { EdgeGatewayOptions } from './types';\nimport { normalizeWebRequest, buildPassRequest, toJsonResponse } from './web';\n\nexport type { EdgeGatewayOptions, GatewayPass } from './types';\n\n/** The subset of `request.cf` connection properties the gateway captures. */\ninterface CfConnectionProperties {\n  country?: string;\n  asn?: number | string;\n  asOrganization?: string;\n  tlsVersion?: string;\n  tlsCipher?: string;\n  httpProtocol?: string;\n  city?: string;\n  colo?: string;\n  timezone?: string;\n  regionCode?: string;\n  continent?: string;\n  clientTcpRtt?: number;\n  /** Present only on zones with Bot Management entitlement. */\n  botManagement?: {\n    ja3Hash?: string;\n    ja4?: string;\n  };\n}\n\n/** Structural subset of the Workers `ExecutionContext`. */\nexport interface CloudflareExecutionContext {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport type CloudflareEnv = Record<string, unknown>;\n\nexport type CloudflareFetchHandler = (\n  request: Request,\n  env?: CloudflareEnv,\n  ctx?: CloudflareExecutionContext\n) => Promise<Response>;\n\n/**\n * Connection-layer signals Cloudflare exposes on `request.cf` plus the\n * `CF-Connecting-IP` header. Absent values are simply omitted.\n */\nexport function collectCloudflareConnection(request: Request): Record<string, string> {\n  const cf = (request as Request & { cf?: CfConnectionProperties }).cf;\n  const out: Record<string, string> = {};\n  const ip = request.headers.get('cf-connecting-ip');\n  if (ip) out.ip = ip;\n  if (!cf) return out;\n  if (cf.country) out.country = cf.country;\n  if (cf.city) out.city = cf.city;\n  if (cf.asn !== undefined && cf.asn !== null && cf.asn !== '') out.asn = String(cf.asn);\n  if (cf.asOrganization) out.asOrg = cf.asOrganization;\n  if (cf.tlsVersion) out.tlsVersion = cf.tlsVersion;\n  if (cf.tlsCipher) out.tlsCipher = cf.tlsCipher;\n  if (cf.httpProtocol) out.httpVersion = cf.httpProtocol;\n  if (cf.colo) out.colo = cf.colo;\n  if (cf.timezone) out.timeZone = cf.timezone;\n  if (cf.regionCode) out.region = cf.regionCode;\n  if (cf.continent) out.continent = cf.continent;\n  if (typeof cf.clientTcpRtt === 'number') out.clientTcpRtt = String(cf.clientTcpRtt);\n  // JA3/JA4 ride request.cf only on Bot Management zones — harmless elsewhere.\n  if (cf.botManagement?.ja3Hash) out.tlsFingerprint = cf.botManagement.ja3Hash;\n  if (cf.botManagement?.ja4) out.ja4 = cf.botManagement.ja4;\n  return out;\n}\n\nfunction envStrings(env: CloudflareEnv | undefined): Record<string, string | undefined> {\n  const out: Record<string, string | undefined> = {};\n  for (const [key, value] of Object.entries(env ?? {})) {\n    if (typeof value === 'string') out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Create the worker `fetch` handler. Pass traffic is forwarded to the\n * origin with `fetch(mutatedRequest)` (spoofable trust headers stripped,\n * attestation headers injected); enforce-mode denials short-circuit with a\n * machine-readable JSON response. Telemetry beacons are scheduled through\n * `ctx.waitUntil`, so they never add request latency.\n */\nexport function createGatewayHandler(options: EdgeGatewayOptions = {}): CloudflareFetchHandler {\n  return async function fetchHandler(request, env, ctx) {\n    const resolved = resolveOptions(options, envStrings(env), 'astrasync-edge/cloudflare');\n    try {\n      if (!isConfigured(resolved)) return fetch(request);\n\n      const config = await loadConfig(resolved);\n      const normalized = await normalizeWebRequest(request, {\n        maxBodyBytes: resolved.maxBodyBytes,\n        clientIp: request.headers.get('cf-connecting-ip') ?? undefined,\n        connection: collectCloudflareConnection(request),\n      });\n\n      const { application } = await evaluateEdgeRequest(\n        {\n          apiBaseUrl: resolved.apiBaseUrl,\n          publicBaseUrl: resolved.publicBaseUrl,\n          counterpartyId: resolved.counterpartyId,\n          counterpartyUrl: resolved.counterpartyUrl,\n          budgets: resolved.budgets,\n          adapter: 'cloudflare',\n          random: resolved.random,\n          log: resolved.log,\n          ...(ctx && { waitUntil: (p: Promise<unknown>) => ctx.waitUntil(p) }),\n        },\n        normalized,\n        config,\n        resolved.apiKey\n      );\n\n      if (application.action === 'respond') return toJsonResponse(application);\n      return fetch(buildPassRequest(request, application));\n    } catch (err) {\n      // Fail-open, unconditionally: the gateway must never take the site down.\n      resolved.log('error', 'gateway error — passing request through', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n      return fetch(request);\n    }\n  };\n}\n","/**\n * Option/environment resolution and dashboard EdgeConfig loading shared by\n * the platform adapters.\n */\n\nimport {\n  getEdgeConfig,\n  DEFAULT_EDGE_CONFIG,\n  type EdgeConfig,\n} from '@astrasyncai/verification-gateway/edge-config';\nimport type { EdgeLogger } from '@astrasyncai/verification-gateway/edge-core';\nimport type { EdgeGatewayOptions } from './types';\n\nexport const DEFAULT_API_BASE_URL = 'https://astrasync.ai/api';\n\nexport interface ResolvedGatewayOptions extends EdgeGatewayOptions {\n  apiBaseUrl: string;\n  log: EdgeLogger;\n}\n\nexport function defaultLogger(prefix: string): EdgeLogger {\n  return (level, message, data) => {\n    console[level === 'info' ? 'log' : level](`[${prefix}] ${message}`, data ?? '');\n  };\n}\n\n/**\n * Merge explicit options with runtime environment variables (options win)\n * and apply defaults. `env` is the platform's environment map — Cloudflare\n * passes the worker `env` binding object, Vercel passes `process.env`,\n * Fastly Compute has no ambient env map (configure via options).\n */\nexport function resolveOptions(\n  options: EdgeGatewayOptions,\n  env: Record<string, string | undefined> | undefined,\n  logPrefix: string\n): ResolvedGatewayOptions {\n  const e = env ?? {};\n  return {\n    ...options,\n    apiBaseUrl: options.apiBaseUrl ?? e.ASTRASYNC_API_BASE_URL ?? DEFAULT_API_BASE_URL,\n    publicBaseUrl: options.publicBaseUrl ?? e.ASTRASYNC_PUBLIC_BASE_URL,\n    counterpartyId: options.counterpartyId ?? e.ASTRASYNC_COUNTERPARTY_ID,\n    counterpartyUrl: options.counterpartyUrl ?? e.ASTRASYNC_COUNTERPARTY_URL,\n    apiKey: options.apiKey ?? e.ASTRASYNC_API_KEY,\n    log: options.log ?? defaultLogger(logPrefix),\n  };\n}\n\n/**\n * Missing identity means the gateway cannot evaluate anything — it fails\n * OPEN (all traffic passes untouched) and says why, once per request.\n */\nexport function isConfigured(\n  resolved: ResolvedGatewayOptions\n): resolved is ResolvedGatewayOptions & { counterpartyId: string; counterpartyUrl: string } {\n  if (resolved.counterpartyId && resolved.counterpartyUrl) return true;\n  resolved.log(\n    'error',\n    'counterpartyId/counterpartyUrl are not configured — passing all traffic through. ' +\n      'Set the ASTRASYNC_COUNTERPARTY_ID / ASTRASYNC_COUNTERPARTY_URL environment variables ' +\n      'or pass them as options.'\n  );\n  return false;\n}\n\n/**\n * Load the effective EdgeConfig. Delegates caching/fallback/degradation to\n * the SDK (60s TTL, stale-while-revalidate, enforce→observe degradation on\n * prolonged staleness) and never throws.\n */\nexport async function loadConfig(\n  resolved: ResolvedGatewayOptions & { counterpartyId: string }\n): Promise<EdgeConfig> {\n  try {\n    return await getEdgeConfig(\n      { apiBaseUrl: resolved.apiBaseUrl, apiKey: resolved.apiKey },\n      resolved.counterpartyId,\n      { ttlMs: resolved.configTtlMs }\n    );\n  } catch {\n    return resolved.fallbackConfig ?? DEFAULT_EDGE_CONFIG;\n  }\n}\n","/**\n * Shared web-standard platform I/O: converts a fetch-API `Request` into\n * the edge core's `NormalizedRequest`, and applies the core's abstract\n * outcome application back onto fetch-API primitives.\n */\n\nimport type {\n  NormalizedRequest,\n  OutcomeApplication,\n} from '@astrasyncai/verification-gateway/edge-core';\nimport type { GatewayPass } from './types';\n\n/** Default request-body read cap for commerce-protocol detection. */\nexport const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;\n\nexport interface WebNormalizeOptions {\n  /** Body read cap in bytes. Default {@link DEFAULT_MAX_BODY_BYTES}. */\n  maxBodyBytes?: number;\n  /** Client IP as the platform reports it. */\n  clientIp?: string;\n  /** Connection-layer metadata the platform collected (country, asn, …). */\n  connection?: Record<string, string>;\n}\n\nasync function readBodyCapped(\n  request: Request,\n  cap: number\n): Promise<{ text?: string; truncated: boolean }> {\n  if (request.method === 'GET' || request.method === 'HEAD') return { truncated: false };\n  const body = request.clone().body;\n  if (!body) return { truncated: false };\n\n  const reader = body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  let truncated = false;\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    if (total + value.byteLength > cap) {\n      chunks.push(value.subarray(0, cap - total));\n      total = cap;\n      truncated = true;\n      // Fire-and-forget: cancelling one branch of a cloned (tee'd) body can\n      // only settle once the other branch is consumed — never await it.\n      void reader.cancel().catch(() => {});\n      break;\n    }\n    chunks.push(value);\n    total += value.byteLength;\n  }\n  if (total === 0 && !truncated) return { truncated: false };\n\n  const joined = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    joined.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return { text: new TextDecoder().decode(joined), truncated };\n}\n\n/**\n * Normalize a fetch-API `Request` into the edge core's request shape.\n * Header names are already lowercased (and multi-valued headers joined\n * with `\", \"`) by the `Headers` class. The body is read from a CLONE — the\n * original request stays forwardable to the origin — and capped at\n * `maxBodyBytes` (detection sees a flagged, truncated prefix beyond it).\n */\nexport async function normalizeWebRequest(\n  request: Request,\n  options: WebNormalizeOptions = {}\n): Promise<NormalizedRequest> {\n  const url = new URL(request.url);\n  const headers: Record<string, string> = {};\n  request.headers.forEach((value, name) => {\n    headers[name] = value;\n  });\n  const body = await readBodyCapped(request, options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);\n  const connection = options.connection ?? {};\n  return {\n    method: request.method,\n    uri: url.pathname,\n    querystring: url.search.startsWith('?') ? url.search.slice(1) : url.search,\n    headers,\n    ...(body.text !== undefined && { bodyText: body.text }),\n    ...(body.truncated && { bodyTruncated: true }),\n    ...(options.clientIp && { clientIp: options.clientIp }),\n    ...(Object.keys(connection).length > 0 && { connection }),\n  };\n}\n\n/**\n * Apply a pass application to a header set: strip every header matching\n * one of the spoofable prefixes, then set the injected trust headers.\n * Returns a NEW `Headers` instance; the input is not mutated.\n */\nexport function applyGatewayPass(headers: Headers, pass: GatewayPass): Headers {\n  const out = new Headers(headers);\n  for (const prefix of pass.stripHeaderPrefixes) {\n    const p = prefix.toLowerCase();\n    for (const name of [...out.keys()]) {\n      if (name.startsWith(p)) out.delete(name);\n    }\n  }\n  for (const [name, value] of Object.entries(pass.injectHeaders)) {\n    out.set(name, value);\n  }\n  return out;\n}\n\n/**\n * Build the origin-bound request for a pass application: the same request\n * with spoofable headers stripped and trust headers injected.\n */\nexport function buildPassRequest(request: Request, pass: GatewayPass): Request {\n  if (pass.stripHeaderPrefixes.length === 0 && Object.keys(pass.injectHeaders).length === 0) {\n    return request;\n  }\n  return new Request(request, { headers: applyGatewayPass(request.headers, pass) });\n}\n\n/** Build the short-circuit JSON response for a respond application. */\nexport function toJsonResponse(\n  application: Extract<OutcomeApplication, { action: 'respond' }>\n): Response {\n  return new Response(JSON.stringify(application.bodyJson), {\n    status: application.status,\n    headers: { 'content-type': 'application/json', ...application.headers },\n  });\n}\n"],"mappings":";AAgBA,SAAS,2BAA2B;;;ACXpC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAIA,IAAM,uBAAuB;AAO7B,SAAS,cAAc,QAA4B;AACxD,SAAO,CAAC,OAAO,SAAS,SAAS;AAC/B,YAAQ,UAAU,SAAS,QAAQ,KAAK,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,EAAE;AAAA,EAChF;AACF;AAQO,SAAS,eACd,SACA,KACA,WACwB;AACxB,QAAM,IAAI,OAAO,CAAC;AAClB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,QAAQ,cAAc,EAAE,0BAA0B;AAAA,IAC9D,eAAe,QAAQ,iBAAiB,EAAE;AAAA,IAC1C,gBAAgB,QAAQ,kBAAkB,EAAE;AAAA,IAC5C,iBAAiB,QAAQ,mBAAmB,EAAE;AAAA,IAC9C,QAAQ,QAAQ,UAAU,EAAE;AAAA,IAC5B,KAAK,QAAQ,OAAO,cAAc,SAAS;AAAA,EAC7C;AACF;AAMO,SAAS,aACd,UAC0F;AAC1F,MAAI,SAAS,kBAAkB,SAAS,gBAAiB,QAAO;AAChE,WAAS;AAAA,IACP;AAAA,IACA;AAAA,EAGF;AACA,SAAO;AACT;AAOA,eAAsB,WACpB,UACqB;AACrB,MAAI;AACF,WAAO,MAAM;AAAA,MACX,EAAE,YAAY,SAAS,YAAY,QAAQ,SAAS,OAAO;AAAA,MAC3D,SAAS;AAAA,MACT,EAAE,OAAO,SAAS,YAAY;AAAA,IAChC;AAAA,EACF,QAAQ;AACN,WAAO,SAAS,kBAAkB;AAAA,EACpC;AACF;;;ACtEO,IAAM,yBAAyB,OAAO;AAW7C,eAAe,eACb,SACA,KACgD;AAChD,MAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,OAAQ,QAAO,EAAE,WAAW,MAAM;AACrF,QAAM,OAAO,QAAQ,MAAM,EAAE;AAC7B,MAAI,CAAC,KAAM,QAAO,EAAE,WAAW,MAAM;AAErC,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,MAAI,YAAY;AAChB,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,QAAI,QAAQ,MAAM,aAAa,KAAK;AAClC,aAAO,KAAK,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC;AAC1C,cAAQ;AACR,kBAAY;AAGZ,WAAK,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACnC;AAAA,IACF;AACA,WAAO,KAAK,KAAK;AACjB,aAAS,MAAM;AAAA,EACjB;AACA,MAAI,UAAU,KAAK,CAAC,UAAW,QAAO,EAAE,WAAW,MAAM;AAEzD,QAAM,SAAS,IAAI,WAAW,KAAK;AACnC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO,EAAE,MAAM,IAAI,YAAY,EAAE,OAAO,MAAM,GAAG,UAAU;AAC7D;AASA,eAAsB,oBACpB,SACA,UAA+B,CAAC,GACJ;AAC5B,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,UAAkC,CAAC;AACzC,UAAQ,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACvC,YAAQ,IAAI,IAAI;AAAA,EAClB,CAAC;AACD,QAAM,OAAO,MAAM,eAAe,SAAS,QAAQ,gBAAgB,sBAAsB;AACzF,QAAM,aAAa,QAAQ,cAAc,CAAC;AAC1C,SAAO;AAAA,IACL,QAAQ,QAAQ;AAAA,IAChB,KAAK,IAAI;AAAA,IACT,aAAa,IAAI,OAAO,WAAW,GAAG,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,IAAI;AAAA,IACpE;AAAA,IACA,GAAI,KAAK,SAAS,UAAa,EAAE,UAAU,KAAK,KAAK;AAAA,IACrD,GAAI,KAAK,aAAa,EAAE,eAAe,KAAK;AAAA,IAC5C,GAAI,QAAQ,YAAY,EAAE,UAAU,QAAQ,SAAS;AAAA,IACrD,GAAI,OAAO,KAAK,UAAU,EAAE,SAAS,KAAK,EAAE,WAAW;AAAA,EACzD;AACF;AAOO,SAAS,iBAAiB,SAAkB,MAA4B;AAC7E,QAAM,MAAM,IAAI,QAAQ,OAAO;AAC/B,aAAW,UAAU,KAAK,qBAAqB;AAC7C,UAAM,IAAI,OAAO,YAAY;AAC7B,eAAW,QAAQ,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG;AAClC,UAAI,KAAK,WAAW,CAAC,EAAG,KAAI,OAAO,IAAI;AAAA,IACzC;AAAA,EACF;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,QAAI,IAAI,MAAM,KAAK;AAAA,EACrB;AACA,SAAO;AACT;AAMO,SAAS,iBAAiB,SAAkB,MAA4B;AAC7E,MAAI,KAAK,oBAAoB,WAAW,KAAK,OAAO,KAAK,KAAK,aAAa,EAAE,WAAW,GAAG;AACzF,WAAO;AAAA,EACT;AACA,SAAO,IAAI,QAAQ,SAAS,EAAE,SAAS,iBAAiB,QAAQ,SAAS,IAAI,EAAE,CAAC;AAClF;AAGO,SAAS,eACd,aACU;AACV,SAAO,IAAI,SAAS,KAAK,UAAU,YAAY,QAAQ,GAAG;AAAA,IACxD,QAAQ,YAAY;AAAA,IACpB,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,YAAY,QAAQ;AAAA,EACxE,CAAC;AACH;;;AFrEO,SAAS,4BAA4B,SAA0C;AACpF,QAAM,KAAM,QAAsD;AAClE,QAAM,MAA8B,CAAC;AACrC,QAAM,KAAK,QAAQ,QAAQ,IAAI,kBAAkB;AACjD,MAAI,GAAI,KAAI,KAAK;AACjB,MAAI,CAAC,GAAI,QAAO;AAChB,MAAI,GAAG,QAAS,KAAI,UAAU,GAAG;AACjC,MAAI,GAAG,KAAM,KAAI,OAAO,GAAG;AAC3B,MAAI,GAAG,QAAQ,UAAa,GAAG,QAAQ,QAAQ,GAAG,QAAQ,GAAI,KAAI,MAAM,OAAO,GAAG,GAAG;AACrF,MAAI,GAAG,eAAgB,KAAI,QAAQ,GAAG;AACtC,MAAI,GAAG,WAAY,KAAI,aAAa,GAAG;AACvC,MAAI,GAAG,UAAW,KAAI,YAAY,GAAG;AACrC,MAAI,GAAG,aAAc,KAAI,cAAc,GAAG;AAC1C,MAAI,GAAG,KAAM,KAAI,OAAO,GAAG;AAC3B,MAAI,GAAG,SAAU,KAAI,WAAW,GAAG;AACnC,MAAI,GAAG,WAAY,KAAI,SAAS,GAAG;AACnC,MAAI,GAAG,UAAW,KAAI,YAAY,GAAG;AACrC,MAAI,OAAO,GAAG,iBAAiB,SAAU,KAAI,eAAe,OAAO,GAAG,YAAY;AAElF,MAAI,GAAG,eAAe,QAAS,KAAI,iBAAiB,GAAG,cAAc;AACrE,MAAI,GAAG,eAAe,IAAK,KAAI,MAAM,GAAG,cAAc;AACtD,SAAO;AACT;AAEA,SAAS,WAAW,KAAoE;AACtF,QAAM,MAA0C,CAAC;AACjD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,CAAC,CAAC,GAAG;AACpD,QAAI,OAAO,UAAU,SAAU,KAAI,GAAG,IAAI;AAAA,EAC5C;AACA,SAAO;AACT;AASO,SAAS,qBAAqB,UAA8B,CAAC,GAA2B;AAC7F,SAAO,eAAe,aAAa,SAAS,KAAK,KAAK;AACpD,UAAM,WAAW,eAAe,SAAS,WAAW,GAAG,GAAG,2BAA2B;AACrF,QAAI;AACF,UAAI,CAAC,aAAa,QAAQ,EAAG,QAAO,MAAM,OAAO;AAEjD,YAAM,SAAS,MAAM,WAAW,QAAQ;AACxC,YAAM,aAAa,MAAM,oBAAoB,SAAS;AAAA,QACpD,cAAc,SAAS;AAAA,QACvB,UAAU,QAAQ,QAAQ,IAAI,kBAAkB,KAAK;AAAA,QACrD,YAAY,4BAA4B,OAAO;AAAA,MACjD,CAAC;AAED,YAAM,EAAE,YAAY,IAAI,MAAM;AAAA,QAC5B;AAAA,UACE,YAAY,SAAS;AAAA,UACrB,eAAe,SAAS;AAAA,UACxB,gBAAgB,SAAS;AAAA,UACzB,iBAAiB,SAAS;AAAA,UAC1B,SAAS,SAAS;AAAA,UAClB,SAAS;AAAA,UACT,QAAQ,SAAS;AAAA,UACjB,KAAK,SAAS;AAAA,UACd,GAAI,OAAO,EAAE,WAAW,CAAC,MAAwB,IAAI,UAAU,CAAC,EAAE;AAAA,QACpE;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,MACX;AAEA,UAAI,YAAY,WAAW,UAAW,QAAO,eAAe,WAAW;AACvE,aAAO,MAAM,iBAAiB,SAAS,WAAW,CAAC;AAAA,IACrD,SAAS,KAAK;AAEZ,eAAS,IAAI,SAAS,gDAA2C;AAAA,QAC/D,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AACD,aAAO,MAAM,OAAO;AAAA,IACtB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/cloudflare.ts","../src/config.ts","../src/web.ts"],"sourcesContent":["/**\n * AstraSync Trusted Agent Gateway — Cloudflare Workers adapter.\n *\n * ```ts\n * import { createGatewayHandler } from '@astrasyncai/adapter-edge/cloudflare';\n *\n * export default { fetch: createGatewayHandler() };\n * ```\n *\n * Configuration comes from the worker's environment bindings\n * (`ASTRASYNC_API_KEY`, `ASTRASYNC_COUNTERPARTY_ID`,\n * `ASTRASYNC_COUNTERPARTY_URL`, optional `ASTRASYNC_API_BASE_URL`) or from\n * explicit options, which win. The handler NEVER blocks traffic outside\n * enforce mode and fails open on any internal error.\n */\n\nimport { evaluateEdgeRequest } from '@astrasyncai/verification-gateway/edge-core';\nimport { resolveOptions, isConfigured, loadConfig } from './config';\nimport type { EdgeGatewayOptions } from './types';\nimport { normalizeWebRequest, buildPassRequest, toJsonResponse } from './web';\n\nexport type { EdgeGatewayOptions, GatewayPass } from './types';\n\n/** The subset of `request.cf` connection properties the gateway captures. */\ninterface CfConnectionProperties {\n  country?: string;\n  asn?: number | string;\n  asOrganization?: string;\n  tlsVersion?: string;\n  tlsCipher?: string;\n  httpProtocol?: string;\n  city?: string;\n  colo?: string;\n  timezone?: string;\n  regionCode?: string;\n  continent?: string;\n  clientTcpRtt?: number;\n  /** Present only on zones with Bot Management entitlement. */\n  botManagement?: {\n    ja3Hash?: string;\n    ja4?: string;\n  };\n}\n\n/** Structural subset of the Workers `ExecutionContext`. */\nexport interface CloudflareExecutionContext {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport type CloudflareEnv = Record<string, unknown>;\n\nexport interface CloudflareGatewayOptions extends EdgeGatewayOptions {\n  /**\n   * Round 31 — where pass traffic goes. Default `fetch` (your origin). Zones\n   * that already run a Worker on the route (one Worker per route) pass their\n   * existing handler here, so the gateway runs first and their logic second.\n   */\n  forward?: (\n    request: Request,\n    env?: CloudflareEnv,\n    ctx?: CloudflareExecutionContext\n  ) => Promise<Response>;\n}\n\nexport type CloudflareFetchHandler = (\n  request: Request,\n  env?: CloudflareEnv,\n  ctx?: CloudflareExecutionContext\n) => Promise<Response>;\n\n/**\n * Connection-layer signals Cloudflare exposes on `request.cf` plus the\n * `CF-Connecting-IP` header. Absent values are simply omitted.\n */\nexport function collectCloudflareConnection(request: Request): Record<string, string> {\n  const cf = (request as Request & { cf?: CfConnectionProperties }).cf;\n  const out: Record<string, string> = {};\n  const ip = request.headers.get('cf-connecting-ip');\n  if (ip) out.ip = ip;\n  if (!cf) return out;\n  if (cf.country) out.country = cf.country;\n  if (cf.city) out.city = cf.city;\n  if (cf.asn !== undefined && cf.asn !== null && cf.asn !== '') out.asn = String(cf.asn);\n  if (cf.asOrganization) out.asOrg = cf.asOrganization;\n  if (cf.tlsVersion) out.tlsVersion = cf.tlsVersion;\n  if (cf.tlsCipher) out.tlsCipher = cf.tlsCipher;\n  if (cf.httpProtocol) out.httpVersion = cf.httpProtocol;\n  if (cf.colo) out.colo = cf.colo;\n  if (cf.timezone) out.timeZone = cf.timezone;\n  if (cf.regionCode) out.region = cf.regionCode;\n  if (cf.continent) out.continent = cf.continent;\n  if (typeof cf.clientTcpRtt === 'number') out.clientTcpRtt = String(cf.clientTcpRtt);\n  // JA3/JA4 ride request.cf only on Bot Management zones — harmless elsewhere.\n  if (cf.botManagement?.ja3Hash) out.tlsFingerprint = cf.botManagement.ja3Hash;\n  if (cf.botManagement?.ja4) out.ja4 = cf.botManagement.ja4;\n  return out;\n}\n\nfunction envStrings(env: CloudflareEnv | undefined): Record<string, string | undefined> {\n  const out: Record<string, string | undefined> = {};\n  for (const [key, value] of Object.entries(env ?? {})) {\n    if (typeof value === 'string') out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Create the worker `fetch` handler. Pass traffic is forwarded to the\n * origin with `fetch(mutatedRequest)` (spoofable trust headers stripped,\n * attestation headers injected); enforce-mode denials short-circuit with a\n * machine-readable JSON response. Telemetry beacons are scheduled through\n * `ctx.waitUntil`, so they never add request latency.\n */\nexport function createGatewayHandler(\n  options: CloudflareGatewayOptions = {}\n): CloudflareFetchHandler {\n  return async function fetchHandler(request, env, ctx) {\n    const forward = (r: Request) => (options.forward ? options.forward(r, env, ctx) : fetch(r));\n    const resolved = resolveOptions(options, envStrings(env), 'astrasync-edge/cloudflare');\n    try {\n      if (!isConfigured(resolved)) return forward(request);\n\n      const config = await loadConfig(resolved);\n      const normalized = await normalizeWebRequest(request, {\n        maxBodyBytes: resolved.maxBodyBytes,\n        clientIp: request.headers.get('cf-connecting-ip') ?? undefined,\n        connection: collectCloudflareConnection(request),\n      });\n\n      const { application } = await evaluateEdgeRequest(\n        {\n          apiBaseUrl: resolved.apiBaseUrl,\n          publicBaseUrl: resolved.publicBaseUrl,\n          counterpartyId: resolved.counterpartyId,\n          counterpartyUrl: resolved.counterpartyUrl,\n          budgets: resolved.budgets,\n          adapter: 'cloudflare',\n          random: resolved.random,\n          log: resolved.log,\n          ...(ctx && { waitUntil: (p: Promise<unknown>) => ctx.waitUntil(p) }),\n        },\n        normalized,\n        config,\n        resolved.apiKey\n      );\n\n      if (application.action === 'respond') return toJsonResponse(application);\n      return forward(buildPassRequest(request, application));\n    } catch (err) {\n      // Fail-open, unconditionally: the gateway must never take the site down.\n      resolved.log('error', 'gateway error — passing request through', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n      return forward(request);\n    }\n  };\n}\n","/**\n * Option/environment resolution and dashboard EdgeConfig loading shared by\n * the platform adapters.\n */\n\nimport {\n  getEdgeConfig,\n  DEFAULT_EDGE_CONFIG,\n  type EdgeConfig,\n} from '@astrasyncai/verification-gateway/edge-config';\nimport type { EdgeLogger } from '@astrasyncai/verification-gateway/edge-core';\nimport type { EdgeGatewayOptions } from './types';\n\nexport const DEFAULT_API_BASE_URL = 'https://astrasync.ai/api';\n\nexport interface ResolvedGatewayOptions extends EdgeGatewayOptions {\n  apiBaseUrl: string;\n  log: EdgeLogger;\n}\n\nexport function defaultLogger(prefix: string): EdgeLogger {\n  return (level, message, data) => {\n    console[level === 'info' ? 'log' : level](`[${prefix}] ${message}`, data ?? '');\n  };\n}\n\n/**\n * Merge explicit options with runtime environment variables (options win)\n * and apply defaults. `env` is the platform's environment map — Cloudflare\n * passes the worker `env` binding object, Vercel passes `process.env`,\n * Fastly Compute has no ambient env map (configure via options).\n */\nexport function resolveOptions(\n  options: EdgeGatewayOptions,\n  env: Record<string, string | undefined> | undefined,\n  logPrefix: string\n): ResolvedGatewayOptions {\n  const e = env ?? {};\n  return {\n    ...options,\n    apiBaseUrl: options.apiBaseUrl ?? e.ASTRASYNC_API_BASE_URL ?? DEFAULT_API_BASE_URL,\n    publicBaseUrl: options.publicBaseUrl ?? e.ASTRASYNC_PUBLIC_BASE_URL,\n    counterpartyId: options.counterpartyId ?? e.ASTRASYNC_COUNTERPARTY_ID,\n    counterpartyUrl: options.counterpartyUrl ?? e.ASTRASYNC_COUNTERPARTY_URL,\n    apiKey: options.apiKey ?? e.ASTRASYNC_API_KEY,\n    log: options.log ?? defaultLogger(logPrefix),\n  };\n}\n\n/**\n * Missing identity means the gateway cannot evaluate anything — it fails\n * OPEN (all traffic passes untouched) and says why, once per request.\n */\nexport function isConfigured(\n  resolved: ResolvedGatewayOptions\n): resolved is ResolvedGatewayOptions & { counterpartyId: string; counterpartyUrl: string } {\n  if (resolved.counterpartyId && resolved.counterpartyUrl) return true;\n  resolved.log(\n    'error',\n    'counterpartyId/counterpartyUrl are not configured — passing all traffic through. ' +\n      'Set the ASTRASYNC_COUNTERPARTY_ID / ASTRASYNC_COUNTERPARTY_URL environment variables ' +\n      'or pass them as options.'\n  );\n  return false;\n}\n\n/**\n * Load the effective EdgeConfig. Delegates caching/fallback/degradation to\n * the SDK (60s TTL, stale-while-revalidate, enforce→observe degradation on\n * prolonged staleness) and never throws.\n */\nexport async function loadConfig(\n  resolved: ResolvedGatewayOptions & { counterpartyId: string }\n): Promise<EdgeConfig> {\n  try {\n    return await getEdgeConfig(\n      { apiBaseUrl: resolved.apiBaseUrl, apiKey: resolved.apiKey },\n      resolved.counterpartyId,\n      { ttlMs: resolved.configTtlMs }\n    );\n  } catch {\n    return resolved.fallbackConfig ?? DEFAULT_EDGE_CONFIG;\n  }\n}\n","/**\n * Shared web-standard platform I/O: converts a fetch-API `Request` into\n * the edge core's `NormalizedRequest`, and applies the core's abstract\n * outcome application back onto fetch-API primitives.\n */\n\nimport type {\n  NormalizedRequest,\n  OutcomeApplication,\n} from '@astrasyncai/verification-gateway/edge-core';\nimport type { GatewayPass } from './types';\n\n/** Default request-body read cap for commerce-protocol detection. */\nexport const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;\n\nexport interface WebNormalizeOptions {\n  /** Body read cap in bytes. Default {@link DEFAULT_MAX_BODY_BYTES}. */\n  maxBodyBytes?: number;\n  /** Client IP as the platform reports it. */\n  clientIp?: string;\n  /** Connection-layer metadata the platform collected (country, asn, …). */\n  connection?: Record<string, string>;\n}\n\nasync function readBodyCapped(\n  request: Request,\n  cap: number\n): Promise<{ text?: string; truncated: boolean }> {\n  if (request.method === 'GET' || request.method === 'HEAD') return { truncated: false };\n  const body = request.clone().body;\n  if (!body) return { truncated: false };\n\n  const reader = body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  let truncated = false;\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    if (total + value.byteLength > cap) {\n      chunks.push(value.subarray(0, cap - total));\n      total = cap;\n      truncated = true;\n      // Fire-and-forget: cancelling one branch of a cloned (tee'd) body can\n      // only settle once the other branch is consumed — never await it.\n      void reader.cancel().catch(() => {});\n      break;\n    }\n    chunks.push(value);\n    total += value.byteLength;\n  }\n  if (total === 0 && !truncated) return { truncated: false };\n\n  const joined = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    joined.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return { text: new TextDecoder().decode(joined), truncated };\n}\n\n/**\n * Normalize a fetch-API `Request` into the edge core's request shape.\n * Header names are already lowercased (and multi-valued headers joined\n * with `\", \"`) by the `Headers` class. The body is read from a CLONE — the\n * original request stays forwardable to the origin — and capped at\n * `maxBodyBytes` (detection sees a flagged, truncated prefix beyond it).\n */\nexport async function normalizeWebRequest(\n  request: Request,\n  options: WebNormalizeOptions = {}\n): Promise<NormalizedRequest> {\n  const url = new URL(request.url);\n  const headers: Record<string, string> = {};\n  request.headers.forEach((value, name) => {\n    headers[name] = value;\n  });\n  const body = await readBodyCapped(request, options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);\n  const connection = options.connection ?? {};\n  return {\n    method: request.method,\n    uri: url.pathname,\n    querystring: url.search.startsWith('?') ? url.search.slice(1) : url.search,\n    headers,\n    ...(body.text !== undefined && { bodyText: body.text }),\n    ...(body.truncated && { bodyTruncated: true }),\n    ...(options.clientIp && { clientIp: options.clientIp }),\n    ...(Object.keys(connection).length > 0 && { connection }),\n  };\n}\n\n/**\n * Apply a pass application to a header set: strip every header matching\n * one of the spoofable prefixes, then set the injected trust headers.\n * Returns a NEW `Headers` instance; the input is not mutated.\n */\nexport function applyGatewayPass(headers: Headers, pass: GatewayPass): Headers {\n  const out = new Headers(headers);\n  for (const prefix of pass.stripHeaderPrefixes) {\n    const p = prefix.toLowerCase();\n    for (const name of [...out.keys()]) {\n      if (name.startsWith(p)) out.delete(name);\n    }\n  }\n  for (const [name, value] of Object.entries(pass.injectHeaders)) {\n    out.set(name, value);\n  }\n  return out;\n}\n\n/**\n * Build the origin-bound request for a pass application: the same request\n * with spoofable headers stripped and trust headers injected.\n */\nexport function buildPassRequest(request: Request, pass: GatewayPass): Request {\n  if (pass.stripHeaderPrefixes.length === 0 && Object.keys(pass.injectHeaders).length === 0) {\n    return request;\n  }\n  return new Request(request, { headers: applyGatewayPass(request.headers, pass) });\n}\n\n/** Build the short-circuit JSON response for a respond application. */\nexport function toJsonResponse(\n  application: Extract<OutcomeApplication, { action: 'respond' }>\n): Response {\n  return new Response(JSON.stringify(application.bodyJson), {\n    status: application.status,\n    headers: { 'content-type': 'application/json', ...application.headers },\n  });\n}\n"],"mappings":";AAgBA,SAAS,2BAA2B;;;ACXpC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAIA,IAAM,uBAAuB;AAO7B,SAAS,cAAc,QAA4B;AACxD,SAAO,CAAC,OAAO,SAAS,SAAS;AAC/B,YAAQ,UAAU,SAAS,QAAQ,KAAK,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,EAAE;AAAA,EAChF;AACF;AAQO,SAAS,eACd,SACA,KACA,WACwB;AACxB,QAAM,IAAI,OAAO,CAAC;AAClB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,QAAQ,cAAc,EAAE,0BAA0B;AAAA,IAC9D,eAAe,QAAQ,iBAAiB,EAAE;AAAA,IAC1C,gBAAgB,QAAQ,kBAAkB,EAAE;AAAA,IAC5C,iBAAiB,QAAQ,mBAAmB,EAAE;AAAA,IAC9C,QAAQ,QAAQ,UAAU,EAAE;AAAA,IAC5B,KAAK,QAAQ,OAAO,cAAc,SAAS;AAAA,EAC7C;AACF;AAMO,SAAS,aACd,UAC0F;AAC1F,MAAI,SAAS,kBAAkB,SAAS,gBAAiB,QAAO;AAChE,WAAS;AAAA,IACP;AAAA,IACA;AAAA,EAGF;AACA,SAAO;AACT;AAOA,eAAsB,WACpB,UACqB;AACrB,MAAI;AACF,WAAO,MAAM;AAAA,MACX,EAAE,YAAY,SAAS,YAAY,QAAQ,SAAS,OAAO;AAAA,MAC3D,SAAS;AAAA,MACT,EAAE,OAAO,SAAS,YAAY;AAAA,IAChC;AAAA,EACF,QAAQ;AACN,WAAO,SAAS,kBAAkB;AAAA,EACpC;AACF;;;ACtEO,IAAM,yBAAyB,OAAO;AAW7C,eAAe,eACb,SACA,KACgD;AAChD,MAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,OAAQ,QAAO,EAAE,WAAW,MAAM;AACrF,QAAM,OAAO,QAAQ,MAAM,EAAE;AAC7B,MAAI,CAAC,KAAM,QAAO,EAAE,WAAW,MAAM;AAErC,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,MAAI,YAAY;AAChB,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,QAAI,QAAQ,MAAM,aAAa,KAAK;AAClC,aAAO,KAAK,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC;AAC1C,cAAQ;AACR,kBAAY;AAGZ,WAAK,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACnC;AAAA,IACF;AACA,WAAO,KAAK,KAAK;AACjB,aAAS,MAAM;AAAA,EACjB;AACA,MAAI,UAAU,KAAK,CAAC,UAAW,QAAO,EAAE,WAAW,MAAM;AAEzD,QAAM,SAAS,IAAI,WAAW,KAAK;AACnC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO,EAAE,MAAM,IAAI,YAAY,EAAE,OAAO,MAAM,GAAG,UAAU;AAC7D;AASA,eAAsB,oBACpB,SACA,UAA+B,CAAC,GACJ;AAC5B,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,UAAkC,CAAC;AACzC,UAAQ,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACvC,YAAQ,IAAI,IAAI;AAAA,EAClB,CAAC;AACD,QAAM,OAAO,MAAM,eAAe,SAAS,QAAQ,gBAAgB,sBAAsB;AACzF,QAAM,aAAa,QAAQ,cAAc,CAAC;AAC1C,SAAO;AAAA,IACL,QAAQ,QAAQ;AAAA,IAChB,KAAK,IAAI;AAAA,IACT,aAAa,IAAI,OAAO,WAAW,GAAG,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,IAAI;AAAA,IACpE;AAAA,IACA,GAAI,KAAK,SAAS,UAAa,EAAE,UAAU,KAAK,KAAK;AAAA,IACrD,GAAI,KAAK,aAAa,EAAE,eAAe,KAAK;AAAA,IAC5C,GAAI,QAAQ,YAAY,EAAE,UAAU,QAAQ,SAAS;AAAA,IACrD,GAAI,OAAO,KAAK,UAAU,EAAE,SAAS,KAAK,EAAE,WAAW;AAAA,EACzD;AACF;AAOO,SAAS,iBAAiB,SAAkB,MAA4B;AAC7E,QAAM,MAAM,IAAI,QAAQ,OAAO;AAC/B,aAAW,UAAU,KAAK,qBAAqB;AAC7C,UAAM,IAAI,OAAO,YAAY;AAC7B,eAAW,QAAQ,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG;AAClC,UAAI,KAAK,WAAW,CAAC,EAAG,KAAI,OAAO,IAAI;AAAA,IACzC;AAAA,EACF;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,QAAI,IAAI,MAAM,KAAK;AAAA,EACrB;AACA,SAAO;AACT;AAMO,SAAS,iBAAiB,SAAkB,MAA4B;AAC7E,MAAI,KAAK,oBAAoB,WAAW,KAAK,OAAO,KAAK,KAAK,aAAa,EAAE,WAAW,GAAG;AACzF,WAAO;AAAA,EACT;AACA,SAAO,IAAI,QAAQ,SAAS,EAAE,SAAS,iBAAiB,QAAQ,SAAS,IAAI,EAAE,CAAC;AAClF;AAGO,SAAS,eACd,aACU;AACV,SAAO,IAAI,SAAS,KAAK,UAAU,YAAY,QAAQ,GAAG;AAAA,IACxD,QAAQ,YAAY;AAAA,IACpB,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,YAAY,QAAQ;AAAA,EACxE,CAAC;AACH;;;AFxDO,SAAS,4BAA4B,SAA0C;AACpF,QAAM,KAAM,QAAsD;AAClE,QAAM,MAA8B,CAAC;AACrC,QAAM,KAAK,QAAQ,QAAQ,IAAI,kBAAkB;AACjD,MAAI,GAAI,KAAI,KAAK;AACjB,MAAI,CAAC,GAAI,QAAO;AAChB,MAAI,GAAG,QAAS,KAAI,UAAU,GAAG;AACjC,MAAI,GAAG,KAAM,KAAI,OAAO,GAAG;AAC3B,MAAI,GAAG,QAAQ,UAAa,GAAG,QAAQ,QAAQ,GAAG,QAAQ,GAAI,KAAI,MAAM,OAAO,GAAG,GAAG;AACrF,MAAI,GAAG,eAAgB,KAAI,QAAQ,GAAG;AACtC,MAAI,GAAG,WAAY,KAAI,aAAa,GAAG;AACvC,MAAI,GAAG,UAAW,KAAI,YAAY,GAAG;AACrC,MAAI,GAAG,aAAc,KAAI,cAAc,GAAG;AAC1C,MAAI,GAAG,KAAM,KAAI,OAAO,GAAG;AAC3B,MAAI,GAAG,SAAU,KAAI,WAAW,GAAG;AACnC,MAAI,GAAG,WAAY,KAAI,SAAS,GAAG;AACnC,MAAI,GAAG,UAAW,KAAI,YAAY,GAAG;AACrC,MAAI,OAAO,GAAG,iBAAiB,SAAU,KAAI,eAAe,OAAO,GAAG,YAAY;AAElF,MAAI,GAAG,eAAe,QAAS,KAAI,iBAAiB,GAAG,cAAc;AACrE,MAAI,GAAG,eAAe,IAAK,KAAI,MAAM,GAAG,cAAc;AACtD,SAAO;AACT;AAEA,SAAS,WAAW,KAAoE;AACtF,QAAM,MAA0C,CAAC;AACjD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,CAAC,CAAC,GAAG;AACpD,QAAI,OAAO,UAAU,SAAU,KAAI,GAAG,IAAI;AAAA,EAC5C;AACA,SAAO;AACT;AASO,SAAS,qBACd,UAAoC,CAAC,GACb;AACxB,SAAO,eAAe,aAAa,SAAS,KAAK,KAAK;AACpD,UAAM,UAAU,CAAC,MAAgB,QAAQ,UAAU,QAAQ,QAAQ,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC;AACzF,UAAM,WAAW,eAAe,SAAS,WAAW,GAAG,GAAG,2BAA2B;AACrF,QAAI;AACF,UAAI,CAAC,aAAa,QAAQ,EAAG,QAAO,QAAQ,OAAO;AAEnD,YAAM,SAAS,MAAM,WAAW,QAAQ;AACxC,YAAM,aAAa,MAAM,oBAAoB,SAAS;AAAA,QACpD,cAAc,SAAS;AAAA,QACvB,UAAU,QAAQ,QAAQ,IAAI,kBAAkB,KAAK;AAAA,QACrD,YAAY,4BAA4B,OAAO;AAAA,MACjD,CAAC;AAED,YAAM,EAAE,YAAY,IAAI,MAAM;AAAA,QAC5B;AAAA,UACE,YAAY,SAAS;AAAA,UACrB,eAAe,SAAS;AAAA,UACxB,gBAAgB,SAAS;AAAA,UACzB,iBAAiB,SAAS;AAAA,UAC1B,SAAS,SAAS;AAAA,UAClB,SAAS;AAAA,UACT,QAAQ,SAAS;AAAA,UACjB,KAAK,SAAS;AAAA,UACd,GAAI,OAAO,EAAE,WAAW,CAAC,MAAwB,IAAI,UAAU,CAAC,EAAE;AAAA,QACpE;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,MACX;AAEA,UAAI,YAAY,WAAW,UAAW,QAAO,eAAe,WAAW;AACvE,aAAO,QAAQ,iBAAiB,SAAS,WAAW,CAAC;AAAA,IACvD,SAAS,KAAK;AAEZ,eAAS,IAAI,SAAS,gDAA2C;AAAA,QAC/D,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AACD,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@astrasyncai/adapter-edge",
-  "version": "1.9.1",
-  "description": "AstraSync Trusted Agent Gateway — edge adapters for Vercel Edge, Cloudflare Workers, and Fastly Compute",
+  "version": "1.10.0",
+  "description": "AstraSync Trusted Agent Gateway — edge adapters for Vercel Edge, Cloudflare Workers, Fastly Compute, and Akamai EdgeWorkers",
   "type": "module",
   "exports": {
     ".": {
@@ -19,10 +19,15 @@
     "./fastly": {
       "types": "./dist/fastly.d.ts",
       "import": "./dist/fastly.js"
+    },
+    "./akamai": {
+      "types": "./dist/akamai.d.ts",
+      "import": "./dist/akamai.js"
     }
   },
   "files": [
     "dist",
+    "templates",
     "README.md"
   ],
   "scripts": {
@@ -43,6 +48,7 @@
     "cloudflare-workers",
     "vercel-edge",
     "fastly-compute",
+    "akamai-edgeworkers",
     "agent-verification",
     "bot-detection"
   ],
@@ -54,13 +60,13 @@
     "directory": "packages/adapter-edge"
   },
   "dependencies": {
-    "@astrasyncai/verification-gateway": "^5.16.0"
+    "@astrasyncai/verification-gateway": "^5.22.0"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",
     "eslint": "^8.56.0",
     "tsup": "^8.0.1",
     "typescript": "^5.3.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   }
 }

package/templates/akamai/README.md

@@ -0,0 +1,16 @@
+# AstraSync gateway on Akamai EdgeWorkers
+
+1. **Client IP header.** In Property Manager, enable the _True Client IP Header_
+   behaviour (`True-Client-IP`). The gateway reads the client IP from it.
+2. **API route.** Add a property rule matching path `/.astrasync/api/*`. Give it the
+   origin `astrasync.ai` (HTTPS, forward host header = origin hostname). Rewrite
+   the path to strip the `/.astrasync` prefix. Caching: _no-store_.
+3. **EdgeWorker.** Create an EdgeWorker ID, upload this bundle, and add the
+   _EdgeWorkers_ behaviour to the rule that covers your site.
+4. **Where it runs.** Akamai's App & API Protector / Bot Manager run first.
+   Requests they deny never reach the EdgeWorker. To see those agents, stream
+   your security events to AstraSync: DataStream 2 → custom HTTPS endpoint, set
+   up on the endpoint page under _Edge logs_.
+
+Limits in this version: header-only detection (EdgeWorkers can't read request
+bodies in `onClientRequest`), and no TLS fingerprints.

package/templates/akamai/bundle.json

@@ -0,0 +1,4 @@
+{
+  "edgeworker-version": "1.0.0",
+  "description": "AstraSync Trusted Agent Gateway"
+}

package/templates/akamai/main.js

@@ -0,0 +1,18 @@
+// AstraSync Trusted Agent Gateway — Akamai EdgeWorkers (onClientRequest).
+// Bundle with your bundler of choice (the adapter is ESM), then:
+//   akamai edgeworkers upload --bundle astrasync-gateway.tgz <ewId>
+//   akamai edgeworkers activate <ewId> STAGING <version>
+import { httpRequest } from 'http-request';
+import { createOnClientRequest } from '@astrasyncai/adapter-edge/akamai';
+
+export const onClientRequest = createOnClientRequest({
+  httpRequest,
+  counterpartyId: 'ASTRAE-replace-me',
+  counterpartyUrl: 'https://www.example.com',
+  // Your merchant kya_… key. Keep it out of source: inject at bundle time
+  // or read it from EdgeKV before calling the gateway.
+  apiKey: 'kya_replace_me',
+  // Sub-requests must reach a hostname on your property: add the property
+  // rule in README.md that routes /.astrasync/api/* to astrasync.ai.
+  apiBaseUrl: 'https://www.example.com/.astrasync/api',
+});

package/templates/cloudflare/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "astrasync-gateway-worker",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "deploy": "wrangler deploy",
+    "dev": "wrangler dev"
+  },
+  "dependencies": {
+    "@astrasyncai/adapter-edge": "^1.10.0"
+  },
+  "devDependencies": {
+    "wrangler": "^4.0.0"
+  }
+}

package/templates/cloudflare/src/compose.ts

@@ -0,0 +1,14 @@
+/**
+ * Use this instead of worker.ts when your zone ALREADY runs a Worker on the
+ * same route (Cloudflare allows one Worker per route). The gateway runs
+ * first; requests it passes go to your existing handler instead of straight
+ * to the origin. Enforce-mode denials are answered before your code runs.
+ */
+import { createGatewayHandler } from '@astrasyncai/adapter-edge/cloudflare';
+import existingWorker from './existing-worker'; // your current Worker module
+
+export default {
+  fetch: createGatewayHandler({
+    forward: (request, env, ctx) => existingWorker.fetch(request, env, ctx),
+  }),
+};

package/templates/cloudflare/src/worker.ts

@@ -0,0 +1,5 @@
+import { createGatewayHandler } from '@astrasyncai/adapter-edge/cloudflare';
+
+// Pass traffic goes to your origin unchanged (plus trust headers for verified
+// agents); telemetry runs in ctx.waitUntil, off the latency path.
+export default { fetch: createGatewayHandler() };

package/templates/cloudflare/wrangler.toml

@@ -0,0 +1,26 @@
+# AstraSync Trusted Agent Gateway — Cloudflare Worker
+#
+# 1. npm install && npx wrangler login
+# 2. Set the two vars below (from your endpoint page in the AstraSync dashboard).
+# 3. npx wrangler secret put ASTRASYNC_API_KEY   (your merchant kya_… key)
+# 4. Edit the route to your zone, then: npx wrangler deploy
+#
+# Observe mode is the default and never blocks. Switch to enforce, choose a
+# check depth and set per-path rules on the endpoint's Edge verification
+# panel — no redeploy. The Worker runs AFTER Cloudflare's WAF and bot
+# rules: requests they block never reach it. To see those, connect your
+# Cloudflare security events (Logpush → HTTP) on the endpoint page under
+# Edge logs.
+
+name = "astrasync-gateway"
+main = "src/worker.ts"
+compatibility_date = "2026-09-01"
+
+# Cover the whole site; humans and static assets pass with no API call.
+routes = [
+  { pattern = "www.example.com/*", zone_name = "example.com" },
+]
+
+[vars]
+ASTRASYNC_COUNTERPARTY_ID = "ASTRAE-replace-me"
+ASTRASYNC_COUNTERPARTY_URL = "https://www.example.com"

package/templates/fastly/fastly.toml

@@ -0,0 +1,17 @@
+# AstraSync Trusted Agent Gateway — Fastly Compute
+#
+# 1. npm install && fastly compute init --from=. (or add to your service)
+# 2. Backends: "origin" → your origin; "astrasync" → astrasync.ai:443
+# 3. Put your merchant kya_… key in a secret store named "astrasync"
+#    (key: api_key) and fill in the ids in src/index.ts.
+# 4. fastly compute publish
+#
+# Runs after Fastly's Next-Gen WAF: requests it blocks never reach this
+# service. Connect Fastly HTTPS logging on the endpoint page (Edge logs) to
+# see them.
+manifest_version = 3
+name = "astrasync-gateway"
+language = "javascript"
+
+[scripts]
+build = "npx js-compute-runtime src/index.ts bin/main.wasm"

package/templates/fastly/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "astrasync-gateway-fastly",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@astrasyncai/adapter-edge": "^1.10.0",
+    "@fastly/js-compute": "^3.0.0"
+  }
+}

package/templates/fastly/src/index.ts

@@ -0,0 +1,15 @@
+/// <reference types="@fastly/js-compute" />
+import { SecretStore } from 'fastly:secret-store';
+import { createGatewayHandler } from '@astrasyncai/adapter-edge/fastly';
+
+const apiKey = (await new SecretStore('astrasync').get('api_key'))?.plaintext();
+
+const gateway = createGatewayHandler({
+  originBackend: 'origin',
+  counterpartyId: 'ASTRAE-replace-me',
+  counterpartyUrl: 'https://www.example.com',
+  ...(apiKey && { apiKey }),
+  geo: true,
+});
+
+addEventListener('fetch', (event) => event.respondWith(gateway(event)));