@astrasyncai/adapter-lambda 1.0.0

package/dist/index.js

@@ -0,0 +1,671 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  ASAT_HEADERS: () => ASAT_HEADERS,
+  _resetConfigCaches: () => _resetConfigCaches,
+  applyOutcome: () => applyOutcome,
+  buildDenyBody: () => buildDenyBody,
+  buildManualReviewBody: () => buildManualReviewBody,
+  classify: () => classify,
+  createEdgeHandler: () => createEdgeHandler,
+  decodeBody: () => decodeBody,
+  detectCommerce: () => detectCommerce,
+  emitBeacon: () => emitBeacon,
+  flattenHeaders: () => flattenHeaders,
+  getHeader: () => getHeader,
+  getRequest: () => getRequest,
+  jsonResponse: () => jsonResponse,
+  loadEdgeConfig: () => loadEdgeConfig,
+  requestUrl: () => requestUrl,
+  resolveApiKey: () => resolveApiKey,
+  resolvePolicy: () => resolvePolicy,
+  runTier: () => runTier,
+  sampled: () => sampled,
+  setHeader: () => setHeader,
+  stripHeadersByPrefix: () => stripHeadersByPrefix,
+  withBudget: () => withBudget
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/cf.ts
+function getRequest(event) {
+  return event.Records[0].cf.request;
+}
+function getHeader(request, name) {
+  return request.headers[name.toLowerCase()]?.[0]?.value;
+}
+function flattenHeaders(headers) {
+  const out = {};
+  for (const [name, entries] of Object.entries(headers)) {
+    if (!entries?.length) continue;
+    out[name] = entries.length === 1 ? entries[0].value : entries.map((e) => e.value);
+  }
+  return out;
+}
+function decodeBody(request) {
+  const body = request.body;
+  if (!body?.data) return { truncated: false };
+  const text = body.encoding === "base64" ? Buffer.from(body.data, "base64").toString("utf8") : body.data;
+  return { text, truncated: body.inputTruncated === true };
+}
+function requestUrl(request, host) {
+  const qs = request.querystring ? `?${request.querystring}` : "";
+  return `https://${host}${request.uri}${qs}`;
+}
+function setHeader(request, name, value) {
+  request.headers[name.toLowerCase()] = [{ key: name, value }];
+}
+function stripHeadersByPrefix(request, prefix) {
+  const p = prefix.toLowerCase();
+  for (const name of Object.keys(request.headers)) {
+    if (name.startsWith(p)) delete request.headers[name];
+  }
+}
+function jsonResponse(status, body, extraHeaders) {
+  const headers = {
+    "content-type": [{ key: "Content-Type", value: "application/json" }]
+  };
+  for (const [name, value] of Object.entries(extraHeaders ?? {})) {
+    headers[name.toLowerCase()] = [{ key: name, value }];
+  }
+  return {
+    status: String(status),
+    statusDescription: status === 403 ? "Forbidden" : status === 202 ? "Accepted" : "OK",
+    headers,
+    body: JSON.stringify(body)
+  };
+}
+
+// src/config.ts
+var import_edge_config = require("@astrasyncai/verification-gateway/edge-config");
+var SECRET_TTL_MS = 15 * 60 * 1e3;
+var secretCache = /* @__PURE__ */ new Map();
+async function defaultFetchSecret(secretName) {
+  const { SecretsManagerClient, GetSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
+  const client = new SecretsManagerClient({ region: "us-east-1" });
+  const result = await client.send(new GetSecretValueCommand({ SecretId: secretName }));
+  return result.SecretString ?? void 0;
+}
+async function resolveApiKey(options) {
+  if (options.apiKey) return options.apiKey;
+  const secretName = options.apiKeySecretName;
+  if (!secretName) return void 0;
+  const cached = secretCache.get(secretName);
+  if (cached && Date.now() - cached.fetchedAt < SECRET_TTL_MS) return cached.value;
+  try {
+    const fetcher = options.fetchSecret ?? defaultFetchSecret;
+    const value = await fetcher(secretName);
+    secretCache.set(secretName, { value, fetchedAt: Date.now() });
+    return value;
+  } catch (err) {
+    options.log?.("warn", "Secrets Manager fetch failed \u2014 continuing keyless", {
+      secretName,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return cached?.value;
+  }
+}
+async function loadEdgeConfig(options, apiKey) {
+  try {
+    return await (0, import_edge_config.getEdgeConfig)({ apiBaseUrl: options.apiBaseUrl, apiKey }, options.counterpartyId, {
+      ttlMs: options.configTtlMs
+    });
+  } catch {
+    return options.fallbackConfig ?? import_edge_config.DEFAULT_EDGE_CONFIG;
+  }
+}
+function _resetConfigCaches() {
+  secretCache.clear();
+}
+
+// src/classify.ts
+var import_verify = require("@astrasyncai/verification-gateway/verify");
+var import_platform_signatures = require("@astrasyncai/verification-gateway/platform-signatures");
+var import_edge_config2 = require("@astrasyncai/verification-gateway/edge-config");
+
+// src/detect.ts
+var SD_JWT_PATTERN = /^eyJ[\w-]+\.[\w-]*\.[\w-]+~/;
+function sniffJwtHeader(compact) {
+  try {
+    const seg = compact.split(".")[0];
+    return JSON.parse(Buffer.from(seg, "base64url").toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function parseJsonBody(body) {
+  if (!body.text) return void 0;
+  try {
+    const parsed = JSON.parse(body.text);
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function detectCommerce(request, host, body) {
+  const url = requestUrl(request, host);
+  const method = request.method;
+  const headers = flattenHeaders(request.headers);
+  const jsonBody = parseJsonBody(body);
+  const truncated = body.truncated ? { bodyTruncated: true } : {};
+  const authHeader = getHeader(request, "authorization");
+  const bearer = authHeader?.replace(/^Bearer\s+/i, "");
+  const mandateHeader = getHeader(request, "x-payment-mandate") ?? getHeader(request, "payment-mandate");
+  const sdJwtCandidate = [mandateHeader, bearer].find((v) => v && SD_JWT_PATTERN.test(v));
+  if (sdJwtCandidate) {
+    const typ = sniffJwtHeader(sdJwtCandidate)?.typ;
+    return {
+      protocol: "vi-sd-jwt",
+      artifacts: { viSdJwt: sdJwtCandidate },
+      evidence: { typ, ...truncated }
+    };
+  }
+  const signature = getHeader(request, "signature");
+  const signatureInput = getHeader(request, "signature-input");
+  if (signature && signatureInput) {
+    const signatureAgent = getHeader(request, "signature-agent");
+    const registryHint = getHeader(request, "x-agent-registry");
+    const lowerInput = signatureInput.toLowerCase();
+    const protocol = signatureAgent ? "rfc9421-web-bot-auth" : registryHint?.toLowerCase().includes("visa") || lowerInput.includes("visa") ? "rfc9421-tap" : registryHint?.toLowerCase().includes("mastercard") || lowerInput.includes("mastercard") ? "rfc9421-agent-pay" : "rfc9421";
+    return {
+      protocol,
+      artifacts: {
+        rfc9421: { headers, method, url, ...body.text && { body: body.text } }
+      },
+      evidence: {
+        ...signatureAgent && { signatureAgent },
+        ...registryHint && { registryHint },
+        keyid: signatureInput.match(/keyid="([^"]+)"/)?.[1],
+        ...truncated
+      }
+    };
+  }
+  const acpTimestamp = getHeader(request, "timestamp");
+  if (signature && !signatureInput && (acpTimestamp || getHeader(request, "idempotency-key"))) {
+    return {
+      protocol: "acp",
+      artifacts: {
+        acpRequest: {
+          method,
+          url,
+          headers,
+          ...body.text && { rawBody: body.text },
+          ...jsonBody && { body: jsonBody }
+        }
+      },
+      evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
+    };
+  }
+  if (/\/checkout[-_]sessions(\/|$)/.test(request.uri)) {
+    return {
+      protocol: "ucp",
+      artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
+      evidence: { path: request.uri, ...truncated }
+    };
+  }
+  if (jsonBody) {
+    const intent = jsonBody.intent_mandate ?? jsonBody.intentMandate;
+    const cart = jsonBody.cart_mandate ?? jsonBody.cartMandate;
+    const payment = jsonBody.payment_mandate ?? jsonBody.paymentMandate;
+    if (typeof intent === "string" || typeof cart === "string" || typeof payment === "string") {
+      return {
+        protocol: "ap2",
+        artifacts: {
+          ap2Mandates: {
+            ...typeof intent === "string" && { intent },
+            ...typeof cart === "string" && { cart },
+            ...typeof payment === "string" && { payment }
+          }
+        },
+        evidence: {
+          mandatesPresent: [
+            typeof intent === "string" && "intent",
+            typeof cart === "string" && "cart",
+            typeof payment === "string" && "payment"
+          ].filter(Boolean),
+          ...truncated
+        }
+      };
+    }
+  }
+  if (authHeader && /^Payment\s+/i.test(authHeader)) {
+    return {
+      protocol: "mpp",
+      artifacts: {
+        mppRequest: {
+          method,
+          url,
+          headers,
+          ...body.text && { rawBody: body.text },
+          ...jsonBody && { body: jsonBody }
+        }
+      },
+      evidence: truncated
+    };
+  }
+  if (getHeader(request, "x-payment")) {
+    return {
+      protocol: "x402",
+      artifacts: {
+        x402Request: { method, url, headers, ...jsonBody && { body: jsonBody } }
+      },
+      evidence: truncated
+    };
+  }
+  return void 0;
+}
+
+// src/classify.ts
+var STATIC_EXTENSIONS = /\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|pdf|txt|xml)$/i;
+var BOT_UA_PATTERN = /curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i;
+var BROWSER_UA_PATTERN = /mozilla\/\d/i;
+function resolvePolicy(config, path) {
+  if (STATIC_EXTENSIONS.test(path)) {
+    return { mode: config.mode, depth: config.depth, skip: true };
+  }
+  const rule = (0, import_edge_config2.matchEdgePathRule)(config.pathRules, path);
+  if (!rule) return { mode: config.mode, depth: config.depth, skip: false };
+  return {
+    mode: rule.mode ?? config.mode,
+    depth: rule.depth ?? config.depth,
+    skip: rule.skip === true
+  };
+}
+function classify(request, host, depth) {
+  const userAgent = getHeader(request, "user-agent") ?? "";
+  const credentials = (0, import_verify.extractCredentials)(flattenHeaders(request.headers), {});
+  if (credentials.astraId || credentials.apiKey || credentials.jwt) {
+    return { tier: "verified", protocol: "x-astra" };
+  }
+  if (depth !== "classify") {
+    const commerce = detectCommerce(request, host, decodeBody(request));
+    if (commerce) {
+      return {
+        tier: "identified",
+        protocol: commerce.protocol,
+        artifacts: commerce.artifacts,
+        evidence: commerce.evidence,
+        fingerprint: (0, import_platform_signatures.detectPlatformFingerprint)({ userAgent })
+      };
+    }
+  }
+  const fingerprint = (0, import_platform_signatures.detectPlatformFingerprint)({ userAgent });
+  if (fingerprint) {
+    return { tier: "identified", protocol: "platform-ua", fingerprint };
+  }
+  if (!userAgent || BOT_UA_PATTERN.test(userAgent) || !BROWSER_UA_PATTERN.test(userAgent)) {
+    return { tier: "anonymous-bot", evidence: { userAgent: userAgent || "(none)" } };
+  }
+  if (!getHeader(request, "sec-fetch-mode") && !getHeader(request, "accept-language")) {
+    return { tier: "anonymous-bot", evidence: { userAgent, spoofedBrowser: true } };
+  }
+  return { tier: "human" };
+}
+
+// src/pipeline.ts
+var import_verify3 = require("@astrasyncai/verification-gateway/verify");
+var import_http_pdlss = require("@astrasyncai/verification-gateway/http-pdlss");
+
+// src/events.ts
+var import_verify2 = require("@astrasyncai/verification-gateway/verify");
+async function withBudget(promise, ms) {
+  let timer;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(void 0), ms);
+      })
+    ]);
+  } catch {
+    return void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function emitBeacon(options, request, classification, budgetMs) {
+  const clientIp = getHeader(request, "cloudfront-viewer-address")?.split(":")[0];
+  await withBudget(
+    (0, import_verify2.reportUnregisteredAttempt)(
+      { apiBaseUrl: options.apiBaseUrl, counterpartyId: options.counterpartyId },
+      {
+        counterpartyUrl: options.counterpartyUrl,
+        counterpartyType: "website",
+        sourceIp: clientIp,
+        userAgent: getHeader(request, "user-agent"),
+        requestPath: request.uri,
+        requestMethod: request.method,
+        // 3.9.0 evidence fields (backend persists them into eventData).
+        protocol: classification.protocol,
+        evidence: classification.evidence
+      }
+    ),
+    budgetMs
+  );
+}
+function sampled(rate, random = Math.random) {
+  if (rate <= 0) return false;
+  if (rate >= 1) return true;
+  return random() < rate;
+}
+
+// src/pipeline.ts
+function baseOutcome(classification) {
+  return {
+    tier: classification.tier,
+    decision: "allow",
+    reasons: [],
+    protocol: classification.protocol
+  };
+}
+function buildVerificationRequest(options, request, classification, includeArtifacts) {
+  const headers = flattenHeaders(request.headers);
+  const clientIp = getHeader(request, "cloudfront-viewer-address")?.split(":")[0];
+  const pdlss = (0, import_http_pdlss.resolveHttpPdlss)({
+    method: request.method,
+    astraPurpose: getHeader(request, "x-astra-purpose"),
+    astraAction: getHeader(request, "x-astra-action")
+  });
+  return {
+    credentials: (0, import_verify3.extractCredentials)(headers, {}),
+    purpose: pdlss.purpose,
+    action: pdlss.action,
+    resource: request.uri,
+    createSession: true,
+    counterpartyType: "website",
+    counterpartyUrl: options.counterpartyUrl,
+    callerMetadata: {
+      sourceIp: clientIp,
+      userAgent: getHeader(request, "user-agent"),
+      referer: getHeader(request, "referer"),
+      host: getHeader(request, "host")
+    },
+    ...includeArtifacts && classification.artifacts && { commerceArtifacts: classification.artifacts }
+  };
+}
+function outcomeFromVerifyResult(classification, result) {
+  const outcome = baseOutcome(classification);
+  outcome.sessionId = result.sessionId;
+  outcome.correlationId = result.correlationId;
+  outcome.guidance = result.guidance;
+  if (result.requiresStepUp || result.stepUpApproval) {
+    outcome.decision = "manual_review";
+    outcome.reasons = ["step-up approval required"];
+    outcome.stepUp = {
+      pollUrl: result.stepUpApproval?.pollUrl,
+      expiresAt: result.stepUpApproval?.expiresAt
+    };
+    return outcome;
+  }
+  if (!result.identityVerified || !result.policyAllowed) {
+    outcome.decision = "deny";
+    outcome.reasons = result.denialReasons?.length ? result.denialReasons : [!result.identityVerified ? "identity not verified" : "denied by access policy"];
+    return outcome;
+  }
+  outcome.asat = {
+    trustScore: result.agent?.trustScore,
+    agentId: result.agent?.astraId,
+    developerId: result.developer?.astradId,
+    accessLevel: result.accessLevel
+  };
+  return outcome;
+}
+async function runTier(options, request, classification, policy, apiKey, sampling) {
+  const budgets = options.budgets ?? {};
+  const beaconMs = budgets.beaconMs ?? 300;
+  const verifyMs = policy.mode === "enforce" ? budgets.verifyEnforceMs ?? 3e3 : budgets.verifyObserveMs ?? 1500;
+  const gatewayConfig = {
+    apiBaseUrl: options.apiBaseUrl,
+    ...apiKey && { apiKey },
+    counterpartyId: options.counterpartyId,
+    // The shell handles its own error semantics; init self-probes don't
+    // belong in a per-request edge function.
+    disableInitChecks: true
+  };
+  try {
+    switch (classification.tier) {
+      case "verified": {
+        if (policy.depth === "classify") {
+          return baseOutcome(classification);
+        }
+        const result = await withBudget(
+          (0, import_verify3.verify)(
+            gatewayConfig,
+            buildVerificationRequest(options, request, classification, policy.depth === "authorize")
+          ),
+          verifyMs
+        );
+        if (!result) {
+          const outcome = baseOutcome(classification);
+          outcome.reasons = ["verify-access unreachable within budget \u2014 fail-open"];
+          return outcome;
+        }
+        return outcomeFromVerifyResult(classification, result);
+      }
+      case "identified": {
+        if (policy.depth === "authorize" && classification.artifacts) {
+          const result = await withBudget(
+            (0, import_verify3.verify)(gatewayConfig, buildVerificationRequest(options, request, classification, true)),
+            verifyMs
+          );
+          if (!result) {
+            const outcome2 = baseOutcome(classification);
+            outcome2.reasons = ["verify-access unreachable within budget \u2014 fail-open"];
+            return outcome2;
+          }
+          return outcomeFromVerifyResult(classification, result);
+        }
+        await emitBeacon(options, request, classification, beaconMs);
+        const outcome = baseOutcome(classification);
+        if (policy.mode === "enforce" && policy.depth !== "classify") {
+          outcome.decision = "deny";
+          outcome.reasons = ["agent is not registered with AstraSync"];
+        }
+        return outcome;
+      }
+      case "anonymous-bot": {
+        if (sampled(sampling.anonymousBeaconRate, options.random)) {
+          await emitBeacon(
+            options,
+            request,
+            { ...classification, protocol: classification.protocol ?? "ua-heuristic" },
+            beaconMs
+          );
+        }
+        return baseOutcome(classification);
+      }
+      default:
+        return baseOutcome(classification);
+    }
+  } catch (err) {
+    const outcome = baseOutcome(classification);
+    outcome.reasons = [
+      `edge pipeline error \u2014 fail-open: ${err instanceof Error ? err.message : String(err)}`
+    ];
+    return outcome;
+  }
+}
+
+// src/messaging.ts
+var PROTOCOL_MESSAGES = {
+  "vi-sd-jwt": "This request presented Visa Intelligent Commerce credentials, but the agent is not verified with AstraSync. Register the agent to pair your VI credentials with a verified identity and mandate.",
+  "rfc9421-agent-pay": "This request carried a Mastercard Agent Pay signature, but the agent is not verified with AstraSync. Register the agent to pair Agent Pay credentials with a verified identity and mandate.",
+  "rfc9421-tap": "This request carried a Visa TAP signature, but the agent is not verified with AstraSync. Register the agent to pair TAP credentials with a verified identity and mandate.",
+  "rfc9421-web-bot-auth": "This request carried a Web Bot Auth signature, but the agent is not verified with AstraSync. Register the agent to link your signed-agent identity to a verified principal.",
+  rfc9421: "This request carried an RFC 9421 HTTP message signature, but the agent is not verified with AstraSync. Register the agent to link the signing identity to a verified principal.",
+  acp: "This request used the Agentic Commerce Protocol, but the agent is not verified with AstraSync. Register the agent to transact on this property.",
+  ucp: "This request used a UCP checkout session, but the agent is not verified with AstraSync. Register the agent to transact on this property.",
+  ap2: "This request presented AP2 mandates, but the agent is not verified with AstraSync. Register the agent to pair your mandates with a verified identity.",
+  mpp: "This request presented MPP payment credentials, but the agent is not verified with AstraSync. Register the agent to transact on this property.",
+  x402: "This request used x402 payment headers, but the agent is not verified with AstraSync. Register the agent to transact on this property.",
+  "platform-ua": "This traffic was identified as a platform AI agent without AstraSync credentials. Register the agent to access this property with a verified identity.",
+  "x-astra": "The presented AstraSync credentials failed verification or were denied by this property\u2019s access policy."
+};
+function buildDenyBody(outcome, apiBaseUrl) {
+  const origin = apiBaseUrl.replace(/\/api\/?$/, "");
+  const protocolMessage = (outcome.protocol && PROTOCOL_MESSAGES[outcome.protocol]) ?? "This request could not be verified by AstraSync.";
+  return {
+    success: false,
+    error: {
+      // UNAUTHORIZED = identity failed (register/re-authenticate helps);
+      // INSUFFICIENT_ACCESS = identity fine, policy denied (fix the mandate).
+      code: outcome.tier === "verified" ? "INSUFFICIENT_ACCESS" : "UNAUTHORIZED",
+      message: protocolMessage,
+      ...outcome.protocol && { protocol: outcome.protocol },
+      failures: outcome.reasons,
+      ...outcome.correlationId && { correlationId: outcome.correlationId },
+      guidance: {
+        // `||` not `??`: verify() fills these with EMPTY STRINGS when the
+        // well-known cache is cold — empty means "use the fallback".
+        message: outcome.guidance?.message || "Register this agent with AstraSync to receive verifiable credentials.",
+        registrationUrl: outcome.guidance?.registrationUrl || `${origin}/register`,
+        documentationUrl: outcome.guidance?.documentationUrl || `${origin}/docs/edge-adapter`
+      }
+    }
+  };
+}
+function buildManualReviewBody(outcome) {
+  return {
+    success: false,
+    status: "manual_review",
+    message: "This action requires human approval. Poll the step-up approval endpoint and retry once approved.",
+    ...outcome.stepUp && { stepUpApproval: outcome.stepUp },
+    ...outcome.correlationId && { correlationId: outcome.correlationId }
+  };
+}
+
+// src/enforce.ts
+var ASAT_HEADERS = {
+  trustScore: "X-AstraSync-Trust-Score",
+  agentId: "X-AstraSync-Agent-Id",
+  developerId: "X-AstraSync-Developer-Id",
+  permissions: "X-AstraSync-Permissions",
+  observedDecision: "X-AstraSync-Observed-Decision"
+};
+function applyOutcome(options, request, outcome, policy) {
+  stripHeadersByPrefix(request, "x-astrasync-");
+  if (policy.mode !== "enforce") {
+    if (outcome.decision !== "allow") {
+      setHeader(request, ASAT_HEADERS.observedDecision, outcome.decision);
+    }
+    injectAsat(request, outcome);
+    return request;
+  }
+  switch (outcome.decision) {
+    case "deny":
+      return jsonResponse(403, buildDenyBody(outcome, options.apiBaseUrl));
+    case "manual_review":
+      return jsonResponse(202, buildManualReviewBody(outcome), {
+        "Retry-After": "30"
+      });
+    default:
+      injectAsat(request, outcome);
+      return request;
+  }
+}
+function injectAsat(request, outcome) {
+  if (!outcome.asat) return;
+  const { trustScore, agentId, developerId, accessLevel } = outcome.asat;
+  if (trustScore !== void 0) {
+    setHeader(request, ASAT_HEADERS.trustScore, String(trustScore));
+  }
+  if (agentId) setHeader(request, ASAT_HEADERS.agentId, agentId);
+  if (developerId) setHeader(request, ASAT_HEADERS.developerId, developerId);
+  if (accessLevel) setHeader(request, ASAT_HEADERS.permissions, accessLevel);
+}
+
+// src/handler.ts
+function createEdgeHandler(options) {
+  const log = options.log ?? ((level, message, data) => {
+    console[level === "info" ? "log" : level](`[astrasync-edge] ${message}`, data ?? "");
+  });
+  return async function handler(event) {
+    const request = getRequest(event);
+    try {
+      const apiKey = await resolveApiKey({ ...options, log });
+      const config = await loadEdgeConfig(options, apiKey);
+      const policy = resolvePolicy(config, request.uri);
+      if (policy.skip) return request;
+      const host = getHeader(request, "x-forwarded-host") ?? getHeader(request, "host") ?? new URL(options.counterpartyUrl).host;
+      const classification = classify(request, host, policy.depth);
+      if (classification.tier === "human") return request;
+      const outcome = await runTier(
+        { ...options, log },
+        request,
+        classification,
+        policy,
+        apiKey,
+        config.sampling
+      );
+      if (outcome.decision !== "allow") {
+        log(
+          "info",
+          policy.mode === "enforce" ? `${outcome.decision.toUpperCase()}: ${request.method} ${request.uri}` : `[OBSERVE] would have been ${outcome.decision.toUpperCase()}: ${request.method} ${request.uri}`,
+          { tier: outcome.tier, protocol: outcome.protocol, reasons: outcome.reasons }
+        );
+      }
+      return applyOutcome(options, request, outcome, policy);
+    } catch (err) {
+      log("error", "edge handler error \u2014 passing request through", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+      return request;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ASAT_HEADERS,
+  _resetConfigCaches,
+  applyOutcome,
+  buildDenyBody,
+  buildManualReviewBody,
+  classify,
+  createEdgeHandler,
+  decodeBody,
+  detectCommerce,
+  emitBeacon,
+  flattenHeaders,
+  getHeader,
+  getRequest,
+  jsonResponse,
+  loadEdgeConfig,
+  requestUrl,
+  resolveApiKey,
+  resolvePolicy,
+  runTier,
+  sampled,
+  setHeader,
+  stripHeadersByPrefix,
+  withBudget
+});
+//# sourceMappingURL=index.js.map