@astrasyncai/adapter-lambda 2.0.0 → 2.2.0

package/dist/index.mjs

@@ -1,7 +1,8 @@
+// src/handler.ts
+import { evaluateEdgeRequest } from "@astrasyncai/verification-gateway/edge-core";
+
 // src/cf.ts
-import {
-  sanitizeHeaders
-} from "@astrasyncai/verification-gateway/metadata-capture";
+import { buildObservedMetadata as buildObservedMetadataCore } from "@astrasyncai/verification-gateway/edge-core";
 function getRequest(event) {
   return event.Records[0].cf.request;
 }
@@ -16,6 +17,14 @@ function flattenHeaders(headers) {
   }
   return out;
 }
+function flattenHeadersSingle(headers) {
+  const out = {};
+  for (const [name, entries] of Object.entries(headers)) {
+    if (!entries?.length) continue;
+    out[name] = entries.map((e) => e.value).join(", ");
+  }
+  return out;
+}
 function decodeBody(request) {
   const body = request.body;
   if (!body?.data) return { truncated: false };
@@ -33,10 +42,17 @@ function collectConnectionMetadata(request) {
   put("country", "cloudfront-viewer-country");
   put("countryName", "cloudfront-viewer-country-name");
   put("region", "cloudfront-viewer-country-region");
+  put("countryRegionName", "cloudfront-viewer-country-region-name");
   put("city", "cloudfront-viewer-city");
   put("asn", "cloudfront-viewer-asn");
   put("tlsVersion", "cloudfront-viewer-tls");
   put("httpVersion", "cloudfront-viewer-http-version");
+  put("timeZone", "cloudfront-viewer-time-zone");
+  put("metroCode", "cloudfront-viewer-metro-code");
+  put("tlsFingerprint", "cloudfront-viewer-ja3-fingerprint");
+  put("ja4", "cloudfront-viewer-ja4-fingerprint");
+  put("headerOrder", "cloudfront-viewer-header-order", (v) => v.slice(0, 256));
+  put("headerCount", "cloudfront-viewer-header-count");
   const devices = [];
   for (const [label, header] of [
     ["desktop", "cloudfront-is-desktop-viewer"],
@@ -49,18 +65,33 @@ function collectConnectionMetadata(request) {
   if (devices.length) out.device = devices.join(",");
   return out;
 }
-function buildObservedMetadata(request) {
-  const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(
-    flattenHeaders(request.headers)
-  );
+function toNormalizedRequest(request) {
+  const body = decodeBody(request);
   const connection = collectConnectionMetadata(request);
+  const clientIp = getHeader(request, "cloudfront-viewer-address")?.split(":")[0];
   return {
-    headers,
-    ...apiKeyFormat && { apiKeyFormat },
-    ...platformHeaders && { platformHeaders },
+    method: request.method,
+    uri: request.uri,
+    querystring: request.querystring ?? "",
+    headers: flattenHeadersSingle(request.headers),
+    ...body.text !== void 0 && { bodyText: body.text },
+    ...body.truncated && { bodyTruncated: true },
+    ...clientIp && { clientIp },
     ...Object.keys(connection).length > 0 && { connection }
   };
 }
+function applyCoreOutcome(request, application) {
+  if (application.action === "respond") {
+    return jsonResponse(application.status, application.bodyJson, application.headers);
+  }
+  for (const prefix of application.stripHeaderPrefixes) {
+    stripHeadersByPrefix(request, prefix);
+  }
+  for (const [name, value] of Object.entries(application.injectHeaders)) {
+    setHeader(request, name, value);
+  }
+  return request;
+}
 function normalizeOriginHost(request) {
   const originDomain = request.origin?.custom?.domainName ?? request.origin?.s3?.domainName ?? void 0;
   if (!originDomain) return;
@@ -144,483 +175,6 @@ function _resetConfigCaches() {
   secretCache.clear();
 }
 
-// src/classify.ts
-import { extractCredentials } from "@astrasyncai/verification-gateway/verify";
-import { detectPlatformFingerprint } from "@astrasyncai/verification-gateway/platform-signatures";
-import { matchEdgePathRule } from "@astrasyncai/verification-gateway/edge-config";
-import { sanitizeHeaders as sanitizeHeaders2 } from "@astrasyncai/verification-gateway/metadata-capture";
-
-// src/detect.ts
-var SD_JWT_PATTERN = /^eyJ[\w-]+\.[\w-]*\.[\w-]+~/;
-function sniffJwtHeader(compact) {
-  try {
-    const seg = compact.split(".")[0];
-    return JSON.parse(Buffer.from(seg, "base64url").toString("utf8"));
-  } catch {
-    return void 0;
-  }
-}
-function parseJsonBody(body) {
-  if (!body.text) return void 0;
-  try {
-    const parsed = JSON.parse(body.text);
-    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function detectCommerce(request, host, body) {
-  const url = requestUrl(request, host);
-  const method = request.method;
-  const headers = flattenHeaders(request.headers);
-  const jsonBody = parseJsonBody(body);
-  const truncated = body.truncated ? { bodyTruncated: true } : {};
-  const authHeader = getHeader(request, "authorization");
-  const bearer = authHeader?.replace(/^Bearer\s+/i, "");
-  const mandateHeader = getHeader(request, "x-payment-mandate") ?? getHeader(request, "payment-mandate");
-  const sdJwtCandidate = [mandateHeader, bearer].find((v) => v && SD_JWT_PATTERN.test(v));
-  if (sdJwtCandidate) {
-    const typ = sniffJwtHeader(sdJwtCandidate)?.typ;
-    return {
-      protocol: "vi-sd-jwt",
-      artifacts: { viSdJwt: sdJwtCandidate },
-      evidence: { typ, ...truncated }
-    };
-  }
-  const signature = getHeader(request, "signature");
-  const signatureInput = getHeader(request, "signature-input");
-  if (signature && signatureInput) {
-    const signatureAgent = getHeader(request, "signature-agent");
-    const registryHint = getHeader(request, "x-agent-registry");
-    const lowerInput = signatureInput.toLowerCase();
-    const protocol = signatureAgent ? "rfc9421-web-bot-auth" : registryHint?.toLowerCase().includes("visa") || lowerInput.includes("visa") ? "rfc9421-tap" : registryHint?.toLowerCase().includes("mastercard") || lowerInput.includes("mastercard") ? "rfc9421-agent-pay" : "rfc9421";
-    return {
-      protocol,
-      artifacts: {
-        rfc9421: { headers, method, url, ...body.text && { body: body.text } }
-      },
-      evidence: {
-        ...signatureAgent && { signatureAgent },
-        ...registryHint && { registryHint },
-        keyid: signatureInput.match(/keyid="([^"]+)"/)?.[1],
-        ...truncated
-      }
-    };
-  }
-  const acpTimestamp = getHeader(request, "timestamp");
-  if (signature && !signatureInput && (acpTimestamp || getHeader(request, "idempotency-key"))) {
-    return {
-      protocol: "acp",
-      artifacts: {
-        acpRequest: {
-          method,
-          url,
-          headers,
-          ...body.text && { rawBody: body.text },
-          ...jsonBody && { body: jsonBody }
-        }
-      },
-      evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
-    };
-  }
-  if (/\/checkout[-_]sessions(\/|$)/.test(request.uri)) {
-    return {
-      protocol: "ucp",
-      artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
-      evidence: { path: request.uri, ...truncated }
-    };
-  }
-  if (jsonBody) {
-    const intent = jsonBody.intent_mandate ?? jsonBody.intentMandate;
-    const cart = jsonBody.cart_mandate ?? jsonBody.cartMandate;
-    const payment = jsonBody.payment_mandate ?? jsonBody.paymentMandate;
-    if (typeof intent === "string" || typeof cart === "string" || typeof payment === "string") {
-      return {
-        protocol: "ap2",
-        artifacts: {
-          ap2Mandates: {
-            ...typeof intent === "string" && { intent },
-            ...typeof cart === "string" && { cart },
-            ...typeof payment === "string" && { payment }
-          }
-        },
-        evidence: {
-          mandatesPresent: [
-            typeof intent === "string" && "intent",
-            typeof cart === "string" && "cart",
-            typeof payment === "string" && "payment"
-          ].filter(Boolean),
-          ...truncated
-        }
-      };
-    }
-  }
-  if (authHeader && /^Payment\s+/i.test(authHeader)) {
-    return {
-      protocol: "mpp",
-      artifacts: {
-        mppRequest: {
-          method,
-          url,
-          headers,
-          ...body.text && { rawBody: body.text },
-          ...jsonBody && { body: jsonBody }
-        }
-      },
-      evidence: truncated
-    };
-  }
-  if (getHeader(request, "x-payment")) {
-    return {
-      protocol: "x402",
-      artifacts: {
-        x402Request: { method, url, headers, ...jsonBody && { body: jsonBody } }
-      },
-      evidence: truncated
-    };
-  }
-  return void 0;
-}
-
-// src/classify.ts
-var STATIC_EXTENSIONS = /\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|pdf|txt|xml)$/i;
-var BOT_UA_PATTERN = /curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i;
-var BROWSER_UA_PATTERN = /mozilla\/\d/i;
-function resolvePolicy(config, path) {
-  if (STATIC_EXTENSIONS.test(path)) {
-    return { mode: config.mode, depth: config.depth, skip: true };
-  }
-  const rule = matchEdgePathRule(config.pathRules, path);
-  if (!rule) return { mode: config.mode, depth: config.depth, skip: false };
-  return {
-    mode: rule.mode ?? config.mode,
-    depth: rule.depth ?? config.depth,
-    skip: rule.skip === true
-  };
-}
-function classify(request, host, depth) {
-  const userAgent = getHeader(request, "user-agent") ?? "";
-  const flat = flattenHeaders(request.headers);
-  const credentials = extractCredentials(flat, {});
-  if (credentials.astraId || credentials.apiKey || credentials.jwt) {
-    return { tier: "verified", protocol: "x-astra" };
-  }
-  const { apiKeyFormat, platformHeaders } = sanitizeHeaders2(flat);
-  const detectionInput = { userAgent, apiKeyFormat, platformHeaders };
-  if (depth !== "classify") {
-    const commerce = detectCommerce(request, host, decodeBody(request));
-    if (commerce) {
-      return {
-        tier: "identified",
-        protocol: commerce.protocol,
-        artifacts: commerce.artifacts,
-        evidence: commerce.evidence,
-        fingerprint: detectPlatformFingerprint(detectionInput)
-      };
-    }
-  }
-  const fingerprint = detectPlatformFingerprint(detectionInput);
-  if (fingerprint) {
-    return { tier: "identified", protocol: "platform-ua", fingerprint };
-  }
-  if (!userAgent || BOT_UA_PATTERN.test(userAgent) || !BROWSER_UA_PATTERN.test(userAgent)) {
-    return { tier: "anonymous-bot", evidence: { userAgent: userAgent || "(none)" } };
-  }
-  if (!getHeader(request, "sec-fetch-mode") && !getHeader(request, "accept-language")) {
-    return { tier: "anonymous-bot", evidence: { userAgent, spoofedBrowser: true } };
-  }
-  return { tier: "human" };
-}
-
-// src/pipeline.ts
-import { verify, extractCredentials as extractCredentials2 } from "@astrasyncai/verification-gateway/verify";
-import { resolveHttpPdlss } from "@astrasyncai/verification-gateway/http-pdlss";
-
-// src/events.ts
-import { reportUnregisteredAttempt } from "@astrasyncai/verification-gateway/verify";
-async function withBudget(promise, ms) {
-  let timer;
-  try {
-    return await Promise.race([
-      promise,
-      new Promise((resolve) => {
-        timer = setTimeout(() => resolve(void 0), ms);
-      })
-    ]);
-  } catch {
-    return void 0;
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-async function emitBeacon(options, request, classification, budgetMs) {
-  const clientIp = getHeader(request, "cloudfront-viewer-address")?.split(":")[0];
-  await withBudget(
-    reportUnregisteredAttempt(
-      { apiBaseUrl: options.apiBaseUrl, counterpartyId: options.counterpartyId },
-      {
-        counterpartyUrl: options.counterpartyUrl,
-        counterpartyType: "website",
-        sourceIp: clientIp,
-        userAgent: getHeader(request, "user-agent"),
-        requestPath: request.uri,
-        requestMethod: request.method,
-        // 3.9.0 evidence fields (backend persists them into eventData).
-        protocol: classification.protocol,
-        evidence: classification.evidence,
-        // Workstream D — full sanitised header + connection capture for the
-        // unregistered caller (fire-and-forget, so free).
-        observedMetadata: buildObservedMetadata(request)
-      }
-    ),
-    budgetMs
-  );
-}
-function sampled(rate, random = Math.random) {
-  if (rate <= 0) return false;
-  if (rate >= 1) return true;
-  return random() < rate;
-}
-
-// src/pipeline.ts
-function baseOutcome(classification) {
-  return {
-    tier: classification.tier,
-    decision: "allow",
-    reasons: [],
-    protocol: classification.protocol
-  };
-}
-function buildVerificationRequest(options, request, classification, includeArtifacts) {
-  const headers = flattenHeaders(request.headers);
-  const clientIp = getHeader(request, "cloudfront-viewer-address")?.split(":")[0];
-  const pdlss = resolveHttpPdlss({
-    method: request.method,
-    astraPurpose: getHeader(request, "x-astra-purpose"),
-    astraAction: getHeader(request, "x-astra-action")
-  });
-  const attemptId = getHeader(request, "x-astra-attempt-id");
-  return {
-    ...attemptId && /^att_[0-9a-f]{32}$/.test(attemptId) && { attemptId },
-    credentials: extractCredentials2(headers, {}),
-    purpose: pdlss.purpose,
-    action: pdlss.action,
-    resource: request.uri,
-    createSession: true,
-    counterpartyType: "website",
-    counterpartyUrl: options.counterpartyUrl,
-    callerMetadata: {
-      sourceIp: clientIp,
-      userAgent: getHeader(request, "user-agent"),
-      referer: getHeader(request, "referer"),
-      host: getHeader(request, "host"),
-      // Workstream D — the full sanitised header + connection capture. The
-      // backend stores it fire-and-forget (zero decision latency) and uses the
-      // key-format / platform headers for attribution.
-      observedMetadata: buildObservedMetadata(request)
-    },
-    ...includeArtifacts && classification.artifacts && { commerceArtifacts: classification.artifacts }
-  };
-}
-function outcomeFromVerifyResult(classification, result) {
-  const outcome = baseOutcome(classification);
-  outcome.sessionId = result.sessionId;
-  outcome.correlationId = result.correlationId;
-  outcome.guidance = result.guidance;
-  if (result.misconfigured) {
-    outcome.reasons = ["verification key misconfigured \u2014 fail-open (merchant_misconfig)"];
-    outcome.misconfig = true;
-    return outcome;
-  }
-  if (result.requiresStepUp || result.stepUpApproval) {
-    outcome.decision = "manual_review";
-    outcome.reasons = ["step-up approval required"];
-    outcome.stepUp = {
-      pollUrl: result.stepUpApproval?.pollUrl,
-      expiresAt: result.stepUpApproval?.expiresAt
-    };
-    return outcome;
-  }
-  if (!result.identityVerified || !result.policyAllowed) {
-    outcome.decision = "deny";
-    outcome.reasons = result.denialReasons?.length ? result.denialReasons : [!result.identityVerified ? "identity not verified" : "denied by access policy"];
-    return outcome;
-  }
-  outcome.asat = {
-    trustScore: result.agent?.trustScore,
-    agentId: result.agent?.astraId,
-    developerId: result.developer?.astradId,
-    accessLevel: result.accessLevel
-  };
-  return outcome;
-}
-async function runTier(options, request, classification, policy, apiKey, sampling) {
-  const budgets = options.budgets ?? {};
-  const beaconMs = budgets.beaconMs ?? 300;
-  const verifyMs = policy.mode === "enforce" ? budgets.verifyEnforceMs ?? 3e3 : budgets.verifyObserveMs ?? 1500;
-  const gatewayConfig = {
-    apiBaseUrl: options.apiBaseUrl,
-    ...apiKey && { apiKey },
-    counterpartyId: options.counterpartyId,
-    // The shell handles its own error semantics; init self-probes don't
-    // belong in a per-request edge function.
-    disableInitChecks: true
-  };
-  try {
-    switch (classification.tier) {
-      case "verified": {
-        if (policy.depth === "classify") {
-          return baseOutcome(classification);
-        }
-        const result = await withBudget(
-          verify(
-            gatewayConfig,
-            buildVerificationRequest(options, request, classification, policy.depth === "authorize")
-          ),
-          verifyMs
-        );
-        if (!result) {
-          const outcome = baseOutcome(classification);
-          outcome.reasons = ["verify-access unreachable within budget \u2014 fail-open"];
-          return outcome;
-        }
-        return outcomeFromVerifyResult(classification, result);
-      }
-      case "identified": {
-        if (policy.depth === "authorize" && classification.artifacts) {
-          const result = await withBudget(
-            verify(gatewayConfig, buildVerificationRequest(options, request, classification, true)),
-            verifyMs
-          );
-          if (!result) {
-            const outcome2 = baseOutcome(classification);
-            outcome2.reasons = ["verify-access unreachable within budget \u2014 fail-open"];
-            return outcome2;
-          }
-          return outcomeFromVerifyResult(classification, result);
-        }
-        await emitBeacon(options, request, classification, beaconMs);
-        const outcome = baseOutcome(classification);
-        if (policy.mode === "enforce" && policy.depth !== "classify") {
-          outcome.decision = "deny";
-          outcome.reasons = ["agent is not registered with AstraSync"];
-        }
-        return outcome;
-      }
-      case "anonymous-bot": {
-        if (sampled(sampling.anonymousBeaconRate, options.random)) {
-          await emitBeacon(
-            options,
-            request,
-            { ...classification, protocol: classification.protocol ?? "ua-heuristic" },
-            beaconMs
-          );
-        }
-        return baseOutcome(classification);
-      }
-      default:
-        return baseOutcome(classification);
-    }
-  } catch (err) {
-    const outcome = baseOutcome(classification);
-    outcome.reasons = [
-      `edge pipeline error \u2014 fail-open: ${err instanceof Error ? err.message : String(err)}`
-    ];
-    return outcome;
-  }
-}
-
-// src/messaging.ts
-var PROTOCOL_MESSAGES = {
-  "vi-sd-jwt": "This request presented Visa Intelligent Commerce credentials, but the agent is not verified with AstraSync. Register the agent to pair your VI credentials with a verified identity and mandate.",
-  "rfc9421-agent-pay": "This request carried a Mastercard Agent Pay signature, but the agent is not verified with AstraSync. Register the agent to pair Agent Pay credentials with a verified identity and mandate.",
-  "rfc9421-tap": "This request carried a Visa TAP signature, but the agent is not verified with AstraSync. Register the agent to pair TAP credentials with a verified identity and mandate.",
-  "rfc9421-web-bot-auth": "This request carried a Web Bot Auth signature, but the agent is not verified with AstraSync. Register the agent to link your signed-agent identity to a verified principal.",
-  rfc9421: "This request carried an RFC 9421 HTTP message signature, but the agent is not verified with AstraSync. Register the agent to link the signing identity to a verified principal.",
-  acp: "This request used the Agentic Commerce Protocol, but the agent is not verified with AstraSync. Register the agent to transact on this property.",
-  ucp: "This request used a UCP checkout session, but the agent is not verified with AstraSync. Register the agent to transact on this property.",
-  ap2: "This request presented AP2 mandates, but the agent is not verified with AstraSync. Register the agent to pair your mandates with a verified identity.",
-  mpp: "This request presented MPP payment credentials, but the agent is not verified with AstraSync. Register the agent to transact on this property.",
-  x402: "This request used x402 payment headers, but the agent is not verified with AstraSync. Register the agent to transact on this property.",
-  "platform-ua": "This traffic was identified as a platform AI agent without AstraSync credentials. Register the agent to access this property with a verified identity.",
-  "x-astra": "The presented AstraSync credentials failed verification or were denied by this property\u2019s access policy."
-};
-function buildDenyBody(outcome, apiBaseUrl) {
-  const origin = apiBaseUrl.replace(/\/api\/?$/, "");
-  const protocolMessage = (outcome.protocol && PROTOCOL_MESSAGES[outcome.protocol]) ?? "This request could not be verified by AstraSync.";
-  return {
-    success: false,
-    error: {
-      // UNAUTHORIZED = identity failed (register/re-authenticate helps);
-      // INSUFFICIENT_ACCESS = identity fine, policy denied (fix the mandate).
-      code: outcome.tier === "verified" ? "INSUFFICIENT_ACCESS" : "UNAUTHORIZED",
-      message: protocolMessage,
-      ...outcome.protocol && { protocol: outcome.protocol },
-      failures: outcome.reasons,
-      ...outcome.correlationId && { correlationId: outcome.correlationId },
-      guidance: {
-        // `||` not `??`: verify() fills these with EMPTY STRINGS when the
-        // well-known cache is cold — empty means "use the fallback".
-        message: outcome.guidance?.message || "Register this agent with AstraSync to receive verifiable credentials.",
-        registrationUrl: outcome.guidance?.registrationUrl || `${origin}/register`,
-        documentationUrl: outcome.guidance?.documentationUrl || `${origin}/docs/edge-adapter`
-      }
-    }
-  };
-}
-function buildManualReviewBody(outcome) {
-  return {
-    success: false,
-    status: "manual_review",
-    message: "This action requires human approval. Poll the step-up approval endpoint and retry once approved.",
-    ...outcome.stepUp && { stepUpApproval: outcome.stepUp },
-    ...outcome.correlationId && { correlationId: outcome.correlationId }
-  };
-}
-
-// src/enforce.ts
-var ASAT_HEADERS = {
-  trustScore: "X-AstraSync-Trust-Score",
-  agentId: "X-AstraSync-Agent-Id",
-  developerId: "X-AstraSync-Developer-Id",
-  permissions: "X-AstraSync-Permissions",
-  observedDecision: "X-AstraSync-Observed-Decision"
-};
-function applyOutcome(options, request, outcome, policy) {
-  stripHeadersByPrefix(request, "x-astrasync-");
-  if (outcome.misconfig) {
-    setHeader(request, ASAT_HEADERS.observedDecision, "misconfig");
-  }
-  if (policy.mode !== "enforce") {
-    if (outcome.decision !== "allow") {
-      setHeader(request, ASAT_HEADERS.observedDecision, outcome.decision);
-    }
-    injectAsat(request, outcome);
-    return request;
-  }
-  switch (outcome.decision) {
-    case "deny":
-      return jsonResponse(403, buildDenyBody(outcome, options.apiBaseUrl));
-    case "manual_review":
-      return jsonResponse(202, buildManualReviewBody(outcome), {
-        "Retry-After": "30"
-      });
-    default:
-      injectAsat(request, outcome);
-      return request;
-  }
-}
-function injectAsat(request, outcome) {
-  if (!outcome.asat) return;
-  const { trustScore, agentId, developerId, accessLevel } = outcome.asat;
-  if (trustScore !== void 0) {
-    setHeader(request, ASAT_HEADERS.trustScore, String(trustScore));
-  }
-  if (agentId) setHeader(request, ASAT_HEADERS.agentId, agentId);
-  if (developerId) setHeader(request, ASAT_HEADERS.developerId, developerId);
-  if (accessLevel) setHeader(request, ASAT_HEADERS.permissions, accessLevel);
-}
-
 // src/handler.ts
 function createEdgeHandler(options) {
   const log = options.log ?? ((level, message, data) => {
@@ -632,27 +186,13 @@ function createEdgeHandler(options) {
       normalizeOriginHost(request);
       const apiKey = await resolveApiKey({ ...options, log });
       const config = await loadEdgeConfig(options, apiKey);
-      const policy = resolvePolicy(config, request.uri);
-      if (policy.skip) return request;
-      const host = getHeader(request, "x-forwarded-host") ?? getHeader(request, "host") ?? new URL(options.counterpartyUrl).host;
-      const classification = classify(request, host, policy.depth);
-      if (classification.tier === "human") return request;
-      const outcome = await runTier(
+      const { application } = await evaluateEdgeRequest(
         { ...options, log },
-        request,
-        classification,
-        policy,
-        apiKey,
-        config.sampling
+        toNormalizedRequest(request),
+        config,
+        apiKey
       );
-      if (outcome.decision !== "allow") {
-        log(
-          "info",
-          policy.mode === "enforce" ? `${outcome.decision.toUpperCase()}: ${request.method} ${request.uri}` : `[OBSERVE] would have been ${outcome.decision.toUpperCase()}: ${request.method} ${request.uri}`,
-          { tier: outcome.tier, protocol: outcome.protocol, reasons: outcome.reasons }
-        );
-      }
-      return applyOutcome(options, request, outcome, policy);
+      return applyCoreOutcome(request, application);
     } catch (err) {
       log("error", "edge handler error \u2014 passing request through", {
         error: err instanceof Error ? err.message : String(err)
@@ -661,6 +201,70 @@ function createEdgeHandler(options) {
     }
   };
 }
+
+// src/classify.ts
+import {
+  classify as classifyCore,
+  resolvePolicy,
+  _patterns
+} from "@astrasyncai/verification-gateway/edge-core";
+function classify(request, host, depth) {
+  return classifyCore(toNormalizedRequest(request), host, depth);
+}
+
+// src/detect.ts
+import {
+  detectCommerce as detectCommerceCore
+} from "@astrasyncai/verification-gateway/edge-core";
+function detectCommerce(request, host, body) {
+  const normalized = toNormalizedRequest(request);
+  return detectCommerceCore(
+    {
+      ...normalized,
+      bodyText: body.text,
+      bodyTruncated: body.truncated
+    },
+    host
+  );
+}
+
+// src/pipeline.ts
+import { runTier as runTierCore } from "@astrasyncai/verification-gateway/edge-core";
+async function runTier(options, request, classification, policy, apiKey, sampling) {
+  return runTierCore(
+    options,
+    toNormalizedRequest(request),
+    classification,
+    policy,
+    apiKey,
+    sampling
+  );
+}
+
+// src/enforce.ts
+import {
+  applyOutcome as resolveOutcomeApplication,
+  ASAT_HEADERS
+} from "@astrasyncai/verification-gateway/edge-core";
+function applyOutcome(options, request, outcome, policy) {
+  return applyCoreOutcome(request, resolveOutcomeApplication(options, outcome, policy));
+}
+
+// src/messaging.ts
+import {
+  buildDenyBody,
+  buildManualReviewBody
+} from "@astrasyncai/verification-gateway/edge-core";
+
+// src/events.ts
+import {
+  emitBeacon as emitBeaconCore,
+  withBudget,
+  sampled
+} from "@astrasyncai/verification-gateway/edge-core";
+async function emitBeacon(options, request, classification, budgetMs) {
+  await emitBeaconCore(options, toNormalizedRequest(request), classification, budgetMs);
+}
 export {
   ASAT_HEADERS,
   _resetConfigCaches,