@astrasyncai/verification-gateway 3.12.0 → 4.1.0

package/dist/adapters/nextjs.js

@@ -102,7 +102,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.12.0";
+var SDK_VERSION = "4.1.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -128,7 +128,7 @@ var DEFAULT_CONFIG = {
 };
 var initCheckPerformed = false;
 var deprecationWarningShown = false;
-async function performInitCheck(apiBaseUrl, debug, strictInit) {
+async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
@@ -145,6 +145,28 @@ async function performInitCheck(apiBaseUrl, debug, strictInit) {
         `[VerificationGateway] init check passed for ${apiBaseUrl} (content-type: ${contentType})`
       );
     }
+    if (apiKey) {
+      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+        headers: { Authorization: `Bearer ${apiKey}` }
+      });
+      if (selfCheck.status === 401) {
+        const body = await selfCheck.json().catch(() => ({}));
+        const message = `[VerificationGateway] the configured AstraSync API key was REJECTED at startup (${body.code ?? "api_key_invalid"}: ${body.message ?? "invalid key"}). Every inbound agent will be turned away until the key is rotated` + (body.remediation?.manageUrl ? ` at ${body.remediation.manageUrl}` : "") + `.`;
+        if (strictInit) {
+          throw new Error(`${message} (strictInit=true)`);
+        }
+        console.error(message);
+      } else if (selfCheck.ok) {
+        const body = await selfCheck.json().catch(() => ({}));
+        if (typeof body.daysToExpiry === "number" && body.daysToExpiry <= 7) {
+          console.warn(
+            `[VerificationGateway] the configured AstraSync API key expires in ${body.daysToExpiry} day(s) \u2014 rotate it at Settings \u2192 Developer Tools before integrations start failing.`
+          );
+        } else if (debug) {
+          console.log("[VerificationGateway] API key self-check passed");
+        }
+      }
+    }
   } catch (err) {
     if (strictInit) {
       throw err;
@@ -219,11 +241,54 @@ function cacheResult(request, result, configuredTtl, counterpartyId) {
     expiresAt: Date.now() + ttlSeconds * 1e3
   });
 }
+function extractCredentials(headers, query) {
+  const credentials = {};
+  const ASTRA_ID_PATTERN = /^ASTRAE?-[A-Za-z0-9_-]{1,64}$/;
+  const astraIdHeader = headers["x-astra-id"] || headers["X-Astra-Id"] || headers["X-ASTRA-ID"] || headers["x-astra-agentid"] || headers["X-Astra-AgentId"] || headers["x-astra-agent-id"] || headers["X-Astra-Agent-Id"] || headers["X-ASTRA-AGENT-ID"];
+  if (astraIdHeader) {
+    const raw = Array.isArray(astraIdHeader) ? astraIdHeader[0] : typeof astraIdHeader === "string" ? astraIdHeader : void 0;
+    if (typeof raw === "string" && ASTRA_ID_PATTERN.test(raw)) {
+      credentials.astraId = raw;
+    }
+  }
+  const apiKeyHeader = headers["x-api-key"] || headers["X-Api-Key"] || headers["X-API-KEY"];
+  if (apiKeyHeader) {
+    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;
+  }
+  const authHeader = headers["authorization"] || headers["Authorization"];
+  if (authHeader) {
+    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+    if (typeof authValue === "string") {
+      credentials.authorizationHeader = authValue;
+      if (authValue.startsWith("Bearer ")) {
+        credentials.jwt = authValue.slice(7);
+      }
+    }
+  }
+  if (query) {
+    if (query.astraId && !credentials.astraId) {
+      credentials.astraId = query.astraId;
+    }
+    if (query.apiKey && !credentials.apiKey) {
+      credentials.apiKey = query.apiKey;
+    }
+  }
+  return credentials;
+}
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
+  const isMisconfig = source === "merchant_misconfig";
   const urls = options.urls;
-  const guidance = isApiError ? {
+  const guidance = isMisconfig ? {
+    message: "This site's AstraSync integration is misconfigured (its API key was revoked, expired, or rotated). Your identity and the AstraSync platform are fine \u2014 contact the site operator. Retrying will not help.",
+    registrationUrl: urls?.registrationUrl ?? "",
+    documentationUrl: options.remediation?.docsUrl ?? urls?.documentationUrl ?? "",
+    steps: [
+      "Report the failure to the site operator \u2014 their AstraSync API key needs rotating",
+      "Do not retry: the failure is deterministic until the operator updates their key"
+    ]
+  } : isApiError ? {
     message: "Verification is temporarily unavailable. Retry with exponential backoff; if the issue persists, contact support with the correlationId.",
     registrationUrl: urls?.registrationUrl ?? "",
     documentationUrl: urls?.documentationUrl ?? "",
@@ -261,13 +326,22 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // partners (and their custom onDenied handlers) can branch on
     // dimension. Without this, the synthesised stub was indistinguishable
     // from a real policy deny.
-    failures: isApiError ? [
+    failures: isMisconfig ? [
+      {
+        dimension: "verify_access.merchant_misconfigured",
+        message: reason ?? "The integration API key was rejected by AstraSync",
+        guidance: guidance.message
+      }
+    ] : isApiError ? [
       {
         dimension: "verify_access.api_error",
         message: reason ?? "Verification temporarily unavailable",
         guidance: guidance.message
       }
     ] : void 0,
+    // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
+    // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
+    ...isMisconfig && { misconfigured: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -322,7 +396,8 @@ async function callVerifyAccessAPI(config, request) {
     const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
-      body: JSON.stringify(body)
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(config.verifyTimeoutMs ?? 1e4)
     });
     const data = await response.json();
     if (response.status === 410) {
@@ -346,6 +421,17 @@ async function callVerifyAccessAPI(config, request) {
       };
     }
     if (!response.ok) {
+      if (response.status === 401) {
+        return {
+          success: false,
+          error: data.message || data.error || "Integration API key rejected",
+          misconfig: true,
+          misconfigCode: typeof data?.code === "string" ? data.code : void 0,
+          remediation: data?.remediation && typeof data.remediation === "object" ? data.remediation : void 0,
+          correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
+          attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
+        };
+      }
       return {
         success: false,
         error: data.message || data.error || `API returned ${response.status}`,
@@ -367,9 +453,19 @@ async function verify(config, request, options) {
   const urls = mergedConfig.apiBaseUrl ? getCachedWellKnownUrls(mergedConfig.apiBaseUrl) : void 0;
   if (!initCheckPerformed && !mergedConfig.disableInitChecks && mergedConfig.apiBaseUrl) {
     if (mergedConfig.strictInit) {
-      await performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug, true);
+      await performInitCheck(
+        mergedConfig.apiBaseUrl,
+        mergedConfig.debug,
+        true,
+        mergedConfig.apiKey
+      );
     } else {
-      void performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug, false);
+      void performInitCheck(
+        mergedConfig.apiBaseUrl,
+        mergedConfig.debug,
+        false,
+        mergedConfig.apiKey
+      );
     }
   }
   if (!deprecationWarningShown && (config.minTrustScore !== void 0 || config.minTrustScoreForFull !== void 0)) {
@@ -408,9 +504,10 @@ async function verify(config, request, options) {
   const serverDenialReasons = Array.isArray(rawServerDenialReasons) && rawServerDenialReasons.length > 0 ? rawServerDenialReasons : void 0;
   if (!apiResponse.success) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
-      source: "api_error",
+      source: apiResponse.misconfig ? "merchant_misconfig" : "api_error",
       correlationId: apiResponse.correlationId,
       attemptId: apiResponse.attemptId,
+      remediation: apiResponse.remediation,
       urls
     });
   }
@@ -552,6 +649,21 @@ async function fetchRoutes(config, counterpartyId) {
     return null;
   }
 }
+async function reportUnregisteredAttempt(config, data) {
+  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
+  const { counterpartyUrl, ...rest } = data;
+  const body = {
+    ...rest,
+    ...counterpartyUrl && { counterpartyUrl },
+    ...config.counterpartyId && { counterpartyId: config.counterpartyId }
+  };
+  await fetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  }).catch(() => {
+  });
+}
 async function reportCounterpartyPreCheckFailure(config, data) {
   const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
   await fetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {
@@ -657,6 +769,7 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
 }
 
 // src/metadata-capture.ts
+var CAPTURE_SCHEMA_VERSION = 1;
 var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
   "cookie",
   "set-cookie",
@@ -793,6 +906,359 @@ function sanitizeHeaders(raw) {
   if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
   return result;
 }
+var CONNECTION_HEADER_SOURCES = [
+  ["ip", ["cf-connecting-ip", "fastly-client-ip", "true-client-ip", "x-real-ip"]],
+  [
+    "country",
+    ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
+  ],
+  ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
+  ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
+  ["asn", ["cloudfront-viewer-asn"]],
+  ["tlsVersion", ["cloudfront-viewer-tls"]],
+  ["httpVersion", ["cloudfront-viewer-http-version"]],
+  // TLS fingerprints can only be computed where TLS terminates. When a CDN
+  // terminates TLS in front of the merchant, its fingerprint headers ARE the
+  // connection-layer truth — normalising them here is the permanent design.
+  ["tlsFingerprint", ["cf-ja3-hash"]],
+  ["ja4", ["cf-ja4"]]
+];
+function deriveConnectionFromHeaders(headers) {
+  if (!headers) return void 0;
+  const lower = {};
+  for (const name of Object.keys(headers)) {
+    const value = headers[name];
+    if (typeof value === "string" && value.length > 0) lower[name.toLowerCase()] = value;
+  }
+  const connection = {};
+  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {
+    for (const source of sources) {
+      const value = lower[source]?.trim();
+      if (value) {
+        connection[key] = value;
+        break;
+      }
+    }
+  }
+  if (!connection.ip) {
+    const xff = lower["x-forwarded-for"];
+    const client = xff?.split(",")[0]?.trim();
+    if (client) connection.ip = client;
+  }
+  return Object.keys(connection).length > 0 ? connection : void 0;
+}
+function buildSdkObservedMetadata(rawHeaders) {
+  const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);
+  const flat = {};
+  if (rawHeaders) {
+    for (const name of Object.keys(rawHeaders)) {
+      const value = rawHeaders[name];
+      if (value === void 0) continue;
+      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
+    }
+  }
+  const connection = deriveConnectionFromHeaders(flat);
+  return {
+    headers,
+    ...apiKeyFormat && { apiKeyFormat },
+    ...platformHeaders && { platformHeaders },
+    ...connection && { connection },
+    schemaVersion: CAPTURE_SCHEMA_VERSION
+  };
+}
+
+// src/edge-config.ts
+var DEFAULT_EDGE_CONFIG = Object.freeze({
+  version: 1,
+  mode: "observe",
+  depth: "classify",
+  pathRules: [],
+  sampling: Object.freeze({ anonymousBeaconRate: 0.1 }),
+  failurePosture: "open"
+});
+var EDGE_MODES = ["observe", "enforce"];
+var EDGE_DEPTHS = ["classify", "authenticate", "authorize"];
+function isEdgeConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (v.version !== 1) return false;
+  if (!EDGE_MODES.includes(v.mode)) return false;
+  if (!EDGE_DEPTHS.includes(v.depth)) return false;
+  if (!Array.isArray(v.pathRules)) return false;
+  for (const rule of v.pathRules) {
+    if (typeof rule !== "object" || rule === null) return false;
+    const r = rule;
+    if (typeof r.pattern !== "string" || r.pattern.length === 0) return false;
+    if (r.mode !== void 0 && !EDGE_MODES.includes(r.mode)) return false;
+    if (r.depth !== void 0 && !EDGE_DEPTHS.includes(r.depth)) return false;
+  }
+  const sampling = v.sampling;
+  if (typeof sampling !== "object" || sampling === null || typeof sampling.anonymousBeaconRate !== "number" || sampling.anonymousBeaconRate < 0 || sampling.anonymousBeaconRate > 1) {
+    return false;
+  }
+  return v.failurePosture === "open";
+}
+async function fetchEdgeConfig(config, counterpartyId, opts) {
+  if (!counterpartyId) return null;
+  const headers = { Accept: "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  if (opts?.etag) headers["If-None-Match"] = opts.etag;
+  try {
+    const response = await fetch(
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/edge-config`,
+      { method: "GET", headers, signal: AbortSignal.timeout(opts?.timeoutMs ?? 5e3) }
+    );
+    if (response.status === 304) return { notModified: true };
+    if (!response.ok) return null;
+    const body = await response.json();
+    const edgeConfig = body.data?.edgeConfig;
+    if (!isEdgeConfig(edgeConfig)) return null;
+    return { edgeConfig, etag: response.headers.get("etag") ?? void 0 };
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_TTL_MS = 60 * 1e3;
+var DEFAULT_MAX_STALE_MS = 24 * 60 * 60 * 1e3;
+var cache2 = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+function cacheKey(apiBaseUrl, counterpartyId) {
+  return `${apiBaseUrl}|${counterpartyId}`;
+}
+function degradeToObserve(config) {
+  if (config.mode !== "enforce" && !config.pathRules.some((r) => r.mode === "enforce")) {
+    return config;
+  }
+  return {
+    ...config,
+    mode: "observe",
+    pathRules: config.pathRules.map((r) => r.mode === "enforce" ? { ...r, mode: "observe" } : r)
+  };
+}
+async function revalidate(config, counterpartyId) {
+  const key = cacheKey(config.apiBaseUrl, counterpartyId);
+  const existing = inflight.get(key);
+  if (existing) return existing;
+  const promise = fetchEdgeConfig(config, counterpartyId, { etag: cache2.get(key)?.etag }).then((result) => {
+    if (result === null) return;
+    const now = Date.now();
+    if ("notModified" in result) {
+      const entry = cache2.get(key);
+      if (entry) entry.lastSuccessAt = now;
+      return;
+    }
+    cache2.set(key, { config: result.edgeConfig, etag: result.etag, lastSuccessAt: now });
+  }).finally(() => {
+    inflight.delete(key);
+  });
+  inflight.set(key, promise);
+  return promise;
+}
+async function getEdgeConfig(config, counterpartyId, opts) {
+  const ttlMs = opts?.ttlMs ?? DEFAULT_TTL_MS;
+  const maxStaleMs = opts?.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
+  const key = cacheKey(config.apiBaseUrl, counterpartyId);
+  const entry = cache2.get(key);
+  if (entry) {
+    const age = Date.now() - entry.lastSuccessAt;
+    if (age > ttlMs) {
+      revalidate(config, counterpartyId).catch(() => {
+      });
+    }
+    return age > maxStaleMs ? degradeToObserve(entry.config) : entry.config;
+  }
+  await revalidate(config, counterpartyId).catch(() => {
+  });
+  return cache2.get(key)?.config ?? DEFAULT_EDGE_CONFIG;
+}
+
+// src/platform-signatures.ts
+var PLATFORM_AGENT_SIGNATURES = [
+  {
+    vendor: "claude",
+    displayName: "Anthropic Claude",
+    uaPatterns: [/claude/i, /anthropic/i],
+    agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i],
+    apiKeyFormatPatterns: [/^sk-ant/i],
+    headerPatterns: [/^anthropic-version/i, /^anthropic-beta/i, /^x-anthropic-/i]
+  },
+  {
+    vendor: "chatgpt",
+    displayName: "OpenAI ChatGPT",
+    uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i],
+    agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i],
+    apiKeyFormatPatterns: [/^sk-proj/i, /^sk-svcacct/i],
+    headerPatterns: [/^openai-organization/i, /^openai-project/i, /^openai-version/i]
+  },
+  {
+    vendor: "gemini",
+    displayName: "Google Gemini",
+    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
+    apiKeyFormatPatterns: [/^aiza/i],
+    headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
+  },
+  {
+    vendor: "cursor",
+    displayName: "Cursor",
+    uaPatterns: [/cursor/i],
+    agentCardPatterns: [/cursor\.sh/i, /cursor\.com/i]
+  },
+  {
+    vendor: "goose",
+    displayName: "Block Goose",
+    uaPatterns: [/goose/i, /block-goose/i],
+    agentCardPatterns: [/block\.xyz\/goose/i, /goose\.tools/i]
+  },
+  {
+    vendor: "perplexity",
+    displayName: "Perplexity",
+    uaPatterns: [/perplexity/i],
+    agentCardPatterns: [/perplexity\.ai/i],
+    apiKeyFormatPatterns: [/^pplx-/i]
+  }
+];
+function matchPlatformSignature(signatures, input) {
+  const ua = input.userAgent ?? "";
+  const cardUrl = input.agentCardUrl ?? "";
+  const apiKeyFormat = input.apiKeyFormat ?? "";
+  const headerLines = [];
+  if (input.platformHeaders) {
+    for (const [name, value] of Object.entries(input.platformHeaders)) {
+      headerLines.push(name, `${name}: ${value}`);
+    }
+  }
+  for (const sig of signatures) {
+    const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));
+    const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));
+    const keyMatch = apiKeyFormat.length > 0 && sig.apiKeyFormatPatterns?.some((p) => p.test(apiKeyFormat));
+    const headerMatch = headerLines.length > 0 && sig.headerPatterns?.some((p) => headerLines.some((line) => p.test(line)));
+    if (uaMatch || cardMatch || keyMatch || headerMatch) {
+      const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
+      const cardHost = (() => {
+        try {
+          return cardUrl ? new URL(cardUrl).host : "";
+        } catch {
+          return "";
+        }
+      })();
+      const keyBasis = uaBase || cardHost || apiKeyFormat || "unknown";
+      return {
+        vendor: sig.vendor,
+        fingerprintKey: `${sig.vendor}:${keyBasis}`,
+        displayName: sig.displayName
+      };
+    }
+  }
+  return void 0;
+}
+function detectPlatformFingerprint(input) {
+  return matchPlatformSignature(PLATFORM_AGENT_SIGNATURES, input);
+}
+
+// src/edge-core/classify.ts
+var STATIC_EXTENSIONS = /\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|pdf|txt|xml)$/i;
+var BOT_UA_PATTERN = /curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i;
+var BROWSER_UA_PATTERN = /mozilla\/\d/i;
+var _patterns = { STATIC_EXTENSIONS, BOT_UA_PATTERN, BROWSER_UA_PATTERN };
+
+// src/edge-core/events.ts
+function sampled(rate, random = Math.random) {
+  if (rate <= 0) return false;
+  if (rate >= 1) return true;
+  return random() < rate;
+}
+
+// src/adapters/anonymous-beacon.ts
+function readHeader(raw, name) {
+  const value = raw[name];
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[0];
+  return void 0;
+}
+function classifyPassThroughTraffic(path, rawHeaders) {
+  if (_patterns.STATIC_EXTENSIONS.test(path)) return { kind: "never" };
+  const credentials = extractCredentials(rawHeaders, {});
+  if (credentials.astraId || credentials.apiKey || credentials.jwt) {
+    return { kind: "never" };
+  }
+  const userAgent = readHeader(rawHeaders, "user-agent") ?? "";
+  const { apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);
+  const fingerprint = detectPlatformFingerprint({ userAgent, apiKeyFormat, platformHeaders });
+  if (fingerprint) {
+    return {
+      kind: "platform",
+      protocol: "platform-ua",
+      evidence: { vendor: fingerprint.vendor, userAgent: userAgent || "(none)" }
+    };
+  }
+  if (!userAgent || _patterns.BOT_UA_PATTERN.test(userAgent) || !_patterns.BROWSER_UA_PATTERN.test(userAgent)) {
+    return {
+      kind: "anonymous-bot",
+      protocol: "ua-heuristic",
+      evidence: { userAgent: userAgent || "(none)" }
+    };
+  }
+  if (!readHeader(rawHeaders, "sec-fetch-mode") && !readHeader(rawHeaders, "accept-language")) {
+    return {
+      kind: "anonymous-bot",
+      protocol: "ua-heuristic",
+      evidence: { userAgent, spoofedBrowser: true }
+    };
+  }
+  return { kind: "never" };
+}
+function createAnonymousBeacon(config, options) {
+  const counterpartyId = config.counterpartyId;
+  if (!counterpartyId) return () => {
+  };
+  const random = options?.random ?? Math.random;
+  let edgeConfig;
+  let refreshing = false;
+  const refreshConfig = () => {
+    if (refreshing) return;
+    refreshing = true;
+    getEdgeConfig(config, counterpartyId).then((cfg) => {
+      edgeConfig = cfg;
+    }).catch(() => {
+    }).finally(() => {
+      refreshing = false;
+    });
+  };
+  refreshConfig();
+  return (input) => {
+    try {
+      refreshConfig();
+      const cfg = edgeConfig;
+      if (!cfg) return;
+      const traffic = classifyPassThroughTraffic(input.requestPath, input.rawHeaders);
+      if (traffic.kind === "never") return;
+      if (traffic.kind === "anonymous-bot" && !sampled(cfg.sampling.anonymousBeaconRate, random)) {
+        return;
+      }
+      const userAgent = readHeader(input.rawHeaders, "user-agent");
+      const xff = input.rawHeaders["x-forwarded-for"];
+      const xffStr = Array.isArray(xff) ? xff.join(", ") : xff;
+      const sourceIp = input.sourceIp ?? xffStr?.split(",")[0]?.trim();
+      reportUnregisteredAttempt(config, {
+        ...input.counterpartyUrl && { counterpartyUrl: input.counterpartyUrl },
+        counterpartyType: options?.counterpartyType ?? config.counterpartyType ?? "api",
+        ...sourceIp && { sourceIp },
+        ...userAgent && { userAgent },
+        requestPath: input.requestPath,
+        requestMethod: input.requestMethod,
+        ...traffic.protocol && { protocol: traffic.protocol },
+        ...traffic.evidence && { evidence: traffic.evidence },
+        observedMetadata: buildSdkObservedMetadata(input.rawHeaders)
+      }).catch(() => {
+      });
+    } catch {
+    }
+  };
+}
 
 // src/adapters/http-pdlss.ts
 var HTTP_METHOD_ACTION_TABLE = {
@@ -956,7 +1422,7 @@ function resolveNextPdlss(request, routeConfig) {
     routeAction: routeConfig?.action
   });
 }
-function generateCommerceShieldHtml(result, options) {
+function generateInterstitialHtml(result, options) {
   const title = escapeHtml(options.commerceShield?.title || "AstraSync Agent Verification");
   const message = escapeHtml(
     options.commerceShield?.message || result.guidance?.message || "This site verifies AI agents before granting access. We noticed you're visiting without AstraSync credentials."
@@ -1112,13 +1578,31 @@ function generateCommerceShieldHtml(result, options) {
 }
 var DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
 function createMiddleware(options) {
+  if ("routes" in options) {
+    console.warn(
+      "[VerificationGateway/Next.js] `routes` is dashboard-managed since v2.9.7; this option is ignored \u2014 configure route policy in your AstraSync dashboard."
+    );
+  }
   const {
     skipPaths = [],
-    showCommerceShield = true,
+    showInterstitial,
+    showCommerceShield,
     enableRuntimeChallenge = true,
     routesRefreshMs = DEFAULT_ROUTES_REFRESH_MS,
+    anonymousBeacon = true,
     ...config
   } = options;
+  const interstitialEnabled = showInterstitial ?? showCommerceShield ?? true;
+  const emitAnonymousBeacon = anonymousBeacon ? createAnonymousBeacon(config, { counterpartyType: config.counterpartyType ?? "website" }) : void 0;
+  const beaconPassThrough = emitAnonymousBeacon ? (request, pathname) => {
+    emitAnonymousBeacon({
+      requestPath: pathname,
+      requestMethod: request.method,
+      counterpartyUrl: config.counterpartyUrl || request.nextUrl.origin,
+      sourceIp: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || void 0,
+      rawHeaders: Object.fromEntries(request.headers.entries())
+    });
+  } : void 0;
   let cachedRoutes = [];
   let lastFetchAt = 0;
   let refreshing = null;
@@ -1160,9 +1644,11 @@ function createMiddleware(options) {
     }
     const routeConfig = findRouteConfig(cachedRoutes, pathname, request.method);
     if (!routeConfig) {
+      beaconPassThrough?.(request, pathname);
       return NextResponse.next();
     }
     if (routeConfig.minAccessLevel === "none") {
+      beaconPassThrough?.(request, pathname);
       return NextResponse.next();
     }
     const credentials = extractCredentialsFromNextRequest(request);
@@ -1214,8 +1700,8 @@ function createMiddleware(options) {
           { status: 403 }
         );
       }
-      if (showCommerceShield) {
-        return new NextResponse(generateCommerceShieldHtml(preCheckResult, options), {
+      if (interstitialEnabled) {
+        return new NextResponse(generateInterstitialHtml(preCheckResult, options), {
           status: 200,
           headers: {
             "Content-Type": "text/html",
@@ -1243,17 +1729,9 @@ function createMiddleware(options) {
         host: request.headers.get("host") || void 0,
         forwardedFor,
         agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0,
-        // Workstream D — full sanitised header capture (Web Headers → plain map).
-        observedMetadata: (() => {
-          const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(
-            Object.fromEntries(request.headers.entries())
-          );
-          return {
-            headers,
-            ...apiKeyFormat && { apiKeyFormat },
-            ...platformHeaders && { platformHeaders }
-          };
-        })()
+        // Workstream D — full sanitised header capture + CDN-derived
+        // connection block (Web Headers → plain map).
+        observedMetadata: buildSdkObservedMetadata(Object.fromEntries(request.headers.entries()))
       }
     };
     let result = await verify(config, verificationRequest);
@@ -1269,6 +1747,21 @@ function createMiddleware(options) {
     const approvalRequired = result.identityVerified && result.policyAllowed && requiresHumanApproval(result);
     if (approvalRequired) annotateApprovalRequired(result);
     if (!result.identityVerified || !result.policyAllowed || approvalRequired) {
+      if (result.misconfigured && pathname.startsWith("/api/")) {
+        return NextResponse.json(
+          {
+            success: false,
+            error: {
+              code: "MERCHANT_VERIFICATION_MISCONFIGURED",
+              message: result.denialReasons?.[0] || "This site's AstraSync integration is misconfigured",
+              guidance: result.guidance,
+              failures: result.failures,
+              correlationId: result.correlationId
+            }
+          },
+          { status: 503 }
+        );
+      }
       if (pathname.startsWith("/api/")) {
         return NextResponse.json(
           {
@@ -1293,8 +1786,8 @@ function createMiddleware(options) {
           }
         );
       }
-      if (showCommerceShield) {
-        return new NextResponse(generateCommerceShieldHtml(result, options), {
+      if (interstitialEnabled) {
+        return new NextResponse(generateInterstitialHtml(result, options), {
           status: 200,
           headers: {
             "Content-Type": "text/html",