@astrasyncai/verification-gateway 3.12.0 → 4.1.0

package/dist/adapters/express.js

@@ -92,7 +92,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.12.0";
+var SDK_VERSION = "4.1.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -170,7 +170,7 @@ var DEFAULT_CONFIG = {
 };
 var initCheckPerformed = false;
 var deprecationWarningShown = false;
-async function performInitCheck(apiBaseUrl, debug, strictInit) {
+async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
   try {
     const probeUrl = `${apiBaseUrl}/agents/verify-access`;
@@ -187,6 +187,28 @@ async function performInitCheck(apiBaseUrl, debug, strictInit) {
         `[VerificationGateway] init check passed for ${apiBaseUrl} (content-type: ${contentType})`
       );
     }
+    if (apiKey) {
+      const selfCheck = await fetch(`${apiBaseUrl}/agents/verify-access/self-check`, {
+        headers: { Authorization: `Bearer ${apiKey}` }
+      });
+      if (selfCheck.status === 401) {
+        const body = await selfCheck.json().catch(() => ({}));
+        const message = `[VerificationGateway] the configured AstraSync API key was REJECTED at startup (${body.code ?? "api_key_invalid"}: ${body.message ?? "invalid key"}). Every inbound agent will be turned away until the key is rotated` + (body.remediation?.manageUrl ? ` at ${body.remediation.manageUrl}` : "") + `.`;
+        if (strictInit) {
+          throw new Error(`${message} (strictInit=true)`);
+        }
+        console.error(message);
+      } else if (selfCheck.ok) {
+        const body = await selfCheck.json().catch(() => ({}));
+        if (typeof body.daysToExpiry === "number" && body.daysToExpiry <= 7) {
+          console.warn(
+            `[VerificationGateway] the configured AstraSync API key expires in ${body.daysToExpiry} day(s) \u2014 rotate it at Settings \u2192 Developer Tools before integrations start failing.`
+          );
+        } else if (debug) {
+          console.log("[VerificationGateway] API key self-check passed");
+        }
+      }
+    }
   } catch (err) {
     if (strictInit) {
       throw err;
@@ -298,8 +320,17 @@ function extractCredentials(headers, query) {
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
+  const isMisconfig = source === "merchant_misconfig";
   const urls = options.urls;
-  const guidance = isApiError ? {
+  const guidance = isMisconfig ? {
+    message: "This site's AstraSync integration is misconfigured (its API key was revoked, expired, or rotated). Your identity and the AstraSync platform are fine \u2014 contact the site operator. Retrying will not help.",
+    registrationUrl: urls?.registrationUrl ?? "",
+    documentationUrl: options.remediation?.docsUrl ?? urls?.documentationUrl ?? "",
+    steps: [
+      "Report the failure to the site operator \u2014 their AstraSync API key needs rotating",
+      "Do not retry: the failure is deterministic until the operator updates their key"
+    ]
+  } : isApiError ? {
     message: "Verification is temporarily unavailable. Retry with exponential backoff; if the issue persists, contact support with the correlationId.",
     registrationUrl: urls?.registrationUrl ?? "",
     documentationUrl: urls?.documentationUrl ?? "",
@@ -337,13 +368,22 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // partners (and their custom onDenied handlers) can branch on
     // dimension. Without this, the synthesised stub was indistinguishable
     // from a real policy deny.
-    failures: isApiError ? [
+    failures: isMisconfig ? [
+      {
+        dimension: "verify_access.merchant_misconfigured",
+        message: reason ?? "The integration API key was rejected by AstraSync",
+        guidance: guidance.message
+      }
+    ] : isApiError ? [
       {
         dimension: "verify_access.api_error",
         message: reason ?? "Verification temporarily unavailable",
         guidance: guidance.message
       }
     ] : void 0,
+    // 4.0.0: typed marker so adapters render the misconfig envelope (503 +
+    // MERCHANT_VERIFICATION_MISCONFIGURED) without string-matching.
+    ...isMisconfig && { misconfigured: true },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
@@ -398,7 +438,8 @@ async function callVerifyAccessAPI(config, request) {
     const response = await fetch(`${config.apiBaseUrl}/agents/verify-access`, {
       method: "POST",
       headers,
-      body: JSON.stringify(body)
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(config.verifyTimeoutMs ?? 1e4)
     });
     const data = await response.json();
     if (response.status === 410) {
@@ -422,6 +463,17 @@ async function callVerifyAccessAPI(config, request) {
       };
     }
     if (!response.ok) {
+      if (response.status === 401) {
+        return {
+          success: false,
+          error: data.message || data.error || "Integration API key rejected",
+          misconfig: true,
+          misconfigCode: typeof data?.code === "string" ? data.code : void 0,
+          remediation: data?.remediation && typeof data.remediation === "object" ? data.remediation : void 0,
+          correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
+          attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
+        };
+      }
       return {
         success: false,
         error: data.message || data.error || `API returned ${response.status}`,
@@ -443,9 +495,19 @@ async function verify(config, request, options) {
   const urls = mergedConfig.apiBaseUrl ? getCachedWellKnownUrls(mergedConfig.apiBaseUrl) : void 0;
   if (!initCheckPerformed && !mergedConfig.disableInitChecks && mergedConfig.apiBaseUrl) {
     if (mergedConfig.strictInit) {
-      await performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug, true);
+      await performInitCheck(
+        mergedConfig.apiBaseUrl,
+        mergedConfig.debug,
+        true,
+        mergedConfig.apiKey
+      );
     } else {
-      void performInitCheck(mergedConfig.apiBaseUrl, mergedConfig.debug, false);
+      void performInitCheck(
+        mergedConfig.apiBaseUrl,
+        mergedConfig.debug,
+        false,
+        mergedConfig.apiKey
+      );
     }
   }
   if (!deprecationWarningShown && (config.minTrustScore !== void 0 || config.minTrustScoreForFull !== void 0)) {
@@ -484,9 +546,10 @@ async function verify(config, request, options) {
   const serverDenialReasons = Array.isArray(rawServerDenialReasons) && rawServerDenialReasons.length > 0 ? rawServerDenialReasons : void 0;
   if (!apiResponse.success) {
     return createGuidanceResponse(mergedConfig, apiResponse.error, {
-      source: "api_error",
+      source: apiResponse.misconfig ? "merchant_misconfig" : "api_error",
       correlationId: apiResponse.correlationId,
       attemptId: apiResponse.attemptId,
+      remediation: apiResponse.remediation,
       urls
     });
   }
@@ -641,6 +704,21 @@ async function fetchRoutes(config, counterpartyId) {
     return null;
   }
 }
+async function reportUnregisteredAttempt(config, data) {
+  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
+  const { counterpartyUrl, ...rest } = data;
+  const body = {
+    ...rest,
+    ...counterpartyUrl && { counterpartyUrl },
+    ...config.counterpartyId && { counterpartyId: config.counterpartyId }
+  };
+  await fetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  }).catch(() => {
+  });
+}
 async function reportCounterpartyPreCheckFailure(config, data) {
   const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
   await fetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {
@@ -838,6 +916,7 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
 }
 
 // src/metadata-capture.ts
+var CAPTURE_SCHEMA_VERSION = 1;
 var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
   "cookie",
   "set-cookie",
@@ -974,6 +1053,359 @@ function sanitizeHeaders(raw) {
   if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
   return result;
 }
+var CONNECTION_HEADER_SOURCES = [
+  ["ip", ["cf-connecting-ip", "fastly-client-ip", "true-client-ip", "x-real-ip"]],
+  [
+    "country",
+    ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
+  ],
+  ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
+  ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
+  ["asn", ["cloudfront-viewer-asn"]],
+  ["tlsVersion", ["cloudfront-viewer-tls"]],
+  ["httpVersion", ["cloudfront-viewer-http-version"]],
+  // TLS fingerprints can only be computed where TLS terminates. When a CDN
+  // terminates TLS in front of the merchant, its fingerprint headers ARE the
+  // connection-layer truth — normalising them here is the permanent design.
+  ["tlsFingerprint", ["cf-ja3-hash"]],
+  ["ja4", ["cf-ja4"]]
+];
+function deriveConnectionFromHeaders(headers) {
+  if (!headers) return void 0;
+  const lower = {};
+  for (const name of Object.keys(headers)) {
+    const value = headers[name];
+    if (typeof value === "string" && value.length > 0) lower[name.toLowerCase()] = value;
+  }
+  const connection = {};
+  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {
+    for (const source of sources) {
+      const value = lower[source]?.trim();
+      if (value) {
+        connection[key] = value;
+        break;
+      }
+    }
+  }
+  if (!connection.ip) {
+    const xff = lower["x-forwarded-for"];
+    const client = xff?.split(",")[0]?.trim();
+    if (client) connection.ip = client;
+  }
+  return Object.keys(connection).length > 0 ? connection : void 0;
+}
+function buildSdkObservedMetadata(rawHeaders) {
+  const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);
+  const flat = {};
+  if (rawHeaders) {
+    for (const name of Object.keys(rawHeaders)) {
+      const value = rawHeaders[name];
+      if (value === void 0) continue;
+      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
+    }
+  }
+  const connection = deriveConnectionFromHeaders(flat);
+  return {
+    headers,
+    ...apiKeyFormat && { apiKeyFormat },
+    ...platformHeaders && { platformHeaders },
+    ...connection && { connection },
+    schemaVersion: CAPTURE_SCHEMA_VERSION
+  };
+}
+
+// src/edge-config.ts
+var DEFAULT_EDGE_CONFIG = Object.freeze({
+  version: 1,
+  mode: "observe",
+  depth: "classify",
+  pathRules: [],
+  sampling: Object.freeze({ anonymousBeaconRate: 0.1 }),
+  failurePosture: "open"
+});
+var EDGE_MODES = ["observe", "enforce"];
+var EDGE_DEPTHS = ["classify", "authenticate", "authorize"];
+function isEdgeConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (v.version !== 1) return false;
+  if (!EDGE_MODES.includes(v.mode)) return false;
+  if (!EDGE_DEPTHS.includes(v.depth)) return false;
+  if (!Array.isArray(v.pathRules)) return false;
+  for (const rule of v.pathRules) {
+    if (typeof rule !== "object" || rule === null) return false;
+    const r = rule;
+    if (typeof r.pattern !== "string" || r.pattern.length === 0) return false;
+    if (r.mode !== void 0 && !EDGE_MODES.includes(r.mode)) return false;
+    if (r.depth !== void 0 && !EDGE_DEPTHS.includes(r.depth)) return false;
+  }
+  const sampling = v.sampling;
+  if (typeof sampling !== "object" || sampling === null || typeof sampling.anonymousBeaconRate !== "number" || sampling.anonymousBeaconRate < 0 || sampling.anonymousBeaconRate > 1) {
+    return false;
+  }
+  return v.failurePosture === "open";
+}
+async function fetchEdgeConfig(config, counterpartyId, opts) {
+  if (!counterpartyId) return null;
+  const headers = { Accept: "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  if (opts?.etag) headers["If-None-Match"] = opts.etag;
+  try {
+    const response = await fetch(
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/edge-config`,
+      { method: "GET", headers, signal: AbortSignal.timeout(opts?.timeoutMs ?? 5e3) }
+    );
+    if (response.status === 304) return { notModified: true };
+    if (!response.ok) return null;
+    const body = await response.json();
+    const edgeConfig = body.data?.edgeConfig;
+    if (!isEdgeConfig(edgeConfig)) return null;
+    return { edgeConfig, etag: response.headers.get("etag") ?? void 0 };
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_TTL_MS = 60 * 1e3;
+var DEFAULT_MAX_STALE_MS = 24 * 60 * 60 * 1e3;
+var cache2 = /* @__PURE__ */ new Map();
+var inflight2 = /* @__PURE__ */ new Map();
+function cacheKey(apiBaseUrl, counterpartyId) {
+  return `${apiBaseUrl}|${counterpartyId}`;
+}
+function degradeToObserve(config) {
+  if (config.mode !== "enforce" && !config.pathRules.some((r) => r.mode === "enforce")) {
+    return config;
+  }
+  return {
+    ...config,
+    mode: "observe",
+    pathRules: config.pathRules.map((r) => r.mode === "enforce" ? { ...r, mode: "observe" } : r)
+  };
+}
+async function revalidate(config, counterpartyId) {
+  const key = cacheKey(config.apiBaseUrl, counterpartyId);
+  const existing = inflight2.get(key);
+  if (existing) return existing;
+  const promise = fetchEdgeConfig(config, counterpartyId, { etag: cache2.get(key)?.etag }).then((result) => {
+    if (result === null) return;
+    const now = Date.now();
+    if ("notModified" in result) {
+      const entry = cache2.get(key);
+      if (entry) entry.lastSuccessAt = now;
+      return;
+    }
+    cache2.set(key, { config: result.edgeConfig, etag: result.etag, lastSuccessAt: now });
+  }).finally(() => {
+    inflight2.delete(key);
+  });
+  inflight2.set(key, promise);
+  return promise;
+}
+async function getEdgeConfig(config, counterpartyId, opts) {
+  const ttlMs = opts?.ttlMs ?? DEFAULT_TTL_MS;
+  const maxStaleMs = opts?.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
+  const key = cacheKey(config.apiBaseUrl, counterpartyId);
+  const entry = cache2.get(key);
+  if (entry) {
+    const age = Date.now() - entry.lastSuccessAt;
+    if (age > ttlMs) {
+      revalidate(config, counterpartyId).catch(() => {
+      });
+    }
+    return age > maxStaleMs ? degradeToObserve(entry.config) : entry.config;
+  }
+  await revalidate(config, counterpartyId).catch(() => {
+  });
+  return cache2.get(key)?.config ?? DEFAULT_EDGE_CONFIG;
+}
+
+// src/platform-signatures.ts
+var PLATFORM_AGENT_SIGNATURES = [
+  {
+    vendor: "claude",
+    displayName: "Anthropic Claude",
+    uaPatterns: [/claude/i, /anthropic/i],
+    agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i],
+    apiKeyFormatPatterns: [/^sk-ant/i],
+    headerPatterns: [/^anthropic-version/i, /^anthropic-beta/i, /^x-anthropic-/i]
+  },
+  {
+    vendor: "chatgpt",
+    displayName: "OpenAI ChatGPT",
+    uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i],
+    agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i],
+    apiKeyFormatPatterns: [/^sk-proj/i, /^sk-svcacct/i],
+    headerPatterns: [/^openai-organization/i, /^openai-project/i, /^openai-version/i]
+  },
+  {
+    vendor: "gemini",
+    displayName: "Google Gemini",
+    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
+    apiKeyFormatPatterns: [/^aiza/i],
+    headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
+  },
+  {
+    vendor: "cursor",
+    displayName: "Cursor",
+    uaPatterns: [/cursor/i],
+    agentCardPatterns: [/cursor\.sh/i, /cursor\.com/i]
+  },
+  {
+    vendor: "goose",
+    displayName: "Block Goose",
+    uaPatterns: [/goose/i, /block-goose/i],
+    agentCardPatterns: [/block\.xyz\/goose/i, /goose\.tools/i]
+  },
+  {
+    vendor: "perplexity",
+    displayName: "Perplexity",
+    uaPatterns: [/perplexity/i],
+    agentCardPatterns: [/perplexity\.ai/i],
+    apiKeyFormatPatterns: [/^pplx-/i]
+  }
+];
+function matchPlatformSignature(signatures, input) {
+  const ua = input.userAgent ?? "";
+  const cardUrl = input.agentCardUrl ?? "";
+  const apiKeyFormat = input.apiKeyFormat ?? "";
+  const headerLines = [];
+  if (input.platformHeaders) {
+    for (const [name, value] of Object.entries(input.platformHeaders)) {
+      headerLines.push(name, `${name}: ${value}`);
+    }
+  }
+  for (const sig of signatures) {
+    const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));
+    const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));
+    const keyMatch = apiKeyFormat.length > 0 && sig.apiKeyFormatPatterns?.some((p) => p.test(apiKeyFormat));
+    const headerMatch = headerLines.length > 0 && sig.headerPatterns?.some((p) => headerLines.some((line) => p.test(line)));
+    if (uaMatch || cardMatch || keyMatch || headerMatch) {
+      const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
+      const cardHost = (() => {
+        try {
+          return cardUrl ? new URL(cardUrl).host : "";
+        } catch {
+          return "";
+        }
+      })();
+      const keyBasis = uaBase || cardHost || apiKeyFormat || "unknown";
+      return {
+        vendor: sig.vendor,
+        fingerprintKey: `${sig.vendor}:${keyBasis}`,
+        displayName: sig.displayName
+      };
+    }
+  }
+  return void 0;
+}
+function detectPlatformFingerprint(input) {
+  return matchPlatformSignature(PLATFORM_AGENT_SIGNATURES, input);
+}
+
+// src/edge-core/classify.ts
+var STATIC_EXTENSIONS = /\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|pdf|txt|xml)$/i;
+var BOT_UA_PATTERN = /curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i;
+var BROWSER_UA_PATTERN = /mozilla\/\d/i;
+var _patterns = { STATIC_EXTENSIONS, BOT_UA_PATTERN, BROWSER_UA_PATTERN };
+
+// src/edge-core/events.ts
+function sampled(rate, random = Math.random) {
+  if (rate <= 0) return false;
+  if (rate >= 1) return true;
+  return random() < rate;
+}
+
+// src/adapters/anonymous-beacon.ts
+function readHeader(raw, name) {
+  const value = raw[name];
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[0];
+  return void 0;
+}
+function classifyPassThroughTraffic(path, rawHeaders) {
+  if (_patterns.STATIC_EXTENSIONS.test(path)) return { kind: "never" };
+  const credentials = extractCredentials(rawHeaders, {});
+  if (credentials.astraId || credentials.apiKey || credentials.jwt) {
+    return { kind: "never" };
+  }
+  const userAgent = readHeader(rawHeaders, "user-agent") ?? "";
+  const { apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);
+  const fingerprint = detectPlatformFingerprint({ userAgent, apiKeyFormat, platformHeaders });
+  if (fingerprint) {
+    return {
+      kind: "platform",
+      protocol: "platform-ua",
+      evidence: { vendor: fingerprint.vendor, userAgent: userAgent || "(none)" }
+    };
+  }
+  if (!userAgent || _patterns.BOT_UA_PATTERN.test(userAgent) || !_patterns.BROWSER_UA_PATTERN.test(userAgent)) {
+    return {
+      kind: "anonymous-bot",
+      protocol: "ua-heuristic",
+      evidence: { userAgent: userAgent || "(none)" }
+    };
+  }
+  if (!readHeader(rawHeaders, "sec-fetch-mode") && !readHeader(rawHeaders, "accept-language")) {
+    return {
+      kind: "anonymous-bot",
+      protocol: "ua-heuristic",
+      evidence: { userAgent, spoofedBrowser: true }
+    };
+  }
+  return { kind: "never" };
+}
+function createAnonymousBeacon(config, options) {
+  const counterpartyId = config.counterpartyId;
+  if (!counterpartyId) return () => {
+  };
+  const random = options?.random ?? Math.random;
+  let edgeConfig;
+  let refreshing = false;
+  const refreshConfig = () => {
+    if (refreshing) return;
+    refreshing = true;
+    getEdgeConfig(config, counterpartyId).then((cfg) => {
+      edgeConfig = cfg;
+    }).catch(() => {
+    }).finally(() => {
+      refreshing = false;
+    });
+  };
+  refreshConfig();
+  return (input) => {
+    try {
+      refreshConfig();
+      const cfg = edgeConfig;
+      if (!cfg) return;
+      const traffic = classifyPassThroughTraffic(input.requestPath, input.rawHeaders);
+      if (traffic.kind === "never") return;
+      if (traffic.kind === "anonymous-bot" && !sampled(cfg.sampling.anonymousBeaconRate, random)) {
+        return;
+      }
+      const userAgent = readHeader(input.rawHeaders, "user-agent");
+      const xff = input.rawHeaders["x-forwarded-for"];
+      const xffStr = Array.isArray(xff) ? xff.join(", ") : xff;
+      const sourceIp = input.sourceIp ?? xffStr?.split(",")[0]?.trim();
+      reportUnregisteredAttempt(config, {
+        ...input.counterpartyUrl && { counterpartyUrl: input.counterpartyUrl },
+        counterpartyType: options?.counterpartyType ?? config.counterpartyType ?? "api",
+        ...sourceIp && { sourceIp },
+        ...userAgent && { userAgent },
+        requestPath: input.requestPath,
+        requestMethod: input.requestMethod,
+        ...traffic.protocol && { protocol: traffic.protocol },
+        ...traffic.evidence && { evidence: traffic.evidence },
+        observedMetadata: buildSdkObservedMetadata(input.rawHeaders)
+      }).catch(() => {
+      });
+    } catch {
+    }
+  };
+}
 
 // src/adapters/express.ts
 function defaultExtractCredentials(req) {
@@ -985,7 +1417,7 @@ function defaultExtractCredentials(req) {
 function extractAstraSyncCredentials(req) {
   return extractHttpCredentials(req.headers);
 }
-function headerValue(value) {
+function headerValue2(value) {
   if (typeof value === "string") return value;
   if (Array.isArray(value)) return value[0];
   return void 0;
@@ -993,9 +1425,9 @@ function headerValue(value) {
 function resolveRequestPdlss(req, routeConfig, customExtractPurpose, customExtractAction) {
   return resolveHttpPdlss({
     method: req.method,
-    astraPurpose: headerValue(req.headers["x-astra-purpose"]),
-    astraAction: headerValue(req.headers["x-astra-action"]),
-    legacyPurpose: headerValue(req.headers["x-purpose"] ?? req.headers["X-Purpose"]),
+    astraPurpose: headerValue2(req.headers["x-astra-purpose"]),
+    astraAction: headerValue2(req.headers["x-astra-action"]),
+    legacyPurpose: headerValue2(req.headers["x-purpose"] ?? req.headers["X-Purpose"]),
     queryPurpose: typeof req.query.purpose === "string" ? req.query.purpose : void 0,
     routePurpose: routeConfig?.purpose,
     routeAction: routeConfig?.action,
@@ -1043,6 +1475,20 @@ function dedupeFailures(result) {
   }
 }
 function defaultOnDenied(result, _req, res) {
+  if (result.misconfigured) {
+    res.setHeader("X-Astra-Gateway-Mode", "enforced");
+    res.status(503).json({
+      success: false,
+      error: {
+        code: "MERCHANT_VERIFICATION_MISCONFIGURED",
+        message: result.denialReasons?.[0] || "This site's AstraSync integration is misconfigured",
+        guidance: result.guidance,
+        failures: result.failures,
+        correlationId: result.correlationId
+      }
+    });
+    return;
+  }
   const statusCode = !result.identityVerified ? 401 : 403;
   res.setHeader("X-Astra-Gateway-Mode", "enforced");
   res.status(statusCode).json({
@@ -1064,6 +1510,11 @@ function defaultOnDenied(result, _req, res) {
 }
 var DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
 function createMiddleware(options) {
+  if ("routes" in options) {
+    console.warn(
+      "[VerificationGateway] `routes` is dashboard-managed since v2.9.7; this option is ignored \u2014 configure route policy in your AstraSync dashboard."
+    );
+  }
   const {
     extractCredentials: customExtractCredentials,
     extractPurpose: customExtractPurpose,
@@ -1075,12 +1526,25 @@ function createMiddleware(options) {
     routesRefreshMs = DEFAULT_ROUTES_REFRESH_MS,
     failOnError = "open",
     caseInsensitiveRouteMatch = false,
+    anonymousBeacon = true,
     ...config
   } = options;
   if (config.apiBaseUrl) {
     prefetchWellKnown(config.apiBaseUrl).catch(() => {
     });
   }
+  const emitAnonymousBeacon = anonymousBeacon ? createAnonymousBeacon(config, { counterpartyType: config.counterpartyType ?? "api" }) : void 0;
+  const beaconPassThrough = emitAnonymousBeacon ? (req) => {
+    const xff = req.headers["x-forwarded-for"];
+    const xffStr = Array.isArray(xff) ? xff.join(", ") : xff;
+    emitAnonymousBeacon({
+      requestPath: req.path,
+      requestMethod: req.method,
+      counterpartyUrl: config.counterpartyUrl || `${req.protocol}://${req.get("host")}`,
+      sourceIp: req.ip ?? (xffStr ? xffStr.split(",")[0].trim() : void 0),
+      rawHeaders: req.headers
+    });
+  } : void 0;
   let cachedRoutes = [];
   let lastFetchAt = 0;
   let refreshing = null;
@@ -1141,6 +1605,7 @@ function createMiddleware(options) {
             cachedRoutes.length === 0 ? "no-policy" : "no-match"
           );
         }
+        beaconPassThrough?.(req);
         return next();
       }
       const wellKnownUrls = config.apiBaseUrl ? await getWellKnownUrls(config.apiBaseUrl).catch(() => void 0) : void 0;
@@ -1151,6 +1616,7 @@ function createMiddleware(options) {
           res.setHeader("X-Astra-Gateway-Mode", "unenforced");
           res.setHeader("X-Astra-Gateway-Reason", "route-none");
         }
+        beaconPassThrough?.(req);
         return next();
       }
       const pdlssPair = resolveRequestPdlss(
@@ -1243,16 +1709,10 @@ function createMiddleware(options) {
           forwardedFor: forwardedForStr,
           agentCardUrl,
           // Workstream D — capture EVERY inbound header (SDK-only merchants
-          // have no edge to do it upstream). Local string work, secrets
-          // stripped; out of the verify cache key so it doesn't defeat caching.
-          observedMetadata: (() => {
-            const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(req.headers);
-            return {
-              headers,
-              ...apiKeyFormat && { apiKeyFormat },
-              ...platformHeaders && { platformHeaders }
-            };
-          })()
+          // have no edge to do it upstream) plus the CDN-derived connection
+          // block. Local string work, secrets stripped; out of the verify
+          // cache key so it doesn't defeat caching.
+          observedMetadata: buildSdkObservedMetadata(req.headers)
         }
       };
       let result = await verify(config, verificationRequest);