@astrasyncai/verification-gateway 3.7.1 → 3.9.0

package/dist/index.js

@@ -37,35 +37,46 @@ __export(src_exports, {
   AstraSyncError: () => AstraSyncError,
   AuthenticationError: () => AuthenticationError,
   ChallengeHandler: () => ChallengeHandler,
+  DEFAULT_EDGE_CONFIG: () => DEFAULT_EDGE_CONFIG,
   DEFAULT_TRUST_THRESHOLDS: () => DEFAULT_TRUST_THRESHOLDS,
   KYDRequiredError: () => KYDRequiredError,
+  PLATFORM_AGENT_SIGNATURES: () => PLATFORM_AGENT_SIGNATURES,
   RegistrationDeniedError: () => RegistrationDeniedError,
   RegistrationExpiredError: () => RegistrationExpiredError,
   RegistrationTimeoutError: () => RegistrationTimeoutError,
   TRUST_LEVEL_RANGES: () => TRUST_LEVEL_RANGES,
-  VERSION: () => VERSION,
+  VERSION: () => SDK_VERSION,
+  _resetEdgeConfigCache: () => _resetEdgeConfigCache,
   agent: () => agent_exports,
   authorizeSettlement: () => authorizeSettlement,
   awaitStepUpApproval: () => awaitStepUpApproval,
   buildGuidance: () => buildGuidance,
   clearCache: () => clearCache,
   createMcpMiddleware: () => createMcpMiddleware,
+  degradeToObserve: () => degradeToObserve,
+  detectPlatformFingerprint: () => detectPlatformFingerprint,
   determineAccessLevel: () => determineAccessLevel,
   express: () => express_exports,
   extractCredentials: () => extractCredentials,
   extractMcpCredentials: () => extractMcpCredentials,
+  fetchEdgeConfig: () => fetchEdgeConfig,
+  fetchRoutes: () => fetchRoutes,
   getAccessLevelForScore: () => getAccessLevelForScore,
   getCachedWellKnownUrls: () => getCachedWellKnownUrls,
   getCapabilities: () => getCapabilities,
+  getEdgeConfig: () => getEdgeConfig,
   getTrustLevel: () => getTrustLevel,
   getWellKnownUrls: () => getWellKnownUrls,
   hasCredentials: () => hasCredentials,
   hasMinimumAccess: () => hasMinimumAccess,
+  isEdgeConfig: () => isEdgeConfig,
+  matchEdgePathRule: () => matchEdgePathRule,
   nextjs: () => nextjs_exports,
   pollStepUpStatus: () => pollStepUpStatus,
   prefetchWellKnown: () => prefetchWellKnown,
   quickVerify: () => quickVerify,
   recordDecision: () => recordDecision2,
+  reportUnregisteredAttempt: () => reportUnregisteredAttempt,
   sdk: () => sdk_exports,
   setMcpMeta: () => setMcpMeta,
   transport: () => transport_exports,
@@ -195,7 +206,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.7.1";
+var SDK_VERSION = "3.9.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -482,6 +493,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.runtimeChallengeOptions)
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
+  if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
@@ -730,6 +742,21 @@ async function fetchRoutes(config, counterpartyId) {
     return null;
   }
 }
+async function reportUnregisteredAttempt(config, data) {
+  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
+  const { counterpartyUrl, ...rest } = data;
+  const body = {
+    ...rest,
+    ...counterpartyUrl && { counterpartyUrl },
+    ...config.counterpartyId && { counterpartyId: config.counterpartyId }
+  };
+  await fetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  }).catch(() => {
+  });
+}
 async function reportCounterpartyPreCheckFailure(config, data) {
   const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
   await fetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {
@@ -4495,7 +4522,7 @@ async function exportJwkFromKeyLike(keyLike) {
 
 // src/transport/registry/mastercard.ts
 function createMastercardRegistry(options = {}) {
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache3 = /* @__PURE__ */ new Map();
   const ttlSec = options.cacheTtlSec ?? 3600;
   const fetchFn = options.fetch ?? globalThis.fetch;
   let warned = false;
@@ -4512,7 +4539,7 @@ function createMastercardRegistry(options = {}) {
         }
         return null;
       }
-      const cached = cache2.get(kid);
+      const cached = cache3.get(kid);
       if (cached && cached.expiresAt > Date.now()) return cached.jwk;
       try {
         const res = await fetchFn(options.registryUrl);
@@ -4521,7 +4548,7 @@ function createMastercardRegistry(options = {}) {
         const keys = body.keys ?? [];
         for (const k of keys) {
           if (k.kid === kid) {
-            cache2.set(kid, { jwk: k, expiresAt: Date.now() + ttlSec * 1e3 });
+            cache3.set(kid, { jwk: k, expiresAt: Date.now() + ttlSec * 1e3 });
             return k;
           }
         }
@@ -4536,7 +4563,7 @@ function createMastercardRegistry(options = {}) {
 // src/transport/registry/web-bot-auth.ts
 var DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 function createWebBotAuthRegistry(options = {}) {
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache3 = /* @__PURE__ */ new Map();
   const ttlSec = options.cacheTtlSec ?? 3600;
   const fetchFn = options.fetch ?? globalThis.fetch;
   return {
@@ -4545,7 +4572,7 @@ function createWebBotAuthRegistry(options = {}) {
       if (!kid) return null;
       const directoryUrl = resolveDirectoryUrl(options.directoryUrl, context?.origin);
       if (!directoryUrl) return null;
-      const cached = cache2.get(directoryUrl);
+      const cached = cache3.get(directoryUrl);
       const now = Date.now();
       if (cached && cached.expiresAt > now) {
         return findKeyByKid(cached.keys, kid);
@@ -4555,7 +4582,7 @@ function createWebBotAuthRegistry(options = {}) {
         if (!res.ok) return null;
         const body = await res.json();
         const keys = body.keys ?? [];
-        cache2.set(directoryUrl, { keys, expiresAt: now + ttlSec * 1e3 });
+        cache3.set(directoryUrl, { keys, expiresAt: now + ttlSec * 1e3 });
         return findKeyByKid(keys, kid);
       } catch {
         return null;
@@ -5724,8 +5751,186 @@ async function recordDecision2(config, params) {
   };
 }
 
-// src/index.ts
-var VERSION = "3.4.0";
+// src/edge-config.ts
+var DEFAULT_EDGE_CONFIG = Object.freeze({
+  version: 1,
+  mode: "observe",
+  depth: "classify",
+  pathRules: [],
+  sampling: Object.freeze({ anonymousBeaconRate: 0.1 }),
+  failurePosture: "open"
+});
+var EDGE_MODES = ["observe", "enforce"];
+var EDGE_DEPTHS = ["classify", "authenticate", "authorize"];
+function isEdgeConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (v.version !== 1) return false;
+  if (!EDGE_MODES.includes(v.mode)) return false;
+  if (!EDGE_DEPTHS.includes(v.depth)) return false;
+  if (!Array.isArray(v.pathRules)) return false;
+  for (const rule of v.pathRules) {
+    if (typeof rule !== "object" || rule === null) return false;
+    const r = rule;
+    if (typeof r.pattern !== "string" || r.pattern.length === 0) return false;
+    if (r.mode !== void 0 && !EDGE_MODES.includes(r.mode)) return false;
+    if (r.depth !== void 0 && !EDGE_DEPTHS.includes(r.depth)) return false;
+  }
+  const sampling = v.sampling;
+  if (typeof sampling !== "object" || sampling === null || typeof sampling.anonymousBeaconRate !== "number" || sampling.anonymousBeaconRate < 0 || sampling.anonymousBeaconRate > 1) {
+    return false;
+  }
+  return v.failurePosture === "open";
+}
+async function fetchEdgeConfig(config, counterpartyId, opts) {
+  if (!counterpartyId) return null;
+  const headers = { Accept: "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  if (opts?.etag) headers["If-None-Match"] = opts.etag;
+  try {
+    const response = await fetch(
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/edge-config`,
+      { method: "GET", headers, signal: AbortSignal.timeout(opts?.timeoutMs ?? 5e3) }
+    );
+    if (response.status === 304) return { notModified: true };
+    if (!response.ok) return null;
+    const body = await response.json();
+    const edgeConfig = body.data?.edgeConfig;
+    if (!isEdgeConfig(edgeConfig)) return null;
+    return { edgeConfig, etag: response.headers.get("etag") ?? void 0 };
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_TTL_MS = 60 * 1e3;
+var DEFAULT_MAX_STALE_MS = 24 * 60 * 60 * 1e3;
+var cache2 = /* @__PURE__ */ new Map();
+var inflight2 = /* @__PURE__ */ new Map();
+function cacheKey(apiBaseUrl, counterpartyId) {
+  return `${apiBaseUrl}|${counterpartyId}`;
+}
+function degradeToObserve(config) {
+  if (config.mode !== "enforce" && !config.pathRules.some((r) => r.mode === "enforce")) {
+    return config;
+  }
+  return {
+    ...config,
+    mode: "observe",
+    pathRules: config.pathRules.map((r) => r.mode === "enforce" ? { ...r, mode: "observe" } : r)
+  };
+}
+async function revalidate(config, counterpartyId) {
+  const key = cacheKey(config.apiBaseUrl, counterpartyId);
+  const existing = inflight2.get(key);
+  if (existing) return existing;
+  const promise = fetchEdgeConfig(config, counterpartyId, { etag: cache2.get(key)?.etag }).then((result) => {
+    if (result === null) return;
+    const now = Date.now();
+    if ("notModified" in result) {
+      const entry = cache2.get(key);
+      if (entry) entry.lastSuccessAt = now;
+      return;
+    }
+    cache2.set(key, { config: result.edgeConfig, etag: result.etag, lastSuccessAt: now });
+  }).finally(() => {
+    inflight2.delete(key);
+  });
+  inflight2.set(key, promise);
+  return promise;
+}
+async function getEdgeConfig(config, counterpartyId, opts) {
+  const ttlMs = opts?.ttlMs ?? DEFAULT_TTL_MS;
+  const maxStaleMs = opts?.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
+  const key = cacheKey(config.apiBaseUrl, counterpartyId);
+  const entry = cache2.get(key);
+  if (entry) {
+    const age = Date.now() - entry.lastSuccessAt;
+    if (age > ttlMs) {
+      revalidate(config, counterpartyId).catch(() => {
+      });
+    }
+    return age > maxStaleMs ? degradeToObserve(entry.config) : entry.config;
+  }
+  await revalidate(config, counterpartyId).catch(() => {
+  });
+  return cache2.get(key)?.config ?? DEFAULT_EDGE_CONFIG;
+}
+function matchEdgePathRule(rules, path) {
+  for (const rule of rules) {
+    if (globToRegExp(rule.pattern).test(path)) return rule;
+  }
+  return void 0;
+}
+function globToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i");
+}
+function _resetEdgeConfigCache() {
+  cache2.clear();
+  inflight2.clear();
+}
+
+// src/platform-signatures.ts
+var PLATFORM_AGENT_SIGNATURES = [
+  {
+    vendor: "claude",
+    displayName: "Anthropic Claude",
+    uaPatterns: [/claude/i, /anthropic/i],
+    agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i]
+  },
+  {
+    vendor: "chatgpt",
+    displayName: "OpenAI ChatGPT",
+    uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i],
+    agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i]
+  },
+  {
+    vendor: "gemini",
+    displayName: "Google Gemini",
+    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i]
+  },
+  {
+    vendor: "cursor",
+    displayName: "Cursor",
+    uaPatterns: [/cursor/i],
+    agentCardPatterns: [/cursor\.sh/i, /cursor\.com/i]
+  },
+  {
+    vendor: "goose",
+    displayName: "Block Goose",
+    uaPatterns: [/goose/i, /block-goose/i],
+    agentCardPatterns: [/block\.xyz\/goose/i, /goose\.tools/i]
+  }
+];
+function detectPlatformFingerprint(input) {
+  const ua = input.userAgent ?? "";
+  const cardUrl = input.agentCardUrl ?? "";
+  for (const sig of PLATFORM_AGENT_SIGNATURES) {
+    const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));
+    const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));
+    if (uaMatch || cardMatch) {
+      const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
+      const cardHost = (() => {
+        try {
+          return cardUrl ? new URL(cardUrl).host : "";
+        } catch {
+          return "";
+        }
+      })();
+      const fingerprintKey = `${sig.vendor}:${uaBase || cardHost || "unknown"}`;
+      return {
+        vendor: sig.vendor,
+        fingerprintKey,
+        displayName: sig.displayName
+      };
+    }
+  }
+  return void 0;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACCESS_LEVEL_DESCRIPTIONS,
@@ -5735,35 +5940,46 @@ var VERSION = "3.4.0";
   AstraSyncError,
   AuthenticationError,
   ChallengeHandler,
+  DEFAULT_EDGE_CONFIG,
   DEFAULT_TRUST_THRESHOLDS,
   KYDRequiredError,
+  PLATFORM_AGENT_SIGNATURES,
   RegistrationDeniedError,
   RegistrationExpiredError,
   RegistrationTimeoutError,
   TRUST_LEVEL_RANGES,
   VERSION,
+  _resetEdgeConfigCache,
   agent,
   authorizeSettlement,
   awaitStepUpApproval,
   buildGuidance,
   clearCache,
   createMcpMiddleware,
+  degradeToObserve,
+  detectPlatformFingerprint,
   determineAccessLevel,
   express,
   extractCredentials,
   extractMcpCredentials,
+  fetchEdgeConfig,
+  fetchRoutes,
   getAccessLevelForScore,
   getCachedWellKnownUrls,
   getCapabilities,
+  getEdgeConfig,
   getTrustLevel,
   getWellKnownUrls,
   hasCredentials,
   hasMinimumAccess,
+  isEdgeConfig,
+  matchEdgePathRule,
   nextjs,
   pollStepUpStatus,
   prefetchWellKnown,
   quickVerify,
   recordDecision,
+  reportUnregisteredAttempt,
   sdk,
   setMcpMeta,
   transport,