@astrasyncai/verification-gateway 3.8.0 → 3.10.0

package/dist/adapters/nextjs.d.mts

@@ -1,3 +1,4 @@
 import 'next/server';
-import '../types-DedAJbNI.mjs';
-export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-BMAe8ode.mjs';
+import '../types-sy3tq8lp.mjs';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-DcQIk6Zj.mjs';
+import '../metadata-capture.mjs';

package/dist/adapters/nextjs.d.ts

@@ -1,3 +1,4 @@
 import 'next/server';
-import '../types-DedAJbNI.js';
-export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-IyXWW2KL.js';
+import '../types-9tns4wyl.js';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-CEBVBsdi.js';
+import '../metadata-capture.js';

package/dist/adapters/nextjs.js

@@ -102,7 +102,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.7.1";
+var SDK_VERSION = "3.10.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -297,6 +297,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.runtimeChallengeOptions)
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
+  if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
@@ -636,6 +637,144 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   return failures;
 }
 
+// src/metadata-capture.ts
+var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "cookie",
+  "set-cookie",
+  "x-csrf-token",
+  "proxy-authorization",
+  "x-astrasync-signature",
+  "x-astrasync-secret",
+  "x-hub-signature",
+  "x-hub-signature-256"
+]);
+var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
+var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "x-api-key",
+  "x-goog-api-key",
+  "api-key"
+]);
+function isSignatureHeader(name) {
+  return name === "signature" || name.endsWith("-signature") || name.endsWith("-signature-256");
+}
+var PLATFORM_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "openai-organization",
+  "openai-project",
+  "openai-version",
+  "openai-processing-ms",
+  "anthropic-version",
+  "anthropic-beta",
+  "x-goog-user-project",
+  "x-goog-api-client",
+  "user-agent",
+  "x-agent-card-url",
+  "x-agent-provider"
+]);
+var PLATFORM_HEADER_PREFIXES = ["x-goog-", "x-stainless-", "x-anthropic-", "x-openai-"];
+var KEY_FORMAT_PREFIXES = [
+  "sk-ant-api03",
+  "sk-ant-api",
+  "sk-ant",
+  "sk-proj",
+  "sk-svcacct",
+  "sk-or-v1",
+  "sk-or",
+  "sk-lf",
+  "sk-",
+  "gsk_",
+  "aiza",
+  "ya29",
+  "ghp_",
+  "gho_",
+  "github_pat_",
+  "xai-",
+  "pplx-",
+  "r8_",
+  "hf_",
+  "astra-",
+  "astrae-"
+];
+var MAX_HEADERS = 64;
+var MAX_HEADER_VALUE_BYTES = 1024;
+var MAX_TOTAL_BYTES = 16 * 1024;
+function byteLength(s) {
+  let bytes = 0;
+  for (let i = 0; i < s.length; i++) {
+    const code = s.charCodeAt(i);
+    if (code < 128) bytes += 1;
+    else if (code < 2048) bytes += 2;
+    else if (code >= 55296 && code <= 56319) {
+      bytes += 4;
+      i++;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+function extractApiKeyFormat(rawValue) {
+  if (!rawValue) return void 0;
+  let value = rawValue.trim();
+  const spaceIdx = value.indexOf(" ");
+  if (spaceIdx > 0) {
+    const scheme = value.slice(0, spaceIdx).toLowerCase();
+    if (scheme === "bearer" || scheme === "basic" || scheme === "token") {
+      value = value.slice(spaceIdx + 1).trim();
+    }
+  }
+  const lower = value.toLowerCase();
+  for (const prefix of KEY_FORMAT_PREFIXES) {
+    if (lower.startsWith(prefix)) {
+      return prefix;
+    }
+  }
+  return void 0;
+}
+function isSecretHeader(name) {
+  if (SECRET_HEADER_NAMES.has(name)) return true;
+  if (SECRET_HEADER_PREFIXES.some((p) => name.startsWith(p))) return true;
+  if (isSignatureHeader(name)) return true;
+  return false;
+}
+function isPlatformHeader(name) {
+  if (PLATFORM_HEADER_NAMES.has(name)) return true;
+  return PLATFORM_HEADER_PREFIXES.some((p) => name.startsWith(p));
+}
+function sanitizeHeaders(raw) {
+  const headers = {};
+  const platformHeaders = {};
+  let apiKeyFormat;
+  let totalBytes = 0;
+  let count = 0;
+  if (!raw) return { headers };
+  for (const rawName of Object.keys(raw)) {
+    if (count >= MAX_HEADERS) break;
+    const name = rawName.toLowerCase();
+    const rawValue = raw[rawName];
+    if (rawValue === void 0) continue;
+    const joined = Array.isArray(rawValue) ? rawValue.join(", ") : String(rawValue);
+    if (CREDENTIAL_HEADER_NAMES.has(name)) {
+      const fmt = extractApiKeyFormat(joined);
+      if (fmt && !apiKeyFormat) apiKeyFormat = fmt;
+      continue;
+    }
+    if (isSecretHeader(name)) continue;
+    let value = joined;
+    if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {
+      value = value.slice(0, MAX_HEADER_VALUE_BYTES);
+    }
+    const entryBytes = byteLength(name) + byteLength(value);
+    if (totalBytes + entryBytes > MAX_TOTAL_BYTES) continue;
+    totalBytes += entryBytes;
+    count++;
+    headers[name] = value;
+    if (isPlatformHeader(name)) platformHeaders[name] = value;
+  }
+  const result = { headers };
+  if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;
+  if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
+  return result;
+}
+
 // src/adapters/http-pdlss.ts
 var HTTP_METHOD_ACTION_TABLE = {
   GET: "data.read",
@@ -1084,7 +1223,18 @@ function createMiddleware(options) {
         referer: request.headers.get("referer") || void 0,
         host: request.headers.get("host") || void 0,
         forwardedFor,
-        agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0
+        agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0,
+        // Workstream D — full sanitised header capture (Web Headers → plain map).
+        observedMetadata: (() => {
+          const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(
+            Object.fromEntries(request.headers.entries())
+          );
+          return {
+            headers,
+            ...apiKeyFormat && { apiKeyFormat },
+            ...platformHeaders && { platformHeaders }
+          };
+        })()
       }
     };
     let result = await verify(config, verificationRequest);