@astrasyncai/verification-gateway 3.9.0 → 3.10.0

package/dist/index.mjs

@@ -126,7 +126,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.9.0";
+var SDK_VERSION = "3.10.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -1023,6 +1023,152 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   return failures;
 }
 
+// src/metadata-capture.ts
+var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "cookie",
+  "set-cookie",
+  "x-csrf-token",
+  "proxy-authorization",
+  "x-astrasync-signature",
+  "x-astrasync-secret",
+  "x-hub-signature",
+  "x-hub-signature-256"
+]);
+var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
+var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "x-api-key",
+  "x-goog-api-key",
+  "api-key"
+]);
+function isSignatureHeader(name) {
+  return name === "signature" || name.endsWith("-signature") || name.endsWith("-signature-256");
+}
+var PLATFORM_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "openai-organization",
+  "openai-project",
+  "openai-version",
+  "openai-processing-ms",
+  "anthropic-version",
+  "anthropic-beta",
+  "x-goog-user-project",
+  "x-goog-api-client",
+  "user-agent",
+  "x-agent-card-url",
+  "x-agent-provider"
+]);
+var PLATFORM_HEADER_PREFIXES = ["x-goog-", "x-stainless-", "x-anthropic-", "x-openai-"];
+var KEY_FORMAT_PREFIXES = [
+  "sk-ant-api03",
+  "sk-ant-api",
+  "sk-ant",
+  "sk-proj",
+  "sk-svcacct",
+  "sk-or-v1",
+  "sk-or",
+  "sk-lf",
+  "sk-",
+  "gsk_",
+  "aiza",
+  "ya29",
+  "ghp_",
+  "gho_",
+  "github_pat_",
+  "xai-",
+  "pplx-",
+  "r8_",
+  "hf_",
+  "astra-",
+  "astrae-"
+];
+var MAX_HEADERS = 64;
+var MAX_HEADER_VALUE_BYTES = 1024;
+var MAX_TOTAL_BYTES = 16 * 1024;
+function byteLength(s) {
+  let bytes = 0;
+  for (let i = 0; i < s.length; i++) {
+    const code = s.charCodeAt(i);
+    if (code < 128) bytes += 1;
+    else if (code < 2048) bytes += 2;
+    else if (code >= 55296 && code <= 56319) {
+      bytes += 4;
+      i++;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+function extractApiKeyFormat(rawValue) {
+  if (!rawValue) return void 0;
+  let value = rawValue.trim();
+  const spaceIdx = value.indexOf(" ");
+  if (spaceIdx > 0) {
+    const scheme = value.slice(0, spaceIdx).toLowerCase();
+    if (scheme === "bearer" || scheme === "basic" || scheme === "token") {
+      value = value.slice(spaceIdx + 1).trim();
+    }
+  }
+  const lower = value.toLowerCase();
+  for (const prefix of KEY_FORMAT_PREFIXES) {
+    if (lower.startsWith(prefix)) {
+      return prefix;
+    }
+  }
+  return void 0;
+}
+function isSecretHeader(name) {
+  if (SECRET_HEADER_NAMES.has(name)) return true;
+  if (SECRET_HEADER_PREFIXES.some((p) => name.startsWith(p))) return true;
+  if (isSignatureHeader(name)) return true;
+  return false;
+}
+function isPlatformHeader(name) {
+  if (PLATFORM_HEADER_NAMES.has(name)) return true;
+  return PLATFORM_HEADER_PREFIXES.some((p) => name.startsWith(p));
+}
+function sanitizeHeaders(raw) {
+  const headers = {};
+  const platformHeaders = {};
+  let apiKeyFormat;
+  let totalBytes = 0;
+  let count = 0;
+  if (!raw) return { headers };
+  for (const rawName of Object.keys(raw)) {
+    if (count >= MAX_HEADERS) break;
+    const name = rawName.toLowerCase();
+    const rawValue = raw[rawName];
+    if (rawValue === void 0) continue;
+    const joined = Array.isArray(rawValue) ? rawValue.join(", ") : String(rawValue);
+    if (CREDENTIAL_HEADER_NAMES.has(name)) {
+      const fmt = extractApiKeyFormat(joined);
+      if (fmt && !apiKeyFormat) apiKeyFormat = fmt;
+      continue;
+    }
+    if (isSecretHeader(name)) continue;
+    let value = joined;
+    if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {
+      value = value.slice(0, MAX_HEADER_VALUE_BYTES);
+    }
+    const entryBytes = byteLength(name) + byteLength(value);
+    if (totalBytes + entryBytes > MAX_TOTAL_BYTES) continue;
+    totalBytes += entryBytes;
+    count++;
+    headers[name] = value;
+    if (isPlatformHeader(name)) platformHeaders[name] = value;
+  }
+  const result = { headers };
+  if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;
+  if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
+  return result;
+}
+function extractPlatformHeaders(sanitized) {
+  const out = {};
+  if (!sanitized) return out;
+  for (const name of Object.keys(sanitized)) {
+    if (isPlatformHeader(name.toLowerCase())) out[name.toLowerCase()] = sanitized[name];
+  }
+  return out;
+}
+
 // src/adapters/express.ts
 function defaultExtractCredentials(req) {
   return extractCredentials(
@@ -1289,7 +1435,18 @@ function createMiddleware(options) {
           referer: req.headers.referer,
           host: req.headers.host,
           forwardedFor: forwardedForStr,
-          agentCardUrl
+          agentCardUrl,
+          // Workstream D — capture EVERY inbound header (SDK-only merchants
+          // have no edge to do it upstream). Local string work, secrets
+          // stripped; out of the verify cache key so it doesn't defeat caching.
+          observedMetadata: (() => {
+            const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(req.headers);
+            return {
+              headers,
+              ...apiKeyFormat && { apiKeyFormat },
+              ...platformHeaders && { platformHeaders }
+            };
+          })()
         }
       };
       let result = await verify(config, verificationRequest);
@@ -1769,7 +1926,18 @@ function createMiddleware2(options) {
         referer: request.headers.get("referer") || void 0,
         host: request.headers.get("host") || void 0,
         forwardedFor,
-        agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0
+        agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0,
+        // Workstream D — full sanitised header capture (Web Headers → plain map).
+        observedMetadata: (() => {
+          const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(
+            Object.fromEntries(request.headers.entries())
+          );
+          return {
+            headers,
+            ...apiKeyFormat && { apiKeyFormat },
+            ...platformHeaders && { platformHeaders }
+          };
+        })()
       }
     };
     let result = await verify(config, verificationRequest);
@@ -5802,19 +5970,25 @@ var PLATFORM_AGENT_SIGNATURES = [
     vendor: "claude",
     displayName: "Anthropic Claude",
     uaPatterns: [/claude/i, /anthropic/i],
-    agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i]
+    agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i],
+    apiKeyFormatPatterns: [/^sk-ant/i],
+    headerPatterns: [/^anthropic-version/i, /^anthropic-beta/i, /^x-anthropic-/i]
   },
   {
     vendor: "chatgpt",
     displayName: "OpenAI ChatGPT",
     uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i],
-    agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i]
+    agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i],
+    apiKeyFormatPatterns: [/^sk-proj/i, /^sk-svcacct/i],
+    headerPatterns: [/^openai-organization/i, /^openai-project/i, /^openai-version/i]
   },
   {
     vendor: "gemini",
     displayName: "Google Gemini",
     uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
-    agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i]
+    agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
+    apiKeyFormatPatterns: [/^aiza/i],
+    headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
   },
   {
     vendor: "cursor",
@@ -5827,15 +6001,31 @@ var PLATFORM_AGENT_SIGNATURES = [
     displayName: "Block Goose",
     uaPatterns: [/goose/i, /block-goose/i],
     agentCardPatterns: [/block\.xyz\/goose/i, /goose\.tools/i]
+  },
+  {
+    vendor: "perplexity",
+    displayName: "Perplexity",
+    uaPatterns: [/perplexity/i],
+    agentCardPatterns: [/perplexity\.ai/i],
+    apiKeyFormatPatterns: [/^pplx-/i]
   }
 ];
-function detectPlatformFingerprint(input) {
+function matchPlatformSignature(signatures, input) {
   const ua = input.userAgent ?? "";
   const cardUrl = input.agentCardUrl ?? "";
-  for (const sig of PLATFORM_AGENT_SIGNATURES) {
+  const apiKeyFormat = input.apiKeyFormat ?? "";
+  const headerLines = [];
+  if (input.platformHeaders) {
+    for (const [name, value] of Object.entries(input.platformHeaders)) {
+      headerLines.push(name, `${name}: ${value}`);
+    }
+  }
+  for (const sig of signatures) {
     const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));
     const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));
-    if (uaMatch || cardMatch) {
+    const keyMatch = apiKeyFormat.length > 0 && sig.apiKeyFormatPatterns?.some((p) => p.test(apiKeyFormat));
+    const headerMatch = headerLines.length > 0 && sig.headerPatterns?.some((p) => headerLines.some((line) => p.test(line)));
+    if (uaMatch || cardMatch || keyMatch || headerMatch) {
       const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
       const cardHost = (() => {
         try {
@@ -5844,16 +6034,19 @@ function detectPlatformFingerprint(input) {
           return "";
         }
       })();
-      const fingerprintKey = `${sig.vendor}:${uaBase || cardHost || "unknown"}`;
+      const keyBasis = uaBase || cardHost || apiKeyFormat || "unknown";
       return {
         vendor: sig.vendor,
-        fingerprintKey,
+        fingerprintKey: `${sig.vendor}:${keyBasis}`,
         displayName: sig.displayName
       };
     }
   }
   return void 0;
 }
+function detectPlatformFingerprint(input) {
+  return matchPlatformSignature(PLATFORM_AGENT_SIGNATURES, input);
+}
 export {
   ACCESS_LEVEL_DESCRIPTIONS,
   ACCESS_LEVEL_HIERARCHY,
@@ -5865,6 +6058,9 @@ export {
   DEFAULT_EDGE_CONFIG,
   DEFAULT_TRUST_THRESHOLDS,
   KYDRequiredError,
+  MAX_HEADERS,
+  MAX_HEADER_VALUE_BYTES,
+  MAX_TOTAL_BYTES,
   PLATFORM_AGENT_SIGNATURES,
   RegistrationDeniedError,
   RegistrationExpiredError,
@@ -5882,8 +6078,10 @@ export {
   detectPlatformFingerprint,
   determineAccessLevel,
   express_exports as express,
+  extractApiKeyFormat,
   extractCredentials,
   extractMcpCredentials,
+  extractPlatformHeaders,
   fetchEdgeConfig,
   fetchRoutes,
   getAccessLevelForScore,
@@ -5896,12 +6094,14 @@ export {
   hasMinimumAccess,
   isEdgeConfig,
   matchEdgePathRule,
+  matchPlatformSignature,
   nextjs_exports as nextjs,
   pollStepUpStatus,
   prefetchWellKnown,
   quickVerify,
   recordDecision2 as recordDecision,
   reportUnregisteredAttempt,
+  sanitizeHeaders,
   sdk_exports as sdk,
   setMcpMeta,
   transport_exports as transport,