@astrasyncai/verification-gateway 4.0.0 → 4.2.0

package/dist/adapters/nextjs.mjs

@@ -65,7 +65,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "4.0.0";
+var SDK_VERSION = "4.1.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -204,6 +204,40 @@ function cacheResult(request, result, configuredTtl, counterpartyId) {
     expiresAt: Date.now() + ttlSeconds * 1e3
   });
 }
+function extractCredentials(headers, query) {
+  const credentials = {};
+  const ASTRA_ID_PATTERN = /^ASTRAE?-[A-Za-z0-9_-]{1,64}$/;
+  const astraIdHeader = headers["x-astra-id"] || headers["X-Astra-Id"] || headers["X-ASTRA-ID"] || headers["x-astra-agentid"] || headers["X-Astra-AgentId"] || headers["x-astra-agent-id"] || headers["X-Astra-Agent-Id"] || headers["X-ASTRA-AGENT-ID"];
+  if (astraIdHeader) {
+    const raw = Array.isArray(astraIdHeader) ? astraIdHeader[0] : typeof astraIdHeader === "string" ? astraIdHeader : void 0;
+    if (typeof raw === "string" && ASTRA_ID_PATTERN.test(raw)) {
+      credentials.astraId = raw;
+    }
+  }
+  const apiKeyHeader = headers["x-api-key"] || headers["X-Api-Key"] || headers["X-API-KEY"];
+  if (apiKeyHeader) {
+    credentials.apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;
+  }
+  const authHeader = headers["authorization"] || headers["Authorization"];
+  if (authHeader) {
+    const authValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+    if (typeof authValue === "string") {
+      credentials.authorizationHeader = authValue;
+      if (authValue.startsWith("Bearer ")) {
+        credentials.jwt = authValue.slice(7);
+      }
+    }
+  }
+  if (query) {
+    if (query.astraId && !credentials.astraId) {
+      credentials.astraId = query.astraId;
+    }
+    if (query.apiKey && !credentials.apiKey) {
+      credentials.apiKey = query.apiKey;
+    }
+  }
+  return credentials;
+}
 function createGuidanceResponse(_config, reason, options = {}) {
   const source = options.source ?? "no_credentials";
   const isApiError = source === "api_error";
@@ -578,6 +612,21 @@ async function fetchRoutes(config, counterpartyId) {
     return null;
   }
 }
+async function reportUnregisteredAttempt(config, data) {
+  const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
+  const { counterpartyUrl, ...rest } = data;
+  const body = {
+    ...rest,
+    ...counterpartyUrl && { counterpartyUrl },
+    ...config.counterpartyId && { counterpartyId: config.counterpartyId }
+  };
+  await fetch(`${apiBaseUrl}/verification-activity/unregistered-attempt`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  }).catch(() => {
+  });
+}
 async function reportCounterpartyPreCheckFailure(config, data) {
   const apiBaseUrl = config.apiBaseUrl || DEFAULT_CONFIG.apiBaseUrl;
   await fetch(`${apiBaseUrl}/verification-activity/counterparty-pre-check-failure`, {
@@ -683,6 +732,7 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
 }
 
 // src/metadata-capture.ts
+var CAPTURE_SCHEMA_VERSION = 1;
 var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
   "cookie",
   "set-cookie",
@@ -819,6 +869,359 @@ function sanitizeHeaders(raw) {
   if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
   return result;
 }
+var CONNECTION_HEADER_SOURCES = [
+  ["ip", ["cf-connecting-ip", "fastly-client-ip", "true-client-ip", "x-real-ip"]],
+  [
+    "country",
+    ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
+  ],
+  ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
+  ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
+  ["asn", ["cloudfront-viewer-asn"]],
+  ["tlsVersion", ["cloudfront-viewer-tls"]],
+  ["httpVersion", ["cloudfront-viewer-http-version"]],
+  // TLS fingerprints can only be computed where TLS terminates. When a CDN
+  // terminates TLS in front of the merchant, its fingerprint headers ARE the
+  // connection-layer truth — normalising them here is the permanent design.
+  ["tlsFingerprint", ["cf-ja3-hash"]],
+  ["ja4", ["cf-ja4"]]
+];
+function deriveConnectionFromHeaders(headers) {
+  if (!headers) return void 0;
+  const lower = {};
+  for (const name of Object.keys(headers)) {
+    const value = headers[name];
+    if (typeof value === "string" && value.length > 0) lower[name.toLowerCase()] = value;
+  }
+  const connection = {};
+  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {
+    for (const source of sources) {
+      const value = lower[source]?.trim();
+      if (value) {
+        connection[key] = value;
+        break;
+      }
+    }
+  }
+  if (!connection.ip) {
+    const xff = lower["x-forwarded-for"];
+    const client = xff?.split(",")[0]?.trim();
+    if (client) connection.ip = client;
+  }
+  return Object.keys(connection).length > 0 ? connection : void 0;
+}
+function buildSdkObservedMetadata(rawHeaders) {
+  const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);
+  const flat = {};
+  if (rawHeaders) {
+    for (const name of Object.keys(rawHeaders)) {
+      const value = rawHeaders[name];
+      if (value === void 0) continue;
+      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
+    }
+  }
+  const connection = deriveConnectionFromHeaders(flat);
+  return {
+    headers,
+    ...apiKeyFormat && { apiKeyFormat },
+    ...platformHeaders && { platformHeaders },
+    ...connection && { connection },
+    schemaVersion: CAPTURE_SCHEMA_VERSION
+  };
+}
+
+// src/edge-config.ts
+var DEFAULT_EDGE_CONFIG = Object.freeze({
+  version: 1,
+  mode: "observe",
+  depth: "classify",
+  pathRules: [],
+  sampling: Object.freeze({ anonymousBeaconRate: 0.1 }),
+  failurePosture: "open"
+});
+var EDGE_MODES = ["observe", "enforce"];
+var EDGE_DEPTHS = ["classify", "authenticate", "authorize"];
+function isEdgeConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (v.version !== 1) return false;
+  if (!EDGE_MODES.includes(v.mode)) return false;
+  if (!EDGE_DEPTHS.includes(v.depth)) return false;
+  if (!Array.isArray(v.pathRules)) return false;
+  for (const rule of v.pathRules) {
+    if (typeof rule !== "object" || rule === null) return false;
+    const r = rule;
+    if (typeof r.pattern !== "string" || r.pattern.length === 0) return false;
+    if (r.mode !== void 0 && !EDGE_MODES.includes(r.mode)) return false;
+    if (r.depth !== void 0 && !EDGE_DEPTHS.includes(r.depth)) return false;
+  }
+  const sampling = v.sampling;
+  if (typeof sampling !== "object" || sampling === null || typeof sampling.anonymousBeaconRate !== "number" || sampling.anonymousBeaconRate < 0 || sampling.anonymousBeaconRate > 1) {
+    return false;
+  }
+  return v.failurePosture === "open";
+}
+async function fetchEdgeConfig(config, counterpartyId, opts) {
+  if (!counterpartyId) return null;
+  const headers = { Accept: "application/json" };
+  if (config.apiKey) {
+    headers["Authorization"] = `Bearer ${config.apiKey}`;
+    headers["X-API-Key"] = config.apiKey;
+  }
+  if (opts?.etag) headers["If-None-Match"] = opts.etag;
+  try {
+    const response = await fetch(
+      `${config.apiBaseUrl}/endpoints/${encodeURIComponent(counterpartyId)}/edge-config`,
+      { method: "GET", headers, signal: AbortSignal.timeout(opts?.timeoutMs ?? 5e3) }
+    );
+    if (response.status === 304) return { notModified: true };
+    if (!response.ok) return null;
+    const body = await response.json();
+    const edgeConfig = body.data?.edgeConfig;
+    if (!isEdgeConfig(edgeConfig)) return null;
+    return { edgeConfig, etag: response.headers.get("etag") ?? void 0 };
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_TTL_MS = 60 * 1e3;
+var DEFAULT_MAX_STALE_MS = 24 * 60 * 60 * 1e3;
+var cache2 = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+function cacheKey(apiBaseUrl, counterpartyId) {
+  return `${apiBaseUrl}|${counterpartyId}`;
+}
+function degradeToObserve(config) {
+  if (config.mode !== "enforce" && !config.pathRules.some((r) => r.mode === "enforce")) {
+    return config;
+  }
+  return {
+    ...config,
+    mode: "observe",
+    pathRules: config.pathRules.map((r) => r.mode === "enforce" ? { ...r, mode: "observe" } : r)
+  };
+}
+async function revalidate(config, counterpartyId) {
+  const key = cacheKey(config.apiBaseUrl, counterpartyId);
+  const existing = inflight.get(key);
+  if (existing) return existing;
+  const promise = fetchEdgeConfig(config, counterpartyId, { etag: cache2.get(key)?.etag }).then((result) => {
+    if (result === null) return;
+    const now = Date.now();
+    if ("notModified" in result) {
+      const entry = cache2.get(key);
+      if (entry) entry.lastSuccessAt = now;
+      return;
+    }
+    cache2.set(key, { config: result.edgeConfig, etag: result.etag, lastSuccessAt: now });
+  }).finally(() => {
+    inflight.delete(key);
+  });
+  inflight.set(key, promise);
+  return promise;
+}
+async function getEdgeConfig(config, counterpartyId, opts) {
+  const ttlMs = opts?.ttlMs ?? DEFAULT_TTL_MS;
+  const maxStaleMs = opts?.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
+  const key = cacheKey(config.apiBaseUrl, counterpartyId);
+  const entry = cache2.get(key);
+  if (entry) {
+    const age = Date.now() - entry.lastSuccessAt;
+    if (age > ttlMs) {
+      revalidate(config, counterpartyId).catch(() => {
+      });
+    }
+    return age > maxStaleMs ? degradeToObserve(entry.config) : entry.config;
+  }
+  await revalidate(config, counterpartyId).catch(() => {
+  });
+  return cache2.get(key)?.config ?? DEFAULT_EDGE_CONFIG;
+}
+
+// src/platform-signatures.ts
+var PLATFORM_AGENT_SIGNATURES = [
+  {
+    vendor: "claude",
+    displayName: "Anthropic Claude",
+    uaPatterns: [/claude/i, /anthropic/i],
+    agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i],
+    apiKeyFormatPatterns: [/^sk-ant/i],
+    headerPatterns: [/^anthropic-version/i, /^anthropic-beta/i, /^x-anthropic-/i]
+  },
+  {
+    vendor: "chatgpt",
+    displayName: "OpenAI ChatGPT",
+    uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i],
+    agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i],
+    apiKeyFormatPatterns: [/^sk-proj/i, /^sk-svcacct/i],
+    headerPatterns: [/^openai-organization/i, /^openai-project/i, /^openai-version/i]
+  },
+  {
+    vendor: "gemini",
+    displayName: "Google Gemini",
+    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
+    apiKeyFormatPatterns: [/^aiza/i],
+    headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
+  },
+  {
+    vendor: "cursor",
+    displayName: "Cursor",
+    uaPatterns: [/cursor/i],
+    agentCardPatterns: [/cursor\.sh/i, /cursor\.com/i]
+  },
+  {
+    vendor: "goose",
+    displayName: "Block Goose",
+    uaPatterns: [/goose/i, /block-goose/i],
+    agentCardPatterns: [/block\.xyz\/goose/i, /goose\.tools/i]
+  },
+  {
+    vendor: "perplexity",
+    displayName: "Perplexity",
+    uaPatterns: [/perplexity/i],
+    agentCardPatterns: [/perplexity\.ai/i],
+    apiKeyFormatPatterns: [/^pplx-/i]
+  }
+];
+function matchPlatformSignature(signatures, input) {
+  const ua = input.userAgent ?? "";
+  const cardUrl = input.agentCardUrl ?? "";
+  const apiKeyFormat = input.apiKeyFormat ?? "";
+  const headerLines = [];
+  if (input.platformHeaders) {
+    for (const [name, value] of Object.entries(input.platformHeaders)) {
+      headerLines.push(name, `${name}: ${value}`);
+    }
+  }
+  for (const sig of signatures) {
+    const uaMatch = sig.uaPatterns?.some((p) => p.test(ua));
+    const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));
+    const keyMatch = apiKeyFormat.length > 0 && sig.apiKeyFormatPatterns?.some((p) => p.test(apiKeyFormat));
+    const headerMatch = headerLines.length > 0 && sig.headerPatterns?.some((p) => headerLines.some((line) => p.test(line)));
+    if (uaMatch || cardMatch || keyMatch || headerMatch) {
+      const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
+      const cardHost = (() => {
+        try {
+          return cardUrl ? new URL(cardUrl).host : "";
+        } catch {
+          return "";
+        }
+      })();
+      const keyBasis = uaBase || cardHost || apiKeyFormat || "unknown";
+      return {
+        vendor: sig.vendor,
+        fingerprintKey: `${sig.vendor}:${keyBasis}`,
+        displayName: sig.displayName
+      };
+    }
+  }
+  return void 0;
+}
+function detectPlatformFingerprint(input) {
+  return matchPlatformSignature(PLATFORM_AGENT_SIGNATURES, input);
+}
+
+// src/edge-core/classify.ts
+var STATIC_EXTENSIONS = /\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|pdf|txt|xml)$/i;
+var BOT_UA_PATTERN = /curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i;
+var BROWSER_UA_PATTERN = /mozilla\/\d/i;
+var _patterns = { STATIC_EXTENSIONS, BOT_UA_PATTERN, BROWSER_UA_PATTERN };
+
+// src/edge-core/events.ts
+function sampled(rate, random = Math.random) {
+  if (rate <= 0) return false;
+  if (rate >= 1) return true;
+  return random() < rate;
+}
+
+// src/adapters/anonymous-beacon.ts
+function readHeader(raw, name) {
+  const value = raw[name];
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[0];
+  return void 0;
+}
+function classifyPassThroughTraffic(path, rawHeaders) {
+  if (_patterns.STATIC_EXTENSIONS.test(path)) return { kind: "never" };
+  const credentials = extractCredentials(rawHeaders, {});
+  if (credentials.astraId || credentials.apiKey || credentials.jwt) {
+    return { kind: "never" };
+  }
+  const userAgent = readHeader(rawHeaders, "user-agent") ?? "";
+  const { apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);
+  const fingerprint = detectPlatformFingerprint({ userAgent, apiKeyFormat, platformHeaders });
+  if (fingerprint) {
+    return {
+      kind: "platform",
+      protocol: "platform-ua",
+      evidence: { vendor: fingerprint.vendor, userAgent: userAgent || "(none)" }
+    };
+  }
+  if (!userAgent || _patterns.BOT_UA_PATTERN.test(userAgent) || !_patterns.BROWSER_UA_PATTERN.test(userAgent)) {
+    return {
+      kind: "anonymous-bot",
+      protocol: "ua-heuristic",
+      evidence: { userAgent: userAgent || "(none)" }
+    };
+  }
+  if (!readHeader(rawHeaders, "sec-fetch-mode") && !readHeader(rawHeaders, "accept-language")) {
+    return {
+      kind: "anonymous-bot",
+      protocol: "ua-heuristic",
+      evidence: { userAgent, spoofedBrowser: true }
+    };
+  }
+  return { kind: "never" };
+}
+function createAnonymousBeacon(config, options) {
+  const counterpartyId = config.counterpartyId;
+  if (!counterpartyId) return () => {
+  };
+  const random = options?.random ?? Math.random;
+  let edgeConfig;
+  let refreshing = false;
+  const refreshConfig = () => {
+    if (refreshing) return;
+    refreshing = true;
+    getEdgeConfig(config, counterpartyId).then((cfg) => {
+      edgeConfig = cfg;
+    }).catch(() => {
+    }).finally(() => {
+      refreshing = false;
+    });
+  };
+  refreshConfig();
+  return (input) => {
+    try {
+      refreshConfig();
+      const cfg = edgeConfig;
+      if (!cfg) return;
+      const traffic = classifyPassThroughTraffic(input.requestPath, input.rawHeaders);
+      if (traffic.kind === "never") return;
+      if (traffic.kind === "anonymous-bot" && !sampled(cfg.sampling.anonymousBeaconRate, random)) {
+        return;
+      }
+      const userAgent = readHeader(input.rawHeaders, "user-agent");
+      const xff = input.rawHeaders["x-forwarded-for"];
+      const xffStr = Array.isArray(xff) ? xff.join(", ") : xff;
+      const sourceIp = input.sourceIp ?? xffStr?.split(",")[0]?.trim();
+      reportUnregisteredAttempt(config, {
+        ...input.counterpartyUrl && { counterpartyUrl: input.counterpartyUrl },
+        counterpartyType: options?.counterpartyType ?? config.counterpartyType ?? "api",
+        ...sourceIp && { sourceIp },
+        ...userAgent && { userAgent },
+        requestPath: input.requestPath,
+        requestMethod: input.requestMethod,
+        ...traffic.protocol && { protocol: traffic.protocol },
+        ...traffic.evidence && { evidence: traffic.evidence },
+        observedMetadata: buildSdkObservedMetadata(input.rawHeaders)
+      }).catch(() => {
+      });
+    } catch {
+    }
+  };
+}
 
 // src/adapters/http-pdlss.ts
 var HTTP_METHOD_ACTION_TABLE = {
@@ -982,7 +1385,7 @@ function resolveNextPdlss(request, routeConfig) {
     routeAction: routeConfig?.action
   });
 }
-function generateCommerceShieldHtml(result, options) {
+function generateInterstitialHtml(result, options) {
   const title = escapeHtml(options.commerceShield?.title || "AstraSync Agent Verification");
   const message = escapeHtml(
     options.commerceShield?.message || result.guidance?.message || "This site verifies AI agents before granting access. We noticed you're visiting without AstraSync credentials."
@@ -1138,13 +1541,31 @@ function generateCommerceShieldHtml(result, options) {
 }
 var DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
 function createMiddleware(options) {
+  if ("routes" in options) {
+    console.warn(
+      "[VerificationGateway/Next.js] `routes` is dashboard-managed since v2.9.7; this option is ignored \u2014 configure route policy in your AstraSync dashboard."
+    );
+  }
   const {
     skipPaths = [],
-    showCommerceShield = true,
+    showInterstitial,
+    showCommerceShield,
     enableRuntimeChallenge = true,
     routesRefreshMs = DEFAULT_ROUTES_REFRESH_MS,
+    anonymousBeacon = true,
     ...config
   } = options;
+  const interstitialEnabled = showInterstitial ?? showCommerceShield ?? true;
+  const emitAnonymousBeacon = anonymousBeacon ? createAnonymousBeacon(config, { counterpartyType: config.counterpartyType ?? "website" }) : void 0;
+  const beaconPassThrough = emitAnonymousBeacon ? (request, pathname) => {
+    emitAnonymousBeacon({
+      requestPath: pathname,
+      requestMethod: request.method,
+      counterpartyUrl: config.counterpartyUrl || request.nextUrl.origin,
+      sourceIp: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || void 0,
+      rawHeaders: Object.fromEntries(request.headers.entries())
+    });
+  } : void 0;
   let cachedRoutes = [];
   let lastFetchAt = 0;
   let refreshing = null;
@@ -1186,9 +1607,11 @@ function createMiddleware(options) {
     }
     const routeConfig = findRouteConfig(cachedRoutes, pathname, request.method);
     if (!routeConfig) {
+      beaconPassThrough?.(request, pathname);
       return NextResponse.next();
     }
     if (routeConfig.minAccessLevel === "none") {
+      beaconPassThrough?.(request, pathname);
       return NextResponse.next();
     }
     const credentials = extractCredentialsFromNextRequest(request);
@@ -1240,8 +1663,8 @@ function createMiddleware(options) {
           { status: 403 }
         );
       }
-      if (showCommerceShield) {
-        return new NextResponse(generateCommerceShieldHtml(preCheckResult, options), {
+      if (interstitialEnabled) {
+        return new NextResponse(generateInterstitialHtml(preCheckResult, options), {
           status: 200,
           headers: {
             "Content-Type": "text/html",
@@ -1269,17 +1692,9 @@ function createMiddleware(options) {
         host: request.headers.get("host") || void 0,
         forwardedFor,
         agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0,
-        // Workstream D — full sanitised header capture (Web Headers → plain map).
-        observedMetadata: (() => {
-          const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(
-            Object.fromEntries(request.headers.entries())
-          );
-          return {
-            headers,
-            ...apiKeyFormat && { apiKeyFormat },
-            ...platformHeaders && { platformHeaders }
-          };
-        })()
+        // Workstream D — full sanitised header capture + CDN-derived
+        // connection block (Web Headers → plain map).
+        observedMetadata: buildSdkObservedMetadata(Object.fromEntries(request.headers.entries()))
       }
     };
     let result = await verify(config, verificationRequest);
@@ -1334,8 +1749,8 @@ function createMiddleware(options) {
           }
         );
       }
-      if (showCommerceShield) {
-        return new NextResponse(generateCommerceShieldHtml(result, options), {
+      if (interstitialEnabled) {
+        return new NextResponse(generateInterstitialHtml(result, options), {
           status: 200,
           headers: {
             "Content-Type": "text/html",