@astrasyncai/verification-gateway 4.2.0 → 4.3.0

package/dist/index.mjs

@@ -996,6 +996,34 @@ function extractHttpCredentials(headers) {
   return credentials;
 }
 
+// src/verified-hop.ts
+var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
+var MCP_VERIFIED_HOP_MAX_AGE_MS = 6e4;
+function serializeVerifiedHop(marker) {
+  return `${marker.astraId};${marker.sessionId ?? ""};${marker.checkedAt}`;
+}
+function parseVerifiedHop(value) {
+  if (!value) return null;
+  const parts = value.split(";");
+  if (parts.length !== 3) return null;
+  const [astraId, sessionId, checkedAtRaw] = parts;
+  if (!astraId) return null;
+  const checkedAt = Number(checkedAtRaw);
+  if (!Number.isFinite(checkedAt) || checkedAt <= 0) return null;
+  return {
+    astraId,
+    ...sessionId ? { sessionId } : {},
+    checkedAt
+  };
+}
+function isVerifiedHopValidFor(marker, expectedAstraId, opts = {}) {
+  if (!marker) return false;
+  if (marker.astraId !== expectedAstraId) return false;
+  const maxAge = opts.maxAgeMs ?? MCP_VERIFIED_HOP_MAX_AGE_MS;
+  const now = opts.now ?? Date.now();
+  return now - marker.checkedAt <= maxAge && now >= marker.checkedAt;
+}
+
 // src/adapters/http-pdlss.ts
 var HTTP_METHOD_ACTION_TABLE = {
   GET: "data.read",
@@ -1133,7 +1161,9 @@ var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-astrasync-signature",
   "x-astrasync-secret",
   "x-hub-signature",
-  "x-hub-signature-256"
+  "x-hub-signature-256",
+  // Short-lived verify dedupe token — must never persist in stored metadata.
+  "x-astra-verified-hop"
 ]);
 var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
 var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
@@ -1276,16 +1306,25 @@ var CONNECTION_HEADER_SOURCES = [
     ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
   ],
   ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
+  ["countryRegionName", ["cloudfront-viewer-country-region-name"]],
   ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
   ["asn", ["cloudfront-viewer-asn"]],
   ["tlsVersion", ["cloudfront-viewer-tls"]],
   ["httpVersion", ["cloudfront-viewer-http-version"]],
+  ["timeZone", ["x-vercel-ip-timezone", "cloudfront-viewer-time-zone"]],
+  ["metroCode", ["cloudfront-viewer-metro-code"]],
   // TLS fingerprints can only be computed where TLS terminates. When a CDN
   // terminates TLS in front of the merchant, its fingerprint headers ARE the
   // connection-layer truth — normalising them here is the permanent design.
-  ["tlsFingerprint", ["cf-ja3-hash"]],
-  ["ja4", ["cf-ja4"]]
+  // CloudFront delivers JA3/JA4 only via an origin request policy and only
+  // for HTTPS viewer connections.
+  ["tlsFingerprint", ["cf-ja3-hash", "cloudfront-viewer-ja3-fingerprint"]],
+  ["ja4", ["cf-ja4", "cloudfront-viewer-ja4-fingerprint"]],
+  // Header-structure fingerprint: browser/SDK-distinctive header ordering.
+  ["headerOrder", ["cloudfront-viewer-header-order"]],
+  ["headerCount", ["cloudfront-viewer-header-count"]]
 ];
+var MAX_CONNECTION_VALUE_CHARS = 256;
 function deriveConnectionFromHeaders(headers) {
   if (!headers) return void 0;
   const lower = {};
@@ -1298,11 +1337,15 @@ function deriveConnectionFromHeaders(headers) {
     for (const source of sources) {
       const value = lower[source]?.trim();
       if (value) {
-        connection[key] = value;
+        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);
         break;
       }
     }
   }
+  if (!connection.ip) {
+    const addr = lower["cloudfront-viewer-address"]?.trim();
+    if (addr) connection.ip = addr.replace(/:\d+$/, "");
+  }
   if (!connection.ip) {
     const xff = lower["x-forwarded-for"];
     const client = xff?.split(",")[0]?.trim();
@@ -1757,6 +1800,8 @@ function createMiddleware(options) {
     failOnError = "open",
     caseInsensitiveRouteMatch = false,
     anonymousBeacon = true,
+    trustVerifiedHop = false,
+    verifiedHopMaxAgeMs,
     ...config
   } = options;
   if (config.apiBaseUrl) {
@@ -1849,6 +1894,16 @@ function createMiddleware(options) {
         beaconPassThrough?.(req);
         return next();
       }
+      if (trustVerifiedHop && credentials.astraId) {
+        const hopRaw = req.headers[MCP_VERIFIED_HOP_HEADER.toLowerCase()];
+        const hopValue = typeof hopRaw === "string" ? hopRaw : Array.isArray(hopRaw) ? hopRaw[0] : void 0;
+        const marker = parseVerifiedHop(hopValue);
+        if (isVerifiedHopValidFor(marker, credentials.astraId, {
+          ...verifiedHopMaxAgeMs !== void 0 ? { maxAgeMs: verifiedHopMaxAgeMs } : {}
+        })) {
+          return next();
+        }
+      }
       const pdlssPair = resolveRequestPdlss(
         req,
         routeConfig,
@@ -2304,6 +2359,8 @@ function createMiddleware2(options) {
     enableRuntimeChallenge = true,
     routesRefreshMs = DEFAULT_ROUTES_REFRESH_MS2,
     anonymousBeacon = true,
+    trustVerifiedHop = false,
+    verifiedHopMaxAgeMs,
     ...config
   } = options;
   const interstitialEnabled = showInterstitial ?? showCommerceShield ?? true;
@@ -2366,6 +2423,14 @@ function createMiddleware2(options) {
       return NextResponse.next();
     }
     const credentials = extractCredentialsFromNextRequest(request);
+    if (trustVerifiedHop && credentials.astraId) {
+      const marker = parseVerifiedHop(request.headers.get(MCP_VERIFIED_HOP_HEADER) ?? void 0);
+      if (isVerifiedHopValidFor(marker, credentials.astraId, {
+        ...verifiedHopMaxAgeMs !== void 0 ? { maxAgeMs: verifiedHopMaxAgeMs } : {}
+      })) {
+        return NextResponse.next();
+      }
+    }
     const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;
     const pdlssPair = resolveNextPdlss(request, routeConfig);
     const purpose = pdlssPair.purpose;
@@ -3473,7 +3538,7 @@ function coerceString3(v) {
 }
 
 // src/transport/vi.ts
-import { splitSdJwt, decodeSdJwtSync } from "@sd-jwt/decode";
+import { splitSdJwt, decodeSdJwtSync } from "@sd-jwt/core";
 import { createHash } from "crypto";
 function extractVIClaims(sdJwtCompact) {
   if (!sdJwtCompact || typeof sdJwtCompact !== "string") return null;
@@ -3866,7 +3931,7 @@ var claim = {
 };
 
 // src/transport/ap2.ts
-import { decodeSdJwtSync as decodeSdJwtSync2 } from "@sd-jwt/decode";
+import { decodeSdJwtSync as decodeSdJwtSync2 } from "@sd-jwt/core";
 import { createHash as createHash2 } from "crypto";
 function extractAP2Mandate(sdJwtCompact) {
   if (!sdJwtCompact || typeof sdJwtCompact !== "string") return null;
@@ -5257,32 +5322,6 @@ function extractCredentialsFromProtocol(protocol, context) {
 }
 
 // src/transport/mcp-server.ts
-var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
-var MCP_VERIFIED_HOP_MAX_AGE_MS = 6e4;
-function serializeVerifiedHop(marker) {
-  return `${marker.astraId};${marker.sessionId ?? ""};${marker.checkedAt}`;
-}
-function parseVerifiedHop(value) {
-  if (!value) return null;
-  const parts = value.split(";");
-  if (parts.length !== 3) return null;
-  const [astraId, sessionId, checkedAtRaw] = parts;
-  if (!astraId) return null;
-  const checkedAt = Number(checkedAtRaw);
-  if (!Number.isFinite(checkedAt) || checkedAt <= 0) return null;
-  return {
-    astraId,
-    ...sessionId ? { sessionId } : {},
-    checkedAt
-  };
-}
-function isVerifiedHopValidFor(marker, expectedAstraId, opts = {}) {
-  if (!marker) return false;
-  if (marker.astraId !== expectedAstraId) return false;
-  const maxAge = opts.maxAgeMs ?? MCP_VERIFIED_HOP_MAX_AGE_MS;
-  const now = opts.now ?? Date.now();
-  return now - marker.checkedAt <= maxAge && now >= marker.checkedAt;
-}
 function parseMcpJsonRpc(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const obj = body;