@astrasyncai/verification-gateway 4.2.0 → 4.3.0

package/dist/adapters/nextjs.d.mts

@@ -1,4 +1,4 @@
 import 'next/server';
-import '../types-r850cOt0.mjs';
-export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-WyeVr2Kp.mjs';
+import '../types-C0zfSXMB.mjs';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-DlX6xwbU.mjs';
 import '../metadata-capture.mjs';

package/dist/adapters/nextjs.d.ts

@@ -1,4 +1,4 @@
 import 'next/server';
-import '../types-sMxBT-nM.js';
-export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-w7RTbP1P.js';
+import '../types-DwSfO7Sb.js';
+export { c as createMatcherConfig, a as createMiddleware } from '../nextjs-DL6uE1ye.js';
 import '../metadata-capture.js';

package/dist/adapters/nextjs.js

@@ -778,7 +778,9 @@ var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-astrasync-signature",
   "x-astrasync-secret",
   "x-hub-signature",
-  "x-hub-signature-256"
+  "x-hub-signature-256",
+  // Short-lived verify dedupe token — must never persist in stored metadata.
+  "x-astra-verified-hop"
 ]);
 var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
 var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
@@ -913,16 +915,25 @@ var CONNECTION_HEADER_SOURCES = [
     ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
   ],
   ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
+  ["countryRegionName", ["cloudfront-viewer-country-region-name"]],
   ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
   ["asn", ["cloudfront-viewer-asn"]],
   ["tlsVersion", ["cloudfront-viewer-tls"]],
   ["httpVersion", ["cloudfront-viewer-http-version"]],
+  ["timeZone", ["x-vercel-ip-timezone", "cloudfront-viewer-time-zone"]],
+  ["metroCode", ["cloudfront-viewer-metro-code"]],
   // TLS fingerprints can only be computed where TLS terminates. When a CDN
   // terminates TLS in front of the merchant, its fingerprint headers ARE the
   // connection-layer truth — normalising them here is the permanent design.
-  ["tlsFingerprint", ["cf-ja3-hash"]],
-  ["ja4", ["cf-ja4"]]
+  // CloudFront delivers JA3/JA4 only via an origin request policy and only
+  // for HTTPS viewer connections.
+  ["tlsFingerprint", ["cf-ja3-hash", "cloudfront-viewer-ja3-fingerprint"]],
+  ["ja4", ["cf-ja4", "cloudfront-viewer-ja4-fingerprint"]],
+  // Header-structure fingerprint: browser/SDK-distinctive header ordering.
+  ["headerOrder", ["cloudfront-viewer-header-order"]],
+  ["headerCount", ["cloudfront-viewer-header-count"]]
 ];
+var MAX_CONNECTION_VALUE_CHARS = 256;
 function deriveConnectionFromHeaders(headers) {
   if (!headers) return void 0;
   const lower = {};
@@ -935,11 +946,15 @@ function deriveConnectionFromHeaders(headers) {
     for (const source of sources) {
       const value = lower[source]?.trim();
       if (value) {
-        connection[key] = value;
+        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);
         break;
       }
     }
   }
+  if (!connection.ip) {
+    const addr = lower["cloudfront-viewer-address"]?.trim();
+    if (addr) connection.ip = addr.replace(/:\d+$/, "");
+  }
   if (!connection.ip) {
     const xff = lower["x-forwarded-for"];
     const client = xff?.split(",")[0]?.trim();
@@ -1352,6 +1367,31 @@ function annotateApprovalRequired(result) {
   result.denialReasons = [APPROVAL_REASON, ...result.denialReasons ?? []];
 }
 
+// src/verified-hop.ts
+var MCP_VERIFIED_HOP_HEADER = "X-Astra-Verified-Hop";
+var MCP_VERIFIED_HOP_MAX_AGE_MS = 6e4;
+function parseVerifiedHop(value) {
+  if (!value) return null;
+  const parts = value.split(";");
+  if (parts.length !== 3) return null;
+  const [astraId, sessionId, checkedAtRaw] = parts;
+  if (!astraId) return null;
+  const checkedAt = Number(checkedAtRaw);
+  if (!Number.isFinite(checkedAt) || checkedAt <= 0) return null;
+  return {
+    astraId,
+    ...sessionId ? { sessionId } : {},
+    checkedAt
+  };
+}
+function isVerifiedHopValidFor(marker, expectedAstraId, opts = {}) {
+  if (!marker) return false;
+  if (marker.astraId !== expectedAstraId) return false;
+  const maxAge = opts.maxAgeMs ?? MCP_VERIFIED_HOP_MAX_AGE_MS;
+  const now = opts.now ?? Date.now();
+  return now - marker.checkedAt <= maxAge && now >= marker.checkedAt;
+}
+
 // src/adapters/nextjs.ts
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -1590,6 +1630,8 @@ function createMiddleware(options) {
     enableRuntimeChallenge = true,
     routesRefreshMs = DEFAULT_ROUTES_REFRESH_MS,
     anonymousBeacon = true,
+    trustVerifiedHop = false,
+    verifiedHopMaxAgeMs,
     ...config
   } = options;
   const interstitialEnabled = showInterstitial ?? showCommerceShield ?? true;
@@ -1652,6 +1694,14 @@ function createMiddleware(options) {
       return NextResponse.next();
     }
     const credentials = extractCredentialsFromNextRequest(request);
+    if (trustVerifiedHop && credentials.astraId) {
+      const marker = parseVerifiedHop(request.headers.get(MCP_VERIFIED_HOP_HEADER) ?? void 0);
+      if (isVerifiedHopValidFor(marker, credentials.astraId, {
+        ...verifiedHopMaxAgeMs !== void 0 ? { maxAgeMs: verifiedHopMaxAgeMs } : {}
+      })) {
+        return NextResponse.next();
+      }
+    }
     const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;
     const pdlssPair = resolveNextPdlss(request, routeConfig);
     const purpose = pdlssPair.purpose;