@astrasyncai/verification-gateway 4.3.0 → 4.5.0

package/dist/metadata-capture.d.mts

@@ -62,6 +62,21 @@ interface ObservedMetadata {
      * absent when neither source had anything.
      */
     connection?: Record<string, string>;
+    /**
+     * Number of cookie pairs the caller sent. The `cookie` header VALUE is a
+     * secret and is always dropped; the COUNT is a client-shape signal
+     * (browsers carry cookies, most automation carries none) that would
+     * otherwise be unobservable downstream. Absent when no cookie header
+     * arrived.
+     */
+    cookieCount?: number;
+    /**
+     * Query-string parameter NAMES (deduped, lowercased) — values are NEVER
+     * captured (they routinely carry OAuth codes, tokens, and PII, and no
+     * deny-list is complete). Names alone fingerprint client shape. Populated
+     * by the edge path, which sees the raw query string.
+     */
+    queryKeys?: string[];
     /**
      * Version of the capture semantics this object was produced under — see
      * {@link CAPTURE_SCHEMA_VERSION}. Optional for backward compatibility with
@@ -77,6 +92,8 @@ interface SanitizeHeadersResult {
     headers: Record<string, string>;
     apiKeyFormat?: string;
     platformHeaders?: Record<string, string>;
+    /** Cookie-pair count; the cookie value itself is always dropped. */
+    cookieCount?: number;
 }
 /** Size caps — the only guard against jsonb bloat from a hostile POST. */
 declare const MAX_HEADERS = 64;

package/dist/metadata-capture.d.ts

@@ -62,6 +62,21 @@ interface ObservedMetadata {
      * absent when neither source had anything.
      */
     connection?: Record<string, string>;
+    /**
+     * Number of cookie pairs the caller sent. The `cookie` header VALUE is a
+     * secret and is always dropped; the COUNT is a client-shape signal
+     * (browsers carry cookies, most automation carries none) that would
+     * otherwise be unobservable downstream. Absent when no cookie header
+     * arrived.
+     */
+    cookieCount?: number;
+    /**
+     * Query-string parameter NAMES (deduped, lowercased) — values are NEVER
+     * captured (they routinely carry OAuth codes, tokens, and PII, and no
+     * deny-list is complete). Names alone fingerprint client shape. Populated
+     * by the edge path, which sees the raw query string.
+     */
+    queryKeys?: string[];
     /**
      * Version of the capture semantics this object was produced under — see
      * {@link CAPTURE_SCHEMA_VERSION}. Optional for backward compatibility with
@@ -77,6 +92,8 @@ interface SanitizeHeadersResult {
     headers: Record<string, string>;
     apiKeyFormat?: string;
     platformHeaders?: Record<string, string>;
+    /** Cookie-pair count; the cookie value itself is always dropped. */
+    cookieCount?: number;
 }
 /** Size caps — the only guard against jsonb bloat from a hostile POST. */
 declare const MAX_HEADERS = 64;

package/dist/metadata-capture.js

@@ -68,7 +68,13 @@ var PLATFORM_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-agent-card-url",
   "x-agent-provider"
 ]);
-var PLATFORM_HEADER_PREFIXES = ["x-goog-", "x-stainless-", "x-anthropic-", "x-openai-"];
+var PLATFORM_HEADER_PREFIXES = [
+  "x-goog-",
+  "x-stainless-",
+  "x-anthropic-",
+  "x-openai-",
+  "sec-ch-"
+];
 var KEY_FORMAT_PREFIXES = [
   "sk-ant-api03",
   "sk-ant-api",
@@ -140,6 +146,7 @@ function sanitizeHeaders(raw) {
   const headers = {};
   const platformHeaders = {};
   let apiKeyFormat;
+  let cookieCount;
   let totalBytes = 0;
   let count = 0;
   if (!raw) return { headers };
@@ -154,6 +161,9 @@ function sanitizeHeaders(raw) {
       if (fmt && !apiKeyFormat) apiKeyFormat = fmt;
       continue;
     }
+    if (name === "cookie") {
+      cookieCount = joined.split(";").filter((s) => s.trim().length > 0).length;
+    }
     if (isSecretHeader(name)) continue;
     let value = joined;
     if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {
@@ -169,6 +179,7 @@ function sanitizeHeaders(raw) {
   const result = { headers };
   if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;
   if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
+  if (cookieCount !== void 0) result.cookieCount = cookieCount;
   return result;
 }
 function extractPlatformHeaders(sanitized) {
@@ -188,6 +199,9 @@ var CONNECTION_HEADER_SOURCES = [
   ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
   ["countryRegionName", ["cloudfront-viewer-country-region-name"]],
   ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
+  ["latitude", ["x-vercel-ip-latitude", "cloudfront-viewer-latitude"]],
+  ["longitude", ["x-vercel-ip-longitude", "cloudfront-viewer-longitude"]],
+  ["postalCode", ["x-vercel-ip-postal-code", "cloudfront-viewer-postal-code"]],
   ["asn", ["cloudfront-viewer-asn"]],
   ["tlsVersion", ["cloudfront-viewer-tls"]],
   ["httpVersion", ["cloudfront-viewer-http-version"]],
@@ -222,19 +236,25 @@ function deriveConnectionFromHeaders(headers) {
       }
     }
   }
-  if (!connection.ip) {
+  {
     const addr = lower["cloudfront-viewer-address"]?.trim();
-    if (addr) connection.ip = addr.replace(/:\d+$/, "");
+    const portMatch = addr?.match(/:(\d+)$/);
+    if (portMatch) connection.sourcePort = portMatch[1];
+    if (!connection.ip && addr) connection.ip = addr.replace(/:\d+$/, "");
   }
   if (!connection.ip) {
     const xff = lower["x-forwarded-for"];
     const client = xff?.split(",")[0]?.trim();
     if (client) connection.ip = client;
   }
+  if (!connection.tlsCipher) {
+    const cipher = connection.tlsVersion?.split(":")[1];
+    if (cipher) connection.tlsCipher = cipher;
+  }
   return Object.keys(connection).length > 0 ? connection : void 0;
 }
 function buildSdkObservedMetadata(rawHeaders) {
-  const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);
+  const { headers, apiKeyFormat, platformHeaders, cookieCount } = sanitizeHeaders(rawHeaders);
   const flat = {};
   if (rawHeaders) {
     for (const name of Object.keys(rawHeaders)) {
@@ -249,6 +269,7 @@ function buildSdkObservedMetadata(rawHeaders) {
     ...apiKeyFormat && { apiKeyFormat },
     ...platformHeaders && { platformHeaders },
     ...connection && { connection },
+    ...cookieCount !== void 0 && { cookieCount },
     schemaVersion: CAPTURE_SCHEMA_VERSION
   };
 }

package/dist/metadata-capture.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/metadata-capture.ts"],"sourcesContent":["/**\n * Maximal metadata capture — the shared, edge-safe sanitiser.\n *\n * AstraSync's thesis is total metadata capture: every header and connection\n * signal an inbound agent presents is a signal we want to keep. This module is\n * the ONE place that decides what is safe to store verbatim, what is a secret\n * to drop, and what credential headers reduce to a safe *format prefix* (a\n * platform signal, never the secret itself).\n *\n * It runs in three places that must agree byte-for-byte:\n *   - the edge adapter (`@astrasyncai/adapter-lambda`) — the richest capture\n *     point (full CloudFront header arrays),\n *   - the SDK adapters (express / nextjs) — for SDK-only merchants with no edge,\n *   - (indirectly) the backend, which stores whatever the above forward.\n *\n * Pure — no Node built-ins, no I/O — so it is safe in Lambda@Edge, the browser\n * build, and Deno. Capture is cheap: at the edge and SDK it is local string\n * work, and the backend stores it on a fire-and-forget event insert, so it adds\n * ZERO verify-access decision latency. Detection (which few signals imply which\n * vendor) is a separate, curated concern — see `platform-signatures.ts`.\n */\n\n/**\n * Version of the capture semantics (what is kept, dropped, reduced, or\n * derived — and under which key names).\n *\n * Capture semantics are FROZEN within a package major version: a given\n * `schemaVersion` always means the same field vocabulary and the same\n * keep/drop/reduce rules. The number bumps only on a SEMANTIC change to\n * capture (a renamed key, a changed reduction rule) — never for additive\n * signals, and never merely because the package version moved. To tell\n * builds apart, use the `sdkVersion` already present on the verify body;\n * `schemaVersion` answers the different question \"how do I interpret this\n * stored metadata?\".\n */\nexport const CAPTURE_SCHEMA_VERSION = 1;\n\n/**\n * The captured, sanitised view of an inbound agent's request metadata. Attached\n * to verify-access / beacon payloads as `callerMetadata.observedMetadata`.\n */\nexport interface ObservedMetadata {\n  /** Header name → value, secrets removed, verbatim otherwise. */\n  headers: Record<string, string>;\n  /**\n   * Safe key-format prefix of a credential header (e.g. `sk-ant-api03`,\n   * `sk-proj`, `AIza`) — a platform signal, NEVER the secret. Absent if no\n   * credential header was present or none matched a known format.\n   */\n  apiKeyFormat?: string;\n  /**\n   * The subset of `headers` that are known platform-signal headers\n   * (`openai-organization`, `x-goog-user-project`, `anthropic-version`, …),\n   * pulled out for convenient detection + display. Values are the same\n   * sanitised strings as in `headers`.\n   */\n  platformHeaders?: Record<string, string>;\n  /**\n   * Connection-layer signals (IP, ASN, country, TLS version, HTTP version,\n   * device class, TLS fingerprint). Edge adapters populate this from the\n   * platform's native connection surface — the authoritative source. SDK\n   * adapters populate it as a fallback via {@link deriveConnectionFromHeaders}\n   * when a CDN in front of the merchant injected the equivalent headers;\n   * absent when neither source had anything.\n   */\n  connection?: Record<string, string>;\n  /**\n   * Version of the capture semantics this object was produced under — see\n   * {@link CAPTURE_SCHEMA_VERSION}. Optional for backward compatibility with\n   * metadata captured before the field existed.\n   */\n  schemaVersion?: number;\n}\n\n/**\n * Result of sanitising a raw header map. `headers` is always present (possibly\n * empty); `apiKeyFormat` / `platformHeaders` only when a signal was found.\n */\nexport interface SanitizeHeadersResult {\n  headers: Record<string, string>;\n  apiKeyFormat?: string;\n  platformHeaders?: Record<string, string>;\n}\n\n/**\n * Header names dropped entirely — genuine secrets or our own credentials that\n * describe the request's transport, not the agent. Matched case-insensitively\n * on the exact header name.\n */\nconst SECRET_HEADER_NAMES = new Set([\n  'cookie',\n  'set-cookie',\n  'x-csrf-token',\n  'proxy-authorization',\n  'x-astrasync-signature',\n  'x-astrasync-secret',\n  'x-hub-signature',\n  'x-hub-signature-256',\n  // Short-lived verify dedupe token — must never persist in stored metadata.\n  'x-astra-verified-hop',\n]);\n\n/**\n * Header-name prefixes dropped entirely — our own credential / signing surface\n * (`x-astrasync-*`, `kya-*`) must never round-trip into stored metadata.\n */\nconst SECRET_HEADER_PREFIXES = ['x-astrasync-', 'kya-', 'kya_'];\n\n/**\n * Credential headers whose VALUE is a secret but whose FORMAT is a signal. We\n * keep the leading format prefix (up to the random tail) and drop the rest.\n */\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'x-api-key',\n  'x-goog-api-key',\n  'api-key',\n]);\n\n/**\n * Header names that carry a raw signature value (drop the value; the presence\n * is not worth a bloat risk). Matched as a suffix so `x-*-signature` variants\n * are covered without an exhaustive list.\n */\nfunction isSignatureHeader(name: string): boolean {\n  return name === 'signature' || name.endsWith('-signature') || name.endsWith('-signature-256');\n}\n\n/**\n * Known platform-signal headers — pulled into `platformHeaders` for convenient\n * detection + display. Exact names plus a few prefixes (`x-goog-`,\n * `x-stainless-` — the OpenAI/Anthropic SDK client fingerprint headers).\n */\nconst PLATFORM_HEADER_NAMES = new Set([\n  'openai-organization',\n  'openai-project',\n  'openai-version',\n  'openai-processing-ms',\n  'anthropic-version',\n  'anthropic-beta',\n  'x-goog-user-project',\n  'x-goog-api-client',\n  'user-agent',\n  'x-agent-card-url',\n  'x-agent-provider',\n]);\nconst PLATFORM_HEADER_PREFIXES = ['x-goog-', 'x-stainless-', 'x-anthropic-', 'x-openai-'];\n\n/**\n * Known API-key format prefixes, longest-first so `sk-ant-api03` wins over\n * `sk-ant` and `sk-`. Each is the SAFE, non-secret leading token of a\n * credential; the random tail is never captured.\n */\nconst KEY_FORMAT_PREFIXES = [\n  'sk-ant-api03',\n  'sk-ant-api',\n  'sk-ant',\n  'sk-proj',\n  'sk-svcacct',\n  'sk-or-v1',\n  'sk-or',\n  'sk-lf',\n  'sk-',\n  'gsk_',\n  'aiza',\n  'ya29',\n  'ghp_',\n  'gho_',\n  'github_pat_',\n  'xai-',\n  'pplx-',\n  'r8_',\n  'hf_',\n  'astra-',\n  'astrae-',\n];\n\n/** Size caps — the only guard against jsonb bloat from a hostile POST. */\nexport const MAX_HEADERS = 64;\nexport const MAX_HEADER_VALUE_BYTES = 1024;\nexport const MAX_TOTAL_BYTES = 16 * 1024;\n\nfunction byteLength(s: string): number {\n  // Edge-safe (no Buffer): count UTF-8 bytes without allocating a Buffer.\n  let bytes = 0;\n  for (let i = 0; i < s.length; i++) {\n    const code = s.charCodeAt(i);\n    if (code < 0x80) bytes += 1;\n    else if (code < 0x800) bytes += 2;\n    else if (code >= 0xd800 && code <= 0xdbff) {\n      bytes += 4;\n      i++; // surrogate pair\n    } else bytes += 3;\n  }\n  return bytes;\n}\n\n/**\n * Extract the safe key-format prefix from a credential header value. Strips a\n * leading `Bearer ` / `Basic ` scheme, then returns the longest known prefix\n * that the (lowercased) value starts with. Returns undefined for opaque values\n * (e.g. a bare UUID token) so we never guess a format we don't recognise.\n */\nexport function extractApiKeyFormat(rawValue: string): string | undefined {\n  if (!rawValue) return undefined;\n  let value = rawValue.trim();\n  const spaceIdx = value.indexOf(' ');\n  if (spaceIdx > 0) {\n    const scheme = value.slice(0, spaceIdx).toLowerCase();\n    if (scheme === 'bearer' || scheme === 'basic' || scheme === 'token') {\n      value = value.slice(spaceIdx + 1).trim();\n    }\n  }\n  const lower = value.toLowerCase();\n  for (const prefix of KEY_FORMAT_PREFIXES) {\n    if (lower.startsWith(prefix)) {\n      // Return the prefix as-declared in the list (canonical casing).\n      return prefix;\n    }\n  }\n  return undefined;\n}\n\nfunction isSecretHeader(name: string): boolean {\n  if (SECRET_HEADER_NAMES.has(name)) return true;\n  if (SECRET_HEADER_PREFIXES.some((p) => name.startsWith(p))) return true;\n  if (isSignatureHeader(name)) return true;\n  return false;\n}\n\nfunction isPlatformHeader(name: string): boolean {\n  if (PLATFORM_HEADER_NAMES.has(name)) return true;\n  return PLATFORM_HEADER_PREFIXES.some((p) => name.startsWith(p));\n}\n\n/**\n * Sanitise a raw header map for storage. Deny-lists genuine secrets, reduces\n * credential headers to a safe format prefix, keeps everything else verbatim,\n * and enforces the size caps that bound jsonb growth.\n *\n * Accepts any string→(string|string[]|undefined) map (Node's `req.headers`,\n * CloudFront's flattened headers, a plain object). Multi-value headers are\n * joined with `, ` per RFC 7230.\n */\nexport function sanitizeHeaders(\n  raw: Record<string, string | string[] | undefined> | undefined | null\n): SanitizeHeadersResult {\n  const headers: Record<string, string> = {};\n  const platformHeaders: Record<string, string> = {};\n  let apiKeyFormat: string | undefined;\n  let totalBytes = 0;\n  let count = 0;\n\n  if (!raw) return { headers };\n\n  for (const rawName of Object.keys(raw)) {\n    if (count >= MAX_HEADERS) break;\n    const name = rawName.toLowerCase();\n    const rawValue = raw[rawName];\n    if (rawValue === undefined) continue;\n    const joined = Array.isArray(rawValue) ? rawValue.join(', ') : String(rawValue);\n\n    // Credential headers: capture the format prefix, drop the secret.\n    if (CREDENTIAL_HEADER_NAMES.has(name)) {\n      const fmt = extractApiKeyFormat(joined);\n      if (fmt && !apiKeyFormat) apiKeyFormat = fmt;\n      continue;\n    }\n\n    // Genuine secrets: drop entirely.\n    if (isSecretHeader(name)) continue;\n\n    // Everything else describing the agent: keep, bounded.\n    let value = joined;\n    if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {\n      value = value.slice(0, MAX_HEADER_VALUE_BYTES);\n    }\n    const entryBytes = byteLength(name) + byteLength(value);\n    if (totalBytes + entryBytes > MAX_TOTAL_BYTES) continue;\n    totalBytes += entryBytes;\n    count++;\n    headers[name] = value;\n    if (isPlatformHeader(name)) platformHeaders[name] = value;\n  }\n\n  const result: SanitizeHeadersResult = { headers };\n  if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;\n  if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;\n  return result;\n}\n\n/**\n * Pull the known platform-signal headers out of an ALREADY-sanitised header\n * map. `sanitizeHeaders` already computes this as a by-product; this standalone\n * form is exported for call-sites (edge, tests) that hold a sanitised map and\n * want only the platform subset. Never re-run over raw (unsanitised) headers.\n */\nexport function extractPlatformHeaders(\n  sanitized: Record<string, string> | undefined | null\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!sanitized) return out;\n  for (const name of Object.keys(sanitized)) {\n    if (isPlatformHeader(name.toLowerCase())) out[name.toLowerCase()] = sanitized[name];\n  }\n  return out;\n}\n\n/**\n * Precedence-ordered CDN header sources for each derived `connection` key.\n * First present header wins; the special `x-forwarded-for` source takes the\n * LEFTMOST (client) entry of the comma-separated chain.\n */\nconst CONNECTION_HEADER_SOURCES: ReadonlyArray<readonly [key: string, headers: readonly string[]]> =\n  [\n    ['ip', ['cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-real-ip']],\n    [\n      'country',\n      ['cf-ipcountry', 'x-vercel-ip-country', 'cloudfront-viewer-country', 'fastly-geo-country'],\n    ],\n    ['region', ['x-vercel-ip-country-region', 'cloudfront-viewer-country-region']],\n    ['countryRegionName', ['cloudfront-viewer-country-region-name']],\n    ['city', ['x-vercel-ip-city', 'cloudfront-viewer-city']],\n    ['asn', ['cloudfront-viewer-asn']],\n    ['tlsVersion', ['cloudfront-viewer-tls']],\n    ['httpVersion', ['cloudfront-viewer-http-version']],\n    ['timeZone', ['x-vercel-ip-timezone', 'cloudfront-viewer-time-zone']],\n    ['metroCode', ['cloudfront-viewer-metro-code']],\n    // TLS fingerprints can only be computed where TLS terminates. When a CDN\n    // terminates TLS in front of the merchant, its fingerprint headers ARE the\n    // connection-layer truth — normalising them here is the permanent design.\n    // CloudFront delivers JA3/JA4 only via an origin request policy and only\n    // for HTTPS viewer connections.\n    ['tlsFingerprint', ['cf-ja3-hash', 'cloudfront-viewer-ja3-fingerprint']],\n    ['ja4', ['cf-ja4', 'cloudfront-viewer-ja4-fingerprint']],\n    // Header-structure fingerprint: browser/SDK-distinctive header ordering.\n    ['headerOrder', ['cloudfront-viewer-header-order']],\n    ['headerCount', ['cloudfront-viewer-header-count']],\n  ];\n\n/**\n * Backend bound: observedMetadata.connection values longer than this fail\n * the platform's zod parse outright (boundedStringRecord(32, 256)), so every\n * emitter truncates — headerOrder routinely exceeds it.\n */\nexport const MAX_CONNECTION_VALUE_CHARS = 256;\n\n/**\n * Derive the connection-layer block from CDN-injected request headers.\n *\n * When a merchant's SDK-gated origin sits behind a CDN (Cloudflare, Fastly,\n * Vercel, CloudFront), the CDN has already seen the connection layer and\n * injected it as headers. This promotes those headers to the same\n * `connection` keys the edge adapters populate natively, so SDK-only\n * deployments still get IP / geo / TLS attribution. Precedence per key:\n *\n * - `ip`: `cf-connecting-ip` > `fastly-client-ip` > `true-client-ip` >\n *   `x-real-ip` > `cloudfront-viewer-address` (port stripped) > leftmost\n *   `x-forwarded-for`\n * - `country`: `cf-ipcountry` > `x-vercel-ip-country` >\n *   `cloudfront-viewer-country` > `fastly-geo-country`\n * - `region` / `city` / `timeZone`: Vercel then CloudFront viewer headers\n * - `countryRegionName` / `asn` / `tlsVersion` / `httpVersion` /\n *   `metroCode` / `headerOrder` / `headerCount`: `cloudfront-viewer-*`\n * - `tlsFingerprint`: `cf-ja3-hash` > `cloudfront-viewer-ja3-fingerprint`\n * - `ja4`: `cf-ja4` > `cloudfront-viewer-ja4-fingerprint`\n *\n * All keys are additive under `schemaVersion` 1 (the frozen-capture doctrine\n * bumps only for changed semantics, never for additive signals). Values are\n * truncated to MAX_CONNECTION_VALUE_CHARS — the platform's hard bound.\n *\n * Edge adapters keep their richer native collectors — native platform\n * signals are authoritative; this header derivation is the SDK-level\n * fallback. Header names are matched case-insensitively. Returns undefined\n * when no source header is present, so the `connection` key is simply\n * omitted (matching edge behaviour).\n */\nexport function deriveConnectionFromHeaders(\n  headers: Record<string, string> | undefined | null\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  const lower: Record<string, string> = {};\n  for (const name of Object.keys(headers)) {\n    const value = headers[name];\n    if (typeof value === 'string' && value.length > 0) lower[name.toLowerCase()] = value;\n  }\n\n  const connection: Record<string, string> = {};\n  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {\n    for (const source of sources) {\n      const value = lower[source]?.trim();\n      if (value) {\n        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);\n        break;\n      }\n    }\n  }\n  // ip fallback 1: cloudfront-viewer-address arrives as ip:port — strip the\n  // trailing port only (IPv6-safe), unlike the dedicated client-ip headers.\n  if (!connection.ip) {\n    const addr = lower['cloudfront-viewer-address']?.trim();\n    if (addr) connection.ip = addr.replace(/:\\d+$/, '');\n  }\n  // ip fallback 2: leftmost (client) hop of the x-forwarded-for chain.\n  if (!connection.ip) {\n    const xff = lower['x-forwarded-for'];\n    const client = xff?.split(',')[0]?.trim();\n    if (client) connection.ip = client;\n  }\n\n  return Object.keys(connection).length > 0 ? connection : undefined;\n}\n\n/**\n * The FULL metadata capture for one request at an SDK adapter (express /\n * nextjs / mcp): sanitised headers, the safe credential format prefix, the\n * platform-signal subset, the CDN-derived connection block, and the capture\n * schema version. This is the ONE builder all SDK adapters share, so their\n * verify-access bodies agree byte-for-byte.\n *\n * Connection derivation runs over the RAW header map (pre-cap) — the size\n * caps guard storage growth and must never hide a geo/IP header that\n * happened to arrive late in an oversized map.\n */\nexport function buildSdkObservedMetadata(\n  rawHeaders: Record<string, string | string[] | undefined> | undefined | null\n): ObservedMetadata {\n  const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);\n  const flat: Record<string, string> = {};\n  if (rawHeaders) {\n    for (const name of Object.keys(rawHeaders)) {\n      const value = rawHeaders[name];\n      if (value === undefined) continue;\n      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(', ') : String(value);\n    }\n  }\n  const connection = deriveConnectionFromHeaders(flat);\n  return {\n    headers,\n    ...(apiKeyFormat && { apiKeyFormat }),\n    ...(platformHeaders && { platformHeaders }),\n    ...(connection && { connection }),\n    schemaVersion: CAPTURE_SCHEMA_VERSION,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmCO,IAAM,yBAAyB;AAsDtC,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AACF,CAAC;AAMD,IAAM,yBAAyB,CAAC,gBAAgB,QAAQ,MAAM;AAM9D,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,kBAAkB,MAAuB;AAChD,SAAO,SAAS,eAAe,KAAK,SAAS,YAAY,KAAK,KAAK,SAAS,gBAAgB;AAC9F;AAOA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,2BAA2B,CAAC,WAAW,gBAAgB,gBAAgB,WAAW;AAOxF,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,cAAc;AACpB,IAAM,yBAAyB;AAC/B,IAAM,kBAAkB,KAAK;AAEpC,SAAS,WAAW,GAAmB;AAErC,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,OAAO,IAAM,UAAS;AAAA,aACjB,OAAO,KAAO,UAAS;AAAA,aACvB,QAAQ,SAAU,QAAQ,OAAQ;AACzC,eAAS;AACT;AAAA,IACF,MAAO,UAAS;AAAA,EAClB;AACA,SAAO;AACT;AAQO,SAAS,oBAAoB,UAAsC;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,QAAQ,SAAS,KAAK;AAC1B,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,WAAW,GAAG;AAChB,UAAM,SAAS,MAAM,MAAM,GAAG,QAAQ,EAAE,YAAY;AACpD,QAAI,WAAW,YAAY,WAAW,WAAW,WAAW,SAAS;AACnE,cAAQ,MAAM,MAAM,WAAW,CAAC,EAAE,KAAK;AAAA,IACzC;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,YAAY;AAChC,aAAW,UAAU,qBAAqB;AACxC,QAAI,MAAM,WAAW,MAAM,GAAG;AAE5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,MAAuB;AAC7C,MAAI,oBAAoB,IAAI,IAAI,EAAG,QAAO;AAC1C,MAAI,uBAAuB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,EAAG,QAAO;AACnE,MAAI,kBAAkB,IAAI,EAAG,QAAO;AACpC,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,sBAAsB,IAAI,IAAI,EAAG,QAAO;AAC5C,SAAO,yBAAyB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;AAChE;AAWO,SAAS,gBACd,KACuB;AACvB,QAAM,UAAkC,CAAC;AACzC,QAAM,kBAA0C,CAAC;AACjD,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI,QAAQ;AAEZ,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ;AAE3B,aAAW,WAAW,OAAO,KAAK,GAAG,GAAG;AACtC,QAAI,SAAS,YAAa;AAC1B,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,WAAW,IAAI,OAAO;AAC5B,QAAI,aAAa,OAAW;AAC5B,UAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,QAAQ;AAG9E,QAAI,wBAAwB,IAAI,IAAI,GAAG;AACrC,YAAM,MAAM,oBAAoB,MAAM;AACtC,UAAI,OAAO,CAAC,aAAc,gBAAe;AACzC;AAAA,IACF;AAGA,QAAI,eAAe,IAAI,EAAG;AAG1B,QAAI,QAAQ;AACZ,QAAI,WAAW,KAAK,IAAI,wBAAwB;AAC9C,cAAQ,MAAM,MAAM,GAAG,sBAAsB;AAAA,IAC/C;AACA,UAAM,aAAa,WAAW,IAAI,IAAI,WAAW,KAAK;AACtD,QAAI,aAAa,aAAa,gBAAiB;AAC/C,kBAAc;AACd;AACA,YAAQ,IAAI,IAAI;AAChB,QAAI,iBAAiB,IAAI,EAAG,iBAAgB,IAAI,IAAI;AAAA,EACtD;AAEA,QAAM,SAAgC,EAAE,QAAQ;AAChD,MAAI,aAAc,QAAO,eAAe;AACxC,MAAI,OAAO,KAAK,eAAe,EAAE,SAAS,EAAG,QAAO,kBAAkB;AACtE,SAAO;AACT;AAQO,SAAS,uBACd,WACwB;AACxB,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,QAAQ,OAAO,KAAK,SAAS,GAAG;AACzC,QAAI,iBAAiB,KAAK,YAAY,CAAC,EAAG,KAAI,KAAK,YAAY,CAAC,IAAI,UAAU,IAAI;AAAA,EACpF;AACA,SAAO;AACT;AAOA,IAAM,4BACJ;AAAA,EACE,CAAC,MAAM,CAAC,oBAAoB,oBAAoB,kBAAkB,WAAW,CAAC;AAAA,EAC9E;AAAA,IACE;AAAA,IACA,CAAC,gBAAgB,uBAAuB,6BAA6B,oBAAoB;AAAA,EAC3F;AAAA,EACA,CAAC,UAAU,CAAC,8BAA8B,kCAAkC,CAAC;AAAA,EAC7E,CAAC,qBAAqB,CAAC,uCAAuC,CAAC;AAAA,EAC/D,CAAC,QAAQ,CAAC,oBAAoB,wBAAwB,CAAC;AAAA,EACvD,CAAC,OAAO,CAAC,uBAAuB,CAAC;AAAA,EACjC,CAAC,cAAc,CAAC,uBAAuB,CAAC;AAAA,EACxC,CAAC,eAAe,CAAC,gCAAgC,CAAC;AAAA,EAClD,CAAC,YAAY,CAAC,wBAAwB,6BAA6B,CAAC;AAAA,EACpE,CAAC,aAAa,CAAC,8BAA8B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9C,CAAC,kBAAkB,CAAC,eAAe,mCAAmC,CAAC;AAAA,EACvE,CAAC,OAAO,CAAC,UAAU,mCAAmC,CAAC;AAAA;AAAA,EAEvD,CAAC,eAAe,CAAC,gCAAgC,CAAC;AAAA,EAClD,CAAC,eAAe,CAAC,gCAAgC,CAAC;AACpD;AAOK,IAAM,6BAA6B;AAgCnC,SAAS,4BACd,SACoC;AACpC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAgC,CAAC;AACvC,aAAW,QAAQ,OAAO,KAAK,OAAO,GAAG;AACvC,UAAM,QAAQ,QAAQ,IAAI;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,OAAM,KAAK,YAAY,CAAC,IAAI;AAAA,EACjF;AAEA,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,OAAO,KAAK,2BAA2B;AACtD,eAAW,UAAU,SAAS;AAC5B,YAAM,QAAQ,MAAM,MAAM,GAAG,KAAK;AAClC,UAAI,OAAO;AACT,mBAAW,GAAG,IAAI,MAAM,MAAM,GAAG,0BAA0B;AAC3D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,WAAW,IAAI;AAClB,UAAM,OAAO,MAAM,2BAA2B,GAAG,KAAK;AACtD,QAAI,KAAM,YAAW,KAAK,KAAK,QAAQ,SAAS,EAAE;AAAA,EACpD;AAEA,MAAI,CAAC,WAAW,IAAI;AAClB,UAAM,MAAM,MAAM,iBAAiB;AACnC,UAAM,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACxC,QAAI,OAAQ,YAAW,KAAK;AAAA,EAC9B;AAEA,SAAO,OAAO,KAAK,UAAU,EAAE,SAAS,IAAI,aAAa;AAC3D;AAaO,SAAS,yBACd,YACkB;AAClB,QAAM,EAAE,SAAS,cAAc,gBAAgB,IAAI,gBAAgB,UAAU;AAC7E,QAAM,OAA+B,CAAC;AACtC,MAAI,YAAY;AACd,eAAW,QAAQ,OAAO,KAAK,UAAU,GAAG;AAC1C,YAAM,QAAQ,WAAW,IAAI;AAC7B,UAAI,UAAU,OAAW;AACzB,WAAK,KAAK,YAAY,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK;AAAA,IACnF;AAAA,EACF;AACA,QAAM,aAAa,4BAA4B,IAAI;AACnD,SAAO;AAAA,IACL;AAAA,IACA,GAAI,gBAAgB,EAAE,aAAa;AAAA,IACnC,GAAI,mBAAmB,EAAE,gBAAgB;AAAA,IACzC,GAAI,cAAc,EAAE,WAAW;AAAA,IAC/B,eAAe;AAAA,EACjB;AACF;","names":[]}
+{"version":3,"sources":["../src/metadata-capture.ts"],"sourcesContent":["/**\n * Maximal metadata capture — the shared, edge-safe sanitiser.\n *\n * AstraSync's thesis is total metadata capture: every header and connection\n * signal an inbound agent presents is a signal we want to keep. This module is\n * the ONE place that decides what is safe to store verbatim, what is a secret\n * to drop, and what credential headers reduce to a safe *format prefix* (a\n * platform signal, never the secret itself).\n *\n * It runs in three places that must agree byte-for-byte:\n *   - the edge adapter (`@astrasyncai/adapter-lambda`) — the richest capture\n *     point (full CloudFront header arrays),\n *   - the SDK adapters (express / nextjs) — for SDK-only merchants with no edge,\n *   - (indirectly) the backend, which stores whatever the above forward.\n *\n * Pure — no Node built-ins, no I/O — so it is safe in Lambda@Edge, the browser\n * build, and Deno. Capture is cheap: at the edge and SDK it is local string\n * work, and the backend stores it on a fire-and-forget event insert, so it adds\n * ZERO verify-access decision latency. Detection (which few signals imply which\n * vendor) is a separate, curated concern — see `platform-signatures.ts`.\n */\n\n/**\n * Version of the capture semantics (what is kept, dropped, reduced, or\n * derived — and under which key names).\n *\n * Capture semantics are FROZEN within a package major version: a given\n * `schemaVersion` always means the same field vocabulary and the same\n * keep/drop/reduce rules. The number bumps only on a SEMANTIC change to\n * capture (a renamed key, a changed reduction rule) — never for additive\n * signals, and never merely because the package version moved. To tell\n * builds apart, use the `sdkVersion` already present on the verify body;\n * `schemaVersion` answers the different question \"how do I interpret this\n * stored metadata?\".\n */\nexport const CAPTURE_SCHEMA_VERSION = 1;\n\n/**\n * The captured, sanitised view of an inbound agent's request metadata. Attached\n * to verify-access / beacon payloads as `callerMetadata.observedMetadata`.\n */\nexport interface ObservedMetadata {\n  /** Header name → value, secrets removed, verbatim otherwise. */\n  headers: Record<string, string>;\n  /**\n   * Safe key-format prefix of a credential header (e.g. `sk-ant-api03`,\n   * `sk-proj`, `AIza`) — a platform signal, NEVER the secret. Absent if no\n   * credential header was present or none matched a known format.\n   */\n  apiKeyFormat?: string;\n  /**\n   * The subset of `headers` that are known platform-signal headers\n   * (`openai-organization`, `x-goog-user-project`, `anthropic-version`, …),\n   * pulled out for convenient detection + display. Values are the same\n   * sanitised strings as in `headers`.\n   */\n  platformHeaders?: Record<string, string>;\n  /**\n   * Connection-layer signals (IP, ASN, country, TLS version, HTTP version,\n   * device class, TLS fingerprint). Edge adapters populate this from the\n   * platform's native connection surface — the authoritative source. SDK\n   * adapters populate it as a fallback via {@link deriveConnectionFromHeaders}\n   * when a CDN in front of the merchant injected the equivalent headers;\n   * absent when neither source had anything.\n   */\n  connection?: Record<string, string>;\n  /**\n   * Number of cookie pairs the caller sent. The `cookie` header VALUE is a\n   * secret and is always dropped; the COUNT is a client-shape signal\n   * (browsers carry cookies, most automation carries none) that would\n   * otherwise be unobservable downstream. Absent when no cookie header\n   * arrived.\n   */\n  cookieCount?: number;\n  /**\n   * Query-string parameter NAMES (deduped, lowercased) — values are NEVER\n   * captured (they routinely carry OAuth codes, tokens, and PII, and no\n   * deny-list is complete). Names alone fingerprint client shape. Populated\n   * by the edge path, which sees the raw query string.\n   */\n  queryKeys?: string[];\n  /**\n   * Version of the capture semantics this object was produced under — see\n   * {@link CAPTURE_SCHEMA_VERSION}. Optional for backward compatibility with\n   * metadata captured before the field existed.\n   */\n  schemaVersion?: number;\n}\n\n/**\n * Result of sanitising a raw header map. `headers` is always present (possibly\n * empty); `apiKeyFormat` / `platformHeaders` only when a signal was found.\n */\nexport interface SanitizeHeadersResult {\n  headers: Record<string, string>;\n  apiKeyFormat?: string;\n  platformHeaders?: Record<string, string>;\n  /** Cookie-pair count; the cookie value itself is always dropped. */\n  cookieCount?: number;\n}\n\n/**\n * Header names dropped entirely — genuine secrets or our own credentials that\n * describe the request's transport, not the agent. Matched case-insensitively\n * on the exact header name.\n */\nconst SECRET_HEADER_NAMES = new Set([\n  'cookie',\n  'set-cookie',\n  'x-csrf-token',\n  'proxy-authorization',\n  'x-astrasync-signature',\n  'x-astrasync-secret',\n  'x-hub-signature',\n  'x-hub-signature-256',\n  // Short-lived verify dedupe token — must never persist in stored metadata.\n  'x-astra-verified-hop',\n]);\n\n/**\n * Header-name prefixes dropped entirely — our own credential / signing surface\n * (`x-astrasync-*`, `kya-*`) must never round-trip into stored metadata.\n */\nconst SECRET_HEADER_PREFIXES = ['x-astrasync-', 'kya-', 'kya_'];\n\n/**\n * Credential headers whose VALUE is a secret but whose FORMAT is a signal. We\n * keep the leading format prefix (up to the random tail) and drop the rest.\n */\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'x-api-key',\n  'x-goog-api-key',\n  'api-key',\n]);\n\n/**\n * Header names that carry a raw signature value (drop the value; the presence\n * is not worth a bloat risk). Matched as a suffix so `x-*-signature` variants\n * are covered without an exhaustive list.\n */\nfunction isSignatureHeader(name: string): boolean {\n  return name === 'signature' || name.endsWith('-signature') || name.endsWith('-signature-256');\n}\n\n/**\n * Known platform-signal headers — pulled into `platformHeaders` for convenient\n * detection + display. Exact names plus a few prefixes (`x-goog-`,\n * `x-stainless-` — the OpenAI/Anthropic SDK client fingerprint headers).\n */\nconst PLATFORM_HEADER_NAMES = new Set([\n  'openai-organization',\n  'openai-project',\n  'openai-version',\n  'openai-processing-ms',\n  'anthropic-version',\n  'anthropic-beta',\n  'x-goog-user-project',\n  'x-goog-api-client',\n  'user-agent',\n  'x-agent-card-url',\n  'x-agent-provider',\n]);\n// `sec-ch-*` client hints are platform signals: Chromium forks (agentic\n// browsers included) often carry their real brand in `sec-ch-ua` even when\n// the UA string mimics stock Chrome.\nconst PLATFORM_HEADER_PREFIXES = [\n  'x-goog-',\n  'x-stainless-',\n  'x-anthropic-',\n  'x-openai-',\n  'sec-ch-',\n];\n\n/**\n * Known API-key format prefixes, longest-first so `sk-ant-api03` wins over\n * `sk-ant` and `sk-`. Each is the SAFE, non-secret leading token of a\n * credential; the random tail is never captured.\n */\nconst KEY_FORMAT_PREFIXES = [\n  'sk-ant-api03',\n  'sk-ant-api',\n  'sk-ant',\n  'sk-proj',\n  'sk-svcacct',\n  'sk-or-v1',\n  'sk-or',\n  'sk-lf',\n  'sk-',\n  'gsk_',\n  'aiza',\n  'ya29',\n  'ghp_',\n  'gho_',\n  'github_pat_',\n  'xai-',\n  'pplx-',\n  'r8_',\n  'hf_',\n  'astra-',\n  'astrae-',\n];\n\n/** Size caps — the only guard against jsonb bloat from a hostile POST. */\nexport const MAX_HEADERS = 64;\nexport const MAX_HEADER_VALUE_BYTES = 1024;\nexport const MAX_TOTAL_BYTES = 16 * 1024;\n\nfunction byteLength(s: string): number {\n  // Edge-safe (no Buffer): count UTF-8 bytes without allocating a Buffer.\n  let bytes = 0;\n  for (let i = 0; i < s.length; i++) {\n    const code = s.charCodeAt(i);\n    if (code < 0x80) bytes += 1;\n    else if (code < 0x800) bytes += 2;\n    else if (code >= 0xd800 && code <= 0xdbff) {\n      bytes += 4;\n      i++; // surrogate pair\n    } else bytes += 3;\n  }\n  return bytes;\n}\n\n/**\n * Extract the safe key-format prefix from a credential header value. Strips a\n * leading `Bearer ` / `Basic ` scheme, then returns the longest known prefix\n * that the (lowercased) value starts with. Returns undefined for opaque values\n * (e.g. a bare UUID token) so we never guess a format we don't recognise.\n */\nexport function extractApiKeyFormat(rawValue: string): string | undefined {\n  if (!rawValue) return undefined;\n  let value = rawValue.trim();\n  const spaceIdx = value.indexOf(' ');\n  if (spaceIdx > 0) {\n    const scheme = value.slice(0, spaceIdx).toLowerCase();\n    if (scheme === 'bearer' || scheme === 'basic' || scheme === 'token') {\n      value = value.slice(spaceIdx + 1).trim();\n    }\n  }\n  const lower = value.toLowerCase();\n  for (const prefix of KEY_FORMAT_PREFIXES) {\n    if (lower.startsWith(prefix)) {\n      // Return the prefix as-declared in the list (canonical casing).\n      return prefix;\n    }\n  }\n  return undefined;\n}\n\nfunction isSecretHeader(name: string): boolean {\n  if (SECRET_HEADER_NAMES.has(name)) return true;\n  if (SECRET_HEADER_PREFIXES.some((p) => name.startsWith(p))) return true;\n  if (isSignatureHeader(name)) return true;\n  return false;\n}\n\nfunction isPlatformHeader(name: string): boolean {\n  if (PLATFORM_HEADER_NAMES.has(name)) return true;\n  return PLATFORM_HEADER_PREFIXES.some((p) => name.startsWith(p));\n}\n\n/**\n * Sanitise a raw header map for storage. Deny-lists genuine secrets, reduces\n * credential headers to a safe format prefix, keeps everything else verbatim,\n * and enforces the size caps that bound jsonb growth.\n *\n * Accepts any string→(string|string[]|undefined) map (Node's `req.headers`,\n * CloudFront's flattened headers, a plain object). Multi-value headers are\n * joined with `, ` per RFC 7230.\n */\nexport function sanitizeHeaders(\n  raw: Record<string, string | string[] | undefined> | undefined | null\n): SanitizeHeadersResult {\n  const headers: Record<string, string> = {};\n  const platformHeaders: Record<string, string> = {};\n  let apiKeyFormat: string | undefined;\n  let cookieCount: number | undefined;\n  let totalBytes = 0;\n  let count = 0;\n\n  if (!raw) return { headers };\n\n  for (const rawName of Object.keys(raw)) {\n    if (count >= MAX_HEADERS) break;\n    const name = rawName.toLowerCase();\n    const rawValue = raw[rawName];\n    if (rawValue === undefined) continue;\n    const joined = Array.isArray(rawValue) ? rawValue.join(', ') : String(rawValue);\n\n    // Credential headers: capture the format prefix, drop the secret.\n    if (CREDENTIAL_HEADER_NAMES.has(name)) {\n      const fmt = extractApiKeyFormat(joined);\n      if (fmt && !apiKeyFormat) apiKeyFormat = fmt;\n      continue;\n    }\n\n    // Cookie: the value is a secret (dropped below), but the PAIR COUNT is a\n    // client-shape signal worth keeping.\n    if (name === 'cookie') {\n      cookieCount = joined.split(';').filter((s) => s.trim().length > 0).length;\n    }\n\n    // Genuine secrets: drop entirely.\n    if (isSecretHeader(name)) continue;\n\n    // Everything else describing the agent: keep, bounded.\n    let value = joined;\n    if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {\n      value = value.slice(0, MAX_HEADER_VALUE_BYTES);\n    }\n    const entryBytes = byteLength(name) + byteLength(value);\n    if (totalBytes + entryBytes > MAX_TOTAL_BYTES) continue;\n    totalBytes += entryBytes;\n    count++;\n    headers[name] = value;\n    if (isPlatformHeader(name)) platformHeaders[name] = value;\n  }\n\n  const result: SanitizeHeadersResult = { headers };\n  if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;\n  if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;\n  if (cookieCount !== undefined) result.cookieCount = cookieCount;\n  return result;\n}\n\n/**\n * Pull the known platform-signal headers out of an ALREADY-sanitised header\n * map. `sanitizeHeaders` already computes this as a by-product; this standalone\n * form is exported for call-sites (edge, tests) that hold a sanitised map and\n * want only the platform subset. Never re-run over raw (unsanitised) headers.\n */\nexport function extractPlatformHeaders(\n  sanitized: Record<string, string> | undefined | null\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!sanitized) return out;\n  for (const name of Object.keys(sanitized)) {\n    if (isPlatformHeader(name.toLowerCase())) out[name.toLowerCase()] = sanitized[name];\n  }\n  return out;\n}\n\n/**\n * Precedence-ordered CDN header sources for each derived `connection` key.\n * First present header wins; the special `x-forwarded-for` source takes the\n * LEFTMOST (client) entry of the comma-separated chain.\n */\nconst CONNECTION_HEADER_SOURCES: ReadonlyArray<readonly [key: string, headers: readonly string[]]> =\n  [\n    ['ip', ['cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-real-ip']],\n    [\n      'country',\n      ['cf-ipcountry', 'x-vercel-ip-country', 'cloudfront-viewer-country', 'fastly-geo-country'],\n    ],\n    ['region', ['x-vercel-ip-country-region', 'cloudfront-viewer-country-region']],\n    ['countryRegionName', ['cloudfront-viewer-country-region-name']],\n    ['city', ['x-vercel-ip-city', 'cloudfront-viewer-city']],\n    ['latitude', ['x-vercel-ip-latitude', 'cloudfront-viewer-latitude']],\n    ['longitude', ['x-vercel-ip-longitude', 'cloudfront-viewer-longitude']],\n    ['postalCode', ['x-vercel-ip-postal-code', 'cloudfront-viewer-postal-code']],\n    ['asn', ['cloudfront-viewer-asn']],\n    ['tlsVersion', ['cloudfront-viewer-tls']],\n    ['httpVersion', ['cloudfront-viewer-http-version']],\n    ['timeZone', ['x-vercel-ip-timezone', 'cloudfront-viewer-time-zone']],\n    ['metroCode', ['cloudfront-viewer-metro-code']],\n    // TLS fingerprints can only be computed where TLS terminates. When a CDN\n    // terminates TLS in front of the merchant, its fingerprint headers ARE the\n    // connection-layer truth — normalising them here is the permanent design.\n    // CloudFront delivers JA3/JA4 only via an origin request policy and only\n    // for HTTPS viewer connections.\n    ['tlsFingerprint', ['cf-ja3-hash', 'cloudfront-viewer-ja3-fingerprint']],\n    ['ja4', ['cf-ja4', 'cloudfront-viewer-ja4-fingerprint']],\n    // Header-structure fingerprint: browser/SDK-distinctive header ordering.\n    ['headerOrder', ['cloudfront-viewer-header-order']],\n    ['headerCount', ['cloudfront-viewer-header-count']],\n  ];\n\n/**\n * Backend bound: observedMetadata.connection values longer than this fail\n * the platform's zod parse outright (boundedStringRecord(32, 256)), so every\n * emitter truncates — headerOrder routinely exceeds it.\n */\nexport const MAX_CONNECTION_VALUE_CHARS = 256;\n\n/**\n * Derive the connection-layer block from CDN-injected request headers.\n *\n * When a merchant's SDK-gated origin sits behind a CDN (Cloudflare, Fastly,\n * Vercel, CloudFront), the CDN has already seen the connection layer and\n * injected it as headers. This promotes those headers to the same\n * `connection` keys the edge adapters populate natively, so SDK-only\n * deployments still get IP / geo / TLS attribution. Precedence per key:\n *\n * - `ip`: `cf-connecting-ip` > `fastly-client-ip` > `true-client-ip` >\n *   `x-real-ip` > `cloudfront-viewer-address` (port stripped) > leftmost\n *   `x-forwarded-for`\n * - `country`: `cf-ipcountry` > `x-vercel-ip-country` >\n *   `cloudfront-viewer-country` > `fastly-geo-country`\n * - `region` / `city` / `timeZone`: Vercel then CloudFront viewer headers\n * - `countryRegionName` / `asn` / `tlsVersion` / `httpVersion` /\n *   `metroCode` / `headerOrder` / `headerCount`: `cloudfront-viewer-*`\n * - `tlsFingerprint`: `cf-ja3-hash` > `cloudfront-viewer-ja3-fingerprint`\n * - `ja4`: `cf-ja4` > `cloudfront-viewer-ja4-fingerprint`\n *\n * All keys are additive under `schemaVersion` 1 (the frozen-capture doctrine\n * bumps only for changed semantics, never for additive signals). Values are\n * truncated to MAX_CONNECTION_VALUE_CHARS — the platform's hard bound.\n *\n * Edge adapters keep their richer native collectors — native platform\n * signals are authoritative; this header derivation is the SDK-level\n * fallback. Header names are matched case-insensitively. Returns undefined\n * when no source header is present, so the `connection` key is simply\n * omitted (matching edge behaviour).\n */\nexport function deriveConnectionFromHeaders(\n  headers: Record<string, string> | undefined | null\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  const lower: Record<string, string> = {};\n  for (const name of Object.keys(headers)) {\n    const value = headers[name];\n    if (typeof value === 'string' && value.length > 0) lower[name.toLowerCase()] = value;\n  }\n\n  const connection: Record<string, string> = {};\n  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {\n    for (const source of sources) {\n      const value = lower[source]?.trim();\n      if (value) {\n        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);\n        break;\n      }\n    }\n  }\n  // ip fallback 1: cloudfront-viewer-address arrives as ip:port — strip the\n  // trailing port only (IPv6-safe), unlike the dedicated client-ip headers.\n  // The port itself is kept as its own key: ephemeral-port patterns signal\n  // NAT/proxy connection reuse.\n  {\n    const addr = lower['cloudfront-viewer-address']?.trim();\n    const portMatch = addr?.match(/:(\\d+)$/);\n    if (portMatch) connection.sourcePort = portMatch[1];\n    if (!connection.ip && addr) connection.ip = addr.replace(/:\\d+$/, '');\n  }\n  // ip fallback 2: leftmost (client) hop of the x-forwarded-for chain.\n  if (!connection.ip) {\n    const xff = lower['x-forwarded-for'];\n    const client = xff?.split(',')[0]?.trim();\n    if (client) connection.ip = client;\n  }\n  // tlsCipher: CloudFront folds the cipher into the viewer-tls string\n  // (`TLSv1.3:TLS_AES_128_GCM_SHA256:fullHandshake`). `tlsVersion` stays\n  // verbatim (reducing it would be a semantic change → schema v2); the\n  // cipher is pulled out additively so it is queryable on its own.\n  if (!connection.tlsCipher) {\n    const cipher = connection.tlsVersion?.split(':')[1];\n    if (cipher) connection.tlsCipher = cipher;\n  }\n\n  return Object.keys(connection).length > 0 ? connection : undefined;\n}\n\n/**\n * The FULL metadata capture for one request at an SDK adapter (express /\n * nextjs / mcp): sanitised headers, the safe credential format prefix, the\n * platform-signal subset, the CDN-derived connection block, and the capture\n * schema version. This is the ONE builder all SDK adapters share, so their\n * verify-access bodies agree byte-for-byte.\n *\n * Connection derivation runs over the RAW header map (pre-cap) — the size\n * caps guard storage growth and must never hide a geo/IP header that\n * happened to arrive late in an oversized map.\n */\nexport function buildSdkObservedMetadata(\n  rawHeaders: Record<string, string | string[] | undefined> | undefined | null\n): ObservedMetadata {\n  const { headers, apiKeyFormat, platformHeaders, cookieCount } = sanitizeHeaders(rawHeaders);\n  const flat: Record<string, string> = {};\n  if (rawHeaders) {\n    for (const name of Object.keys(rawHeaders)) {\n      const value = rawHeaders[name];\n      if (value === undefined) continue;\n      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(', ') : String(value);\n    }\n  }\n  const connection = deriveConnectionFromHeaders(flat);\n  return {\n    headers,\n    ...(apiKeyFormat && { apiKeyFormat }),\n    ...(platformHeaders && { platformHeaders }),\n    ...(connection && { connection }),\n    ...(cookieCount !== undefined && { cookieCount }),\n    schemaVersion: CAPTURE_SCHEMA_VERSION,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmCO,IAAM,yBAAyB;AAuEtC,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AACF,CAAC;AAMD,IAAM,yBAAyB,CAAC,gBAAgB,QAAQ,MAAM;AAM9D,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,kBAAkB,MAAuB;AAChD,SAAO,SAAS,eAAe,KAAK,SAAS,YAAY,KAAK,KAAK,SAAS,gBAAgB;AAC9F;AAOA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,IAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOA,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,cAAc;AACpB,IAAM,yBAAyB;AAC/B,IAAM,kBAAkB,KAAK;AAEpC,SAAS,WAAW,GAAmB;AAErC,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,OAAO,IAAM,UAAS;AAAA,aACjB,OAAO,KAAO,UAAS;AAAA,aACvB,QAAQ,SAAU,QAAQ,OAAQ;AACzC,eAAS;AACT;AAAA,IACF,MAAO,UAAS;AAAA,EAClB;AACA,SAAO;AACT;AAQO,SAAS,oBAAoB,UAAsC;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,QAAQ,SAAS,KAAK;AAC1B,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,WAAW,GAAG;AAChB,UAAM,SAAS,MAAM,MAAM,GAAG,QAAQ,EAAE,YAAY;AACpD,QAAI,WAAW,YAAY,WAAW,WAAW,WAAW,SAAS;AACnE,cAAQ,MAAM,MAAM,WAAW,CAAC,EAAE,KAAK;AAAA,IACzC;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,YAAY;AAChC,aAAW,UAAU,qBAAqB;AACxC,QAAI,MAAM,WAAW,MAAM,GAAG;AAE5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,MAAuB;AAC7C,MAAI,oBAAoB,IAAI,IAAI,EAAG,QAAO;AAC1C,MAAI,uBAAuB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,EAAG,QAAO;AACnE,MAAI,kBAAkB,IAAI,EAAG,QAAO;AACpC,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,sBAAsB,IAAI,IAAI,EAAG,QAAO;AAC5C,SAAO,yBAAyB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;AAChE;AAWO,SAAS,gBACd,KACuB;AACvB,QAAM,UAAkC,CAAC;AACzC,QAAM,kBAA0C,CAAC;AACjD,MAAI;AACJ,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI,QAAQ;AAEZ,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ;AAE3B,aAAW,WAAW,OAAO,KAAK,GAAG,GAAG;AACtC,QAAI,SAAS,YAAa;AAC1B,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,WAAW,IAAI,OAAO;AAC5B,QAAI,aAAa,OAAW;AAC5B,UAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,QAAQ;AAG9E,QAAI,wBAAwB,IAAI,IAAI,GAAG;AACrC,YAAM,MAAM,oBAAoB,MAAM;AACtC,UAAI,OAAO,CAAC,aAAc,gBAAe;AACzC;AAAA,IACF;AAIA,QAAI,SAAS,UAAU;AACrB,oBAAc,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE;AAAA,IACrE;AAGA,QAAI,eAAe,IAAI,EAAG;AAG1B,QAAI,QAAQ;AACZ,QAAI,WAAW,KAAK,IAAI,wBAAwB;AAC9C,cAAQ,MAAM,MAAM,GAAG,sBAAsB;AAAA,IAC/C;AACA,UAAM,aAAa,WAAW,IAAI,IAAI,WAAW,KAAK;AACtD,QAAI,aAAa,aAAa,gBAAiB;AAC/C,kBAAc;AACd;AACA,YAAQ,IAAI,IAAI;AAChB,QAAI,iBAAiB,IAAI,EAAG,iBAAgB,IAAI,IAAI;AAAA,EACtD;AAEA,QAAM,SAAgC,EAAE,QAAQ;AAChD,MAAI,aAAc,QAAO,eAAe;AACxC,MAAI,OAAO,KAAK,eAAe,EAAE,SAAS,EAAG,QAAO,kBAAkB;AACtE,MAAI,gBAAgB,OAAW,QAAO,cAAc;AACpD,SAAO;AACT;AAQO,SAAS,uBACd,WACwB;AACxB,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,QAAQ,OAAO,KAAK,SAAS,GAAG;AACzC,QAAI,iBAAiB,KAAK,YAAY,CAAC,EAAG,KAAI,KAAK,YAAY,CAAC,IAAI,UAAU,IAAI;AAAA,EACpF;AACA,SAAO;AACT;AAOA,IAAM,4BACJ;AAAA,EACE,CAAC,MAAM,CAAC,oBAAoB,oBAAoB,kBAAkB,WAAW,CAAC;AAAA,EAC9E;AAAA,IACE;AAAA,IACA,CAAC,gBAAgB,uBAAuB,6BAA6B,oBAAoB;AAAA,EAC3F;AAAA,EACA,CAAC,UAAU,CAAC,8BAA8B,kCAAkC,CAAC;AAAA,EAC7E,CAAC,qBAAqB,CAAC,uCAAuC,CAAC;AAAA,EAC/D,CAAC,QAAQ,CAAC,oBAAoB,wBAAwB,CAAC;AAAA,EACvD,CAAC,YAAY,CAAC,wBAAwB,4BAA4B,CAAC;AAAA,EACnE,CAAC,aAAa,CAAC,yBAAyB,6BAA6B,CAAC;AAAA,EACtE,CAAC,cAAc,CAAC,2BAA2B,+BAA+B,CAAC;AAAA,EAC3E,CAAC,OAAO,CAAC,uBAAuB,CAAC;AAAA,EACjC,CAAC,cAAc,CAAC,uBAAuB,CAAC;AAAA,EACxC,CAAC,eAAe,CAAC,gCAAgC,CAAC;AAAA,EAClD,CAAC,YAAY,CAAC,wBAAwB,6BAA6B,CAAC;AAAA,EACpE,CAAC,aAAa,CAAC,8BAA8B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9C,CAAC,kBAAkB,CAAC,eAAe,mCAAmC,CAAC;AAAA,EACvE,CAAC,OAAO,CAAC,UAAU,mCAAmC,CAAC;AAAA;AAAA,EAEvD,CAAC,eAAe,CAAC,gCAAgC,CAAC;AAAA,EAClD,CAAC,eAAe,CAAC,gCAAgC,CAAC;AACpD;AAOK,IAAM,6BAA6B;AAgCnC,SAAS,4BACd,SACoC;AACpC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAgC,CAAC;AACvC,aAAW,QAAQ,OAAO,KAAK,OAAO,GAAG;AACvC,UAAM,QAAQ,QAAQ,IAAI;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,OAAM,KAAK,YAAY,CAAC,IAAI;AAAA,EACjF;AAEA,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,OAAO,KAAK,2BAA2B;AACtD,eAAW,UAAU,SAAS;AAC5B,YAAM,QAAQ,MAAM,MAAM,GAAG,KAAK;AAClC,UAAI,OAAO;AACT,mBAAW,GAAG,IAAI,MAAM,MAAM,GAAG,0BAA0B;AAC3D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA;AACE,UAAM,OAAO,MAAM,2BAA2B,GAAG,KAAK;AACtD,UAAM,YAAY,MAAM,MAAM,SAAS;AACvC,QAAI,UAAW,YAAW,aAAa,UAAU,CAAC;AAClD,QAAI,CAAC,WAAW,MAAM,KAAM,YAAW,KAAK,KAAK,QAAQ,SAAS,EAAE;AAAA,EACtE;AAEA,MAAI,CAAC,WAAW,IAAI;AAClB,UAAM,MAAM,MAAM,iBAAiB;AACnC,UAAM,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACxC,QAAI,OAAQ,YAAW,KAAK;AAAA,EAC9B;AAKA,MAAI,CAAC,WAAW,WAAW;AACzB,UAAM,SAAS,WAAW,YAAY,MAAM,GAAG,EAAE,CAAC;AAClD,QAAI,OAAQ,YAAW,YAAY;AAAA,EACrC;AAEA,SAAO,OAAO,KAAK,UAAU,EAAE,SAAS,IAAI,aAAa;AAC3D;AAaO,SAAS,yBACd,YACkB;AAClB,QAAM,EAAE,SAAS,cAAc,iBAAiB,YAAY,IAAI,gBAAgB,UAAU;AAC1F,QAAM,OAA+B,CAAC;AACtC,MAAI,YAAY;AACd,eAAW,QAAQ,OAAO,KAAK,UAAU,GAAG;AAC1C,YAAM,QAAQ,WAAW,IAAI;AAC7B,UAAI,UAAU,OAAW;AACzB,WAAK,KAAK,YAAY,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK;AAAA,IACnF;AAAA,EACF;AACA,QAAM,aAAa,4BAA4B,IAAI;AACnD,SAAO;AAAA,IACL;AAAA,IACA,GAAI,gBAAgB,EAAE,aAAa;AAAA,IACnC,GAAI,mBAAmB,EAAE,gBAAgB;AAAA,IACzC,GAAI,cAAc,EAAE,WAAW;AAAA,IAC/B,GAAI,gBAAgB,UAAa,EAAE,YAAY;AAAA,IAC/C,eAAe;AAAA,EACjB;AACF;","names":[]}

package/dist/metadata-capture.mjs

@@ -35,7 +35,13 @@ var PLATFORM_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-agent-card-url",
   "x-agent-provider"
 ]);
-var PLATFORM_HEADER_PREFIXES = ["x-goog-", "x-stainless-", "x-anthropic-", "x-openai-"];
+var PLATFORM_HEADER_PREFIXES = [
+  "x-goog-",
+  "x-stainless-",
+  "x-anthropic-",
+  "x-openai-",
+  "sec-ch-"
+];
 var KEY_FORMAT_PREFIXES = [
   "sk-ant-api03",
   "sk-ant-api",
@@ -107,6 +113,7 @@ function sanitizeHeaders(raw) {
   const headers = {};
   const platformHeaders = {};
   let apiKeyFormat;
+  let cookieCount;
   let totalBytes = 0;
   let count = 0;
   if (!raw) return { headers };
@@ -121,6 +128,9 @@ function sanitizeHeaders(raw) {
       if (fmt && !apiKeyFormat) apiKeyFormat = fmt;
       continue;
     }
+    if (name === "cookie") {
+      cookieCount = joined.split(";").filter((s) => s.trim().length > 0).length;
+    }
     if (isSecretHeader(name)) continue;
     let value = joined;
     if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {
@@ -136,6 +146,7 @@ function sanitizeHeaders(raw) {
   const result = { headers };
   if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;
   if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
+  if (cookieCount !== void 0) result.cookieCount = cookieCount;
   return result;
 }
 function extractPlatformHeaders(sanitized) {
@@ -155,6 +166,9 @@ var CONNECTION_HEADER_SOURCES = [
   ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
   ["countryRegionName", ["cloudfront-viewer-country-region-name"]],
   ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
+  ["latitude", ["x-vercel-ip-latitude", "cloudfront-viewer-latitude"]],
+  ["longitude", ["x-vercel-ip-longitude", "cloudfront-viewer-longitude"]],
+  ["postalCode", ["x-vercel-ip-postal-code", "cloudfront-viewer-postal-code"]],
   ["asn", ["cloudfront-viewer-asn"]],
   ["tlsVersion", ["cloudfront-viewer-tls"]],
   ["httpVersion", ["cloudfront-viewer-http-version"]],
@@ -189,19 +203,25 @@ function deriveConnectionFromHeaders(headers) {
       }
     }
   }
-  if (!connection.ip) {
+  {
     const addr = lower["cloudfront-viewer-address"]?.trim();
-    if (addr) connection.ip = addr.replace(/:\d+$/, "");
+    const portMatch = addr?.match(/:(\d+)$/);
+    if (portMatch) connection.sourcePort = portMatch[1];
+    if (!connection.ip && addr) connection.ip = addr.replace(/:\d+$/, "");
   }
   if (!connection.ip) {
     const xff = lower["x-forwarded-for"];
     const client = xff?.split(",")[0]?.trim();
     if (client) connection.ip = client;
   }
+  if (!connection.tlsCipher) {
+    const cipher = connection.tlsVersion?.split(":")[1];
+    if (cipher) connection.tlsCipher = cipher;
+  }
   return Object.keys(connection).length > 0 ? connection : void 0;
 }
 function buildSdkObservedMetadata(rawHeaders) {
-  const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);
+  const { headers, apiKeyFormat, platformHeaders, cookieCount } = sanitizeHeaders(rawHeaders);
   const flat = {};
   if (rawHeaders) {
     for (const name of Object.keys(rawHeaders)) {
@@ -216,6 +236,7 @@ function buildSdkObservedMetadata(rawHeaders) {
     ...apiKeyFormat && { apiKeyFormat },
     ...platformHeaders && { platformHeaders },
     ...connection && { connection },
+    ...cookieCount !== void 0 && { cookieCount },
     schemaVersion: CAPTURE_SCHEMA_VERSION
   };
 }

package/dist/metadata-capture.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/metadata-capture.ts"],"sourcesContent":["/**\n * Maximal metadata capture — the shared, edge-safe sanitiser.\n *\n * AstraSync's thesis is total metadata capture: every header and connection\n * signal an inbound agent presents is a signal we want to keep. This module is\n * the ONE place that decides what is safe to store verbatim, what is a secret\n * to drop, and what credential headers reduce to a safe *format prefix* (a\n * platform signal, never the secret itself).\n *\n * It runs in three places that must agree byte-for-byte:\n *   - the edge adapter (`@astrasyncai/adapter-lambda`) — the richest capture\n *     point (full CloudFront header arrays),\n *   - the SDK adapters (express / nextjs) — for SDK-only merchants with no edge,\n *   - (indirectly) the backend, which stores whatever the above forward.\n *\n * Pure — no Node built-ins, no I/O — so it is safe in Lambda@Edge, the browser\n * build, and Deno. Capture is cheap: at the edge and SDK it is local string\n * work, and the backend stores it on a fire-and-forget event insert, so it adds\n * ZERO verify-access decision latency. Detection (which few signals imply which\n * vendor) is a separate, curated concern — see `platform-signatures.ts`.\n */\n\n/**\n * Version of the capture semantics (what is kept, dropped, reduced, or\n * derived — and under which key names).\n *\n * Capture semantics are FROZEN within a package major version: a given\n * `schemaVersion` always means the same field vocabulary and the same\n * keep/drop/reduce rules. The number bumps only on a SEMANTIC change to\n * capture (a renamed key, a changed reduction rule) — never for additive\n * signals, and never merely because the package version moved. To tell\n * builds apart, use the `sdkVersion` already present on the verify body;\n * `schemaVersion` answers the different question \"how do I interpret this\n * stored metadata?\".\n */\nexport const CAPTURE_SCHEMA_VERSION = 1;\n\n/**\n * The captured, sanitised view of an inbound agent's request metadata. Attached\n * to verify-access / beacon payloads as `callerMetadata.observedMetadata`.\n */\nexport interface ObservedMetadata {\n  /** Header name → value, secrets removed, verbatim otherwise. */\n  headers: Record<string, string>;\n  /**\n   * Safe key-format prefix of a credential header (e.g. `sk-ant-api03`,\n   * `sk-proj`, `AIza`) — a platform signal, NEVER the secret. Absent if no\n   * credential header was present or none matched a known format.\n   */\n  apiKeyFormat?: string;\n  /**\n   * The subset of `headers` that are known platform-signal headers\n   * (`openai-organization`, `x-goog-user-project`, `anthropic-version`, …),\n   * pulled out for convenient detection + display. Values are the same\n   * sanitised strings as in `headers`.\n   */\n  platformHeaders?: Record<string, string>;\n  /**\n   * Connection-layer signals (IP, ASN, country, TLS version, HTTP version,\n   * device class, TLS fingerprint). Edge adapters populate this from the\n   * platform's native connection surface — the authoritative source. SDK\n   * adapters populate it as a fallback via {@link deriveConnectionFromHeaders}\n   * when a CDN in front of the merchant injected the equivalent headers;\n   * absent when neither source had anything.\n   */\n  connection?: Record<string, string>;\n  /**\n   * Version of the capture semantics this object was produced under — see\n   * {@link CAPTURE_SCHEMA_VERSION}. Optional for backward compatibility with\n   * metadata captured before the field existed.\n   */\n  schemaVersion?: number;\n}\n\n/**\n * Result of sanitising a raw header map. `headers` is always present (possibly\n * empty); `apiKeyFormat` / `platformHeaders` only when a signal was found.\n */\nexport interface SanitizeHeadersResult {\n  headers: Record<string, string>;\n  apiKeyFormat?: string;\n  platformHeaders?: Record<string, string>;\n}\n\n/**\n * Header names dropped entirely — genuine secrets or our own credentials that\n * describe the request's transport, not the agent. Matched case-insensitively\n * on the exact header name.\n */\nconst SECRET_HEADER_NAMES = new Set([\n  'cookie',\n  'set-cookie',\n  'x-csrf-token',\n  'proxy-authorization',\n  'x-astrasync-signature',\n  'x-astrasync-secret',\n  'x-hub-signature',\n  'x-hub-signature-256',\n  // Short-lived verify dedupe token — must never persist in stored metadata.\n  'x-astra-verified-hop',\n]);\n\n/**\n * Header-name prefixes dropped entirely — our own credential / signing surface\n * (`x-astrasync-*`, `kya-*`) must never round-trip into stored metadata.\n */\nconst SECRET_HEADER_PREFIXES = ['x-astrasync-', 'kya-', 'kya_'];\n\n/**\n * Credential headers whose VALUE is a secret but whose FORMAT is a signal. We\n * keep the leading format prefix (up to the random tail) and drop the rest.\n */\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'x-api-key',\n  'x-goog-api-key',\n  'api-key',\n]);\n\n/**\n * Header names that carry a raw signature value (drop the value; the presence\n * is not worth a bloat risk). Matched as a suffix so `x-*-signature` variants\n * are covered without an exhaustive list.\n */\nfunction isSignatureHeader(name: string): boolean {\n  return name === 'signature' || name.endsWith('-signature') || name.endsWith('-signature-256');\n}\n\n/**\n * Known platform-signal headers — pulled into `platformHeaders` for convenient\n * detection + display. Exact names plus a few prefixes (`x-goog-`,\n * `x-stainless-` — the OpenAI/Anthropic SDK client fingerprint headers).\n */\nconst PLATFORM_HEADER_NAMES = new Set([\n  'openai-organization',\n  'openai-project',\n  'openai-version',\n  'openai-processing-ms',\n  'anthropic-version',\n  'anthropic-beta',\n  'x-goog-user-project',\n  'x-goog-api-client',\n  'user-agent',\n  'x-agent-card-url',\n  'x-agent-provider',\n]);\nconst PLATFORM_HEADER_PREFIXES = ['x-goog-', 'x-stainless-', 'x-anthropic-', 'x-openai-'];\n\n/**\n * Known API-key format prefixes, longest-first so `sk-ant-api03` wins over\n * `sk-ant` and `sk-`. Each is the SAFE, non-secret leading token of a\n * credential; the random tail is never captured.\n */\nconst KEY_FORMAT_PREFIXES = [\n  'sk-ant-api03',\n  'sk-ant-api',\n  'sk-ant',\n  'sk-proj',\n  'sk-svcacct',\n  'sk-or-v1',\n  'sk-or',\n  'sk-lf',\n  'sk-',\n  'gsk_',\n  'aiza',\n  'ya29',\n  'ghp_',\n  'gho_',\n  'github_pat_',\n  'xai-',\n  'pplx-',\n  'r8_',\n  'hf_',\n  'astra-',\n  'astrae-',\n];\n\n/** Size caps — the only guard against jsonb bloat from a hostile POST. */\nexport const MAX_HEADERS = 64;\nexport const MAX_HEADER_VALUE_BYTES = 1024;\nexport const MAX_TOTAL_BYTES = 16 * 1024;\n\nfunction byteLength(s: string): number {\n  // Edge-safe (no Buffer): count UTF-8 bytes without allocating a Buffer.\n  let bytes = 0;\n  for (let i = 0; i < s.length; i++) {\n    const code = s.charCodeAt(i);\n    if (code < 0x80) bytes += 1;\n    else if (code < 0x800) bytes += 2;\n    else if (code >= 0xd800 && code <= 0xdbff) {\n      bytes += 4;\n      i++; // surrogate pair\n    } else bytes += 3;\n  }\n  return bytes;\n}\n\n/**\n * Extract the safe key-format prefix from a credential header value. Strips a\n * leading `Bearer ` / `Basic ` scheme, then returns the longest known prefix\n * that the (lowercased) value starts with. Returns undefined for opaque values\n * (e.g. a bare UUID token) so we never guess a format we don't recognise.\n */\nexport function extractApiKeyFormat(rawValue: string): string | undefined {\n  if (!rawValue) return undefined;\n  let value = rawValue.trim();\n  const spaceIdx = value.indexOf(' ');\n  if (spaceIdx > 0) {\n    const scheme = value.slice(0, spaceIdx).toLowerCase();\n    if (scheme === 'bearer' || scheme === 'basic' || scheme === 'token') {\n      value = value.slice(spaceIdx + 1).trim();\n    }\n  }\n  const lower = value.toLowerCase();\n  for (const prefix of KEY_FORMAT_PREFIXES) {\n    if (lower.startsWith(prefix)) {\n      // Return the prefix as-declared in the list (canonical casing).\n      return prefix;\n    }\n  }\n  return undefined;\n}\n\nfunction isSecretHeader(name: string): boolean {\n  if (SECRET_HEADER_NAMES.has(name)) return true;\n  if (SECRET_HEADER_PREFIXES.some((p) => name.startsWith(p))) return true;\n  if (isSignatureHeader(name)) return true;\n  return false;\n}\n\nfunction isPlatformHeader(name: string): boolean {\n  if (PLATFORM_HEADER_NAMES.has(name)) return true;\n  return PLATFORM_HEADER_PREFIXES.some((p) => name.startsWith(p));\n}\n\n/**\n * Sanitise a raw header map for storage. Deny-lists genuine secrets, reduces\n * credential headers to a safe format prefix, keeps everything else verbatim,\n * and enforces the size caps that bound jsonb growth.\n *\n * Accepts any string→(string|string[]|undefined) map (Node's `req.headers`,\n * CloudFront's flattened headers, a plain object). Multi-value headers are\n * joined with `, ` per RFC 7230.\n */\nexport function sanitizeHeaders(\n  raw: Record<string, string | string[] | undefined> | undefined | null\n): SanitizeHeadersResult {\n  const headers: Record<string, string> = {};\n  const platformHeaders: Record<string, string> = {};\n  let apiKeyFormat: string | undefined;\n  let totalBytes = 0;\n  let count = 0;\n\n  if (!raw) return { headers };\n\n  for (const rawName of Object.keys(raw)) {\n    if (count >= MAX_HEADERS) break;\n    const name = rawName.toLowerCase();\n    const rawValue = raw[rawName];\n    if (rawValue === undefined) continue;\n    const joined = Array.isArray(rawValue) ? rawValue.join(', ') : String(rawValue);\n\n    // Credential headers: capture the format prefix, drop the secret.\n    if (CREDENTIAL_HEADER_NAMES.has(name)) {\n      const fmt = extractApiKeyFormat(joined);\n      if (fmt && !apiKeyFormat) apiKeyFormat = fmt;\n      continue;\n    }\n\n    // Genuine secrets: drop entirely.\n    if (isSecretHeader(name)) continue;\n\n    // Everything else describing the agent: keep, bounded.\n    let value = joined;\n    if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {\n      value = value.slice(0, MAX_HEADER_VALUE_BYTES);\n    }\n    const entryBytes = byteLength(name) + byteLength(value);\n    if (totalBytes + entryBytes > MAX_TOTAL_BYTES) continue;\n    totalBytes += entryBytes;\n    count++;\n    headers[name] = value;\n    if (isPlatformHeader(name)) platformHeaders[name] = value;\n  }\n\n  const result: SanitizeHeadersResult = { headers };\n  if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;\n  if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;\n  return result;\n}\n\n/**\n * Pull the known platform-signal headers out of an ALREADY-sanitised header\n * map. `sanitizeHeaders` already computes this as a by-product; this standalone\n * form is exported for call-sites (edge, tests) that hold a sanitised map and\n * want only the platform subset. Never re-run over raw (unsanitised) headers.\n */\nexport function extractPlatformHeaders(\n  sanitized: Record<string, string> | undefined | null\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!sanitized) return out;\n  for (const name of Object.keys(sanitized)) {\n    if (isPlatformHeader(name.toLowerCase())) out[name.toLowerCase()] = sanitized[name];\n  }\n  return out;\n}\n\n/**\n * Precedence-ordered CDN header sources for each derived `connection` key.\n * First present header wins; the special `x-forwarded-for` source takes the\n * LEFTMOST (client) entry of the comma-separated chain.\n */\nconst CONNECTION_HEADER_SOURCES: ReadonlyArray<readonly [key: string, headers: readonly string[]]> =\n  [\n    ['ip', ['cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-real-ip']],\n    [\n      'country',\n      ['cf-ipcountry', 'x-vercel-ip-country', 'cloudfront-viewer-country', 'fastly-geo-country'],\n    ],\n    ['region', ['x-vercel-ip-country-region', 'cloudfront-viewer-country-region']],\n    ['countryRegionName', ['cloudfront-viewer-country-region-name']],\n    ['city', ['x-vercel-ip-city', 'cloudfront-viewer-city']],\n    ['asn', ['cloudfront-viewer-asn']],\n    ['tlsVersion', ['cloudfront-viewer-tls']],\n    ['httpVersion', ['cloudfront-viewer-http-version']],\n    ['timeZone', ['x-vercel-ip-timezone', 'cloudfront-viewer-time-zone']],\n    ['metroCode', ['cloudfront-viewer-metro-code']],\n    // TLS fingerprints can only be computed where TLS terminates. When a CDN\n    // terminates TLS in front of the merchant, its fingerprint headers ARE the\n    // connection-layer truth — normalising them here is the permanent design.\n    // CloudFront delivers JA3/JA4 only via an origin request policy and only\n    // for HTTPS viewer connections.\n    ['tlsFingerprint', ['cf-ja3-hash', 'cloudfront-viewer-ja3-fingerprint']],\n    ['ja4', ['cf-ja4', 'cloudfront-viewer-ja4-fingerprint']],\n    // Header-structure fingerprint: browser/SDK-distinctive header ordering.\n    ['headerOrder', ['cloudfront-viewer-header-order']],\n    ['headerCount', ['cloudfront-viewer-header-count']],\n  ];\n\n/**\n * Backend bound: observedMetadata.connection values longer than this fail\n * the platform's zod parse outright (boundedStringRecord(32, 256)), so every\n * emitter truncates — headerOrder routinely exceeds it.\n */\nexport const MAX_CONNECTION_VALUE_CHARS = 256;\n\n/**\n * Derive the connection-layer block from CDN-injected request headers.\n *\n * When a merchant's SDK-gated origin sits behind a CDN (Cloudflare, Fastly,\n * Vercel, CloudFront), the CDN has already seen the connection layer and\n * injected it as headers. This promotes those headers to the same\n * `connection` keys the edge adapters populate natively, so SDK-only\n * deployments still get IP / geo / TLS attribution. Precedence per key:\n *\n * - `ip`: `cf-connecting-ip` > `fastly-client-ip` > `true-client-ip` >\n *   `x-real-ip` > `cloudfront-viewer-address` (port stripped) > leftmost\n *   `x-forwarded-for`\n * - `country`: `cf-ipcountry` > `x-vercel-ip-country` >\n *   `cloudfront-viewer-country` > `fastly-geo-country`\n * - `region` / `city` / `timeZone`: Vercel then CloudFront viewer headers\n * - `countryRegionName` / `asn` / `tlsVersion` / `httpVersion` /\n *   `metroCode` / `headerOrder` / `headerCount`: `cloudfront-viewer-*`\n * - `tlsFingerprint`: `cf-ja3-hash` > `cloudfront-viewer-ja3-fingerprint`\n * - `ja4`: `cf-ja4` > `cloudfront-viewer-ja4-fingerprint`\n *\n * All keys are additive under `schemaVersion` 1 (the frozen-capture doctrine\n * bumps only for changed semantics, never for additive signals). Values are\n * truncated to MAX_CONNECTION_VALUE_CHARS — the platform's hard bound.\n *\n * Edge adapters keep their richer native collectors — native platform\n * signals are authoritative; this header derivation is the SDK-level\n * fallback. Header names are matched case-insensitively. Returns undefined\n * when no source header is present, so the `connection` key is simply\n * omitted (matching edge behaviour).\n */\nexport function deriveConnectionFromHeaders(\n  headers: Record<string, string> | undefined | null\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  const lower: Record<string, string> = {};\n  for (const name of Object.keys(headers)) {\n    const value = headers[name];\n    if (typeof value === 'string' && value.length > 0) lower[name.toLowerCase()] = value;\n  }\n\n  const connection: Record<string, string> = {};\n  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {\n    for (const source of sources) {\n      const value = lower[source]?.trim();\n      if (value) {\n        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);\n        break;\n      }\n    }\n  }\n  // ip fallback 1: cloudfront-viewer-address arrives as ip:port — strip the\n  // trailing port only (IPv6-safe), unlike the dedicated client-ip headers.\n  if (!connection.ip) {\n    const addr = lower['cloudfront-viewer-address']?.trim();\n    if (addr) connection.ip = addr.replace(/:\\d+$/, '');\n  }\n  // ip fallback 2: leftmost (client) hop of the x-forwarded-for chain.\n  if (!connection.ip) {\n    const xff = lower['x-forwarded-for'];\n    const client = xff?.split(',')[0]?.trim();\n    if (client) connection.ip = client;\n  }\n\n  return Object.keys(connection).length > 0 ? connection : undefined;\n}\n\n/**\n * The FULL metadata capture for one request at an SDK adapter (express /\n * nextjs / mcp): sanitised headers, the safe credential format prefix, the\n * platform-signal subset, the CDN-derived connection block, and the capture\n * schema version. This is the ONE builder all SDK adapters share, so their\n * verify-access bodies agree byte-for-byte.\n *\n * Connection derivation runs over the RAW header map (pre-cap) — the size\n * caps guard storage growth and must never hide a geo/IP header that\n * happened to arrive late in an oversized map.\n */\nexport function buildSdkObservedMetadata(\n  rawHeaders: Record<string, string | string[] | undefined> | undefined | null\n): ObservedMetadata {\n  const { headers, apiKeyFormat, platformHeaders } = sanitizeHeaders(rawHeaders);\n  const flat: Record<string, string> = {};\n  if (rawHeaders) {\n    for (const name of Object.keys(rawHeaders)) {\n      const value = rawHeaders[name];\n      if (value === undefined) continue;\n      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(', ') : String(value);\n    }\n  }\n  const connection = deriveConnectionFromHeaders(flat);\n  return {\n    headers,\n    ...(apiKeyFormat && { apiKeyFormat }),\n    ...(platformHeaders && { platformHeaders }),\n    ...(connection && { connection }),\n    schemaVersion: CAPTURE_SCHEMA_VERSION,\n  };\n}\n"],"mappings":";AAmCO,IAAM,yBAAyB;AAsDtC,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AACF,CAAC;AAMD,IAAM,yBAAyB,CAAC,gBAAgB,QAAQ,MAAM;AAM9D,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,kBAAkB,MAAuB;AAChD,SAAO,SAAS,eAAe,KAAK,SAAS,YAAY,KAAK,KAAK,SAAS,gBAAgB;AAC9F;AAOA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,2BAA2B,CAAC,WAAW,gBAAgB,gBAAgB,WAAW;AAOxF,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,cAAc;AACpB,IAAM,yBAAyB;AAC/B,IAAM,kBAAkB,KAAK;AAEpC,SAAS,WAAW,GAAmB;AAErC,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,OAAO,IAAM,UAAS;AAAA,aACjB,OAAO,KAAO,UAAS;AAAA,aACvB,QAAQ,SAAU,QAAQ,OAAQ;AACzC,eAAS;AACT;AAAA,IACF,MAAO,UAAS;AAAA,EAClB;AACA,SAAO;AACT;AAQO,SAAS,oBAAoB,UAAsC;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,QAAQ,SAAS,KAAK;AAC1B,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,WAAW,GAAG;AAChB,UAAM,SAAS,MAAM,MAAM,GAAG,QAAQ,EAAE,YAAY;AACpD,QAAI,WAAW,YAAY,WAAW,WAAW,WAAW,SAAS;AACnE,cAAQ,MAAM,MAAM,WAAW,CAAC,EAAE,KAAK;AAAA,IACzC;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,YAAY;AAChC,aAAW,UAAU,qBAAqB;AACxC,QAAI,MAAM,WAAW,MAAM,GAAG;AAE5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,MAAuB;AAC7C,MAAI,oBAAoB,IAAI,IAAI,EAAG,QAAO;AAC1C,MAAI,uBAAuB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,EAAG,QAAO;AACnE,MAAI,kBAAkB,IAAI,EAAG,QAAO;AACpC,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,sBAAsB,IAAI,IAAI,EAAG,QAAO;AAC5C,SAAO,yBAAyB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;AAChE;AAWO,SAAS,gBACd,KACuB;AACvB,QAAM,UAAkC,CAAC;AACzC,QAAM,kBAA0C,CAAC;AACjD,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI,QAAQ;AAEZ,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ;AAE3B,aAAW,WAAW,OAAO,KAAK,GAAG,GAAG;AACtC,QAAI,SAAS,YAAa;AAC1B,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,WAAW,IAAI,OAAO;AAC5B,QAAI,aAAa,OAAW;AAC5B,UAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,QAAQ;AAG9E,QAAI,wBAAwB,IAAI,IAAI,GAAG;AACrC,YAAM,MAAM,oBAAoB,MAAM;AACtC,UAAI,OAAO,CAAC,aAAc,gBAAe;AACzC;AAAA,IACF;AAGA,QAAI,eAAe,IAAI,EAAG;AAG1B,QAAI,QAAQ;AACZ,QAAI,WAAW,KAAK,IAAI,wBAAwB;AAC9C,cAAQ,MAAM,MAAM,GAAG,sBAAsB;AAAA,IAC/C;AACA,UAAM,aAAa,WAAW,IAAI,IAAI,WAAW,KAAK;AACtD,QAAI,aAAa,aAAa,gBAAiB;AAC/C,kBAAc;AACd;AACA,YAAQ,IAAI,IAAI;AAChB,QAAI,iBAAiB,IAAI,EAAG,iBAAgB,IAAI,IAAI;AAAA,EACtD;AAEA,QAAM,SAAgC,EAAE,QAAQ;AAChD,MAAI,aAAc,QAAO,eAAe;AACxC,MAAI,OAAO,KAAK,eAAe,EAAE,SAAS,EAAG,QAAO,kBAAkB;AACtE,SAAO;AACT;AAQO,SAAS,uBACd,WACwB;AACxB,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,QAAQ,OAAO,KAAK,SAAS,GAAG;AACzC,QAAI,iBAAiB,KAAK,YAAY,CAAC,EAAG,KAAI,KAAK,YAAY,CAAC,IAAI,UAAU,IAAI;AAAA,EACpF;AACA,SAAO;AACT;AAOA,IAAM,4BACJ;AAAA,EACE,CAAC,MAAM,CAAC,oBAAoB,oBAAoB,kBAAkB,WAAW,CAAC;AAAA,EAC9E;AAAA,IACE;AAAA,IACA,CAAC,gBAAgB,uBAAuB,6BAA6B,oBAAoB;AAAA,EAC3F;AAAA,EACA,CAAC,UAAU,CAAC,8BAA8B,kCAAkC,CAAC;AAAA,EAC7E,CAAC,qBAAqB,CAAC,uCAAuC,CAAC;AAAA,EAC/D,CAAC,QAAQ,CAAC,oBAAoB,wBAAwB,CAAC;AAAA,EACvD,CAAC,OAAO,CAAC,uBAAuB,CAAC;AAAA,EACjC,CAAC,cAAc,CAAC,uBAAuB,CAAC;AAAA,EACxC,CAAC,eAAe,CAAC,gCAAgC,CAAC;AAAA,EAClD,CAAC,YAAY,CAAC,wBAAwB,6BAA6B,CAAC;AAAA,EACpE,CAAC,aAAa,CAAC,8BAA8B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9C,CAAC,kBAAkB,CAAC,eAAe,mCAAmC,CAAC;AAAA,EACvE,CAAC,OAAO,CAAC,UAAU,mCAAmC,CAAC;AAAA;AAAA,EAEvD,CAAC,eAAe,CAAC,gCAAgC,CAAC;AAAA,EAClD,CAAC,eAAe,CAAC,gCAAgC,CAAC;AACpD;AAOK,IAAM,6BAA6B;AAgCnC,SAAS,4BACd,SACoC;AACpC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAgC,CAAC;AACvC,aAAW,QAAQ,OAAO,KAAK,OAAO,GAAG;AACvC,UAAM,QAAQ,QAAQ,IAAI;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,OAAM,KAAK,YAAY,CAAC,IAAI;AAAA,EACjF;AAEA,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,OAAO,KAAK,2BAA2B;AACtD,eAAW,UAAU,SAAS;AAC5B,YAAM,QAAQ,MAAM,MAAM,GAAG,KAAK;AAClC,UAAI,OAAO;AACT,mBAAW,GAAG,IAAI,MAAM,MAAM,GAAG,0BAA0B;AAC3D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,WAAW,IAAI;AAClB,UAAM,OAAO,MAAM,2BAA2B,GAAG,KAAK;AACtD,QAAI,KAAM,YAAW,KAAK,KAAK,QAAQ,SAAS,EAAE;AAAA,EACpD;AAEA,MAAI,CAAC,WAAW,IAAI;AAClB,UAAM,MAAM,MAAM,iBAAiB;AACnC,UAAM,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACxC,QAAI,OAAQ,YAAW,KAAK;AAAA,EAC9B;AAEA,SAAO,OAAO,KAAK,UAAU,EAAE,SAAS,IAAI,aAAa;AAC3D;AAaO,SAAS,yBACd,YACkB;AAClB,QAAM,EAAE,SAAS,cAAc,gBAAgB,IAAI,gBAAgB,UAAU;AAC7E,QAAM,OAA+B,CAAC;AACtC,MAAI,YAAY;AACd,eAAW,QAAQ,OAAO,KAAK,UAAU,GAAG;AAC1C,YAAM,QAAQ,WAAW,IAAI;AAC7B,UAAI,UAAU,OAAW;AACzB,WAAK,KAAK,YAAY,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK;AAAA,IACnF;AAAA,EACF;AACA,QAAM,aAAa,4BAA4B,IAAI;AACnD,SAAO;AAAA,IACL;AAAA,IACA,GAAI,gBAAgB,EAAE,aAAa;AAAA,IACnC,GAAI,mBAAmB,EAAE,gBAAgB;AAAA,IACzC,GAAI,cAAc,EAAE,WAAW;AAAA,IAC/B,eAAe;AAAA,EACjB;AACF;","names":[]}
+{"version":3,"sources":["../src/metadata-capture.ts"],"sourcesContent":["/**\n * Maximal metadata capture — the shared, edge-safe sanitiser.\n *\n * AstraSync's thesis is total metadata capture: every header and connection\n * signal an inbound agent presents is a signal we want to keep. This module is\n * the ONE place that decides what is safe to store verbatim, what is a secret\n * to drop, and what credential headers reduce to a safe *format prefix* (a\n * platform signal, never the secret itself).\n *\n * It runs in three places that must agree byte-for-byte:\n *   - the edge adapter (`@astrasyncai/adapter-lambda`) — the richest capture\n *     point (full CloudFront header arrays),\n *   - the SDK adapters (express / nextjs) — for SDK-only merchants with no edge,\n *   - (indirectly) the backend, which stores whatever the above forward.\n *\n * Pure — no Node built-ins, no I/O — so it is safe in Lambda@Edge, the browser\n * build, and Deno. Capture is cheap: at the edge and SDK it is local string\n * work, and the backend stores it on a fire-and-forget event insert, so it adds\n * ZERO verify-access decision latency. Detection (which few signals imply which\n * vendor) is a separate, curated concern — see `platform-signatures.ts`.\n */\n\n/**\n * Version of the capture semantics (what is kept, dropped, reduced, or\n * derived — and under which key names).\n *\n * Capture semantics are FROZEN within a package major version: a given\n * `schemaVersion` always means the same field vocabulary and the same\n * keep/drop/reduce rules. The number bumps only on a SEMANTIC change to\n * capture (a renamed key, a changed reduction rule) — never for additive\n * signals, and never merely because the package version moved. To tell\n * builds apart, use the `sdkVersion` already present on the verify body;\n * `schemaVersion` answers the different question \"how do I interpret this\n * stored metadata?\".\n */\nexport const CAPTURE_SCHEMA_VERSION = 1;\n\n/**\n * The captured, sanitised view of an inbound agent's request metadata. Attached\n * to verify-access / beacon payloads as `callerMetadata.observedMetadata`.\n */\nexport interface ObservedMetadata {\n  /** Header name → value, secrets removed, verbatim otherwise. */\n  headers: Record<string, string>;\n  /**\n   * Safe key-format prefix of a credential header (e.g. `sk-ant-api03`,\n   * `sk-proj`, `AIza`) — a platform signal, NEVER the secret. Absent if no\n   * credential header was present or none matched a known format.\n   */\n  apiKeyFormat?: string;\n  /**\n   * The subset of `headers` that are known platform-signal headers\n   * (`openai-organization`, `x-goog-user-project`, `anthropic-version`, …),\n   * pulled out for convenient detection + display. Values are the same\n   * sanitised strings as in `headers`.\n   */\n  platformHeaders?: Record<string, string>;\n  /**\n   * Connection-layer signals (IP, ASN, country, TLS version, HTTP version,\n   * device class, TLS fingerprint). Edge adapters populate this from the\n   * platform's native connection surface — the authoritative source. SDK\n   * adapters populate it as a fallback via {@link deriveConnectionFromHeaders}\n   * when a CDN in front of the merchant injected the equivalent headers;\n   * absent when neither source had anything.\n   */\n  connection?: Record<string, string>;\n  /**\n   * Number of cookie pairs the caller sent. The `cookie` header VALUE is a\n   * secret and is always dropped; the COUNT is a client-shape signal\n   * (browsers carry cookies, most automation carries none) that would\n   * otherwise be unobservable downstream. Absent when no cookie header\n   * arrived.\n   */\n  cookieCount?: number;\n  /**\n   * Query-string parameter NAMES (deduped, lowercased) — values are NEVER\n   * captured (they routinely carry OAuth codes, tokens, and PII, and no\n   * deny-list is complete). Names alone fingerprint client shape. Populated\n   * by the edge path, which sees the raw query string.\n   */\n  queryKeys?: string[];\n  /**\n   * Version of the capture semantics this object was produced under — see\n   * {@link CAPTURE_SCHEMA_VERSION}. Optional for backward compatibility with\n   * metadata captured before the field existed.\n   */\n  schemaVersion?: number;\n}\n\n/**\n * Result of sanitising a raw header map. `headers` is always present (possibly\n * empty); `apiKeyFormat` / `platformHeaders` only when a signal was found.\n */\nexport interface SanitizeHeadersResult {\n  headers: Record<string, string>;\n  apiKeyFormat?: string;\n  platformHeaders?: Record<string, string>;\n  /** Cookie-pair count; the cookie value itself is always dropped. */\n  cookieCount?: number;\n}\n\n/**\n * Header names dropped entirely — genuine secrets or our own credentials that\n * describe the request's transport, not the agent. Matched case-insensitively\n * on the exact header name.\n */\nconst SECRET_HEADER_NAMES = new Set([\n  'cookie',\n  'set-cookie',\n  'x-csrf-token',\n  'proxy-authorization',\n  'x-astrasync-signature',\n  'x-astrasync-secret',\n  'x-hub-signature',\n  'x-hub-signature-256',\n  // Short-lived verify dedupe token — must never persist in stored metadata.\n  'x-astra-verified-hop',\n]);\n\n/**\n * Header-name prefixes dropped entirely — our own credential / signing surface\n * (`x-astrasync-*`, `kya-*`) must never round-trip into stored metadata.\n */\nconst SECRET_HEADER_PREFIXES = ['x-astrasync-', 'kya-', 'kya_'];\n\n/**\n * Credential headers whose VALUE is a secret but whose FORMAT is a signal. We\n * keep the leading format prefix (up to the random tail) and drop the rest.\n */\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'x-api-key',\n  'x-goog-api-key',\n  'api-key',\n]);\n\n/**\n * Header names that carry a raw signature value (drop the value; the presence\n * is not worth a bloat risk). Matched as a suffix so `x-*-signature` variants\n * are covered without an exhaustive list.\n */\nfunction isSignatureHeader(name: string): boolean {\n  return name === 'signature' || name.endsWith('-signature') || name.endsWith('-signature-256');\n}\n\n/**\n * Known platform-signal headers — pulled into `platformHeaders` for convenient\n * detection + display. Exact names plus a few prefixes (`x-goog-`,\n * `x-stainless-` — the OpenAI/Anthropic SDK client fingerprint headers).\n */\nconst PLATFORM_HEADER_NAMES = new Set([\n  'openai-organization',\n  'openai-project',\n  'openai-version',\n  'openai-processing-ms',\n  'anthropic-version',\n  'anthropic-beta',\n  'x-goog-user-project',\n  'x-goog-api-client',\n  'user-agent',\n  'x-agent-card-url',\n  'x-agent-provider',\n]);\n// `sec-ch-*` client hints are platform signals: Chromium forks (agentic\n// browsers included) often carry their real brand in `sec-ch-ua` even when\n// the UA string mimics stock Chrome.\nconst PLATFORM_HEADER_PREFIXES = [\n  'x-goog-',\n  'x-stainless-',\n  'x-anthropic-',\n  'x-openai-',\n  'sec-ch-',\n];\n\n/**\n * Known API-key format prefixes, longest-first so `sk-ant-api03` wins over\n * `sk-ant` and `sk-`. Each is the SAFE, non-secret leading token of a\n * credential; the random tail is never captured.\n */\nconst KEY_FORMAT_PREFIXES = [\n  'sk-ant-api03',\n  'sk-ant-api',\n  'sk-ant',\n  'sk-proj',\n  'sk-svcacct',\n  'sk-or-v1',\n  'sk-or',\n  'sk-lf',\n  'sk-',\n  'gsk_',\n  'aiza',\n  'ya29',\n  'ghp_',\n  'gho_',\n  'github_pat_',\n  'xai-',\n  'pplx-',\n  'r8_',\n  'hf_',\n  'astra-',\n  'astrae-',\n];\n\n/** Size caps — the only guard against jsonb bloat from a hostile POST. */\nexport const MAX_HEADERS = 64;\nexport const MAX_HEADER_VALUE_BYTES = 1024;\nexport const MAX_TOTAL_BYTES = 16 * 1024;\n\nfunction byteLength(s: string): number {\n  // Edge-safe (no Buffer): count UTF-8 bytes without allocating a Buffer.\n  let bytes = 0;\n  for (let i = 0; i < s.length; i++) {\n    const code = s.charCodeAt(i);\n    if (code < 0x80) bytes += 1;\n    else if (code < 0x800) bytes += 2;\n    else if (code >= 0xd800 && code <= 0xdbff) {\n      bytes += 4;\n      i++; // surrogate pair\n    } else bytes += 3;\n  }\n  return bytes;\n}\n\n/**\n * Extract the safe key-format prefix from a credential header value. Strips a\n * leading `Bearer ` / `Basic ` scheme, then returns the longest known prefix\n * that the (lowercased) value starts with. Returns undefined for opaque values\n * (e.g. a bare UUID token) so we never guess a format we don't recognise.\n */\nexport function extractApiKeyFormat(rawValue: string): string | undefined {\n  if (!rawValue) return undefined;\n  let value = rawValue.trim();\n  const spaceIdx = value.indexOf(' ');\n  if (spaceIdx > 0) {\n    const scheme = value.slice(0, spaceIdx).toLowerCase();\n    if (scheme === 'bearer' || scheme === 'basic' || scheme === 'token') {\n      value = value.slice(spaceIdx + 1).trim();\n    }\n  }\n  const lower = value.toLowerCase();\n  for (const prefix of KEY_FORMAT_PREFIXES) {\n    if (lower.startsWith(prefix)) {\n      // Return the prefix as-declared in the list (canonical casing).\n      return prefix;\n    }\n  }\n  return undefined;\n}\n\nfunction isSecretHeader(name: string): boolean {\n  if (SECRET_HEADER_NAMES.has(name)) return true;\n  if (SECRET_HEADER_PREFIXES.some((p) => name.startsWith(p))) return true;\n  if (isSignatureHeader(name)) return true;\n  return false;\n}\n\nfunction isPlatformHeader(name: string): boolean {\n  if (PLATFORM_HEADER_NAMES.has(name)) return true;\n  return PLATFORM_HEADER_PREFIXES.some((p) => name.startsWith(p));\n}\n\n/**\n * Sanitise a raw header map for storage. Deny-lists genuine secrets, reduces\n * credential headers to a safe format prefix, keeps everything else verbatim,\n * and enforces the size caps that bound jsonb growth.\n *\n * Accepts any string→(string|string[]|undefined) map (Node's `req.headers`,\n * CloudFront's flattened headers, a plain object). Multi-value headers are\n * joined with `, ` per RFC 7230.\n */\nexport function sanitizeHeaders(\n  raw: Record<string, string | string[] | undefined> | undefined | null\n): SanitizeHeadersResult {\n  const headers: Record<string, string> = {};\n  const platformHeaders: Record<string, string> = {};\n  let apiKeyFormat: string | undefined;\n  let cookieCount: number | undefined;\n  let totalBytes = 0;\n  let count = 0;\n\n  if (!raw) return { headers };\n\n  for (const rawName of Object.keys(raw)) {\n    if (count >= MAX_HEADERS) break;\n    const name = rawName.toLowerCase();\n    const rawValue = raw[rawName];\n    if (rawValue === undefined) continue;\n    const joined = Array.isArray(rawValue) ? rawValue.join(', ') : String(rawValue);\n\n    // Credential headers: capture the format prefix, drop the secret.\n    if (CREDENTIAL_HEADER_NAMES.has(name)) {\n      const fmt = extractApiKeyFormat(joined);\n      if (fmt && !apiKeyFormat) apiKeyFormat = fmt;\n      continue;\n    }\n\n    // Cookie: the value is a secret (dropped below), but the PAIR COUNT is a\n    // client-shape signal worth keeping.\n    if (name === 'cookie') {\n      cookieCount = joined.split(';').filter((s) => s.trim().length > 0).length;\n    }\n\n    // Genuine secrets: drop entirely.\n    if (isSecretHeader(name)) continue;\n\n    // Everything else describing the agent: keep, bounded.\n    let value = joined;\n    if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {\n      value = value.slice(0, MAX_HEADER_VALUE_BYTES);\n    }\n    const entryBytes = byteLength(name) + byteLength(value);\n    if (totalBytes + entryBytes > MAX_TOTAL_BYTES) continue;\n    totalBytes += entryBytes;\n    count++;\n    headers[name] = value;\n    if (isPlatformHeader(name)) platformHeaders[name] = value;\n  }\n\n  const result: SanitizeHeadersResult = { headers };\n  if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;\n  if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;\n  if (cookieCount !== undefined) result.cookieCount = cookieCount;\n  return result;\n}\n\n/**\n * Pull the known platform-signal headers out of an ALREADY-sanitised header\n * map. `sanitizeHeaders` already computes this as a by-product; this standalone\n * form is exported for call-sites (edge, tests) that hold a sanitised map and\n * want only the platform subset. Never re-run over raw (unsanitised) headers.\n */\nexport function extractPlatformHeaders(\n  sanitized: Record<string, string> | undefined | null\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!sanitized) return out;\n  for (const name of Object.keys(sanitized)) {\n    if (isPlatformHeader(name.toLowerCase())) out[name.toLowerCase()] = sanitized[name];\n  }\n  return out;\n}\n\n/**\n * Precedence-ordered CDN header sources for each derived `connection` key.\n * First present header wins; the special `x-forwarded-for` source takes the\n * LEFTMOST (client) entry of the comma-separated chain.\n */\nconst CONNECTION_HEADER_SOURCES: ReadonlyArray<readonly [key: string, headers: readonly string[]]> =\n  [\n    ['ip', ['cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-real-ip']],\n    [\n      'country',\n      ['cf-ipcountry', 'x-vercel-ip-country', 'cloudfront-viewer-country', 'fastly-geo-country'],\n    ],\n    ['region', ['x-vercel-ip-country-region', 'cloudfront-viewer-country-region']],\n    ['countryRegionName', ['cloudfront-viewer-country-region-name']],\n    ['city', ['x-vercel-ip-city', 'cloudfront-viewer-city']],\n    ['latitude', ['x-vercel-ip-latitude', 'cloudfront-viewer-latitude']],\n    ['longitude', ['x-vercel-ip-longitude', 'cloudfront-viewer-longitude']],\n    ['postalCode', ['x-vercel-ip-postal-code', 'cloudfront-viewer-postal-code']],\n    ['asn', ['cloudfront-viewer-asn']],\n    ['tlsVersion', ['cloudfront-viewer-tls']],\n    ['httpVersion', ['cloudfront-viewer-http-version']],\n    ['timeZone', ['x-vercel-ip-timezone', 'cloudfront-viewer-time-zone']],\n    ['metroCode', ['cloudfront-viewer-metro-code']],\n    // TLS fingerprints can only be computed where TLS terminates. When a CDN\n    // terminates TLS in front of the merchant, its fingerprint headers ARE the\n    // connection-layer truth — normalising them here is the permanent design.\n    // CloudFront delivers JA3/JA4 only via an origin request policy and only\n    // for HTTPS viewer connections.\n    ['tlsFingerprint', ['cf-ja3-hash', 'cloudfront-viewer-ja3-fingerprint']],\n    ['ja4', ['cf-ja4', 'cloudfront-viewer-ja4-fingerprint']],\n    // Header-structure fingerprint: browser/SDK-distinctive header ordering.\n    ['headerOrder', ['cloudfront-viewer-header-order']],\n    ['headerCount', ['cloudfront-viewer-header-count']],\n  ];\n\n/**\n * Backend bound: observedMetadata.connection values longer than this fail\n * the platform's zod parse outright (boundedStringRecord(32, 256)), so every\n * emitter truncates — headerOrder routinely exceeds it.\n */\nexport const MAX_CONNECTION_VALUE_CHARS = 256;\n\n/**\n * Derive the connection-layer block from CDN-injected request headers.\n *\n * When a merchant's SDK-gated origin sits behind a CDN (Cloudflare, Fastly,\n * Vercel, CloudFront), the CDN has already seen the connection layer and\n * injected it as headers. This promotes those headers to the same\n * `connection` keys the edge adapters populate natively, so SDK-only\n * deployments still get IP / geo / TLS attribution. Precedence per key:\n *\n * - `ip`: `cf-connecting-ip` > `fastly-client-ip` > `true-client-ip` >\n *   `x-real-ip` > `cloudfront-viewer-address` (port stripped) > leftmost\n *   `x-forwarded-for`\n * - `country`: `cf-ipcountry` > `x-vercel-ip-country` >\n *   `cloudfront-viewer-country` > `fastly-geo-country`\n * - `region` / `city` / `timeZone`: Vercel then CloudFront viewer headers\n * - `countryRegionName` / `asn` / `tlsVersion` / `httpVersion` /\n *   `metroCode` / `headerOrder` / `headerCount`: `cloudfront-viewer-*`\n * - `tlsFingerprint`: `cf-ja3-hash` > `cloudfront-viewer-ja3-fingerprint`\n * - `ja4`: `cf-ja4` > `cloudfront-viewer-ja4-fingerprint`\n *\n * All keys are additive under `schemaVersion` 1 (the frozen-capture doctrine\n * bumps only for changed semantics, never for additive signals). Values are\n * truncated to MAX_CONNECTION_VALUE_CHARS — the platform's hard bound.\n *\n * Edge adapters keep their richer native collectors — native platform\n * signals are authoritative; this header derivation is the SDK-level\n * fallback. Header names are matched case-insensitively. Returns undefined\n * when no source header is present, so the `connection` key is simply\n * omitted (matching edge behaviour).\n */\nexport function deriveConnectionFromHeaders(\n  headers: Record<string, string> | undefined | null\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n  const lower: Record<string, string> = {};\n  for (const name of Object.keys(headers)) {\n    const value = headers[name];\n    if (typeof value === 'string' && value.length > 0) lower[name.toLowerCase()] = value;\n  }\n\n  const connection: Record<string, string> = {};\n  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {\n    for (const source of sources) {\n      const value = lower[source]?.trim();\n      if (value) {\n        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);\n        break;\n      }\n    }\n  }\n  // ip fallback 1: cloudfront-viewer-address arrives as ip:port — strip the\n  // trailing port only (IPv6-safe), unlike the dedicated client-ip headers.\n  // The port itself is kept as its own key: ephemeral-port patterns signal\n  // NAT/proxy connection reuse.\n  {\n    const addr = lower['cloudfront-viewer-address']?.trim();\n    const portMatch = addr?.match(/:(\\d+)$/);\n    if (portMatch) connection.sourcePort = portMatch[1];\n    if (!connection.ip && addr) connection.ip = addr.replace(/:\\d+$/, '');\n  }\n  // ip fallback 2: leftmost (client) hop of the x-forwarded-for chain.\n  if (!connection.ip) {\n    const xff = lower['x-forwarded-for'];\n    const client = xff?.split(',')[0]?.trim();\n    if (client) connection.ip = client;\n  }\n  // tlsCipher: CloudFront folds the cipher into the viewer-tls string\n  // (`TLSv1.3:TLS_AES_128_GCM_SHA256:fullHandshake`). `tlsVersion` stays\n  // verbatim (reducing it would be a semantic change → schema v2); the\n  // cipher is pulled out additively so it is queryable on its own.\n  if (!connection.tlsCipher) {\n    const cipher = connection.tlsVersion?.split(':')[1];\n    if (cipher) connection.tlsCipher = cipher;\n  }\n\n  return Object.keys(connection).length > 0 ? connection : undefined;\n}\n\n/**\n * The FULL metadata capture for one request at an SDK adapter (express /\n * nextjs / mcp): sanitised headers, the safe credential format prefix, the\n * platform-signal subset, the CDN-derived connection block, and the capture\n * schema version. This is the ONE builder all SDK adapters share, so their\n * verify-access bodies agree byte-for-byte.\n *\n * Connection derivation runs over the RAW header map (pre-cap) — the size\n * caps guard storage growth and must never hide a geo/IP header that\n * happened to arrive late in an oversized map.\n */\nexport function buildSdkObservedMetadata(\n  rawHeaders: Record<string, string | string[] | undefined> | undefined | null\n): ObservedMetadata {\n  const { headers, apiKeyFormat, platformHeaders, cookieCount } = sanitizeHeaders(rawHeaders);\n  const flat: Record<string, string> = {};\n  if (rawHeaders) {\n    for (const name of Object.keys(rawHeaders)) {\n      const value = rawHeaders[name];\n      if (value === undefined) continue;\n      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(', ') : String(value);\n    }\n  }\n  const connection = deriveConnectionFromHeaders(flat);\n  return {\n    headers,\n    ...(apiKeyFormat && { apiKeyFormat }),\n    ...(platformHeaders && { platformHeaders }),\n    ...(connection && { connection }),\n    ...(cookieCount !== undefined && { cookieCount }),\n    schemaVersion: CAPTURE_SCHEMA_VERSION,\n  };\n}\n"],"mappings":";AAmCO,IAAM,yBAAyB;AAuEtC,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AACF,CAAC;AAMD,IAAM,yBAAyB,CAAC,gBAAgB,QAAQ,MAAM;AAM9D,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,kBAAkB,MAAuB;AAChD,SAAO,SAAS,eAAe,KAAK,SAAS,YAAY,KAAK,KAAK,SAAS,gBAAgB;AAC9F;AAOA,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,IAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOA,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,cAAc;AACpB,IAAM,yBAAyB;AAC/B,IAAM,kBAAkB,KAAK;AAEpC,SAAS,WAAW,GAAmB;AAErC,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,UAAM,OAAO,EAAE,WAAW,CAAC;AAC3B,QAAI,OAAO,IAAM,UAAS;AAAA,aACjB,OAAO,KAAO,UAAS;AAAA,aACvB,QAAQ,SAAU,QAAQ,OAAQ;AACzC,eAAS;AACT;AAAA,IACF,MAAO,UAAS;AAAA,EAClB;AACA,SAAO;AACT;AAQO,SAAS,oBAAoB,UAAsC;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,QAAQ,SAAS,KAAK;AAC1B,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,WAAW,GAAG;AAChB,UAAM,SAAS,MAAM,MAAM,GAAG,QAAQ,EAAE,YAAY;AACpD,QAAI,WAAW,YAAY,WAAW,WAAW,WAAW,SAAS;AACnE,cAAQ,MAAM,MAAM,WAAW,CAAC,EAAE,KAAK;AAAA,IACzC;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,YAAY;AAChC,aAAW,UAAU,qBAAqB;AACxC,QAAI,MAAM,WAAW,MAAM,GAAG;AAE5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,MAAuB;AAC7C,MAAI,oBAAoB,IAAI,IAAI,EAAG,QAAO;AAC1C,MAAI,uBAAuB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,EAAG,QAAO;AACnE,MAAI,kBAAkB,IAAI,EAAG,QAAO;AACpC,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,sBAAsB,IAAI,IAAI,EAAG,QAAO;AAC5C,SAAO,yBAAyB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;AAChE;AAWO,SAAS,gBACd,KACuB;AACvB,QAAM,UAAkC,CAAC;AACzC,QAAM,kBAA0C,CAAC;AACjD,MAAI;AACJ,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI,QAAQ;AAEZ,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ;AAE3B,aAAW,WAAW,OAAO,KAAK,GAAG,GAAG;AACtC,QAAI,SAAS,YAAa;AAC1B,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,WAAW,IAAI,OAAO;AAC5B,QAAI,aAAa,OAAW;AAC5B,UAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,QAAQ;AAG9E,QAAI,wBAAwB,IAAI,IAAI,GAAG;AACrC,YAAM,MAAM,oBAAoB,MAAM;AACtC,UAAI,OAAO,CAAC,aAAc,gBAAe;AACzC;AAAA,IACF;AAIA,QAAI,SAAS,UAAU;AACrB,oBAAc,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE;AAAA,IACrE;AAGA,QAAI,eAAe,IAAI,EAAG;AAG1B,QAAI,QAAQ;AACZ,QAAI,WAAW,KAAK,IAAI,wBAAwB;AAC9C,cAAQ,MAAM,MAAM,GAAG,sBAAsB;AAAA,IAC/C;AACA,UAAM,aAAa,WAAW,IAAI,IAAI,WAAW,KAAK;AACtD,QAAI,aAAa,aAAa,gBAAiB;AAC/C,kBAAc;AACd;AACA,YAAQ,IAAI,IAAI;AAChB,QAAI,iBAAiB,IAAI,EAAG,iBAAgB,IAAI,IAAI;AAAA,EACtD;AAEA,QAAM,SAAgC,EAAE,QAAQ;AAChD,MAAI,aAAc,QAAO,eAAe;AACxC,MAAI,OAAO,KAAK,eAAe,EAAE,SAAS,EAAG,QAAO,kBAAkB;AACtE,MAAI,gBAAgB,OAAW,QAAO,cAAc;AACpD,SAAO;AACT;AAQO,SAAS,uBACd,WACwB;AACxB,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,QAAQ,OAAO,KAAK,SAAS,GAAG;AACzC,QAAI,iBAAiB,KAAK,YAAY,CAAC,EAAG,KAAI,KAAK,YAAY,CAAC,IAAI,UAAU,IAAI;AAAA,EACpF;AACA,SAAO;AACT;AAOA,IAAM,4BACJ;AAAA,EACE,CAAC,MAAM,CAAC,oBAAoB,oBAAoB,kBAAkB,WAAW,CAAC;AAAA,EAC9E;AAAA,IACE;AAAA,IACA,CAAC,gBAAgB,uBAAuB,6BAA6B,oBAAoB;AAAA,EAC3F;AAAA,EACA,CAAC,UAAU,CAAC,8BAA8B,kCAAkC,CAAC;AAAA,EAC7E,CAAC,qBAAqB,CAAC,uCAAuC,CAAC;AAAA,EAC/D,CAAC,QAAQ,CAAC,oBAAoB,wBAAwB,CAAC;AAAA,EACvD,CAAC,YAAY,CAAC,wBAAwB,4BAA4B,CAAC;AAAA,EACnE,CAAC,aAAa,CAAC,yBAAyB,6BAA6B,CAAC;AAAA,EACtE,CAAC,cAAc,CAAC,2BAA2B,+BAA+B,CAAC;AAAA,EAC3E,CAAC,OAAO,CAAC,uBAAuB,CAAC;AAAA,EACjC,CAAC,cAAc,CAAC,uBAAuB,CAAC;AAAA,EACxC,CAAC,eAAe,CAAC,gCAAgC,CAAC;AAAA,EAClD,CAAC,YAAY,CAAC,wBAAwB,6BAA6B,CAAC;AAAA,EACpE,CAAC,aAAa,CAAC,8BAA8B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9C,CAAC,kBAAkB,CAAC,eAAe,mCAAmC,CAAC;AAAA,EACvE,CAAC,OAAO,CAAC,UAAU,mCAAmC,CAAC;AAAA;AAAA,EAEvD,CAAC,eAAe,CAAC,gCAAgC,CAAC;AAAA,EAClD,CAAC,eAAe,CAAC,gCAAgC,CAAC;AACpD;AAOK,IAAM,6BAA6B;AAgCnC,SAAS,4BACd,SACoC;AACpC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAgC,CAAC;AACvC,aAAW,QAAQ,OAAO,KAAK,OAAO,GAAG;AACvC,UAAM,QAAQ,QAAQ,IAAI;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,OAAM,KAAK,YAAY,CAAC,IAAI;AAAA,EACjF;AAEA,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,OAAO,KAAK,2BAA2B;AACtD,eAAW,UAAU,SAAS;AAC5B,YAAM,QAAQ,MAAM,MAAM,GAAG,KAAK;AAClC,UAAI,OAAO;AACT,mBAAW,GAAG,IAAI,MAAM,MAAM,GAAG,0BAA0B;AAC3D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA;AACE,UAAM,OAAO,MAAM,2BAA2B,GAAG,KAAK;AACtD,UAAM,YAAY,MAAM,MAAM,SAAS;AACvC,QAAI,UAAW,YAAW,aAAa,UAAU,CAAC;AAClD,QAAI,CAAC,WAAW,MAAM,KAAM,YAAW,KAAK,KAAK,QAAQ,SAAS,EAAE;AAAA,EACtE;AAEA,MAAI,CAAC,WAAW,IAAI;AAClB,UAAM,MAAM,MAAM,iBAAiB;AACnC,UAAM,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACxC,QAAI,OAAQ,YAAW,KAAK;AAAA,EAC9B;AAKA,MAAI,CAAC,WAAW,WAAW;AACzB,UAAM,SAAS,WAAW,YAAY,MAAM,GAAG,EAAE,CAAC;AAClD,QAAI,OAAQ,YAAW,YAAY;AAAA,EACrC;AAEA,SAAO,OAAO,KAAK,UAAU,EAAE,SAAS,IAAI,aAAa;AAC3D;AAaO,SAAS,yBACd,YACkB;AAClB,QAAM,EAAE,SAAS,cAAc,iBAAiB,YAAY,IAAI,gBAAgB,UAAU;AAC1F,QAAM,OAA+B,CAAC;AACtC,MAAI,YAAY;AACd,eAAW,QAAQ,OAAO,KAAK,UAAU,GAAG;AAC1C,YAAM,QAAQ,WAAW,IAAI;AAC7B,UAAI,UAAU,OAAW;AACzB,WAAK,KAAK,YAAY,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK;AAAA,IACnF;AAAA,EACF;AACA,QAAM,aAAa,4BAA4B,IAAI;AACnD,SAAO;AAAA,IACL;AAAA,IACA,GAAI,gBAAgB,EAAE,aAAa;AAAA,IACnC,GAAI,mBAAmB,EAAE,gBAAgB;AAAA,IACzC,GAAI,cAAc,EAAE,WAAW;AAAA,IAC/B,GAAI,gBAAgB,UAAa,EAAE,YAAY;AAAA,IAC/C,eAAe;AAAA,EACjB;AACF;","names":[]}

package/dist/platform-signatures.d.mts

@@ -12,7 +12,7 @@
  * Pure regex — no Node built-ins, edge-safe. Detection is regex-only for
  * v2.9 — TLS fingerprinting / behavioural signatures are deferred.
  */
-type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'perplexity' | 'unknown';
+type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'perplexity' | 'chatgpt-atlas' | 'perplexity-comet' | 'astrasync-sdk' | 'unknown';
 interface PlatformFingerprint {
     vendor: PlatformAgentVendor;
     /** A stable identifier used as the orphan-agent dedup key. */
@@ -35,6 +35,19 @@ interface PlatformDetectionInput {
      * against `headerPatterns` (which test on `name` and `name: value`).
      */
     platformHeaders?: Record<string, string>;
+    /**
+     * The caller's JA4 TLS-client fingerprint (from the connection capture).
+     * Matched against `ja4Patterns`. A JA4 identifies the client TLS stack,
+     * so signatures should pair it with other evidence when attributing a
+     * vendor.
+     */
+    ja4?: string;
+    /**
+     * The caller's origin ASN (from the connection capture). Matched against
+     * `asnList` by exact membership. An ASN alone attributes an entire cloud
+     * provider — registry validation rejects ASN-only signatures.
+     */
+    asn?: string;
 }
 /**
  * A signature definition, generic over the vendor key. The seed constant
@@ -59,6 +72,10 @@ interface PlatformSignatureDef<V extends string = string> {
      * `/x-goog-user-project/i` match on presence).
      */
     headerPatterns?: RegExp[];
+    /** Patterns tested against the observed JA4 TLS-client fingerprint. */
+    ja4Patterns?: RegExp[];
+    /** Exact ASN strings this signature matches (never regex). */
+    asnList?: string[];
 }
 /**
  * A fingerprint whose vendor may be a dynamically-promoted (non-seed) key.

package/dist/platform-signatures.d.ts

@@ -12,7 +12,7 @@
  * Pure regex — no Node built-ins, edge-safe. Detection is regex-only for
  * v2.9 — TLS fingerprinting / behavioural signatures are deferred.
  */
-type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'perplexity' | 'unknown';
+type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'perplexity' | 'chatgpt-atlas' | 'perplexity-comet' | 'astrasync-sdk' | 'unknown';
 interface PlatformFingerprint {
     vendor: PlatformAgentVendor;
     /** A stable identifier used as the orphan-agent dedup key. */
@@ -35,6 +35,19 @@ interface PlatformDetectionInput {
      * against `headerPatterns` (which test on `name` and `name: value`).
      */
     platformHeaders?: Record<string, string>;
+    /**
+     * The caller's JA4 TLS-client fingerprint (from the connection capture).
+     * Matched against `ja4Patterns`. A JA4 identifies the client TLS stack,
+     * so signatures should pair it with other evidence when attributing a
+     * vendor.
+     */
+    ja4?: string;
+    /**
+     * The caller's origin ASN (from the connection capture). Matched against
+     * `asnList` by exact membership. An ASN alone attributes an entire cloud
+     * provider — registry validation rejects ASN-only signatures.
+     */
+    asn?: string;
 }
 /**
  * A signature definition, generic over the vendor key. The seed constant
@@ -59,6 +72,10 @@ interface PlatformSignatureDef<V extends string = string> {
      * `/x-goog-user-project/i` match on presence).
      */
     headerPatterns?: RegExp[];
+    /** Patterns tested against the observed JA4 TLS-client fingerprint. */
+    ja4Patterns?: RegExp[];
+    /** Exact ASN strings this signature matches (never regex). */
+    asnList?: string[];
 }
 /**
  * A fingerprint whose vendor may be a dynamically-promoted (non-seed) key.

package/dist/platform-signatures.js

@@ -68,12 +68,43 @@ var PLATFORM_AGENT_SIGNATURES = [
     uaPatterns: [/perplexity/i],
     agentCardPatterns: [/perplexity\.ai/i],
     apiKeyFormatPatterns: [/^pplx-/i]
+  },
+  // Agentic browsers — versioned-token patterns ONLY (a stock Chrome UA must
+  // never match). Distinct vendor keys (not 'chatgpt'/'perplexity'): the
+  // browser product is a different surface than the assistant service, and
+  // the DB registry mirrors one row per vendor. These sit after the primary
+  // vendor entries so a UA carrying an explicit vendor token keeps its
+  // primary attribution; a browser-shaped UA with the agentic token is
+  // caught here BEFORE classify's human tier, which is what makes these
+  // visits observable at all. Token drift is real (some builds mimic Chrome
+  // outright) — re-verify against captured events when a new browser ships,
+  // and check `sec-ch-ua` platformHeaders for the real brand.
+  {
+    vendor: "chatgpt-atlas",
+    displayName: "ChatGPT Atlas browser",
+    uaPatterns: [/\batlas\/\d/i],
+    headerPatterns: [/^sec-ch-ua: .*atlas/i]
+  },
+  {
+    vendor: "perplexity-comet",
+    displayName: "Perplexity Comet browser",
+    uaPatterns: [/\bcomet\/\d/i],
+    headerPatterns: [/^sec-ch-ua: .*comet/i]
+  },
+  // Our own SDK self-identifies (sdkFetch stamps this UA) — first-party
+  // traffic must never pollute the unknown/anonymous pool it exists to audit.
+  {
+    vendor: "astrasync-sdk",
+    displayName: "AstraSync SDK",
+    uaPatterns: [/^astrasync-sdk\//i]
   }
 ];
 function matchPlatformSignature(signatures, input) {
   const ua = input.userAgent ?? "";
   const cardUrl = input.agentCardUrl ?? "";
   const apiKeyFormat = input.apiKeyFormat ?? "";
+  const ja4 = input.ja4 ?? "";
+  const asn = input.asn ?? "";
   const headerLines = [];
   if (input.platformHeaders) {
     for (const [name, value] of Object.entries(input.platformHeaders)) {
@@ -85,7 +116,9 @@ function matchPlatformSignature(signatures, input) {
     const cardMatch = sig.agentCardPatterns?.some((p) => p.test(cardUrl));
     const keyMatch = apiKeyFormat.length > 0 && sig.apiKeyFormatPatterns?.some((p) => p.test(apiKeyFormat));
     const headerMatch = headerLines.length > 0 && sig.headerPatterns?.some((p) => headerLines.some((line) => p.test(line)));
-    if (uaMatch || cardMatch || keyMatch || headerMatch) {
+    const ja4Match = ja4.length > 0 && sig.ja4Patterns?.some((p) => p.test(ja4));
+    const asnMatch = asn.length > 0 && sig.asnList?.includes(asn);
+    if (uaMatch || cardMatch || keyMatch || headerMatch || ja4Match || asnMatch) {
       const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
       const cardHost = (() => {
         try {
@@ -94,7 +127,7 @@ function matchPlatformSignature(signatures, input) {
           return "";
         }
       })();
-      const keyBasis = uaBase || cardHost || apiKeyFormat || "unknown";
+      const keyBasis = uaBase || cardHost || apiKeyFormat || ja4 || asn && `asn${asn}` || "unknown";
       return {
         vendor: sig.vendor,
         fingerprintKey: `${sig.vendor}:${keyBasis}`,