@astrasyncai/verification-gateway 5.13.0 → 5.15.0

package/dist/edge-core/index.d.ts

@@ -1,6 +1,6 @@
 import { EdgeMode, EdgeVerificationDepth, EdgeConfig } from '../edge-config.js';
 import { PlatformFingerprint } from '../platform-signatures.js';
-import { C as CommerceArtifactsPayload, V as VerificationRequest } from '../types-C_b4QTyO.js';
+import { C as CommerceArtifactsPayload, V as VerificationRequest } from '../types-DtJjlW4O.js';
 import { verify } from '../verify.js';
 import { ObservedMetadata } from '../metadata-capture.js';
 
@@ -140,6 +140,7 @@ interface TierOutcome {
     };
     stepUp?: {
         pollUrl?: string;
+        approvalUrl?: string;
         expiresAt?: string;
     };
     correlationId?: string;
@@ -306,6 +307,13 @@ interface EdgeEvaluation {
  *   response).
  */
 declare function evaluateEdgeRequest(options: EdgeCoreOptions, req: NormalizedRequest, config: EdgeConfig, apiKey: string | undefined): Promise<EdgeEvaluation>;
+/** Negotiated TLS version from CloudFront-Viewer-TLS (`TLSv1.3:cipher:…`). */
+declare function negotiatedTlsVersion(req: NormalizedRequest): string | null;
+/** The violation when the request's TLS is below `minTls`; null = fine or unknown. */
+declare function checkMinTls(req: NormalizedRequest, minTls: EdgeConfig['minTls']): {
+    minimum: string;
+    negotiated: string;
+} | null;
 
 /**
  * Decision → abstract outcome-application wiring. Executed in BOTH modes
@@ -369,9 +377,14 @@ declare function applyOutcome(options: {
  *    without spending an attempt; a 401 on the key falls back to
  *    unauthenticated delivery);
  *  - collapses identical requests (same counterparty, IP, UA, method, path,
- *    attempt id) inside a 60s window into one item carrying `repeatCount`;
+ *    attempt id) inside a 60s window into one item carrying `repeatCount`
+ *    — but only while that item is still queued (5.14.0, round 27.6: the
+ *    old 60s held aggregate waited for a later invocation that a reclaimed
+ *    Lambda container never gets; S1003 measured ~68% delivery);
  *  - stamps each batch with `meta { droppedSinceLast, queueDepth, adapter,
- *    version }` so the backend can report delivery loss.
+ *    version, containerId, enqueuedTotal, deliveredTotal, droppedTotal }`
+ *    so the backend can report delivery loss — including what a container
+ *    that stops reporting left behind (5.14.0).
  * Delivery is at-least-once: a POST that times out after the backend
  * recorded it is retried.
  */
@@ -398,6 +411,16 @@ interface BeaconBatchMeta {
     queueDepth: number;
     adapter: string;
     version: string;
+    /**
+     * 5.14.0 (round 27.6): this container's id (one per cold start) and its
+     * cumulative item counters. The backend keeps the last report per
+     * container, so items stranded in a container that stops reporting (a
+     * reclaimed Lambda) are counted instead of silently vanishing.
+     */
+    containerId: string;
+    enqueuedTotal: number;
+    deliveredTotal: number;
+    droppedTotal: number;
 }
 interface BeaconBufferOptions {
     /** Max queued items; the oldest is dropped (and counted) beyond it. Default 1000. */
@@ -408,6 +431,16 @@ interface BeaconBufferOptions {
     maxAttempts?: number;
     /** Repeat-collapse window. Default 60s. */
     collapseWindowMs?: number;
+    /**
+     * Pre-5.14 behaviour: hold a repeat aggregate until its collapse window
+     * closes. Off by default — a held item waits up to 60s for a later
+     * invocation of the same container, and a container that is never
+     * invoked again loses it (round 27.6, S1003: ~32% loss on staging). Kept
+     * only so the delivery simulator can compare the two.
+     */
+    holdRepeats?: boolean;
+    /** Container id stamped on batch meta. Default: one per module load. */
+    containerId?: string;
     /** Max distinct repeat keys remembered (LRU). Default 1000. */
     collapseMaxKeys?: number;
     /** Per-POST timeout (the budget is the caller's; this bounds a hung POST). Default 10s. */
@@ -422,6 +455,7 @@ declare class BeaconBuffer {
     private droppedSinceLast;
     private droppedTotal;
     private deliveredTotal;
+    private enqueuedTotal;
     private inFlight;
     private backoffUntil;
     private readonly collapse;
@@ -431,8 +465,9 @@ declare class BeaconBuffer {
     constructor(options?: BeaconBufferOptions);
     /**
      * Queue one beacon. With a `collapseKey`, a repeat inside the window is
-     * merged into a held aggregate (sent when the window closes) instead of
-     * becoming its own item.
+     * merged into this key's item while that item is still queued (not yet in
+     * flight). Once it has left, the repeat becomes a new item, sendable on
+     * this flush — nothing waits for a later invocation (round 27.6).
      */
     enqueue(dest: BeaconDestination, item: BeaconItem, collapseKey?: string): void;
     /**
@@ -448,6 +483,7 @@ declare class BeaconBuffer {
         droppedSinceLast: number;
         droppedTotal: number;
         deliveredTotal: number;
+        enqueuedTotal: number;
         flushing: boolean;
     };
     private push;
@@ -510,6 +546,7 @@ interface ManualReviewBody {
     message: string;
     stepUpApproval?: {
         pollUrl?: string;
+        approvalUrl?: string;
         expiresAt?: string;
     };
     correlationId?: string;
@@ -576,4 +613,4 @@ declare function requestUrl(req: NormalizedRequest, host: string): string;
  */
 declare function buildObservedMetadata(req: NormalizedRequest, queryValueAllowlist?: string[]): ObservedMetadata;
 
-export { ASAT_HEADERS, type BeaconBatchMeta, BeaconBuffer, type BeaconBufferOptions, type BeaconDestination, type BeaconItem, type Classification, type DenyBody, type DetectedCommerce, type EdgeCoreOptions, type EdgeDecision, type EdgeEvaluation, type EdgeLogger, type EffectivePolicy, type ManualReviewBody, type NormalizedRequest, type OutcomeApplication, type PlatformIo, type TierOutcome, type TrafficTier, _patterns, applyOutcome, buildDenyBody, buildManualReviewBody, buildObservedMetadata, buildVerificationRequest, classify, detectCommerce, emitBeacon, evaluateEdgeRequest, getBeaconBuffer, headerValue, outcomeFromVerifyResult, passUntouched, requestUrl, resetBeaconBuffer, resolvePolicy, runTier, sampled, withBudget };
+export { ASAT_HEADERS, type BeaconBatchMeta, BeaconBuffer, type BeaconBufferOptions, type BeaconDestination, type BeaconItem, type Classification, type DenyBody, type DetectedCommerce, type EdgeCoreOptions, type EdgeDecision, type EdgeEvaluation, type EdgeLogger, type EffectivePolicy, type ManualReviewBody, type NormalizedRequest, type OutcomeApplication, type PlatformIo, type TierOutcome, type TrafficTier, _patterns, applyOutcome, buildDenyBody, buildManualReviewBody, buildObservedMetadata, buildVerificationRequest, checkMinTls, classify, detectCommerce, emitBeacon, evaluateEdgeRequest, getBeaconBuffer, headerValue, negotiatedTlsVersion, outcomeFromVerifyResult, passUntouched, requestUrl, resetBeaconBuffer, resolvePolicy, runTier, sampled, withBudget };

package/dist/edge-core/index.js

@@ -28,12 +28,14 @@ __export(edge_core_exports, {
   buildManualReviewBody: () => buildManualReviewBody,
   buildObservedMetadata: () => buildObservedMetadata,
   buildVerificationRequest: () => buildVerificationRequest,
+  checkMinTls: () => checkMinTls,
   classify: () => classify,
   detectCommerce: () => detectCommerce,
   emitBeacon: () => emitBeacon,
   evaluateEdgeRequest: () => evaluateEdgeRequest,
   getBeaconBuffer: () => getBeaconBuffer,
   headerValue: () => headerValue,
+  negotiatedTlsVersion: () => negotiatedTlsVersion,
   outcomeFromVerifyResult: () => outcomeFromVerifyResult,
   passUntouched: () => passUntouched,
   requestUrl: () => requestUrl,
@@ -46,7 +48,7 @@ __export(edge_core_exports, {
 module.exports = __toCommonJS(edge_core_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.13.0";
+var SDK_VERSION = "5.15.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -66,6 +68,29 @@ function withUserAgent(initHeaders) {
 }
 var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
+// src/route-pattern.ts
+function routePatternToRegExp(pattern, opts = {}) {
+  let source = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      source += ".*";
+    } else if (ch === ":" && /[A-Za-z_]/.test(pattern[i + 1] ?? "") && (i === 0 || pattern[i - 1] === "/")) {
+      let j = i + 1;
+      while (j < pattern.length && /[A-Za-z0-9_]/.test(pattern[j])) j++;
+      source += "[^/]+";
+      i = j - 1;
+    } else {
+      source += ch.replace(/[.+?^${}()|[\]\\/]/g, "\\$&");
+    }
+  }
+  try {
+    return new RegExp(`^${source}$`, opts.caseInsensitive ? "i" : "");
+  } catch {
+    return null;
+  }
+}
+
 // src/edge-config.ts
 var DEFAULT_EDGE_CONFIG = Object.freeze({
   version: 1,
@@ -84,8 +109,7 @@ function matchEdgePathRule(rules, path) {
   return void 0;
 }
 function globToRegExp(pattern) {
-  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i");
+  return routePatternToRegExp(pattern, { caseInsensitive: true }) ?? /$^/;
 }
 
 // src/metadata-capture.ts
@@ -730,6 +754,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -880,7 +905,8 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -961,7 +987,10 @@ async function verify(config, request, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -971,7 +1000,10 @@ async function verify(config, request, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -1022,7 +1054,11 @@ async function verify(config, request, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -1042,7 +1078,9 @@ async function verify(config, request, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -1241,7 +1279,7 @@ function detectCommerce(req, host) {
       };
     }
   }
-  if (authHeader && /^Payment\s+/i.test(authHeader)) {
+  if (authHeader && /^Payment\s+/i.test(authHeader) || headerValue(req, "payment-authorization")) {
     return {
       protocol: "mpp",
       artifacts: {
@@ -1256,7 +1294,7 @@ function detectCommerce(req, host) {
       evidence: truncated
     };
   }
-  if (headerValue(req, "x-payment")) {
+  if (headerValue(req, "payment-signature") || headerValue(req, "x-payment")) {
     return {
       protocol: "x402",
       artifacts: {
@@ -1581,6 +1619,11 @@ async function withBudget(promise, ms) {
     if (timer) clearTimeout(timer);
   }
 }
+var CONTAINER_ID = (() => {
+  const c = globalThis.crypto;
+  if (c?.randomUUID) return c.randomUUID();
+  return `c-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 12)}`;
+})();
 var destKeyOf = (d) => `${d.apiBaseUrl}\0${d.apiKey ?? ""}\0${d.counterparty}\0${d.adapter ?? ""}`;
 var BeaconBuffer = class {
   constructor(options = {}) {
@@ -1588,6 +1631,7 @@ var BeaconBuffer = class {
     this.droppedSinceLast = 0;
     this.droppedTotal = 0;
     this.deliveredTotal = 0;
+    this.enqueuedTotal = 0;
     this.backoffUntil = 0;
     this.collapse = /* @__PURE__ */ new Map();
     /** Keys the backend answered 401 for — later batches go unauthenticated. */
@@ -1600,13 +1644,16 @@ var BeaconBuffer = class {
       collapseMaxKeys: options.collapseMaxKeys ?? 1e3,
       requestTimeoutMs: options.requestTimeoutMs ?? 1e4,
       retryBackoffMs: options.retryBackoffMs ?? 1e3,
+      holdRepeats: options.holdRepeats ?? false,
+      containerId: options.containerId ?? CONTAINER_ID,
       now: options.now ?? Date.now
     };
   }
   /**
    * Queue one beacon. With a `collapseKey`, a repeat inside the window is
-   * merged into a held aggregate (sent when the window closes) instead of
-   * becoming its own item.
+   * merged into this key's item while that item is still queued (not yet in
+   * flight). Once it has left, the repeat becomes a new item, sendable on
+   * this flush — nothing waits for a later invocation (round 27.6).
    */
   enqueue(dest, item, collapseKey) {
     const now = this.opts.now();
@@ -1619,12 +1666,15 @@ var BeaconBuffer = class {
             return;
           }
         }
-        const held = this.push(
-          dest,
-          { ...item, repeatCount: 1 },
-          entry.firstSeenAt + this.opts.collapseWindowMs
-        );
-        entry.held = held;
+        if (this.opts.holdRepeats) {
+          entry.held = this.push(
+            dest,
+            { ...item, repeatCount: 1 },
+            entry.firstSeenAt + this.opts.collapseWindowMs
+          );
+          return;
+        }
+        entry.first = this.push(dest, { ...item, repeatCount: 1 }, now);
         return;
       }
       this.collapse.delete(collapseKey);
@@ -1660,6 +1710,7 @@ var BeaconBuffer = class {
       droppedSinceLast: this.droppedSinceLast,
       droppedTotal: this.droppedTotal,
       deliveredTotal: this.deliveredTotal,
+      enqueuedTotal: this.enqueuedTotal,
       flushing: this.inFlight !== void 0
     };
   }
@@ -1674,6 +1725,7 @@ var BeaconBuffer = class {
       inFlight: false
     };
     this.queue.push(entry);
+    this.enqueuedTotal += 1;
     return entry;
   }
   dropOldest() {
@@ -1719,7 +1771,11 @@ var BeaconBuffer = class {
       droppedSinceLast: reportedDropped,
       queueDepth: this.queue.length,
       adapter: dest.adapter ?? "edge-core",
-      version: SDK_VERSION
+      version: SDK_VERSION,
+      containerId: this.opts.containerId,
+      enqueuedTotal: this.enqueuedTotal,
+      deliveredTotal: this.deliveredTotal,
+      droppedTotal: this.droppedTotal
     };
     const controller = typeof AbortController !== "undefined" ? new AbortController() : void 0;
     const response = await withBudget(
@@ -1900,6 +1956,7 @@ function outcomeFromVerifyResult(classification, result) {
     outcome.reasons = ["step-up approval required"];
     outcome.stepUp = {
       pollUrl: result.stepUpApproval?.pollUrl,
+      approvalUrl: result.stepUpApproval?.approvalUrl,
       expiresAt: result.stepUpApproval?.expiresAt
     };
     return outcome;
@@ -2045,6 +2102,20 @@ async function evaluateEdgeRequest(options, req, config, apiKey) {
     if (classification.tier === "human" || classification.tier === "self") {
       return { policy, classification, application: passUntouched() };
     }
+    const tls = checkMinTls(req, config.minTls);
+    if (tls) {
+      if (policy.mode === "enforce") {
+        options.log?.(
+          "info",
+          `TLS ${tls.negotiated} below ${tls.minimum}: ${req.method} ${req.uri}`
+        );
+        return { policy, classification, application: tlsUpgradeRequired(tls) };
+      }
+      options.log?.(
+        "info",
+        `[OBSERVE] would have required TLS ${tls.minimum} (got ${tls.negotiated}): ${req.method} ${req.uri}`
+      );
+    }
     const outcome = await runTier(options, req, classification, policy, apiKey, {
       sampling: policy.sampling ?? config.sampling,
       queryValueAllowlist: config.queryValueAllowlist
@@ -2069,6 +2140,34 @@ async function evaluateEdgeRequest(options, req, config, apiKey) {
     return { policy, application: passUntouched() };
   }
 }
+function negotiatedTlsVersion(req) {
+  const raw = req.connection?.tlsVersion ?? headerValue(req, "cloudfront-viewer-tls");
+  const m = raw ? /^TLSv(1(?:\.\d)?)/i.exec(raw) : null;
+  return m ? m[1] === "1" ? "1.0" : m[1] : null;
+}
+function checkMinTls(req, minTls) {
+  if (!minTls) return null;
+  const negotiated = negotiatedTlsVersion(req);
+  if (!negotiated) return null;
+  return Number(negotiated) < Number(minTls) ? { minimum: minTls, negotiated } : null;
+}
+function tlsUpgradeRequired(v) {
+  return {
+    action: "respond",
+    status: 426,
+    headers: {
+      "content-type": "application/json",
+      upgrade: `TLS/${v.minimum}`,
+      connection: "Upgrade"
+    },
+    bodyJson: {
+      error: "tls_version_too_low",
+      minimum: `TLS ${v.minimum}`,
+      negotiated: `TLS ${v.negotiated}`,
+      message: `This endpoint requires TLS ${v.minimum} or later for agent requests. Reconnect with TLS ${v.minimum}.`
+    }
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ASAT_HEADERS,
@@ -2079,12 +2178,14 @@ async function evaluateEdgeRequest(options, req, config, apiKey) {
   buildManualReviewBody,
   buildObservedMetadata,
   buildVerificationRequest,
+  checkMinTls,
   classify,
   detectCommerce,
   emitBeacon,
   evaluateEdgeRequest,
   getBeaconBuffer,
   headerValue,
+  negotiatedTlsVersion,
   outcomeFromVerifyResult,
   passUntouched,
   requestUrl,