@astrasyncai/verification-gateway 5.14.0 → 5.16.0

package/dist/adapters/nextjs.mjs

@@ -1,5 +1,430 @@
+// src/metadata-capture.ts
+var CAPTURE_SCHEMA_VERSION = 1;
+var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "cookie",
+  "set-cookie",
+  "x-csrf-token",
+  "proxy-authorization",
+  "x-astrasync-signature",
+  "x-astrasync-secret",
+  "x-hub-signature",
+  "x-hub-signature-256",
+  // Short-lived verify dedupe token — must never persist in stored metadata.
+  "x-astra-verified-hop"
+]);
+var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
+var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "x-api-key",
+  "x-goog-api-key",
+  "api-key"
+]);
+function isSignatureHeader(name) {
+  return name === "signature" || name.endsWith("-signature") || name.endsWith("-signature-256");
+}
+var PLATFORM_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "openai-organization",
+  "openai-project",
+  "openai-version",
+  "openai-processing-ms",
+  "anthropic-version",
+  "anthropic-beta",
+  "x-goog-user-project",
+  "x-goog-api-client",
+  "user-agent",
+  "x-agent-card-url",
+  "x-agent-provider"
+]);
+var PLATFORM_HEADER_PREFIXES = [
+  "x-goog-",
+  "x-stainless-",
+  "x-anthropic-",
+  "x-openai-",
+  "sec-ch-"
+];
+var KEY_FORMAT_PREFIXES = [
+  "sk-ant-api03",
+  "sk-ant-api",
+  "sk-ant",
+  "sk-proj",
+  "sk-svcacct",
+  "sk-or-v1",
+  "sk-or",
+  "sk-lf",
+  "sk-",
+  "gsk_",
+  "aiza",
+  "ya29",
+  "ghp_",
+  "gho_",
+  "github_pat_",
+  "xai-",
+  "pplx-",
+  "r8_",
+  "hf_",
+  "astra-",
+  "astrae-"
+];
+var MAX_HEADERS = 64;
+var MAX_HEADER_VALUE_BYTES = 1024;
+var MAX_TOTAL_BYTES = 16 * 1024;
+function byteLength(s) {
+  let bytes = 0;
+  for (let i = 0; i < s.length; i++) {
+    const code = s.charCodeAt(i);
+    if (code < 128) bytes += 1;
+    else if (code < 2048) bytes += 2;
+    else if (code >= 55296 && code <= 56319) {
+      bytes += 4;
+      i++;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+function extractApiKeyFormat(rawValue) {
+  if (!rawValue) return void 0;
+  let value = rawValue.trim();
+  const spaceIdx = value.indexOf(" ");
+  if (spaceIdx > 0) {
+    const scheme = value.slice(0, spaceIdx).toLowerCase();
+    if (scheme === "bearer" || scheme === "basic" || scheme === "token") {
+      value = value.slice(spaceIdx + 1).trim();
+    }
+  }
+  const lower = value.toLowerCase();
+  for (const prefix of KEY_FORMAT_PREFIXES) {
+    if (lower.startsWith(prefix)) {
+      return prefix;
+    }
+  }
+  return void 0;
+}
+function isSecretHeader(name) {
+  if (SECRET_HEADER_NAMES.has(name)) return true;
+  if (SECRET_HEADER_PREFIXES.some((p) => name.startsWith(p))) return true;
+  if (isSignatureHeader(name)) return true;
+  return false;
+}
+function isPlatformHeader(name) {
+  if (PLATFORM_HEADER_NAMES.has(name)) return true;
+  return PLATFORM_HEADER_PREFIXES.some((p) => name.startsWith(p));
+}
+function sanitizeHeaders(raw) {
+  const headers = {};
+  const platformHeaders = {};
+  let apiKeyFormat;
+  let cookieCount;
+  let totalBytes = 0;
+  let count = 0;
+  if (!raw) return { headers };
+  for (const rawName of Object.keys(raw)) {
+    if (count >= MAX_HEADERS) break;
+    const name = rawName.toLowerCase();
+    const rawValue = raw[rawName];
+    if (rawValue === void 0) continue;
+    const joined = Array.isArray(rawValue) ? rawValue.join(", ") : String(rawValue);
+    if (CREDENTIAL_HEADER_NAMES.has(name)) {
+      const fmt = extractApiKeyFormat(joined);
+      if (fmt && !apiKeyFormat) apiKeyFormat = fmt;
+      continue;
+    }
+    if (name === "cookie") {
+      cookieCount = joined.split(";").filter((s) => s.trim().length > 0).length;
+    }
+    if (isSecretHeader(name)) continue;
+    let value = joined;
+    if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {
+      value = value.slice(0, MAX_HEADER_VALUE_BYTES);
+    }
+    const entryBytes = byteLength(name) + byteLength(value);
+    if (totalBytes + entryBytes > MAX_TOTAL_BYTES) continue;
+    totalBytes += entryBytes;
+    count++;
+    headers[name] = value;
+    if (isPlatformHeader(name)) platformHeaders[name] = value;
+  }
+  const result = { headers };
+  if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;
+  if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
+  if (cookieCount !== void 0) result.cookieCount = cookieCount;
+  return result;
+}
+var CONNECTION_HEADER_SOURCES = [
+  ["ip", ["cf-connecting-ip", "fastly-client-ip", "true-client-ip", "x-real-ip"]],
+  [
+    "country",
+    ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
+  ],
+  ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
+  ["countryRegionName", ["cloudfront-viewer-country-region-name"]],
+  ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
+  ["latitude", ["x-vercel-ip-latitude", "cloudfront-viewer-latitude"]],
+  ["longitude", ["x-vercel-ip-longitude", "cloudfront-viewer-longitude"]],
+  ["postalCode", ["x-vercel-ip-postal-code", "cloudfront-viewer-postal-code"]],
+  ["asn", ["cloudfront-viewer-asn"]],
+  ["tlsVersion", ["cloudfront-viewer-tls"]],
+  ["httpVersion", ["cloudfront-viewer-http-version"]],
+  ["timeZone", ["x-vercel-ip-timezone", "cloudfront-viewer-time-zone"]],
+  ["metroCode", ["cloudfront-viewer-metro-code"]],
+  // TLS fingerprints can only be computed where TLS terminates. When a CDN
+  // terminates TLS in front of the merchant, its fingerprint headers ARE the
+  // connection-layer truth — normalising them here is the permanent design.
+  // CloudFront delivers JA3/JA4 only via an origin request policy and only
+  // for HTTPS viewer connections.
+  ["tlsFingerprint", ["cf-ja3-hash", "cloudfront-viewer-ja3-fingerprint"]],
+  ["ja4", ["cf-ja4", "cloudfront-viewer-ja4-fingerprint"]],
+  // Header-structure fingerprint: browser/SDK-distinctive header ordering.
+  ["headerOrder", ["cloudfront-viewer-header-order"]],
+  ["headerCount", ["cloudfront-viewer-header-count"]]
+];
+var MAX_CONNECTION_VALUE_CHARS = 256;
+function deriveConnectionFromHeaders(headers) {
+  if (!headers) return void 0;
+  const lower = {};
+  for (const name of Object.keys(headers)) {
+    const value = headers[name];
+    if (typeof value === "string" && value.length > 0) lower[name.toLowerCase()] = value;
+  }
+  const connection = {};
+  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {
+    for (const source of sources) {
+      const value = lower[source]?.trim();
+      if (value) {
+        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);
+        break;
+      }
+    }
+  }
+  {
+    const addr = lower["cloudfront-viewer-address"]?.trim();
+    const portMatch = addr?.match(/:(\d+)$/);
+    if (portMatch) connection.sourcePort = portMatch[1];
+    if (!connection.ip && addr) connection.ip = addr.replace(/:\d+$/, "");
+  }
+  if (!connection.ip) {
+    const xff = lower["x-forwarded-for"];
+    const client = xff?.split(",")[0]?.trim();
+    if (client) connection.ip = client;
+  }
+  if (!connection.tlsCipher) {
+    const cipher = connection.tlsVersion?.split(":")[1];
+    if (cipher) connection.tlsCipher = cipher;
+  }
+  return Object.keys(connection).length > 0 ? connection : void 0;
+}
+function buildSdkObservedMetadata(rawHeaders) {
+  const { headers, apiKeyFormat, platformHeaders, cookieCount } = sanitizeHeaders(rawHeaders);
+  const flat = {};
+  if (rawHeaders) {
+    for (const name of Object.keys(rawHeaders)) {
+      const value = rawHeaders[name];
+      if (value === void 0) continue;
+      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
+    }
+  }
+  const connection = deriveConnectionFromHeaders(flat);
+  return {
+    headers,
+    ...apiKeyFormat && { apiKeyFormat },
+    ...platformHeaders && { platformHeaders },
+    ...connection && { connection },
+    ...cookieCount !== void 0 && { cookieCount },
+    schemaVersion: CAPTURE_SCHEMA_VERSION
+  };
+}
+
+// src/edge-core/request.ts
+function headerValue(req, name) {
+  return req.headers[name.toLowerCase()];
+}
+function requestUrl(req, host) {
+  const qs = req.querystring ? `?${req.querystring}` : "";
+  return `https://${host}${req.uri}${qs}`;
+}
+
+// src/edge-core/detect.ts
+var SD_JWT_PATTERN = /^eyJ[\w-]+\.[\w-]*\.[\w-]+~/;
+function decodeBase64Url(seg) {
+  const b64 = seg.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
+}
+function sniffJwtHeader(compact) {
+  try {
+    const seg = compact.split(".")[0];
+    return JSON.parse(decodeBase64Url(seg));
+  } catch {
+    return void 0;
+  }
+}
+function parseJsonBody(bodyText) {
+  if (!bodyText) return void 0;
+  try {
+    const parsed = JSON.parse(bodyText);
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function detectCommerce(req, host) {
+  const url = requestUrl(req, host);
+  const method = req.method;
+  const headers = req.headers;
+  const jsonBody = parseJsonBody(req.bodyText);
+  const truncated = req.bodyTruncated ? { bodyTruncated: true } : {};
+  const authHeader = headerValue(req, "authorization");
+  const bearer = authHeader?.replace(/^Bearer\s+/i, "");
+  const mandateHeader = headerValue(req, "x-payment-mandate") ?? headerValue(req, "payment-mandate");
+  const sdJwtCandidate = [mandateHeader, bearer].find((v) => v && SD_JWT_PATTERN.test(v));
+  if (sdJwtCandidate) {
+    const typ = sniffJwtHeader(sdJwtCandidate)?.typ;
+    return {
+      protocol: "vi-sd-jwt",
+      artifacts: { viSdJwt: sdJwtCandidate },
+      evidence: { typ, ...truncated }
+    };
+  }
+  const signature = headerValue(req, "signature");
+  const signatureInput = headerValue(req, "signature-input");
+  if (signature && signatureInput) {
+    const signatureAgent = headerValue(req, "signature-agent");
+    const registryHint = headerValue(req, "x-agent-registry");
+    const lowerInput = signatureInput.toLowerCase();
+    const protocol = signatureAgent ? "rfc9421-web-bot-auth" : registryHint?.toLowerCase().includes("visa") || lowerInput.includes("visa") ? "rfc9421-tap" : registryHint?.toLowerCase().includes("mastercard") || lowerInput.includes("mastercard") ? "rfc9421-agent-pay" : "rfc9421";
+    return {
+      protocol,
+      artifacts: {
+        rfc9421: { headers, method, url, ...req.bodyText && { body: req.bodyText } }
+      },
+      evidence: {
+        ...signatureAgent && { signatureAgent },
+        ...registryHint && { registryHint },
+        keyid: signatureInput.match(/keyid="([^"]+)"/)?.[1],
+        ...truncated
+      }
+    };
+  }
+  const acpTimestamp = headerValue(req, "timestamp");
+  if (signature && !signatureInput && (acpTimestamp || headerValue(req, "idempotency-key"))) {
+    return {
+      protocol: "acp",
+      artifacts: {
+        acpRequest: {
+          method,
+          url,
+          headers,
+          ...req.bodyText && { rawBody: req.bodyText },
+          ...jsonBody && { body: jsonBody }
+        }
+      },
+      evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
+    };
+  }
+  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
+    return {
+      protocol: "ucp",
+      artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
+      evidence: { path: req.uri, ...truncated }
+    };
+  }
+  if (jsonBody) {
+    const intent = jsonBody.intent_mandate ?? jsonBody.intentMandate;
+    const cart = jsonBody.cart_mandate ?? jsonBody.cartMandate;
+    const payment = jsonBody.payment_mandate ?? jsonBody.paymentMandate;
+    if (typeof intent === "string" || typeof cart === "string" || typeof payment === "string") {
+      return {
+        protocol: "ap2",
+        artifacts: {
+          ap2Mandates: {
+            ...typeof intent === "string" && { intent },
+            ...typeof cart === "string" && { cart },
+            ...typeof payment === "string" && { payment }
+          }
+        },
+        evidence: {
+          mandatesPresent: [
+            typeof intent === "string" && "intent",
+            typeof cart === "string" && "cart",
+            typeof payment === "string" && "payment"
+          ].filter(Boolean),
+          ...truncated
+        }
+      };
+    }
+  }
+  if (authHeader && /^Payment\s+/i.test(authHeader) || headerValue(req, "payment-authorization")) {
+    return {
+      protocol: "mpp",
+      artifacts: {
+        mppRequest: {
+          method,
+          url,
+          headers,
+          ...req.bodyText && { rawBody: req.bodyText },
+          ...jsonBody && { body: jsonBody }
+        }
+      },
+      evidence: truncated
+    };
+  }
+  if (headerValue(req, "payment-signature") || headerValue(req, "x-payment")) {
+    return {
+      protocol: "x402",
+      artifacts: {
+        x402Request: { method, url, headers, ...jsonBody && { body: jsonBody } }
+      },
+      evidence: truncated
+    };
+  }
+  return void 0;
+}
+
+// src/adapters/commerce-detect.ts
+var MAX_BODY_BYTES = 64 * 1024;
+function detect(req, host) {
+  try {
+    return detectCommerce(req, host)?.artifacts;
+  } catch {
+    return void 0;
+  }
+}
+async function detectFetchCommerce(request) {
+  const url = new URL(request.url);
+  const headers = {};
+  request.headers.forEach((v, k) => headers[k.toLowerCase()] = v);
+  let bodyText;
+  const length = Number(headers["content-length"] ?? 0);
+  if (request.method !== "GET" && request.method !== "HEAD" && length <= MAX_BODY_BYTES) {
+    bodyText = await request.clone().text().catch(() => void 0);
+  }
+  return detect(
+    {
+      method: request.method,
+      uri: url.pathname,
+      querystring: url.search.replace(/^\?/, ""),
+      headers,
+      ...bodyText ? { bodyText } : {}
+    },
+    headers["x-forwarded-host"] ?? url.host
+  );
+}
+
+// src/types.ts
+function routePolicyOf(route) {
+  if (!route) return void 0;
+  const owners = route.allowedOwners?.filter(Boolean) ?? [];
+  const policy = {
+    ...owners.length > 0 && { allowedOwners: owners },
+    ...route.requiresRuntimeChallenge === true && { requiresRuntimeChallenge: true }
+  };
+  return Object.keys(policy).length > 0 ? policy : void 0;
+}
+
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -247,6 +672,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -453,6 +880,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -463,6 +891,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -613,7 +1042,8 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -694,7 +1124,10 @@ async function verify(config, request, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -704,7 +1137,10 @@ async function verify(config, request, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -755,7 +1191,11 @@ async function verify(config, request, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -775,7 +1215,9 @@ async function verify(config, request, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -929,239 +1371,30 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   return failures;
 }
 
-// src/metadata-capture.ts
-var CAPTURE_SCHEMA_VERSION = 1;
-var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
-  "cookie",
-  "set-cookie",
-  "x-csrf-token",
-  "proxy-authorization",
-  "x-astrasync-signature",
-  "x-astrasync-secret",
-  "x-hub-signature",
-  "x-hub-signature-256",
-  // Short-lived verify dedupe token — must never persist in stored metadata.
-  "x-astra-verified-hop"
-]);
-var SECRET_HEADER_PREFIXES = ["x-astrasync-", "kya-", "kya_"];
-var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
-  "authorization",
-  "x-api-key",
-  "x-goog-api-key",
-  "api-key"
-]);
-function isSignatureHeader(name) {
-  return name === "signature" || name.endsWith("-signature") || name.endsWith("-signature-256");
-}
-var PLATFORM_HEADER_NAMES = /* @__PURE__ */ new Set([
-  "openai-organization",
-  "openai-project",
-  "openai-version",
-  "openai-processing-ms",
-  "anthropic-version",
-  "anthropic-beta",
-  "x-goog-user-project",
-  "x-goog-api-client",
-  "user-agent",
-  "x-agent-card-url",
-  "x-agent-provider"
-]);
-var PLATFORM_HEADER_PREFIXES = [
-  "x-goog-",
-  "x-stainless-",
-  "x-anthropic-",
-  "x-openai-",
-  "sec-ch-"
-];
-var KEY_FORMAT_PREFIXES = [
-  "sk-ant-api03",
-  "sk-ant-api",
-  "sk-ant",
-  "sk-proj",
-  "sk-svcacct",
-  "sk-or-v1",
-  "sk-or",
-  "sk-lf",
-  "sk-",
-  "gsk_",
-  "aiza",
-  "ya29",
-  "ghp_",
-  "gho_",
-  "github_pat_",
-  "xai-",
-  "pplx-",
-  "r8_",
-  "hf_",
-  "astra-",
-  "astrae-"
-];
-var MAX_HEADERS = 64;
-var MAX_HEADER_VALUE_BYTES = 1024;
-var MAX_TOTAL_BYTES = 16 * 1024;
-function byteLength(s) {
-  let bytes = 0;
-  for (let i = 0; i < s.length; i++) {
-    const code = s.charCodeAt(i);
-    if (code < 128) bytes += 1;
-    else if (code < 2048) bytes += 2;
-    else if (code >= 55296 && code <= 56319) {
-      bytes += 4;
-      i++;
-    } else bytes += 3;
-  }
-  return bytes;
-}
-function extractApiKeyFormat(rawValue) {
-  if (!rawValue) return void 0;
-  let value = rawValue.trim();
-  const spaceIdx = value.indexOf(" ");
-  if (spaceIdx > 0) {
-    const scheme = value.slice(0, spaceIdx).toLowerCase();
-    if (scheme === "bearer" || scheme === "basic" || scheme === "token") {
-      value = value.slice(spaceIdx + 1).trim();
-    }
-  }
-  const lower = value.toLowerCase();
-  for (const prefix of KEY_FORMAT_PREFIXES) {
-    if (lower.startsWith(prefix)) {
-      return prefix;
-    }
-  }
-  return void 0;
-}
-function isSecretHeader(name) {
-  if (SECRET_HEADER_NAMES.has(name)) return true;
-  if (SECRET_HEADER_PREFIXES.some((p) => name.startsWith(p))) return true;
-  if (isSignatureHeader(name)) return true;
-  return false;
-}
-function isPlatformHeader(name) {
-  if (PLATFORM_HEADER_NAMES.has(name)) return true;
-  return PLATFORM_HEADER_PREFIXES.some((p) => name.startsWith(p));
-}
-function sanitizeHeaders(raw) {
-  const headers = {};
-  const platformHeaders = {};
-  let apiKeyFormat;
-  let cookieCount;
-  let totalBytes = 0;
-  let count = 0;
-  if (!raw) return { headers };
-  for (const rawName of Object.keys(raw)) {
-    if (count >= MAX_HEADERS) break;
-    const name = rawName.toLowerCase();
-    const rawValue = raw[rawName];
-    if (rawValue === void 0) continue;
-    const joined = Array.isArray(rawValue) ? rawValue.join(", ") : String(rawValue);
-    if (CREDENTIAL_HEADER_NAMES.has(name)) {
-      const fmt = extractApiKeyFormat(joined);
-      if (fmt && !apiKeyFormat) apiKeyFormat = fmt;
-      continue;
-    }
-    if (name === "cookie") {
-      cookieCount = joined.split(";").filter((s) => s.trim().length > 0).length;
-    }
-    if (isSecretHeader(name)) continue;
-    let value = joined;
-    if (byteLength(value) > MAX_HEADER_VALUE_BYTES) {
-      value = value.slice(0, MAX_HEADER_VALUE_BYTES);
-    }
-    const entryBytes = byteLength(name) + byteLength(value);
-    if (totalBytes + entryBytes > MAX_TOTAL_BYTES) continue;
-    totalBytes += entryBytes;
-    count++;
-    headers[name] = value;
-    if (isPlatformHeader(name)) platformHeaders[name] = value;
-  }
-  const result = { headers };
-  if (apiKeyFormat) result.apiKeyFormat = apiKeyFormat;
-  if (Object.keys(platformHeaders).length > 0) result.platformHeaders = platformHeaders;
-  if (cookieCount !== void 0) result.cookieCount = cookieCount;
-  return result;
-}
-var CONNECTION_HEADER_SOURCES = [
-  ["ip", ["cf-connecting-ip", "fastly-client-ip", "true-client-ip", "x-real-ip"]],
-  [
-    "country",
-    ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
-  ],
-  ["region", ["x-vercel-ip-country-region", "cloudfront-viewer-country-region"]],
-  ["countryRegionName", ["cloudfront-viewer-country-region-name"]],
-  ["city", ["x-vercel-ip-city", "cloudfront-viewer-city"]],
-  ["latitude", ["x-vercel-ip-latitude", "cloudfront-viewer-latitude"]],
-  ["longitude", ["x-vercel-ip-longitude", "cloudfront-viewer-longitude"]],
-  ["postalCode", ["x-vercel-ip-postal-code", "cloudfront-viewer-postal-code"]],
-  ["asn", ["cloudfront-viewer-asn"]],
-  ["tlsVersion", ["cloudfront-viewer-tls"]],
-  ["httpVersion", ["cloudfront-viewer-http-version"]],
-  ["timeZone", ["x-vercel-ip-timezone", "cloudfront-viewer-time-zone"]],
-  ["metroCode", ["cloudfront-viewer-metro-code"]],
-  // TLS fingerprints can only be computed where TLS terminates. When a CDN
-  // terminates TLS in front of the merchant, its fingerprint headers ARE the
-  // connection-layer truth — normalising them here is the permanent design.
-  // CloudFront delivers JA3/JA4 only via an origin request policy and only
-  // for HTTPS viewer connections.
-  ["tlsFingerprint", ["cf-ja3-hash", "cloudfront-viewer-ja3-fingerprint"]],
-  ["ja4", ["cf-ja4", "cloudfront-viewer-ja4-fingerprint"]],
-  // Header-structure fingerprint: browser/SDK-distinctive header ordering.
-  ["headerOrder", ["cloudfront-viewer-header-order"]],
-  ["headerCount", ["cloudfront-viewer-header-count"]]
-];
-var MAX_CONNECTION_VALUE_CHARS = 256;
-function deriveConnectionFromHeaders(headers) {
-  if (!headers) return void 0;
-  const lower = {};
-  for (const name of Object.keys(headers)) {
-    const value = headers[name];
-    if (typeof value === "string" && value.length > 0) lower[name.toLowerCase()] = value;
-  }
-  const connection = {};
-  for (const [key, sources] of CONNECTION_HEADER_SOURCES) {
-    for (const source of sources) {
-      const value = lower[source]?.trim();
-      if (value) {
-        connection[key] = value.slice(0, MAX_CONNECTION_VALUE_CHARS);
-        break;
-      }
+// src/route-pattern.ts
+function routePatternToRegExp(pattern, opts = {}) {
+  let source = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      source += ".*";
+    } else if (ch === ":" && /[A-Za-z_]/.test(pattern[i + 1] ?? "") && (i === 0 || pattern[i - 1] === "/")) {
+      let j = i + 1;
+      while (j < pattern.length && /[A-Za-z0-9_]/.test(pattern[j])) j++;
+      source += "[^/]+";
+      i = j - 1;
+    } else {
+      source += ch.replace(/[.+?^${}()|[\]\\/]/g, "\\$&");
     }
   }
-  {
-    const addr = lower["cloudfront-viewer-address"]?.trim();
-    const portMatch = addr?.match(/:(\d+)$/);
-    if (portMatch) connection.sourcePort = portMatch[1];
-    if (!connection.ip && addr) connection.ip = addr.replace(/:\d+$/, "");
-  }
-  if (!connection.ip) {
-    const xff = lower["x-forwarded-for"];
-    const client = xff?.split(",")[0]?.trim();
-    if (client) connection.ip = client;
-  }
-  if (!connection.tlsCipher) {
-    const cipher = connection.tlsVersion?.split(":")[1];
-    if (cipher) connection.tlsCipher = cipher;
+  try {
+    return new RegExp(`^${source}$`, opts.caseInsensitive ? "i" : "");
+  } catch {
+    return null;
   }
-  return Object.keys(connection).length > 0 ? connection : void 0;
 }
-function buildSdkObservedMetadata(rawHeaders) {
-  const { headers, apiKeyFormat, platformHeaders, cookieCount } = sanitizeHeaders(rawHeaders);
-  const flat = {};
-  if (rawHeaders) {
-    for (const name of Object.keys(rawHeaders)) {
-      const value = rawHeaders[name];
-      if (value === void 0) continue;
-      flat[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
-    }
-  }
-  const connection = deriveConnectionFromHeaders(flat);
-  return {
-    headers,
-    ...apiKeyFormat && { apiKeyFormat },
-    ...platformHeaders && { platformHeaders },
-    ...connection && { connection },
-    ...cookieCount !== void 0 && { cookieCount },
-    schemaVersion: CAPTURE_SCHEMA_VERSION
-  };
+function matchRoutePattern(pattern, path, opts = {}) {
+  return routePatternToRegExp(pattern, opts)?.test(path) ?? false;
 }
 
 // src/edge-config.ts
@@ -1196,6 +1429,7 @@ function isEdgeConfig(value) {
     if (r.sampling !== void 0 && !isSamplingShape(r.sampling)) return false;
   }
   if (!isSamplingShape(v.sampling)) return false;
+  if (v.minTls !== void 0 && v.minTls !== "1.2" && v.minTls !== "1.3") return false;
   if (v.queryValueAllowlist !== void 0) {
     if (!Array.isArray(v.queryValueAllowlist) || v.queryValueAllowlist.length > 16 || !v.queryValueAllowlist.every((e) => typeof e === "string" && e.length > 0 && e.length <= 64)) {
       return false;
@@ -1911,9 +2145,7 @@ function extractCredentialsFromNextRequest(request) {
   return credentials;
 }
 function matchRoute(pattern, path) {
-  const regexPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
-  const regex = new RegExp(`^${regexPattern}$`);
-  return regex.test(path);
+  return matchRoutePattern(pattern, path);
 }
 function findRouteConfig(routes, path, method) {
   return routes.find((route) => {
@@ -2104,7 +2336,8 @@ function createMiddleware(options) {
     skipPaths = [],
     showInterstitial,
     showCommerceShield,
-    enableRuntimeChallenge = true,
+    // Round 27.8: opt-in only (the merchant turns it on); was default-on.
+    enableRuntimeChallenge = false,
     routesRefreshMs = DEFAULT_ROUTES_REFRESH_MS,
     anonymousBeacon = true,
     trustVerifiedHop = false,
@@ -2241,14 +2474,17 @@ function createMiddleware(options) {
     const originalClientIp = forwardedFor?.split(",")[0]?.trim();
     const attemptHeader = request.headers.get("x-astra-attempt-id");
     const inboundAttemptId = attemptHeader && /^att_[0-9a-f]{32}$/.test(attemptHeader) ? attemptHeader : void 0;
+    const commerceArtifacts = await detectFetchCommerce(request);
     const verificationRequest = {
       credentials,
+      ...commerceArtifacts && { commerceArtifacts },
       purpose,
       action: pdlssPair.action,
       resource: pathname,
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",
       enableRuntimeChallenge,
+      ...routePolicyOf(routeConfig) && { routePolicy: routePolicyOf(routeConfig) },
       durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
       ...inboundAttemptId && { attemptId: inboundAttemptId },
       callerMetadata: {