@astrasyncai/verification-gateway 5.14.0 → 5.16.0

package/dist/edge-core/index.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -19,6 +19,29 @@ function withUserAgent(initHeaders) {
 }
 var sdkFetch = (input, init) => fetch(input, { ...init, headers: withUserAgent(init?.headers) });
 
+// src/route-pattern.ts
+function routePatternToRegExp(pattern, opts = {}) {
+  let source = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      source += ".*";
+    } else if (ch === ":" && /[A-Za-z_]/.test(pattern[i + 1] ?? "") && (i === 0 || pattern[i - 1] === "/")) {
+      let j = i + 1;
+      while (j < pattern.length && /[A-Za-z0-9_]/.test(pattern[j])) j++;
+      source += "[^/]+";
+      i = j - 1;
+    } else {
+      source += ch.replace(/[.+?^${}()|[\]\\/]/g, "\\$&");
+    }
+  }
+  try {
+    return new RegExp(`^${source}$`, opts.caseInsensitive ? "i" : "");
+  } catch {
+    return null;
+  }
+}
+
 // src/edge-config.ts
 var DEFAULT_EDGE_CONFIG = Object.freeze({
   version: 1,
@@ -37,8 +60,7 @@ function matchEdgePathRule(rules, path) {
   return void 0;
 }
 function globToRegExp(pattern) {
-  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i");
+  return routePatternToRegExp(pattern, { caseInsensitive: true }) ?? /$^/;
 }
 
 // src/metadata-capture.ts
@@ -467,6 +489,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -673,6 +697,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -683,6 +708,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -833,7 +859,8 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -914,7 +941,10 @@ async function verify(config, request, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -924,7 +954,10 @@ async function verify(config, request, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -975,7 +1008,11 @@ async function verify(config, request, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -995,7 +1032,9 @@ async function verify(config, request, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -1162,7 +1201,7 @@ function detectCommerce(req, host) {
       evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
     };
   }
-  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri)) {
+  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
     return {
       protocol: "ucp",
       artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
@@ -1194,7 +1233,7 @@ function detectCommerce(req, host) {
       };
     }
   }
-  if (authHeader && /^Payment\s+/i.test(authHeader)) {
+  if (authHeader && /^Payment\s+/i.test(authHeader) || headerValue(req, "payment-authorization")) {
     return {
       protocol: "mpp",
       artifacts: {
@@ -1209,7 +1248,7 @@ function detectCommerce(req, host) {
       evidence: truncated
     };
   }
-  if (headerValue(req, "x-payment")) {
+  if (headerValue(req, "payment-signature") || headerValue(req, "x-payment")) {
     return {
       protocol: "x402",
       artifacts: {
@@ -1871,6 +1910,7 @@ function outcomeFromVerifyResult(classification, result) {
     outcome.reasons = ["step-up approval required"];
     outcome.stepUp = {
       pollUrl: result.stepUpApproval?.pollUrl,
+      approvalUrl: result.stepUpApproval?.approvalUrl,
       expiresAt: result.stepUpApproval?.expiresAt
     };
     return outcome;
@@ -2016,6 +2056,20 @@ async function evaluateEdgeRequest(options, req, config, apiKey) {
     if (classification.tier === "human" || classification.tier === "self") {
       return { policy, classification, application: passUntouched() };
     }
+    const tls = checkMinTls(req, config.minTls);
+    if (tls) {
+      if (policy.mode === "enforce") {
+        options.log?.(
+          "info",
+          `TLS ${tls.negotiated} below ${tls.minimum}: ${req.method} ${req.uri}`
+        );
+        return { policy, classification, application: tlsUpgradeRequired(tls) };
+      }
+      options.log?.(
+        "info",
+        `[OBSERVE] would have required TLS ${tls.minimum} (got ${tls.negotiated}): ${req.method} ${req.uri}`
+      );
+    }
     const outcome = await runTier(options, req, classification, policy, apiKey, {
       sampling: policy.sampling ?? config.sampling,
       queryValueAllowlist: config.queryValueAllowlist
@@ -2040,6 +2094,34 @@ async function evaluateEdgeRequest(options, req, config, apiKey) {
     return { policy, application: passUntouched() };
   }
 }
+function negotiatedTlsVersion(req) {
+  const raw = req.connection?.tlsVersion ?? headerValue(req, "cloudfront-viewer-tls");
+  const m = raw ? /^TLSv(1(?:\.\d)?)/i.exec(raw) : null;
+  return m ? m[1] === "1" ? "1.0" : m[1] : null;
+}
+function checkMinTls(req, minTls) {
+  if (!minTls) return null;
+  const negotiated = negotiatedTlsVersion(req);
+  if (!negotiated) return null;
+  return Number(negotiated) < Number(minTls) ? { minimum: minTls, negotiated } : null;
+}
+function tlsUpgradeRequired(v) {
+  return {
+    action: "respond",
+    status: 426,
+    headers: {
+      "content-type": "application/json",
+      upgrade: `TLS/${v.minimum}`,
+      connection: "Upgrade"
+    },
+    bodyJson: {
+      error: "tls_version_too_low",
+      minimum: `TLS ${v.minimum}`,
+      negotiated: `TLS ${v.negotiated}`,
+      message: `This endpoint requires TLS ${v.minimum} or later for agent requests. Reconnect with TLS ${v.minimum}.`
+    }
+  };
+}
 export {
   ASAT_HEADERS,
   BeaconBuffer,
@@ -2049,12 +2131,14 @@ export {
   buildManualReviewBody,
   buildObservedMetadata,
   buildVerificationRequest,
+  checkMinTls,
   classify,
   detectCommerce,
   emitBeacon,
   evaluateEdgeRequest,
   getBeaconBuffer,
   headerValue,
+  negotiatedTlsVersion,
   outcomeFromVerifyResult,
   passUntouched,
   requestUrl,