@astrasyncai/verification-gateway 5.17.2 → 5.18.1

package/dist/adapters/express.mjs

@@ -289,6 +289,23 @@ function detectCommerce(req, host) {
   }
   const signature = headerValue(req, "signature");
   const signatureInput = headerValue(req, "signature-input");
+  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
+    const signed = Boolean(signature && signatureInput);
+    return {
+      protocol: "ucp",
+      artifacts: {
+        ucpRequest: { method, url, ...jsonBody && { body: jsonBody } },
+        ...signed && {
+          rfc9421: { headers, method, url, ...req.bodyText && { body: req.bodyText } }
+        }
+      },
+      evidence: {
+        path: req.uri,
+        ...signed && { keyid: signatureInput.match(/keyid="([^"]+)"/)?.[1] },
+        ...truncated
+      }
+    };
+  }
   if (signature && signatureInput) {
     const signatureAgent = headerValue(req, "signature-agent");
     const registryHint = headerValue(req, "x-agent-registry");
@@ -323,13 +340,6 @@ function detectCommerce(req, host) {
       evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
     };
   }
-  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
-    return {
-      protocol: "ucp",
-      artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
-      evidence: { path: req.uri, ...truncated }
-    };
-  }
   if (jsonBody) {
     const intent = jsonBody.intent_mandate ?? jsonBody.intentMandate;
     const cart = jsonBody.cart_mandate ?? jsonBody.cartMandate;
@@ -442,7 +452,7 @@ function routePolicyOf(route) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.17.2";
+var SDK_VERSION = "5.18.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -2334,6 +2344,7 @@ function createMiddleware(options) {
     anonymousBeacon = true,
     trustVerifiedHop = false,
     verifiedHopMaxAgeMs,
+    defaultRoutePolicy = "pass",
     ...config
   } = options;
   if (config.apiBaseUrl) {
@@ -2399,12 +2410,15 @@ function createMiddleware(options) {
         });
       }
       const correlationId = req.headers["x-request-id"] || req.headers["x-correlation-id"];
-      const routeConfig = findRouteConfig(cachedRoutes, req.path, req.method, {
+      const matchedRoute = findRouteConfig(cachedRoutes, req.path, req.method, {
         caseInsensitive: caseInsensitiveRouteMatch,
         logShadowDivergence: true,
         correlationId
       });
-      if (!routeConfig) {
+      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
+      const credentialed = Boolean(credentials.astraId || credentials.apiKey || credentials.jwt);
+      const observeUnmatched = !matchedRoute && (config.evaluateAlwaysIfCredentialed === true && Boolean(credentials.astraId) || defaultRoutePolicy === "observe" && credentialed);
+      if (!matchedRoute && !observeUnmatched) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "unenforced");
           res.setHeader(
@@ -2415,10 +2429,14 @@ function createMiddleware(options) {
         beaconPassThrough?.(req);
         return next();
       }
+      const routeConfig = matchedRoute ?? {
+        pattern: req.path,
+        method: req.method,
+        observe: true
+      };
       const wellKnownUrls = config.apiBaseUrl ? await getWellKnownUrls(config.apiBaseUrl).catch(() => void 0) : void 0;
-      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
       const shouldEnforce = !routeConfig.observe;
-      if (routeConfig.observe && (!config.evaluateAlwaysIfCredentialed || !credentials.astraId)) {
+      if (routeConfig.observe && !observeUnmatched && (!config.evaluateAlwaysIfCredentialed || !credentials.astraId)) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "unenforced");
           res.setHeader("X-Astra-Gateway-Reason", "route-observe");