@astrasyncai/verification-gateway 5.21.1 → 5.21.2

package/dist/index.d.mts

@@ -5322,7 +5322,7 @@ declare function _resetEdgeConfigCache(): void;
  * Pure regex — no Node built-ins, edge-safe. Detection is regex-only for
  * v2.9 — TLS fingerprinting / behavioural signatures are deferred.
  */
-type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'perplexity' | 'chatgpt-atlas' | 'perplexity-comet' | 'astrasync-bridge' | 'astrasync-sdk' | 'unknown';
+type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'perplexity' | 'grok' | 'meta-ai' | 'chatgpt-atlas' | 'perplexity-comet' | 'astrasync-bridge' | 'astrasync-sdk' | 'unknown';
 interface PlatformFingerprint {
     vendor: PlatformAgentVendor;
     /** A stable identifier used as the orphan-agent dedup key. */
@@ -5402,6 +5402,12 @@ interface DynamicPlatformFingerprint {
  * Patterns are intentionally permissive (case-insensitive substring match) since
  * platform UA strings drift between versions. False positives are tolerable —
  * the orphan record is informational, not enforcement.
+ *
+ * NOT detectable here, by design (Oct 2026): Meta's Muse and OpenAI's Dots
+ * publish no user agent and browse through real Chromium sessions that are
+ * indistinguishable from a person's. There is no signature to find — don't
+ * chase one. Verified identity (an ASTRA-id the agent presents) is the only
+ * durable way to know such an agent is there; that is the product's point.
  */
 declare const PLATFORM_AGENT_SIGNATURES: ReadonlyArray<PlatformSignatureDef<PlatformAgentVendor>>;
 /**
@@ -5466,7 +5472,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.21.1";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.21.2";
 declare const sdkFetch: typeof fetch;
 
 interface LocalPolicy {
@@ -5584,7 +5590,7 @@ declare function parseYaml(yamlContent: string): ParseResult;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.21.1";
+declare const SDK_VERSION = "5.21.2";
 
 /**
  * 5.15.0 — the `UCP-Agent` request header (UCP 2026-08-25): an RFC 8941

package/dist/index.d.ts

@@ -5322,7 +5322,7 @@ declare function _resetEdgeConfigCache(): void;
  * Pure regex — no Node built-ins, edge-safe. Detection is regex-only for
  * v2.9 — TLS fingerprinting / behavioural signatures are deferred.
  */
-type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'perplexity' | 'chatgpt-atlas' | 'perplexity-comet' | 'astrasync-bridge' | 'astrasync-sdk' | 'unknown';
+type PlatformAgentVendor = 'claude' | 'chatgpt' | 'gemini' | 'cursor' | 'goose' | 'perplexity' | 'grok' | 'meta-ai' | 'chatgpt-atlas' | 'perplexity-comet' | 'astrasync-bridge' | 'astrasync-sdk' | 'unknown';
 interface PlatformFingerprint {
     vendor: PlatformAgentVendor;
     /** A stable identifier used as the orphan-agent dedup key. */
@@ -5402,6 +5402,12 @@ interface DynamicPlatformFingerprint {
  * Patterns are intentionally permissive (case-insensitive substring match) since
  * platform UA strings drift between versions. False positives are tolerable —
  * the orphan record is informational, not enforcement.
+ *
+ * NOT detectable here, by design (Oct 2026): Meta's Muse and OpenAI's Dots
+ * publish no user agent and browse through real Chromium sessions that are
+ * indistinguishable from a person's. There is no signature to find — don't
+ * chase one. Verified identity (an ASTRA-id the agent presents) is the only
+ * durable way to know such an agent is there; that is the product's point.
  */
 declare const PLATFORM_AGENT_SIGNATURES: ReadonlyArray<PlatformSignatureDef<PlatformAgentVendor>>;
 /**
@@ -5466,7 +5472,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.21.1";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.21.2";
 declare const sdkFetch: typeof fetch;
 
 interface LocalPolicy {
@@ -5584,7 +5590,7 @@ declare function parseYaml(yamlContent: string): ParseResult;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.21.1";
+declare const SDK_VERSION = "5.21.2";
 
 /**
  * 5.15.0 — the `UCP-Agent` request header (UCP 2026-08-25): an RFC 8941

package/dist/index.js

@@ -229,7 +229,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.21.1";
+var SDK_VERSION = "5.21.2";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -2337,6 +2337,23 @@ var PLATFORM_AGENT_SIGNATURES = [
     agentCardPatterns: [/perplexity\.ai/i],
     apiKeyFormatPatterns: [/^pplx-/i]
   },
+  // Round 30.1: xAI's documented crawlers (GrokBot/1.0, xAI-Grok/1.0,
+  // Grok-DeepSearch/1.0). Anchored, versioned tokens — never in a stock UA.
+  {
+    vendor: "grok",
+    displayName: "xAI Grok",
+    uaPatterns: [/\bGrokBot\//i, /\bxAI-Grok\//i, /\bGrok-DeepSearch\//i],
+    agentCardPatterns: [/\bx\.ai\b/i, /grok\.com/i],
+    apiKeyFormatPatterns: [/^xai-/i]
+  },
+  // Round 30.1: Meta AI's index and fetch crawlers. facebookexternalhit
+  // (link previews) is deliberately NOT here — it stays a generic crawler.
+  {
+    vendor: "meta-ai",
+    displayName: "Meta AI",
+    uaPatterns: [/\bMeta-WebIndexer\b/i, /\bMeta-ExternalFetcher\b/i],
+    agentCardPatterns: [/meta\.ai/i]
+  },
   // Agentic browsers — versioned-token patterns ONLY (a stock Chrome UA must
   // never match). Distinct vendor keys (not 'chatgpt'/'perplexity'): the
   // browser product is a different surface than the assistant service, and