@astrasyncai/verification-gateway 5.21.2 → 5.22.1

package/dist/adapters/express.mjs

@@ -33,7 +33,11 @@ var PLATFORM_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-goog-api-client",
   "user-agent",
   "x-agent-card-url",
-  "x-agent-provider"
+  "x-agent-provider",
+  // Round 31 — Web Bot Auth's Signature-Agent names the signing agent's
+  // directory host (a public URL, never a secret). It attributes a signed
+  // agent even when its UA is stock Chrome.
+  "signature-agent"
 ]);
 var PLATFORM_HEADER_PREFIXES = [
   "x-goog-",
@@ -150,7 +154,12 @@ function sanitizeHeaders(raw) {
   return result;
 }
 var CONNECTION_HEADER_SOURCES = [
-  ["ip", ["cf-connecting-ip", "fastly-client-ip", "true-client-ip", "x-real-ip"]],
+  // Round 31: `incap-client-ip` = Imperva Cloud WAF; `true-client-ip` is
+  // also Akamai's client-IP header when the property enables it.
+  [
+    "ip",
+    ["cf-connecting-ip", "fastly-client-ip", "incap-client-ip", "true-client-ip", "x-real-ip"]
+  ],
   [
     "country",
     ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
@@ -201,6 +210,28 @@ function deriveConnectionFromHeaders(headers) {
     if (portMatch) connection.sourcePort = portMatch[1];
     if (!connection.ip && addr) connection.ip = addr.replace(/:\d+$/, "");
   }
+  {
+    const edgescape = (lower["x-akamai-edgescape"] ?? lower["akamai-edgescape"])?.trim();
+    if (edgescape) {
+      const fields = /* @__PURE__ */ new Map();
+      for (const pair of edgescape.split(",")) {
+        const i = pair.indexOf("=");
+        if (i > 0) fields.set(pair.slice(0, i).trim().toLowerCase(), pair.slice(i + 1).trim());
+      }
+      const fill = (key, field) => {
+        const v = fields.get(field);
+        if (v && !connection[key]) connection[key] = v.slice(0, MAX_CONNECTION_VALUE_CHARS);
+      };
+      fill("country", "country_code");
+      fill("region", "region_code");
+      fill("city", "city");
+      fill("latitude", "lat");
+      fill("longitude", "long");
+      fill("timeZone", "timezone");
+      fill("asn", "asnum");
+      fill("continent", "continent");
+    }
+  }
   if (!connection.ip) {
     const xff = lower["x-forwarded-for"];
     const client = xff?.split(",")[0]?.trim();
@@ -452,7 +483,7 @@ function routePolicyOf(route) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.21.2";
+var SDK_VERSION = "5.22.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -1873,7 +1904,8 @@ var PLATFORM_AGENT_SIGNATURES = [
     uaPatterns: [/claude/i, /anthropic/i],
     agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i],
     apiKeyFormatPatterns: [/^sk-ant/i],
-    headerPatterns: [/^anthropic-version/i, /^anthropic-beta/i, /^x-anthropic-/i]
+    headerPatterns: [/^anthropic-version/i, /^anthropic-beta/i, /^x-anthropic-/i],
+    wafLabelPatterns: [/\bclaude/i, /\banthropic/i]
   },
   {
     vendor: "chatgpt",
@@ -1884,7 +1916,14 @@ var PLATFORM_AGENT_SIGNATURES = [
     uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i, /\bGPTBot\b/i, /\bOAI-SearchBot\b/i],
     agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i],
     apiKeyFormatPatterns: [/^sk-proj/i, /^sk-svcacct/i],
-    headerPatterns: [/^openai-organization/i, /^openai-project/i, /^openai-version/i]
+    headerPatterns: [
+      /^openai-organization/i,
+      /^openai-project/i,
+      /^openai-version/i,
+      // ChatGPT agent signs with Web Bot Auth under this directory host.
+      /^signature-agent: "?https:\/\/chatgpt\.com/i
+    ],
+    wafLabelPatterns: [/\bgptbot\b/i, /\bchatgpt/i, /\boai-searchbot\b/i, /\bopenai/i]
   },
   {
     vendor: "gemini",
@@ -1905,7 +1944,8 @@ var PLATFORM_AGENT_SIGNATURES = [
     ],
     agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
     apiKeyFormatPatterns: [/^aiza/i],
-    headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
+    headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i],
+    wafLabelPatterns: [/\bgoogle-extended\b/i, /\bgoogleother\b/i, /\bgemini/i]
   },
   {
     vendor: "cursor",
@@ -1924,7 +1964,8 @@ var PLATFORM_AGENT_SIGNATURES = [
     displayName: "Perplexity",
     uaPatterns: [/perplexity/i],
     agentCardPatterns: [/perplexity\.ai/i],
-    apiKeyFormatPatterns: [/^pplx-/i]
+    apiKeyFormatPatterns: [/^pplx-/i],
+    wafLabelPatterns: [/\bperplexity/i]
   },
   // Round 30.1: xAI's documented crawlers (GrokBot/1.0, xAI-Grok/1.0,
   // Grok-DeepSearch/1.0). Anchored, versioned tokens — never in a stock UA.
@@ -1933,7 +1974,8 @@ var PLATFORM_AGENT_SIGNATURES = [
     displayName: "xAI Grok",
     uaPatterns: [/\bGrokBot\//i, /\bxAI-Grok\//i, /\bGrok-DeepSearch\//i],
     agentCardPatterns: [/\bx\.ai\b/i, /grok\.com/i],
-    apiKeyFormatPatterns: [/^xai-/i]
+    apiKeyFormatPatterns: [/^xai-/i],
+    wafLabelPatterns: [/\bgrok/i, /\bxai\b/i]
   },
   // Round 30.1: Meta AI's index and fetch crawlers. facebookexternalhit
   // (link previews) is deliberately NOT here — it stays a generic crawler.
@@ -1941,7 +1983,12 @@ var PLATFORM_AGENT_SIGNATURES = [
     vendor: "meta-ai",
     displayName: "Meta AI",
     uaPatterns: [/\bMeta-WebIndexer\b/i, /\bMeta-ExternalFetcher\b/i],
-    agentCardPatterns: [/meta\.ai/i]
+    agentCardPatterns: [/meta\.ai/i],
+    wafLabelPatterns: [
+      /\bmeta-webindexer\b/i,
+      /\bmeta-externalfetcher\b/i,
+      /\bmeta-externalagent\b/i
+    ]
   },
   // Agentic browsers — versioned-token patterns ONLY (a stock Chrome UA must
   // never match). Distinct vendor keys (not 'chatgpt'/'perplexity'): the
@@ -1989,6 +2036,7 @@ function matchPlatformSignature(signatures, input) {
   const apiKeyFormat = input.apiKeyFormat ?? "";
   const ja4 = input.ja4 ?? "";
   const asn = input.asn ?? "";
+  const wafLabels = input.wafLabels ?? [];
   const headerLines = [];
   if (input.platformHeaders) {
     for (const [name, value] of Object.entries(input.platformHeaders)) {
@@ -2002,7 +2050,8 @@ function matchPlatformSignature(signatures, input) {
     const headerMatch = headerLines.length > 0 && sig.headerPatterns?.some((p) => headerLines.some((line) => p.test(line)));
     const ja4Match = ja4.length > 0 && sig.ja4Patterns?.some((p) => p.test(ja4));
     const asnMatch = asn.length > 0 && sig.asnList?.includes(asn);
-    if (uaMatch || cardMatch || keyMatch || headerMatch || ja4Match || asnMatch) {
+    const wafMatch = wafLabels.length > 0 && sig.wafLabelPatterns?.some((p) => wafLabels.some((label) => p.test(label)));
+    if (uaMatch || cardMatch || keyMatch || headerMatch || ja4Match || asnMatch || wafMatch) {
       const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
       const cardHost = (() => {
         try {
@@ -2011,7 +2060,7 @@ function matchPlatformSignature(signatures, input) {
           return "";
         }
       })();
-      const keyBasis = uaBase || cardHost || apiKeyFormat || ja4 || asn && `asn${asn}` || "unknown";
+      const keyBasis = uaBase || cardHost || apiKeyFormat || ja4 || asn && `asn${asn}` || wafMatch && `waf:${wafLabels[0]?.toLowerCase()}` || "unknown";
       return {
         vendor: sig.vendor,
         fingerprintKey: `${sig.vendor}:${keyBasis}`,