@astrasyncai/verification-gateway 5.21.2 → 5.22.1

package/dist/index.mjs

@@ -30,7 +30,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.21.2";
+var SDK_VERSION = "5.22.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -1205,7 +1205,11 @@ var PLATFORM_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-goog-api-client",
   "user-agent",
   "x-agent-card-url",
-  "x-agent-provider"
+  "x-agent-provider",
+  // Round 31 — Web Bot Auth's Signature-Agent names the signing agent's
+  // directory host (a public URL, never a secret). It attributes a signed
+  // agent even when its UA is stock Chrome.
+  "signature-agent"
 ]);
 var PLATFORM_HEADER_PREFIXES = [
   "x-goog-",
@@ -1336,7 +1340,12 @@ function extractPlatformHeaders(sanitized) {
   return out;
 }
 var CONNECTION_HEADER_SOURCES = [
-  ["ip", ["cf-connecting-ip", "fastly-client-ip", "true-client-ip", "x-real-ip"]],
+  // Round 31: `incap-client-ip` = Imperva Cloud WAF; `true-client-ip` is
+  // also Akamai's client-IP header when the property enables it.
+  [
+    "ip",
+    ["cf-connecting-ip", "fastly-client-ip", "incap-client-ip", "true-client-ip", "x-real-ip"]
+  ],
   [
     "country",
     ["cf-ipcountry", "x-vercel-ip-country", "cloudfront-viewer-country", "fastly-geo-country"]
@@ -1387,6 +1396,28 @@ function deriveConnectionFromHeaders(headers) {
     if (portMatch) connection.sourcePort = portMatch[1];
     if (!connection.ip && addr) connection.ip = addr.replace(/:\d+$/, "");
   }
+  {
+    const edgescape = (lower["x-akamai-edgescape"] ?? lower["akamai-edgescape"])?.trim();
+    if (edgescape) {
+      const fields = /* @__PURE__ */ new Map();
+      for (const pair of edgescape.split(",")) {
+        const i = pair.indexOf("=");
+        if (i > 0) fields.set(pair.slice(0, i).trim().toLowerCase(), pair.slice(i + 1).trim());
+      }
+      const fill = (key, field) => {
+        const v = fields.get(field);
+        if (v && !connection[key]) connection[key] = v.slice(0, MAX_CONNECTION_VALUE_CHARS);
+      };
+      fill("country", "country_code");
+      fill("region", "region_code");
+      fill("city", "city");
+      fill("latitude", "lat");
+      fill("longitude", "long");
+      fill("timeZone", "timezone");
+      fill("asn", "asnum");
+      fill("continent", "continent");
+    }
+  }
   if (!connection.ip) {
     const xff = lower["x-forwarded-for"];
     const client = xff?.split(",")[0]?.trim();
@@ -2085,7 +2116,8 @@ var PLATFORM_AGENT_SIGNATURES = [
     uaPatterns: [/claude/i, /anthropic/i],
     agentCardPatterns: [/anthropic\.com/i, /claude\.ai/i],
     apiKeyFormatPatterns: [/^sk-ant/i],
-    headerPatterns: [/^anthropic-version/i, /^anthropic-beta/i, /^x-anthropic-/i]
+    headerPatterns: [/^anthropic-version/i, /^anthropic-beta/i, /^x-anthropic-/i],
+    wafLabelPatterns: [/\bclaude/i, /\banthropic/i]
   },
   {
     vendor: "chatgpt",
@@ -2096,7 +2128,14 @@ var PLATFORM_AGENT_SIGNATURES = [
     uaPatterns: [/chatgpt/i, /openai/i, /gpt-?\d/i, /\bGPTBot\b/i, /\bOAI-SearchBot\b/i],
     agentCardPatterns: [/openai\.com/i, /chatgpt\.com/i],
     apiKeyFormatPatterns: [/^sk-proj/i, /^sk-svcacct/i],
-    headerPatterns: [/^openai-organization/i, /^openai-project/i, /^openai-version/i]
+    headerPatterns: [
+      /^openai-organization/i,
+      /^openai-project/i,
+      /^openai-version/i,
+      // ChatGPT agent signs with Web Bot Auth under this directory host.
+      /^signature-agent: "?https:\/\/chatgpt\.com/i
+    ],
+    wafLabelPatterns: [/\bgptbot\b/i, /\bchatgpt/i, /\boai-searchbot\b/i, /\bopenai/i]
   },
   {
     vendor: "gemini",
@@ -2117,7 +2156,8 @@ var PLATFORM_AGENT_SIGNATURES = [
     ],
     agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
     apiKeyFormatPatterns: [/^aiza/i],
-    headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
+    headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i],
+    wafLabelPatterns: [/\bgoogle-extended\b/i, /\bgoogleother\b/i, /\bgemini/i]
   },
   {
     vendor: "cursor",
@@ -2136,7 +2176,8 @@ var PLATFORM_AGENT_SIGNATURES = [
     displayName: "Perplexity",
     uaPatterns: [/perplexity/i],
     agentCardPatterns: [/perplexity\.ai/i],
-    apiKeyFormatPatterns: [/^pplx-/i]
+    apiKeyFormatPatterns: [/^pplx-/i],
+    wafLabelPatterns: [/\bperplexity/i]
   },
   // Round 30.1: xAI's documented crawlers (GrokBot/1.0, xAI-Grok/1.0,
   // Grok-DeepSearch/1.0). Anchored, versioned tokens — never in a stock UA.
@@ -2145,7 +2186,8 @@ var PLATFORM_AGENT_SIGNATURES = [
     displayName: "xAI Grok",
     uaPatterns: [/\bGrokBot\//i, /\bxAI-Grok\//i, /\bGrok-DeepSearch\//i],
     agentCardPatterns: [/\bx\.ai\b/i, /grok\.com/i],
-    apiKeyFormatPatterns: [/^xai-/i]
+    apiKeyFormatPatterns: [/^xai-/i],
+    wafLabelPatterns: [/\bgrok/i, /\bxai\b/i]
   },
   // Round 30.1: Meta AI's index and fetch crawlers. facebookexternalhit
   // (link previews) is deliberately NOT here — it stays a generic crawler.
@@ -2153,7 +2195,12 @@ var PLATFORM_AGENT_SIGNATURES = [
     vendor: "meta-ai",
     displayName: "Meta AI",
     uaPatterns: [/\bMeta-WebIndexer\b/i, /\bMeta-ExternalFetcher\b/i],
-    agentCardPatterns: [/meta\.ai/i]
+    agentCardPatterns: [/meta\.ai/i],
+    wafLabelPatterns: [
+      /\bmeta-webindexer\b/i,
+      /\bmeta-externalfetcher\b/i,
+      /\bmeta-externalagent\b/i
+    ]
   },
   // Agentic browsers — versioned-token patterns ONLY (a stock Chrome UA must
   // never match). Distinct vendor keys (not 'chatgpt'/'perplexity'): the
@@ -2201,6 +2248,7 @@ function matchPlatformSignature(signatures, input) {
   const apiKeyFormat = input.apiKeyFormat ?? "";
   const ja4 = input.ja4 ?? "";
   const asn = input.asn ?? "";
+  const wafLabels = input.wafLabels ?? [];
   const headerLines = [];
   if (input.platformHeaders) {
     for (const [name, value] of Object.entries(input.platformHeaders)) {
@@ -2214,7 +2262,8 @@ function matchPlatformSignature(signatures, input) {
     const headerMatch = headerLines.length > 0 && sig.headerPatterns?.some((p) => headerLines.some((line) => p.test(line)));
     const ja4Match = ja4.length > 0 && sig.ja4Patterns?.some((p) => p.test(ja4));
     const asnMatch = asn.length > 0 && sig.asnList?.includes(asn);
-    if (uaMatch || cardMatch || keyMatch || headerMatch || ja4Match || asnMatch) {
+    const wafMatch = wafLabels.length > 0 && sig.wafLabelPatterns?.some((p) => wafLabels.some((label) => p.test(label)));
+    if (uaMatch || cardMatch || keyMatch || headerMatch || ja4Match || asnMatch || wafMatch) {
       const uaBase = ua.split(/[\s/]/)[0]?.toLowerCase() ?? "";
       const cardHost = (() => {
         try {
@@ -2223,7 +2272,7 @@ function matchPlatformSignature(signatures, input) {
           return "";
         }
       })();
-      const keyBasis = uaBase || cardHost || apiKeyFormat || ja4 || asn && `asn${asn}` || "unknown";
+      const keyBasis = uaBase || cardHost || apiKeyFormat || ja4 || asn && `asn${asn}` || wafMatch && `waf:${wafLabels[0]?.toLowerCase()}` || "unknown";
       return {
         vendor: sig.vendor,
         fingerprintKey: `${sig.vendor}:${keyBasis}`,
@@ -11567,7 +11616,11 @@ function createAgentCommerce(opts) {
       const headers = {
         Accept: "application/json",
         Authorization: `Bearer ${opts.apiKey}`,
-        "X-AstraSync-SDK-Version": SDK_VERSION
+        "X-AstraSync-SDK-Version": SDK_VERSION,
+        // 5.22.1: identifies the agent-commerce kit, so only a kit fetching
+        // its rules marks the merchant as applying them (cardholder prices
+        // are then shown to agents). A curl or another client never does.
+        "X-AstraSync-Kit": "agent-commerce"
       };
       if (kitReport) {
         headers["X-AstraSync-Kit-Report"] = Buffer.from(JSON.stringify(kitReport)).toString(
@@ -11604,10 +11657,14 @@ function createAgentCommerce(opts) {
     }
   };
 }
-function pricingContextFrom(headers) {
+function pricingContextFrom(headers, opts = {}) {
   const astraId = headers.get("x-astra-id");
   const hop = parseVerifiedHop(headers.get(MCP_VERIFIED_HOP_HEADER.toLowerCase()));
-  const verified = !!astraId && (!hop || hop.astraId === astraId && Date.now() - hop.checkedAt <= MCP_VERIFIED_HOP_MAX_AGE_MS);
+  let verified = !!astraId && (!hop || hop.astraId === astraId && Date.now() - hop.checkedAt <= MCP_VERIFIED_HOP_MAX_AGE_MS);
+  const v = opts.verification;
+  if (verified && v) {
+    verified = v.identityVerified === true && (!v.agent?.astraId || v.agent.astraId === astraId);
+  }
   const program = headers.get(ISSUER_PROGRAM_HEADER.toLowerCase());
   return {
     verified,