@astrasyncai/verification-gateway 5.7.0 → 5.9.0

package/dist/adapters/express.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "5.7.0";
+var SDK_VERSION = "5.9.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -609,7 +609,7 @@ async function verify(config, request, options) {
     name: apiResponse.agent.name,
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
-    blockchainVerified: apiResponse.agent.blockchainStatus === "verified",
+    blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
     status: apiResponse.agent.agentStatus
   } : void 0;
   const developer = apiResponse.developer ? {
@@ -1194,11 +1194,16 @@ var DEFAULT_EDGE_CONFIG = Object.freeze({
   mode: "observe",
   depth: "classify",
   pathRules: [],
-  sampling: Object.freeze({ anonymousBeaconRate: 0.1 }),
+  sampling: Object.freeze({ anonymousBeaconRate: 1 }),
   failurePosture: "open"
 });
 var EDGE_MODES = ["observe", "enforce"];
 var EDGE_DEPTHS = ["classify", "authenticate", "authorize"];
+function isSamplingShape(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const rate = value.anonymousBeaconRate;
+  return typeof rate === "number" && rate >= 0 && rate <= 1;
+}
 function isEdgeConfig(value) {
   if (typeof value !== "object" || value === null) return false;
   const v = value;
@@ -1212,10 +1217,13 @@ function isEdgeConfig(value) {
     if (typeof r.pattern !== "string" || r.pattern.length === 0) return false;
     if (r.mode !== void 0 && !EDGE_MODES.includes(r.mode)) return false;
     if (r.depth !== void 0 && !EDGE_DEPTHS.includes(r.depth)) return false;
+    if (r.sampling !== void 0 && !isSamplingShape(r.sampling)) return false;
   }
-  const sampling = v.sampling;
-  if (typeof sampling !== "object" || sampling === null || typeof sampling.anonymousBeaconRate !== "number" || sampling.anonymousBeaconRate < 0 || sampling.anonymousBeaconRate > 1) {
-    return false;
+  if (!isSamplingShape(v.sampling)) return false;
+  if (v.queryValueAllowlist !== void 0) {
+    if (!Array.isArray(v.queryValueAllowlist) || v.queryValueAllowlist.length > 16 || !v.queryValueAllowlist.every((e) => typeof e === "string" && e.length > 0 && e.length <= 64)) {
+      return false;
+    }
   }
   return v.failurePosture === "open";
 }
@@ -1317,7 +1325,20 @@ var PLATFORM_AGENT_SIGNATURES = [
   {
     vendor: "gemini",
     displayName: "Google Gemini",
-    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    uaPatterns: [
+      /gemini/i,
+      /google-gemini/i,
+      /bard/i,
+      // Google's AI/agent fetcher tokens (VI uplift 1.3). These are the
+      // AI-training/agent crawlers, NOT the Search crawler — googlebot IP
+      // ranges attribute Search and are deliberately absent from
+      // vendor-ip-ranges. Anchored tokens: none appears in stock browser
+      // UAs, and `-` counts as a \b boundary so GoogleOther-Image/-Video
+      // match too.
+      /\bGoogle-Extended\b/i,
+      /\bGoogleOther\b/i,
+      /\bGoogle-CloudVertexBot\b/i
+    ],
     agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
     apiKeyFormatPatterns: [/^aiza/i],
     headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
@@ -1363,6 +1384,16 @@ var PLATFORM_AGENT_SIGNATURES = [
     uaPatterns: [/\bcomet\/\d/i],
     headerPatterns: [/^sec-ch-ua: .*comet/i]
   },
+  // The MCP bridge's own catalog fetches (VI uplift 1.5). Deliberately a
+  // DISTINCT UA from `astrasync-sdk/`: bridge fetches are buyer-agent
+  // traffic merchants should see (identified · unregistered), so this
+  // vendor is kept OUT of the self-traffic filter and the edge's SELF
+  // short-circuit.
+  {
+    vendor: "astrasync-bridge",
+    displayName: "AstraSync MCP bridge (buyer-agent catalog fetch)",
+    uaPatterns: [/^astrasync-bridge\//i]
+  },
   // Our own SDK self-identifies (sdkFetch stamps this UA) — first-party
   // traffic must never pollute the unknown/anonymous pool it exists to audit.
   {
@@ -1807,6 +1838,8 @@ function createMiddleware(options) {
           }
         }
       }
+      const attemptHeader = req.headers["x-astra-attempt-id"];
+      const inboundAttemptId = typeof attemptHeader === "string" && /^att_[0-9a-f]{32}$/.test(attemptHeader) ? attemptHeader : void 0;
       const verificationRequest = {
         credentials,
         purpose,
@@ -1819,6 +1852,7 @@ function createMiddleware(options) {
         durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
         ...txValue !== void 0 && { transactionValue: txValue },
         ...txCurrency && { currency: txCurrency },
+        ...inboundAttemptId && { attemptId: inboundAttemptId },
         callerMetadata: {
           sourceIp: originalClientIp,
           userAgent: req.headers["user-agent"],