@astrasyncai/verification-gateway 5.7.0 → 5.9.0

package/dist/index.mjs

@@ -19,7 +19,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.7.0";
+var SDK_VERSION = "5.9.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -569,7 +569,7 @@ async function verify(config, request, options) {
     name: apiResponse.agent.name,
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
-    blockchainVerified: apiResponse.agent.blockchainStatus === "verified",
+    blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
     status: apiResponse.agent.agentStatus
   } : void 0;
   const developer = apiResponse.developer ? {
@@ -1153,6 +1153,12 @@ var KEY_FORMAT_PREFIXES = [
 var MAX_HEADERS = 64;
 var MAX_HEADER_VALUE_BYTES = 1024;
 var MAX_TOTAL_BYTES = 16 * 1024;
+var DECLARED_SOURCE_MAX = 64;
+var DECLARED_SOURCE_PATTERN = /^[a-z0-9][a-z0-9 ._/-]{0,63}$/;
+function normalizeDeclaredSource(value) {
+  const trimmed = value?.trim().slice(0, DECLARED_SOURCE_MAX).toLowerCase();
+  return trimmed && DECLARED_SOURCE_PATTERN.test(trimmed) ? trimmed : void 0;
+}
 function byteLength(s) {
   let bytes = 0;
   for (let i = 0; i < s.length; i++) {
@@ -1332,11 +1338,16 @@ var DEFAULT_EDGE_CONFIG = Object.freeze({
   mode: "observe",
   depth: "classify",
   pathRules: [],
-  sampling: Object.freeze({ anonymousBeaconRate: 0.1 }),
+  sampling: Object.freeze({ anonymousBeaconRate: 1 }),
   failurePosture: "open"
 });
 var EDGE_MODES = ["observe", "enforce"];
 var EDGE_DEPTHS = ["classify", "authenticate", "authorize"];
+function isSamplingShape(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const rate = value.anonymousBeaconRate;
+  return typeof rate === "number" && rate >= 0 && rate <= 1;
+}
 function isEdgeConfig(value) {
   if (typeof value !== "object" || value === null) return false;
   const v = value;
@@ -1350,10 +1361,13 @@ function isEdgeConfig(value) {
     if (typeof r.pattern !== "string" || r.pattern.length === 0) return false;
     if (r.mode !== void 0 && !EDGE_MODES.includes(r.mode)) return false;
     if (r.depth !== void 0 && !EDGE_DEPTHS.includes(r.depth)) return false;
+    if (r.sampling !== void 0 && !isSamplingShape(r.sampling)) return false;
   }
-  const sampling = v.sampling;
-  if (typeof sampling !== "object" || sampling === null || typeof sampling.anonymousBeaconRate !== "number" || sampling.anonymousBeaconRate < 0 || sampling.anonymousBeaconRate > 1) {
-    return false;
+  if (!isSamplingShape(v.sampling)) return false;
+  if (v.queryValueAllowlist !== void 0) {
+    if (!Array.isArray(v.queryValueAllowlist) || v.queryValueAllowlist.length > 16 || !v.queryValueAllowlist.every((e) => typeof e === "string" && e.length > 0 && e.length <= 64)) {
+      return false;
+    }
   }
   return v.failurePosture === "open";
 }
@@ -1469,7 +1483,20 @@ var PLATFORM_AGENT_SIGNATURES = [
   {
     vendor: "gemini",
     displayName: "Google Gemini",
-    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    uaPatterns: [
+      /gemini/i,
+      /google-gemini/i,
+      /bard/i,
+      // Google's AI/agent fetcher tokens (VI uplift 1.3). These are the
+      // AI-training/agent crawlers, NOT the Search crawler — googlebot IP
+      // ranges attribute Search and are deliberately absent from
+      // vendor-ip-ranges. Anchored tokens: none appears in stock browser
+      // UAs, and `-` counts as a \b boundary so GoogleOther-Image/-Video
+      // match too.
+      /\bGoogle-Extended\b/i,
+      /\bGoogleOther\b/i,
+      /\bGoogle-CloudVertexBot\b/i
+    ],
     agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
     apiKeyFormatPatterns: [/^aiza/i],
     headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
@@ -1515,6 +1542,16 @@ var PLATFORM_AGENT_SIGNATURES = [
     uaPatterns: [/\bcomet\/\d/i],
     headerPatterns: [/^sec-ch-ua: .*comet/i]
   },
+  // The MCP bridge's own catalog fetches (VI uplift 1.5). Deliberately a
+  // DISTINCT UA from `astrasync-sdk/`: bridge fetches are buyer-agent
+  // traffic merchants should see (identified · unregistered), so this
+  // vendor is kept OUT of the self-traffic filter and the edge's SELF
+  // short-circuit.
+  {
+    vendor: "astrasync-bridge",
+    displayName: "AstraSync MCP bridge (buyer-agent catalog fetch)",
+    uaPatterns: [/^astrasync-bridge\//i]
+  },
   // Our own SDK self-identifies (sdkFetch stamps this UA) — first-party
   // traffic must never pollute the unknown/anonymous pool it exists to audit.
   {
@@ -1959,6 +1996,8 @@ function createMiddleware(options) {
           }
         }
       }
+      const attemptHeader = req.headers["x-astra-attempt-id"];
+      const inboundAttemptId = typeof attemptHeader === "string" && /^att_[0-9a-f]{32}$/.test(attemptHeader) ? attemptHeader : void 0;
       const verificationRequest = {
         credentials,
         purpose,
@@ -1971,6 +2010,7 @@ function createMiddleware(options) {
         durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
         ...txValue !== void 0 && { transactionValue: txValue },
         ...txCurrency && { currency: txCurrency },
+        ...inboundAttemptId && { attemptId: inboundAttemptId },
         callerMetadata: {
           sourceIp: originalClientIp,
           userAgent: req.headers["user-agent"],
@@ -2475,6 +2515,8 @@ function createMiddleware2(options) {
     }
     const forwardedFor = request.headers.get("x-forwarded-for") || void 0;
     const originalClientIp = forwardedFor?.split(",")[0]?.trim();
+    const attemptHeader = request.headers.get("x-astra-attempt-id");
+    const inboundAttemptId = attemptHeader && /^att_[0-9a-f]{32}$/.test(attemptHeader) ? attemptHeader : void 0;
     const verificationRequest = {
       credentials,
       purpose,
@@ -2484,6 +2526,7 @@ function createMiddleware2(options) {
       counterpartyType: config.counterpartyType || "website",
       enableRuntimeChallenge,
       durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
+      ...inboundAttemptId && { attemptId: inboundAttemptId },
       callerMetadata: {
         sourceIp: originalClientIp,
         userAgent: request.headers.get("user-agent") || void 0,
@@ -6528,6 +6571,7 @@ export {
   AuthenticationError,
   CAPTURE_SCHEMA_VERSION,
   ChallengeHandler,
+  DECLARED_SOURCE_MAX,
   DEFAULT_EDGE_CONFIG,
   KYDRequiredError,
   MAX_HEADERS,
@@ -6572,6 +6616,7 @@ export {
   matchEdgePathRule,
   matchPlatformSignature,
   nextjs_exports as nextjs,
+  normalizeDeclaredSource,
   parseVerifiedHop,
   pollStepUpStatus,
   prefetchWellKnown,