@astrasyncai/verification-gateway 5.7.0 → 5.9.0

package/dist/adapters/nextjs.d.mts

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from '../types-BK_pRNSs.mjs';
+import { N as NextJsMiddlewareOptions } from '../types-CTmUpNpS.mjs';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/adapters/nextjs.d.ts

@@ -1,6 +1,6 @@
 import * as next_server from 'next/server';
 import { NextRequest } from 'next/server';
-import { N as NextJsMiddlewareOptions } from '../types-BK_pRNSs.js';
+import { N as NextJsMiddlewareOptions } from '../types-CTmUpNpS.js';
 
 /**
  * Create Next.js middleware for agent verification.

package/dist/adapters/nextjs.js

@@ -36,7 +36,7 @@ __export(nextjs_exports, {
 module.exports = __toCommonJS(nextjs_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.7.0";
+var SDK_VERSION = "5.9.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -594,7 +594,7 @@ async function verify(config, request, options) {
     name: apiResponse.agent.name,
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
-    blockchainVerified: apiResponse.agent.blockchainStatus === "verified",
+    blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
     status: apiResponse.agent.agentStatus
   } : void 0;
   const developer = apiResponse.developer ? {
@@ -1049,11 +1049,16 @@ var DEFAULT_EDGE_CONFIG = Object.freeze({
   mode: "observe",
   depth: "classify",
   pathRules: [],
-  sampling: Object.freeze({ anonymousBeaconRate: 0.1 }),
+  sampling: Object.freeze({ anonymousBeaconRate: 1 }),
   failurePosture: "open"
 });
 var EDGE_MODES = ["observe", "enforce"];
 var EDGE_DEPTHS = ["classify", "authenticate", "authorize"];
+function isSamplingShape(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const rate = value.anonymousBeaconRate;
+  return typeof rate === "number" && rate >= 0 && rate <= 1;
+}
 function isEdgeConfig(value) {
   if (typeof value !== "object" || value === null) return false;
   const v = value;
@@ -1067,10 +1072,13 @@ function isEdgeConfig(value) {
     if (typeof r.pattern !== "string" || r.pattern.length === 0) return false;
     if (r.mode !== void 0 && !EDGE_MODES.includes(r.mode)) return false;
     if (r.depth !== void 0 && !EDGE_DEPTHS.includes(r.depth)) return false;
+    if (r.sampling !== void 0 && !isSamplingShape(r.sampling)) return false;
   }
-  const sampling = v.sampling;
-  if (typeof sampling !== "object" || sampling === null || typeof sampling.anonymousBeaconRate !== "number" || sampling.anonymousBeaconRate < 0 || sampling.anonymousBeaconRate > 1) {
-    return false;
+  if (!isSamplingShape(v.sampling)) return false;
+  if (v.queryValueAllowlist !== void 0) {
+    if (!Array.isArray(v.queryValueAllowlist) || v.queryValueAllowlist.length > 16 || !v.queryValueAllowlist.every((e) => typeof e === "string" && e.length > 0 && e.length <= 64)) {
+      return false;
+    }
   }
   return v.failurePosture === "open";
 }
@@ -1172,7 +1180,20 @@ var PLATFORM_AGENT_SIGNATURES = [
   {
     vendor: "gemini",
     displayName: "Google Gemini",
-    uaPatterns: [/gemini/i, /google-gemini/i, /bard/i],
+    uaPatterns: [
+      /gemini/i,
+      /google-gemini/i,
+      /bard/i,
+      // Google's AI/agent fetcher tokens (VI uplift 1.3). These are the
+      // AI-training/agent crawlers, NOT the Search crawler — googlebot IP
+      // ranges attribute Search and are deliberately absent from
+      // vendor-ip-ranges. Anchored tokens: none appears in stock browser
+      // UAs, and `-` counts as a \b boundary so GoogleOther-Image/-Video
+      // match too.
+      /\bGoogle-Extended\b/i,
+      /\bGoogleOther\b/i,
+      /\bGoogle-CloudVertexBot\b/i
+    ],
     agentCardPatterns: [/gemini\.google\.com/i, /ai\.google\.dev/i],
     apiKeyFormatPatterns: [/^aiza/i],
     headerPatterns: [/^x-goog-user-project/i, /^x-goog-api-client/i]
@@ -1218,6 +1239,16 @@ var PLATFORM_AGENT_SIGNATURES = [
     uaPatterns: [/\bcomet\/\d/i],
     headerPatterns: [/^sec-ch-ua: .*comet/i]
   },
+  // The MCP bridge's own catalog fetches (VI uplift 1.5). Deliberately a
+  // DISTINCT UA from `astrasync-sdk/`: bridge fetches are buyer-agent
+  // traffic merchants should see (identified · unregistered), so this
+  // vendor is kept OUT of the self-traffic filter and the edge's SELF
+  // short-circuit.
+  {
+    vendor: "astrasync-bridge",
+    displayName: "AstraSync MCP bridge (buyer-agent catalog fetch)",
+    uaPatterns: [/^astrasync-bridge\//i]
+  },
   // Our own SDK self-identifies (sdkFetch stamps this UA) — first-party
   // traffic must never pollute the unknown/anonymous pool it exists to audit.
   {
@@ -1857,6 +1888,8 @@ function createMiddleware(options) {
     }
     const forwardedFor = request.headers.get("x-forwarded-for") || void 0;
     const originalClientIp = forwardedFor?.split(",")[0]?.trim();
+    const attemptHeader = request.headers.get("x-astra-attempt-id");
+    const inboundAttemptId = attemptHeader && /^att_[0-9a-f]{32}$/.test(attemptHeader) ? attemptHeader : void 0;
     const verificationRequest = {
       credentials,
       purpose,
@@ -1866,6 +1899,7 @@ function createMiddleware(options) {
       counterpartyType: config.counterpartyType || "website",
       enableRuntimeChallenge,
       durationRequired: astraCreds?.pdlss?.duration?.maxSessionDuration,
+      ...inboundAttemptId && { attemptId: inboundAttemptId },
       callerMetadata: {
         sourceIp: originalClientIp,
         userAgent: request.headers.get("user-agent") || void 0,