@kya-os/agentshield-nextjs 0.1.38 → 0.1.41

package/dist/index.js

@@ -2,7 +2,469 @@
 
 var server = require('next/server');
 
-// src/create-middleware.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/wasm-loader.ts
+function setWasmBaseUrl(url) {
+  baseUrl = url;
+}
+function getWasmUrl() {
+  if (baseUrl) {
+    try {
+      const url = new URL(baseUrl);
+      return `${url.origin}${WASM_PATH}`;
+    } catch {
+      return WASM_PATH;
+    }
+  }
+  return WASM_PATH;
+}
+async function initWasm() {
+  if (wasmExports) return true;
+  if (initPromise) {
+    await initPromise;
+    return !!wasmExports;
+  }
+  initPromise = (async () => {
+    try {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 3e3);
+      try {
+        const wasmUrl = getWasmUrl();
+        if (typeof WebAssembly.instantiateStreaming === "function") {
+          try {
+            const response2 = await fetch(wasmUrl, { signal: controller.signal });
+            clearTimeout(timeout);
+            if (!response2.ok) {
+              throw new Error(`Failed to fetch WASM: ${response2.status}`);
+            }
+            const streamResponse = response2.clone();
+            const { instance } = await WebAssembly.instantiateStreaming(
+              streamResponse,
+              {
+                wbg: {
+                  __wbg_log_1d3ae13c3d5e6b8e: (ptr, len) => {
+                    console.log("WASM:", ptr, len);
+                  },
+                  __wbindgen_throw: (ptr, len) => {
+                    throw new Error(`WASM Error at ${ptr}, length ${len}`);
+                  }
+                }
+              }
+            );
+            wasmInstance = instance;
+            wasmExports = instance.exports;
+            console.log("[AgentShield] \u2705 WASM module initialized with streaming");
+            return;
+          } catch (streamError) {
+            if (!controller.signal.aborted) {
+              console.log("[AgentShield] Streaming compilation failed, falling back to standard compilation");
+            } else {
+              throw streamError;
+            }
+          }
+        }
+        const response = await fetch(wasmUrl, { signal: controller.signal });
+        clearTimeout(timeout);
+        if (!response.ok) {
+          throw new Error(`Failed to fetch WASM: ${response.status}`);
+        }
+        const wasmArrayBuffer = await response.arrayBuffer();
+        const compiledModule = await WebAssembly.compile(wasmArrayBuffer);
+        const imports = {
+          wbg: {
+            __wbg_log_1d3ae13c3d5e6b8e: (ptr, len) => {
+              console.log("WASM:", ptr, len);
+            },
+            __wbindgen_throw: (ptr, len) => {
+              throw new Error(`WASM Error at ${ptr}, length ${len}`);
+            }
+          }
+        };
+        wasmInstance = await WebAssembly.instantiate(compiledModule, imports);
+        wasmExports = wasmInstance.exports;
+        console.log("[AgentShield] \u2705 WASM module initialized via fallback");
+      } catch (fetchError) {
+        if (fetchError.name === "AbortError") {
+          console.warn("[AgentShield] WASM fetch timed out after 3 seconds - using pattern detection");
+        } else {
+          console.warn("[AgentShield] Failed to fetch WASM file:", fetchError.message);
+        }
+        wasmExports = null;
+      }
+    } catch (error) {
+      console.error("[AgentShield] Failed to initialize WASM:", error);
+      wasmExports = null;
+    }
+  })();
+  await initPromise;
+  return !!wasmExports;
+}
+async function detectAgentWithWasm(userAgent, headers, ipAddress) {
+  const initialized = await initWasm();
+  if (!initialized || !wasmExports) {
+    return null;
+  }
+  try {
+    const headersJson = JSON.stringify(headers);
+    if (typeof wasmExports.detect_agent === "function") {
+      const result = wasmExports.detect_agent(
+        userAgent || "",
+        headersJson,
+        ipAddress || "",
+        (/* @__PURE__ */ new Date()).toISOString()
+      );
+      return {
+        isAgent: result.is_agent || false,
+        confidence: result.confidence || 0,
+        agent: result.agent,
+        verificationMethod: result.verification_method || "wasm",
+        riskLevel: result.risk_level || "low"
+      };
+    }
+    console.warn("[AgentShield] WASM exports do not include detect_agent function");
+    return null;
+  } catch (error) {
+    console.error("[AgentShield] WASM detection failed:", error);
+    return null;
+  }
+}
+async function getWasmVersion() {
+  const initialized = await initWasm();
+  if (!initialized || !wasmExports) {
+    return null;
+  }
+  if (typeof wasmExports.version === "function") {
+    return wasmExports.version();
+  }
+  return "unknown";
+}
+async function isWasmAvailable() {
+  try {
+    const initialized = await initWasm();
+    if (!initialized) return false;
+    const version = await getWasmVersion();
+    return version !== null;
+  } catch {
+    return false;
+  }
+}
+var wasmInstance, wasmExports, initPromise, WASM_PATH, baseUrl;
+var init_wasm_loader = __esm({
+  "src/wasm-loader.ts"() {
+    wasmInstance = null;
+    wasmExports = null;
+    initPromise = null;
+    WASM_PATH = "/wasm/agentshield_wasm_bg.wasm";
+    baseUrl = null;
+  }
+});
+
+// src/edge-detector-with-wasm.ts
+var edge_detector_with_wasm_exports = {};
+__export(edge_detector_with_wasm_exports, {
+  EdgeAgentDetectorWithWasm: () => EdgeAgentDetectorWithWasm,
+  EdgeAgentDetectorWrapperWithWasm: () => EdgeAgentDetectorWrapperWithWasm
+});
+var AI_AGENT_PATTERNS2, CLOUD_PROVIDERS2, EdgeAgentDetectorWithWasm, EdgeAgentDetectorWrapperWithWasm;
+var init_edge_detector_with_wasm = __esm({
+  "src/edge-detector-with-wasm.ts"() {
+    init_wasm_loader();
+    AI_AGENT_PATTERNS2 = [
+      { pattern: /chatgpt-user/i, type: "chatgpt", name: "ChatGPT" },
+      { pattern: /claude-web/i, type: "claude", name: "Claude" },
+      { pattern: /perplexitybot/i, type: "perplexity", name: "Perplexity" },
+      { pattern: /perplexity-user/i, type: "perplexity", name: "Perplexity" },
+      { pattern: /perplexity-ai/i, type: "perplexity", name: "Perplexity" },
+      { pattern: /perplexity/i, type: "perplexity", name: "Perplexity" },
+      { pattern: /bingbot/i, type: "bing", name: "Bing AI" },
+      { pattern: /anthropic-ai/i, type: "anthropic", name: "Anthropic" }
+    ];
+    CLOUD_PROVIDERS2 = {
+      aws: ["54.", "52.", "35.", "18.", "3."],
+      gcp: ["35.", "34.", "104.", "107.", "108."],
+      azure: ["13.", "20.", "40.", "52.", "104."]
+    };
+    EdgeAgentDetectorWithWasm = class {
+      constructor(enableWasm = true) {
+        this.enableWasm = enableWasm;
+      }
+      wasmEnabled = false;
+      initPromise = null;
+      baseUrl = null;
+      /**
+       * Set the base URL for WASM loading in Edge Runtime
+       */
+      setBaseUrl(url) {
+        this.baseUrl = url;
+        setWasmBaseUrl(url);
+      }
+      /**
+       * Initialize the detector (including WASM if enabled)
+       */
+      async init() {
+        if (!this.enableWasm) {
+          this.wasmEnabled = false;
+          return;
+        }
+        if (this.initPromise) {
+          await this.initPromise;
+          return;
+        }
+        this.initPromise = (async () => {
+          try {
+            const wasmAvailable = await isWasmAvailable();
+            this.wasmEnabled = wasmAvailable;
+            if (this.wasmEnabled) {
+              console.log("[AgentShield] WASM detection enabled");
+            } else {
+              console.log("[AgentShield] WASM not available, using pattern detection");
+            }
+          } catch (error) {
+            console.error("[AgentShield] Failed to initialize WASM:", error);
+            this.wasmEnabled = false;
+          }
+        })();
+        await this.initPromise;
+      }
+      /**
+       * Pattern-based detection (fallback)
+       */
+      async patternDetection(input) {
+        const reasons = [];
+        let detectedAgent;
+        let verificationMethod;
+        let confidence = 0;
+        const headers = input.headers || {};
+        const normalizedHeaders = {};
+        for (const [key, value] of Object.entries(headers)) {
+          normalizedHeaders[key.toLowerCase()] = value;
+        }
+        const signaturePresent = !!(normalizedHeaders["signature"] || normalizedHeaders["signature-input"]);
+        const signatureAgent = normalizedHeaders["signature-agent"];
+        if (signatureAgent?.includes("chatgpt.com")) {
+          confidence = 0.85;
+          reasons.push("signature_agent:chatgpt");
+          detectedAgent = { type: "chatgpt", name: "ChatGPT" };
+          verificationMethod = "signature";
+        } else if (signaturePresent) {
+          confidence = Math.max(confidence, 0.4);
+          reasons.push("signature_present");
+        }
+        const userAgent = input.userAgent || input.headers?.["user-agent"] || "";
+        if (userAgent) {
+          for (const { pattern, type, name } of AI_AGENT_PATTERNS2) {
+            if (pattern.test(userAgent)) {
+              const highConfidenceAgents = [
+                "chatgpt",
+                "claude",
+                "perplexity",
+                "anthropic"
+              ];
+              const patternConfidence = highConfidenceAgents.includes(type) ? 0.85 : 0.5;
+              confidence = Math.max(confidence, patternConfidence);
+              reasons.push(`known_pattern:${type}`);
+              if (!detectedAgent) {
+                detectedAgent = { type, name };
+                verificationMethod = "pattern";
+              }
+              break;
+            }
+          }
+        }
+        const aiHeaders = [
+          "openai-conversation-id",
+          "openai-ephemeral-user-id",
+          "anthropic-client-id",
+          "x-goog-api-client",
+          "x-ms-copilot-id"
+        ];
+        const foundAiHeaders = aiHeaders.filter(
+          (header) => normalizedHeaders[header]
+        );
+        if (foundAiHeaders.length > 0) {
+          confidence = Math.max(confidence, 0.6);
+          reasons.push(`ai_headers:${foundAiHeaders.length}`);
+        }
+        const ip = input.ip || input.ipAddress;
+        if (ip && !normalizedHeaders["x-forwarded-for"] && !normalizedHeaders["x-real-ip"]) {
+          for (const [provider, prefixes] of Object.entries(CLOUD_PROVIDERS2)) {
+            if (prefixes.some((prefix) => ip.startsWith(prefix))) {
+              confidence = Math.max(confidence, 0.4);
+              reasons.push(`cloud_provider:${provider}`);
+              break;
+            }
+          }
+        }
+        if (reasons.length > 2) {
+          confidence = Math.min(confidence * 1.2, 0.95);
+        }
+        return {
+          isAgent: confidence > 0.3,
+          confidence,
+          ...detectedAgent && { detectedAgent },
+          reasons,
+          ...verificationMethod && { verificationMethod },
+          forgeabilityRisk: confidence > 0.8 ? "medium" : "high",
+          timestamp: /* @__PURE__ */ new Date()
+        };
+      }
+      /**
+       * Analyze request with WASM enhancement when available
+       */
+      async analyze(input) {
+        await this.init();
+        if (this.wasmEnabled) {
+          try {
+            const wasmResult = await detectAgentWithWasm(
+              input.userAgent || input.headers?.["user-agent"],
+              input.headers || {},
+              input.ip || input.ipAddress
+            );
+            if (wasmResult) {
+              console.log("[AgentShield] Using WASM detection result");
+              const detectedAgent = wasmResult.agent ? this.mapAgentName(wasmResult.agent) : void 0;
+              return {
+                isAgent: wasmResult.isAgent,
+                confidence: wasmResult.confidence,
+                ...detectedAgent && { detectedAgent },
+                reasons: [`wasm:${wasmResult.verificationMethod}`],
+                verificationMethod: wasmResult.verificationMethod,
+                forgeabilityRisk: wasmResult.verificationMethod === "signature" ? "low" : wasmResult.confidence > 0.9 ? "medium" : "high",
+                timestamp: /* @__PURE__ */ new Date()
+              };
+            }
+          } catch (error) {
+            console.error("[AgentShield] WASM detection error:", error);
+          }
+        }
+        const patternResult = await this.patternDetection(input);
+        if (this.wasmEnabled && patternResult.confidence >= 0.85) {
+          patternResult.confidence = Math.min(0.95, patternResult.confidence + 0.1);
+          patternResult.reasons.push("wasm_enhanced");
+          if (!patternResult.verificationMethod) {
+            patternResult.verificationMethod = "wasm-enhanced";
+          }
+        }
+        return patternResult;
+      }
+      /**
+       * Map agent names from WASM to consistent format
+       */
+      mapAgentName(agent) {
+        const lowerAgent = agent.toLowerCase();
+        if (lowerAgent.includes("chatgpt")) {
+          return { type: "chatgpt", name: "ChatGPT" };
+        } else if (lowerAgent.includes("claude")) {
+          return { type: "claude", name: "Claude" };
+        } else if (lowerAgent.includes("perplexity")) {
+          return { type: "perplexity", name: "Perplexity" };
+        } else if (lowerAgent.includes("bing")) {
+          return { type: "bing", name: "Bing AI" };
+        } else if (lowerAgent.includes("anthropic")) {
+          return { type: "anthropic", name: "Anthropic" };
+        }
+        return { type: "unknown", name: agent };
+      }
+    };
+    EdgeAgentDetectorWrapperWithWasm = class {
+      detector;
+      events = /* @__PURE__ */ new Map();
+      constructor(config) {
+        this.detector = new EdgeAgentDetectorWithWasm(config?.enableWasm ?? true);
+        if (config?.baseUrl) {
+          this.detector.setBaseUrl(config.baseUrl);
+        }
+      }
+      setBaseUrl(url) {
+        this.detector.setBaseUrl(url);
+      }
+      async analyze(input) {
+        const result = await this.detector.analyze(input);
+        if (result.isAgent && this.events.has("agent.detected")) {
+          const handlers = this.events.get("agent.detected") || [];
+          handlers.forEach((handler) => handler(result, input));
+        }
+        return result;
+      }
+      on(event, handler) {
+        if (!this.events.has(event)) {
+          this.events.set(event, []);
+        }
+        this.events.get(event).push(handler);
+      }
+      emit(event, ...args) {
+        const handlers = this.events.get(event) || [];
+        handlers.forEach((handler) => handler(...args));
+      }
+      async init() {
+        await this.detector.init();
+      }
+    };
+  }
+});
+
+// src/wasm-confidence.ts
+var wasm_confidence_exports = {};
+__export(wasm_confidence_exports, {
+  checkWasmAvailability: () => checkWasmAvailability,
+  getVerificationMethod: () => getVerificationMethod,
+  getWasmConfidenceBoost: () => getWasmConfidenceBoost,
+  shouldIndicateWasmVerification: () => shouldIndicateWasmVerification
+});
+async function checkWasmAvailability() {
+  try {
+    if (typeof WebAssembly === "undefined") {
+      return false;
+    }
+    if (!WebAssembly.instantiate || !WebAssembly.Module) {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function shouldIndicateWasmVerification(confidence) {
+  return confidence >= 0.85 && confidence < 1;
+}
+function getWasmConfidenceBoost(baseConfidence, reasons = []) {
+  if (reasons.some(
+    (r) => r.includes("signature_agent") && !r.includes("signature_headers_present")
+  )) {
+    return 1;
+  }
+  if (baseConfidence >= 0.85) {
+    return 0.95;
+  }
+  if (baseConfidence >= 0.7) {
+    return Math.min(baseConfidence * 1.1, 0.9);
+  }
+  return baseConfidence;
+}
+function getVerificationMethod(confidence, reasons = []) {
+  if (reasons.some(
+    (r) => r.includes("signature_agent") && !r.includes("signature_headers_present")
+  )) {
+    return "signature";
+  }
+  if (shouldIndicateWasmVerification(confidence)) {
+    return "wasm-enhanced";
+  }
+  return "pattern";
+}
+var init_wasm_confidence = __esm({
+  "src/wasm-confidence.ts"() {
+  }
+});
 
 // src/signature-verifier.ts
 var KNOWN_KEYS = {
@@ -175,398 +637,67 @@ async function verifyAgentSignature(method, path, headers) {
       isValid: false,
       confidence: 0,
       reason: "Key is not valid at current time",
-      verificationMethod: "none"
-    };
-  }
-  const signatureBase = buildSignatureBase(method, path, headers, parsed.signedHeaders);
-  let signatureValue = signature;
-  if (signatureValue.startsWith("sig1=:")) {
-    signatureValue = signatureValue.substring(6);
-  }
-  if (signatureValue.endsWith(":")) {
-    signatureValue = signatureValue.slice(0, -1);
-  }
-  const isValid = await verifyEd25519Signature(
-    key.publicKey,
-    signatureValue,
-    signatureBase
-  );
-  if (isValid) {
-    return {
-      isValid: true,
-      agent,
-      keyid: parsed.keyid,
-      confidence: 1,
-      // 100% confidence for valid signature
-      verificationMethod: "signature"
-    };
-  } else {
-    return {
-      isValid: false,
-      confidence: 0,
-      reason: "Signature verification failed",
-      verificationMethod: "none"
-    };
-  }
-}
-function hasSignatureHeaders(headers) {
-  return !!((headers["signature"] || headers["Signature"]) && (headers["signature-input"] || headers["Signature-Input"]));
-}
-function isChatGPTSignature(headers) {
-  const signatureAgent = headers["signature-agent"] || headers["Signature-Agent"];
-  return signatureAgent === '"https://chatgpt.com"' || (signatureAgent?.includes("chatgpt.com") || false);
-}
-
-// src/edge-detector-wrapper.ts
-var AI_AGENT_PATTERNS = [
-  { pattern: /chatgpt-user/i, type: "chatgpt", name: "ChatGPT" },
-  { pattern: /claude-web/i, type: "claude", name: "Claude" },
-  { pattern: /perplexitybot/i, type: "perplexity", name: "Perplexity" },
-  { pattern: /perplexity-user/i, type: "perplexity", name: "Perplexity" },
-  { pattern: /perplexity-ai/i, type: "perplexity", name: "Perplexity" },
-  { pattern: /perplexity/i, type: "perplexity", name: "Perplexity" },
-  // Fallback
-  { pattern: /bingbot/i, type: "bing", name: "Bing AI" },
-  { pattern: /anthropic-ai/i, type: "anthropic", name: "Anthropic" }
-];
-var CLOUD_PROVIDERS = {
-  aws: ["54.", "52.", "35.", "18.", "3."],
-  gcp: ["35.", "34.", "104.", "107.", "108."],
-  azure: ["13.", "20.", "40.", "52.", "104."]
-};
-var EdgeAgentDetector = class {
-  async analyze(input) {
-    const reasons = [];
-    let detectedAgent;
-    let verificationMethod;
-    let confidence = 0;
-    const headers = input.headers || {};
-    const normalizedHeaders = {};
-    for (const [key, value] of Object.entries(headers)) {
-      normalizedHeaders[key.toLowerCase()] = value;
-    }
-    if (hasSignatureHeaders(headers)) {
-      try {
-        const signatureResult = await verifyAgentSignature(
-          input.method || "GET",
-          input.url || "/",
-          headers
-        );
-        if (signatureResult.isValid) {
-          confidence = signatureResult.confidence;
-          reasons.push(`verified_signature:${signatureResult.agent?.toLowerCase() || "unknown"}`);
-          if (signatureResult.agent) {
-            detectedAgent = {
-              type: signatureResult.agent.toLowerCase(),
-              name: signatureResult.agent
-            };
-          }
-          verificationMethod = signatureResult.verificationMethod;
-          if (signatureResult.keyid) {
-            reasons.push(`keyid:${signatureResult.keyid}`);
-          }
-        } else {
-          confidence = Math.max(confidence, 0.3);
-          reasons.push("invalid_signature");
-          if (signatureResult.reason) {
-            reasons.push(`signature_error:${signatureResult.reason}`);
-          }
-          if (isChatGPTSignature(headers)) {
-            reasons.push("claims_chatgpt");
-            detectedAgent = { type: "chatgpt", name: "ChatGPT (unverified)" };
-          }
-        }
-      } catch (error) {
-        console.error("[EdgeAgentDetector] Signature verification error:", error);
-        confidence = Math.max(confidence, 0.2);
-        reasons.push("signature_verification_error");
-      }
-    }
-    const userAgent = input.userAgent || input.headers?.["user-agent"] || "";
-    if (userAgent) {
-      for (const { pattern, type, name } of AI_AGENT_PATTERNS) {
-        if (pattern.test(userAgent)) {
-          const highConfidenceAgents = [
-            "chatgpt",
-            "claude",
-            "perplexity",
-            "anthropic"
-          ];
-          const patternConfidence = highConfidenceAgents.includes(type) ? 0.85 : 0.5;
-          confidence = Math.max(confidence, patternConfidence);
-          reasons.push(`known_pattern:${type}`);
-          if (!detectedAgent) {
-            detectedAgent = { type, name };
-            verificationMethod = "pattern";
-          }
-          break;
-        }
-      }
-    }
-    const aiHeaders = [
-      "openai-conversation-id",
-      "openai-ephemeral-user-id",
-      "anthropic-client-id",
-      "x-goog-api-client",
-      "x-ms-copilot-id"
-    ];
-    const foundAiHeaders = aiHeaders.filter(
-      (header) => normalizedHeaders[header]
-    );
-    if (foundAiHeaders.length > 0) {
-      confidence = Math.max(confidence, 0.6);
-      reasons.push(`ai_headers:${foundAiHeaders.length}`);
-    }
-    const ip = input.ip || input.ipAddress;
-    if (ip && !normalizedHeaders["x-forwarded-for"] && !normalizedHeaders["x-real-ip"]) {
-      for (const [provider, prefixes] of Object.entries(CLOUD_PROVIDERS)) {
-        if (prefixes.some((prefix) => ip.startsWith(prefix))) {
-          confidence = Math.max(confidence, 0.4);
-          reasons.push(`cloud_provider:${provider}`);
-          break;
-        }
-      }
-    }
-    if (reasons.length > 2 && confidence < 1) {
-      confidence = Math.min(confidence * 1.2, 0.95);
-    }
-    return {
-      isAgent: confidence > 0.3,
-      confidence,
-      ...detectedAgent && { detectedAgent },
-      reasons,
-      ...verificationMethod && { verificationMethod },
-      forgeabilityRisk: verificationMethod === "signature" ? "low" : confidence > 0.8 ? "medium" : "high",
-      timestamp: /* @__PURE__ */ new Date()
-    };
-  }
-};
-var EdgeAgentDetectorWrapper = class {
-  detector;
-  events = /* @__PURE__ */ new Map();
-  constructor(_config) {
-    this.detector = new EdgeAgentDetector();
-  }
-  async analyze(input) {
-    const result = await this.detector.analyze(input);
-    if (result.isAgent && this.events.has("agent.detected")) {
-      const handlers = this.events.get("agent.detected") || [];
-      handlers.forEach((handler) => handler(result, input));
-    }
-    return result;
-  }
-  on(event, handler) {
-    if (!this.events.has(event)) {
-      this.events.set(event, []);
-    }
-    this.events.get(event).push(handler);
-  }
-  emit(event, ...args) {
-    const handlers = this.events.get(event) || [];
-    handlers.forEach((handler) => handler(...args));
-  }
-  async init() {
-    return;
-  }
-};
-
-// src/wasm-loader.ts
-var wasmInstance = null;
-var wasmExports = null;
-var initPromise = null;
-var WASM_PATH = "/wasm/agentshield_wasm_bg.wasm";
-var baseUrl = null;
-function setWasmBaseUrl(url) {
-  baseUrl = url;
-}
-function getWasmUrl() {
-  if (baseUrl) {
-    try {
-      const url = new URL(baseUrl);
-      return `${url.origin}${WASM_PATH}`;
-    } catch {
-      return WASM_PATH;
-    }
-  }
-  return WASM_PATH;
-}
-async function initWasm() {
-  if (wasmExports) return true;
-  if (initPromise) {
-    await initPromise;
-    return !!wasmExports;
-  }
-  initPromise = (async () => {
-    try {
-      if (typeof WebAssembly.instantiateStreaming === "function") {
-        try {
-          const wasmUrl2 = getWasmUrl();
-          const response2 = await fetch(wasmUrl2);
-          if (!response2.ok) {
-            throw new Error(`Failed to fetch WASM: ${response2.status}`);
-          }
-          const streamResponse = response2.clone();
-          const { instance } = await WebAssembly.instantiateStreaming(
-            streamResponse,
-            {
-              wbg: {
-                __wbg_log_1d3ae13c3d5e6b8e: (ptr, len) => {
-                  console.log("WASM:", ptr, len);
-                },
-                __wbindgen_throw: (ptr, len) => {
-                  throw new Error(`WASM Error at ${ptr}, length ${len}`);
-                }
-              }
-            }
-          );
-          wasmInstance = instance;
-          wasmExports = instance.exports;
-          console.log("[AgentShield] \u2705 WASM module initialized with streaming");
-          return;
-        } catch (streamError) {
-          console.log("[AgentShield] Streaming compilation failed, falling back to standard compilation");
-        }
-      }
-      const wasmUrl = getWasmUrl();
-      const response = await fetch(wasmUrl);
-      if (!response.ok) {
-        throw new Error(`Failed to fetch WASM: ${response.status}`);
-      }
-      const wasmArrayBuffer = await response.arrayBuffer();
-      const compiledModule = await WebAssembly.compile(wasmArrayBuffer);
-      const imports = {
-        wbg: {
-          __wbg_log_1d3ae13c3d5e6b8e: (ptr, len) => {
-            console.log("WASM:", ptr, len);
-          },
-          __wbindgen_throw: (ptr, len) => {
-            throw new Error(`WASM Error at ${ptr}, length ${len}`);
-          }
-        }
-      };
-      wasmInstance = await WebAssembly.instantiate(compiledModule, imports);
-      wasmExports = wasmInstance.exports;
-      console.log("[AgentShield] \u2705 WASM module initialized via fallback");
-    } catch (error) {
-      console.error("[AgentShield] Failed to initialize WASM:", error);
-      wasmExports = null;
-    }
-  })();
-  await initPromise;
-  return !!wasmExports;
-}
-async function detectAgentWithWasm(userAgent, headers, ipAddress) {
-  const initialized = await initWasm();
-  if (!initialized || !wasmExports) {
-    return null;
+      verificationMethod: "none"
+    };
   }
-  try {
-    const headersJson = JSON.stringify(headers);
-    if (typeof wasmExports.detect_agent === "function") {
-      const result = wasmExports.detect_agent(
-        userAgent || "",
-        headersJson,
-        ipAddress || "",
-        (/* @__PURE__ */ new Date()).toISOString()
-      );
-      return {
-        isAgent: result.is_agent || false,
-        confidence: result.confidence || 0,
-        agent: result.agent,
-        verificationMethod: result.verification_method || "wasm",
-        riskLevel: result.risk_level || "low"
-      };
-    }
-    console.warn("[AgentShield] WASM exports do not include detect_agent function");
-    return null;
-  } catch (error) {
-    console.error("[AgentShield] WASM detection failed:", error);
-    return null;
+  const signatureBase = buildSignatureBase(method, path, headers, parsed.signedHeaders);
+  let signatureValue = signature;
+  if (signatureValue.startsWith("sig1=:")) {
+    signatureValue = signatureValue.substring(6);
   }
-}
-async function getWasmVersion() {
-  const initialized = await initWasm();
-  if (!initialized || !wasmExports) {
-    return null;
+  if (signatureValue.endsWith(":")) {
+    signatureValue = signatureValue.slice(0, -1);
   }
-  if (typeof wasmExports.version === "function") {
-    return wasmExports.version();
+  const isValid = await verifyEd25519Signature(
+    key.publicKey,
+    signatureValue,
+    signatureBase
+  );
+  if (isValid) {
+    return {
+      isValid: true,
+      agent,
+      keyid: parsed.keyid,
+      confidence: 1,
+      // 100% confidence for valid signature
+      verificationMethod: "signature"
+    };
+  } else {
+    return {
+      isValid: false,
+      confidence: 0,
+      reason: "Signature verification failed",
+      verificationMethod: "none"
+    };
   }
-  return "unknown";
 }
-async function isWasmAvailable() {
-  try {
-    const initialized = await initWasm();
-    if (!initialized) return false;
-    const version = await getWasmVersion();
-    return version !== null;
-  } catch {
-    return false;
-  }
+function hasSignatureHeaders(headers) {
+  return !!((headers["signature"] || headers["Signature"]) && (headers["signature-input"] || headers["Signature-Input"]));
+}
+function isChatGPTSignature(headers) {
+  const signatureAgent = headers["signature-agent"] || headers["Signature-Agent"];
+  return signatureAgent === '"https://chatgpt.com"' || (signatureAgent?.includes("chatgpt.com") || false);
 }
 
-// src/edge-detector-with-wasm.ts
-var AI_AGENT_PATTERNS2 = [
+// src/edge-detector-wrapper.ts
+var AI_AGENT_PATTERNS = [
   { pattern: /chatgpt-user/i, type: "chatgpt", name: "ChatGPT" },
   { pattern: /claude-web/i, type: "claude", name: "Claude" },
   { pattern: /perplexitybot/i, type: "perplexity", name: "Perplexity" },
   { pattern: /perplexity-user/i, type: "perplexity", name: "Perplexity" },
   { pattern: /perplexity-ai/i, type: "perplexity", name: "Perplexity" },
   { pattern: /perplexity/i, type: "perplexity", name: "Perplexity" },
+  // Fallback
   { pattern: /bingbot/i, type: "bing", name: "Bing AI" },
   { pattern: /anthropic-ai/i, type: "anthropic", name: "Anthropic" }
 ];
-var CLOUD_PROVIDERS2 = {
+var CLOUD_PROVIDERS = {
   aws: ["54.", "52.", "35.", "18.", "3."],
   gcp: ["35.", "34.", "104.", "107.", "108."],
   azure: ["13.", "20.", "40.", "52.", "104."]
 };
-var EdgeAgentDetectorWithWasm = class {
-  constructor(enableWasm = true) {
-    this.enableWasm = enableWasm;
-  }
-  wasmEnabled = false;
-  initPromise = null;
-  baseUrl = null;
-  /**
-   * Set the base URL for WASM loading in Edge Runtime
-   */
-  setBaseUrl(url) {
-    this.baseUrl = url;
-    setWasmBaseUrl(url);
-  }
-  /**
-   * Initialize the detector (including WASM if enabled)
-   */
-  async init() {
-    if (!this.enableWasm) {
-      this.wasmEnabled = false;
-      return;
-    }
-    if (this.initPromise) {
-      await this.initPromise;
-      return;
-    }
-    this.initPromise = (async () => {
-      try {
-        const wasmAvailable = await isWasmAvailable();
-        this.wasmEnabled = wasmAvailable;
-        if (this.wasmEnabled) {
-          console.log("[AgentShield] WASM detection enabled");
-        } else {
-          console.log("[AgentShield] WASM not available, using pattern detection");
-        }
-      } catch (error) {
-        console.error("[AgentShield] Failed to initialize WASM:", error);
-        this.wasmEnabled = false;
-      }
-    })();
-    await this.initPromise;
-  }
-  /**
-   * Pattern-based detection (fallback)
-   */
-  async patternDetection(input) {
+var EdgeAgentDetector = class {
+  async analyze(input) {
     const reasons = [];
     let detectedAgent;
     let verificationMethod;
@@ -576,20 +707,46 @@ var EdgeAgentDetectorWithWasm = class {
     for (const [key, value] of Object.entries(headers)) {
       normalizedHeaders[key.toLowerCase()] = value;
     }
-    const signaturePresent = !!(normalizedHeaders["signature"] || normalizedHeaders["signature-input"]);
-    const signatureAgent = normalizedHeaders["signature-agent"];
-    if (signatureAgent?.includes("chatgpt.com")) {
-      confidence = 0.85;
-      reasons.push("signature_agent:chatgpt");
-      detectedAgent = { type: "chatgpt", name: "ChatGPT" };
-      verificationMethod = "signature";
-    } else if (signaturePresent) {
-      confidence = Math.max(confidence, 0.4);
-      reasons.push("signature_present");
+    if (hasSignatureHeaders(headers)) {
+      try {
+        const signatureResult = await verifyAgentSignature(
+          input.method || "GET",
+          input.url || "/",
+          headers
+        );
+        if (signatureResult.isValid) {
+          confidence = signatureResult.confidence;
+          reasons.push(`verified_signature:${signatureResult.agent?.toLowerCase() || "unknown"}`);
+          if (signatureResult.agent) {
+            detectedAgent = {
+              type: signatureResult.agent.toLowerCase(),
+              name: signatureResult.agent
+            };
+          }
+          verificationMethod = signatureResult.verificationMethod;
+          if (signatureResult.keyid) {
+            reasons.push(`keyid:${signatureResult.keyid}`);
+          }
+        } else {
+          confidence = Math.max(confidence, 0.3);
+          reasons.push("invalid_signature");
+          if (signatureResult.reason) {
+            reasons.push(`signature_error:${signatureResult.reason}`);
+          }
+          if (isChatGPTSignature(headers)) {
+            reasons.push("claims_chatgpt");
+            detectedAgent = { type: "chatgpt", name: "ChatGPT (unverified)" };
+          }
+        }
+      } catch (error) {
+        console.error("[EdgeAgentDetector] Signature verification error:", error);
+        confidence = Math.max(confidence, 0.2);
+        reasons.push("signature_verification_error");
+      }
     }
     const userAgent = input.userAgent || input.headers?.["user-agent"] || "";
     if (userAgent) {
-      for (const { pattern, type, name } of AI_AGENT_PATTERNS2) {
+      for (const { pattern, type, name } of AI_AGENT_PATTERNS) {
         if (pattern.test(userAgent)) {
           const highConfidenceAgents = [
             "chatgpt",
@@ -624,7 +781,7 @@ var EdgeAgentDetectorWithWasm = class {
     }
     const ip = input.ip || input.ipAddress;
     if (ip && !normalizedHeaders["x-forwarded-for"] && !normalizedHeaders["x-real-ip"]) {
-      for (const [provider, prefixes] of Object.entries(CLOUD_PROVIDERS2)) {
+      for (const [provider, prefixes] of Object.entries(CLOUD_PROVIDERS)) {
         if (prefixes.some((prefix) => ip.startsWith(prefix))) {
           confidence = Math.max(confidence, 0.4);
           reasons.push(`cloud_provider:${provider}`);
@@ -632,7 +789,7 @@ var EdgeAgentDetectorWithWasm = class {
         }
       }
     }
-    if (reasons.length > 2) {
+    if (reasons.length > 2 && confidence < 1) {
       confidence = Math.min(confidence * 1.2, 0.95);
     }
     return {
@@ -641,79 +798,16 @@ var EdgeAgentDetectorWithWasm = class {
       ...detectedAgent && { detectedAgent },
       reasons,
       ...verificationMethod && { verificationMethod },
-      forgeabilityRisk: confidence > 0.8 ? "medium" : "high",
+      forgeabilityRisk: verificationMethod === "signature" ? "low" : confidence > 0.8 ? "medium" : "high",
       timestamp: /* @__PURE__ */ new Date()
     };
   }
-  /**
-   * Analyze request with WASM enhancement when available
-   */
-  async analyze(input) {
-    await this.init();
-    if (this.wasmEnabled) {
-      try {
-        const wasmResult = await detectAgentWithWasm(
-          input.userAgent || input.headers?.["user-agent"],
-          input.headers || {},
-          input.ip || input.ipAddress
-        );
-        if (wasmResult) {
-          console.log("[AgentShield] Using WASM detection result");
-          const detectedAgent = wasmResult.agent ? this.mapAgentName(wasmResult.agent) : void 0;
-          return {
-            isAgent: wasmResult.isAgent,
-            confidence: wasmResult.confidence,
-            ...detectedAgent && { detectedAgent },
-            reasons: [`wasm:${wasmResult.verificationMethod}`],
-            verificationMethod: wasmResult.verificationMethod,
-            forgeabilityRisk: wasmResult.verificationMethod === "signature" ? "low" : wasmResult.confidence > 0.9 ? "medium" : "high",
-            timestamp: /* @__PURE__ */ new Date()
-          };
-        }
-      } catch (error) {
-        console.error("[AgentShield] WASM detection error:", error);
-      }
-    }
-    const patternResult = await this.patternDetection(input);
-    if (this.wasmEnabled && patternResult.confidence >= 0.85) {
-      patternResult.confidence = Math.min(0.95, patternResult.confidence + 0.1);
-      patternResult.reasons.push("wasm_enhanced");
-      if (!patternResult.verificationMethod) {
-        patternResult.verificationMethod = "wasm-enhanced";
-      }
-    }
-    return patternResult;
-  }
-  /**
-   * Map agent names from WASM to consistent format
-   */
-  mapAgentName(agent) {
-    const lowerAgent = agent.toLowerCase();
-    if (lowerAgent.includes("chatgpt")) {
-      return { type: "chatgpt", name: "ChatGPT" };
-    } else if (lowerAgent.includes("claude")) {
-      return { type: "claude", name: "Claude" };
-    } else if (lowerAgent.includes("perplexity")) {
-      return { type: "perplexity", name: "Perplexity" };
-    } else if (lowerAgent.includes("bing")) {
-      return { type: "bing", name: "Bing AI" };
-    } else if (lowerAgent.includes("anthropic")) {
-      return { type: "anthropic", name: "Anthropic" };
-    }
-    return { type: "unknown", name: agent };
-  }
 };
-var EdgeAgentDetectorWrapperWithWasm = class {
+var EdgeAgentDetectorWrapper = class {
   detector;
   events = /* @__PURE__ */ new Map();
-  constructor(config) {
-    this.detector = new EdgeAgentDetectorWithWasm(config?.enableWasm ?? true);
-    if (config?.baseUrl) {
-      this.detector.setBaseUrl(config.baseUrl);
-    }
-  }
-  setBaseUrl(url) {
-    this.detector.setBaseUrl(url);
+  constructor(_config) {
+    this.detector = new EdgeAgentDetector();
   }
   async analyze(input) {
     const result = await this.detector.analyze(input);
@@ -734,10 +828,13 @@ var EdgeAgentDetectorWrapperWithWasm = class {
     handlers.forEach((handler) => handler(...args));
   }
   async init() {
-    await this.detector.init();
+    return;
   }
 };
 
+// src/middleware.ts
+init_edge_detector_with_wasm();
+
 // src/session-tracker.ts
 var EdgeSessionTracker = class {
   config;
@@ -1088,48 +1185,80 @@ function createAgentShieldMiddleware2(config) {
   };
 }
 
-// src/wasm-confidence.ts
-async function checkWasmAvailability() {
-  try {
-    if (typeof WebAssembly === "undefined") {
-      return false;
+// src/edge-safe-detector.ts
+var AI_AGENT_PATTERNS3 = [
+  { pattern: /chatgpt-user/i, type: "chatgpt", name: "ChatGPT" },
+  { pattern: /claude-web/i, type: "claude", name: "Claude" },
+  { pattern: /perplexitybot/i, type: "perplexity", name: "Perplexity" },
+  { pattern: /perplexity-user/i, type: "perplexity", name: "Perplexity" },
+  { pattern: /perplexity/i, type: "perplexity", name: "Perplexity" },
+  { pattern: /bingbot/i, type: "bing", name: "Bing AI" },
+  { pattern: /anthropic-ai/i, type: "anthropic", name: "Anthropic" }
+];
+var EdgeSafeDetector = class {
+  async analyze(input) {
+    const reasons = [];
+    let detectedAgent;
+    let confidence = 0;
+    const headers = input.headers || {};
+    const normalizedHeaders = {};
+    for (const [key, value] of Object.entries(headers)) {
+      normalizedHeaders[key.toLowerCase()] = value;
     }
-    if (!WebAssembly.instantiate || !WebAssembly.Module) {
-      return false;
+    const userAgent = input.userAgent || normalizedHeaders["user-agent"] || "";
+    if (userAgent) {
+      for (const { pattern, type, name } of AI_AGENT_PATTERNS3) {
+        if (pattern.test(userAgent)) {
+          confidence = 0.85;
+          reasons.push(`known_pattern:${type}`);
+          detectedAgent = { type, name };
+          break;
+        }
+      }
     }
-    return true;
-  } catch {
-    return false;
-  }
-}
-function shouldIndicateWasmVerification(confidence) {
-  return confidence >= 0.85 && confidence < 1;
-}
-function getWasmConfidenceBoost(baseConfidence, reasons = []) {
-  if (reasons.some(
-    (r) => r.includes("signature_agent") && !r.includes("signature_headers_present")
-  )) {
-    return 1;
-  }
-  if (baseConfidence >= 0.85) {
-    return 0.95;
-  }
-  if (baseConfidence >= 0.7) {
-    return Math.min(baseConfidence * 1.1, 0.9);
-  }
-  return baseConfidence;
-}
-function getVerificationMethod(confidence, reasons = []) {
-  if (reasons.some(
-    (r) => r.includes("signature_agent") && !r.includes("signature_headers_present")
-  )) {
-    return "signature";
-  }
-  if (shouldIndicateWasmVerification(confidence)) {
-    return "wasm-enhanced";
+    const hasChrome = userAgent.toLowerCase().includes("chrome");
+    const hasFirefox = userAgent.toLowerCase().includes("firefox");
+    const hasSafari = userAgent.toLowerCase().includes("safari");
+    const hasBrowserUA = hasChrome || hasFirefox || hasSafari;
+    if (hasBrowserUA) {
+      const hasSecChUa = !!normalizedHeaders["sec-ch-ua"];
+      const hasSecFetch = !!normalizedHeaders["sec-fetch-site"];
+      const hasAcceptLanguage = !!normalizedHeaders["accept-language"];
+      const hasCookies = !!normalizedHeaders["cookie"];
+      const missingHeaders = [];
+      if (!hasSecChUa && hasChrome) missingHeaders.push("sec-ch-ua");
+      if (!hasSecFetch) missingHeaders.push("sec-fetch");
+      if (!hasAcceptLanguage) missingHeaders.push("accept-language");
+      if (!hasCookies) missingHeaders.push("cookies");
+      if (missingHeaders.length >= 2) {
+        confidence = Math.max(confidence, 0.85);
+        reasons.push("browser_ua_missing_headers");
+        if (!detectedAgent && hasChrome && !hasSecChUa) {
+          detectedAgent = { type: "perplexity", name: "Perplexity" };
+        }
+      }
+    }
+    const aiHeaders = [
+      "openai-conversation-id",
+      "anthropic-client-id",
+      "x-goog-api-client"
+    ];
+    const foundAiHeaders = aiHeaders.filter((h) => normalizedHeaders[h]);
+    if (foundAiHeaders.length > 0) {
+      confidence = Math.max(confidence, 0.6);
+      reasons.push(`ai_headers:${foundAiHeaders.length}`);
+    }
+    return {
+      isAgent: confidence > 0.3,
+      confidence,
+      detectedAgent,
+      reasons,
+      verificationMethod: "pattern",
+      timestamp: /* @__PURE__ */ new Date(),
+      confidenceLevel: confidence >= 0.8 ? "high" : confidence >= 0.5 ? "medium" : "low"
+    };
   }
-  return "pattern";
-}
+};
 
 // src/storage/memory-adapter.ts
 var MemoryStorageAdapter = class {
@@ -1404,39 +1533,48 @@ function createEnhancedAgentShieldMiddleware(config = {}) {
   };
   let detector = null;
   let detectorInitPromise = null;
+  let wasmConfidenceUtils = null;
   const getDetector = async (requestUrl) => {
     if (detector) {
-      if (requestUrl && "setBaseUrl" in detector) {
-        detector.setBaseUrl(requestUrl);
-      }
       return detector;
     }
     if (detectorInitPromise) {
       await detectorInitPromise;
-      if (requestUrl && detector && "setBaseUrl" in detector) {
-        detector.setBaseUrl(requestUrl);
-      }
       return detector;
     }
     detectorInitPromise = (async () => {
-      try {
-        const wasmAvailable = await checkWasmAvailability();
-        if (wasmAvailable) {
-          console.log("[AgentShield] \u2705 WASM support detected - enhanced detection enabled");
-          detector = new EdgeAgentDetectorWrapperWithWasm({ enableWasm: true });
-        } else {
-          console.log("[AgentShield] \u2139\uFE0F Using pattern-based detection (WASM not available)");
-          detector = new EdgeAgentDetectorWrapper({});
+      const isEdgeRuntime = typeof globalThis.EdgeRuntime !== "undefined" || process.env.NEXT_RUNTIME === "edge";
+      if (isEdgeRuntime) {
+        console.log("[AgentShield] Edge Runtime detected - using pattern detection");
+        detector = new EdgeSafeDetector();
+      } else {
+        try {
+          try {
+            const wasmUtils = await Promise.resolve().then(() => (init_wasm_confidence(), wasm_confidence_exports));
+            wasmConfidenceUtils = wasmUtils;
+            const wasmAvailable = await wasmUtils.checkWasmAvailability();
+            if (wasmAvailable) {
+              const { EdgeAgentDetectorWrapperWithWasm: EdgeAgentDetectorWrapperWithWasm2 } = await Promise.resolve().then(() => (init_edge_detector_with_wasm(), edge_detector_with_wasm_exports));
+              console.log("[AgentShield] \u2705 WASM support detected - enhanced detection enabled");
+              detector = new EdgeAgentDetectorWrapperWithWasm2({ enableWasm: true });
+              if (requestUrl && "setBaseUrl" in detector) {
+                detector.setBaseUrl(requestUrl);
+              }
+            } else {
+              console.log("[AgentShield] \u2139\uFE0F Using pattern-based detection (WASM not available)");
+              detector = new EdgeSafeDetector();
+            }
+          } catch (wasmError) {
+            console.log("[AgentShield] WASM utilities not available, using pattern detection");
+            detector = new EdgeSafeDetector();
+          }
+        } catch (error) {
+          console.warn("[AgentShield] Failed to initialize enhanced detector, using fallback");
+          detector = new EdgeSafeDetector();
         }
-      } catch (error) {
-        console.warn("[AgentShield] Failed to initialize WASM, using fallback:", error);
-        detector = new EdgeAgentDetectorWrapper({});
       }
     })();
     await detectorInitPromise;
-    if (requestUrl && detector && "setBaseUrl" in detector) {
-      detector.setBaseUrl(requestUrl);
-    }
     return detector;
   };
   const sessionManager = new SessionManager();
@@ -1462,11 +1600,11 @@ function createEnhancedAgentShieldMiddleware(config = {}) {
     const result = await activeDetector.analyze(context);
     let finalConfidence = result.confidence;
     let verificationMethod = result.verificationMethod || "pattern";
-    if (result.isAgent) {
+    if (result.isAgent && wasmConfidenceUtils) {
       const reasons = result.reasons || [];
-      if (shouldIndicateWasmVerification(result.confidence)) {
-        finalConfidence = getWasmConfidenceBoost(result.confidence, reasons);
-        verificationMethod = getVerificationMethod(finalConfidence, reasons);
+      if (wasmConfidenceUtils.shouldIndicateWasmVerification(result.confidence)) {
+        finalConfidence = wasmConfidenceUtils.getWasmConfidenceBoost(result.confidence, reasons);
+        verificationMethod = wasmConfidenceUtils.getVerificationMethod(finalConfidence, reasons);
       }
     }
     if (result.isAgent && finalConfidence >= (config.confidenceThreshold ?? 0.7)) {