@astrasyncai/adapter-lambda

AstraSync Commerce Shield edge adapter — a Lambda@Edge/CloudFront interception shell that classifies and verifies inbound AI-agent traffic in front of your existing site. Zero site changes; observe-only by default.

Most of the web's traffic is now machines, and the analytics stack — GA4, session replay, attribution pixels, A/B tests — is structurally blind to it: agents run no JS, carry no cookies, and strip referrers. The edge adapter sits at your CDN edge and gives you the missing lens.

What it does

Every request is classified into a visibility tier:

| Tier | Signal | What happens | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | | Verified | X-Astra-* AstraSync credentials | Full verify-access round trip: identity, trust score, PDLSS mandate | | Identified (unregistered) | Payment-rail / signed-agent credentials (Visa Intelligent Commerce SD-JWTs, Mastercard Agent Pay & Visa TAP RFC 9421 signatures, Web Bot Auth, ACP, UCP, AP2, MPP, x402) or a platform-agent UA (Claude, ChatGPT, Gemini, …) | Recorded with protocol evidence; platform agents surface in your dashboard automatically | | Anonymous bot | CLI/library/headless UA shapes | Sampled telemetry | | Human | Browser-shaped traffic | Untouched — zero API calls, zero added latency |

Static assets and any paths you configure are skipped entirely.

Cryptographic verification of rail credentials happens server-side at AstraSync's verify-access (the adapter forwards raw artifacts) — the edge bundle stays tiny (~26KB) and every decision is recorded once, centrally.

Modes: observe → enforce

• Observe (default): verify, classify, record. Never blocks anything. Would-have-been decisions are logged and stamped on origin requests as X-AstraSync-Observed-Decision.
• Enforce (opt-in, per path): requests that fail verification on enforced paths get a machine-readable 403 with registration guidance; human-approval flows return 202 with step-up polling info. Allowed agent requests reach your origin with trust attestation headers: X-AstraSync-Trust-Score, X-AstraSync-Agent-Id, X-AstraSync-Developer-Id, X-AstraSync-Permissions. (Inbound spoofs of these headers are stripped in both modes.)

Configuration lives in your dashboard

Mode, check depth (classify / authenticate / authorize), per-path rules (ordered, first-match-wins, case-insensitive globs), and bot-telemetry sampling are configured on the endpoint's Edge verification panel in the AstraSync dashboard — no redeploys. The edge refreshes its config every ~60s.

Fail-open guarantee: if the edge can't reach AstraSync it always falls back to observe + pass-through. An unreachable backend can never break your site — and can never silently enforce. Configs stale for more than 24h automatically degrade enforce back to observe.

Deploying

The package ships a CloudFormation/SAM template and deploy script under infra/ that stand up a CloudFront distribution in front of your existing origin with the shell attached as an origin-request trigger:

export ASTRASYNC_COUNTERPARTY_ID="ASTRAE-…"     # your endpoint id
export ASTRASYNC_COUNTERPARTY_URL="https://your-site.example"
export ORIGIN_DOMAIN="your-existing-origin.example"
export ACM_CERT_ARN="arn:aws:acm:us-east-1:…"
./infra/deploy.sh

See infra/RUNBOOK.md for prerequisites (ACM cert, Secrets Manager secret for your merchant API key), DNS cutover, smoke tests, and rollback. Talk to AstraSync for a guided deployment.

Programmatic use

import { createEdgeHandler } from '@astrasyncai/adapter-lambda';

export const handler = createEdgeHandler({
  apiBaseUrl: 'https://astrasync.ai/api',
  counterpartyId: 'ASTRAE-…',
  counterpartyUrl: 'https://your-site.example',
  apiKeySecretName: 'astrasync/edge/your-site', // Secrets Manager, us-east-1
});

Related

• @astrasyncai/verification-gateway — the SDK (Express/Next.js middleware, MCP, agent-side clients) this adapter builds on.
• AstraSync docs: https://astrasync.ai/docs/edge-adapter