@agentronics/sdk 0.5.0 → 0.7.0

package/dist/next.cjs

@@ -0,0 +1,1137 @@
+'use strict';
+
+// src/detection/crawler.ts
+var CRAWLER_SIGNATURES = [
+  // AI / LLM crawlers
+  { name: "GPTBot", category: "ai", pattern: /GPTBot/i },
+  { name: "OAI-SearchBot", category: "ai", pattern: /OAI-SearchBot/i },
+  { name: "ChatGPT-User", category: "ai", pattern: /ChatGPT-User/i },
+  { name: "Claude-User", category: "ai", pattern: /Claude-User/i },
+  { name: "Claude-SearchBot", category: "ai", pattern: /Claude-SearchBot/i },
+  { name: "ClaudeBot", category: "ai", pattern: /ClaudeBot/i },
+  { name: "Claude-Web", category: "ai", pattern: /Claude-Web/i },
+  { name: "anthropic-ai", category: "ai", pattern: /anthropic-ai/i },
+  { name: "Perplexity-User", category: "ai", pattern: /Perplexity-User/i },
+  { name: "PerplexityBot", category: "ai", pattern: /PerplexityBot/i },
+  { name: "Google-Extended", category: "ai", pattern: /Google-Extended/i },
+  { name: "Applebot-Extended", category: "ai", pattern: /Applebot-Extended/i },
+  { name: "Amazonbot", category: "ai", pattern: /Amazonbot/i },
+  { name: "Bytespider", category: "ai", pattern: /Bytespider/i },
+  { name: "CCBot", category: "ai", pattern: /CCBot/i },
+  { name: "Meta-ExternalAgent", category: "ai", pattern: /Meta-ExternalAgent/i },
+  { name: "cohere-ai", category: "ai", pattern: /cohere-ai/i },
+  // Search crawlers
+  { name: "Googlebot", category: "search", pattern: /Googlebot/i },
+  { name: "Bingbot", category: "search", pattern: /bingbot/i },
+  { name: "DuckDuckBot", category: "search", pattern: /DuckDuckBot/i },
+  { name: "YandexBot", category: "search", pattern: /YandexBot/i },
+  { name: "Baiduspider", category: "search", pattern: /Baiduspider/i },
+  { name: "Applebot", category: "search", pattern: /Applebot/i }
+];
+
+// src/server/ipRanges.ts
+var PUBLISHED_IP_RANGES = {
+  GPTBot: ["https://openai.com/gptbot.json"],
+  "OAI-SearchBot": ["https://openai.com/searchbot.json"],
+  "ChatGPT-User": ["https://openai.com/chatgpt-user.json"],
+  PerplexityBot: ["https://www.perplexity.ai/perplexitybot.json"],
+  "Perplexity-User": ["https://www.perplexity.ai/perplexity-user.json"],
+  Googlebot: ["https://developers.google.com/static/crawling/ipranges/common-crawlers.json"],
+  Bingbot: ["https://www.bing.com/toolbox/bingbot.json"],
+  DuckDuckBot: ["https://duckduckgo.com/duckduckbot.json"],
+  CCBot: ["https://index.commoncrawl.org/ccbot.json"]
+};
+var TTL_MS = 24 * 36e5;
+var FAILED_TTL_MS = 10 * 6e4;
+var cache = /* @__PURE__ */ new Map();
+async function loadUrl(url, fetcher) {
+  const hit = cache.get(url);
+  if (hit && hit.until > Date.now()) return hit.cidrs;
+  try {
+    const res = await fetcher(url, { signal: AbortSignal.timeout(5e3), redirect: "follow" });
+    if (!res.ok) throw new Error(String(res.status));
+    const body = await res.json();
+    const cidrs = (body.prefixes ?? []).flatMap((p) => [p.ipv4Prefix, p.ipv6Prefix]).filter((c) => typeof c === "string");
+    cache.set(url, { cidrs, until: Date.now() + TTL_MS });
+    return cidrs;
+  } catch {
+    const cidrs = hit?.cidrs ?? [];
+    cache.set(url, { cidrs, until: Date.now() + FAILED_TTL_MS });
+    return cidrs;
+  }
+}
+async function rangesFor(name, options = {}) {
+  const fixed = options.ipRanges?.[name];
+  if (fixed) return fixed;
+  const urls = PUBLISHED_IP_RANGES[name];
+  if (!urls) return null;
+  const fetcher = options.fetcher ?? fetch;
+  return (await Promise.all(urls.map((u) => loadUrl(u, fetcher)))).flat();
+}
+function v4ToBigInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let n = 0n;
+  for (const p of parts) {
+    if (!/^\d{1,3}$/.test(p) || Number(p) > 255) return null;
+    n = n << 8n | BigInt(p);
+  }
+  return n;
+}
+function v6ToBigInt(ip) {
+  let s = ip.toLowerCase().replace(/^\[|\]$/g, "");
+  const zone = s.indexOf("%");
+  if (zone >= 0) s = s.slice(0, zone);
+  const v4 = s.match(/(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4) {
+    const n2 = v4ToBigInt(v4[1]);
+    if (n2 === null) return null;
+    s = s.slice(0, -v4[1].length) + (n2 >> 16n & 0xffffn).toString(16) + ":" + (n2 & 0xffffn).toString(16);
+  }
+  const halves = s.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const tail = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const missing = 8 - head.length - tail.length;
+  if (halves.length === 1 ? missing !== 0 : missing < 1) return null;
+  const groups = [...head, ...Array(halves.length === 2 ? missing : 0).fill("0"), ...tail];
+  let n = 0n;
+  for (const g of groups) {
+    if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+    n = n << 16n | BigInt(parseInt(g, 16));
+  }
+  return n;
+}
+function ipInCidr(ip, cidr) {
+  const [range, bitsRaw] = cidr.split("/");
+  if (!range) return false;
+  const isV6 = range.includes(":");
+  const mapped = ip.toLowerCase().match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  const candidate = !isV6 && mapped ? mapped[1] : ip;
+  const width = isV6 ? 128 : 32;
+  const bits = bitsRaw === void 0 ? width : Number(bitsRaw);
+  if (!Number.isInteger(bits) || bits < 0 || bits > width) return false;
+  const a = isV6 ? v6ToBigInt(candidate) : v4ToBigInt(candidate);
+  const b = isV6 ? v6ToBigInt(range) : v4ToBigInt(range);
+  if (a === null || b === null) return false;
+  const shift = BigInt(width - bits);
+  return a >> shift === b >> shift;
+}
+var ipInRanges = (ip, cidrs) => cidrs.some((c) => ipInCidr(ip, c));
+
+// src/server/crawlers.ts
+var RDNS_DOMAINS = {
+  Googlebot: ["googlebot.com", "google.com", "googleusercontent.com"],
+  Bingbot: ["search.msn.com"],
+  Applebot: ["applebot.apple.com"],
+  "Applebot-Extended": ["applebot.apple.com"],
+  YandexBot: ["yandex.ru", "yandex.net", "yandex.com"],
+  Baiduspider: ["baidu.com", "baidu.jp"],
+  Amazonbot: ["crawl.amazonbot.amazon"]
+};
+function classifyUserAgent(ua, signatures = CRAWLER_SIGNATURES) {
+  if (!ua) return null;
+  const hit = signatures.find((s) => s.pattern.test(ua));
+  return hit ? { name: hit.name, category: hit.category } : null;
+}
+function clientIp(request, source = "auto") {
+  if (typeof source === "function") return source(request);
+  const h = request.headers;
+  if (source === "cloudflare") return h.get("cf-connecting-ip");
+  if (source === "vercel") return h.get("x-real-ip") ?? h.get("x-vercel-forwarded-for");
+  return h.get("cf-connecting-ip") ?? h.get("x-real-ip") ?? h.get("x-vercel-forwarded-for");
+}
+async function nodeResolver() {
+  try {
+    const dns = await import(
+      /* webpackIgnore: true */
+      /* @vite-ignore */
+      'dns/promises'
+    );
+    return {
+      reverse: (ip) => dns.reverse(ip),
+      lookup: async (host) => (await dns.lookup(host, { all: true })).map((a) => a.address)
+    };
+  } catch {
+    return null;
+  }
+}
+var rdnsCache = /* @__PURE__ */ new Map();
+async function verifyCrawler(claim, ip, resolver, ranges = {}) {
+  const domains = RDNS_DOMAINS[claim.name];
+  const cidrs = await rangesFor(claim.name, ranges);
+  if (!domains && !cidrs) return { status: "unverified", name: claim.name, reason: "no_verification_method_for_vendor" };
+  if (!ip) return { status: "unverified", name: claim.name, reason: "client_ip_unknown" };
+  if (cidrs?.length && ipInRanges(ip, cidrs)) {
+    return { status: "verified", name: claim.name, host: ip, ip, via: "ip-range" };
+  }
+  if (!domains) return { status: "unverified", name: claim.name, reason: "ip_outside_published_ranges" };
+  const key = `${claim.name}|${ip}`;
+  const hit = rdnsCache.get(key);
+  if (hit && hit.until > Date.now()) {
+    return hit.ok ? { status: "verified", name: claim.name, host: hit.host, ip, via: "rdns" } : { status: "unverified", name: claim.name, reason: "rdns_mismatch" };
+  }
+  const dns = resolver ?? await nodeResolver();
+  if (!dns) return { status: "unverified", name: claim.name, reason: "dns_unavailable_in_runtime" };
+  const remember = (ok, host) => {
+    if (rdnsCache.size > 5e3) rdnsCache.delete(rdnsCache.keys().next().value);
+    rdnsCache.set(key, { ok, ...host ? { host } : {}, until: Date.now() + (ok ? 36e5 : 6e5) });
+  };
+  try {
+    const names = await dns.reverse(ip);
+    for (const name of names) {
+      const host = name.toLowerCase().replace(/\.$/, "");
+      if (!domains.some((d) => host === d || host.endsWith(`.${d}`))) continue;
+      const forward = await dns.lookup(host);
+      if (forward.includes(ip)) {
+        remember(true, host);
+        return { status: "verified", name: claim.name, host, ip, via: "rdns" };
+      }
+    }
+    remember(false);
+    return { status: "unverified", name: claim.name, reason: "rdns_mismatch" };
+  } catch {
+    return { status: "unverified", name: claim.name, reason: "rdns_lookup_failed" };
+  }
+}
+
+// src/server/structuredFields.ts
+var SfToken = class {
+  constructor(value) {
+    this.value = value;
+  }
+  value;
+};
+var SfDecimal = class {
+  constructor(value) {
+    this.value = value;
+  }
+  value;
+};
+var isInnerList = (m) => "items" in m;
+var SfParseError = class extends Error {
+};
+var Parser = class {
+  constructor(s) {
+    this.s = s;
+  }
+  s;
+  i = 0;
+  get done() {
+    return this.i >= this.s.length;
+  }
+  peek() {
+    return this.s[this.i] ?? "";
+  }
+  fail(what) {
+    throw new SfParseError(`${what} at ${this.i}`);
+  }
+  sp() {
+    while (this.peek() === " ") this.i++;
+  }
+  ows() {
+    while (this.peek() === " " || this.peek() === "	") this.i++;
+  }
+  key() {
+    const c = this.peek();
+    if (!/[a-z*]/.test(c)) this.fail("invalid key");
+    let out = "";
+    while (/[a-z0-9_\-.*]/.test(this.peek())) out += this.s[this.i++];
+    return out;
+  }
+  params() {
+    const out = [];
+    while (this.peek() === ";") {
+      this.i++;
+      this.sp();
+      const k = this.key();
+      let v = true;
+      if (this.peek() === "=") {
+        this.i++;
+        v = this.bareItem();
+      }
+      const existing = out.findIndex(([ek]) => ek === k);
+      if (existing >= 0) out[existing] = [k, v];
+      else out.push([k, v]);
+    }
+    return out;
+  }
+  bareItem() {
+    const c = this.peek();
+    if (c === "-" || /[0-9]/.test(c)) return this.number();
+    if (c === '"') return this.string();
+    if (c === ":") return this.bytes();
+    if (c === "?") return this.boolean();
+    if (/[A-Za-z*]/.test(c)) return this.token();
+    return this.fail("invalid bare item");
+  }
+  number() {
+    let sign = 1;
+    if (this.peek() === "-") {
+      sign = -1;
+      this.i++;
+    }
+    let num = "";
+    let isDecimal = false;
+    while (!this.done) {
+      const c = this.peek();
+      if (/[0-9]/.test(c)) num += c;
+      else if (c === "." && !isDecimal) {
+        if (num.length > 12) this.fail("decimal integer part too long");
+        isDecimal = true;
+        num += c;
+      } else break;
+      this.i++;
+      if (!isDecimal && num.length > 15) this.fail("integer too long");
+      if (isDecimal && num.length > 16) this.fail("decimal too long");
+    }
+    if (!/[0-9]/.test(num[0] ?? "")) this.fail("invalid number");
+    if (isDecimal) {
+      if (num.endsWith(".")) this.fail("decimal ends with dot");
+      if (num.split(".")[1].length > 3) this.fail("decimal fraction too long");
+      return new SfDecimal(sign * Number(num));
+    }
+    return sign * Number(num);
+  }
+  string() {
+    this.i++;
+    let out = "";
+    while (!this.done) {
+      const c = this.s[this.i++];
+      if (c === "\\") {
+        const n = this.s[this.i++];
+        if (n !== '"' && n !== "\\") this.fail("invalid escape");
+        out += n;
+      } else if (c === '"') return out;
+      else {
+        const code = c.charCodeAt(0);
+        if (code < 32 || code > 126) this.fail("invalid string char");
+        out += c;
+      }
+    }
+    return this.fail("unterminated string");
+  }
+  token() {
+    let out = "";
+    while (/[A-Za-z0-9!#$%&'*+\-.^_`|~:/]/.test(this.peek()) && !this.done) out += this.s[this.i++];
+    return new SfToken(out);
+  }
+  bytes() {
+    this.i++;
+    const end = this.s.indexOf(":", this.i);
+    if (end < 0) this.fail("unterminated byte sequence");
+    const b64 = this.s.slice(this.i, end);
+    if (!/^[A-Za-z0-9+/=]*$/.test(b64)) this.fail("invalid base64");
+    this.i = end + 1;
+    return base64ToBytes(b64);
+  }
+  boolean() {
+    this.i++;
+    const c = this.s[this.i++];
+    if (c === "1") return true;
+    if (c === "0") return false;
+    return this.fail("invalid boolean");
+  }
+  item() {
+    const value = this.bareItem();
+    return { value, params: this.params() };
+  }
+  innerList() {
+    this.i++;
+    const items = [];
+    while (!this.done) {
+      this.sp();
+      if (this.peek() === ")") {
+        this.i++;
+        return { items, params: this.params() };
+      }
+      items.push(this.item());
+      const c = this.peek();
+      if (c !== " " && c !== ")") this.fail("invalid inner list");
+    }
+    return this.fail("unterminated inner list");
+  }
+  member() {
+    return this.peek() === "(" ? this.innerList() : this.item();
+  }
+  dictionary() {
+    const out = /* @__PURE__ */ new Map();
+    this.sp();
+    while (!this.done) {
+      const k = this.key();
+      let m;
+      if (this.peek() === "=") {
+        this.i++;
+        m = this.member();
+      } else {
+        m = { value: true, params: this.params() };
+      }
+      out.set(k, m);
+      this.ows();
+      if (this.done) return out;
+      if (this.peek() !== ",") this.fail("expected comma");
+      this.i++;
+      this.ows();
+      if (this.done) this.fail("trailing comma");
+    }
+    return out;
+  }
+};
+function parseTop(input, fn) {
+  const p = new Parser(input.trim());
+  const out = fn(p);
+  p.sp();
+  if (!p.done) p.fail("trailing characters");
+  return out;
+}
+var parseDictionary = (input) => parseTop(input, (p) => p.dictionary());
+var parseItem = (input) => parseTop(input, (p) => p.item());
+function serializeBareItem(v) {
+  if (typeof v === "boolean") return v ? "?1" : "?0";
+  if (typeof v === "number") {
+    if (!Number.isInteger(v)) throw new SfParseError("non-integer number; use SfDecimal");
+    return String(v);
+  }
+  if (v instanceof SfDecimal) {
+    const s = (Math.round(v.value * 1e3) / 1e3).toString();
+    return s.includes(".") ? s : `${s}.0`;
+  }
+  if (v instanceof SfToken) return v.value;
+  if (v instanceof Uint8Array) return `:${bytesToBase64(v)}:`;
+  return `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+var serializeParams = (params) => params.map(([k, v]) => v === true ? `;${k}` : `;${k}=${serializeBareItem(v)}`).join("");
+var serializeItem = (item) => serializeBareItem(item.value) + serializeParams(item.params);
+var serializeInnerList = (list) => `(${list.items.map(serializeItem).join(" ")})${serializeParams(list.params)}`;
+var serializeMember = (m) => isInnerList(m) ? serializeInnerList(m) : serializeItem(m);
+var getParam = (params, key) => params.find(([k]) => k === key)?.[1];
+function base64ToBytes(b64) {
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+var bytesToBase64Url = (bytes) => bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+
+// src/server/oauth.ts
+var josePromise;
+var loadJose = () => josePromise ??= import('jose');
+var remoteSets = /* @__PURE__ */ new Map();
+var ASYMMETRIC = ["RS256", "PS256", "ES256", "EdDSA"];
+function unverifiedIssuer(token) {
+  try {
+    const payload = token.split(".")[1];
+    const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+    const iss = JSON.parse(json).iss;
+    return typeof iss === "string" ? iss : null;
+  } catch {
+    return null;
+  }
+}
+var str = (v) => typeof v === "string" && v ? v : void 0;
+async function sha256B64u(text) {
+  const d = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return bytesToBase64Url(new Uint8Array(d));
+}
+var htuOf = (url) => {
+  const u = new URL(url);
+  return `${u.origin}${u.pathname}`;
+};
+async function verifyDpopProof(jose, proof, token, jkt, request, replay) {
+  try {
+    const { payload, protectedHeader } = await jose.jwtVerify(proof, jose.EmbeddedJWK, {
+      typ: "dpop+jwt",
+      algorithms: ASYMMETRIC
+    });
+    const jwk = protectedHeader.jwk;
+    if (!jwk) return "dpop_missing_jwk";
+    if (await jose.calculateJwkThumbprint(jwk, "sha256") !== jkt) return "dpop_key_mismatch";
+    if (str(payload.htm)?.toUpperCase() !== request.method.toUpperCase()) return "dpop_htm_mismatch";
+    if (str(payload.htu) === void 0 || htuOf(str(payload.htu)) !== htuOf(request.url)) return "dpop_htu_mismatch";
+    const iat = typeof payload.iat === "number" ? payload.iat : NaN;
+    if (!Number.isFinite(iat) || Math.abs(Date.now() / 1e3 - iat) > 300) return "dpop_stale";
+    if (str(payload.ath) !== await sha256B64u(token)) return "dpop_ath_mismatch";
+    const jti = str(payload.jti);
+    if (!jti) return "dpop_missing_jti";
+    if (replay) {
+      const key = `dpop:${jkt}:${jti}`;
+      if (await replay.has(key)) return "dpop_replayed";
+      await replay.add(key, 600);
+    }
+    return null;
+  } catch (e) {
+    return `dpop_invalid:${e.code ?? e.message}`;
+  }
+}
+async function verifyOAuthToken(token, o, ctx) {
+  const jose = await loadJose();
+  const keySet = o.jwks ? jose.createLocalJWKSet(o.jwks) : (() => {
+    const uri = o.jwksUri ?? `${o.issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
+    let s = remoteSets.get(uri);
+    if (!s) {
+      s = jose.createRemoteJWKSet(new URL(uri), { cacheMaxAge: 36e5, cooldownDuration: 3e4 });
+      remoteSets.set(uri, s);
+    }
+    return s;
+  })();
+  let payload;
+  try {
+    ;
+    ({ payload } = await jose.jwtVerify(token, keySet, {
+      issuer: o.issuer,
+      audience: o.audience,
+      algorithms: o.algorithms ?? ASYMMETRIC,
+      clockTolerance: o.clockToleranceSec ?? 30
+    }));
+  } catch (e) {
+    return { error: `invalid_token:${e.code ?? e.message}` };
+  }
+  const jkt = str(payload.cnf?.jkt);
+  let dpop = false;
+  if (jkt) {
+    const proof = ctx.request.headers.get("dpop");
+    if (ctx.scheme !== "dpop" || !proof) return { error: "dpop_proof_required" };
+    const bad = await verifyDpopProof(jose, proof, token, jkt, ctx.request, ctx.replayCache);
+    if (bad) return { error: bad };
+    dpop = true;
+  } else if (o.requireDpop) {
+    return { error: "token_not_dpop_bound" };
+  }
+  if (o.requiredScopes?.length) {
+    const granted = new Set(String(payload.scope ?? payload.scp ?? "").split(/\s+/));
+    const missing = o.requiredScopes.filter((s) => !granted.has(s));
+    if (missing.length) return { error: `missing_scopes:${missing.join(",")}` };
+  }
+  const act = payload.act;
+  const clientId = str(payload.client_id) ?? str(payload.azp);
+  const sub = str(payload.sub);
+  const agentId = str(act?.client_id) ?? str(act?.sub) ?? clientId ?? sub;
+  if (!agentId) return { error: "token_has_no_client_id" };
+  const user = act ? sub : sub && clientId && sub !== clientId ? sub : void 0;
+  const agent = {
+    id: `oauth2:${agentId}`,
+    name: str(payload.agent_name) ?? str(payload.client_name) ?? agentId,
+    vendor: str(payload.agent_vendor) ?? null,
+    claims: { iss: payload.iss, sub, scope: payload.scope ?? payload.scp, ...act ? { act } : {} },
+    dpop
+  };
+  if (user) {
+    const onBehalfOf = { sub: user };
+    if (str(payload.email)) onBehalfOf.email = str(payload.email);
+    if (str(payload.name)) onBehalfOf.name = str(payload.name);
+    agent.onBehalfOf = onBehalfOf;
+  }
+  return agent;
+}
+
+// src/server/httpSignatures.ts
+var SignatureError = class extends Error {
+  constructor(code, message) {
+    super(message ?? code);
+    this.code = code;
+  }
+  code;
+};
+var DERIVED = /* @__PURE__ */ new Set([
+  "@method",
+  "@target-uri",
+  "@authority",
+  "@scheme",
+  "@request-target",
+  "@path",
+  "@query",
+  "@query-param"
+]);
+function componentValue(id, ctx) {
+  if (typeof id.value !== "string") throw new SignatureError("invalid_component", "component id must be a string");
+  const name = id.value;
+  const { url } = ctx;
+  if (name.startsWith("@")) {
+    if (!DERIVED.has(name)) throw new SignatureError("unsupported_component", name);
+    switch (name) {
+      case "@method":
+        return ctx.request.method.toUpperCase();
+      case "@target-uri":
+        return url.href;
+      case "@authority":
+        return (ctx.authority ?? url.host).toLowerCase();
+      case "@scheme":
+        return url.protocol.replace(/:$/, "").toLowerCase();
+      case "@request-target":
+        return url.pathname + url.search;
+      case "@path":
+        return url.pathname || "/";
+      case "@query":
+        return url.search || "?";
+      case "@query-param": {
+        const pname = getParam(id.params, "name");
+        if (typeof pname !== "string") throw new SignatureError("invalid_component", "@query-param needs name");
+        const values = url.searchParams.getAll(pname);
+        if (values.length !== 1) throw new SignatureError("invalid_component", `@query-param ${pname}`);
+        return encodeURIComponent(values[0]);
+      }
+    }
+  }
+  for (const [k] of id.params) {
+    if (k !== "key") throw new SignatureError("unsupported_component", `param ${k}`);
+  }
+  const raw = ctx.request.headers.get(name);
+  if (raw === null) throw new SignatureError("missing_component", name);
+  const value = raw.trim();
+  const key = getParam(id.params, "key");
+  if (typeof key === "string") {
+    let dict;
+    try {
+      dict = parseDictionary(value);
+    } catch (e) {
+      throw new SignatureError("invalid_component", `${name} is not a dictionary: ${e.message}`);
+    }
+    const member = dict.get(key);
+    if (!member) throw new SignatureError("missing_component", `${name};key=${key}`);
+    return serializeMember(member);
+  }
+  return value;
+}
+function signatureBase(input, ctx) {
+  const seen = /* @__PURE__ */ new Set();
+  const lines = [];
+  for (const id of input.items) {
+    const ident = serializeItem(id);
+    if (seen.has(ident)) throw new SignatureError("duplicate_component", ident);
+    seen.add(ident);
+    lines.push(`${ident}: ${componentValue(id, ctx)}`);
+  }
+  lines.push(`"@signature-params": ${serializeInnerList(input)}`);
+  return lines.join("\n");
+}
+var ALGS = {
+  ed25519: { kty: "OKP", crv: "Ed25519", importAlg: { name: "Ed25519" }, verifyAlg: { name: "Ed25519" } },
+  "rsa-pss-sha512": {
+    kty: "RSA",
+    importAlg: { name: "RSA-PSS", hash: "SHA-512" },
+    verifyAlg: { name: "RSA-PSS", saltLength: 64 }
+  },
+  "rsa-v1_5-sha256": {
+    kty: "RSA",
+    importAlg: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    verifyAlg: { name: "RSASSA-PKCS1-v1_5" }
+  },
+  "ecdsa-p256-sha256": {
+    kty: "EC",
+    crv: "P-256",
+    importAlg: { name: "ECDSA", namedCurve: "P-256" },
+    verifyAlg: { name: "ECDSA", hash: "SHA-256" }
+  },
+  "ecdsa-p384-sha384": {
+    kty: "EC",
+    crv: "P-384",
+    importAlg: { name: "ECDSA", namedCurve: "P-384" },
+    verifyAlg: { name: "ECDSA", hash: "SHA-384" }
+  }
+};
+function resolveAlgorithm(jwk, algParam) {
+  if (typeof algParam === "string") {
+    const spec = ALGS[algParam];
+    if (!spec) throw new SignatureError("unsupported_alg", algParam);
+    if (spec.kty !== jwk.kty || spec.crv && spec.crv !== jwk.crv) {
+      throw new SignatureError("alg_key_mismatch", `${algParam} vs ${jwk.kty}/${jwk.crv ?? ""}`);
+    }
+    return algParam;
+  }
+  if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "ed25519";
+  if (jwk.kty === "EC" && jwk.crv === "P-256") return "ecdsa-p256-sha256";
+  if (jwk.kty === "EC" && jwk.crv === "P-384") return "ecdsa-p384-sha384";
+  throw new SignatureError("alg_required", `cannot infer algorithm for ${jwk.kty}`);
+}
+async function verifySignature(alg, jwk, base, signature) {
+  const spec = ALGS[alg];
+  const { kid: _kid, alg: _alg, use: _use, nbf: _nbf, exp: _exp, ...material } = jwk;
+  let key;
+  try {
+    key = await crypto.subtle.importKey("jwk", material, spec.importAlg, false, ["verify"]);
+  } catch (e) {
+    throw new SignatureError("invalid_key", e.message);
+  }
+  return crypto.subtle.verify(spec.verifyAlg, key, new Uint8Array(signature), new TextEncoder().encode(base));
+}
+async function jwkThumbprint(jwk) {
+  let canonical;
+  if (jwk.kty === "OKP") canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x });
+  else if (jwk.kty === "EC") canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+  else if (jwk.kty === "RSA") canonical = JSON.stringify({ e: jwk.e, kty: jwk.kty, n: jwk.n });
+  else throw new SignatureError("invalid_key", `unsupported kty ${jwk.kty}`);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+  return bytesToBase64Url(new Uint8Array(digest));
+}
+
+// src/server/safeFetch.ts
+var UnsafeUrlError = class extends Error {
+};
+var BLOCKED_SUFFIXES = [".localhost", ".local", ".internal", ".home.arpa", ".lan", ".corp", ".intranet"];
+function isPrivateIpv4(ip) {
+  const m = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return false;
+  const [a, b] = [Number(m[1]), Number(m[2])];
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || // CGNAT
+  a === 169 && b === 254 || // link-local / cloud metadata
+  a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 || a === 198 && (b === 18 || b === 19) || a >= 224;
+}
+function isPrivateIpv6(ip) {
+  const s = ip.toLowerCase().replace(/^\[|\]$/g, "");
+  if (s === "::" || s === "::1") return true;
+  const mapped = s.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (mapped) return isPrivateIpv4(mapped[1]);
+  return /^(fc|fd|fe8|fe9|fea|feb|ff)/.test(s);
+}
+var isIpLiteral = (host) => /^\d+\.\d+\.\d+\.\d+$/.test(host) || host.includes(":") || host.startsWith("[");
+function assertSafeUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new UnsafeUrlError("invalid URL");
+  }
+  if (url.protocol !== "https:") throw new UnsafeUrlError("HTTPS required");
+  if (url.username || url.password) throw new UnsafeUrlError("credentials in URL");
+  if (url.port && url.port !== "443") throw new UnsafeUrlError("non-standard port");
+  const host = url.hostname.toLowerCase();
+  if (isIpLiteral(host)) throw new UnsafeUrlError("IP-literal hosts are not allowed");
+  if (host === "localhost" || !host.includes(".") || BLOCKED_SUFFIXES.some((s) => host.endsWith(s))) {
+    throw new UnsafeUrlError("internal hostname");
+  }
+  return url;
+}
+async function assertPublicDns(host) {
+  let dns;
+  try {
+    dns = await import(
+      /* webpackIgnore: true */
+      /* @vite-ignore */
+      'dns/promises'
+    );
+  } catch {
+    return;
+  }
+  const addrs = await dns.lookup(host, { all: true }).catch(() => {
+    throw new UnsafeUrlError("DNS lookup failed");
+  });
+  for (const { address, family } of addrs) {
+    if (family === 4 ? isPrivateIpv4(address) : isPrivateIpv6(address)) {
+      throw new UnsafeUrlError("host resolves to a private address");
+    }
+  }
+}
+async function safeFetch(raw, opts = {}) {
+  const url = assertSafeUrl(raw);
+  if (opts.resolveDns) await assertPublicDns(url.hostname);
+  const doFetch = opts.fetch ?? fetch;
+  const res = await doFetch(url.href, {
+    method: "GET",
+    redirect: "manual",
+    headers: { accept: opts.accept ?? "application/json" },
+    signal: AbortSignal.timeout(opts.timeoutMs ?? 3e3)
+  });
+  const maxBytes = opts.maxBytes ?? 64 * 1024;
+  const declared = Number(res.headers.get("content-length") ?? 0);
+  if (declared > maxBytes) throw new UnsafeUrlError("response too large");
+  const reader = res.body?.getReader();
+  const chunks = [];
+  let total = 0;
+  if (reader) {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        throw new UnsafeUrlError("response too large");
+      }
+      chunks.push(value);
+    }
+  }
+  const body = new Uint8Array(total);
+  let o = 0;
+  for (const c of chunks) {
+    body.set(c, o);
+    o += c.byteLength;
+  }
+  return { status: res.status, headers: res.headers, body: new TextDecoder().decode(body) };
+}
+
+// src/server/webBotAuth.ts
+var WEB_BOT_AUTH_TAG = "web-bot-auth";
+var DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
+var DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
+function memoryReplayCache(maxEntries = 1e4) {
+  const m = /* @__PURE__ */ new Map();
+  return {
+    has(key) {
+      const exp = m.get(key);
+      if (exp === void 0) return false;
+      if (exp < Date.now()) {
+        m.delete(key);
+        return false;
+      }
+      return true;
+    },
+    add(key, ttl) {
+      if (m.size >= maxEntries) m.delete(m.keys().next().value);
+      m.set(key, Date.now() + ttl * 1e3);
+    }
+  };
+}
+var directoryCache = /* @__PURE__ */ new Map();
+var MAX_CACHED = 256;
+var NEGATIVE_TTL = 5 * 60 * 1e3;
+function cacheTtlMs(headers) {
+  const cc = headers.get("cache-control") ?? "";
+  const m = cc.match(/max-age=(\d+)/i);
+  const secs = m ? Number(m[1]) : 3600;
+  return Math.min(Math.max(secs, 60), 86400) * 1e3;
+}
+async function loadDirectory(url, opts) {
+  const cached = directoryCache.get(url);
+  if (cached && "failedUntil" in cached && cached.failedUntil > Date.now()) {
+    throw new SignatureError("discovery_failed", "recent discovery failure (cached)");
+  }
+  if (cached && "keys" in cached && cached.until > Date.now()) return cached;
+  try {
+    const res = await safeFetch(url, {
+      ...opts.fetch ? { fetch: opts.fetch } : {},
+      accept: `${DIRECTORY_MEDIA_TYPE}, application/jwk-set+json, application/json`,
+      resolveDns: opts.resolveDns ?? true
+    });
+    if (res.status !== 200) throw new SignatureError("discovery_failed", `directory returned ${res.status}`);
+    let doc;
+    try {
+      doc = JSON.parse(res.body);
+    } catch {
+      throw new SignatureError("discovery_failed", "directory is not JSON");
+    }
+    const raw = doc.keys;
+    if (!Array.isArray(raw)) throw new SignatureError("discovery_failed", "directory has no keys array");
+    const now = opts.now?.() ?? Date.now() / 1e3;
+    const keys = raw.filter(
+      (k) => typeof k === "object" && k !== null && typeof k.kty === "string" && (k.nbf === void 0 || k.nbf <= now) && (k.exp === void 0 || k.exp > now)
+    );
+    const thumbprints = await Promise.all(keys.map((k) => jwkThumbprint(k).catch(() => "")));
+    const entry = { keys, thumbprints, until: Date.now() + cacheTtlMs(res.headers) };
+    if (directoryCache.size >= MAX_CACHED) directoryCache.delete(directoryCache.keys().next().value);
+    directoryCache.set(url, entry);
+    return entry;
+  } catch (e) {
+    directoryCache.set(url, { failedUntil: Date.now() + NEGATIVE_TTL });
+    if (e instanceof SignatureError) throw e;
+    throw new SignatureError("discovery_failed", e.message);
+  }
+}
+function directoryUrlFor(member) {
+  if (typeof member.value !== "string") throw new SignatureError("invalid_signature_agent", "must be a string");
+  let url;
+  try {
+    url = new URL(member.value);
+  } catch {
+    throw new SignatureError("invalid_signature_agent", "not a URL");
+  }
+  if (url.protocol !== "https:") throw new SignatureError("invalid_signature_agent", "HTTPS required");
+  const typeParam = getParam(member.params, "type");
+  const type = typeParam instanceof SfToken ? typeParam.value : typeof typeParam === "string" ? typeParam : "directory";
+  if (type === "directory") return { signer: url.origin, directoryUrl: url.origin + DIRECTORY_PATH };
+  if (type === "jwks_uri") return { signer: url.href, directoryUrl: url.href };
+  throw new SignatureError("unsupported_signature_agent_type", type);
+}
+function isAllowed(signer, allowed) {
+  if (!allowed || allowed === "any") return true;
+  return allowed.some((a) => {
+    try {
+      const u = new URL(a);
+      return u.origin === signer || u.href === signer || new URL(signer).origin === u.origin;
+    } catch {
+      return false;
+    }
+  });
+}
+async function verifyWebBotAuth(request, opts = {}) {
+  const sigHeader = request.headers.get("signature");
+  const inputHeader = request.headers.get("signature-input");
+  if (!sigHeader && !inputHeader) return { status: "absent" };
+  if (!sigHeader || !inputHeader) return { status: "invalid", reason: "signature_headers_incomplete" };
+  let inputs, sigs;
+  try {
+    inputs = parseDictionary(inputHeader);
+    sigs = parseDictionary(sigHeader);
+  } catch (e) {
+    return { status: "invalid", reason: `malformed_signature_headers: ${e.message}` };
+  }
+  const candidates = [...inputs.entries()].filter(
+    ([, m]) => isInnerList(m) && getParam(m.params, "tag") === WEB_BOT_AUTH_TAG
+  );
+  if (candidates.length === 0) return { status: "absent" };
+  let lastFailure = { status: "invalid", reason: "no_valid_signature" };
+  for (const [label, input] of candidates) {
+    const r = await verifyOne(request, label, input, sigs.get(label), opts);
+    if (r.status === "verified") return r;
+    lastFailure = r;
+  }
+  return lastFailure;
+}
+async function verifyOne(request, label, input, sigMember, opts) {
+  const fail = (reason, extra = {}) => ({
+    status: "invalid",
+    reason,
+    ...extra
+  });
+  if (!sigMember || isInnerList(sigMember) || !(sigMember.value instanceof Uint8Array)) {
+    return fail("signature_missing_for_label");
+  }
+  const signature = sigMember.value;
+  const created = getParam(input.params, "created");
+  const expires = getParam(input.params, "expires");
+  const keyid = getParam(input.params, "keyid");
+  const nonce = getParam(input.params, "nonce");
+  if (typeof created !== "number" || typeof expires !== "number") return fail("created_and_expires_required");
+  if (typeof keyid !== "string") return fail("keyid_required");
+  if (nonce !== void 0 && typeof nonce !== "string") return fail("invalid_nonce");
+  if (opts.requireNonce && nonce === void 0) return fail("nonce_required", { keyid });
+  const now = Math.floor(opts.now?.() ?? Date.now() / 1e3);
+  const skew = opts.clockSkewSec ?? 60;
+  if (created > now + skew) return fail("created_in_future", { keyid });
+  if (expires < now - skew) return fail("expired", { keyid });
+  if (expires <= created) return fail("expires_before_created", { keyid });
+  if (expires - created > (opts.maxValiditySec ?? 86400)) return fail("validity_window_too_long", { keyid });
+  const names = input.items.map((i) => i.value);
+  if (!names.includes("@authority") && !names.includes("@target-uri")) {
+    return fail("authority_or_target_uri_not_covered", { keyid });
+  }
+  const agentComponent = input.items.find((i) => i.value === "signature-agent");
+  if (!agentComponent) return fail("signature_agent_not_covered", { keyid });
+  const agentHeader = request.headers.get("signature-agent");
+  if (!agentHeader) return fail("signature_agent_missing", { keyid });
+  let member;
+  try {
+    const key = getParam(agentComponent.params, "key");
+    if (typeof key === "string") {
+      const m = parseDictionary(agentHeader).get(key);
+      if (!m || isInnerList(m)) return fail("signature_agent_member_missing", { keyid });
+      member = m;
+    } else {
+      member = parseItem(agentHeader);
+    }
+  } catch (e) {
+    return fail(`malformed_signature_agent: ${e.message}`, { keyid });
+  }
+  let signer, directoryUrl;
+  try {
+    ;
+    ({ signer, directoryUrl } = directoryUrlFor(member));
+  } catch (e) {
+    return fail(e.code ?? "invalid_signature_agent", { keyid });
+  }
+  if (!isAllowed(signer, opts.allowedDirectories)) return fail("signer_not_allowed", { agentUrl: signer, keyid });
+  const replayKey = nonce ? `${signer}|${keyid}|${nonce}` : void 0;
+  if (replayKey && await opts.replayCache?.has(replayKey)) return fail("replayed_nonce", { agentUrl: signer, keyid });
+  let dir;
+  try {
+    dir = await loadDirectory(directoryUrl, opts);
+  } catch (e) {
+    return fail(e.code ?? "discovery_failed", { agentUrl: signer, keyid });
+  }
+  const idx = dir.thumbprints.indexOf(keyid);
+  if (idx < 0) return fail("unknown_keyid", { agentUrl: signer, keyid });
+  const jwk = dir.keys[idx];
+  try {
+    const url = new URL(request.url);
+    const alg = resolveAlgorithm(jwk, getParam(input.params, "alg"));
+    const base = signatureBase(input, {
+      request,
+      url,
+      ...opts.authority ? { authority: opts.authority(request, url) } : {}
+    });
+    const ok = await verifySignature(alg, jwk, base, signature);
+    if (!ok) return fail("bad_signature", { agentUrl: signer, keyid });
+    if (replayKey) await opts.replayCache?.add(replayKey, Math.max(expires - now, 1) + skew);
+    return { status: "verified", agentUrl: signer, keyid, label, alg, created, expires };
+  } catch (e) {
+    return fail(e instanceof SignatureError ? e.code : "verification_error", { agentUrl: signer, keyid });
+  }
+}
+
+// src/server/agentAuth.ts
+var KNOWN_SIGNERS = {
+  "https://chatgpt.com": { name: "ChatGPT agent", vendor: "OpenAI" }
+};
+var GENERIC_AGENT_UA = /\b(bot|crawler|spider|agent|headless|scraper)\b/i;
+var JWT_SHAPE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;
+function credential(request) {
+  const h = request.headers.get("authorization");
+  const m = h?.match(/^(bearer|dpop)\s+(.+)$/i);
+  return m ? { token: m[2].trim(), scheme: m[1].toLowerCase() } : null;
+}
+function createAgentAuth(options = {}) {
+  const replayCache = options.replayCache ?? memoryReplayCache();
+  const wba = options.webBotAuth === false ? null : { replayCache, ...typeof options.webBotAuth === "object" ? options.webBotAuth : {} };
+  const issuers = options.oauth2 ? Array.isArray(options.oauth2) ? options.oauth2 : [options.oauth2] : [];
+  const crawlers = options.crawlers === false ? null : typeof options.crawlers === "object" ? options.crawlers : {};
+  const keyPrefix = options.apiKey?.prefix ?? "agk_";
+  async function authenticate(request) {
+    const attempted = [];
+    const reasons = [];
+    let claimedName;
+    if (wba) {
+      const r = await verifyWebBotAuth(request, wba);
+      if (r.status === "verified") {
+        const known = KNOWN_SIGNERS[r.agentUrl];
+        const host = new URL(r.agentUrl).hostname;
+        return {
+          status: "verified",
+          agent: {
+            id: r.agentUrl,
+            name: known?.name ?? host,
+            vendor: known?.vendor ?? null,
+            method: "web-bot-auth",
+            claims: { keyid: r.keyid, alg: r.alg }
+          }
+        };
+      }
+      if (r.status === "invalid") {
+        attempted.push("web-bot-auth");
+        reasons.push(`web-bot-auth:${r.reason}`);
+        claimedName ??= r.agentUrl ? new URL(r.agentUrl).hostname : void 0;
+      }
+    }
+    const cred = credential(request);
+    const token = cred?.token ?? request.headers.get("x-agent-key");
+    if (token && options.apiKey && token.startsWith(keyPrefix)) {
+      attempted.push("api-key");
+      const id = await options.apiKey.verify(token);
+      if (id) {
+        return {
+          status: "verified",
+          agent: {
+            id: `key:${id.agentId}`,
+            name: id.name ?? id.agentId,
+            vendor: id.vendor ?? null,
+            method: "api-key",
+            ...id.scopes ? { claims: { scopes: id.scopes } } : {}
+          }
+        };
+      }
+      reasons.push("api-key:unknown_or_revoked");
+    } else if (cred && issuers.length && JWT_SHAPE.test(cred.token)) {
+      const iss = unverifiedIssuer(cred.token);
+      const config = issuers.find((i) => i.issuer === iss);
+      if (config) {
+        attempted.push("oauth2");
+        const r = await verifyOAuthToken(cred.token, config, { request, scheme: cred.scheme, replayCache });
+        if (!("error" in r)) {
+          const agent = {
+            id: r.id,
+            name: r.name,
+            vendor: r.vendor,
+            method: "oauth2",
+            claims: { ...r.claims, dpop: r.dpop }
+          };
+          if (r.onBehalfOf) agent.onBehalfOf = r.onBehalfOf;
+          return { status: "verified", agent };
+        }
+        reasons.push(`oauth2:${r.error}`);
+      }
+    }
+    const ua = request.headers.get("user-agent");
+    const claim = classifyUserAgent(ua);
+    if (claim) {
+      claimedName ??= claim.name;
+      if (crawlers) {
+        attempted.push("verified-crawler");
+        const v = await verifyCrawler(claim, clientIp(request, crawlers.clientIp), crawlers.resolver, crawlers);
+        if (v.status === "verified") {
+          return {
+            status: "verified",
+            agent: { id: `crawler:${claim.name}`, name: claim.name, vendor: null, method: "verified-crawler", claims: { host: v.host, via: v.via } }
+          };
+        }
+        reasons.push(`crawler:${v.reason}`);
+      } else reasons.push("crawler:verification_disabled");
+    }
+    if (attempted.length || claim || ua && GENERIC_AGENT_UA.test(ua) || request.headers.has("signature-agent")) {
+      return {
+        status: "unverified",
+        reason: reasons[0] ?? "agent_claim_without_credentials",
+        ...claimedName ? { claimedName } : {},
+        attempted
+      };
+    }
+    return { status: "none" };
+  }
+  return { authenticate };
+}
+var AGENT_HEADERS = {
+  status: "x-agentronics-agent-status",
+  id: "x-agentronics-agent-id",
+  name: "x-agentronics-agent-name",
+  vendor: "x-agentronics-agent-vendor",
+  method: "x-agentronics-auth-method"
+};
+function withAgentHeaders(request, result) {
+  const h = new Headers(request.headers);
+  for (const k of [...h.keys()]) if (k.toLowerCase().startsWith("x-agentronics-")) h.delete(k);
+  h.set(AGENT_HEADERS.status, result.status);
+  if (result.status === "verified") {
+    h.set(AGENT_HEADERS.id, result.agent.id);
+    h.set(AGENT_HEADERS.name, result.agent.name);
+    h.set(AGENT_HEADERS.method, result.agent.method);
+    if (result.agent.vendor) h.set(AGENT_HEADERS.vendor, result.agent.vendor);
+  }
+  return h;
+}
+function readAgentHeaders(headers) {
+  const status = headers.get(AGENT_HEADERS.status);
+  return {
+    status: status ?? "none",
+    id: headers.get(AGENT_HEADERS.id),
+    name: headers.get(AGENT_HEADERS.name),
+    vendor: headers.get(AGENT_HEADERS.vendor),
+    method: headers.get(AGENT_HEADERS.method)
+  };
+}
+
+// src/server/middleware.ts
+function createAgentAuthHandler(options = {}) {
+  const auth = createAgentAuth(options);
+  return async function handle(request) {
+    if (options.matcher && !options.matcher(new URL(request.url))) {
+      const result2 = { status: "none" };
+      return { result: result2, headers: withAgentHeaders(request, result2) };
+    }
+    const result = await auth.authenticate(request);
+    if (result.status !== "none" && options.onResult) {
+      void Promise.resolve().then(() => options.onResult({ result, request })).catch(() => void 0);
+    }
+    return { result, headers: withAgentHeaders(request, result) };
+  };
+}
+
+// src/server/next.ts
+function agentronicsMiddleware(options = {}) {
+  const handle = createAgentAuthHandler(options);
+  return async function middleware(request) {
+    const { NextResponse } = await import('next/server');
+    try {
+      const out = await handle(request);
+      return NextResponse.next({ request: { headers: out.headers } });
+    } catch {
+      return NextResponse.next();
+    }
+  };
+}
+
+exports.agentronicsMiddleware = agentronicsMiddleware;
+exports.readAgentHeaders = readAgentHeaders;
+exports.withAgentHeaders = withAgentHeaders;
+//# sourceMappingURL=next.cjs.map
+//# sourceMappingURL=next.cjs.map