@agentstats/sdk 0.0.0-stage → 0.4.1

package/dist/server.js

@@ -0,0 +1,1638 @@
+//#region src/bots.ts
+/** Categories that count as "AI traffic". Search engines and other bots are shown separately. */
+const AI_CATEGORIES = [
+	"training",
+	"search",
+	"assistant",
+	"agent"
+];
+const isAiCategory = (c) => AI_CATEGORIES.includes(c);
+/** Products group several bots from one vendor ("ChatGPT" = GPTBot + OAI-SearchBot + ChatGPT-User + ChatGPT agent). */
+const BOT_PRODUCTS = {
+	chatgpt: {
+		name: "ChatGPT",
+		operator: "OpenAI"
+	},
+	claude: {
+		name: "Claude",
+		operator: "Anthropic"
+	},
+	perplexity: {
+		name: "Perplexity",
+		operator: "Perplexity"
+	},
+	gemini: {
+		name: "Gemini",
+		operator: "Google"
+	},
+	copilot: {
+		name: "Copilot & Bing",
+		operator: "Microsoft"
+	},
+	meta: {
+		name: "Meta AI",
+		operator: "Meta"
+	},
+	apple: {
+		name: "Apple",
+		operator: "Apple"
+	},
+	amazon: {
+		name: "Amazon",
+		operator: "Amazon"
+	},
+	mistral: {
+		name: "Mistral",
+		operator: "Mistral AI"
+	},
+	deepseek: {
+		name: "DeepSeek",
+		operator: "DeepSeek"
+	},
+	bytedance: {
+		name: "ByteDance",
+		operator: "ByteDance"
+	},
+	xai: {
+		name: "Grok",
+		operator: "xAI"
+	},
+	duckduckgo: {
+		name: "DuckDuckGo",
+		operator: "DuckDuckGo"
+	},
+	commoncrawl: {
+		name: "Common Crawl",
+		operator: "Common Crawl Foundation"
+	},
+	cohere: {
+		name: "Cohere",
+		operator: "Cohere"
+	},
+	you: {
+		name: "You.com",
+		operator: "You.com"
+	},
+	qwen: {
+		name: "Qwen",
+		operator: "Alibaba"
+	},
+	kimi: {
+		name: "Kimi",
+		operator: "Moonshot AI"
+	},
+	baidu: {
+		name: "Baidu",
+		operator: "Baidu"
+	},
+	yandex: {
+		name: "Yandex",
+		operator: "Yandex"
+	},
+	huawei: {
+		name: "Huawei",
+		operator: "Huawei"
+	},
+	ai2: {
+		name: "Ai2",
+		operator: "Allen Institute for AI"
+	},
+	brave: {
+		name: "Brave",
+		operator: "Brave"
+	},
+	kagi: {
+		name: "Kagi",
+		operator: "Kagi"
+	},
+	phind: {
+		name: "Phind",
+		operator: "Phind"
+	},
+	poe: {
+		name: "Poe",
+		operator: "Quora"
+	},
+	manus: {
+		name: "Manus",
+		operator: "Butterfly Effect"
+	},
+	coding: {
+		name: "Coding agents",
+		operator: "Various"
+	},
+	aidata: {
+		name: "AI data providers",
+		operator: "Various"
+	},
+	google: {
+		name: "Google Search",
+		operator: "Google"
+	},
+	automation: {
+		name: "Automated browsers",
+		operator: "Various"
+	},
+	seo: {
+		name: "SEO tools",
+		operator: "Various"
+	},
+	social: {
+		name: "Link previews",
+		operator: "Various"
+	},
+	monitor: {
+		name: "Uptime monitors",
+		operator: "Various"
+	},
+	tools: {
+		name: "HTTP clients & scripts",
+		operator: "Various"
+	},
+	other: {
+		name: "Other bots",
+		operator: "Unknown"
+	}
+};
+/**
+* Order matters: the first matching pattern wins, so specific tokens come
+* before the vendor's generic ones and the catch-all patterns come last.
+*/
+const BOT_PATTERNS = [
+	{
+		id: "chatgpt-agent",
+		name: "ChatGPT agent",
+		product: "chatgpt",
+		category: "agent",
+		pattern: /ChatGPT[- ]Agent/i
+	},
+	{
+		id: "chatgpt-user",
+		name: "ChatGPT-User",
+		product: "chatgpt",
+		category: "assistant",
+		pattern: /ChatGPT-User/i
+	},
+	{
+		id: "oai-searchbot",
+		name: "OAI-SearchBot",
+		product: "chatgpt",
+		category: "search",
+		pattern: /OAI-SearchBot/i
+	},
+	{
+		id: "gptbot",
+		name: "GPTBot",
+		product: "chatgpt",
+		category: "training",
+		pattern: /GPTBot/i
+	},
+	{
+		id: "oai-adsbot",
+		name: "OAI-AdsBot",
+		product: "chatgpt",
+		category: "other",
+		pattern: /OAI-AdsBot/i
+	},
+	{
+		id: "claude-code",
+		name: "Claude Code",
+		product: "claude",
+		category: "assistant",
+		pattern: /claude-code/i
+	},
+	{
+		id: "claude-user",
+		name: "Claude-User",
+		product: "claude",
+		category: "assistant",
+		pattern: /Claude-User/i
+	},
+	{
+		id: "claude-searchbot",
+		name: "Claude-SearchBot",
+		product: "claude",
+		category: "search",
+		pattern: /Claude-SearchBot/i
+	},
+	{
+		id: "claudebot",
+		name: "ClaudeBot",
+		product: "claude",
+		category: "training",
+		pattern: /ClaudeBot|Claude-Web|anthropic-ai/i
+	},
+	{
+		id: "perplexity-user",
+		name: "Perplexity-User",
+		product: "perplexity",
+		category: "assistant",
+		pattern: /Perplexity-User/i
+	},
+	{
+		id: "perplexitybot",
+		name: "PerplexityBot",
+		product: "perplexity",
+		category: "search",
+		pattern: /PerplexityBot/i
+	},
+	{
+		id: "google-agent",
+		name: "Google-Agent",
+		product: "gemini",
+		category: "agent",
+		pattern: /Google-Agent\b/i
+	},
+	{
+		id: "googleagent-mariner",
+		name: "Project Mariner",
+		product: "gemini",
+		category: "agent",
+		pattern: /GoogleAgent-Mariner/i
+	},
+	{
+		id: "googleagent-urlcontext",
+		name: "Gemini URL context",
+		product: "gemini",
+		category: "assistant",
+		pattern: /GoogleAgent-URLContext/i
+	},
+	{
+		id: "gemini-deep-research",
+		name: "Gemini Deep Research",
+		product: "gemini",
+		category: "assistant",
+		pattern: /Gemini-Deep-Research/i
+	},
+	{
+		id: "google-gemininotebook",
+		name: "Gemini Notebook",
+		product: "gemini",
+		category: "assistant",
+		pattern: /Google-GeminiNotebook|Google-NotebookLM|NotebookLM/i
+	},
+	{
+		id: "gemini-cli",
+		name: "Gemini CLI",
+		product: "gemini",
+		category: "assistant",
+		pattern: /Gemini-?CLI/i
+	},
+	{
+		id: "google-cloudvertexbot",
+		name: "Google-CloudVertexBot",
+		product: "gemini",
+		category: "search",
+		pattern: /Google-CloudVertexBot/i
+	},
+	{
+		id: "google-read-aloud",
+		name: "Google Read Aloud",
+		product: "google",
+		category: "other",
+		pattern: /Google-Read-Aloud/i
+	},
+	{
+		id: "google-ads",
+		name: "Google Ads crawlers",
+		product: "google",
+		category: "other",
+		pattern: /AdsBot-Google|Mediapartners-Google|APIs-Google/i
+	},
+	{
+		id: "googleother",
+		name: "GoogleOther",
+		product: "google",
+		category: "other",
+		pattern: /GoogleOther|Google-InspectionTool|Storebot-Google/i
+	},
+	{
+		id: "googlebot",
+		name: "Googlebot",
+		product: "google",
+		category: "search_engine",
+		pattern: /Googlebot/i
+	},
+	{
+		id: "azureai-searchbot",
+		name: "AzureAI-SearchBot",
+		product: "copilot",
+		category: "search",
+		pattern: /AzureAI-SearchBot/i
+	},
+	{
+		id: "bingbot",
+		name: "Bingbot",
+		product: "copilot",
+		category: "search_engine",
+		pattern: /bingbot|BingPreview|msnbot/i
+	},
+	{
+		id: "meta-externalfetcher",
+		name: "Meta-ExternalFetcher",
+		product: "meta",
+		category: "assistant",
+		pattern: /meta-externalfetcher/i
+	},
+	{
+		id: "meta-webindexer",
+		name: "Meta-WebIndexer",
+		product: "meta",
+		category: "search",
+		pattern: /meta-webindexer/i
+	},
+	{
+		id: "meta-externalagent",
+		name: "Meta-ExternalAgent",
+		product: "meta",
+		category: "training",
+		pattern: /meta-externalagent|FacebookBot/i
+	},
+	{
+		id: "facebookexternalhit",
+		name: "Facebook link preview",
+		product: "meta",
+		category: "other",
+		pattern: /facebookexternalhit|facebookcatalog/i
+	},
+	{
+		id: "applebot",
+		name: "Applebot",
+		product: "apple",
+		category: "search_engine",
+		pattern: /Applebot/i
+	},
+	{
+		id: "amazonbuyforme",
+		name: "Amazon Buy for Me",
+		product: "amazon",
+		category: "agent",
+		pattern: /AmazonBuyForMe/i
+	},
+	{
+		id: "novaact",
+		name: "Nova Act",
+		product: "amazon",
+		category: "agent",
+		pattern: /NovaAct/i
+	},
+	{
+		id: "amzn-user",
+		name: "Amzn-User",
+		product: "amazon",
+		category: "assistant",
+		pattern: /Amzn-User/i
+	},
+	{
+		id: "amzn-searchbot",
+		name: "Amzn-SearchBot",
+		product: "amazon",
+		category: "search",
+		pattern: /Amzn-SearchBot|amazon-kendra/i
+	},
+	{
+		id: "bedrockbot",
+		name: "BedrockBot",
+		product: "amazon",
+		category: "training",
+		pattern: /bedrockbot/i
+	},
+	{
+		id: "amazonbot",
+		name: "Amazonbot",
+		product: "amazon",
+		category: "search",
+		pattern: /Amazonbot/i
+	},
+	{
+		id: "mistralai-user",
+		name: "MistralAI-User",
+		product: "mistral",
+		category: "assistant",
+		pattern: /MistralAI-User/i
+	},
+	{
+		id: "mistralai-index",
+		name: "MistralAI-Index",
+		product: "mistral",
+		category: "search",
+		pattern: /MistralAI-Index/i
+	},
+	{
+		id: "mistralai-training",
+		name: "MistralAI-Training",
+		product: "mistral",
+		category: "training",
+		pattern: /MistralAI-Training/i
+	},
+	{
+		id: "deepseekbot",
+		name: "DeepSeekBot",
+		product: "deepseek",
+		category: "training",
+		pattern: /DeepSeekBot/i
+	},
+	{
+		id: "doubaobot",
+		name: "DoubaoBot",
+		product: "bytedance",
+		category: "search",
+		pattern: /DoubaoBot/i
+	},
+	{
+		id: "bytespider",
+		name: "Bytespider",
+		product: "bytedance",
+		category: "training",
+		pattern: /Bytespider|TikTokSpider/i
+	},
+	{
+		id: "duckassistbot",
+		name: "DuckAssistBot",
+		product: "duckduckgo",
+		category: "assistant",
+		pattern: /DuckAssistBot/i
+	},
+	{
+		id: "duckduckbot",
+		name: "DuckDuckBot",
+		product: "duckduckgo",
+		category: "search_engine",
+		pattern: /DuckDuckBot/i
+	},
+	{
+		id: "ccbot",
+		name: "CCBot",
+		product: "commoncrawl",
+		category: "training",
+		pattern: /CCBot/i
+	},
+	{
+		id: "cohere-training",
+		name: "Cohere training crawler",
+		product: "cohere",
+		category: "training",
+		pattern: /cohere-training-data-crawler/i
+	},
+	{
+		id: "cohere-ai",
+		name: "cohere-ai",
+		product: "cohere",
+		category: "assistant",
+		pattern: /cohere-ai/i
+	},
+	{
+		id: "youbot",
+		name: "YouBot",
+		product: "you",
+		category: "search",
+		pattern: /YouBot/i
+	},
+	{
+		id: "tongyibot",
+		name: "TongyiBot",
+		product: "qwen",
+		category: "assistant",
+		pattern: /TongyiBot/i
+	},
+	{
+		id: "qwenbot",
+		name: "QwenBot",
+		product: "qwen",
+		category: "training",
+		pattern: /QwenBot/i
+	},
+	{
+		id: "kimi-user",
+		name: "Kimi-User",
+		product: "kimi",
+		category: "assistant",
+		pattern: /Kimi-User/i
+	},
+	{
+		id: "kimi-searchbot",
+		name: "Kimi-SearchBot",
+		product: "kimi",
+		category: "search",
+		pattern: /Kimi-SearchBot/i
+	},
+	{
+		id: "kimibot",
+		name: "KimiBot",
+		product: "kimi",
+		category: "training",
+		pattern: /KimiBot/i
+	},
+	{
+		id: "yiyanbot",
+		name: "YiyanBot",
+		product: "baidu",
+		category: "assistant",
+		pattern: /YiyanBot/i
+	},
+	{
+		id: "erniebot",
+		name: "ERNIEBot",
+		product: "baidu",
+		category: "training",
+		pattern: /ERNIEBot/i
+	},
+	{
+		id: "baiduspider",
+		name: "Baiduspider",
+		product: "baidu",
+		category: "search_engine",
+		pattern: /Baiduspider/i
+	},
+	{
+		id: "yandexadditional",
+		name: "YandexAdditional",
+		product: "yandex",
+		category: "training",
+		pattern: /YandexAdditional/i
+	},
+	{
+		id: "yandexbot",
+		name: "YandexBot",
+		product: "yandex",
+		category: "search_engine",
+		pattern: /YandexBot|YandexMobileBot/i
+	},
+	{
+		id: "pangubot",
+		name: "PanguBot",
+		product: "huawei",
+		category: "training",
+		pattern: /PanguBot/i
+	},
+	{
+		id: "petalbot",
+		name: "PetalBot",
+		product: "huawei",
+		category: "search_engine",
+		pattern: /PetalBot/i
+	},
+	{
+		id: "ai2bot",
+		name: "AI2Bot",
+		product: "ai2",
+		category: "training",
+		pattern: /AI2Bot|Ai2Bot-Dolma/i
+	},
+	{
+		id: "bravebot",
+		name: "Bravebot",
+		product: "brave",
+		category: "search",
+		pattern: /Bravebot/i
+	},
+	{
+		id: "kagi-fetcher",
+		name: "Kagi fetcher",
+		product: "kagi",
+		category: "assistant",
+		pattern: /kagi-fetcher/i
+	},
+	{
+		id: "phindbot",
+		name: "PhindBot",
+		product: "phind",
+		category: "assistant",
+		pattern: /PhindBot/i
+	},
+	{
+		id: "manus-user",
+		name: "Manus",
+		product: "manus",
+		category: "agent",
+		pattern: /Manus-User/i
+	},
+	{
+		id: "cursor",
+		name: "Cursor",
+		product: "coding",
+		category: "assistant",
+		pattern: /\bCursor\//i
+	},
+	{
+		id: "devin",
+		name: "Devin",
+		product: "coding",
+		category: "agent",
+		pattern: /\bDevin\b/i
+	},
+	{
+		id: "opencode",
+		name: "opencode",
+		product: "coding",
+		category: "assistant",
+		pattern: /\bopencode\b/i
+	},
+	{
+		id: "firecrawl",
+		name: "Firecrawl",
+		product: "aidata",
+		category: "assistant",
+		pattern: /FirecrawlAgent|Firecrawl/i
+	},
+	{
+		id: "exabot",
+		name: "Exa",
+		product: "aidata",
+		category: "search",
+		pattern: /ExaBot|ExaSearchBot/i
+	},
+	{
+		id: "tavilybot",
+		name: "Tavily",
+		product: "aidata",
+		category: "search",
+		pattern: /TavilyBot/i
+	},
+	{
+		id: "linkupbot",
+		name: "Linkup",
+		product: "aidata",
+		category: "search",
+		pattern: /LinkupBot/i
+	},
+	{
+		id: "shapbot",
+		name: "Parallel (ShapBot)",
+		product: "aidata",
+		category: "search",
+		pattern: /ShapBot|Shap-User/i
+	},
+	{
+		id: "jina",
+		name: "Jina Reader",
+		product: "aidata",
+		category: "assistant",
+		pattern: /Jina-?Reader|\bJina\b/i
+	},
+	{
+		id: "diffbot",
+		name: "Diffbot",
+		product: "aidata",
+		category: "training",
+		pattern: /Diffbot/i
+	},
+	{
+		id: "brightbot",
+		name: "Bright Data",
+		product: "aidata",
+		category: "training",
+		pattern: /Brightbot/i
+	},
+	{
+		id: "apifybot",
+		name: "Apify",
+		product: "aidata",
+		category: "training",
+		pattern: /ApifyBot|ApifyWebsiteContentCrawler/i
+	},
+	{
+		id: "crawl4ai",
+		name: "Crawl4AI",
+		product: "aidata",
+		category: "training",
+		pattern: /Crawl4AI/i
+	},
+	{
+		id: "webzio",
+		name: "Webz.io",
+		product: "aidata",
+		category: "training",
+		pattern: /omgili|Webzio-Extended/i
+	},
+	{
+		id: "timpibot",
+		name: "Timpibot",
+		product: "aidata",
+		category: "training",
+		pattern: /Timpibot/i
+	},
+	{
+		id: "imagesiftbot",
+		name: "ImagesiftBot",
+		product: "aidata",
+		category: "training",
+		pattern: /ImagesiftBot|img2dataset|LAIONDownloader/i
+	},
+	{
+		id: "signed-agent",
+		name: "Signed agent",
+		product: "automation",
+		category: "agent",
+		pattern: null
+	},
+	{
+		id: "headless",
+		name: "Headless browser",
+		product: "automation",
+		category: "other",
+		pattern: /HeadlessChrome|PhantomJS|Puppeteer|Playwright|Selenium|Lightpanda|webdriver/i
+	},
+	{
+		id: "seo",
+		name: "SEO crawler",
+		product: "seo",
+		category: "other",
+		pattern: /AhrefsBot|AhrefsSiteAudit|SemrushBot|SiteAuditBot|MJ12bot|DotBot|rogerbot|Screaming Frog|DataForSeoBot|BLEXBot|serpstatbot|SEOkicks|barkrowler/i
+	},
+	{
+		id: "link-preview",
+		name: "Link preview",
+		product: "social",
+		category: "other",
+		pattern: /Twitterbot|LinkedInBot|Slackbot|Slack-ImgProxy|Discordbot|WhatsApp|TelegramBot|Pinterestbot|redditbot|Embedly|Iframely|SkypeUriPreview|vkShare|Mastodon/i
+	},
+	{
+		id: "monitor",
+		name: "Uptime monitor",
+		product: "monitor",
+		category: "other",
+		pattern: /UptimeRobot|Pingdom|StatusCake|Better ?Uptime|BetterStack|Checkly|Site24x7|NewRelicPinger|Datadog|UptimeKuma|Uptime-Kuma|Hetrix/i
+	},
+	{
+		id: "search-other",
+		name: "Other search engine",
+		product: "other",
+		category: "search_engine",
+		pattern: /Slurp|SeznamBot|Qwantbot|Qwantify|MojeekBot|Ecosia|coccocbot|Sogou|NaverBot|Yeti\//i
+	},
+	{
+		id: "http-client",
+		name: "HTTP client / script",
+		product: "tools",
+		category: "other",
+		pattern: /^curl\/|\bWget\b|python-requests|python-urllib|Python\/\d|aiohttp|python-httpx|Go-http-client|okhttp|axios\/|node-fetch|undici|^node$|Java\/\d|Apache-HttpClient|libwww-perl|^Ruby|Faraday|Scrapy|^Deno\/|^Bun\/|GuzzleHttp|^PostmanRuntime|HTTPie/i
+	},
+	{
+		id: "other-bot",
+		name: "Other bot",
+		product: "other",
+		category: "other",
+		pattern: /bot\b|bot\/|robot|crawl|spider|scrape|scraping|fetcher|preview|archiver|indexer/i
+	},
+	{
+		id: "no-ua",
+		name: "No user agent",
+		product: "other",
+		category: "other",
+		pattern: null
+	}
+];
+const BY_ID = new Map(BOT_PATTERNS.map((b) => [b.id, b]));
+/** Real browsers whose UA happens to contain a bot-ish word. */
+const HUMAN_LOOKALIKES = /cubot|\bbotswana\b/i;
+/** Identify a bot from its User-Agent. Returns null for (what looks like) a normal browser. */
+function classifyUserAgent(ua) {
+	const s = (ua ?? "").trim();
+	if (!s) return BY_ID.get("no-ua");
+	for (const b of BOT_PATTERNS) {
+		if (!b.pattern || !b.pattern.test(s)) continue;
+		if ((b.id === "other-bot" || b.id === "link-preview") && HUMAN_LOOKALIKES.test(s)) continue;
+		return b;
+	}
+	return null;
+}
+/** Hostnames of AI assistants that send people to websites, and the `utm_source` values they add. */
+const AI_REFERRERS = [
+	{
+		product: "chatgpt",
+		hosts: /(^|\.)(chatgpt\.com|chat\.openai\.com)$/,
+		utm: /^(chatgpt(\.com)?|openai)$/
+	},
+	{
+		product: "perplexity",
+		hosts: /(^|\.)perplexity\.ai$/,
+		utm: /^perplexity(\.ai)?$/
+	},
+	{
+		product: "claude",
+		hosts: /(^|\.)claude\.ai$/,
+		utm: /^claude(\.ai)?$/
+	},
+	{
+		product: "gemini",
+		hosts: /^(gemini|bard)\.google\.com$/,
+		utm: /^(gemini|bard)$/
+	},
+	{
+		product: "copilot",
+		hosts: /^copilot\.microsoft\.com$|(^|\.)copilot\.cloud\.microsoft$|^copilot\.com$/,
+		utm: /^copilot(\.com)?$/
+	},
+	{
+		product: "meta",
+		hosts: /(^|\.)meta\.ai$/,
+		utm: /^meta\.?ai$/
+	},
+	{
+		product: "deepseek",
+		hosts: /(^|\.)deepseek\.com$/,
+		utm: /^deepseek$/
+	},
+	{
+		product: "xai",
+		hosts: /(^|\.)grok\.com$/,
+		utm: /^grok$/
+	},
+	{
+		product: "mistral",
+		hosts: /^chat\.mistral\.ai$/,
+		utm: /^(le-?chat|mistral)$/
+	},
+	{
+		product: "you",
+		hosts: /(^|\.)you\.com$/
+	},
+	{
+		product: "phind",
+		hosts: /(^|\.)phind\.com$/
+	},
+	{
+		product: "poe",
+		hosts: /(^|\.)poe\.com$/
+	},
+	{
+		product: "duckduckgo",
+		hosts: /^duck\.ai$/
+	},
+	{
+		product: "qwen",
+		hosts: /^chat\.qwen\.ai$/
+	},
+	{
+		product: "kimi",
+		hosts: /(^|\.)kimi\.(com|ai)$|^kimi\.moonshot\.cn$/
+	},
+	{
+		product: "bytedance",
+		hosts: /(^|\.)doubao\.com$/
+	}
+];
+function hostOf(raw) {
+	try {
+		return new URL(raw.includes("://") ? raw : `https://${raw}`).hostname.toLowerCase().replace(/^www\./, "");
+	} catch {
+		return "";
+	}
+}
+/**
+* Which AI assistant sent a human to this page, from the Referer header and/or
+* the landing URL's `utm_source`. Returns the product id, or null.
+*/
+function classifyReferral(referrer, url) {
+	if (referrer) {
+		const host = hostOf(referrer);
+		const hit = host && AI_REFERRERS.find((r) => r.hosts.test(host));
+		if (hit) return hit.product;
+	}
+	if (url && url.includes("utm_source=")) {
+		const m = url.match(/[?&]utm_source=([^&#]+)/);
+		const src = m ? decodeURIComponent(m[1]).toLowerCase().replace(/^www\./, "") : "";
+		const hit = src && AI_REFERRERS.find((r) => r.utm?.test(src) || r.hosts.test(src));
+		if (hit) return hit.product;
+	}
+	return null;
+}
+function readHeader(h, name) {
+	if (!h) return null;
+	if (typeof h.get === "function") return h.get(name);
+	const v = h[name];
+	return Array.isArray(v) ? v.join(", ") : v ?? null;
+}
+/**
+* What kind of client sent this request, from its User-Agent, Web Bot Auth headers and referrer.
+* Synchronous and dependency-free, so it works in any server, middleware or edge function.
+*
+* It reports who the client *claims* to be. Anyone can send `User-Agent: GPTBot`, so don't
+* use it to grant access; your dashboard verifies each hit against the vendor's IP ranges,
+* reverse DNS and signatures.
+*
+*   detectBot(request)           // fetch Request (Next, SvelteKit, Astro, Hono, Workers…)
+*   detectBot(await headers())   // Next.js server components
+*   detectBot(req)               // Node / Express IncomingMessage
+*/
+function detectBot(input) {
+	const headers = input && typeof input.get === "function" ? input : input?.headers;
+	return detectFromHeaders((name) => readHeader(headers, name), input && "url" in input && typeof input.url === "string" ? input.url : null);
+}
+/** `detectBot` over a header getter (used by the server adapters). */
+function detectFromHeaders(header, url) {
+	const ua = header("user-agent") ?? null;
+	const signed = !!(header("signature-agent") && header("signature-input"));
+	const bot = classifyUserAgent(ua) ?? (signed ? BY_ID.get("signed-agent") : null);
+	if (!bot) {
+		const referral = classifyReferral(header("referer"), url);
+		return {
+			isBot: false,
+			isAI: false,
+			id: null,
+			name: null,
+			category: null,
+			product: null,
+			operator: null,
+			browser: false,
+			signed: false,
+			referral: referral ? BOT_PRODUCTS[referral].name : null
+		};
+	}
+	const product = BOT_PRODUCTS[bot.product];
+	return {
+		isBot: true,
+		isAI: isAiCategory(bot.category),
+		id: bot.id,
+		name: bot.name,
+		category: bot.category,
+		product: product.name,
+		operator: product.operator,
+		browser: bot.category === "agent" || bot.id === "headless",
+		signed,
+		referral: null
+	};
+}
+//#endregion
+//#region src/server.ts
+/**
+* AgentStats server integration — see which AI crawlers and agents visit your
+* site (GPTBot, ClaudeBot, PerplexityBot, ChatGPT agent, Google-Agent, …),
+* including the ones that never run JavaScript.
+*
+* Runs on Node and on edge runtimes (no Node built-ins). What leaves your server:
+*  - bot-like requests: method, URL, status, user agent, IP (used to verify the
+*    bot against the vendor's published ranges, then discarded) and Web Bot Auth
+*    signature headers;
+*  - visits referred by an AI assistant (chatgpt.com, perplexity.ai, …): URL and
+*    referrer host only;
+*  - everything else: a per-day count of page views. Nothing about humans.
+*
+*   import { createAgentStats } from '@agentstats/sdk/server'
+*   const lens = createAgentStats({ serverKey: process.env.AGENTSTATS_SERVER_KEY })
+*   app.use(lens.express())                        // Express / Connect: res.locals.bot
+*   export default defineNitroPlugin(lens.nitro()) // Nuxt / Nitro: event.context.bot
+*   export const handle = lens.sveltekit()         // SvelteKit: event.locals.bot
+*   export const onRequest = lens.astro()          // Astro: Astro.locals.bot
+*   app.use(lens.hono())                           // Hono: c.get('bot')
+*   lens.track(request, { waitUntil, response })   // Next.js proxy, Workers, Bun, Deno
+*
+* Every adapter also hands you `detectBot()`'s answer for the request, and `detectBot`
+* works on its own (no key needed): `detectBot(request).isAI`.
+*
+* With an `apiKey` (an API's key, `al_api_…`), the same adapters also track your API: calls an
+* AI agent made (a Web Bot Auth signature, an `X-AI-Agent` header, an agent's User-Agent, or a
+* credential you name in `apiCaller`) with method, route pattern, status and duration, and a
+* per-day count of every other call. Never bodies, query strings or credentials: the caller is
+* sent as an HMAC of its credential, keyed with your API key.
+*
+*   const lens = createAgentStats({ apiKey: process.env.AGENTSTATS_API_KEY }) // API-only server
+*/
+const SERVER_SDK_VERSION = "0.3.1";
+/**
+* Words that may mean a bot the table below doesn't know yet. Deliberately broad: the server
+* makes the final call, and its table can be newer than this SDK's.
+*/
+const BOT_HINT = /bot|crawl|spider|slurp|scrap|fetch|agent|preview|headless|python|curl|wget|httpx|http-?client|go-http|java\/|okhttp|axios|node|undici|libwww|perl|ruby|phantom|puppeteer|playwright|selenium|lighthouse|monitor|uptime|gpt|openai|claude|anthropic|perplexity|gemini|google-|googleother|meta-external|facebookexternalhit|bytespider|ccbot|diffbot|cohere|mistral|deepseek|manus|firecrawl|jina|tavily|exabot|linkup|novaact|amzn|cursor|devin|opencode|kagi|duckassist|qwen|tongyi|kimi|yiyan|ernie|doubao|petal|pangu|timpi|omgili|webzio|imagesift|img2dataset|lightpanda|crawl4ai|apify|youbot|phind/i;
+const ASSET = /\.(?:js|mjs|css|map|png|jpe?g|gif|webp|avif|svg|ico|bmp|woff2?|ttf|otf|eot|mp4|webm|mov|mp3|wav|ogg|zip|gz|wasm|pdf)$/i;
+const SIGNATURE_HEADERS = [
+	"signature",
+	"signature-input",
+	"signature-agent"
+];
+const NEVER_FORWARD = /* @__PURE__ */ new Set([
+	"cookie",
+	"authorization",
+	"proxy-authorization",
+	"x-api-key"
+]);
+const VISIT_COOKIE = "_al_v";
+/** Paths that are API calls when the server also serves a website. */
+const API_PATH = /^\/(?:api|v\d+)(?:\/|$)/;
+/** A path segment that's a value rather than part of the route: numbers, UUIDs, hashes, long tokens, emails. */
+const ID_SEGMENT = /^(\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9a-f]{12,}|(?=[^/]*\d)[\w-]{16,}|[^/@]+@[^/]+|[A-Za-z]+_[A-Za-z0-9]{12,})$/i;
+/** A path as a route pattern: values (ids, UUIDs, tokens, emails) replaced by `:id`. */
+function routeFromPath(path) {
+	return path.split("/").map((s) => {
+		let v = s;
+		try {
+			v = decodeURIComponent(s);
+		} catch {}
+		return s && ID_SEGMENT.test(v) ? ":id" : s;
+	}).join("/") || "/";
+}
+/** A framework route pattern as `/users/:id`: SvelteKit and Astro `[id]`/`[...rest]`, minus route groups. */
+function normalizeRoutePattern(pattern) {
+	return pattern.replace(/\/\([^/)]+\)(?=\/|$)/g, "").replace(/\[\[?\.\.\.([^\]]+)\]\]?/g, ":$1*").replace(/\[\[?([^\]]+)\]\]?/g, ":$1") || "/";
+}
+/** The framework's route pattern, if it fits the request's path segment for segment (else it's a parent router's or a middleware's). */
+function fitRoute(pattern, path) {
+	if (typeof pattern !== "string" || !pattern.startsWith("/")) return null;
+	const p = normalizeRoutePattern(pattern).replace(/\/$/, "") || "/";
+	if (p.includes("*")) return p;
+	const segments = (s) => s.split("/").filter(Boolean).length;
+	return segments(p) === segments(path) ? p : null;
+}
+/** Web Bot Auth headers and the headers their signature covers, so the server can verify it. Never credentials or cookies. */
+function signatureHeaders(header) {
+	const headers = {};
+	const covered = (header("signature-input") ?? "").match(/"([a-z0-9-]+)"/gi)?.map((s) => s.slice(1, -1).toLowerCase()) ?? [];
+	for (const name of [...SIGNATURE_HEADERS, ...covered].slice(0, 16)) {
+		if (name.startsWith("@") || NEVER_FORWARD.has(name)) continue;
+		const v = header(name);
+		if (v) headers[name] = v;
+	}
+	return headers;
+}
+function defaultCaller(header) {
+	return header("authorization")?.trim() || header("x-api-key")?.trim() || header("api-key")?.trim() || null;
+}
+function defaultEndpoint() {
+	const env = globalThis.process?.env;
+	if (env?.AGENTSTATS_ENDPOINT) return env.AGENTSTATS_ENDPOINT;
+	return "https://agentstats.io/api/ingest".replace(/\/api\/ingest\/?$/, "/api/ingest/hits");
+}
+function randomId() {
+	const c = globalThis.crypto;
+	if (c?.randomUUID) return c.randomUUID().replace(/-/g, "");
+	return Array.from({ length: 32 }, () => Math.floor(Math.random() * 16).toString(16)).join("");
+}
+function firstIp(v) {
+	return v?.split(",")[0]?.trim() || null;
+}
+/** The client-IP header of the platform we run on. These platforms overwrite it, so a client can't forge it. */
+function platformIpHeader() {
+	const g = globalThis;
+	const env = g.process?.env ?? {};
+	if (g.navigator?.userAgent === "Cloudflare-Workers") return "cf-connecting-ip";
+	if (env.VERCEL) return "x-real-ip";
+	if (g.Netlify || env.NETLIFY) return "x-nf-client-connection-ip";
+	if (env.FLY_APP_NAME) return "fly-client-ip";
+	return null;
+}
+/** Forwarding headers in order of preference, for proxies we can't identify. */
+function forwardedIp(h) {
+	return firstIp(h("cf-connecting-ip") ?? h("true-client-ip") ?? h("x-real-ip") ?? h("x-vercel-forwarded-for") ?? h("fly-client-ip") ?? h("x-forwarded-for"));
+}
+/** `waitUntil` of the current request on platforms that expose it globally (Vercel functions, Netlify). */
+function ambientWaitUntil() {
+	const g = globalThis;
+	const vercel = g[Symbol.for("@vercel/request-context")]?.get?.();
+	if (typeof vercel?.waitUntil === "function") return (p) => vercel.waitUntil(p);
+	const netlify = g.Netlify?.context;
+	if (typeof netlify?.waitUntil === "function") return (p) => netlify.waitUntil(p);
+}
+/** Loopback, private (RFC 1918 / ULA), link-local and carrier-grade NAT addresses: never a crawler's real IP. */
+function isPrivateIp(ip) {
+	if (!ip) return false;
+	const s = ip.toLowerCase().replace(/^\[|\]$/g, "").replace(/%.*$/, "").replace(/^::ffff:(?=\d+\.\d+\.\d+\.\d+$)/, "");
+	const v4 = s.match(/^(\d+)\.(\d+)\.\d+\.\d+$/);
+	if (v4) {
+		const a = Number(v4[1]);
+		const b = Number(v4[2]);
+		return a === 10 || a === 127 || a === 0 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a === 100 && b >= 64 && b <= 127;
+	}
+	return s === "::1" || s === "::" || /^f[cd][0-9a-f]{0,2}:/.test(s) || /^fe[89ab][0-9a-f]?:/.test(s);
+}
+let dayCache = {
+	from: 0,
+	to: 0,
+	value: ""
+};
+function day(ts) {
+	if (ts < dayCache.from || ts >= dayCache.to) {
+		const from = ts - ts % 864e5;
+		dayCache = {
+			from,
+			to: from + 864e5,
+			value: new Date(from).toISOString().slice(0, 10)
+		};
+	}
+	return dayCache.value;
+}
+const now = () => globalThis.performance?.now() ?? Date.now();
+var AgentStatsServer = class {
+	constructor(opts) {
+		this.queue = [];
+		this.humans = {};
+		this.humanCount = 0;
+		this.apiQueue = [];
+		this.apiOther = {};
+		this.apiOtherCount = 0;
+		this.apiHmacKey = null;
+		this.apiHmacs = /* @__PURE__ */ new Map();
+		this.timer = null;
+		this.lastFlush = 0;
+		this.inflight = Promise.resolve();
+		if (!opts?.serverKey && !opts?.apiKey && !opts?.disabled) console.warn("[agentstats] no `serverKey`: detecting bots only, nothing is sent to AgentStats (Site settings → Server key)");
+		if (opts.serverKey && !opts.serverKey.startsWith("al_srv_")) throw new Error("[agentstats] `serverKey` must be the secret server key (al_srv_…), not the public site key");
+		if (opts.apiKey && !opts.apiKey.startsWith("al_api_")) throw new Error("[agentstats] `apiKey` must be an API's key (al_api_…, Project settings → APIs)");
+		const endpoint = opts?.endpoint ?? defaultEndpoint();
+		if (!endpoint && (opts?.serverKey || opts?.apiKey) && !opts?.disabled) throw new Error("[agentstats] `endpoint` is required, e.g. https://your-host/api/ingest/hits");
+		this.options = {
+			countHumans: true,
+			visitCookie: true,
+			maxBatch: 100,
+			flushIntervalMs: 5e3,
+			debug: false,
+			disabled: false,
+			...Object.fromEntries(Object.entries(opts ?? {}).filter(([, v]) => v !== void 0)),
+			endpoint,
+			apiEndpoint: opts?.apiEndpoint ?? endpoint.replace(/\/hits\/?$/, "/api")
+		};
+		this.hitsOn = !!opts?.serverKey && !this.options.disabled;
+		this.apiOn = !!opts?.apiKey && !this.options.disabled;
+		this._fetch = opts?.fetch ?? ((...a) => fetch(...a));
+	}
+	/** Express / Connect middleware: `app.use(lens.express())`. The detection is on `res.locals.bot`. */
+	express() {
+		return (req, res, next) => {
+			const bot = this.node(req, res);
+			if (res.locals) res.locals.bot = bot;
+			next?.();
+		};
+	}
+	/** Plain Node `http`. Call before the response is written. Returns what `detectBot` says about the request. */
+	node(req, res) {
+		const get = (name) => headerValue(req.headers[name]);
+		let d;
+		try {
+			d = this.decide(req.method ?? "GET", this.nodeUrl(req), get, this.nodeIp(req));
+			if (d.kind === "ignore") return d.detection;
+			if (d.cookie) appendNodeCookie(res, d.cookie);
+			const decided = d;
+			res.once?.("finish", () => {
+				if (typeof req.route?.path === "string") this.setRoute(decided, (req.baseUrl ?? "") + req.route.path);
+				this.setContentType(decided, res.getHeader?.("content-type"));
+				this.commit(decided, res.statusCode ?? null);
+			});
+			if (!res.once) this.commit(d, null);
+		} catch (err) {
+			this.log("track failed", err);
+		}
+		return d?.detection ?? detectFromHeaders(get, req.url ?? null);
+	}
+	/**
+	* Fetch-API requests (Next.js proxy/middleware, Cloudflare Workers, Bun, Deno).
+	* Pass `response` to let AgentStats set the visit cookie on it, and `waitUntil` on serverless/edge
+	* so the hit is sent after the response. Returns what `detectBot` says about the request.
+	*/
+	track(request, init = {}) {
+		const d = this.fetchDecision(request, init.ip);
+		this.setRoute(d, init.route);
+		this.fetchFinish(d, init.status ?? null, init.response, init.waitUntil);
+		return d.detection;
+	}
+	/** Hono middleware: `app.use(lens.hono())`. The detection is on `c.get('bot')`. */
+	hono() {
+		return async (c, next) => {
+			let ip;
+			try {
+				const incoming = c.env?.incoming;
+				if (incoming?.socket) ip = this.nodeIp(incoming);
+				else if (typeof c.env?.requestIP === "function") ip = this.options.ipHeader || this.options.trustProxy || platformIpHeader() ? void 0 : c.env.requestIP(c.req.raw)?.address;
+			} catch {}
+			const d = this.fetchDecision(c.req.raw, ip);
+			c.set?.("bot", d.detection);
+			await next();
+			try {
+				const routes = c.req.matchedRoutes?.filter((r) => r.method !== "ALL") ?? [];
+				this.setRoute(d, routes[routes.length - 1]?.path ?? c.req.routePath);
+			} catch {}
+			let waitUntil;
+			try {
+				const ctx = c.executionCtx;
+				if (ctx?.waitUntil) waitUntil = ctx.waitUntil.bind(ctx);
+			} catch {}
+			this.fetchFinish(d, c.res?.status ?? null, c.res, waitUntil);
+		};
+	}
+	/** SvelteKit: `export const handle = lens.sveltekit()` in `src/hooks.server.ts` (or inside `sequence()`). The detection is on `event.locals.bot`. */
+	sveltekit() {
+		return async ({ event, resolve }) => {
+			let ip;
+			try {
+				ip = event.getClientAddress();
+			} catch {
+				event.locals.bot = detectBot(event.request);
+				return resolve(event);
+			}
+			const d = event.isSubRequest ? null : this.fetchDecision(event.request, ip);
+			event.locals.bot = d?.detection ?? detectBot(event.request);
+			const res = await resolve(event);
+			if (d) {
+				this.setRoute(d, event.route?.id);
+				const p = event.platform;
+				const ctx = p?.context?.waitUntil ? p.context : p?.ctx;
+				this.fetchFinish(d, res.status, res, ctx?.waitUntil?.bind(ctx));
+			}
+			return res;
+		};
+	}
+	/** Astro: `export const onRequest = lens.astro()` in `src/middleware.ts` (or inside `sequence()`). The detection is on `Astro.locals.bot`. */
+	astro() {
+		return async (context, next) => {
+			if (context.isPrerendered) return next();
+			let ip = null;
+			try {
+				ip = context.clientAddress ?? null;
+			} catch {}
+			const d = this.fetchDecision(context.request, ip);
+			const locals = context.locals;
+			locals.bot = d.detection;
+			const res = await next();
+			this.setRoute(d, context.routePattern);
+			const ctx = locals.runtime?.ctx;
+			this.fetchFinish(d, res.status, res, ctx?.waitUntil?.bind(ctx));
+			return res;
+		};
+	}
+	/**
+	* Nuxt / Nitro plugin: `export default defineNitroPlugin(lens.nitro())` in `server/plugins/agentstats.ts`.
+	* The detection is on `event.context.bot` in server routes, and on `useRequestEvent()?.context.bot` in pages.
+	* Works on every Nitro preset (Node, Vercel, Netlify, Cloudflare…).
+	*/
+	nitro() {
+		return (nitroApp) => {
+			nitroApp.hooks.hook("request", (event) => {
+				const d = this.h3Decision(event);
+				event.context.bot = d.detection;
+				if (d.kind === "ignore") return;
+				event.context[DECISION] = d;
+				if (d.cookie && event.node?.res) appendNodeCookie(event.node.res, d.cookie);
+			});
+			const finish = (event, status) => {
+				const d = event?.context[DECISION];
+				if (!d) return;
+				delete event.context[DECISION];
+				this.setRoute(d, event.context.matchedRoute?.path);
+				this.setContentType(d, event.node?.res?.getHeader?.("content-type"));
+				this.commit(d, status, typeof event.waitUntil === "function" ? event.waitUntil.bind(event) : void 0);
+			};
+			nitroApp.hooks.hook("afterResponse", (event) => finish(event, event.node?.res?.statusCode ?? null));
+			nitroApp.hooks.hook("error", (error, context = {}) => finish(context.event, error?.statusCode ?? 500));
+		};
+	}
+	/**
+	* Wrap a `fetch(request, env, ctx)` handler (Cloudflare Workers, Bun.serve, Deno.serve), or a Next.js
+	* route handler. `route` names the handler's route pattern for API tracking, e.g. `/api/users/[id]`.
+	*/
+	wrapFetch(handler, opts = {}) {
+		return async (request, ...rest) => {
+			const d = this.fetchDecision(request);
+			this.setRoute(d, opts.route);
+			const res = await handler(request, ...rest);
+			const ctx = rest[1];
+			let out = res;
+			try {
+				out = new Response(res.body, res);
+			} catch {}
+			this.fetchFinish(d, res.status, out, ctx?.waitUntil?.bind(ctx));
+			return out;
+		};
+	}
+	/** Send everything queued now. */
+	flush() {
+		if (this.timer) {
+			clearTimeout(this.timer);
+			this.timer = null;
+		}
+		const sends = [];
+		if (this.queue.length || this.humanCount) sends.push(this.flushHits());
+		if (this.apiQueue.length || this.apiOtherCount) sends.push(this.flushApi());
+		if (!sends.length) return this.inflight;
+		this.lastFlush = Date.now();
+		const p = Promise.all(sends).then(() => {});
+		this.inflight = p;
+		return p;
+	}
+	flushHits() {
+		const hits = this.queue.splice(0, this.queue.length);
+		const humans = this.humans;
+		this.humans = {};
+		this.humanCount = 0;
+		const body = JSON.stringify({
+			sdk: `node/${SERVER_SDK_VERSION}`,
+			humans,
+			hits
+		});
+		return this._fetch(this.options.endpoint, {
+			method: "POST",
+			body,
+			headers: {
+				"content-type": "application/json",
+				"authorization": `Bearer ${this.options.serverKey}`
+			}
+		}).then((res) => {
+			if (!res.ok) this.log("ingest responded", res.status);
+		}).catch((err) => {
+			this.log("ingest failed", err);
+			if (this.queue.length < 1e3) this.queue.unshift(...hits.slice(0, 1e3 - this.queue.length));
+		});
+	}
+	async flushApi() {
+		const items = this.apiQueue.splice(0, this.apiQueue.length);
+		const other = this.apiOther;
+		this.apiOther = {};
+		this.apiOtherCount = 0;
+		for (const item of items) {
+			if (item.caller !== null) item.record.actor = await this.hmac(item.caller);
+			item.caller = null;
+		}
+		const body = JSON.stringify({
+			calls: items.map((i) => i.record),
+			other
+		});
+		return this._fetch(this.options.apiEndpoint, {
+			method: "POST",
+			body,
+			headers: {
+				"content-type": "application/json",
+				"authorization": `Bearer ${this.options.apiKey}`,
+				"x-agentstats-sdk": `node/${SERVER_SDK_VERSION}`
+			}
+		}).then((res) => {
+			if (!res.ok) this.log("api ingest responded", res.status);
+		}).catch((err) => {
+			this.log("api ingest failed", err);
+			if (this.apiQueue.length < 1e3) this.apiQueue.unshift(...items.slice(0, 1e3 - this.apiQueue.length));
+			for (const [k, n] of Object.entries(other)) {
+				this.apiOther[k] = (this.apiOther[k] ?? 0) + n;
+				this.apiOtherCount += n;
+			}
+		});
+	}
+	/** HMAC-SHA256 of a credential keyed with the API key (hex, 128 bits), or null without Web Crypto. */
+	hmac(value) {
+		let h = this.apiHmacs.get(value);
+		if (!h) {
+			if (this.apiHmacs.size >= 1e3) this.apiHmacs.delete(this.apiHmacs.keys().next().value);
+			h = this.computeHmac(value);
+			this.apiHmacs.set(value, h);
+		}
+		return h;
+	}
+	async computeHmac(value) {
+		const subtle = globalThis.crypto?.subtle;
+		if (!subtle) return null;
+		this.apiHmacKey ??= subtle.importKey("raw", new TextEncoder().encode(this.options.apiKey), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign"]).catch(() => null);
+		const key = await this.apiHmacKey;
+		if (!key) return null;
+		const sig = new Uint8Array(await subtle.sign("HMAC", key, new TextEncoder().encode(value)));
+		return Array.from(sig.slice(0, 16), (b) => b.toString(16).padStart(2, "0")).join("");
+	}
+	/** Decide what a request is (synchronously, so the visit cookie can still be set). */
+	decide(method, url, header, ip) {
+		const detection = detectFromHeaders(header, url);
+		const ignore = {
+			kind: "ignore",
+			detection
+		};
+		if (!this.hitsOn && !this.apiOn) return ignore;
+		const m = method.toUpperCase();
+		if (m === "OPTIONS" || m === "CONNECT" || m === "TRACE") return ignore;
+		let path;
+		try {
+			path = new URL(url).pathname;
+		} catch {
+			return ignore;
+		}
+		if (ASSET.test(path) || path.startsWith("/_next/") || path.startsWith("/_nuxt/") || path.startsWith("/_app/immutable/") || path.startsWith("/_astro/")) return ignore;
+		const ig = this.options.ignore;
+		if (ig && (typeof ig === "function" ? ig(path) : ig.test(path))) return ignore;
+		if (this.apiOn && this.isApiPath(path)) return this.decideApi(m, url, path, header, ip, detection);
+		if (!this.hitsOn) return ignore;
+		const ua = header("user-agent") ?? null;
+		if (!ip && !ua?.trim()) return ignore;
+		const signed = detection.signed;
+		if (signed || detection.isBot || ua && BOT_HINT.test(ua)) {
+			const record = {
+				ts: Date.now(),
+				method: m,
+				url,
+				status: null,
+				ua,
+				ip,
+				referrer: header("referer") ?? null
+			};
+			if (signed) record.headers = signatureHeaders(header);
+			if (/text\/markdown/i.test(header("accept") ?? "") || /\.md$/i.test(path)) record.accept_md = true;
+			const d = {
+				kind: "bot",
+				detection,
+				record
+			};
+			if (this.options.visitCookie && m === "GET" && (signed || detection.browser)) {
+				d.visitId = randomId();
+				record.visit_id = d.visitId;
+				d.cookie = `${VISIT_COOKIE}=${d.visitId}; Path=/; Max-Age=1800; SameSite=Lax${url.startsWith("https:") ? "; Secure" : ""}`;
+			}
+			return d;
+		}
+		if (m === "GET" && detection.referral) {
+			let refHost = "";
+			try {
+				refHost = new URL(header("referer") ?? "").hostname.replace(/^www\./, "");
+			} catch {}
+			return {
+				kind: "referral",
+				detection,
+				record: {
+					ts: Date.now(),
+					method: m,
+					url,
+					status: null,
+					ua,
+					ip: null,
+					referrer: refHost ? `https://${refHost}/` : null
+				}
+			};
+		}
+		if (!this.options.countHumans || m !== "GET") return ignore;
+		const dest = header("sec-fetch-dest");
+		return (dest ? dest === "document" : (header("accept") ?? "").includes("text/html")) ? {
+			kind: "human",
+			detection
+		} : ignore;
+	}
+	isApiPath(path) {
+		const r = this.options.apiRoutes;
+		if (r) return typeof r === "function" ? r(path) : r.test(path);
+		return !this.hitsOn || API_PATH.test(path);
+	}
+	/** An API call: by an agent (kept, with how we know) or not (only counted). */
+	decideApi(m, url, path, header, ip, detection) {
+		const agent = header("x-ai-agent")?.trim().slice(0, 120) || null;
+		const signed = detection.signed;
+		let caller = null;
+		const pick = this.options.apiCaller;
+		if (pick !== false && (pick || signed || detection.isAI || agent)) try {
+			const c = pick ? pick(header) : defaultCaller(header);
+			caller = typeof c === "string" ? c ? { id: c } : null : c?.id ? c : null;
+		} catch (err) {
+			this.log("apiCaller failed", err);
+		}
+		if (!signed && !detection.isAI && !agent && !caller?.agent) return {
+			kind: "api-other",
+			detection
+		};
+		return {
+			kind: "api",
+			detection,
+			api: {
+				ts: Date.now(),
+				method: m,
+				route: routeFromPath(path),
+				status: null,
+				durationMs: null,
+				ua: header("user-agent") ?? null,
+				ip: signed || detection.isAI ? ip : null,
+				url: signed ? url : null,
+				headers: signed ? signatureHeaders(header) : {},
+				agent,
+				run: header("x-ai-agent-run")?.trim().slice(0, 200) || null,
+				actor: null,
+				actorAgent: caller?.agent?.slice(0, 120) ?? null
+			},
+			caller: caller?.id ?? null,
+			started: now()
+		};
+	}
+	/** Note whether the response to a bot was Markdown, from its content type (when the adapter can see it). */
+	setContentType(d, contentType) {
+		if (!d?.record || d.kind !== "bot" || typeof contentType !== "string" || !contentType) return;
+		d.record.served_md = /text\/(?:x-)?markdown/i.test(contentType);
+	}
+	/** Use the framework's route pattern for an API call when it fits the request's path. */
+	setRoute(d, pattern) {
+		if (!d?.api) return;
+		const fitted = fitRoute(pattern, d.api.route);
+		if (fitted) d.api.route = fitted;
+	}
+	/** Queue a decided request once its status is known. */
+	commit(d, status, waitUntil = ambientWaitUntil()) {
+		if (d.kind === "ignore") return;
+		if (d.kind === "human") {
+			const k = day(Date.now());
+			this.humans[k] = (this.humans[k] ?? 0) + 1;
+			this.humanCount++;
+		} else if (d.kind === "api-other") {
+			const k = day(Date.now());
+			this.apiOther[k] = (this.apiOther[k] ?? 0) + 1;
+			this.apiOtherCount++;
+		} else if (d.api) {
+			d.api.status = status;
+			d.api.durationMs = Math.round((now() - (d.started ?? now())) * 100) / 100;
+			this.apiQueue.push({
+				record: d.api,
+				caller: d.caller ?? null
+			});
+			this.log("api", d.api.method, d.api.route, status);
+		} else if (d.record) {
+			d.record.status = status;
+			this.queue.push(d.record);
+			this.log(d.kind, d.record.ua, d.record.url);
+		}
+		if (waitUntil) {
+			if (this.queue.length || this.apiQueue.length || this.humanCount + this.apiOtherCount >= 25 || Date.now() - this.lastFlush > 3e4) waitUntil(this.flush());
+			return;
+		}
+		if (this.queue.length + this.apiQueue.length >= this.options.maxBatch) this.flush();
+		else if (!this.timer) {
+			this.timer = setTimeout(() => void this.flush(), this.options.flushIntervalMs);
+			this.timer.unref?.();
+		}
+	}
+	fetchDecision(request, ip) {
+		const h = request.headers;
+		const get = (name) => h.get(name);
+		try {
+			return this.decide(request.method, request.url, get, ip ?? this.fetchIp(get));
+		} catch (err) {
+			this.log("track failed", err);
+			return {
+				kind: "ignore",
+				detection: detectFromHeaders(get, request.url)
+			};
+		}
+	}
+	fetchFinish(d, status, response, waitUntil) {
+		if (d.kind === "ignore") return;
+		try {
+			this.setContentType(d, response?.headers?.get?.("content-type"));
+			if (d.cookie && response) try {
+				response.headers.append("set-cookie", d.cookie);
+			} catch {}
+			this.commit(d, status, waitUntil ?? ambientWaitUntil());
+		} catch (err) {
+			this.log("track failed", err);
+		}
+	}
+	h3Decision(event) {
+		const req = event.node?.req;
+		const get = typeof event.headers?.get === "function" ? (name) => event.headers.get(name) : (name) => headerValue(req?.headers[name]);
+		try {
+			if (get("x-nitro-prerender") || (event.path ?? req?.url ?? "").startsWith("/__nuxt_error")) return {
+				kind: "ignore",
+				detection: detectFromHeaders(get, null)
+			};
+			const native = !!req?.socket?.remoteAddress;
+			const url = native && req ? this.nodeUrl(req) : event.web?.request?.url ?? `${firstIp(get("x-forwarded-proto")) || "https"}://${get("host") ?? "localhost"}${event.path ?? req?.url ?? "/"}`;
+			return this.decide(event.method ?? req?.method ?? "GET", url, get, native && req ? this.nodeIp(req) : this.fetchIp(get));
+		} catch (err) {
+			this.log("track failed", err);
+			return {
+				kind: "ignore",
+				detection: detectFromHeaders(get, null)
+			};
+		}
+	}
+	/** Client IP of a fetch-API request: the configured header, else the platform's, else the usual forwarding headers. */
+	fetchIp(h) {
+		if (this.options.ipHeader) return firstIp(h(this.options.ipHeader.toLowerCase()));
+		const platform = platformIpHeader();
+		return platform && firstIp(h(platform)) || forwardedIp(h);
+	}
+	/** Whether this request came through a proxy whose forwarding headers we should believe. */
+	viaProxy(req) {
+		return this.options.trustProxy ?? isPrivateIp(req.socket?.remoteAddress);
+	}
+	nodeUrl(req) {
+		const h = (n) => headerValue(req.headers[n]);
+		const proxied = this.viaProxy(req);
+		return `${proxied && firstIp(h("x-forwarded-proto")) || (req.socket?.encrypted ? "https" : "http")}://${proxied && firstIp(h("x-forwarded-host")) || h("host") || "localhost"}${req.originalUrl ?? req.url ?? "/"}`;
+	}
+	nodeIp(req) {
+		const h = (n) => headerValue(req.headers[n]);
+		if (this.options.ipHeader) return firstIp(h(this.options.ipHeader.toLowerCase())) ?? req.socket?.remoteAddress ?? null;
+		if (this.viaProxy(req)) {
+			const platform = platformIpHeader();
+			const fwd = platform && firstIp(h(platform)) || firstIp(h("cf-connecting-ip") ?? h("true-client-ip") ?? h("x-real-ip") ?? h("fly-client-ip") ?? h("x-forwarded-for"));
+			if (fwd) return fwd;
+		}
+		return req.socket?.remoteAddress ?? null;
+	}
+	log(...args) {
+		if (this.options.debug) console.debug("[agentstats]", ...args);
+	}
+};
+const DECISION = Symbol.for("agentstats.decision");
+function headerValue(v) {
+	if (v === void 0) return null;
+	return Array.isArray(v) ? v.join(", ") : v;
+}
+function appendNodeCookie(res, cookie) {
+	if (res.headersSent || !res.setHeader) return;
+	const prev = res.getHeader?.("set-cookie");
+	const list = prev === void 0 ? [] : Array.isArray(prev) ? prev.map(String) : [String(prev)];
+	res.setHeader("set-cookie", [...list, cookie]);
+}
+function createAgentStats(options) {
+	return new AgentStatsServer(options);
+}
+//#endregion
+export { AI_CATEGORIES, AgentStatsServer, BOT_PATTERNS, BOT_PRODUCTS, SERVER_SDK_VERSION, classifyReferral, classifyUserAgent, createAgentStats, createAgentStats as default, detectBot, isAiCategory, isPrivateIp, normalizeRoutePattern, routeFromPath };