@apideck/agent-analytics 0.13.0 → 0.15.0

package/README.md

@@ -82,6 +82,119 @@ Now you can build:
 
 ---
 
+## Charging for training crawls (experimental)
+
+> **⚠️ Experimental.** The payment surface — `paymentRequired`, `paymentGate`,
+> `x402Gateway`, `mppxGateway` — may change without a major version bump. The
+> protocols are weeks old and still moving: x402 and MPP are both live but their
+> specs are unstable, MPP had not publicly pinned a settlement-confirmation
+> header at the time of writing, and no agent in our own production traffic has
+> yet presented a payment credential. Detection, verification and policy are
+> stable; this is not. Do not put it on a revenue-critical path yet.
+
+### Meter first. Charge later, if at all.
+
+Per-request 402 is what x402 and MPP define, and it is the wrong shape for a
+training sweep. On one production site that is ~199,000 training requests a
+month: three times the traffic once you add pay-and-retry, 199,000 settlements
+whose per-transaction cost exceeds any sane per-page price, and — decisively —
+**no crawler in the wild retries a 402**. Charging per request is blocking with
+extra steps.
+
+So start by counting:
+
+```ts
+import { paymentGate } from '@apideck/agent-analytics'
+import { combinedVerifier } from '@apideck/agent-analytics/verify'
+
+const gate = await paymentGate(req, {
+  verify: combinedVerifier(),
+  meter: { record: (e) => warehouse.insert(e) } // training only
+})
+if (gate.response) return gate.response
+return gate.decorate(await serve(req))
+```
+
+`meter` fires only for training traffic. Retrieval and search are served free
+and never counted, because charging the channel that sends you readers is the
+one outcome this design exists to prevent.
+
+### Then sell a licence, not a page
+
+When you know the number, switch to an entitlement: one 402 advertising a bulk
+offer, one settlement, a reusable credential.
+
+```ts
+import { entitlementGateway } from '@apideck/agent-analytics'
+
+const gate = await paymentGate(req, {
+  onTraining: 'charge',
+  gateway: entitlementGateway({
+    store: myKV,                    // lookup + consume; quota state is yours
+    offer: { units: 1_000_000, unit: 'pages', validForSeconds: 2_592_000, price: '$400' },
+    challenges: [{ protocol: 'mpp', id, realm: 'example.com', method: 'tempo' }]
+  })
+})
+```
+
+```
+402  once, advertising the licence
+200  every request after, quota −1
+402  again when it runs out
+```
+
+Unknown, expired and exhausted credentials all return the same challenge —
+distinguishing them would turn the endpoint into an oracle for probing quota.
+
+MPP's reusable `Authorization: Payment` credential suits this better than
+x402's per-resource signature, which proves payment for a single URL.
+
+Measured against real traffic shapes:
+
+```
+402    training   charge  GPTBot
+serve  retrieval  allow   ChatGPT-User
+403    training   block   ClaudeBot from an unpublished IP
+402    training   charge  ClaudeBot from a real Anthropic IP
+serve  search     allow   Googlebot
+```
+
+Settlement is never ours. `mppxGateway` wraps Stripe's MPP SDK; `x402Gateway`
+calls a facilitator you supply. The library emits challenges and reads
+credentials — holding money would drag PCI scope into edge middleware.
+
+## Cryptographic verification (Web Bot Auth)
+
+Published IP ranges were always the weak form of identity. [Web Bot
+Auth](https://blog.cloudflare.com/web-bot-auth/) is the strong one: an RFC 9421
+HTTP Message Signatures profile where an agent signs each request with Ed25519
+and publishes its keys at a well-known directory. Backed by Cloudflare, Amazon,
+Akamai and OpenAI, with an IETF working group chartered in 2026.
+
+```ts
+import { combinedVerifier } from '@apideck/agent-analytics/verify'
+
+void trackVisit(req, { analytics, verify: combinedVerifier() })
+```
+
+`combinedVerifier` prefers the signature and falls back to ranges:
+
+| | published IP ranges | Web Bot Auth |
+| --- | --- | --- |
+| Coverage | 4 vendors | any agent that signs |
+| Freshness | rots; needs weekly refresh | none needed |
+| False `spoofed` | stale list accuses real crawlers | impossible |
+| Agents on a user's machine | unverifiable | signable |
+
+A present-but-invalid signature is decisive: it returns `spoofed` even if the
+client IP happens to sit in a published range, so a forged signature cannot be
+laundered by the weaker check. Unsigned traffic is `unverifiable`, never
+`spoofed` — most agents do not sign yet, and treating silence as forgery would
+mislabel nearly all real traffic.
+
+Unsigned requests cost nothing: the check returns before any I/O. Signed ones
+fetch the signer's key directory once per origin and cache it for an hour.
+
 ## Upgrading to 0.12
 
 Four breaking changes, all deliberate. Each one existed because the previous
@@ -138,6 +251,37 @@ without Web Crypto now fail with an explicit message rather than a confusing
 - Outbound captures carry a 3s `AbortSignal` (`timeoutMs` to change it).
 - Root bundle is 65% smaller (27.7 kB → 9.6 kB, 3.8 kB gzipped).
 
+## Recommending firewall rules
+
+Turn observed traffic into staged Vercel WAF proposals. It emits *proposals* —
+every rule comes out in `log` mode and Vercel stages rule changes as drafts, so
+nothing is live until you run `vercel firewall publish` yourself.
+
+```ts
+import { recommendFirewallRules, firewallScript } from '@apideck/agent-analytics'
+
+const rules = recommendFirewallRules(observations) // aggregate from your warehouse
+console.log(firewallScript(rules))                // runnable, commented bash
+```
+
+Two rules it will not break, both from measurement rather than taste:
+
+- **Retrieval and search agents are never proposed for blocking**, and a `bypass`
+  rule protecting them is emitted *first* so later rules cannot catch them.
+  Rules evaluate top to bottom, and 60% of AI traffic on one production site is
+  a person asking a question.
+- **Training crawlers get rate limits, not denials.** Denying them removes you
+  from future training sets, which is a discoverability decision rather than a
+  default.
+
+Only a failed verification earns a proposed `deny`. Every recommendation carries
+its `evidence`, a `risk` rating, and a `caveat` where over-blocking is plausible
+— the datacenter-ASN rule is marked `high` risk because corporate VPNs and
+privacy relays egress from hosting networks.
+
+See [`docs/TESTING-PAYMENTS.md`](./docs/TESTING-PAYMENTS.md) for testing the
+payment path end to end.
+
 ## Install
 
 ```bash

package/dist/adapters/posthog.cjs

@@ -1,3 +1,3 @@
-'use strict';var r=class extends Error{status;body;constructor(e,a,i){super(e),this.name="CaptureTransportError",this.status=a,this.body=i;}};function h(t){let e=t.host??"https://us.i.posthog.com",a=(/^https?:\/\//.test(e)?e:`https://${e}`).replace(/\/$/,""),i=(t.path??"/i/v0/e/").replace(/^(?!\/)/,"/"),n=`${a}${i}`,p=t.fetchImpl??fetch;return {async capture(o){let c={api_key:t.apiKey,event:o.event,distinct_id:o.distinctId,timestamp:o.timestamp,properties:o.properties},s=await p(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(c),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!s.ok)throw new r(`PostHog capture failed: ${s.status} ${s.statusText}`,s.status,await s.text().catch(()=>{}))}}}
-exports.posthogAnalytics=h;//# sourceMappingURL=posthog.cjs.map
+'use strict';var o=class extends Error{status;body;constructor(s,i,p){super(s),this.name="CaptureTransportError",this.status=i,this.body=p;}};function y(t){let s=t.host??"https://us.i.posthog.com",i=(/^https?:\/\//.test(s)?s:`https://${s}`).replace(/\/$/,""),p=(t.path??"/i/v0/e/").replace(/^(?!\/)/,"/"),c=`${i}${p}`,u=t.fetchImpl??fetch;return {async capture(e){let a=e.properties.user_agent,n=e.properties.client_ip,d={api_key:t.apiKey,event:e.event,distinct_id:e.distinctId,timestamp:e.timestamp,properties:{...e.properties,...typeof a=="string"&&a?{$raw_user_agent:a}:{},...typeof n=="string"&&n?{$ip:n}:{}}},r=await u(c,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(d),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!r.ok)throw new o(`PostHog capture failed: ${r.status} ${r.statusText}`,r.status,await r.text().catch(()=>{}))}}}
+exports.posthogAnalytics=y;//# sourceMappingURL=posthog.cjs.map
 //# sourceMappingURL=posthog.cjs.map

package/dist/adapters/posthog.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/errors.ts","../../src/adapters/posthog.ts"],"names":["CaptureTransportError","message","status","body","posthogAnalytics","config","hostRaw","base","path","endpoint","fetchImpl","event","payload","res"],"mappings":"aACO,IAAMA,CAAAA,CAAN,cAAoC,KAAM,CACtC,OACA,IAAA,CACT,WAAA,CAAYC,CAAAA,CAAiBC,CAAAA,CAAiBC,CAAAA,CAAe,CAC3D,KAAA,CAAMF,CAAO,EACb,IAAA,CAAK,IAAA,CAAO,uBAAA,CACZ,IAAA,CAAK,MAAA,CAASC,CAAAA,CACd,IAAA,CAAK,IAAA,CAAOC,EACd,CACF,CAAA,CC2BO,SAASC,CAAAA,CAAiBC,EAAgD,CAC/E,IAAMC,CAAAA,CAAUD,CAAAA,CAAO,MAAQ,0BAAA,CACzBE,CAAAA,CAAAA,CAAQ,cAAA,CAAe,IAAA,CAAKD,CAAO,CAAA,CAAIA,CAAAA,CAAU,CAAA,QAAA,EAAWA,CAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,KAAA,CAAO,EAAE,CAAA,CACxFE,CAAAA,CAAAA,CAAQH,CAAAA,CAAO,IAAA,EAAQ,YAAY,OAAA,CAAQ,SAAA,CAAW,GAAG,CAAA,CACzDI,CAAAA,CAAW,CAAA,EAAGF,CAAI,CAAA,EAAGC,CAAI,CAAA,CAAA,CACzBE,CAAAA,CAAYL,CAAAA,CAAO,SAAA,EAAa,MAEtC,OAAO,CACL,MAAM,OAAA,CAAQM,EAAoC,CAChD,IAAMC,CAAAA,CAAU,CACd,OAAA,CAASP,CAAAA,CAAO,MAAA,CAChB,KAAA,CAAOM,EAAM,KAAA,CACb,WAAA,CAAaA,CAAAA,CAAM,UAAA,CACnB,SAAA,CAAWA,CAAAA,CAAM,SAAA,CACjB,UAAA,CAAYA,EAAM,UACpB,CAAA,CAIME,CAAAA,CAAM,MAAMH,CAAAA,CAAUD,CAAAA,CAAU,CACpC,MAAA,CAAQ,OACR,OAAA,CAAS,CAAE,cAAA,CAAgB,kBAAmB,EAC9C,IAAA,CAAM,IAAA,CAAK,SAAA,CAAUG,CAAO,EAC5B,SAAA,CAAW,IAAA,CACX,MAAA,CAAQ,WAAA,CAAY,OAAA,CAAQP,CAAAA,CAAO,SAAA,EAAa,GAAI,CACtD,CAAC,CAAA,CACD,GAAI,CAACQ,CAAAA,CAAI,EAAA,CACP,MAAM,IAAIb,EACR,CAAA,wBAAA,EAA2Ba,CAAAA,CAAI,MAAM,CAAA,CAAA,EAAIA,CAAAA,CAAI,UAAU,CAAA,CAAA,CACvDA,CAAAA,CAAI,OACJ,MAAMA,CAAAA,CAAI,IAAA,EAAK,CAAE,MAAM,IAAG,CAAA,CAAY,CACxC,CAEJ,CACF,CACF","file":"posthog.cjs","sourcesContent":["/** Thrown when the analytics backend rejects, errors, or times out a capture. */\nexport class CaptureTransportError extends Error {\n  readonly status: number | undefined\n  readonly body: string | undefined\n  constructor(message: string, status?: number, body?: string) {\n    super(message)\n    this.name = 'CaptureTransportError'\n    this.status = status\n    this.body = body\n  }\n}\n","import type { AnalyticsAdapter, CaptureEvent } from '../types.js'\nimport { CaptureTransportError } from '../errors.js'\n\n\nexport interface PostHogAdapterConfig {\n  /** PostHog project API key (the public one used by the JS SDK). */\n  apiKey: string\n  /**\n   * PostHog host, with or without scheme. Defaults to `https://us.i.posthog.com`.\n   * Use `https://eu.i.posthog.com` for EU cloud, or your own reverse-proxy\n   * domain (e.g. `https://svc.example.com`).\n   */\n  host?: string\n  /**\n   * Path on the host that accepts single-event captures. Defaults to\n   * `/i/v0/e/` which is PostHog's current endpoint for this.\n   */\n  path?: string\n  /**\n   * Override the `fetch` implementation (useful for tests or custom runtimes\n   * that need a pinned fetch).\n   */\n  fetchImpl?: typeof fetch\n  /**\n   * Abort the capture after this many milliseconds. Defaults to 3000. Without\n   * a bound, a hung backend leaves a pending promise for the lifetime of an\n   * edge invocation.\n   */\n  timeoutMs?: number\n}\n\n/**\n * Adapter that posts each event to the PostHog capture endpoint. Uses\n * `keepalive: true` so the request survives after a serverless response\n * returns — events aren't guaranteed (fire-and-forget), but that's the\n * trade we want to keep the hot path fast.\n */\nexport function posthogAnalytics(config: PostHogAdapterConfig): AnalyticsAdapter {\n  const hostRaw = config.host ?? 'https://us.i.posthog.com'\n  const base = (/^https?:\\/\\//.test(hostRaw) ? hostRaw : `https://${hostRaw}`).replace(/\\/$/, '')\n  const path = (config.path ?? '/i/v0/e/').replace(/^(?!\\/)/, '/')\n  const endpoint = `${base}${path}`\n  const fetchImpl = config.fetchImpl ?? fetch\n\n  return {\n    async capture(event: CaptureEvent): Promise<void> {\n      const payload = {\n        api_key: config.apiKey,\n        event: event.event,\n        distinct_id: event.distinctId,\n        timestamp: event.timestamp,\n        properties: event.properties\n      }\n      // A 401 from a mistyped key used to look identical to success. Surface\n      // it: `trackVisit` routes it to `onError` and still never throws into\n      // the response path.\n      const res = await fetchImpl(endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n        keepalive: true,\n        signal: AbortSignal.timeout(config.timeoutMs ?? 3000)\n      })\n      if (!res.ok) {\n        throw new CaptureTransportError(\n          `PostHog capture failed: ${res.status} ${res.statusText}`,\n          res.status,\n          await res.text().catch(() => undefined)\n        )\n      }\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../../src/errors.ts","../../src/adapters/posthog.ts"],"names":["CaptureTransportError","message","status","body","posthogAnalytics","config","hostRaw","base","path","endpoint","fetchImpl","event","ua","ip","payload","res"],"mappings":"aACO,IAAMA,EAAN,cAAoC,KAAM,CACtC,MAAA,CACA,IAAA,CACT,YAAYC,CAAAA,CAAiBC,CAAAA,CAAiBC,CAAAA,CAAe,CAC3D,MAAMF,CAAO,CAAA,CACb,KAAK,IAAA,CAAO,uBAAA,CACZ,KAAK,MAAA,CAASC,CAAAA,CACd,IAAA,CAAK,IAAA,CAAOC,EACd,CACF,CAAA,CC2BO,SAASC,CAAAA,CAAiBC,CAAAA,CAAgD,CAC/E,IAAMC,CAAAA,CAAUD,EAAO,IAAA,EAAQ,0BAAA,CACzBE,GAAQ,cAAA,CAAe,IAAA,CAAKD,CAAO,CAAA,CAAIA,CAAAA,CAAU,WAAWA,CAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,KAAA,CAAO,EAAE,CAAA,CACxFE,CAAAA,CAAAA,CAAQH,EAAO,IAAA,EAAQ,UAAA,EAAY,QAAQ,SAAA,CAAW,GAAG,CAAA,CACzDI,CAAAA,CAAW,GAAGF,CAAI,CAAA,EAAGC,CAAI,CAAA,CAAA,CACzBE,CAAAA,CAAYL,EAAO,SAAA,EAAa,KAAA,CAEtC,OAAO,CACL,MAAM,OAAA,CAAQM,CAAAA,CAAoC,CAchD,IAAMC,CAAAA,CAAKD,EAAM,UAAA,CAAW,UAAA,CACtBE,EAAKF,CAAAA,CAAM,UAAA,CAAW,UACtBG,CAAAA,CAAU,CACd,QAAST,CAAAA,CAAO,MAAA,CAChB,MAAOM,CAAAA,CAAM,KAAA,CACb,WAAA,CAAaA,CAAAA,CAAM,WACnB,SAAA,CAAWA,CAAAA,CAAM,UACjB,UAAA,CAAY,CACV,GAAGA,CAAAA,CAAM,UAAA,CACT,GAAI,OAAOC,GAAO,QAAA,EAAYA,CAAAA,CAAK,CAAE,eAAA,CAAiBA,CAAG,EAAI,EAAC,CAC9D,GAAI,OAAOC,GAAO,QAAA,EAAYA,CAAAA,CAAK,CAAE,GAAA,CAAKA,CAAG,EAAI,EACnD,CACF,CAAA,CAIME,CAAAA,CAAM,MAAML,CAAAA,CAAUD,CAAAA,CAAU,CACpC,MAAA,CAAQ,MAAA,CACR,QAAS,CAAE,cAAA,CAAgB,kBAAmB,CAAA,CAC9C,KAAM,IAAA,CAAK,SAAA,CAAUK,CAAO,CAAA,CAC5B,SAAA,CAAW,KACX,MAAA,CAAQ,WAAA,CAAY,QAAQT,CAAAA,CAAO,SAAA,EAAa,GAAI,CACtD,CAAC,EACD,GAAI,CAACU,EAAI,EAAA,CACP,MAAM,IAAIf,CAAAA,CACR,2BAA2Be,CAAAA,CAAI,MAAM,IAAIA,CAAAA,CAAI,UAAU,GACvDA,CAAAA,CAAI,MAAA,CACJ,MAAMA,CAAAA,CAAI,IAAA,GAAO,KAAA,CAAM,IAAG,EAAY,CACxC,CAEJ,CACF,CACF","file":"posthog.cjs","sourcesContent":["/** Thrown when the analytics backend rejects, errors, or times out a capture. */\nexport class CaptureTransportError extends Error {\n  readonly status: number | undefined\n  readonly body: string | undefined\n  constructor(message: string, status?: number, body?: string) {\n    super(message)\n    this.name = 'CaptureTransportError'\n    this.status = status\n    this.body = body\n  }\n}\n","import type { AnalyticsAdapter, CaptureEvent } from '../types.js'\nimport { CaptureTransportError } from '../errors.js'\n\n\nexport interface PostHogAdapterConfig {\n  /** PostHog project API key (the public one used by the JS SDK). */\n  apiKey: string\n  /**\n   * PostHog host, with or without scheme. Defaults to `https://us.i.posthog.com`.\n   * Use `https://eu.i.posthog.com` for EU cloud, or your own reverse-proxy\n   * domain (e.g. `https://svc.example.com`).\n   */\n  host?: string\n  /**\n   * Path on the host that accepts single-event captures. Defaults to\n   * `/i/v0/e/` which is PostHog's current endpoint for this.\n   */\n  path?: string\n  /**\n   * Override the `fetch` implementation (useful for tests or custom runtimes\n   * that need a pinned fetch).\n   */\n  fetchImpl?: typeof fetch\n  /**\n   * Abort the capture after this many milliseconds. Defaults to 3000. Without\n   * a bound, a hung backend leaves a pending promise for the lifetime of an\n   * edge invocation.\n   */\n  timeoutMs?: number\n}\n\n/**\n * Adapter that posts each event to the PostHog capture endpoint. Uses\n * `keepalive: true` so the request survives after a serverless response\n * returns — events aren't guaranteed (fire-and-forget), but that's the\n * trade we want to keep the hot path fast.\n */\nexport function posthogAnalytics(config: PostHogAdapterConfig): AnalyticsAdapter {\n  const hostRaw = config.host ?? 'https://us.i.posthog.com'\n  const base = (/^https?:\\/\\//.test(hostRaw) ? hostRaw : `https://${hostRaw}`).replace(/\\/$/, '')\n  const path = (config.path ?? '/i/v0/e/').replace(/^(?!\\/)/, '/')\n  const endpoint = `${base}${path}`\n  const fetchImpl = config.fetchImpl ?? fetch\n\n  return {\n    async capture(event: CaptureEvent): Promise<void> {\n      // PostHog runs its own user-agent and GeoIP enrichment, but only off its\n      // canonical property names. We already carry both values under our own\n      // keys, so mirroring them costs nothing and unlocks a free second opinion:\n      // getTrafficCategory(), getBotName() and friends all read\n      // `properties.$raw_user_agent`, and GeoIP reads `properties.$ip`.\n      //\n      // Without this every event arrives with traffic category `no_user_agent`\n      // and PostHog's whole bot taxonomy sits dormant — which is exactly what\n      // happened on ours until someone queried it.\n      //\n      // `$ip` is mirrored only when the caller already opted into `captureIp`.\n      // Adding it otherwise would put a raw address on the event that the\n      // caller deliberately kept off.\n      const ua = event.properties.user_agent\n      const ip = event.properties.client_ip\n      const payload = {\n        api_key: config.apiKey,\n        event: event.event,\n        distinct_id: event.distinctId,\n        timestamp: event.timestamp,\n        properties: {\n          ...event.properties,\n          ...(typeof ua === 'string' && ua ? { $raw_user_agent: ua } : {}),\n          ...(typeof ip === 'string' && ip ? { $ip: ip } : {})\n        }\n      }\n      // A 401 from a mistyped key used to look identical to success. Surface\n      // it: `trackVisit` routes it to `onError` and still never throws into\n      // the response path.\n      const res = await fetchImpl(endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n        keepalive: true,\n        signal: AbortSignal.timeout(config.timeoutMs ?? 3000)\n      })\n      if (!res.ok) {\n        throw new CaptureTransportError(\n          `PostHog capture failed: ${res.status} ${res.statusText}`,\n          res.status,\n          await res.text().catch(() => undefined)\n        )\n      }\n    }\n  }\n}\n"]}

package/dist/adapters/posthog.d.cts

@@ -1,4 +1,4 @@
-import { A as AnalyticsAdapter } from '../types-sQoQK-ox.cjs';
+import { A as AnalyticsAdapter } from '../types-Dw43eu7D.cjs';
 
 interface PostHogAdapterConfig {
     /** PostHog project API key (the public one used by the JS SDK). */

package/dist/adapters/posthog.d.ts

@@ -1,4 +1,4 @@
-import { A as AnalyticsAdapter } from '../types-sQoQK-ox.js';
+import { A as AnalyticsAdapter } from '../types-Dw43eu7D.js';
 
 interface PostHogAdapterConfig {
     /** PostHog project API key (the public one used by the JS SDK). */

package/dist/adapters/posthog.js

@@ -1,3 +1,3 @@
-var r=class extends Error{status;body;constructor(e,a,i){super(e),this.name="CaptureTransportError",this.status=a,this.body=i;}};function h(t){let e=t.host??"https://us.i.posthog.com",a=(/^https?:\/\//.test(e)?e:`https://${e}`).replace(/\/$/,""),i=(t.path??"/i/v0/e/").replace(/^(?!\/)/,"/"),n=`${a}${i}`,p=t.fetchImpl??fetch;return {async capture(o){let c={api_key:t.apiKey,event:o.event,distinct_id:o.distinctId,timestamp:o.timestamp,properties:o.properties},s=await p(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(c),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!s.ok)throw new r(`PostHog capture failed: ${s.status} ${s.statusText}`,s.status,await s.text().catch(()=>{}))}}}
-export{h as posthogAnalytics};//# sourceMappingURL=posthog.js.map
+var o=class extends Error{status;body;constructor(s,i,p){super(s),this.name="CaptureTransportError",this.status=i,this.body=p;}};function y(t){let s=t.host??"https://us.i.posthog.com",i=(/^https?:\/\//.test(s)?s:`https://${s}`).replace(/\/$/,""),p=(t.path??"/i/v0/e/").replace(/^(?!\/)/,"/"),c=`${i}${p}`,u=t.fetchImpl??fetch;return {async capture(e){let a=e.properties.user_agent,n=e.properties.client_ip,d={api_key:t.apiKey,event:e.event,distinct_id:e.distinctId,timestamp:e.timestamp,properties:{...e.properties,...typeof a=="string"&&a?{$raw_user_agent:a}:{},...typeof n=="string"&&n?{$ip:n}:{}}},r=await u(c,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(d),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!r.ok)throw new o(`PostHog capture failed: ${r.status} ${r.statusText}`,r.status,await r.text().catch(()=>{}))}}}
+export{y as posthogAnalytics};//# sourceMappingURL=posthog.js.map
 //# sourceMappingURL=posthog.js.map

package/dist/adapters/posthog.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/errors.ts","../../src/adapters/posthog.ts"],"names":["CaptureTransportError","message","status","body","posthogAnalytics","config","hostRaw","base","path","endpoint","fetchImpl","event","payload","res"],"mappings":"AACO,IAAMA,CAAAA,CAAN,cAAoC,KAAM,CACtC,OACA,IAAA,CACT,WAAA,CAAYC,CAAAA,CAAiBC,CAAAA,CAAiBC,CAAAA,CAAe,CAC3D,KAAA,CAAMF,CAAO,EACb,IAAA,CAAK,IAAA,CAAO,uBAAA,CACZ,IAAA,CAAK,MAAA,CAASC,CAAAA,CACd,IAAA,CAAK,IAAA,CAAOC,EACd,CACF,CAAA,CC2BO,SAASC,CAAAA,CAAiBC,EAAgD,CAC/E,IAAMC,CAAAA,CAAUD,CAAAA,CAAO,MAAQ,0BAAA,CACzBE,CAAAA,CAAAA,CAAQ,cAAA,CAAe,IAAA,CAAKD,CAAO,CAAA,CAAIA,CAAAA,CAAU,CAAA,QAAA,EAAWA,CAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,KAAA,CAAO,EAAE,CAAA,CACxFE,CAAAA,CAAAA,CAAQH,CAAAA,CAAO,IAAA,EAAQ,YAAY,OAAA,CAAQ,SAAA,CAAW,GAAG,CAAA,CACzDI,CAAAA,CAAW,CAAA,EAAGF,CAAI,CAAA,EAAGC,CAAI,CAAA,CAAA,CACzBE,CAAAA,CAAYL,CAAAA,CAAO,SAAA,EAAa,MAEtC,OAAO,CACL,MAAM,OAAA,CAAQM,EAAoC,CAChD,IAAMC,CAAAA,CAAU,CACd,OAAA,CAASP,CAAAA,CAAO,MAAA,CAChB,KAAA,CAAOM,EAAM,KAAA,CACb,WAAA,CAAaA,CAAAA,CAAM,UAAA,CACnB,SAAA,CAAWA,CAAAA,CAAM,SAAA,CACjB,UAAA,CAAYA,EAAM,UACpB,CAAA,CAIME,CAAAA,CAAM,MAAMH,CAAAA,CAAUD,CAAAA,CAAU,CACpC,MAAA,CAAQ,OACR,OAAA,CAAS,CAAE,cAAA,CAAgB,kBAAmB,EAC9C,IAAA,CAAM,IAAA,CAAK,SAAA,CAAUG,CAAO,EAC5B,SAAA,CAAW,IAAA,CACX,MAAA,CAAQ,WAAA,CAAY,OAAA,CAAQP,CAAAA,CAAO,SAAA,EAAa,GAAI,CACtD,CAAC,CAAA,CACD,GAAI,CAACQ,CAAAA,CAAI,EAAA,CACP,MAAM,IAAIb,EACR,CAAA,wBAAA,EAA2Ba,CAAAA,CAAI,MAAM,CAAA,CAAA,EAAIA,CAAAA,CAAI,UAAU,CAAA,CAAA,CACvDA,CAAAA,CAAI,OACJ,MAAMA,CAAAA,CAAI,IAAA,EAAK,CAAE,MAAM,IAAG,CAAA,CAAY,CACxC,CAEJ,CACF,CACF","file":"posthog.js","sourcesContent":["/** Thrown when the analytics backend rejects, errors, or times out a capture. */\nexport class CaptureTransportError extends Error {\n  readonly status: number | undefined\n  readonly body: string | undefined\n  constructor(message: string, status?: number, body?: string) {\n    super(message)\n    this.name = 'CaptureTransportError'\n    this.status = status\n    this.body = body\n  }\n}\n","import type { AnalyticsAdapter, CaptureEvent } from '../types.js'\nimport { CaptureTransportError } from '../errors.js'\n\n\nexport interface PostHogAdapterConfig {\n  /** PostHog project API key (the public one used by the JS SDK). */\n  apiKey: string\n  /**\n   * PostHog host, with or without scheme. Defaults to `https://us.i.posthog.com`.\n   * Use `https://eu.i.posthog.com` for EU cloud, or your own reverse-proxy\n   * domain (e.g. `https://svc.example.com`).\n   */\n  host?: string\n  /**\n   * Path on the host that accepts single-event captures. Defaults to\n   * `/i/v0/e/` which is PostHog's current endpoint for this.\n   */\n  path?: string\n  /**\n   * Override the `fetch` implementation (useful for tests or custom runtimes\n   * that need a pinned fetch).\n   */\n  fetchImpl?: typeof fetch\n  /**\n   * Abort the capture after this many milliseconds. Defaults to 3000. Without\n   * a bound, a hung backend leaves a pending promise for the lifetime of an\n   * edge invocation.\n   */\n  timeoutMs?: number\n}\n\n/**\n * Adapter that posts each event to the PostHog capture endpoint. Uses\n * `keepalive: true` so the request survives after a serverless response\n * returns — events aren't guaranteed (fire-and-forget), but that's the\n * trade we want to keep the hot path fast.\n */\nexport function posthogAnalytics(config: PostHogAdapterConfig): AnalyticsAdapter {\n  const hostRaw = config.host ?? 'https://us.i.posthog.com'\n  const base = (/^https?:\\/\\//.test(hostRaw) ? hostRaw : `https://${hostRaw}`).replace(/\\/$/, '')\n  const path = (config.path ?? '/i/v0/e/').replace(/^(?!\\/)/, '/')\n  const endpoint = `${base}${path}`\n  const fetchImpl = config.fetchImpl ?? fetch\n\n  return {\n    async capture(event: CaptureEvent): Promise<void> {\n      const payload = {\n        api_key: config.apiKey,\n        event: event.event,\n        distinct_id: event.distinctId,\n        timestamp: event.timestamp,\n        properties: event.properties\n      }\n      // A 401 from a mistyped key used to look identical to success. Surface\n      // it: `trackVisit` routes it to `onError` and still never throws into\n      // the response path.\n      const res = await fetchImpl(endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n        keepalive: true,\n        signal: AbortSignal.timeout(config.timeoutMs ?? 3000)\n      })\n      if (!res.ok) {\n        throw new CaptureTransportError(\n          `PostHog capture failed: ${res.status} ${res.statusText}`,\n          res.status,\n          await res.text().catch(() => undefined)\n        )\n      }\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../../src/errors.ts","../../src/adapters/posthog.ts"],"names":["CaptureTransportError","message","status","body","posthogAnalytics","config","hostRaw","base","path","endpoint","fetchImpl","event","ua","ip","payload","res"],"mappings":"AACO,IAAMA,EAAN,cAAoC,KAAM,CACtC,MAAA,CACA,IAAA,CACT,YAAYC,CAAAA,CAAiBC,CAAAA,CAAiBC,CAAAA,CAAe,CAC3D,MAAMF,CAAO,CAAA,CACb,KAAK,IAAA,CAAO,uBAAA,CACZ,KAAK,MAAA,CAASC,CAAAA,CACd,IAAA,CAAK,IAAA,CAAOC,EACd,CACF,CAAA,CC2BO,SAASC,CAAAA,CAAiBC,CAAAA,CAAgD,CAC/E,IAAMC,CAAAA,CAAUD,EAAO,IAAA,EAAQ,0BAAA,CACzBE,GAAQ,cAAA,CAAe,IAAA,CAAKD,CAAO,CAAA,CAAIA,CAAAA,CAAU,WAAWA,CAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,KAAA,CAAO,EAAE,CAAA,CACxFE,CAAAA,CAAAA,CAAQH,EAAO,IAAA,EAAQ,UAAA,EAAY,QAAQ,SAAA,CAAW,GAAG,CAAA,CACzDI,CAAAA,CAAW,GAAGF,CAAI,CAAA,EAAGC,CAAI,CAAA,CAAA,CACzBE,CAAAA,CAAYL,EAAO,SAAA,EAAa,KAAA,CAEtC,OAAO,CACL,MAAM,OAAA,CAAQM,CAAAA,CAAoC,CAchD,IAAMC,CAAAA,CAAKD,EAAM,UAAA,CAAW,UAAA,CACtBE,EAAKF,CAAAA,CAAM,UAAA,CAAW,UACtBG,CAAAA,CAAU,CACd,QAAST,CAAAA,CAAO,MAAA,CAChB,MAAOM,CAAAA,CAAM,KAAA,CACb,WAAA,CAAaA,CAAAA,CAAM,WACnB,SAAA,CAAWA,CAAAA,CAAM,UACjB,UAAA,CAAY,CACV,GAAGA,CAAAA,CAAM,UAAA,CACT,GAAI,OAAOC,GAAO,QAAA,EAAYA,CAAAA,CAAK,CAAE,eAAA,CAAiBA,CAAG,EAAI,EAAC,CAC9D,GAAI,OAAOC,GAAO,QAAA,EAAYA,CAAAA,CAAK,CAAE,GAAA,CAAKA,CAAG,EAAI,EACnD,CACF,CAAA,CAIME,CAAAA,CAAM,MAAML,CAAAA,CAAUD,CAAAA,CAAU,CACpC,MAAA,CAAQ,MAAA,CACR,QAAS,CAAE,cAAA,CAAgB,kBAAmB,CAAA,CAC9C,KAAM,IAAA,CAAK,SAAA,CAAUK,CAAO,CAAA,CAC5B,SAAA,CAAW,KACX,MAAA,CAAQ,WAAA,CAAY,QAAQT,CAAAA,CAAO,SAAA,EAAa,GAAI,CACtD,CAAC,EACD,GAAI,CAACU,EAAI,EAAA,CACP,MAAM,IAAIf,CAAAA,CACR,2BAA2Be,CAAAA,CAAI,MAAM,IAAIA,CAAAA,CAAI,UAAU,GACvDA,CAAAA,CAAI,MAAA,CACJ,MAAMA,CAAAA,CAAI,IAAA,GAAO,KAAA,CAAM,IAAG,EAAY,CACxC,CAEJ,CACF,CACF","file":"posthog.js","sourcesContent":["/** Thrown when the analytics backend rejects, errors, or times out a capture. */\nexport class CaptureTransportError extends Error {\n  readonly status: number | undefined\n  readonly body: string | undefined\n  constructor(message: string, status?: number, body?: string) {\n    super(message)\n    this.name = 'CaptureTransportError'\n    this.status = status\n    this.body = body\n  }\n}\n","import type { AnalyticsAdapter, CaptureEvent } from '../types.js'\nimport { CaptureTransportError } from '../errors.js'\n\n\nexport interface PostHogAdapterConfig {\n  /** PostHog project API key (the public one used by the JS SDK). */\n  apiKey: string\n  /**\n   * PostHog host, with or without scheme. Defaults to `https://us.i.posthog.com`.\n   * Use `https://eu.i.posthog.com` for EU cloud, or your own reverse-proxy\n   * domain (e.g. `https://svc.example.com`).\n   */\n  host?: string\n  /**\n   * Path on the host that accepts single-event captures. Defaults to\n   * `/i/v0/e/` which is PostHog's current endpoint for this.\n   */\n  path?: string\n  /**\n   * Override the `fetch` implementation (useful for tests or custom runtimes\n   * that need a pinned fetch).\n   */\n  fetchImpl?: typeof fetch\n  /**\n   * Abort the capture after this many milliseconds. Defaults to 3000. Without\n   * a bound, a hung backend leaves a pending promise for the lifetime of an\n   * edge invocation.\n   */\n  timeoutMs?: number\n}\n\n/**\n * Adapter that posts each event to the PostHog capture endpoint. Uses\n * `keepalive: true` so the request survives after a serverless response\n * returns — events aren't guaranteed (fire-and-forget), but that's the\n * trade we want to keep the hot path fast.\n */\nexport function posthogAnalytics(config: PostHogAdapterConfig): AnalyticsAdapter {\n  const hostRaw = config.host ?? 'https://us.i.posthog.com'\n  const base = (/^https?:\\/\\//.test(hostRaw) ? hostRaw : `https://${hostRaw}`).replace(/\\/$/, '')\n  const path = (config.path ?? '/i/v0/e/').replace(/^(?!\\/)/, '/')\n  const endpoint = `${base}${path}`\n  const fetchImpl = config.fetchImpl ?? fetch\n\n  return {\n    async capture(event: CaptureEvent): Promise<void> {\n      // PostHog runs its own user-agent and GeoIP enrichment, but only off its\n      // canonical property names. We already carry both values under our own\n      // keys, so mirroring them costs nothing and unlocks a free second opinion:\n      // getTrafficCategory(), getBotName() and friends all read\n      // `properties.$raw_user_agent`, and GeoIP reads `properties.$ip`.\n      //\n      // Without this every event arrives with traffic category `no_user_agent`\n      // and PostHog's whole bot taxonomy sits dormant — which is exactly what\n      // happened on ours until someone queried it.\n      //\n      // `$ip` is mirrored only when the caller already opted into `captureIp`.\n      // Adding it otherwise would put a raw address on the event that the\n      // caller deliberately kept off.\n      const ua = event.properties.user_agent\n      const ip = event.properties.client_ip\n      const payload = {\n        api_key: config.apiKey,\n        event: event.event,\n        distinct_id: event.distinctId,\n        timestamp: event.timestamp,\n        properties: {\n          ...event.properties,\n          ...(typeof ua === 'string' && ua ? { $raw_user_agent: ua } : {}),\n          ...(typeof ip === 'string' && ip ? { $ip: ip } : {})\n        }\n      }\n      // A 401 from a mistyped key used to look identical to success. Surface\n      // it: `trackVisit` routes it to `onError` and still never throws into\n      // the response path.\n      const res = await fetchImpl(endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(payload),\n        keepalive: true,\n        signal: AbortSignal.timeout(config.timeoutMs ?? 3000)\n      })\n      if (!res.ok) {\n        throw new CaptureTransportError(\n          `PostHog capture failed: ${res.status} ${res.statusText}`,\n          res.status,\n          await res.text().catch(() => undefined)\n        )\n      }\n    }\n  }\n}\n"]}

package/dist/adapters/webhook.d.cts

@@ -1,4 +1,4 @@
-import { C as CaptureEvent, A as AnalyticsAdapter } from '../types-sQoQK-ox.cjs';
+import { C as CaptureEvent, A as AnalyticsAdapter } from '../types-Dw43eu7D.cjs';
 
 interface WebhookAdapterConfig {
     /** Destination URL that receives a POST for each event. */

package/dist/adapters/webhook.d.ts

@@ -1,4 +1,4 @@
-import { C as CaptureEvent, A as AnalyticsAdapter } from '../types-sQoQK-ox.js';
+import { C as CaptureEvent, A as AnalyticsAdapter } from '../types-Dw43eu7D.js';
 
 interface WebhookAdapterConfig {
     /** Destination URL that receives a POST for each event. */

package/dist/index.cjs

@@ -1,3 +1,11 @@
-'use strict';var B=/ClaudeBot|Claude-User|Claude-SearchBot|Claude-Web|Anthropic|GPTBot|ChatGPT-User|OAI-SearchBot|PerplexityBot|Perplexity-User|Google-Extended|Google-CloudVertexBot|Google-Agent|GoogleAgent-Mariner|Gemini-Deep-Research|Applebot|cohere|Bytespider|CCBot|Amazonbot|Amzn-SearchBot|NovaAct|AzureAI-SearchBot|Meta-ExternalAgent|meta-externalfetcher|meta-webindexer|FacebookBot|DuckAssistBot|MistralAI-User|YouBot|AI2Bot|Diffbot|DeepSeek|PanguBot|Webzio-Extended|omgili|Timpibot|Grok|Manus-User|quillbot|MyCentralAIScraperBot|Cursor|Windsurf/i,S=/axios\/|curl\/|(?:^|[\s(])got(?:\/|[\s(])|\bcolly\b|Electron\/|node-fetch\/|python-requests\/|Go-http-client\/|okhttp\/|aiohttp\/|Deno\//i;function f(t){return t?B.test(t):false}function m(t){return t?S.test(t):false}function T(t){if(!t||typeof t!="string")return "Other";let e=t.toLowerCase();return e.includes("chatgpt-user")||e.includes("gptbot")||e.includes("oai-searchbot")||e.includes("openai")?"ChatGPT":e.includes("claudebot")||e.includes("claude-user")||e.includes("claude-searchbot")||e.includes("claude-web")||e.includes("anthropic")?"Claude":e.includes("perplexitybot")||e.includes("perplexity-user")?"Perplexity":e.includes("ccbot")?"Common Crawl":e.includes("google-extended")||e.includes("googlebot")||e.includes("google-cloudvertexbot")||e.includes("google-agent")||e.includes("googleagent-mariner")||e.includes("gemini-deep-research")?"Google":e.includes("applebot")?"Apple":e.includes("bingbot")?"Bing":e.includes("bytespider")?"Bytespider":e.includes("amazonbot")||e.includes("amzn-searchbot")||e.includes("novaact")?"Amazon":e.includes("meta-externalagent")||e.includes("meta-externalfetcher")||e.includes("meta-webindexer")||e.includes("facebookbot")?"Meta":e.includes("mistralai-user")?"Mistral":e.includes("duckassistbot")?"DuckDuckGo":e.includes("youbot")?"You.com":e.includes("diffbot")?"Diffbot":e.includes("ai2bot")?"AI2":e.includes("cohere")?"Cohere":e.includes("cursor")?"Cursor":e.includes("windsurf")?"Windsurf":e.includes("deepseek")?"DeepSeek":e.includes("pangubot")?"Huawei":e.includes("webzio")||e.includes("omgili")?"Webz.io":e.includes("timpibot")?"Timpi":e.includes("grok")||e.includes("xai-")?"xAI":e.includes("manus-user")?"Manus":e.includes("quillbot")?"QuillBot":e.includes("azureai-searchbot")?"Microsoft":e.includes("mycentralaiscraperbot")?"MyCentralAI":e.includes("petalbot")?"PetalBot":e.includes("ahrefsbot")?"Ahrefs":e.includes("semrushbot")?"Semrush":e.includes("mj12bot")?"Majestic":e.includes("dotbot")||e.includes("rogerbot")?"Moz":e.includes("screaming frog")?"Screaming Frog":e.includes("sitebulb")?"Sitebulb":e.includes("linkfluence")?"Linkfluence":e.includes("dataforseo")?"DataForSEO":e.includes("serpstatbot")?"Serpstat":e.includes("uptimerobot")?"UptimeRobot":e.includes("pingdom")?"Pingdom":e.includes("statuscake")?"StatusCake":e.includes("newrelicpinger")?"New Relic":e.includes("datadogagent")||e.includes("datadog")?"Datadog":e.includes("slackbot")?"Slack":e.includes("twitterbot")?"Twitter":e.includes("linkedinbot")?"LinkedIn":e.includes("discordbot")?"Discord":e.includes("telegrambot")?"Telegram":e.includes("whatsapp")?"WhatsApp":e.includes("linkupbot")?"Linkup":e.includes("sogou")?"Sogou":e.includes("yandexbot")?"Yandex":e.includes("baiduspider")?"Baidu":e.includes("facebookexternalhit")?"Facebook":e.includes("com.apple.webkit")?"Apple URL Preview":e.includes("ohdear")?"Oh Dear":e.includes("scrapy")?"Scrapy":e.includes("headlesschrome")?"Headless Chrome":e.includes("phantomjs")?"PhantomJS":e.includes("wget")?"wget":e.includes("httpie")?"HTTPie":e.includes("guzzlehttp")?"Guzzle":e.includes("electron/")?"Electron":/curl\//.test(e)?"curl":/axios\//.test(e)?"axios":/(?:^|[\s(])got(?:\/|[\s(])/.test(e)?"got":/\bcolly\b/.test(e)?"colly":/node-fetch\//.test(e)?"node-fetch":/python-requests\//.test(e)?"python-requests":/go-http-client\//.test(e)?"Go http client":/okhttp\//.test(e)?"OkHttp":/aiohttp\//.test(e)?"aiohttp":/deno\//.test(e)?"Deno":e.includes("mozilla")||e.includes("chrome")||e.includes("safari")||e.includes("firefox")?"Browser":"Other"}function M(t){if(!t||typeof t!="string")return "Other";let e=t.match(/compatible;\s*([^/;\s]+)(?:\/[^\s;]*)?/i);return e&&e[1]?e[1].trim():t.trim().split("/")[0]?.trim().split(/\s+/)[0]?.trim()||"Other"}function b(t){let e=[],r=(t.headers.get("user-agent")||"").toLowerCase();if(!(r.includes("mozilla")||r.includes("chrome")||r.includes("safari")||r.includes("firefox")))return {score:0,signals:[],likely:false};t.headers.get("accept-language")||e.push("missing-accept-language"),t.headers.get("sec-fetch-mode")||e.push("missing-sec-fetch-mode");let n=t.headers.get("sec-ch-ua");n?n.toLowerCase().includes("headlesschrome")&&e.push("headless-chrome-hint"):e.push("missing-sec-ch-ua");let i=t.headers.get("accept")||"";(!i||i==="*/*")&&e.push("missing-or-bare-accept"),(t.headers.get("connection")||"").toLowerCase()==="close"&&e.push("connection-close");let s=e.length;return {score:s,signals:e,likely:s>=2}}function v(t){let e=T(t),r=f(t),o=m(t),n;return r?n="declared-crawler":o?n="coding-agent-hint":e==="Browser"?n="browser":n="other",{kind:n,label:e,isAiBot:r,codingAgentHint:o}}function p(t){let e=t.headers.get("user-agent")||"",r=v(e),o=b(t),n=r.kind,i=r.label;return n==="browser"&&o.likely&&(n="headless-likely",i="Headless"),{...r,kind:n,label:i,headless:o}}var g=class extends Error{constructor(e){super(e),this.name="HashSecretError";}};function A(){let t=globalThis.crypto;if(!t?.subtle)throw new g("Web Crypto is unavailable. agent-analytics requires Node >= 20, or any runtime exposing globalThis.crypto.subtle (Vercel Edge, Cloudflare Workers, Deno, browsers).");return t.subtle}var E=new Map;function N(t){let e=E.get(t);return e||(e=A().importKey("raw",new TextEncoder().encode(t),{name:"HMAC",hash:"SHA-256"},false,["sign"]),E.set(t,e)),e}async function x(t,e){if(typeof e!="string"||e.length===0)throw new g("hashId requires a non-empty secret");let r=await A().sign("HMAC",await N(e),new TextEncoder().encode(t)),o=new Uint8Array(r,0,8),n="";for(let i of o)n+=i.toString(16).padStart(2,"0");return "anon_"+n}function w(){let t=new Uint8Array(32);A(),globalThis.crypto.getRandomValues(t);let e="";for(let r of t)e+=r.toString(16).padStart(2,"0");return e}var k,I=false;function z(t){if(t)return t;let e=typeof process<"u"?process.env?.AGENT_ANALYTICS_ID_SECRET:void 0;return e||(k||(k=w(),I||(I=true,console.warn("[agent-analytics] No idSecret or AGENT_ANALYTICS_ID_SECRET set. Using a per-instance random secret: distinctIds will not correlate across instances or deploys."))),k)}async function O(t,e){let r=t.headers.get("user-agent")||"",o=e.onlyBots??false,n=e.skipBrowsers??false;if(!(o&&!f(r))&&!(n&&!f(r)&&!m(r)&&!b(t).likely))try{let i="/",s="";try{let C=new URL(t.url);i=C.pathname,s=C.origin;}catch{i=t.url||"/";}let a=e.origin??s,y=(t.headers.get("x-forwarded-for")||"").split(",")[0]?.trim()??"",h=t.headers.get("referer"),R=e.captureCountry&&(t.headers.get("x-vercel-ip-country")||t.headers.get("cf-ipcountry")||t.headers.get("x-country-code"))||null,_=e.captureGeo?U(t):null,c=p(t),d=e.verify?e.verify(t):null,D=c.kind==="headless-likely"||c.kind==="browser",H=await x(`${y}:${r}`,z(e.idSecret)),G={event:e.eventName??"agent_visit",distinctId:H,timestamp:new Date().toISOString(),properties:{...e.properties,$process_person_profile:!1,$current_url:a?`${a}${i}`:i,path:i,method:t.method,...e.captureCountry?{country_code:R}:{},..._??{},...e.captureIp?{client_ip:y||null}:{},user_agent:r,is_ai_bot:c.isAiBot,bot_name:c.label,ua_category:c.kind,coding_agent_hint:c.codingAgentHint,...D?{headless_score:c.headless?.score??0,headless_likely:c.headless?.likely??!1}:{},...d?{bot_verified:d.verified,bot_verification:d.verdict,...d.reason?{bot_verification_reason:d.reason}:{}}:{},referer:h,source:e.source??null}};await e.analytics.capture(G);}catch(i){e.onError?.(i instanceof Error?i:new Error(String(i)));}}function U(t){let e=n=>{if(!n)return "";try{return decodeURIComponent(n)}catch{return n}},r=[["region",e(t.headers.get("x-vercel-ip-country-region"))],["city",e(t.headers.get("x-vercel-ip-city"))],["latitude",t.headers.get("x-vercel-ip-latitude")??""],["longitude",t.headers.get("x-vercel-ip-longitude")??""],["timezone",t.headers.get("x-vercel-ip-timezone")??""]],o={};for(let[n,i]of r)i&&(o[n]=i);return o}var u=class extends Error{status;body;constructor(e,r,o){super(e),this.name="CaptureTransportError",this.status=r,this.body=o;}};var L=/ChatGPT-User|OAI-SearchBot|Claude-User|Claude-SearchBot|Perplexity-User|claude-code|DuckAssistBot|MistralAI-User|Gemini-Deep-Research|Manus-User|YouBot/i,$=/GPTBot|ClaudeBot|Claude-Web|CCBot|Bytespider|Amazonbot|Amzn-SearchBot|Meta-ExternalAgent|meta-externalfetcher|meta-webindexer|FacebookBot|Google-Extended|Applebot-Extended|AI2Bot|Diffbot|omgili|Webzio-Extended|Timpibot|PanguBot|cohere|DeepSeek|Grok|quillbot|MyCentralAIScraperBot|NovaAct|AzureAI-SearchBot|Google-CloudVertexBot/i,j=/bingbot|Googlebot|DuckDuckBot|YandexBot|Baiduspider|PetalBot|Sogou|Applebot(?!-Extended)/i;function P(t){let e=t??"";return e?L.test(e)?"retrieval":$.test(e)?"training":j.test(e)?"search":"unknown":"unknown"}function V(t,e={}){let r=t.headers.get("user-agent")||"",o=p(t),n=o.label,i=P(r);if(i==="unknown"&&o.codingAgentHint&&(i="tooling"),e.allowList?.some(h=>h===n||r.toLowerCase().includes(h.toLowerCase())))return {action:"allow",intent:i,label:n,reason:"on allowList"};let a;return e.verify&&(a=e.verify(t).verdict,a==="spoofed")?{action:"block",intent:i,label:n,verification:a,reason:`${n} claimed but client IP is outside its published ranges`}:{action:i==="training"?e.onTraining??"meter":i==="retrieval"?e.onRetrieval??"allow":i==="search"?e.onSearch??"allow":i==="tooling"?e.onTooling??"allow":"allow",intent:i,label:n,...a?{verification:a}:{},reason:{retrieval:"a person is waiting on this answer",training:"bulk corpus collection",search:"search index crawler",tooling:"coding agent or HTTP client",unknown:"not a recognised agent"}[i]}}function W(t){let e=t.host??"https://us.i.posthog.com",r=(/^https?:\/\//.test(e)?e:`https://${e}`).replace(/\/$/,""),o=(t.path??"/i/v0/e/").replace(/^(?!\/)/,"/"),n=`${r}${o}`,i=t.fetchImpl??fetch;return {async capture(s){let a={api_key:t.apiKey,event:s.event,distinct_id:s.distinctId,timestamp:s.timestamp,properties:s.properties},l=await i(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(a),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!l.ok)throw new u(`PostHog capture failed: ${l.status} ${l.statusText}`,l.status,await l.text().catch(()=>{}))}}}function K(t){let e=t.fetchImpl??fetch,r=t.transform??(o=>o);return {async capture(o){let n=await e(t.url,{method:"POST",headers:{"Content-Type":"application/json",...t.headers??{}},body:JSON.stringify(r(o)),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!n.ok)throw new u(`Webhook capture failed: ${n.status} ${n.statusText}`,n.status,await n.text().catch(()=>{}))}}}function F(t){return {capture:t}}
-exports.AI_BOT_PATTERN=B;exports.CaptureTransportError=u;exports.HTTP_CLIENT_PATTERN=S;exports.HashSecretError=g;exports.agentIntent=P;exports.agentPolicy=V;exports.classifyAgent=v;exports.classifyRequest=p;exports.customAnalytics=F;exports.detectHeadless=b;exports.firstUserAgentProduct=M;exports.hashId=x;exports.isAiBot=f;exports.isHttpClient=m;exports.parseBotName=T;exports.posthogAnalytics=W;exports.randomSecret=w;exports.trackVisit=O;exports.webhookAnalytics=K;//# sourceMappingURL=index.cjs.map
+'use strict';var O=/ClaudeBot|Claude-User|Claude-SearchBot|Claude-Web|Anthropic|GPTBot|ChatGPT-User|OAI-SearchBot|PerplexityBot|Perplexity-User|Google-Extended|Google-CloudVertexBot|Google-Agent|GoogleAgent-Mariner|Gemini-Deep-Research|Applebot|cohere|Bytespider|CCBot|Amazonbot|Amzn-SearchBot|NovaAct|AzureAI-SearchBot|Meta-ExternalAgent|meta-externalfetcher|meta-webindexer|FacebookBot|DuckAssistBot|MistralAI-User|YouBot|AI2Bot|Diffbot|DeepSeek|PanguBot|Webzio-Extended|omgili|Timpibot|Grok|Manus-User|quillbot|MyCentralAIScraperBot|Cursor|Windsurf/i,G=/axios\/|curl\/|(?:^|[\s(])got(?:\/|[\s(])|\bcolly\b|Electron\/|node-fetch\/|python-requests\/|Go-http-client\/|okhttp\/|aiohttp\/|Deno\//i;function b(t){return t?O.test(t):false}function h(t){return t?G.test(t):false}function $(t){if(!t||typeof t!="string")return "Other";let e=t.toLowerCase();return e.includes("chatgpt-user")||e.includes("gptbot")||e.includes("oai-searchbot")||e.includes("openai")?"ChatGPT":e.includes("claudebot")||e.includes("claude-user")||e.includes("claude-searchbot")||e.includes("claude-web")||e.includes("anthropic")?"Claude":e.includes("perplexitybot")||e.includes("perplexity-user")?"Perplexity":e.includes("ccbot")?"Common Crawl":e.includes("google-extended")||e.includes("googlebot")||e.includes("google-cloudvertexbot")||e.includes("google-agent")||e.includes("googleagent-mariner")||e.includes("gemini-deep-research")?"Google":e.includes("applebot")?"Apple":e.includes("bingbot")?"Bing":e.includes("bytespider")?"Bytespider":e.includes("amazonbot")||e.includes("amzn-searchbot")||e.includes("novaact")?"Amazon":e.includes("meta-externalagent")||e.includes("meta-externalfetcher")||e.includes("meta-webindexer")||e.includes("facebookbot")?"Meta":e.includes("mistralai-user")?"Mistral":e.includes("duckassistbot")?"DuckDuckGo":e.includes("youbot")?"You.com":e.includes("diffbot")?"Diffbot":e.includes("ai2bot")?"AI2":e.includes("cohere")?"Cohere":e.includes("cursor")?"Cursor":e.includes("windsurf")?"Windsurf":e.includes("deepseek")?"DeepSeek":e.includes("pangubot")?"Huawei":e.includes("webzio")||e.includes("omgili")?"Webz.io":e.includes("timpibot")?"Timpi":e.includes("grok")||e.includes("xai-")?"xAI":e.includes("manus-user")?"Manus":e.includes("quillbot")?"QuillBot":e.includes("azureai-searchbot")?"Microsoft":e.includes("mycentralaiscraperbot")?"MyCentralAI":e.includes("petalbot")?"PetalBot":e.includes("ahrefsbot")?"Ahrefs":e.includes("semrushbot")?"Semrush":e.includes("mj12bot")?"Majestic":e.includes("dotbot")||e.includes("rogerbot")?"Moz":e.includes("screaming frog")?"Screaming Frog":e.includes("sitebulb")?"Sitebulb":e.includes("linkfluence")?"Linkfluence":e.includes("dataforseo")?"DataForSEO":e.includes("serpstatbot")?"Serpstat":e.includes("uptimerobot")?"UptimeRobot":e.includes("pingdom")?"Pingdom":e.includes("statuscake")?"StatusCake":e.includes("newrelicpinger")?"New Relic":e.includes("datadogagent")||e.includes("datadog")?"Datadog":e.includes("slackbot")?"Slack":e.includes("twitterbot")?"Twitter":e.includes("linkedinbot")?"LinkedIn":e.includes("discordbot")?"Discord":e.includes("telegrambot")?"Telegram":e.includes("whatsapp")?"WhatsApp":e.includes("linkupbot")?"Linkup":e.includes("sogou")?"Sogou":e.includes("yandexbot")?"Yandex":e.includes("baiduspider")?"Baidu":e.includes("facebookexternalhit")?"Facebook":e.includes("com.apple.webkit")?"Apple URL Preview":e.includes("ohdear")?"Oh Dear":e.includes("scrapy")?"Scrapy":e.includes("headlesschrome")?"Headless Chrome":e.includes("phantomjs")?"PhantomJS":e.includes("wget")?"wget":e.includes("httpie")?"HTTPie":e.includes("guzzlehttp")?"Guzzle":e.includes("electron/")?"Electron":/curl\//.test(e)?"curl":/axios\//.test(e)?"axios":/(?:^|[\s(])got(?:\/|[\s(])/.test(e)?"got":/\bcolly\b/.test(e)?"colly":/node-fetch\//.test(e)?"node-fetch":/python-requests\//.test(e)?"python-requests":/go-http-client\//.test(e)?"Go http client":/okhttp\//.test(e)?"OkHttp":/aiohttp\//.test(e)?"aiohttp":/deno\//.test(e)?"Deno":e.includes("mozilla")||e.includes("chrome")||e.includes("safari")||e.includes("firefox")?"Browser":"Other"}function H(t){if(!t||typeof t!="string")return "Other";let e=t.match(/compatible;\s*([^/;\s]+)(?:\/[^\s;]*)?/i);return e&&e[1]?e[1].trim():t.trim().split("/")[0]?.trim().split(/\s+/)[0]?.trim()||"Other"}function R(t){let e=[],n=(t.headers.get("user-agent")||"").toLowerCase();if(!(n.includes("mozilla")||n.includes("chrome")||n.includes("safari")||n.includes("firefox")))return {score:0,signals:[],likely:false};t.headers.get("accept-language")||e.push("missing-accept-language"),t.headers.get("sec-fetch-mode")||e.push("missing-sec-fetch-mode");let r=t.headers.get("sec-ch-ua");r?r.toLowerCase().includes("headlesschrome")&&e.push("headless-chrome-hint"):e.push("missing-sec-ch-ua");let s=t.headers.get("accept")||"";(!s||s==="*/*")&&e.push("missing-or-bare-accept"),(t.headers.get("connection")||"").toLowerCase()==="close"&&e.push("connection-close");let d=e.length;return {score:d,signals:e,likely:d>=2}}function _(t){let e=$(t),n=b(t),i=h(t),r;return n?r="declared-crawler":i?r="coding-agent-hint":e==="Browser"?r="browser":r="other",{kind:r,label:e,isAiBot:n,codingAgentHint:i}}function w(t){let e=t.headers.get("user-agent")||"",n=_(e),i=R(t),r=n.kind,s=n.label;return r==="browser"&&i.likely&&(r="headless-likely",s="Headless"),{...n,kind:r,label:s,headless:i}}var x=class extends Error{constructor(e){super(e),this.name="HashSecretError";}};function P(){let t=globalThis.crypto;if(!t?.subtle)throw new x("Web Crypto is unavailable. agent-analytics requires Node >= 20, or any runtime exposing globalThis.crypto.subtle (Vercel Edge, Cloudflare Workers, Deno, browsers).");return t.subtle}var I=new Map;function F(t){let e=I.get(t);return e||(e=P().importKey("raw",new TextEncoder().encode(t),{name:"HMAC",hash:"SHA-256"},false,["sign"]),I.set(t,e)),e}async function S(t,e){if(typeof e!="string"||e.length===0)throw new x("hashId requires a non-empty secret");let n=await P().sign("HMAC",await F(e),new TextEncoder().encode(t)),i=new Uint8Array(n,0,8),r="";for(let s of i)r+=s.toString(16).padStart(2,"0");return "anon_"+r}function C(){let t=new Uint8Array(32);P(),globalThis.crypto.getRandomValues(t);let e="";for(let n of t)e+=n.toString(16).padStart(2,"0");return e}var E,M=false;function z(t){if(t)return t;let e=typeof process<"u"?process.env?.AGENT_ANALYTICS_ID_SECRET:void 0;return e||(E||(E=C(),M||(M=true,console.warn("[agent-analytics] No idSecret or AGENT_ANALYTICS_ID_SECRET set. Using a per-instance random secret: distinctIds will not correlate across instances or deploys."))),E)}async function V(t,e){let n=t.headers.get("user-agent")||"",i=e.onlyBots??false,r=e.skipBrowsers??false;if(!(i&&!b(n))&&!(r&&!b(n)&&!h(n)&&!R(t).likely))try{let s="/",d="";try{let B=new URL(t.url);s=B.pathname,d=B.origin;}catch{s=t.url||"/";}let l=e.origin??d,f=(t.headers.get("x-forwarded-for")||"").split(",")[0]?.trim()??"",o=t.headers.get("referer"),a=e.captureCountry&&(t.headers.get("x-vercel-ip-country")||t.headers.get("cf-ipcountry")||t.headers.get("x-country-code"))||null,p=e.captureGeo?W(t):null,u=w(t),g=e.verify?await e.verify(t):null,D=u.kind==="headless-likely"||u.kind==="browser",j=await S(`${f}:${n}`,z(e.idSecret)),U={event:e.eventName??"agent_visit",distinctId:j,timestamp:new Date().toISOString(),properties:{...e.properties,$process_person_profile:!1,$current_url:l?`${l}${s}`:s,path:s,method:t.method,...e.captureCountry?{country_code:a}:{},...p??{},...e.captureIp?{client_ip:f||null}:{},user_agent:n,is_ai_bot:u.isAiBot,bot_name:u.label,ua_category:u.kind,coding_agent_hint:u.codingAgentHint,...D?{headless_score:u.headless?.score??0,headless_likely:u.headless?.likely??!1}:{},...g?{bot_verified:g.verified,bot_verification:g.verdict,...g.reason?{bot_verification_reason:g.reason}:{}}:{},referer:o,source:e.source??null}};await e.analytics.capture(U);}catch(s){e.onError?.(s instanceof Error?s:new Error(String(s)));}}function W(t){let e=r=>{if(!r)return "";try{return decodeURIComponent(r)}catch{return r}},n=[["region",e(t.headers.get("x-vercel-ip-country-region"))],["city",e(t.headers.get("x-vercel-ip-city"))],["latitude",t.headers.get("x-vercel-ip-latitude")??""],["longitude",t.headers.get("x-vercel-ip-longitude")??""],["timezone",t.headers.get("x-vercel-ip-timezone")??""]],i={};for(let[r,s]of n)s&&(i[r]=s);return i}var m=class extends Error{status;body;constructor(e,n,i){super(e),this.name="CaptureTransportError",this.status=n,this.body=i;}};var K=/ChatGPT-User|OAI-SearchBot|Claude-User|Claude-SearchBot|Perplexity-User|claude-code|DuckAssistBot|MistralAI-User|Gemini-Deep-Research|Manus-User|YouBot/i,Y=/GPTBot|ClaudeBot|Claude-Web|CCBot|Bytespider|Amazonbot|Amzn-SearchBot|Meta-ExternalAgent|meta-externalfetcher|meta-webindexer|FacebookBot|Google-Extended|Applebot-Extended|AI2Bot|Diffbot|omgili|Webzio-Extended|Timpibot|PanguBot|cohere|DeepSeek|Grok|quillbot|MyCentralAIScraperBot|NovaAct|AzureAI-SearchBot|Google-CloudVertexBot/i,X=/bingbot|Googlebot|DuckDuckBot|YandexBot|Baiduspider|PetalBot|Sogou|Applebot(?!-Extended)/i;function N(t){let e=t??"";return e?K.test(e)?"retrieval":Y.test(e)?"training":X.test(e)?"search":h(e)?"tooling":"unknown":"unknown"}function T(t,e={}){let n=t.headers.get("user-agent")||"",r=w(t).label,s=N(n);if(e.allowList?.some(a=>a===r||n.toLowerCase().includes(a.toLowerCase())))return {action:"allow",intent:s,label:r,reason:"on allowList"};let l=e.verification??(e.verify?e.verify(t):void 0),c;return l&&(c=l.verdict,c==="spoofed")?{action:"block",intent:s,label:r,verification:c,reason:`${r} claimed but client IP is outside its published ranges`}:{action:s==="training"?e.onTraining??"meter":s==="retrieval"?e.onRetrieval??"allow":s==="search"?e.onSearch??"allow":s==="tooling"?e.onTooling??"allow":"allow",intent:s,label:r,...c?{verification:c}:{},reason:{retrieval:"a person is waiting on this answer",training:"bulk corpus collection",search:"search index crawler",tooling:"coding agent or HTTP client",unknown:"not a recognised agent"}[s]}}var J="PAYMENT-REQUIRED",Q="PAYMENT-SIGNATURE",Z="PAYMENT-RESPONSE",ee="WWW-Authenticate",te="Authorization";function A(t){return `"${t.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`}function q(t){let e=JSON.stringify(t),n=new TextEncoder().encode(e),i="";for(let r of n)i+=String.fromCharCode(r);return btoa(i)}function y(t){if(!t.challenges.length)throw new Error("paymentRequired needs at least one challenge");let e=new Headers({"content-type":"text/plain; charset=utf-8","content-signal":t.contentSignal??"search=yes, ai-input=yes, ai-train=paid"});for(let n of t.challenges)if(n.protocol==="x402"){if(!n.accepts.length)throw new Error("an x402 challenge needs at least one entry in `accepts`");e.set(J,q({x402Version:n.x402Version??1,accepts:n.accepts}));}else {let i=[`id=${A(n.id)}`,`realm=${A(n.realm)}`,`method=${A(n.method)}`,...n.intent?[`intent=${A(n.intent)}`]:[],...n.request?[`request=${A(n.request)}`]:[]];e.append(ee,`Payment ${i.join(", ")}`);}for(let[n,i]of Object.entries(t.headers??{}))e.set(n,i);return new Response(t.body??`Payment required for training access.
+`,{status:402,headers:e})}function k(t){let e=t.headers.get(Q);if(e)return {protocol:"x402",value:e};let n=t.headers.get(te);if(n){let i=n.match(/^Payment\s+(.*)$/i);if(i?.[1])return {protocol:"mpp",value:i[1]}}return null}function ne(t){return k(t)!==null}function re(t,e,n={}){let i=new Headers(t.headers);return i.set(n.header??Z,q(e)),new Response(t.body,{status:t.status,statusText:t.statusText,headers:i})}function ie(t,e){return t.action==="block"?new Response(`Forbidden: agent identity could not be verified.
+`,{status:403}):t.action==="charge"?y({body:`Payment required: ${t.label} \u2014 ${t.reason}.
+`,...e}):null}function oe(t){return {async handle(e){let n=await t(e);return n.status===402?{status:"challenge",response:n.challenge}:{status:"paid",...n.withReceipt?{receipt:i=>n.withReceipt(i)}:{}}}}}function se(t){let{settle:e,receipt:n,...i}=t;return {async handle(r){let s=r.headers.get("PAYMENT-SIGNATURE");return s&&await e(s,r)?{status:"paid",...n?{receipt:n}:{}}:{status:"challenge",response:y(i)}}}}async function ae(t,e){let{gateway:n,onDecision:i,verify:r,meter:s,...d}=e,l=r?await r(t):void 0,c=T(t,{...d,...l?{verification:l}:{}});i?.(c);let f=a=>a;if(c.action==="block")return {decision:c,response:new Response(`Forbidden: agent identity could not be verified.
+`,{status:403}),decorate:f};if(c.action==="meter"){try{let a=t.url,p=t.method;try{a=new URL(t.url).pathname;}catch{}await s?.record({decision:c,units:1,path:a,method:p});}catch{}return {decision:c,response:null,decorate:f}}if(c.action!=="charge")return {decision:c,response:null,decorate:f};let o=await n.handle(t);return o.status==="challenge"?{decision:c,response:o.response,decorate:f}:{decision:c,response:null,decorate:o.receipt??f}}function L(t){let e=Math.round(t.validForSeconds/86400),n=e>=1?`${e} day${e===1?"":"s"}`:`${t.validForSeconds}s`;return t.description??`${t.units.toLocaleString("en-US")} ${t.unit} for ${n}, ${t.price}`}function le(t){let{store:e,offer:n,exposeRemaining:i,...r}=t;return {async handle(s){let d=k(s);if(d){let l=await e.lookup(d.value,s),c=Math.floor(Date.now()/1e3);if(l!==null&&(l.expiresAt===void 0||l.expiresAt>c)&&(l.remaining===void 0||l.remaining>0)&&l){await e.consume?.(l,s);let o=l.remaining===void 0?void 0:l.remaining-1;return {status:"paid",...i&&o!==void 0?{receipt:a=>{let p=new Headers(a.headers);return p.set("x-quota-remaining",String(Math.max(0,o))),new Response(a.body,{status:a.status,statusText:a.statusText,headers:p})}}:{}}}}return {status:"challenge",response:y({...r,body:`Payment required for training access.
+Offer: ${L(n)}
+`,headers:{...r.headers??{},"x-bulk-offer":L(n)}})}}}}function ce(t={}){let e=new Map(Object.entries(t));return {lookup:n=>e.get(n)??null,consume:n=>{n.remaining!==void 0&&e.set(n.id,{...n,remaining:n.remaining-1});},entries:()=>Object.fromEntries(e)}}function ue(t){return `'${JSON.stringify(t).replace(/'/g,"'\\''")}'`}function de(t){let e=[`vercel firewall rules add ${JSON.stringify(t.name)}`];if(t.groups.forEach((n,i)=>{i>0&&e.push("  --or");for(let r of n)e.push(`  --condition ${ue(r)}`);}),e.push(`  --action ${t.action}`),t.action==="rate_limit"&&t.rateLimit){e.push(`  --rate-limit-window ${t.rateLimit.window}`),e.push(`  --rate-limit-requests ${t.rateLimit.requests}`),e.push(`  --rate-limit-action ${t.rateLimit.action}`);for(let n of t.rateLimit.keys)e.push(`  --rate-limit-keys ${n}`);}return e.push("  --yes"),e.join(` \\
+`)}function pe(t){return {name:t.name,conditionGroup:t.groups.map(e=>({conditions:e})),action:{mitigate:{action:t.action}}}}function v(t){return {...t,cli:de(t),json:pe(t)}}function fe(t){if(!t.length)return 0;let e=[...t].sort((i,r)=>i-r),n=Math.floor(e.length/2);return e.length%2?e[n]:(e[n-1]+e[n])/2}function ge(t,e={}){let n=[];if(!e.omitProtectiveBypass){let o=t.filter(u=>u.intent==="retrieval"||u.intent==="search"),a=o.reduce((u,g)=>u+g.requests,0),p=[...new Set(o.map(u=>u.botName))];n.push(v({name:"Allow retrieval and search agents",rationale:"Retrieval agents and search crawlers must never be caught by the rules below \u2014 they bring readers and rankings.",evidence:a?`${a.toLocaleString("en-US")} observed requests across ${p.length} vendors (${p.slice(0,6).join(", ")})`:"no retrieval or search traffic observed yet; installed pre-emptively",groups:[[{type:"user_agent",op:"inc",value:["ChatGPT-User","OAI-SearchBot","Claude-User","Claude-SearchBot","Perplexity-User","Googlebot","bingbot","DuckDuckBot","Applebot"]}]],action:"bypass",eventual:"bypass",risk:"low",caveat:"Place this rule first (`vercel firewall rules reorder ... --first`). A user-agent allowlist is spoofable, so pair with verification in middleware rather than relying on it for security \u2014 its job here is to stop your own rules misfiring."}));}let i=t.filter(o=>o.verification==="spoofed"),r=[...new Set(i.map(o=>o.ip).filter(o=>!!o))];if(r.length){let o=i.reduce((p,u)=>p+u.requests,0),a=[...new Set(i.map(p=>p.botName))];n.push(v({name:"Deny impersonated crawler identities",rationale:"These addresses claimed a crawler identity that failed verification against the vendor\u2019s published ranges or signature.",evidence:`${o.toLocaleString("en-US")} requests from ${r.length} address${r.length===1?"":"es"} impersonating ${a.join(", ")}`,groups:[[{type:"ip_address",op:"inc",value:r}]],action:"log",eventual:"deny",risk:"low",caveat:"Verification failure is strong evidence, but confirm your edge controls x-forwarded-for before enforcing \u2014 behind a proxy that forwards a client-supplied header the verdict is worthless."}));}let s=t.filter(o=>o.ip&&o.verification!=="verified"),d=e.abuseThreshold??Math.max(500,Math.round(fe(s.map(o=>o.requests))*10)),l=s.filter(o=>o.requests>=d).sort((o,a)=>a.requests-o.requests).slice(0,50);if(l.length){let o=l.filter(a=>(a.distinctPaths??0)>100);n.push(v({name:"Rate limit high-volume unverified addresses",rationale:"A single address making orders of magnitude more requests than the median, with no verified identity.",evidence:`${l.length} address${l.length===1?"":"es"} above ${d.toLocaleString("en-US")} requests`+(o.length?`; ${o.length} swept >100 distinct paths, which reads as a scrape rather than a reader`:""),groups:[[{type:"ip_address",op:"inc",value:l.map(a=>a.ip)}]],action:"log",eventual:"rate_limit",rateLimit:{window:60,requests:60,action:"rate_limit",keys:["ip"]},risk:"medium",caveat:"Shared egress means one address can front many real users \u2014 a corporate NAT, a mobile carrier, or a VPN. Review the dashboard before enforcing."}));}let c=t.filter(o=>o.intent==="training");if(c.length){let o=c.reduce((u,g)=>u+g.requests,0),a=[...new Set(c.map(u=>u.botName))],p=e.trainingBudget??{window:3600,requests:600};n.push(v({name:"Rate limit training crawlers",rationale:"Bound what bulk corpus collection costs you without removing yourself from training sets.",evidence:`${o.toLocaleString("en-US")} training requests from ${a.length} vendors (${a.slice(0,6).join(", ")})`,groups:[[{type:"user_agent",op:"inc",value:["GPTBot","ClaudeBot","CCBot","Bytespider","Amazonbot","meta-externalagent"]}]],action:"log",eventual:"rate_limit",rateLimit:{window:p.window,requests:p.requests,action:"rate_limit",keys:["ip"]},risk:"medium",caveat:"Denying these removes you from future training sets, which may be exactly wrong for discoverability. Rate limit rather than deny unless you have decided otherwise. Note Vercel counters are per region, so N regions can collectively exceed the limit by ~Nx."}));}let f=[...new Set(t.filter(o=>o.asn!==void 0&&/Mozilla|Chrome|Safari/i.test(o.userAgent)).filter(o=>o.verification!=="verified").map(o=>o.asn))];if(f.length){let a=t.filter(p=>p.asn!==void 0&&f.includes(p.asn)).reduce((p,u)=>p+u.requests,0);n.push(v({name:"Challenge browser user agents from datacenter networks",rationale:"A browser user agent arriving from a hosting network is automation wearing a costume \u2014 real browsers come from consumer ISPs.",evidence:`${a.toLocaleString("en-US")} requests across ${f.length} datacenter AS numbers`,groups:[[{type:"geo_as_number",op:"inc",value:f},{type:"user_agent",op:"sub",value:"Mozilla"}]],action:"log",eventual:"challenge",risk:"high",caveat:"Highest false-positive risk here. Corporate VPNs, privacy relays and some mobile carriers egress from hosting ASNs, and a challenge page breaks API clients and link unfurlers outright. Keep this in log mode for a full week before considering enforcement."}));}return n}function me(t){let e=["#!/usr/bin/env bash","# Vercel WAF proposals generated from observed agent traffic.","#","# Every rule starts in LOG mode and blocks nothing. Vercel stages rule","# changes as drafts, so nothing is live until you run:","#","#   vercel firewall diff            # review","#   vercel firewall publish --yes   # go live","#","# Review each rule in the dashboard before promoting it to its eventual","# action. Rules evaluate top to bottom, so keep the bypass rule first.","set -euo pipefail",""];return t.forEach((n,i)=>{e.push(`# ${i+1}. ${n.name}`),e.push(`#    why:      ${n.rationale}`),e.push(`#    evidence: ${n.evidence}`),e.push(`#    risk:     ${n.risk} \u2014 eventual action: ${n.eventual}`),n.caveat&&e.push(`#    caveat:   ${n.caveat}`),e.push(n.cli),e.push("");}),t.length&&(e.push("# Keep the protective allow rule at the top of the evaluation order."),e.push(`vercel firewall rules reorder ${JSON.stringify(t[0].name)} --first --yes`),e.push(""),e.push("vercel firewall diff"),e.push('echo "Review above, then: vercel firewall publish --yes"')),e.join(`
+`)}function he(t){let e=t.host??"https://us.i.posthog.com",n=(/^https?:\/\//.test(e)?e:`https://${e}`).replace(/\/$/,""),i=(t.path??"/i/v0/e/").replace(/^(?!\/)/,"/"),r=`${n}${i}`,s=t.fetchImpl??fetch;return {async capture(d){let l=d.properties.user_agent,c=d.properties.client_ip,f={api_key:t.apiKey,event:d.event,distinct_id:d.distinctId,timestamp:d.timestamp,properties:{...d.properties,...typeof l=="string"&&l?{$raw_user_agent:l}:{},...typeof c=="string"&&c?{$ip:c}:{}}},o=await s(r,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(f),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!o.ok)throw new m(`PostHog capture failed: ${o.status} ${o.statusText}`,o.status,await o.text().catch(()=>{}))}}}function ye(t){let e=t.fetchImpl??fetch,n=t.transform??(i=>i);return {async capture(i){let r=await e(t.url,{method:"POST",headers:{"Content-Type":"application/json",...t.headers??{}},body:JSON.stringify(n(i)),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!r.ok)throw new m(`Webhook capture failed: ${r.status} ${r.statusText}`,r.status,await r.text().catch(()=>{}))}}}function be(t){return {capture:t}}
+exports.AI_BOT_PATTERN=O;exports.CaptureTransportError=m;exports.HTTP_CLIENT_PATTERN=G;exports.HashSecretError=x;exports.agentIntent=N;exports.agentPolicy=T;exports.classifyAgent=_;exports.classifyRequest=w;exports.customAnalytics=be;exports.detectHeadless=R;exports.entitlementGateway=le;exports.firewallScript=me;exports.firstUserAgentProduct=H;exports.hasPaymentPayload=ne;exports.hashId=S;exports.isAiBot=b;exports.isHttpClient=h;exports.memoryEntitlementStore=ce;exports.mppxGateway=oe;exports.parseBotName=$;exports.paymentGate=ae;exports.paymentPayload=k;exports.paymentRequired=y;exports.posthogAnalytics=he;exports.randomSecret=C;exports.recommendFirewallRules=ge;exports.respondToDecision=ie;exports.trackVisit=V;exports.webhookAnalytics=ye;exports.withSettlement=re;exports.x402Gateway=se;//# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map