@apideck/agent-analytics 0.13.0 → 0.15.0

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { T as TrackVisitOptions, B as BotVerificationLike, C as CaptureEvent, A as AnalyticsAdapter } from './types-sQoQK-ox.cjs';
+import { T as TrackVisitOptions, B as BotVerificationLike, C as CaptureEvent, A as AnalyticsAdapter } from './types-Dw43eu7D.cjs';
 export { posthogAnalytics } from './adapters/posthog.cjs';
 export { webhookAnalytics } from './adapters/webhook.cjs';
 
@@ -219,6 +219,16 @@ interface AgentPolicyOptions {
      * an attacker picks their own verdict.
      */
     verify?: (req: Request) => BotVerificationLike;
+    /**
+     * A verification already computed elsewhere. Use this when your verifier is
+     * async — {@link verifyWebBotAuth} fetches a key directory, so the natural
+     * verifier from `@apideck/agent-analytics/verify` returns a promise and
+     * cannot be passed to `verify` on this synchronous function.
+     *
+     * {@link paymentGate} does this for you: it awaits the verifier and forwards
+     * the result here.
+     */
+    verification?: BotVerificationLike;
     /** What to do with bulk training crawlers. Defaults to `'meter'`. */
     onTraining?: AgentAction;
     /** What to do with retrieval agents. Defaults to `'allow'` — see AgentIntent. */
@@ -230,7 +240,16 @@ interface AgentPolicyOptions {
     /** Vendor labels or UA substrings always allowed, whatever the intent. */
     allowList?: readonly string[];
 }
-/** Classify why an agent is here, from its user agent alone. */
+/**
+ * Classify why an agent is here, from its user agent alone.
+ *
+ * This must return exactly what {@link agentPolicy} reports for the same UA.
+ * It previously did not: the `tooling` promotion for HTTP-library UAs lived
+ * only inside `agentPolicy`, so `agentIntent('curl/8.4.0')` said `'unknown'`
+ * while the policy said `'tooling'` — two exported functions disagreeing on
+ * every HTTP client, with no way for a caller to know which was right. The
+ * invariant is pinned by a test.
+ */
 declare function agentIntent(userAgent: string | null | undefined): AgentIntent;
 /**
  * Decide what to do with a request. Pure classification plus policy — no
@@ -246,6 +265,536 @@ declare function agentIntent(userAgent: string | null | undefined): AgentIntent;
  */
 declare function agentPolicy(req: Request, opts?: AgentPolicyOptions): AgentDecision;
 
+/**
+ * Charge for training crawls. **EXPERIMENTAL.**
+ *
+ * The protocols this speaks are weeks old and moving. x402 and MPP are both
+ * live but their specs are unstable, MPP's settlement-confirmation header was
+ * not pinned publicly at the time of writing, and no agent in our production
+ * traffic has yet presented a payment credential. Expect this API to change
+ * without a major version while that settles — everything else in the package
+ * is stable, this is not.
+ *
+ * Today the industry's answer to bulk AI crawling is `Disallow` — over 2.5
+ * million sites block AI training in robots.txt. That leaves money on the
+ * table and depends on the crawler's goodwill to work at all.
+ *
+ * The alternative is to let them train and price it. That only works if you
+ * can tell training from retrieval, because they have opposite economics: a
+ * `GPTBot` fetch is corpus collection you get nothing back for, while a
+ * `ChatGPT-User` fetch is a person asking about you — charging for the second
+ * is charging for your own distribution. {@link agentPolicy} draws that line;
+ * this module turns a `'charge'` decision into the HTTP challenge.
+ *
+ * Two protocols, one status code. Both settle at the HTTP layer and both use
+ * 402, but the framing differs:
+ *
+ *   x402  PAYMENT-REQUIRED: <base64 JSON>      -> PAYMENT-SIGNATURE
+ *   MPP   WWW-Authenticate: Payment id="…"     -> Authorization: Payment …
+ *
+ * MPP reuses standard HTTP authentication framing; x402 defines its own
+ * headers. They do not collide, so a single 402 can advertise both and let the
+ * agent pick — which is what {@link paymentRequired} does when given both.
+ *
+ * Scope: this emits the 402 and reads the client's payment header. It does not
+ * settle anything. Settlement belongs to an x402 facilitator or Stripe's MPP —
+ * a library that held money would inherit PCI scope and stop being something
+ * you can drop into middleware.
+ */
+
+/**
+ * One way a client may pay. Field names follow x402's `PaymentRequirements`;
+ * values are yours — the library never invents an amount, network or asset.
+ */
+interface PaymentRequirements {
+    scheme: string;
+    network: string;
+    maxAmountRequired: string;
+    resource: string;
+    description?: string;
+    mimeType?: string;
+    payTo: string;
+    maxTimeoutSeconds?: number;
+    asset: string;
+    extra?: Record<string, unknown>;
+}
+/** Which settlement protocol a challenge speaks. */
+type PaymentProtocol = 'x402' | 'mpp';
+/** x402: base64 JSON in a `PAYMENT-REQUIRED` header. */
+interface X402Challenge {
+    protocol: 'x402';
+    /** Accepted payment methods, in preference order. At least one. */
+    accepts: readonly PaymentRequirements[];
+    /** Protocol version. Defaults to 1. */
+    x402Version?: number;
+}
+/**
+ * MPP: an RFC 9110 `WWW-Authenticate: Payment` challenge.
+ *
+ * Field values are yours. `request` carries the encoded challenge payload your
+ * MPP provider generates — the library does not construct or price it.
+ */
+interface MppChallenge {
+    protocol: 'mpp';
+    /** Challenge identifier. */
+    id: string;
+    /** Authentication realm. */
+    realm: string;
+    /** Payment method, e.g. `'tempo'`. */
+    method: string;
+    /** Transaction intent, e.g. `'charge'`. */
+    intent?: string;
+    /** Encoded challenge data from your provider. */
+    request?: string;
+}
+type PaymentChallenge = X402Challenge | MppChallenge;
+interface PaymentChallengeOptions {
+    /**
+     * Challenges to advertise. Supplying both an x402 and an MPP challenge is
+     * valid and usually correct: they use non-colliding headers, so one 402 can
+     * offer both and the agent takes whichever it speaks.
+     */
+    challenges: readonly PaymentChallenge[];
+    /**
+     * `Content-Signal` to send with the challenge. Defaults to
+     * `search=yes, ai-input=yes, ai-train=paid` — the whole point being that
+     * training is available rather than forbidden.
+     */
+    contentSignal?: string;
+    /** Extra response headers. */
+    headers?: Record<string, string>;
+    /** Human-readable body. Agents read the header; people read logs. */
+    body?: string;
+}
+/**
+ * Build a 402 challenge.
+ *
+ * @example
+ * ```ts
+ * const decision = agentPolicy(req, { onTraining: 'charge' })
+ * if (decision.action === 'charge') {
+ *   return paymentRequired({
+ *     challenges: [
+ *       {
+ *         protocol: 'x402',
+ *         accepts: [{
+ *           scheme: 'exact',
+ *           network: 'base',
+ *           maxAmountRequired: '1000',     // your price, your units
+ *           resource: req.url,
+ *           payTo: process.env.WALLET!,
+ *           asset: process.env.USDC!
+ *         }]
+ *       },
+ *       { protocol: 'mpp', id: challengeId, realm: 'example.com', method: 'tempo', intent: 'charge' }
+ *     ]
+ *   })
+ * }
+ * ```
+ */
+declare function paymentRequired(opts: PaymentChallengeOptions): Response;
+/** A payment credential the client sent back, and which protocol it speaks. */
+interface SubmittedPayment {
+    protocol: PaymentProtocol;
+    /** Raw header value, for handing to a facilitator. */
+    value: string;
+}
+/**
+ * Read the client's payment credential, whichever protocol it used.
+ *
+ * x402 sends `PAYMENT-SIGNATURE`; MPP sends `Authorization: Payment …`. The
+ * `Payment` scheme check matters — a site behind normal auth will also have a
+ * Bearer or Basic `Authorization` header, and mistaking that for a payment
+ * would be a security-relevant confusion.
+ */
+declare function paymentPayload(req: Request): SubmittedPayment | null;
+/**
+ * True when the client attached a payment credential — i.e. this is the retry
+ * after a 402, not a fresh unpaid request.
+ *
+ * Presence is not proof. Hand the value to your facilitator to verify and
+ * settle; only then serve the resource.
+ */
+declare function hasPaymentPayload(req: Request): boolean;
+/**
+ * Attach a facilitator's settlement result to a successful response.
+ *
+ * x402 defines `PAYMENT-RESPONSE` for this. MPP's public spec did not pin a
+ * settlement-confirmation header at the time of writing, so pass `header` to
+ * name whatever your provider expects rather than have the library guess.
+ */
+declare function withSettlement(res: Response, settlement: unknown, opts?: {
+    header?: string;
+}): Response;
+/**
+ * Convenience: turn an {@link AgentDecision} straight into a response, or
+ * `null` when the request should simply be served.
+ *
+ * Returns 403 for `'block'`, a 402 challenge for `'charge'`, and `null` for
+ * `'allow'` and `'meter'` — metering is an accounting concern, not a gate, so
+ * the request still gets served while `trackVisit` records it.
+ */
+declare function respondToDecision(decision: AgentDecision, opts: PaymentChallengeOptions): Response | null;
+
+/**
+ * The paid-access gate: policy decides *whether* to charge, a gateway decides
+ * *how*. **EXPERIMENTAL** — see `payments.ts`. The classification and policy
+ * layers underneath are stable; the payment surface is not.
+ *
+ * The split matters. We own classification — telling a training crawl from a
+ * retrieval fetch, which is the part nobody else does and the part that makes
+ * charging sane. Settlement is somebody else's job: Stripe's MPP SDK, an x402
+ * facilitator, whatever comes next. A library that held money would inherit PCI
+ * scope and stop being something you drop into middleware.
+ *
+ * So gateways are injected, exactly like analytics adapters, and this module
+ * takes no dependency on Stripe or any chain.
+ */
+
+/**
+ * Outcome of handing a request to a payment gateway.
+ *
+ * - `challenge` — respond with this. The client has not paid.
+ * - `paid` — settled; serve the resource. `receipt` decorates the response with
+ *   whatever proof the protocol expects.
+ */
+type GatewayResult = {
+    status: 'challenge';
+    response: Response;
+} | {
+    status: 'paid';
+    receipt?: (res: Response) => Response;
+};
+interface PaymentGateway {
+    handle(req: Request): Promise<GatewayResult>;
+}
+/**
+ * Wrap Stripe's MPP SDK.
+ *
+ * `Mppx.compose(...)` returns a handler that either yields a 402 with a
+ * `.challenge` response, or a settled result with `.withReceipt(res)`. This
+ * adapts that shape without importing it — pass the composed handler in.
+ *
+ * @example
+ * ```ts
+ * const mppx = Mppx.create({ methods: [...], secretKey })
+ * const handler = Mppx.compose(
+ *   mppx.tempo.charge({ amount: '0.01', recipient }),
+ *   mppx.stripe.charge({ amount: '0.50', currency: 'usd' })
+ * )
+ * const gateway = mppxGateway(handler)
+ * ```
+ */
+declare function mppxGateway(handler: (req: Request) => Promise<MppxResponse> | MppxResponse): PaymentGateway;
+/** The subset of Stripe's MPP response we rely on. Structural, not imported. */
+interface MppxResponse {
+    status: number;
+    challenge: Response;
+    withReceipt?: (res: Response) => Response;
+}
+interface X402GatewayOptions extends PaymentChallengeOptions {
+    /**
+     * Verify and settle a `PAYMENT-SIGNATURE` payload with your facilitator.
+     * Resolve truthy to serve the resource, falsy to re-challenge.
+     */
+    settle: (payload: string, req: Request) => Promise<boolean> | boolean;
+    /** Attach the facilitator's settlement result to the served response. */
+    receipt?: (res: Response) => Response;
+}
+/**
+ * Gateway using this library's own challenge builder plus a facilitator you
+ * supply. For x402, or for MPP if you are not using Stripe's SDK.
+ */
+declare function x402Gateway(opts: X402GatewayOptions): PaymentGateway;
+/** One unit of billable agent traffic. */
+interface MeterRecord {
+    decision: AgentDecision;
+    /** Units consumed. One request is one unit unless you price by bytes or tokens. */
+    units: number;
+    path: string;
+    method: string;
+}
+/**
+ * Where billable usage goes.
+ *
+ * Metering is the model to ship first: it needs no crawler cooperation, works
+ * today, and produces the number you would negotiate a licence with. Charging
+ * per request is what the protocols define but not what a training sweep can
+ * actually do — no crawler in the wild retries a 402.
+ */
+interface Meter {
+    record(entry: MeterRecord): Promise<void> | void;
+}
+interface PaymentGateOptions extends Omit<AgentPolicyOptions, 'verify'> {
+    gateway: PaymentGateway;
+    /**
+     * Sink for billable traffic. Called for every `'meter'` decision — serve the
+     * request, count it, bill out of band.
+     *
+     * Errors are swallowed: a metering failure must not turn into a failed
+     * response, for the same reason analytics failures do not.
+     */
+    meter?: Meter;
+    /**
+     * Identity verifier, sync or async. Unlike {@link agentPolicy}'s option this
+     * accepts a promise, because `paymentGate` is already async and can await it.
+     * That matters: `combinedVerifier()` and `webBotAuthVerifier()` are async by
+     * necessity — Web Bot Auth fetches the signer's key directory — so without
+     * this they could not be used with policy or payments at all.
+     */
+    verify?: (req: Request) => BotVerificationLike | Promise<BotVerificationLike>;
+    /**
+     * Called for every decision, paid or not — wire it to your metering so
+     * `'meter'` traffic is actually counted rather than merely allowed.
+     */
+    onDecision?: (decision: AgentDecision) => void;
+}
+/**
+ * Full gate: classify, decide, and either let the request through or return the
+ * response it should get instead.
+ *
+ * Returns `null` when the request should be served normally. That covers
+ * `'allow'`, `'meter'` (accounting, not a gate) and any request that has already
+ * paid — in which case `receipt` is handed back so you can decorate the response
+ * you were going to send anyway.
+ *
+ * @example
+ * ```ts
+ * const gate = await paymentGate(req, {
+ *   onTraining: 'charge',
+ *   verify: combinedVerifier(),
+ *   gateway: mppxGateway(handler),
+ *   onDecision: (d) => void trackVisit(req, { analytics, properties: { action: d.action } })
+ * })
+ * if (gate.response) return gate.response
+ * return gate.decorate(await serve(req))
+ * ```
+ */
+declare function paymentGate(req: Request, opts: PaymentGateOptions): Promise<{
+    decision: AgentDecision;
+    /** Respond with this instead of serving, when set. */
+    response: Response | null;
+    /** Wrap the response you were going to send. Identity when nothing to add. */
+    decorate: (res: Response) => Response;
+}>;
+
+/**
+ * Quota and entitlements — the model that actually works for training crawls.
+ * **EXPERIMENTAL**, like the rest of the payment surface.
+ *
+ * Per-request 402 is what x402 and MPP define, and it is the wrong shape for a
+ * training sweep. On one production site training traffic is ~199,000 requests a
+ * month. Charging each one means three times the traffic (402, pay, retry),
+ * 199,000 settlements whose per-transaction cost exceeds any sane per-page
+ * price, and — decisively — no crawler in the wild implements the retry, so a
+ * per-request 402 is just blocking with extra steps.
+ *
+ * Two workable shapes instead, both supported here:
+ *
+ *   METER      Serve the request, count it, bill out of band. Needs no crawler
+ *              cooperation and works today. This is the one to ship.
+ *
+ *   ENTITLEMENT  Challenge once with a bulk offer, take payment, issue a
+ *              credential. Every later request presents it and is served
+ *              directly, decrementing quota. One settlement per licence rather
+ *              than per page.
+ *
+ * MPP's reusable `Authorization: Payment` credential fits entitlements better
+ * than x402's per-resource signature, which proves payment for one URL.
+ */
+
+/** What a buyer holds after paying. */
+interface Entitlement {
+    /** Opaque licence id, for your own accounting. */
+    id: string;
+    /**
+     * Units left. Omit for an unmetered licence — `consume` is still called, so
+     * you can count without capping.
+     */
+    remaining?: number;
+    /** Expiry as epoch seconds. Omit for no expiry. */
+    expiresAt?: number;
+}
+/**
+ * Where entitlements live. A KV namespace, Redis, your database — anything
+ * reachable from the edge. The library deliberately ships no storage: quota
+ * state is yours, and so is the money it represents.
+ */
+interface EntitlementStore {
+    /** Resolve the credential a client presented. Return null to challenge. */
+    lookup(credential: string, req: Request): Promise<Entitlement | null> | Entitlement | null;
+    /**
+     * Record consumption after a request is admitted. Called for every served
+     * request, including unmetered licences, so this doubles as your meter.
+     */
+    consume?(entitlement: Entitlement, req: Request): Promise<void> | void;
+}
+/**
+ * What is for sale. Folded into the challenge so an agent sees a bulk product
+ * rather than a price for the single page it happened to ask for.
+ */
+interface BulkOffer {
+    /** e.g. 1_000_000 */
+    units: number;
+    /** e.g. `'pages'` */
+    unit: string;
+    /** Licence lifetime in seconds. */
+    validForSeconds: number;
+    /** Total price, in whatever units your challenge already uses. */
+    price: string;
+    /** Summary surfaced to the agent. */
+    description?: string;
+}
+interface EntitlementGatewayOptions extends PaymentChallengeOptions {
+    store: EntitlementStore;
+    /** The bulk product the 402 advertises. */
+    offer: BulkOffer;
+    /**
+     * Emit `x-quota-remaining` on served responses so a paying crawler can see
+     * its balance and slow down before running out.
+     *
+     * Off by default: this header is **not** part of x402 or MPP. It is a
+     * convenience, and a crawler that does not know it will ignore it.
+     */
+    exposeRemaining?: boolean;
+}
+/**
+ * Gateway that honours a bulk licence instead of charging per request.
+ *
+ * A request carrying a valid credential is served and its quota decremented —
+ * no challenge, no round-trip. A request without one gets a single 402
+ * advertising the bulk offer.
+ *
+ * @example
+ * ```ts
+ * const gateway = entitlementGateway({
+ *   store: myKvStore,
+ *   offer: { units: 1_000_000, unit: 'pages', validForSeconds: 2_592_000, price: '$400' },
+ *   challenges: [{ protocol: 'mpp', id, realm: 'example.com', method: 'tempo' }]
+ * })
+ * ```
+ */
+declare function entitlementGateway(opts: EntitlementGatewayOptions): PaymentGateway;
+/**
+ * In-memory store. For tests and local development only — an edge runtime
+ * gives each instance its own memory, so quota would neither be shared nor
+ * survive a deploy. Use KV, Redis, or your database in production.
+ */
+declare function memoryEntitlementStore(seed?: Record<string, Entitlement>): EntitlementStore & {
+    entries(): Record<string, Entitlement>;
+};
+
+/**
+ * Recommend Vercel WAF rules from observed agent traffic.
+ *
+ * This generates *proposals*, never live changes. Every recommendation comes out
+ * with `action: 'log'`, because a firewall rule's blast radius is unpredictable
+ * until real traffic hits it and a bad `deny` takes out real users or your SEO.
+ * Vercel's own guidance is log → review → preview → production; the `eventual`
+ * field records where a rule is meant to end up, and `cli` emits the command for
+ * the *current* stage only.
+ *
+ * Two hard rules, both from measurement rather than taste:
+ *
+ *   1. Retrieval agents and search crawlers are never proposed for blocking.
+ *      60% of AI traffic on one production site is retrieval — a person asked a
+ *      question and an assistant went to read the page. Blocking that is
+ *      blocking your own distribution. The recommender emits a `bypass` rule to
+ *      protect them *first*, so later rules cannot catch them.
+ *
+ *   2. Training crawlers get rate limits, not denials, by default. The point is
+ *      to bound cost, not to disappear from corpora.
+ *
+ * Only abuse gets a denial: an identity that failed cryptographic or IP
+ * verification, or a single address behaving like a scraper.
+ */
+
+/** A Vercel WAF condition. Mirrors the CLI's `--condition` JSON. */
+interface FirewallCondition {
+    type: 'user_agent' | 'ip_address' | 'geo_as_number' | 'geo_country' | 'path' | 'method' | 'environment' | 'ja4_digest';
+    op: 'eq' | 'neq' | 'sub' | 'pre' | 'suf' | 're' | 'inc' | 'ninc' | 'gt' | 'gte';
+    value?: string | number | Array<string | number>;
+    key?: string;
+    neg?: boolean;
+}
+type FirewallAction = 'log' | 'deny' | 'challenge' | 'bypass' | 'rate_limit';
+interface RateLimitSpec {
+    /** Seconds, 10–3600. */
+    window: number;
+    /** Max requests per window. */
+    requests: number;
+    /** What happens on breach. */
+    action: 'rate_limit' | 'deny' | 'challenge' | 'log';
+    keys: Array<'ip' | 'ja4'>;
+}
+interface FirewallRecommendation {
+    name: string;
+    /** Why this rule is proposed, in one sentence. */
+    rationale: string;
+    /** The measurement behind it. Never propose a rule without evidence. */
+    evidence: string;
+    /** OR of ANDs: outer array is groups, inner is conditions within a group. */
+    groups: FirewallCondition[][];
+    /** Always `'log'` or `'bypass'` — see the module note. */
+    action: FirewallAction;
+    /** Where this rule is intended to end up after review. */
+    eventual: FirewallAction;
+    rateLimit?: RateLimitSpec;
+    /** How likely this is to catch traffic you wanted. */
+    risk: 'low' | 'medium' | 'high';
+    /** What could go wrong, when it is not obvious. */
+    caveat?: string;
+    /** Ready-to-run CLI for the *current* stage. */
+    cli: string;
+    /** Equivalent `--json` payload. */
+    json: unknown;
+}
+/** One aggregated slice of observed traffic. */
+interface TrafficObservation {
+    userAgent: string;
+    botName: string;
+    intent: AgentIntent;
+    requests: number;
+    ip?: string;
+    /** Autonomous system number, if you resolved one. */
+    asn?: number;
+    /** Distinct paths this slice touched — a scraper sweeps, a reader does not. */
+    distinctPaths?: number;
+    /** Verification verdict, if you ran one. */
+    verification?: 'verified' | 'spoofed' | 'unverifiable' | 'not-claimed';
+    country?: string;
+}
+interface RecommendOptions {
+    /**
+     * Requests-per-slice above which a single IP is considered abusive. Defaults
+     * to 10x the median across observations, floored at 500.
+     */
+    abuseThreshold?: number;
+    /** Rate-limit budget proposed for training crawlers. Defaults to 600/hour. */
+    trainingBudget?: {
+        window: number;
+        requests: number;
+    };
+    /** Skip the protective bypass rule. Rarely a good idea. */
+    omitProtectiveBypass?: boolean;
+}
+/**
+ * Turn observations into staged WAF proposals.
+ *
+ * @example
+ * ```ts
+ * const rules = recommendFirewallRules(observations)
+ * for (const r of rules) {
+ *   console.log(`# ${r.name} — ${r.rationale}`)
+ *   console.log(`# evidence: ${r.evidence}`)
+ *   console.log(r.cli)
+ * }
+ * ```
+ */
+declare function recommendFirewallRules(observations: readonly TrafficObservation[], opts?: RecommendOptions): FirewallRecommendation[];
+/** Render recommendations as a runnable, commented shell script. */
+declare function firewallScript(recommendations: readonly FirewallRecommendation[]): string;
+
 /**
  * Escape hatch for wiring a callback directly as an analytics adapter.
  * Useful when you want to log events, pipe them through your own SDK, or
@@ -258,4 +807,4 @@ declare function agentPolicy(req: Request, opts?: AgentPolicyOptions): AgentDeci
  */
 declare function customAnalytics(capture: (event: CaptureEvent) => Promise<void> | void): AnalyticsAdapter;
 
-export { AI_BOT_PATTERN, type AgentAction, type AgentClassification, type AgentDecision, type AgentIntent, type AgentKind, type AgentPolicyOptions, AnalyticsAdapter, BotVerificationLike, CaptureEvent, CaptureTransportError, HTTP_CLIENT_PATTERN, HashSecretError, type HeadlessDetection, TrackVisitOptions, agentIntent, agentPolicy, classifyAgent, classifyRequest, customAnalytics, detectHeadless, firstUserAgentProduct, hashId, isAiBot, isHttpClient, parseBotName, randomSecret, trackVisit };
+export { AI_BOT_PATTERN, type AgentAction, type AgentClassification, type AgentDecision, type AgentIntent, type AgentKind, type AgentPolicyOptions, AnalyticsAdapter, BotVerificationLike, type BulkOffer, CaptureEvent, CaptureTransportError, type Entitlement, type EntitlementGatewayOptions, type EntitlementStore, type FirewallAction, type FirewallCondition, type FirewallRecommendation, type GatewayResult, HTTP_CLIENT_PATTERN, HashSecretError, type HeadlessDetection, type Meter, type MeterRecord, type MppChallenge, type MppxResponse, type PaymentChallenge, type PaymentChallengeOptions, type PaymentGateOptions, type PaymentGateway, type PaymentProtocol, type PaymentRequirements, type RateLimitSpec, type RecommendOptions, type SubmittedPayment, TrackVisitOptions, type TrafficObservation, type X402Challenge, type X402GatewayOptions, agentIntent, agentPolicy, classifyAgent, classifyRequest, customAnalytics, detectHeadless, entitlementGateway, firewallScript, firstUserAgentProduct, hasPaymentPayload, hashId, isAiBot, isHttpClient, memoryEntitlementStore, mppxGateway, parseBotName, paymentGate, paymentPayload, paymentRequired, randomSecret, recommendFirewallRules, respondToDecision, trackVisit, withSettlement, x402Gateway };