@apideck/agent-analytics 0.14.0 → 0.16.0

package/dist/gateway-YJL5J0LR.d.ts

@@ -0,0 +1,317 @@
+import { b as AgentDecision, c as AgentPolicyOptions } from './policy-DMTBUe4F.js';
+import { B as BotVerificationLike } from './types-Dw43eu7D.js';
+
+/**
+ * Charge for training crawls. **EXPERIMENTAL.**
+ *
+ * The protocols this speaks are weeks old and moving. x402 and MPP are both
+ * live but their specs are unstable, MPP's settlement-confirmation header was
+ * not pinned publicly at the time of writing, and no agent in our production
+ * traffic has yet presented a payment credential. Expect this API to change
+ * without a major version while that settles — everything else in the package
+ * is stable, this is not.
+ *
+ * Today the industry's answer to bulk AI crawling is `Disallow` — over 2.5
+ * million sites block AI training in robots.txt. That leaves money on the
+ * table and depends on the crawler's goodwill to work at all.
+ *
+ * The alternative is to let them train and price it. That only works if you
+ * can tell training from retrieval, because they have opposite economics: a
+ * `GPTBot` fetch is corpus collection you get nothing back for, while a
+ * `ChatGPT-User` fetch is a person asking about you — charging for the second
+ * is charging for your own distribution. {@link agentPolicy} draws that line;
+ * this module turns a `'charge'` decision into the HTTP challenge.
+ *
+ * Two protocols, one status code. Both settle at the HTTP layer and both use
+ * 402, but the framing differs:
+ *
+ *   x402  PAYMENT-REQUIRED: <base64 JSON>      -> PAYMENT-SIGNATURE
+ *   MPP   WWW-Authenticate: Payment id="…"     -> Authorization: Payment …
+ *
+ * MPP reuses standard HTTP authentication framing; x402 defines its own
+ * headers. They do not collide, so a single 402 can advertise both and let the
+ * agent pick — which is what {@link paymentRequired} does when given both.
+ *
+ * Scope: this emits the 402 and reads the client's payment header. It does not
+ * settle anything. Settlement belongs to an x402 facilitator or Stripe's MPP —
+ * a library that held money would inherit PCI scope and stop being something
+ * you can drop into middleware.
+ */
+
+/**
+ * One way a client may pay. Field names follow x402's `PaymentRequirements`;
+ * values are yours — the library never invents an amount, network or asset.
+ */
+interface PaymentRequirements {
+    scheme: string;
+    network: string;
+    maxAmountRequired: string;
+    resource: string;
+    description?: string;
+    mimeType?: string;
+    payTo: string;
+    maxTimeoutSeconds?: number;
+    asset: string;
+    extra?: Record<string, unknown>;
+}
+/** Which settlement protocol a challenge speaks. */
+type PaymentProtocol = 'x402' | 'mpp';
+/** x402: base64 JSON in a `PAYMENT-REQUIRED` header. */
+interface X402Challenge {
+    protocol: 'x402';
+    /** Accepted payment methods, in preference order. At least one. */
+    accepts: readonly PaymentRequirements[];
+    /** Protocol version. Defaults to 1. */
+    x402Version?: number;
+}
+/**
+ * MPP: an RFC 9110 `WWW-Authenticate: Payment` challenge.
+ *
+ * Field values are yours. `request` carries the encoded challenge payload your
+ * MPP provider generates — the library does not construct or price it.
+ */
+interface MppChallenge {
+    protocol: 'mpp';
+    /** Challenge identifier. */
+    id: string;
+    /** Authentication realm. */
+    realm: string;
+    /** Payment method, e.g. `'tempo'`. */
+    method: string;
+    /** Transaction intent, e.g. `'charge'`. */
+    intent?: string;
+    /** Encoded challenge data from your provider. */
+    request?: string;
+}
+type PaymentChallenge = X402Challenge | MppChallenge;
+interface PaymentChallengeOptions {
+    /**
+     * Challenges to advertise. Supplying both an x402 and an MPP challenge is
+     * valid and usually correct: they use non-colliding headers, so one 402 can
+     * offer both and the agent takes whichever it speaks.
+     */
+    challenges: readonly PaymentChallenge[];
+    /**
+     * `Content-Signal` to send with the challenge. Defaults to
+     * `search=yes, ai-input=yes, ai-train=paid` — the whole point being that
+     * training is available rather than forbidden.
+     */
+    contentSignal?: string;
+    /** Extra response headers. */
+    headers?: Record<string, string>;
+    /** Human-readable body. Agents read the header; people read logs. */
+    body?: string;
+}
+/**
+ * Build a 402 challenge.
+ *
+ * @example
+ * ```ts
+ * const decision = agentPolicy(req, { onTraining: 'charge' })
+ * if (decision.action === 'charge') {
+ *   return paymentRequired({
+ *     challenges: [
+ *       {
+ *         protocol: 'x402',
+ *         accepts: [{
+ *           scheme: 'exact',
+ *           network: 'base',
+ *           maxAmountRequired: '1000',     // your price, your units
+ *           resource: req.url,
+ *           payTo: process.env.WALLET!,
+ *           asset: process.env.USDC!
+ *         }]
+ *       },
+ *       { protocol: 'mpp', id: challengeId, realm: 'example.com', method: 'tempo', intent: 'charge' }
+ *     ]
+ *   })
+ * }
+ * ```
+ */
+declare function paymentRequired(opts: PaymentChallengeOptions): Response;
+/** A payment credential the client sent back, and which protocol it speaks. */
+interface SubmittedPayment {
+    protocol: PaymentProtocol;
+    /** Raw header value, for handing to a facilitator. */
+    value: string;
+}
+/**
+ * Read the client's payment credential, whichever protocol it used.
+ *
+ * x402 sends `PAYMENT-SIGNATURE`; MPP sends `Authorization: Payment …`. The
+ * `Payment` scheme check matters — a site behind normal auth will also have a
+ * Bearer or Basic `Authorization` header, and mistaking that for a payment
+ * would be a security-relevant confusion.
+ */
+declare function paymentPayload(req: Request): SubmittedPayment | null;
+/**
+ * True when the client attached a payment credential — i.e. this is the retry
+ * after a 402, not a fresh unpaid request.
+ *
+ * Presence is not proof. Hand the value to your facilitator to verify and
+ * settle; only then serve the resource.
+ */
+declare function hasPaymentPayload(req: Request): boolean;
+/**
+ * Attach a facilitator's settlement result to a successful response.
+ *
+ * x402 defines `PAYMENT-RESPONSE` for this. MPP's public spec did not pin a
+ * settlement-confirmation header at the time of writing, so pass `header` to
+ * name whatever your provider expects rather than have the library guess.
+ */
+declare function withSettlement(res: Response, settlement: unknown, opts?: {
+    header?: string;
+}): Response;
+/**
+ * Convenience: turn an {@link AgentDecision} straight into a response, or
+ * `null` when the request should simply be served.
+ *
+ * Returns 403 for `'block'`, a 402 challenge for `'charge'`, and `null` for
+ * `'allow'` and `'meter'` — metering is an accounting concern, not a gate, so
+ * the request still gets served while `trackVisit` records it.
+ */
+declare function respondToDecision(decision: AgentDecision, opts: PaymentChallengeOptions): Response | null;
+
+/**
+ * The paid-access gate: policy decides *whether* to charge, a gateway decides
+ * *how*. **EXPERIMENTAL** — see `payments.ts`. The classification and policy
+ * layers underneath are stable; the payment surface is not.
+ *
+ * The split matters. We own classification — telling a training crawl from a
+ * retrieval fetch, which is the part nobody else does and the part that makes
+ * charging sane. Settlement is somebody else's job: Stripe's MPP SDK, an x402
+ * facilitator, whatever comes next. A library that held money would inherit PCI
+ * scope and stop being something you drop into middleware.
+ *
+ * So gateways are injected, exactly like analytics adapters, and this module
+ * takes no dependency on Stripe or any chain.
+ */
+
+/**
+ * Outcome of handing a request to a payment gateway.
+ *
+ * - `challenge` — respond with this. The client has not paid.
+ * - `paid` — settled; serve the resource. `receipt` decorates the response with
+ *   whatever proof the protocol expects.
+ */
+type GatewayResult = {
+    status: 'challenge';
+    response: Response;
+} | {
+    status: 'paid';
+    receipt?: (res: Response) => Response;
+};
+interface PaymentGateway {
+    handle(req: Request): Promise<GatewayResult>;
+}
+/**
+ * Wrap Stripe's MPP SDK.
+ *
+ * `Mppx.compose(...)` returns a handler that either yields a 402 with a
+ * `.challenge` response, or a settled result with `.withReceipt(res)`. This
+ * adapts that shape without importing it — pass the composed handler in.
+ *
+ * @example
+ * ```ts
+ * const mppx = Mppx.create({ methods: [...], secretKey })
+ * const handler = Mppx.compose(
+ *   mppx.tempo.charge({ amount: '0.01', recipient }),
+ *   mppx.stripe.charge({ amount: '0.50', currency: 'usd' })
+ * )
+ * const gateway = mppxGateway(handler)
+ * ```
+ */
+declare function mppxGateway(handler: (req: Request) => Promise<MppxResponse> | MppxResponse): PaymentGateway;
+/** The subset of Stripe's MPP response we rely on. Structural, not imported. */
+interface MppxResponse {
+    status: number;
+    challenge: Response;
+    withReceipt?: (res: Response) => Response;
+}
+interface X402GatewayOptions extends PaymentChallengeOptions {
+    /**
+     * Verify and settle a `PAYMENT-SIGNATURE` payload with your facilitator.
+     * Resolve truthy to serve the resource, falsy to re-challenge.
+     */
+    settle: (payload: string, req: Request) => Promise<boolean> | boolean;
+    /** Attach the facilitator's settlement result to the served response. */
+    receipt?: (res: Response) => Response;
+}
+/**
+ * Gateway using this library's own challenge builder plus a facilitator you
+ * supply. For x402, or for MPP if you are not using Stripe's SDK.
+ */
+declare function x402Gateway(opts: X402GatewayOptions): PaymentGateway;
+/** One unit of billable agent traffic. */
+interface MeterRecord {
+    decision: AgentDecision;
+    /** Units consumed. One request is one unit unless you price by bytes or tokens. */
+    units: number;
+    path: string;
+    method: string;
+}
+/**
+ * Where billable usage goes.
+ *
+ * Metering is the model to ship first: it needs no crawler cooperation, works
+ * today, and produces the number you would negotiate a licence with. Charging
+ * per request is what the protocols define but not what a training sweep can
+ * actually do — no crawler in the wild retries a 402.
+ */
+interface Meter {
+    record(entry: MeterRecord): Promise<void> | void;
+}
+interface PaymentGateOptions extends Omit<AgentPolicyOptions, 'verify'> {
+    gateway: PaymentGateway;
+    /**
+     * Sink for billable traffic. Called for every `'meter'` decision — serve the
+     * request, count it, bill out of band.
+     *
+     * Errors are swallowed: a metering failure must not turn into a failed
+     * response, for the same reason analytics failures do not.
+     */
+    meter?: Meter;
+    /**
+     * Identity verifier, sync or async. Unlike {@link agentPolicy}'s option this
+     * accepts a promise, because `paymentGate` is already async and can await it.
+     * That matters: `combinedVerifier()` and `webBotAuthVerifier()` are async by
+     * necessity — Web Bot Auth fetches the signer's key directory — so without
+     * this they could not be used with policy or payments at all.
+     */
+    verify?: (req: Request) => BotVerificationLike | Promise<BotVerificationLike>;
+    /**
+     * Called for every decision, paid or not — wire it to your metering so
+     * `'meter'` traffic is actually counted rather than merely allowed.
+     */
+    onDecision?: (decision: AgentDecision) => void;
+}
+/**
+ * Full gate: classify, decide, and either let the request through or return the
+ * response it should get instead.
+ *
+ * Returns `null` when the request should be served normally. That covers
+ * `'allow'`, `'meter'` (accounting, not a gate) and any request that has already
+ * paid — in which case `receipt` is handed back so you can decorate the response
+ * you were going to send anyway.
+ *
+ * @example
+ * ```ts
+ * const gate = await paymentGate(req, {
+ *   onTraining: 'charge',
+ *   verify: combinedVerifier(),
+ *   gateway: mppxGateway(handler),
+ *   onDecision: (d) => void trackVisit(req, { analytics, properties: { action: d.action } })
+ * })
+ * if (gate.response) return gate.response
+ * return gate.decorate(await serve(req))
+ * ```
+ */
+declare function paymentGate(req: Request, opts: PaymentGateOptions): Promise<{
+    decision: AgentDecision;
+    /** Respond with this instead of serving, when set. */
+    response: Response | null;
+    /** Wrap the response you were going to send. Identity when nothing to add. */
+    decorate: (res: Response) => Response;
+}>;
+
+export { type GatewayResult as G, type Meter as M, type PaymentChallenge as P, type SubmittedPayment as S, type X402Challenge as X, type MeterRecord as a, type MppChallenge as b, type MppxResponse as c, type PaymentChallengeOptions as d, type PaymentGateOptions as e, type PaymentGateway as f, type PaymentProtocol as g, type PaymentRequirements as h, type X402GatewayOptions as i, hasPaymentPayload as j, paymentPayload as k, paymentRequired as l, mppxGateway as m, paymentGate as p, respondToDecision as r, withSettlement as w, x402Gateway as x };

package/dist/index.cjs

@@ -1,3 +1,3 @@
-'use strict';var B=/ClaudeBot|Claude-User|Claude-SearchBot|Claude-Web|Anthropic|GPTBot|ChatGPT-User|OAI-SearchBot|PerplexityBot|Perplexity-User|Google-Extended|Google-CloudVertexBot|Google-Agent|GoogleAgent-Mariner|Gemini-Deep-Research|Applebot|cohere|Bytespider|CCBot|Amazonbot|Amzn-SearchBot|NovaAct|AzureAI-SearchBot|Meta-ExternalAgent|meta-externalfetcher|meta-webindexer|FacebookBot|DuckAssistBot|MistralAI-User|YouBot|AI2Bot|Diffbot|DeepSeek|PanguBot|Webzio-Extended|omgili|Timpibot|Grok|Manus-User|quillbot|MyCentralAIScraperBot|Cursor|Windsurf/i,S=/axios\/|curl\/|(?:^|[\s(])got(?:\/|[\s(])|\bcolly\b|Electron\/|node-fetch\/|python-requests\/|Go-http-client\/|okhttp\/|aiohttp\/|Deno\//i;function f(t){return t?B.test(t):false}function m(t){return t?S.test(t):false}function T(t){if(!t||typeof t!="string")return "Other";let e=t.toLowerCase();return e.includes("chatgpt-user")||e.includes("gptbot")||e.includes("oai-searchbot")||e.includes("openai")?"ChatGPT":e.includes("claudebot")||e.includes("claude-user")||e.includes("claude-searchbot")||e.includes("claude-web")||e.includes("anthropic")?"Claude":e.includes("perplexitybot")||e.includes("perplexity-user")?"Perplexity":e.includes("ccbot")?"Common Crawl":e.includes("google-extended")||e.includes("googlebot")||e.includes("google-cloudvertexbot")||e.includes("google-agent")||e.includes("googleagent-mariner")||e.includes("gemini-deep-research")?"Google":e.includes("applebot")?"Apple":e.includes("bingbot")?"Bing":e.includes("bytespider")?"Bytespider":e.includes("amazonbot")||e.includes("amzn-searchbot")||e.includes("novaact")?"Amazon":e.includes("meta-externalagent")||e.includes("meta-externalfetcher")||e.includes("meta-webindexer")||e.includes("facebookbot")?"Meta":e.includes("mistralai-user")?"Mistral":e.includes("duckassistbot")?"DuckDuckGo":e.includes("youbot")?"You.com":e.includes("diffbot")?"Diffbot":e.includes("ai2bot")?"AI2":e.includes("cohere")?"Cohere":e.includes("cursor")?"Cursor":e.includes("windsurf")?"Windsurf":e.includes("deepseek")?"DeepSeek":e.includes("pangubot")?"Huawei":e.includes("webzio")||e.includes("omgili")?"Webz.io":e.includes("timpibot")?"Timpi":e.includes("grok")||e.includes("xai-")?"xAI":e.includes("manus-user")?"Manus":e.includes("quillbot")?"QuillBot":e.includes("azureai-searchbot")?"Microsoft":e.includes("mycentralaiscraperbot")?"MyCentralAI":e.includes("petalbot")?"PetalBot":e.includes("ahrefsbot")?"Ahrefs":e.includes("semrushbot")?"Semrush":e.includes("mj12bot")?"Majestic":e.includes("dotbot")||e.includes("rogerbot")?"Moz":e.includes("screaming frog")?"Screaming Frog":e.includes("sitebulb")?"Sitebulb":e.includes("linkfluence")?"Linkfluence":e.includes("dataforseo")?"DataForSEO":e.includes("serpstatbot")?"Serpstat":e.includes("uptimerobot")?"UptimeRobot":e.includes("pingdom")?"Pingdom":e.includes("statuscake")?"StatusCake":e.includes("newrelicpinger")?"New Relic":e.includes("datadogagent")||e.includes("datadog")?"Datadog":e.includes("slackbot")?"Slack":e.includes("twitterbot")?"Twitter":e.includes("linkedinbot")?"LinkedIn":e.includes("discordbot")?"Discord":e.includes("telegrambot")?"Telegram":e.includes("whatsapp")?"WhatsApp":e.includes("linkupbot")?"Linkup":e.includes("sogou")?"Sogou":e.includes("yandexbot")?"Yandex":e.includes("baiduspider")?"Baidu":e.includes("facebookexternalhit")?"Facebook":e.includes("com.apple.webkit")?"Apple URL Preview":e.includes("ohdear")?"Oh Dear":e.includes("scrapy")?"Scrapy":e.includes("headlesschrome")?"Headless Chrome":e.includes("phantomjs")?"PhantomJS":e.includes("wget")?"wget":e.includes("httpie")?"HTTPie":e.includes("guzzlehttp")?"Guzzle":e.includes("electron/")?"Electron":/curl\//.test(e)?"curl":/axios\//.test(e)?"axios":/(?:^|[\s(])got(?:\/|[\s(])/.test(e)?"got":/\bcolly\b/.test(e)?"colly":/node-fetch\//.test(e)?"node-fetch":/python-requests\//.test(e)?"python-requests":/go-http-client\//.test(e)?"Go http client":/okhttp\//.test(e)?"OkHttp":/aiohttp\//.test(e)?"aiohttp":/deno\//.test(e)?"Deno":e.includes("mozilla")||e.includes("chrome")||e.includes("safari")||e.includes("firefox")?"Browser":"Other"}function M(t){if(!t||typeof t!="string")return "Other";let e=t.match(/compatible;\s*([^/;\s]+)(?:\/[^\s;]*)?/i);return e&&e[1]?e[1].trim():t.trim().split("/")[0]?.trim().split(/\s+/)[0]?.trim()||"Other"}function b(t){let e=[],r=(t.headers.get("user-agent")||"").toLowerCase();if(!(r.includes("mozilla")||r.includes("chrome")||r.includes("safari")||r.includes("firefox")))return {score:0,signals:[],likely:false};t.headers.get("accept-language")||e.push("missing-accept-language"),t.headers.get("sec-fetch-mode")||e.push("missing-sec-fetch-mode");let n=t.headers.get("sec-ch-ua");n?n.toLowerCase().includes("headlesschrome")&&e.push("headless-chrome-hint"):e.push("missing-sec-ch-ua");let i=t.headers.get("accept")||"";(!i||i==="*/*")&&e.push("missing-or-bare-accept"),(t.headers.get("connection")||"").toLowerCase()==="close"&&e.push("connection-close");let s=e.length;return {score:s,signals:e,likely:s>=2}}function v(t){let e=T(t),r=f(t),o=m(t),n;return r?n="declared-crawler":o?n="coding-agent-hint":e==="Browser"?n="browser":n="other",{kind:n,label:e,isAiBot:r,codingAgentHint:o}}function p(t){let e=t.headers.get("user-agent")||"",r=v(e),o=b(t),n=r.kind,i=r.label;return n==="browser"&&o.likely&&(n="headless-likely",i="Headless"),{...r,kind:n,label:i,headless:o}}var g=class extends Error{constructor(e){super(e),this.name="HashSecretError";}};function A(){let t=globalThis.crypto;if(!t?.subtle)throw new g("Web Crypto is unavailable. agent-analytics requires Node >= 20, or any runtime exposing globalThis.crypto.subtle (Vercel Edge, Cloudflare Workers, Deno, browsers).");return t.subtle}var E=new Map;function N(t){let e=E.get(t);return e||(e=A().importKey("raw",new TextEncoder().encode(t),{name:"HMAC",hash:"SHA-256"},false,["sign"]),E.set(t,e)),e}async function x(t,e){if(typeof e!="string"||e.length===0)throw new g("hashId requires a non-empty secret");let r=await A().sign("HMAC",await N(e),new TextEncoder().encode(t)),o=new Uint8Array(r,0,8),n="";for(let i of o)n+=i.toString(16).padStart(2,"0");return "anon_"+n}function w(){let t=new Uint8Array(32);A(),globalThis.crypto.getRandomValues(t);let e="";for(let r of t)e+=r.toString(16).padStart(2,"0");return e}var k,I=false;function z(t){if(t)return t;let e=typeof process<"u"?process.env?.AGENT_ANALYTICS_ID_SECRET:void 0;return e||(k||(k=w(),I||(I=true,console.warn("[agent-analytics] No idSecret or AGENT_ANALYTICS_ID_SECRET set. Using a per-instance random secret: distinctIds will not correlate across instances or deploys."))),k)}async function O(t,e){let r=t.headers.get("user-agent")||"",o=e.onlyBots??false,n=e.skipBrowsers??false;if(!(o&&!f(r))&&!(n&&!f(r)&&!m(r)&&!b(t).likely))try{let i="/",s="";try{let C=new URL(t.url);i=C.pathname,s=C.origin;}catch{i=t.url||"/";}let a=e.origin??s,y=(t.headers.get("x-forwarded-for")||"").split(",")[0]?.trim()??"",h=t.headers.get("referer"),R=e.captureCountry&&(t.headers.get("x-vercel-ip-country")||t.headers.get("cf-ipcountry")||t.headers.get("x-country-code"))||null,_=e.captureGeo?U(t):null,c=p(t),d=e.verify?await e.verify(t):null,D=c.kind==="headless-likely"||c.kind==="browser",H=await x(`${y}:${r}`,z(e.idSecret)),G={event:e.eventName??"agent_visit",distinctId:H,timestamp:new Date().toISOString(),properties:{...e.properties,$process_person_profile:!1,$current_url:a?`${a}${i}`:i,path:i,method:t.method,...e.captureCountry?{country_code:R}:{},..._??{},...e.captureIp?{client_ip:y||null}:{},user_agent:r,is_ai_bot:c.isAiBot,bot_name:c.label,ua_category:c.kind,coding_agent_hint:c.codingAgentHint,...D?{headless_score:c.headless?.score??0,headless_likely:c.headless?.likely??!1}:{},...d?{bot_verified:d.verified,bot_verification:d.verdict,...d.reason?{bot_verification_reason:d.reason}:{}}:{},referer:h,source:e.source??null}};await e.analytics.capture(G);}catch(i){e.onError?.(i instanceof Error?i:new Error(String(i)));}}function U(t){let e=n=>{if(!n)return "";try{return decodeURIComponent(n)}catch{return n}},r=[["region",e(t.headers.get("x-vercel-ip-country-region"))],["city",e(t.headers.get("x-vercel-ip-city"))],["latitude",t.headers.get("x-vercel-ip-latitude")??""],["longitude",t.headers.get("x-vercel-ip-longitude")??""],["timezone",t.headers.get("x-vercel-ip-timezone")??""]],o={};for(let[n,i]of r)i&&(o[n]=i);return o}var u=class extends Error{status;body;constructor(e,r,o){super(e),this.name="CaptureTransportError",this.status=r,this.body=o;}};var L=/ChatGPT-User|OAI-SearchBot|Claude-User|Claude-SearchBot|Perplexity-User|claude-code|DuckAssistBot|MistralAI-User|Gemini-Deep-Research|Manus-User|YouBot/i,$=/GPTBot|ClaudeBot|Claude-Web|CCBot|Bytespider|Amazonbot|Amzn-SearchBot|Meta-ExternalAgent|meta-externalfetcher|meta-webindexer|FacebookBot|Google-Extended|Applebot-Extended|AI2Bot|Diffbot|omgili|Webzio-Extended|Timpibot|PanguBot|cohere|DeepSeek|Grok|quillbot|MyCentralAIScraperBot|NovaAct|AzureAI-SearchBot|Google-CloudVertexBot/i,j=/bingbot|Googlebot|DuckDuckBot|YandexBot|Baiduspider|PetalBot|Sogou|Applebot(?!-Extended)/i;function P(t){let e=t??"";return e?L.test(e)?"retrieval":$.test(e)?"training":j.test(e)?"search":"unknown":"unknown"}function V(t,e={}){let r=t.headers.get("user-agent")||"",o=p(t),n=o.label,i=P(r);if(i==="unknown"&&o.codingAgentHint&&(i="tooling"),e.allowList?.some(h=>h===n||r.toLowerCase().includes(h.toLowerCase())))return {action:"allow",intent:i,label:n,reason:"on allowList"};let a;return e.verify&&(a=e.verify(t).verdict,a==="spoofed")?{action:"block",intent:i,label:n,verification:a,reason:`${n} claimed but client IP is outside its published ranges`}:{action:i==="training"?e.onTraining??"meter":i==="retrieval"?e.onRetrieval??"allow":i==="search"?e.onSearch??"allow":i==="tooling"?e.onTooling??"allow":"allow",intent:i,label:n,...a?{verification:a}:{},reason:{retrieval:"a person is waiting on this answer",training:"bulk corpus collection",search:"search index crawler",tooling:"coding agent or HTTP client",unknown:"not a recognised agent"}[i]}}function W(t){let e=t.host??"https://us.i.posthog.com",r=(/^https?:\/\//.test(e)?e:`https://${e}`).replace(/\/$/,""),o=(t.path??"/i/v0/e/").replace(/^(?!\/)/,"/"),n=`${r}${o}`,i=t.fetchImpl??fetch;return {async capture(s){let a={api_key:t.apiKey,event:s.event,distinct_id:s.distinctId,timestamp:s.timestamp,properties:s.properties},l=await i(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(a),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!l.ok)throw new u(`PostHog capture failed: ${l.status} ${l.statusText}`,l.status,await l.text().catch(()=>{}))}}}function K(t){let e=t.fetchImpl??fetch,r=t.transform??(o=>o);return {async capture(o){let n=await e(t.url,{method:"POST",headers:{"Content-Type":"application/json",...t.headers??{}},body:JSON.stringify(r(o)),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!n.ok)throw new u(`Webhook capture failed: ${n.status} ${n.statusText}`,n.status,await n.text().catch(()=>{}))}}}function F(t){return {capture:t}}
-exports.AI_BOT_PATTERN=B;exports.CaptureTransportError=u;exports.HTTP_CLIENT_PATTERN=S;exports.HashSecretError=g;exports.agentIntent=P;exports.agentPolicy=V;exports.classifyAgent=v;exports.classifyRequest=p;exports.customAnalytics=F;exports.detectHeadless=b;exports.firstUserAgentProduct=M;exports.hashId=x;exports.isAiBot=f;exports.isHttpClient=m;exports.parseBotName=T;exports.posthogAnalytics=W;exports.randomSecret=w;exports.trackVisit=O;exports.webhookAnalytics=K;//# sourceMappingURL=index.cjs.map
+'use strict';var S=/ClaudeBot|Claude-User|Claude-SearchBot|Claude-Web|Anthropic|GPTBot|ChatGPT-User|OAI-SearchBot|PerplexityBot|Perplexity-User|Google-Extended|Google-CloudVertexBot|Google-Agent|GoogleAgent-Mariner|Gemini-Deep-Research|Applebot|cohere|Bytespider|CCBot|Amazonbot|Amzn-SearchBot|NovaAct|AzureAI-SearchBot|Meta-ExternalAgent|meta-externalfetcher|meta-webindexer|FacebookBot|DuckAssistBot|MistralAI-User|YouBot|AI2Bot|Diffbot|DeepSeek|PanguBot|Webzio-Extended|omgili|Timpibot|Grok|Manus-User|quillbot|MyCentralAIScraperBot|Cursor|Windsurf/i,T=/axios\/|curl\/|(?:^|[\s(])got(?:\/|[\s(])|\bcolly\b|Electron\/|node-fetch\/|python-requests\/|Go-http-client\/|okhttp\/|aiohttp\/|Deno\//i;function h(t){return t?S.test(t):false}function p(t){return t?T.test(t):false}function v(t){if(!t||typeof t!="string")return "Other";let e=t.toLowerCase();return e.includes("chatgpt-user")||e.includes("gptbot")||e.includes("oai-searchbot")||e.includes("openai")?"ChatGPT":e.includes("claudebot")||e.includes("claude-user")||e.includes("claude-searchbot")||e.includes("claude-web")||e.includes("anthropic")?"Claude":e.includes("perplexitybot")||e.includes("perplexity-user")?"Perplexity":e.includes("ccbot")?"Common Crawl":e.includes("google-extended")||e.includes("googlebot")||e.includes("google-cloudvertexbot")||e.includes("google-agent")||e.includes("googleagent-mariner")||e.includes("gemini-deep-research")?"Google":e.includes("applebot")?"Apple":e.includes("bingbot")?"Bing":e.includes("bytespider")?"Bytespider":e.includes("amazonbot")||e.includes("amzn-searchbot")||e.includes("novaact")?"Amazon":e.includes("meta-externalagent")||e.includes("meta-externalfetcher")||e.includes("meta-webindexer")||e.includes("facebookbot")?"Meta":e.includes("mistralai-user")?"Mistral":e.includes("duckassistbot")?"DuckDuckGo":e.includes("youbot")?"You.com":e.includes("diffbot")?"Diffbot":e.includes("ai2bot")?"AI2":e.includes("cohere")?"Cohere":e.includes("cursor")?"Cursor":e.includes("windsurf")?"Windsurf":e.includes("deepseek")?"DeepSeek":e.includes("pangubot")?"Huawei":e.includes("webzio")||e.includes("omgili")?"Webz.io":e.includes("timpibot")?"Timpi":e.includes("grok")||e.includes("xai-")?"xAI":e.includes("manus-user")?"Manus":e.includes("quillbot")?"QuillBot":e.includes("azureai-searchbot")?"Microsoft":e.includes("mycentralaiscraperbot")?"MyCentralAI":e.includes("petalbot")?"PetalBot":e.includes("ahrefsbot")?"Ahrefs":e.includes("semrushbot")?"Semrush":e.includes("mj12bot")?"Majestic":e.includes("dotbot")||e.includes("rogerbot")?"Moz":e.includes("screaming frog")?"Screaming Frog":e.includes("sitebulb")?"Sitebulb":e.includes("linkfluence")?"Linkfluence":e.includes("dataforseo")?"DataForSEO":e.includes("serpstatbot")?"Serpstat":e.includes("uptimerobot")?"UptimeRobot":e.includes("pingdom")?"Pingdom":e.includes("statuscake")?"StatusCake":e.includes("newrelicpinger")?"New Relic":e.includes("datadogagent")||e.includes("datadog")?"Datadog":e.includes("slackbot")?"Slack":e.includes("twitterbot")?"Twitter":e.includes("linkedinbot")?"LinkedIn":e.includes("discordbot")?"Discord":e.includes("telegrambot")?"Telegram":e.includes("whatsapp")?"WhatsApp":e.includes("linkupbot")?"Linkup":e.includes("sogou")?"Sogou":e.includes("yandexbot")?"Yandex":e.includes("baiduspider")?"Baidu":e.includes("facebookexternalhit")?"Facebook":e.includes("com.apple.webkit")?"Apple URL Preview":e.includes("ohdear")?"Oh Dear":e.includes("scrapy")?"Scrapy":e.includes("headlesschrome")?"Headless Chrome":e.includes("phantomjs")?"PhantomJS":e.includes("wget")?"wget":e.includes("httpie")?"HTTPie":e.includes("guzzlehttp")?"Guzzle":e.includes("electron/")?"Electron":/curl\//.test(e)?"curl":/axios\//.test(e)?"axios":/(?:^|[\s(])got(?:\/|[\s(])/.test(e)?"got":/\bcolly\b/.test(e)?"colly":/node-fetch\//.test(e)?"node-fetch":/python-requests\//.test(e)?"python-requests":/go-http-client\//.test(e)?"Go http client":/okhttp\//.test(e)?"OkHttp":/aiohttp\//.test(e)?"aiohttp":/deno\//.test(e)?"Deno":e.includes("mozilla")||e.includes("chrome")||e.includes("safari")||e.includes("firefox")?"Browser":"Other"}function M(t){if(!t||typeof t!="string")return "Other";let e=t.match(/compatible;\s*([^/;\s]+)(?:\/[^\s;]*)?/i);return e&&e[1]?e[1].trim():t.trim().split("/")[0]?.trim().split(/\s+/)[0]?.trim()||"Other"}function A(t){let e=[],r=(t.headers.get("user-agent")||"").toLowerCase();if(!(r.includes("mozilla")||r.includes("chrome")||r.includes("safari")||r.includes("firefox")))return {score:0,signals:[],likely:false};t.headers.get("accept-language")||e.push("missing-accept-language"),t.headers.get("sec-fetch-mode")||e.push("missing-sec-fetch-mode");let n=t.headers.get("sec-ch-ua");n?n.toLowerCase().includes("headlesschrome")&&e.push("headless-chrome-hint"):e.push("missing-sec-ch-ua");let i=t.headers.get("accept")||"";(!i||i==="*/*")&&e.push("missing-or-bare-accept"),(t.headers.get("connection")||"").toLowerCase()==="close"&&e.push("connection-close");let s=e.length;return {score:s,signals:e,likely:s>=2}}function P(t){let e=v(t),r=h(t),o=p(t),n;return r?n="declared-crawler":o?n="coding-agent-hint":e==="Browser"?n="browser":n="other",{kind:n,label:e,isAiBot:r,codingAgentHint:o}}function m(t){let e=t.headers.get("user-agent")||"",r=P(e),o=A(t),n=r.kind,i=r.label;return n==="browser"&&o.likely&&(n="headless-likely",i="Headless"),{...r,kind:n,label:i,headless:o}}var y=class extends Error{constructor(e){super(e),this.name="HashSecretError";}};function x(){let t=globalThis.crypto;if(!t?.subtle)throw new y("Web Crypto is unavailable. agent-analytics requires Node >= 20, or any runtime exposing globalThis.crypto.subtle (Vercel Edge, Cloudflare Workers, Deno, browsers).");return t.subtle}var E=new Map;function O(t){let e=E.get(t);return e||(e=x().importKey("raw",new TextEncoder().encode(t),{name:"HMAC",hash:"SHA-256"},false,["sign"]),E.set(t,e)),e}async function w(t,e){if(typeof e!="string"||e.length===0)throw new y("hashId requires a non-empty secret");let r=await x().sign("HMAC",await O(e),new TextEncoder().encode(t)),o=new Uint8Array(r,0,8),n="";for(let i of o)n+=i.toString(16).padStart(2,"0");return "anon_"+n}function k(){let t=new Uint8Array(32);x(),globalThis.crypto.getRandomValues(t);let e="";for(let r of t)e+=r.toString(16).padStart(2,"0");return e}var C,I=false;function N(t){if(t)return t;let e=typeof process<"u"?process.env?.AGENT_ANALYTICS_ID_SECRET:void 0;return e||(C||(C=k(),I||(I=true,console.warn("[agent-analytics] No idSecret or AGENT_ANALYTICS_ID_SECRET set. Using a per-instance random secret: distinctIds will not correlate across instances or deploys."))),C)}async function z(t,e){let r=t.headers.get("user-agent")||"",o=e.onlyBots??false,n=e.skipBrowsers??false;if(!(o&&!h(r))&&!(n&&!h(r)&&!p(r)&&!A(t).likely))try{let i="/",s="";try{let B=new URL(t.url);i=B.pathname,s=B.origin;}catch{i=t.url||"/";}let c=e.origin??s,f=(t.headers.get("x-forwarded-for")||"").split(",")[0]?.trim()??"",l=t.headers.get("referer"),b=e.captureCountry&&(t.headers.get("x-vercel-ip-country")||t.headers.get("cf-ipcountry")||t.headers.get("x-country-code"))||null,_=e.captureGeo?L(t):null,u=m(t),g=e.verify?await e.verify(t):null,D=u.kind==="headless-likely"||u.kind==="browser",G=await w(`${f}:${r}`,N(e.idSecret)),H={event:e.eventName??"agent_visit",distinctId:G,timestamp:new Date().toISOString(),properties:{...e.properties,$process_person_profile:!1,$current_url:c?`${c}${i}`:i,path:i,method:t.method,...e.captureCountry?{country_code:b}:{},..._??{},...e.captureIp?{client_ip:f||null}:{},user_agent:r,is_ai_bot:u.isAiBot,bot_name:u.label,ua_category:u.kind,coding_agent_hint:u.codingAgentHint,...D?{headless_score:u.headless?.score??0,headless_likely:u.headless?.likely??!1}:{},...g?{bot_verified:g.verified,bot_verification:g.verdict,...g.reason?{bot_verification_reason:g.reason}:{}}:{},referer:l,source:e.source??null}};await e.analytics.capture(H);}catch(i){e.onError?.(i instanceof Error?i:new Error(String(i)));}}function L(t){let e=n=>{if(!n)return "";try{return decodeURIComponent(n)}catch{return n}},r=[["region",e(t.headers.get("x-vercel-ip-country-region"))],["city",e(t.headers.get("x-vercel-ip-city"))],["latitude",t.headers.get("x-vercel-ip-latitude")??""],["longitude",t.headers.get("x-vercel-ip-longitude")??""],["timezone",t.headers.get("x-vercel-ip-timezone")??""]],o={};for(let[n,i]of r)i&&(o[n]=i);return o}var d=class extends Error{status;body;constructor(e,r,o){super(e),this.name="CaptureTransportError",this.status=r,this.body=o;}};var U=/ChatGPT-User|OAI-SearchBot|Claude-User|Claude-SearchBot|Perplexity-User|claude-code|DuckAssistBot|MistralAI-User|Gemini-Deep-Research|Manus-User|YouBot/i,$=/GPTBot|ClaudeBot|Claude-Web|CCBot|Bytespider|Amazonbot|Amzn-SearchBot|Meta-ExternalAgent|meta-externalfetcher|meta-webindexer|FacebookBot|Google-Extended|Applebot-Extended|AI2Bot|Diffbot|omgili|Webzio-Extended|Timpibot|PanguBot|cohere|DeepSeek|Grok|quillbot|MyCentralAIScraperBot|NovaAct|AzureAI-SearchBot|Google-CloudVertexBot/i,j=/bingbot|Googlebot|DuckDuckBot|YandexBot|Baiduspider|PetalBot|Sogou|Applebot(?!-Extended)/i;function R(t){let e=t??"";return e?U.test(e)?"retrieval":$.test(e)?"training":j.test(e)?"search":p(e)?"tooling":"unknown":"unknown"}function V(t,e={}){let r=t.headers.get("user-agent")||"",n=m(t).label,i=R(r);if(e.allowList?.some(b=>b===n||r.toLowerCase().includes(b.toLowerCase())))return {action:"allow",intent:i,label:n,reason:"on allowList"};let c=e.verification??(e.verify?e.verify(t):void 0),a;return c&&(a=c.verdict,a==="spoofed")?{action:"block",intent:i,label:n,verification:a,reason:`${n} claimed but client IP is outside its published ranges`}:{action:i==="training"?e.onTraining??"meter":i==="retrieval"?e.onRetrieval??"allow":i==="search"?e.onSearch??"allow":i==="tooling"?e.onTooling??"allow":"allow",intent:i,label:n,...a?{verification:a}:{},reason:{retrieval:"a person is waiting on this answer",training:"bulk corpus collection",search:"search index crawler",tooling:"coding agent or HTTP client",unknown:"not a recognised agent"}[i]}}function W(t){let e=t.host??"https://us.i.posthog.com",r=(/^https?:\/\//.test(e)?e:`https://${e}`).replace(/\/$/,""),o=(t.path??"/i/v0/e/").replace(/^(?!\/)/,"/"),n=`${r}${o}`,i=t.fetchImpl??fetch;return {async capture(s){let c=s.properties.user_agent,a=s.properties.client_ip,f={api_key:t.apiKey,event:s.event,distinct_id:s.distinctId,timestamp:s.timestamp,properties:{...s.properties,...typeof c=="string"&&c?{$raw_user_agent:c}:{},...typeof a=="string"&&a?{$ip:a}:{}}},l=await i(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(f),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!l.ok)throw new d(`PostHog capture failed: ${l.status} ${l.statusText}`,l.status,await l.text().catch(()=>{}))}}}function K(t){let e=t.fetchImpl??fetch,r=t.transform??(o=>o);return {async capture(o){let n=await e(t.url,{method:"POST",headers:{"Content-Type":"application/json",...t.headers??{}},body:JSON.stringify(r(o)),keepalive:true,signal:AbortSignal.timeout(t.timeoutMs??3e3)});if(!n.ok)throw new d(`Webhook capture failed: ${n.status} ${n.statusText}`,n.status,await n.text().catch(()=>{}))}}}function F(t){return {capture:t}}
+exports.AI_BOT_PATTERN=S;exports.CaptureTransportError=d;exports.HTTP_CLIENT_PATTERN=T;exports.HashSecretError=y;exports.agentIntent=R;exports.agentPolicy=V;exports.classifyAgent=P;exports.classifyRequest=m;exports.customAnalytics=F;exports.detectHeadless=A;exports.firstUserAgentProduct=M;exports.hashId=w;exports.isAiBot=h;exports.isHttpClient=p;exports.parseBotName=v;exports.posthogAnalytics=W;exports.randomSecret=k;exports.trackVisit=z;exports.webhookAnalytics=K;//# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map