@canonry/canonry 7.84.0 → 7.85.0

package/dist/{chunk-O7TWL6ZH.js → chunk-2R6WI237.js}

@@ -12,7 +12,139 @@ import {
   classifyTrafficPath,
   hostMatchesDomain,
   hostOf
-} from "./chunk-K3OY52MI.js";
+} from "./chunk-KNKOTLVW.js";
+
+// ../integration-traffic/src/agent-trust.ts
+var AGENT_TRUST_RULES_VERSION = 2;
+var SCANNER_SEGMENTS = /* @__PURE__ */ new Set([
+  "wp-login.php",
+  "xmlrpc.php",
+  "phpmyadmin",
+  "phpunit",
+  "eval-stdin.php",
+  "phpinfo.php",
+  // Debug consoles of web frameworks, and the Vite dev server's file access.
+  "_profiler",
+  "_debugbar",
+  "_ignition",
+  "__debug__",
+  "elmah.axd",
+  "trace.axd",
+  "@fs"
+]);
+var ENCODED_TRAVERSAL = /(?:%2e%2e|%2e\.|\.%2e)(?:\/|\\|%2f|%5c|$)|\.\.(?:%2f|%5c)|%252e%252e/i;
+var NETLIFY_PUBLIC = /* @__PURE__ */ new Set(["functions", "edge-functions", "images"]);
+var CONFIG_FOLDERS = /* @__PURE__ */ new Set(["config", "configs", "conf", "keys", "secrets", "credentials", "private", "certs", "ssl", "backup", "backups"]);
+var SECRET_EXTENSIONS = /* @__PURE__ */ new Set(["pem", "key", "p12", "pfx", "jks", "keystore", "ppk", "kdbx", "ovpn", "tfstate", "tfvars", "sql", "bak", "swp"]);
+var CREDENTIAL_FILE = /(?:^|[-_.])(?:credentials?|secrets?|service[-_]?account(?:[-_]?key)?|private[-_]?key|access[-_]?keys?|adminsdk(?:[-_][\w-]+)?)\.(?:json|ya?ml|toml|ini|conf|cfg|xml|txt|js|env|properties)$/;
+var SSH_KEY_FILE = /^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/;
+var SECRET_FILES = /* @__PURE__ */ new Set([
+  "key.json",
+  "keyfile.json",
+  "sa.json",
+  "gcp-key.json",
+  "gcp-service.json",
+  "gc-service.json",
+  "firebase-admin.json",
+  "docker-compose.yml",
+  "docker-compose.yaml",
+  "serverless.yml",
+  "serverless.yaml",
+  "rclone.conf",
+  "appsettings.json",
+  "local.settings.json",
+  "application.properties",
+  "application.yml",
+  "application.yaml",
+  "values.yaml",
+  "web.config",
+  "configuration.php",
+  "settings.py",
+  "database.yml",
+  "parameters.yml",
+  "env.json",
+  "env.js"
+]);
+var ENVIRONMENT_CONFIG = /^(?:production|prod|development|dev|staging|default|local|test)\.(?:json|ya?ml|js|toml)$/;
+var REASON_ORDER = [
+  AgentTrustReasons["scanner-path"],
+  AgentTrustReasons["scanner-burst"],
+  AgentTrustReasons["unusual-user-agent"],
+  AgentTrustReasons["ip-in-published-list"],
+  AgentTrustReasons["ip-outside-published-list"],
+  AgentTrustReasons["no-ip"],
+  AgentTrustReasons["no-published-list"],
+  AgentTrustReasons["documented-user-agent"]
+];
+var FAKE_REASONS = /* @__PURE__ */ new Set([
+  AgentTrustReasons["scanner-path"],
+  AgentTrustReasons["scanner-burst"],
+  AgentTrustReasons["unusual-user-agent"]
+]);
+function isHiddenSegment(segment, next) {
+  if (!segment.startsWith(".") || segment === "." || segment === ".well-known") return false;
+  return !(segment === ".netlify" && next !== void 0 && NETLIFY_PUBLIC.has(next));
+}
+function isSecretFile(folders, file) {
+  if (!folders.every((folder) => CONFIG_FOLDERS.has(folder))) return false;
+  if (folders.length > 0 && ENVIRONMENT_CONFIG.test(file)) return true;
+  const dot = file.lastIndexOf(".");
+  const extension = dot > 0 ? file.slice(dot + 1) : "";
+  return SECRET_EXTENSIONS.has(extension) || SECRET_FILES.has(file) || SSH_KEY_FILE.test(file) || CREDENTIAL_FILE.test(file) || /^appsettings\.[\w-]+\.json$/.test(file);
+}
+function isScannerPath(rawPath) {
+  const pathOnly = (rawPath.split(/[?#]/)[0] ?? "").toLowerCase();
+  if (ENCODED_TRAVERSAL.test(pathOnly)) return true;
+  let decoded = pathOnly;
+  try {
+    decoded = decodeURIComponent(pathOnly);
+  } catch {
+  }
+  const segments = decoded.split(/[\\/]+/).filter(Boolean);
+  for (const [index, segment] of segments.entries()) {
+    if (segment === ".." || segment.endsWith("..")) return true;
+    if (SCANNER_SEGMENTS.has(segment) || segment.startsWith("wp-config") || segment.endsWith(".env")) return true;
+    if (isHiddenSegment(segment, segments[index + 1])) return true;
+    if (segment === "proc" && segments[index + 1] === "self") return true;
+    if (segment === "var" && segments[index + 1] === "run" && segments[index + 2] === "secrets") return true;
+  }
+  const file = segments.at(-1);
+  if (file === void 0) return false;
+  if (segments[0] === "userfiles" && !file.includes(".")) return true;
+  return isSecretFile(segments.slice(0, -1), file);
+}
+function sortAgentTrustReasons(reasons) {
+  const present = new Set(reasons);
+  return REASON_ORDER.filter((reason) => present.has(reason));
+}
+function withScannerBurst(assessment) {
+  if (assessment.trust === AgentTrustLevels.verified || assessment.trust === AgentTrustLevels.likely_fake) return assessment;
+  return {
+    ...assessment,
+    trust: AgentTrustLevels.likely_fake,
+    trustReasons: sortAgentTrustReasons([...assessment.trustReasons, AgentTrustReasons["scanner-burst"]])
+  };
+}
+function ipReason(input) {
+  if (input.verification.verified) return AgentTrustReasons["ip-in-published-list"];
+  if (input.verification.manifest) return AgentTrustReasons["ip-outside-published-list"];
+  return input.listPublished ? AgentTrustReasons["no-ip"] : AgentTrustReasons["no-published-list"];
+}
+function assessAgentTrust(input) {
+  const reasons = /* @__PURE__ */ new Set([ipReason(input)]);
+  const documented = input.rule.documentedUserAgents;
+  if (documented && documented.length > 0) {
+    reasons.add(documented.some((pattern) => pattern.test(input.userAgent.trim())) ? AgentTrustReasons["documented-user-agent"] : AgentTrustReasons["unusual-user-agent"]);
+  }
+  if (isScannerPath(input.path)) reasons.add(AgentTrustReasons["scanner-path"]);
+  return { trust: trustFor(reasons), trustReasons: sortAgentTrustReasons(reasons) };
+}
+function trustFor(reasons) {
+  if (reasons.has(AgentTrustReasons["ip-in-published-list"])) return AgentTrustLevels.verified;
+  for (const reason of reasons) if (FAKE_REASONS.has(reason)) return AgentTrustLevels.likely_fake;
+  const unchecked = reasons.has(AgentTrustReasons["no-ip"]) || reasons.has(AgentTrustReasons["no-published-list"]);
+  return unchecked && reasons.has(AgentTrustReasons["documented-user-agent"]) ? AgentTrustLevels.likely_real : AgentTrustLevels.unknown;
+}
 
 // ../integration-traffic/src/rules.ts
 var SELF_TRAFFIC_USER_AGENT_PATTERNS = [
@@ -451,81 +583,6 @@ var DEFAULT_AI_REFERRER_RULES = [
   { domain: AI_ENGINE_DOMAINS.metaAi, operator: "Meta", product: "Meta AI" }
 ];
 
-// ../integration-traffic/src/agent-trust.ts
-var SCANNER_SEGMENTS = /* @__PURE__ */ new Set([
-  ".git",
-  ".svn",
-  ".hg",
-  ".github",
-  ".aws",
-  ".ssh",
-  ".docker",
-  ".kube",
-  ".npmrc",
-  ".htpasswd",
-  ".htaccess",
-  ".ds_store",
-  "wp-login.php",
-  "xmlrpc.php",
-  "phpmyadmin",
-  "phpunit",
-  "eval-stdin.php"
-]);
-var ENCODED_TRAVERSAL = /(?:%2e%2e|%2e\.|\.%2e)(?:\/|\\|%2f|%5c|$)|\.\.(?:%2f|%5c)|%252e%252e/i;
-var REASON_ORDER = [
-  AgentTrustReasons["scanner-path"],
-  AgentTrustReasons["unusual-user-agent"],
-  AgentTrustReasons["ip-in-published-list"],
-  AgentTrustReasons["ip-outside-published-list"],
-  AgentTrustReasons["no-ip"],
-  AgentTrustReasons["no-published-list"],
-  AgentTrustReasons["documented-user-agent"]
-];
-var FAKE_REASONS = /* @__PURE__ */ new Set([
-  AgentTrustReasons["scanner-path"],
-  AgentTrustReasons["unusual-user-agent"]
-]);
-function isScannerPath(rawPath) {
-  const pathOnly = (rawPath.split(/[?#]/)[0] ?? "").toLowerCase();
-  if (ENCODED_TRAVERSAL.test(pathOnly)) return true;
-  let decoded = pathOnly;
-  try {
-    decoded = decodeURIComponent(pathOnly);
-  } catch {
-  }
-  for (const segment of decoded.split(/[\\/]+/)) {
-    if (!segment) continue;
-    if (segment === ".." || segment.endsWith("..")) return true;
-    if (SCANNER_SEGMENTS.has(segment) || segment.startsWith("wp-config")) return true;
-    if (segment === ".env" || segment.startsWith(".env.") || segment.endsWith(".env")) return true;
-  }
-  return false;
-}
-function sortAgentTrustReasons(reasons) {
-  const present = new Set(reasons);
-  return REASON_ORDER.filter((reason) => present.has(reason));
-}
-function ipReason(input) {
-  if (input.verification.verified) return AgentTrustReasons["ip-in-published-list"];
-  if (input.verification.manifest) return AgentTrustReasons["ip-outside-published-list"];
-  return input.listPublished ? AgentTrustReasons["no-ip"] : AgentTrustReasons["no-published-list"];
-}
-function assessAgentTrust(input) {
-  const reasons = /* @__PURE__ */ new Set([ipReason(input)]);
-  const documented = input.rule.documentedUserAgents;
-  if (documented && documented.length > 0) {
-    reasons.add(documented.some((pattern) => pattern.test(input.userAgent.trim())) ? AgentTrustReasons["documented-user-agent"] : AgentTrustReasons["unusual-user-agent"]);
-  }
-  if (isScannerPath(input.path)) reasons.add(AgentTrustReasons["scanner-path"]);
-  return { trust: trustFor(reasons), trustReasons: sortAgentTrustReasons(reasons) };
-}
-function trustFor(reasons) {
-  if (reasons.has(AgentTrustReasons["ip-in-published-list"])) return AgentTrustLevels.verified;
-  for (const reason of reasons) if (FAKE_REASONS.has(reason)) return AgentTrustLevels.likely_fake;
-  const unchecked = reasons.has(AgentTrustReasons["no-ip"]) || reasons.has(AgentTrustReasons["no-published-list"]);
-  return unchecked && reasons.has(AgentTrustReasons["documented-user-agent"]) ? AgentTrustLevels.likely_real : AgentTrustLevels.unknown;
-}
-
 // ../integration-traffic/src/ip-ranges/amazonbot.json
 var amazonbot_default = {
   _source: "https://developer.amazon.com/amazonbot/ip-addresses/",
@@ -18016,97 +18073,8 @@ function classifyAiReferral(event) {
   return null;
 }
 
-// ../integration-traffic/src/unlisted-agents.ts
-var UNLISTED_AGENT_SKIPPED_EXTENSIONS = [
-  "avif",
-  "bmp",
-  "css",
-  "gif",
-  "ico",
-  "jpeg",
-  "jpg",
-  "js",
-  "map",
-  "mjs",
-  "mp3",
-  "mp4",
-  "otf",
-  "png",
-  "svg",
-  "ttf",
-  "webm",
-  "webmanifest",
-  "webp",
-  "woff",
-  "woff2",
-  "zip"
-];
-var GENERIC_HTTP_CLIENTS = [
-  "curl",
-  "wget",
-  "python",
-  "python-requests",
-  "python-urllib",
-  "python-httpx",
-  "aiohttp",
-  "httpx",
-  "go-http-client",
-  "okhttp",
-  "java",
-  "apache-httpclient",
-  "axios",
-  "node",
-  "node-fetch",
-  "undici",
-  "got",
-  "libwww-perl",
-  "guzzlehttp",
-  "ruby",
-  "faraday",
-  "http.rb",
-  "php",
-  "wordpress",
-  "dalvik",
-  "postmanruntime",
-  "insomnia"
-];
-var BROWSER_SHAPED_AGENT_MARKERS = ["compatible;", "fetch", "agent", "headless", "+http"];
-var PRODUCT_NAME_END = /[/\s;(]/;
-var SKIPPED_PATH = new RegExp(`\\.(?:${UNLISTED_AGENT_SKIPPED_EXTENSIONS.join("|")})$`, "i");
-var COMPATIBLE_NAME = /compatible;\s*([a-z0-9][a-z0-9._-]*)/;
-var BOT_LIKE_NAME = /([a-z0-9][a-z0-9._-]*(?:bot|crawler|spider|fetcher|agent|-user))\//;
-var HEADLESS_NAME = /\b(headless[a-z]*)\//;
-var BROWSER_COMPATIBLE_NAMES = ["msie"];
-var MAX_AGENT_NAME_LENGTH = 64;
-var HEADER_NAME_PREFIX = /^user-agent\s*:\s*/;
-var AGENT_NAME = /^[a-z0-9][a-z0-9._-]*$/;
-var KNOWN_AGENT_NAMES = [
-  { marker: "facebookexternalhit/1.1 facebot twitterbot/1.0", name: "imessage-link-preview" }
-];
-function boundedAgentName(name) {
-  const bounded = name.replace(/^[._-]+/, "").slice(0, MAX_AGENT_NAME_LENGTH).replace(/[._-]+$/, "");
-  return AGENT_NAME.test(bounded) ? bounded : null;
-}
-var UNRECOGNIZED_AGENT_NAMING_VERSION = 2;
-function unrecognizedAgentName(request) {
-  const method = (request.method ?? "GET").toUpperCase();
-  if (method !== "GET" && method !== "HEAD") return null;
-  if (request.path && SKIPPED_PATH.test(request.path.split("?")[0] ?? "")) return null;
-  const ua = (request.userAgent ?? "").trim().toLowerCase().replace(HEADER_NAME_PREFIX, "");
-  if (!ua) return null;
-  const known = KNOWN_AGENT_NAMES.find((entry) => ua.includes(entry.marker));
-  if (known) return known.name;
-  const product = ua.split(PRODUCT_NAME_END)[0] ?? "";
-  if (!product || GENERIC_HTTP_CLIENTS.includes(product)) return null;
-  if (product !== "mozilla") {
-    return boundedAgentName(ua.includes("/") ? product : ua.replace(/[^a-z0-9._-]+/g, "-"));
-  }
-  const name = COMPATIBLE_NAME.exec(ua)?.[1] ?? BOT_LIKE_NAME.exec(ua)?.[1] ?? HEADLESS_NAME.exec(ua)?.[1];
-  if (!name || BROWSER_COMPATIBLE_NAMES.includes(name)) return null;
-  return boundedAgentName(name);
-}
-
 // ../integration-traffic/src/journey.ts
+var JOURNEY_RULES_VERSION = 2;
 var ASSET_EXTENSION_PATTERN = /\.(?:avif|bmp|css|gif|ico|jpe?g|js|map|mjs|mp3|mp4|otf|png|svg|ttf|txt|webm|webmanifest|webp|woff2?|xml)$/i;
 var ASSET_PATH_PREFIXES = ["/_next/static/", "/_nuxt/", "/_ipx/", "/_vercel/", "/assets/", "/build/", "/dist/", "/fonts/", "/images/", "/img/", "/static/", "/wp-content/", "/wp-includes/", "/cdn-cgi/"];
 var DATA_PATH_PATTERN = /\.json$|^\/api\/|^\/wp-json\/|^\/graphql/i;
@@ -18321,10 +18289,10 @@ function sessionizeJourneyRequests(requests, state, options) {
   let dropped = 0;
   let capped = 0;
   for (const [visitorKey, list] of byVisitor) {
-    list.sort((a, b) => a.observedAt < b.observedAt ? -1 : a.observedAt > b.observedAt ? 1 : 0);
+    list.sort((a, b) => a.observedAt < b.observedAt ? -1 : a.observedAt > b.observedAt ? 1 : Number(a.kind === "data") - Number(b.kind === "data"));
     const prior = state.get(visitorKey);
-    const isWeakAi = (r) => Boolean(r.signal.aiProduct) && r.stepReferer;
-    const isStrongAi = (r) => Boolean(r.signal.aiProduct) && !r.stepReferer;
+    const isWeakAi = (r) => r.kind === "page" && Boolean(r.signal.aiProduct) && r.stepReferer;
+    const isStrongAi = (r) => r.kind === "page" && Boolean(r.signal.aiProduct) && !r.stepReferer;
     const aiTimes = [...new Set([
       prior?.firstAiAt,
       prior?.lastAiAt,
@@ -18355,12 +18323,11 @@ function sessionizeJourneyRequests(requests, state, options) {
       }
       if (aiTouch && request.signal.aiProduct && !engineAt.has(request.observedAt)) engineAt.set(request.observedAt, request.signal.aiProduct);
       const entry = aiTouch ? classifyJourneyEntry(request.signal) : request.stepReferer ? DIRECT_ENTRY : classifyJourneyEntry({ ...request.signal, aiProduct: null, aiDomain: null, aiPaid: false });
-      const outside = aiTouch || hasEntryEvidence(request);
+      const outside = request.kind === "page" && (aiTouch || hasEntryEvidence(request));
       const placement = placeRequest(known, t, outside ? entryKey(entry) : null, options.idleMs);
       const continues = placement.visit !== void 0 && !placement.head;
       const kept = aiTouch || withinLookback || continues;
-      const opensVisit = placement.visit === void 0;
-      if (!kept || opensVisit && request.kind === "data" && !outside) {
+      if (!kept || request.kind === "data" && !continues) {
         dropped += 1;
         continue;
       }
@@ -18428,39 +18395,156 @@ function sessionizeJourneyRequests(requests, state, options) {
   return { visits: [...visits.values()], events, visitors, dropped, capped };
 }
 
-// ../integration-traffic/src/agent-journeys.ts
-function extractAgentJourneyRequests(events) {
-  const requests = [];
+// ../integration-traffic/src/scanner-bursts.ts
+var SCANNER_BURST_WINDOW_MS = 10 * 6e4;
+function mergeRuns(runs, windowMs) {
+  runs.sort((a, b) => a.firstProbeAt - b.firstProbeAt);
+  const merged = [];
+  for (const run of runs) {
+    const last = merged.at(-1);
+    if (last && run.firstProbeAt <= last.lastProbeAt + windowMs) last.lastProbeAt = Math.max(last.lastProbeAt, run.lastProbeAt);
+    else merged.push({ ...run });
+  }
+  return merged;
+}
+function findScannerBursts(events, options) {
+  const windowMs = options.windowMs ?? SCANNER_BURST_WINDOW_MS;
+  const keys = /* @__PURE__ */ new Map();
+  const probesByClient = /* @__PURE__ */ new Map();
+  const candidates = [];
   for (const event of events) {
-    if (isSelfTraffic(event)) continue;
+    const remoteIp = event.remoteIp?.trim();
+    if (!remoteIp || isSelfTraffic(event)) continue;
     const agent = classifyAiUserFetch(event);
-    if (!agent || agent.trust === AgentTrustLevels.likely_fake) continue;
-    const timestamp = Date.parse(event.observedAt);
-    if (!Number.isFinite(timestamp)) continue;
-    const path = event.path.split(/[?#]/)[0] || "/";
-    if (classifyTrafficPath(path) === TrafficPathClasses.asset && !/\.json\/?$/i.test(path)) continue;
-    const maskedPath = maskJourneyPath(path);
-    const retainedPath = maskedPath.length > 512 ? `${maskedPath.slice(0, 505)}/:token` : maskedPath;
-    requests.push({
-      sourceEventId: event.eventId,
-      ts: new Date(timestamp).toISOString(),
-      remoteIp: event.remoteIp?.trim() || null,
-      userAgent: agent.matchedUserAgent,
-      agentId: agent.botId,
-      operator: agent.operator,
-      product: agent.product,
-      verificationStatus: agent.verificationStatus,
-      verificationManifest: agent.verificationManifest,
-      trust: agent.trust,
-      trustReasons: agent.trustReasons,
-      host: hostOf(event.host) ?? hostOf(event.requestUrl),
-      path: retainedPath,
-      method: event.method?.trim().toUpperCase() || null,
-      status: event.status,
-      latencyMs: event.latencyMs !== null && Number.isFinite(event.latencyMs) && event.latencyMs >= 0 ? event.latencyMs : null
-    });
+    if (!agent || agent.trust === AgentTrustLevels.verified) continue;
+    const at = Date.parse(event.observedAt);
+    if (!Number.isFinite(at)) continue;
+    let client = keys.get(remoteIp);
+    if (client === void 0) {
+      client = options.clientKey(remoteIp);
+      keys.set(remoteIp, client);
+    }
+    if (client === null) continue;
+    if (agent.trustReasons.includes(AgentTrustReasons["scanner-path"])) {
+      const probes = probesByClient.get(client);
+      if (probes) probes.push(at);
+      else probesByClient.set(client, [at]);
+    } else if (agent.trust !== AgentTrustLevels.likely_fake) {
+      candidates.push({ eventId: event.eventId, client, at });
+    }
   }
-  return requests;
+  const clients = [.../* @__PURE__ */ new Set([...probesByClient.keys(), ...candidates.map((candidate) => candidate.client)])];
+  const known = clients.length > 0 && options.known ? options.known(clients) : /* @__PURE__ */ new Map();
+  const runsByClient = /* @__PURE__ */ new Map();
+  const windows = /* @__PURE__ */ new Map();
+  for (const client of clients) {
+    const stored = known.get(client);
+    const probes = probesByClient.get(client) ?? [];
+    const runs = mergeRuns([...stored ? [stored] : [], ...probes.map((at) => ({ firstProbeAt: at, lastProbeAt: at }))], windowMs);
+    if (runs.length === 0) continue;
+    runsByClient.set(client, runs);
+    const latest = runs.at(-1);
+    if (probes.length > 0 && (latest.firstProbeAt !== stored?.firstProbeAt || latest.lastProbeAt !== stored.lastProbeAt)) windows.set(client, latest);
+  }
+  const eventIds = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    const runs = runsByClient.get(candidate.client);
+    if (runs?.some((run) => candidate.at >= run.firstProbeAt - windowMs && candidate.at <= run.lastProbeAt + windowMs)) eventIds.add(candidate.eventId);
+  }
+  return { eventIds, windows };
+}
+function findScannerBurstsInBatch(events) {
+  return findScannerBursts(events, { clientKey: (remoteIp) => remoteIp }).eventIds;
+}
+
+// ../integration-traffic/src/unlisted-agents.ts
+var UNLISTED_AGENT_SKIPPED_EXTENSIONS = [
+  "avif",
+  "bmp",
+  "css",
+  "gif",
+  "ico",
+  "jpeg",
+  "jpg",
+  "js",
+  "map",
+  "mjs",
+  "mp3",
+  "mp4",
+  "otf",
+  "png",
+  "svg",
+  "ttf",
+  "webm",
+  "webmanifest",
+  "webp",
+  "woff",
+  "woff2",
+  "zip"
+];
+var GENERIC_HTTP_CLIENTS = [
+  "curl",
+  "wget",
+  "python",
+  "python-requests",
+  "python-urllib",
+  "python-httpx",
+  "aiohttp",
+  "httpx",
+  "go-http-client",
+  "okhttp",
+  "java",
+  "apache-httpclient",
+  "axios",
+  "node",
+  "node-fetch",
+  "undici",
+  "got",
+  "libwww-perl",
+  "guzzlehttp",
+  "ruby",
+  "faraday",
+  "http.rb",
+  "php",
+  "wordpress",
+  "dalvik",
+  "postmanruntime",
+  "insomnia"
+];
+var BROWSER_SHAPED_AGENT_MARKERS = ["compatible;", "fetch", "agent", "headless", "+http"];
+var PRODUCT_NAME_END = /[/\s;(]/;
+var SKIPPED_PATH = new RegExp(`\\.(?:${UNLISTED_AGENT_SKIPPED_EXTENSIONS.join("|")})$`, "i");
+var COMPATIBLE_NAME = /compatible;\s*([a-z0-9][a-z0-9._-]*)/;
+var BOT_LIKE_NAME = /([a-z0-9][a-z0-9._-]*(?:bot|crawler|spider|fetcher|agent|-user))\//;
+var HEADLESS_NAME = /\b(headless[a-z]*)\//;
+var BROWSER_COMPATIBLE_NAMES = ["msie"];
+var MAX_AGENT_NAME_LENGTH = 64;
+var HEADER_NAME_PREFIX = /^user-agent\s*:\s*/;
+var AGENT_NAME = /^[a-z0-9][a-z0-9._-]*$/;
+var KNOWN_AGENT_NAMES = [
+  { marker: "facebookexternalhit/1.1 facebot twitterbot/1.0", name: "imessage-link-preview" }
+];
+function boundedAgentName(name) {
+  const bounded = name.replace(/^[._-]+/, "").slice(0, MAX_AGENT_NAME_LENGTH).replace(/[._-]+$/, "");
+  return AGENT_NAME.test(bounded) ? bounded : null;
+}
+var UNRECOGNIZED_AGENT_NAMING_VERSION = 2;
+function unrecognizedAgentName(request) {
+  const method = (request.method ?? "GET").toUpperCase();
+  if (method !== "GET" && method !== "HEAD") return null;
+  if (request.path && SKIPPED_PATH.test(request.path.split("?")[0] ?? "")) return null;
+  const ua = (request.userAgent ?? "").trim().toLowerCase().replace(HEADER_NAME_PREFIX, "");
+  if (!ua) return null;
+  const known = KNOWN_AGENT_NAMES.find((entry) => ua.includes(entry.marker));
+  if (known) return known.name;
+  const product = ua.split(PRODUCT_NAME_END)[0] ?? "";
+  if (!product || GENERIC_HTTP_CLIENTS.includes(product)) return null;
+  if (product !== "mozilla") {
+    return boundedAgentName(ua.includes("/") ? product : ua.replace(/[^a-z0-9._-]+/g, "-"));
+  }
+  const name = COMPATIBLE_NAME.exec(ua)?.[1] ?? BOT_LIKE_NAME.exec(ua)?.[1] ?? HEADLESS_NAME.exec(ua)?.[1];
+  if (!name || BROWSER_COMPATIBLE_NAMES.includes(name)) return null;
+  return boundedAgentName(name);
 }
 
 // ../integration-traffic/src/rollup.ts
@@ -18594,6 +18678,7 @@ function buildTrafficProbeReport(events, options = {}) {
   const topAiReferralLandingPaths = /* @__PURE__ */ new Map();
   const includedEvents = events.filter((event) => !isSelfTraffic(event));
   const selfTrafficExcluded = events.length - includedEvents.length;
+  const scannerBursts = options.scannerBurstEventIds ?? findScannerBurstsInBatch(includedEvents);
   let crawlerHits = 0;
   let aiUserFetchHits = 0;
   let aiUserFetchLikelyFakeHits = 0;
@@ -18606,7 +18691,8 @@ function buildTrafficProbeReport(events, options = {}) {
     const tsHour = hourBucket(event.observedAt);
     const pathNormalized = normalizeTrafficPathPattern(event.path);
     const crawler = classifyCrawler(event);
-    const aiUserFetch = classifyAiUserFetch(event);
+    const classifiedFetch = classifyAiUserFetch(event);
+    const aiUserFetch = classifiedFetch && scannerBursts.has(event.eventId) ? withScannerBurst(classifiedFetch) : classifiedFetch;
     const aiReferral = classifyAiReferral(event);
     if (crawler) {
       crawlerHits += 1;
@@ -18806,6 +18892,43 @@ function incrementBucket(map, key, fields) {
   else map.set(key, { fields, hits: 1 });
 }
 
+// ../integration-traffic/src/agent-journeys.ts
+function extractAgentJourneyRequests(events, options = {}) {
+  const bursts = options.scannerBurstEventIds ?? findScannerBurstsInBatch(events);
+  const requests = [];
+  for (const event of events) {
+    if (isSelfTraffic(event)) continue;
+    const classified = classifyAiUserFetch(event);
+    const agent = classified && bursts.has(event.eventId) ? withScannerBurst(classified) : classified;
+    if (!agent || agent.trust === AgentTrustLevels.likely_fake) continue;
+    const timestamp = Date.parse(event.observedAt);
+    if (!Number.isFinite(timestamp)) continue;
+    const path = event.path.split(/[?#]/)[0] || "/";
+    if (classifyTrafficPath(path) === TrafficPathClasses.asset && !/\.json\/?$/i.test(path)) continue;
+    const maskedPath = maskJourneyPath(path);
+    const retainedPath = maskedPath.length > 512 ? `${maskedPath.slice(0, 505)}/:token` : maskedPath;
+    requests.push({
+      sourceEventId: event.eventId,
+      ts: new Date(timestamp).toISOString(),
+      remoteIp: event.remoteIp?.trim() || null,
+      userAgent: agent.matchedUserAgent,
+      agentId: agent.botId,
+      operator: agent.operator,
+      product: agent.product,
+      verificationStatus: agent.verificationStatus,
+      verificationManifest: agent.verificationManifest,
+      trust: agent.trust,
+      trustReasons: agent.trustReasons,
+      host: hostOf(event.host) ?? hostOf(event.requestUrl),
+      path: retainedPath,
+      method: event.method?.trim().toUpperCase() || null,
+      status: event.status,
+      latencyMs: event.latencyMs !== null && Number.isFinite(event.latencyMs) && event.latencyMs >= 0 ? event.latencyMs : null
+    });
+  }
+  return requests;
+}
+
 // ../integration-cloudflare-worker/src/types.ts
 var CLOUDFLARE_WORKER_BINDINGS = {
   deliveryMode: "CANONRY_DELIVERY_MODE",
@@ -19406,19 +19529,26 @@ function verifyRequestSignature(opts) {
 }
 
 export {
+  AGENT_TRUST_RULES_VERSION,
+  isScannerPath,
   SELF_TRAFFIC_USER_AGENT_PATTERNS,
   DEFAULT_AI_CRAWLER_RULES,
   isSelfTraffic,
   classifyCrawler,
   classifyAiUserFetch,
+  classifyAiReferral,
+  JOURNEY_RULES_VERSION,
   extractJourneyRequests,
   sessionizeJourneyRequests,
+  SCANNER_BURST_WINDOW_MS,
+  findScannerBursts,
   extractAgentJourneyRequests,
   UNLISTED_AGENT_SKIPPED_EXTENSIONS,
   GENERIC_HTTP_CLIENTS,
   BROWSER_SHAPED_AGENT_MARKERS,
   UNRECOGNIZED_AGENT_NAMING_VERSION,
   unrecognizedAgentName,
+  normalizeTrafficPathPattern,
   buildTrafficProbeReport,
   normalizeCloudflareWorkerEvent,
   CLOUDFLARE_WORKER_BINDINGS,