@devtune/ai-traffic 0.10.0 → 0.12.0

package/dist/cjs/index.js

@@ -4,7 +4,7 @@
  * Exposes middleware helpers, route wrappers, and registry matching utilities.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FALLBACK_AI_REFERRER_REGISTRY_ENTRIES = exports.detectAiReferrer = exports.detectAiCrawler = exports.parseAiBotRegistryPayload = exports.matchAiBotRegistryEntry = exports.compileAiBotRegistryEntries = exports.FALLBACK_AI_BOT_REGISTRY_ENTRIES = exports.resolveClientIp = exports.detectTrustedProxy = exports.SDK_VERSION_HEADER = exports.SDK_VERSION = exports.withDevTuneAiTrafficRoute = exports.mightBeAiBotUserAgent = exports.createDevTuneAiTrafficMiddleware = exports.createDevTuneAiTraffic = exports.DevTuneAiTrafficClient = exports.DEFAULT_REGISTRY_URL = exports.DEFAULT_INGEST_ENDPOINT = void 0;
+exports.FALLBACK_AI_REFERRER_REGISTRY_ENTRIES = exports.detectAiReferrer = exports.detectAiCrawler = exports.parseAiBotRegistryPayload = exports.matchAiBotRegistryEntry = exports.compileAiBotRegistryEntries = exports.FALLBACK_AI_BOT_REGISTRY_ENTRIES = exports.resolveClientIp = exports.detectTrustedProxy = exports.WEB_BOT_AUTH_FORWARDED_HEADERS = exports.SDK_VERSION_HEADER = exports.SDK_VERSION = exports.withDevTuneAiTrafficRoute = exports.mightBeAiBotUserAgent = exports.createDevTuneAiTrafficMiddleware = exports.createDevTuneAiTraffic = exports.DevTuneAiTrafficClient = exports.DEFAULT_REGISTRY_URL = exports.DEFAULT_INGEST_ENDPOINT = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "DEFAULT_INGEST_ENDPOINT", { enumerable: true, get: function () { return client_js_1.DEFAULT_INGEST_ENDPOINT; } });
 Object.defineProperty(exports, "DEFAULT_REGISTRY_URL", { enumerable: true, get: function () { return client_js_1.DEFAULT_REGISTRY_URL; } });
@@ -16,6 +16,8 @@ Object.defineProperty(exports, "withDevTuneAiTrafficRoute", { enumerable: true,
 var version_js_1 = require("./version.js");
 Object.defineProperty(exports, "SDK_VERSION", { enumerable: true, get: function () { return version_js_1.SDK_VERSION; } });
 Object.defineProperty(exports, "SDK_VERSION_HEADER", { enumerable: true, get: function () { return version_js_1.SDK_VERSION_HEADER; } });
+var web_bot_auth_js_1 = require("./web-bot-auth.js");
+Object.defineProperty(exports, "WEB_BOT_AUTH_FORWARDED_HEADERS", { enumerable: true, get: function () { return web_bot_auth_js_1.WEB_BOT_AUTH_FORWARDED_HEADERS; } });
 var client_ip_js_1 = require("./client-ip.js");
 Object.defineProperty(exports, "detectTrustedProxy", { enumerable: true, get: function () { return client_ip_js_1.detectTrustedProxy; } });
 Object.defineProperty(exports, "resolveClientIp", { enumerable: true, get: function () { return client_ip_js_1.resolveClientIp; } });

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,yCAgBqB;AAfnB,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,mHAAA,sBAAsB,OAAA;AACtB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAChC,kHAAA,qBAAqB,OAAA;AACrB,sHAAA,yBAAyB,OAAA;AAW3B,2CAA+D;AAAtD,yGAAA,WAAW,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAExC,+CAIwB;AAHtB,kHAAA,kBAAkB,OAAA;AAClB,+GAAA,eAAe,OAAA;AAIjB,6CASuB;AARrB,+HAAA,gCAAgC,OAAA;AAChC,0HAAA,2BAA2B,OAAA;AAC3B,sHAAA,uBAAuB,OAAA;AACvB,wHAAA,yBAAyB,OAAA;AAO3B,+CAUwB;AATtB,+GAAA,eAAe,OAAA;AACf,gHAAA,gBAAgB,OAAA;AAChB,qIAAA,qCAAqC,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,yCAgBqB;AAfnB,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,mHAAA,sBAAsB,OAAA;AACtB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAChC,kHAAA,qBAAqB,OAAA;AACrB,sHAAA,yBAAyB,OAAA;AAW3B,2CAA+D;AAAtD,yGAAA,WAAW,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAExC,qDAAoG;AAA3F,iIAAA,8BAA8B,OAAA;AAEvC,+CAIwB;AAHtB,kHAAA,kBAAkB,OAAA;AAClB,+GAAA,eAAe,OAAA;AAIjB,6CASuB;AARrB,+HAAA,gCAAgC,OAAA;AAChC,0HAAA,2BAA2B,OAAA;AAC3B,sHAAA,uBAAuB,OAAA;AACvB,wHAAA,yBAAyB,OAAA;AAO3B,+CAUwB;AATtB,+GAAA,eAAe,OAAA;AACf,gHAAA,gBAAgB,OAAA;AAChB,qIAAA,qCAAqC,OAAA"}

package/dist/cjs/node.js

@@ -14,13 +14,17 @@ function createDevTuneAiTrafficNodeHandler(options) {
             headers: createHeadersLike(request),
             url: createRequestUrl(request, origin),
             ip: request.socket?.remoteAddress ?? null,
+            method: request.method,
+            targetUri: createTargetUri(request),
         };
         client.refreshRegistryIfStale();
         if (!client.mightTrackRequest(requestLike)) {
             return;
         }
+        // Recorded after the response, so keep the arrival time a signature is checked against.
+        const receivedAt = client.signedArrivalTime(requestLike);
         response.once("finish", () => {
-            client.trackRequest(requestLike, undefined, response.statusCode);
+            client.trackRequest(requestLike, undefined, response.statusCode, receivedAt);
         });
     };
 }
@@ -29,6 +33,9 @@ function createHeadersLike(request) {
         get(name) {
             return getHeader(request, name);
         },
+        getCombined(name) {
+            return ownCombinedHeaderValue(request.headers, name);
+        },
     };
 }
 function createRequestUrl(request, configuredOrigin) {
@@ -40,11 +47,30 @@ function createRequestUrl(request, configuredOrigin) {
         return requestPath;
     }
 }
-function getRequestOrigin(request) {
+/**
+ * The URL a signature covers, as the request line and the raw host (`X-Forwarded-Host`, then `Host`) carried
+ * it. Never parsed, so a signed `https://EXAMPLE.com:443/guide` is forwarded
+ * byte for byte. A configured `origin` never replaces the host the agent
+ * signed. An absolute-form request target is already the whole URL. Null
+ * when there is no host to build it from.
+ */
+function createTargetUri(request) {
+    const requestPath = request.url ?? "/";
+    // An absolute-form target is already the whole URL; any other non-path
+    // form (`*`, authority-form) is not a URL a signature can cover.
+    if (!requestPath.startsWith("/")) {
+        return /^https?:\/\//iu.test(requestPath) ? requestPath : null;
+    }
+    const host = getRequestHost(request);
+    return host ? `${getRequestOrigin(request, host)}${requestPath}` : null;
+}
+function getRequestOrigin(request, host = getRequestHost(request) || "localhost") {
     const forwardedProtocol = getForwardedHeader(request, "x-forwarded-proto");
     const protocol = forwardedProtocol ?? (request.socket?.encrypted ? "https" : "http");
-    const host = getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host");
-    return `${protocol}://${host || "localhost"}`;
+    return `${protocol}://${host}`;
+}
+function getRequestHost(request) {
+    return getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host");
 }
 function getHeader(request, name) {
     return headerValue(request.headers[name.toLowerCase()]);
@@ -59,4 +85,27 @@ function headerValue(value) {
     }
     return value?.[0] ?? null;
 }
+/**
+ * A covered field's value, read only as an own property: the names come from
+ * a client's `Signature-Input`, so `constructor` or `__proto__` must not
+ * reach an inherited value.
+ */
+function ownCombinedHeaderValue(headers, name) {
+    const key = name.toLowerCase();
+    return Object.prototype.hasOwnProperty.call(headers, key)
+        ? combinedHeaderValue(headers[key])
+        : null;
+}
+/**
+ * Repeated values combine with ", " as RFC 9110 field combination does. Only
+ * a string or an array of strings is a value; anything else is absent.
+ */
+function combinedHeaderValue(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string")
+        ? value.join(", ")
+        : null;
+}
 //# sourceMappingURL=node.js.map

package/dist/cjs/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../../../node/src/node.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA4BH,8EAwBC;AAlDD,oDAI6B;AAsB7B,SAAgB,iCAAiC,CAAC,OAAoC;IACpF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAA,mCAAsB,EAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,2BAA2B,CACzC,OAAoC,EACpC,QAAsC;QAEtC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;SAC1C,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoC;IAC7D,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC,EAAE,gBAAyB;IACvF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC;IAC5D,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE3F,OAAO,GAAG,QAAQ,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,OAAoC,EAAE,IAAY;IACnE,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../../node/src/node.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA6BH,8EA6BC;AAxDD,oDAI6B;AAuB7B,SAAgB,iCAAiC,CAAC,OAAoC;IACpF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAA,mCAAsB,EAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,2BAA2B,CACzC,OAAoC,EACpC,QAAsC;QAEtC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;SACpC,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,wFAAwF;QACxF,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEzD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoC;IAC7D,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,WAAW,CAAC,IAAI;YACd,OAAO,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC,EAAE,gBAAyB;IACvF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAoC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAoC,EACpC,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,WAAW;IAE7C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAErF,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAoC;IAC1D,OAAO,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,SAAS,CAAC,OAAoC,EAAE,IAAY;IACnE,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAoC,EAAE,IAAY;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAE/B,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAChG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}

package/dist/cjs/vercel-oidc.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * ABOUTME: Vercel OIDC credentials for ingest, used instead of an ingest key on Vercel.
+ * Filters the per-request token header and exchanges it for DevTune's audience with a cache.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VercelOidcTokenExchanger = exports.VercelOidcExchangeError = exports.TOKEN_EXPIRY_MARGIN_MS = exports.VERCEL_TOKEN_EXCHANGE_URL = exports.DEVTUNE_INGEST_AUDIENCE = exports.DEVTUNE_PROJECT_HEADER = exports.VERCEL_OIDC_TOKEN_HEADER = void 0;
+exports.isDevTuneProjectId = isDevTuneProjectId;
+exports.readVercelOidcTokenExpiry = readVercelOidcTokenExpiry;
+/** Vercel sets this on every request to a deployment that has OIDC enabled. */
+exports.VERCEL_OIDC_TOKEN_HEADER = "x-vercel-oidc-token";
+/** Tells the ingest route which DevTune project's Vercel link to check the token against. */
+exports.DEVTUNE_PROJECT_HEADER = "x-devtune-project";
+exports.DEVTUNE_INGEST_AUDIENCE = "https://devtune.ai/ai-traffic-ingest";
+exports.VERCEL_TOKEN_EXCHANGE_URL = "https://oidc.vercel.com/~token";
+const VERCEL_OIDC_ISSUER = "https://oidc.vercel.com";
+const MAX_TOKEN_LENGTH = 8_192;
+const TOKEN_EXCHANGE_TIMEOUT_MS = 5_000;
+const BASE64URL_SEGMENT = /^[A-Za-z0-9_-]+$/u;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+/** Tokens this close to expiry are neither captured, exchanged nor served from the cache. */
+exports.TOKEN_EXPIRY_MARGIN_MS = 60_000;
+function isDevTuneProjectId(value) {
+    return UUID_PATTERN.test(value);
+}
+/**
+ * Returns the token's expiry in milliseconds when the value looks like a live
+ * Vercel OIDC token, or null for anything else.
+ *
+ * The signature is not checked: the SDK has no way to, and the ingest route
+ * verifies it. This filter only keeps a client-supplied junk header, a token
+ * from another issuer or an expired token from replacing a good one.
+ */
+function readVercelOidcTokenExpiry(value, nowMs) {
+    if (value.length > MAX_TOKEN_LENGTH) {
+        return null;
+    }
+    const segments = value.split(".");
+    if (segments.length !== 3 || !segments.every((segment) => BASE64URL_SEGMENT.test(segment))) {
+        return null;
+    }
+    const claims = decodeJsonSegment(segments[1] ?? "");
+    if (!claims ||
+        typeof claims.iss !== "string" ||
+        (claims.iss !== VERCEL_OIDC_ISSUER && !claims.iss.startsWith(`${VERCEL_OIDC_ISSUER}/`)) ||
+        typeof claims.owner_id !== "string" ||
+        typeof claims.project_id !== "string" ||
+        typeof claims.exp !== "number" ||
+        !Number.isFinite(claims.exp)) {
+        return null;
+    }
+    const expiresAtMs = claims.exp * 1000;
+    return expiresAtMs - nowMs > exports.TOKEN_EXPIRY_MARGIN_MS ? expiresAtMs : null;
+}
+/**
+ * Thrown when Vercel answers an exchange but not with a usable token. Carries
+ * a fixed `kind` and the status, so callers can report the failure without
+ * reading any message text.
+ */
+class VercelOidcExchangeError extends Error {
+    kind;
+    status;
+    constructor(kind, status) {
+        super(kind === "exchange_status"
+            ? `Vercel OIDC token exchange failed with status ${status}`
+            : "Vercel OIDC token exchange returned an unusable response");
+        this.kind = kind;
+        this.status = status;
+        this.name = "VercelOidcExchangeError";
+    }
+}
+exports.VercelOidcExchangeError = VercelOidcExchangeError;
+/**
+ * Exchanges a deployment's Vercel OIDC token for one scoped to DevTune's
+ * ingest audience.
+ *
+ * Results are cached in memory by source token until their expiry, less the
+ * margin, and expired entries are dropped on every call, so the steady state
+ * is one entry per live source token. Callers that need the same token at once
+ * share one request. Vercel's answers are reported as a
+ * `VercelOidcExchangeError`; anything the fetch itself throws is passed on.
+ */
+class VercelOidcTokenExchanger {
+    fetchImpl;
+    nowMs;
+    cache = new Map();
+    inFlight = new Map();
+    constructor(fetchImpl, nowMs) {
+        this.fetchImpl = fetchImpl;
+        this.nowMs = nowMs;
+    }
+    async exchange(sourceToken) {
+        const nowMs = this.nowMs();
+        for (const [key, entry] of this.cache) {
+            if (entry.usableUntilMs <= nowMs) {
+                this.cache.delete(key);
+            }
+        }
+        const cached = this.cache.get(sourceToken);
+        if (cached) {
+            return cached.token;
+        }
+        const pending = this.inFlight.get(sourceToken);
+        if (pending) {
+            return pending;
+        }
+        const request = this.requestExchange(sourceToken).finally(() => {
+            this.inFlight.delete(sourceToken);
+        });
+        this.inFlight.set(sourceToken, request);
+        return request;
+    }
+    async requestExchange(sourceToken) {
+        const response = await this.fetchImpl(exports.VERCEL_TOKEN_EXCHANGE_URL, {
+            body: JSON.stringify({ token: sourceToken, aud: exports.DEVTUNE_INGEST_AUDIENCE }),
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json",
+            },
+            method: "POST",
+            signal: AbortSignal.timeout(TOKEN_EXCHANGE_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            throw new VercelOidcExchangeError("exchange_status", response.status);
+        }
+        const payload = await response.json().catch(() => null);
+        if (!isRecord(payload) ||
+            typeof payload.token !== "string" ||
+            payload.token.length === 0 ||
+            typeof payload.expiry !== "number" ||
+            !Number.isFinite(payload.expiry)) {
+            throw new VercelOidcExchangeError("exchange_response");
+        }
+        const usableUntilMs = payload.expiry * 1000 - exports.TOKEN_EXPIRY_MARGIN_MS;
+        // A token that is already inside the margin would only be rejected at ingest.
+        if (usableUntilMs <= this.nowMs()) {
+            throw new VercelOidcExchangeError("exchange_response");
+        }
+        this.cache.set(sourceToken, { token: payload.token, usableUntilMs });
+        return payload.token;
+    }
+}
+exports.VercelOidcTokenExchanger = VercelOidcTokenExchanger;
+function decodeJsonSegment(segment) {
+    try {
+        const base64 = segment.replace(/-/gu, "+").replace(/_/gu, "/");
+        const binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="));
+        const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+        const value = JSON.parse(new TextDecoder().decode(bytes));
+        return isRecord(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+//# sourceMappingURL=vercel-oidc.js.map

package/dist/cjs/vercel-oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-oidc.js","sourceRoot":"","sources":["../../src/vercel-oidc.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAoBH,gDAEC;AAUD,8DA4BC;AA1DD,+EAA+E;AAClE,QAAA,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,mBAAmB,CAAC;AAE7C,QAAA,uBAAuB,GAAG,sCAAsC,CAAC;AACjE,QAAA,yBAAyB,GAAG,gCAAgC,CAAC;AAE1E,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AACrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,yBAAyB,GAAG,KAAK,CAAC;AACxC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,YAAY,GAAG,kEAAkE,CAAC;AAExF,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,MAAM,CAAC;AAE7C,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,KAAa,EAAE,KAAa;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,GAAG,KAAK,kBAAkB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAEtC,OAAO,WAAW,GAAG,KAAK,GAAG,8BAAsB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAID;;;;GAIG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IAErC;IACA;IAFX,YACW,IAAmC,EACnC,MAAe;QAExB,KAAK,CACH,IAAI,KAAK,iBAAiB;YACxB,CAAC,CAAC,iDAAiD,MAAM,EAAE;YAC3D,CAAC,CAAC,0DAA0D,CAC/D,CAAC;QAPO,SAAI,GAAJ,IAAI,CAA+B;QACnC,WAAM,GAAN,MAAM,CAAS;QAOxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAZD,0DAYC;AAOD;;;;;;;;;GASG;AACH,MAAa,wBAAwB;IAKhB;IACA;IALF,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/D,YACmB,SAAuB,EACvB,KAAmB;QADnB,cAAS,GAAT,SAAS,CAAc;QACvB,UAAK,GAAL,KAAK,CAAc;IACnC,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE/C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAExC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,WAAmB;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iCAAyB,EAAE;YAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,+BAAuB,EAAE,CAAC;YAC1E,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,yBAAyB,CAAC;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAEjE,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,8BAAsB,CAAC;QAErE,8EAA8E;QAC9E,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAErE,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;CACF;AA7ED,4DA6EC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAEnE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC"}

package/dist/cjs/version.js

@@ -6,7 +6,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION_HEADER = exports.SDK_VERSION = void 0;
 /** Must equal `version` in package.json; a unit test and the release check enforce it. */
-exports.SDK_VERSION = "0.10.0";
+exports.SDK_VERSION = "0.12.0";
 /** Sent on every ingest and registry request. Carries the version only, no visitor data. */
 exports.SDK_VERSION_HEADER = "x-devtune-sdk-version";
 //# sourceMappingURL=version.js.map

package/dist/cjs/web-bot-auth.js

@@ -0,0 +1,238 @@
+"use strict";
+/**
+ * ABOUTME: Collects the Web Bot Auth signature material DevTune needs to verify a signed agent request.
+ * Forwards the signature headers verbatim with the request line and covered fields; never verifies, logs or stores them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WEB_BOT_AUTH_FORWARDED_HEADERS = void 0;
+exports.readWebBotAuth = readWebBotAuth;
+exports.hasWebBotAuthHeaders = hasWebBotAuthHeaders;
+const MAX_SIGNATURE_LENGTH = 4096;
+const MAX_SIGNATURE_INPUT_LENGTH = 4096;
+const MAX_SIGNATURE_AGENT_LENGTH = 2048;
+const MAX_METHOD_LENGTH = 16;
+const MAX_TARGET_URI_LENGTH = 8192;
+const MAX_HEADER_VALUE_LENGTH = 4096;
+const SIGNATURE_HEADERS = new Set(["signature", "signature-input", "signature-agent"]);
+/**
+ * Derived components that depend on the path, query or scheme, which a Fetch
+ * runtime may have rewritten: it normalises the path, and behind a
+ * TLS-terminating proxy its `request.url` can be `http:` for an `https:`
+ * request.
+ */
+const FETCH_REWRITTEN_COMPONENTS = new Set([
+    "@path",
+    "@query",
+    "@request-target",
+    "@scheme",
+    "@target-uri",
+]);
+/**
+ * The only header fields ever forwarded with a signature: non-sensitive
+ * request headers. A request whose signature covers any other field, besides
+ * the three signature headers, forwards no signature material at all, since
+ * an unknown field may carry a credential and dropping just that field would
+ * leave a signature that can never verify. Short enough to stay within
+ * ingest's limits of 16 fields and 128-character names.
+ */
+exports.WEB_BOT_AUTH_FORWARDED_HEADERS = [
+    "accept",
+    "accept-encoding",
+    "accept-language",
+    "cache-control",
+    "content-length",
+    "content-type",
+    "date",
+    "from",
+    "host",
+    "user-agent",
+];
+const FORWARDED_HEADERS = new Set(exports.WEB_BOT_AUTH_FORWARDED_HEADERS);
+/** RFC 9110 field-value characters: visible ASCII, SP and HTAB. */
+const FIELD_VALUE = /^[\t\x20-\x7e]*$/u;
+/** RFC 9110 method token. */
+const METHOD = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u;
+/** An absolute URI as sent on the wire: visible ASCII, no whitespace. */
+const TARGET_URI = /^[\x21-\x7e]+$/u;
+/**
+ * Reads the material for a request that carries all three of `Signature`,
+ * `Signature-Input` and `Signature-Agent`, or returns null.
+ *
+ * Also returns null when anything would exceed ingest's limits or is not a
+ * value the site could have received, rather than truncating: a truncated
+ * signature can never verify, and the event is then sent exactly as an
+ * unsigned one would be.
+ *
+ * `targetUri` must carry the authority and target the agent sent. A target
+ * that differs from the event's `url` only makes DevTune's check
+ * inconclusive, but a rewritten one that happens to match `url` turns a
+ * genuine signature into a failed one.
+ *
+ * A target with a query, even a bare `?`, forwards nothing. The query can
+ * carry a reset token, an OAuth code or search terms, and DevTune could not
+ * verify the signature anyway: the event's `url` never has a query, so the
+ * target would not match it.
+ */
+function readWebBotAuth(request) {
+    if (!hasWebBotAuthHeaders(request)) {
+        return null;
+    }
+    const signature = request.headers.get("signature");
+    const signatureInput = request.headers.get("signature-input");
+    const signatureAgent = request.headers.get("signature-agent");
+    const { method } = request;
+    const targetUri = request.targetUri === undefined ? readFetchTargetUri(request) : request.targetUri;
+    if (targetUri === null ||
+        targetUri.includes("?") ||
+        !isFieldValue(signature, MAX_SIGNATURE_LENGTH) ||
+        !isFieldValue(signatureInput, MAX_SIGNATURE_INPUT_LENGTH) ||
+        !isFieldValue(signatureAgent, MAX_SIGNATURE_AGENT_LENGTH) ||
+        !method ||
+        method.length > MAX_METHOD_LENGTH ||
+        !METHOD.test(method) ||
+        targetUri.length > MAX_TARGET_URI_LENGTH ||
+        !TARGET_URI.test(targetUri)) {
+        return null;
+    }
+    const components = readCoveredComponents(signatureInput);
+    // A Fetch runtime has already normalised the path (`/a/../guide` arrives as
+    // `/guide`) and may report a proxied `https:` request as `http:`. The raw
+    // forms are gone, so a signature over them would be checked against a
+    // rewritten base and fail. Signatures over `@authority` and
+    // `signature-agent` alone depend on neither and still forward.
+    if (request.targetUri === undefined &&
+        components.some((component) => FETCH_REWRITTEN_COMPONENTS.has(component))) {
+        return null;
+    }
+    const coveredNames = components.filter((component) => !component.startsWith("@") && !SIGNATURE_HEADERS.has(component));
+    if (coveredNames.some((name) => !FORWARDED_HEADERS.has(name))) {
+        return null;
+    }
+    const headers = new Map();
+    for (const name of coveredNames) {
+        if (headers.has(name)) {
+            continue;
+        }
+        const value = request.headers.getCombined
+            ? request.headers.getCombined(name)
+            : request.headers.get(name);
+        if (value === null) {
+            continue;
+        }
+        if (!isFieldValue(value, MAX_HEADER_VALUE_LENGTH, true)) {
+            return null;
+        }
+        headers.set(name, value);
+    }
+    return {
+        signature,
+        signatureInput,
+        signatureAgent,
+        method,
+        targetUri,
+        ...(headers.size === 0 ? {} : { headers: Object.fromEntries(headers) }),
+    };
+}
+/**
+ * The signed target for a Fetch-compatible runtime, which hands over
+ * `request.url` already normalised: `https://DOCS.example.com:443/guide`
+ * arrives as `https://docs.example.com/guide`. The authority is put back
+ * from the raw header the runtime built `url` from, `X-Forwarded-Host` or
+ * `Host`, and falls back to the raw `Host` when neither matches, so it is
+ * never a rewritten one. The scheme and path still come from `url`, which is
+ * why a signature covering a component that depends on them is not
+ * forwarded from here. Null without a `Host` header, or when `url` has a
+ * query, which `url.search` would hide when it is a bare `?`.
+ */
+function readFetchTargetUri(request) {
+    const host = request.headers.get("host");
+    let url;
+    try {
+        url = new URL(request.url);
+    }
+    catch {
+        return null;
+    }
+    if (!host || request.url.split("#", 1)[0]?.includes("?")) {
+        return null;
+    }
+    const forwardedHost = request.headers.get("x-forwarded-host")?.split(",", 1)[0]?.trim();
+    const authority = [forwardedHost, host].find((candidate) => candidate && normalizeHost(url.protocol, candidate) === url.host) ?? host;
+    return `${url.protocol}//${authority}${url.pathname}`;
+}
+function normalizeHost(protocol, host) {
+    try {
+        return new URL(`${protocol}//${host}`).host;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a request carries all three Web Bot Auth signature headers, the
+ * only requests whose arrival time or signature material is worth reading.
+ */
+function hasWebBotAuthHeaders(request) {
+    return (request.headers.get("signature") !== null &&
+        request.headers.get("signature-input") !== null &&
+        request.headers.get("signature-agent") !== null);
+}
+/**
+ * Component identifiers a `Signature-Input` covers, across every signature it
+ * labels: header field names and derived components such as `@path`. This is
+ * just enough of RFC 8941 to find the strings that start an inner-list item:
+ * quoted strings are skipped whole, so a parameter value such as `key="a"` or
+ * `keyid="x (y)"` is never mistaken for one. Anything odd in the input is left
+ * for the caller or DevTune's parser to reject.
+ */
+function readCoveredComponents(signatureInput) {
+    const names = [];
+    let inInnerList = false;
+    let previous = "";
+    for (let index = 0; index < signatureInput.length; index += 1) {
+        const char = signatureInput[index];
+        if (char === '"') {
+            const end = findStringEnd(signatureInput, index + 1);
+            if (end === -1) {
+                break;
+            }
+            if (inInnerList && (previous === "(" || previous === " ")) {
+                names.push(signatureInput.slice(index + 1, end).replace(/\\(["\\])/gu, "$1"));
+            }
+            index = end;
+            previous = '"';
+            continue;
+        }
+        if (char === "(") {
+            inInnerList = true;
+        }
+        else if (char === ")") {
+            inInnerList = false;
+        }
+        previous = char ?? "";
+    }
+    return names;
+}
+/** Index of the quote closing an sf-string that opened before `start`, or -1. */
+function findStringEnd(value, start) {
+    for (let index = start; index < value.length; index += 1) {
+        if (value[index] === "\\") {
+            index += 1;
+        }
+        else if (value[index] === '"') {
+            return index;
+        }
+    }
+    return -1;
+}
+/**
+ * Also rejects a non-string, which a hand-written `HeadersLike` can return
+ * for a repeated field and which ingest's schema would refuse.
+ */
+function isFieldValue(value, maxLength, allowEmpty = false) {
+    return (typeof value === "string" &&
+        (allowEmpty || value.length > 0) &&
+        value.length <= maxLength &&
+        FIELD_VALUE.test(value));
+}
+//# sourceMappingURL=web-bot-auth.js.map

package/dist/cjs/web-bot-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-bot-auth.js","sourceRoot":"","sources":["../../src/web-bot-auth.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA4FH,wCAiFC;AAgDD,oDAMC;AA9MD,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACvF;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO;IACP,QAAQ;IACR,iBAAiB;IACjB,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;;GAOG;AACU,QAAA,8BAA8B,GAAsB;IAC/D,QAAQ;IACR,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,MAAM;IACN,MAAM;IACN,MAAM;IACN,YAAY;CACb,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,sCAA8B,CAAC,CAAC;AAElE,mEAAmE;AACnE,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,6BAA6B;AAC7B,MAAM,MAAM,GAAG,iCAAiC,CAAC;AACjD,yEAAyE;AACzE,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,cAAc,CAC5B,OAAsE;IAEtE,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAEpF,IACE,SAAS,KAAK,IAAI;QAClB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,CAAC,YAAY,CAAC,SAAS,EAAE,oBAAoB,CAAC;QAC9C,CAAC,YAAY,CAAC,cAAc,EAAE,0BAA0B,CAAC;QACzD,CAAC,YAAY,CAAC,cAAc,EAAE,0BAA0B,CAAC;QACzD,CAAC,MAAM;QACP,MAAM,CAAC,MAAM,GAAG,iBAAiB;QACjC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACpB,SAAS,CAAC,MAAM,GAAG,qBAAqB;QACxC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,4DAA4D;IAC5D,+DAA+D;IAC/D,IACE,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CACpC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAC/E,CAAC;IAEF,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW;YACvC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;YACnC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,SAAS;QACT,cAAc;QACd,cAAc;QACd,MAAM;QACN,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,OAA6C;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACxF,MAAM,SAAS,GACb,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CACxB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,IAAI,CAChF,IAAI,IAAI,CAAC;IAEZ,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAqC;IACxE,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;QACzC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI;QAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,cAAsB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,aAAa,CAAC,cAAc,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAErD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM;YACR,CAAC;YAED,IAAI,WAAW,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;YAChF,CAAC;YAED,KAAK,GAAG,GAAG,CAAC;YACZ,QAAQ,GAAG,GAAG,CAAC;YAEf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QAED,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,KAAoB,EACpB,SAAiB,EACjB,UAAU,GAAG,KAAK;IAElB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,KAAK,CAAC,MAAM,IAAI,SAAS;QACzB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CACxB,CAAC;AACJ,CAAC"}