@devtune/ai-traffic 0.10.0 → 0.12.0

package/dist/express.js

@@ -11,14 +11,18 @@ export function createDevTuneAiTrafficExpressMiddleware(options) {
             headers: createHeadersLike(request),
             url: createRequestUrl(request, origin),
             ip: request.socket?.remoteAddress ?? null,
+            method: request.method,
+            targetUri: createTargetUri(request),
         };
         client.refreshRegistryIfStale();
         if (!client.mightTrackRequest(requestLike)) {
             next();
             return;
         }
+        // Recorded after the response, so keep the arrival time a signature is checked against.
+        const receivedAt = client.signedArrivalTime(requestLike);
         response.once("finish", () => {
-            client.trackRequest(requestLike, undefined, response.statusCode);
+            client.trackRequest(requestLike, undefined, response.statusCode, receivedAt);
         });
         next();
     };
@@ -28,6 +32,11 @@ function createHeadersLike(request) {
         get(name) {
             return getHeader(request, name);
         },
+        // Express's getter reads `request.headers` with inherited properties, so
+        // its result is trusted only when it is a string or an array of strings.
+        getCombined(name) {
+            return (combinedHeaderValue(request.get?.(name)) ?? ownCombinedHeaderValue(request.headers, name));
+        },
     };
 }
 function createRequestUrl(request, configuredOrigin) {
@@ -39,13 +48,33 @@ function createRequestUrl(request, configuredOrigin) {
         return requestPath;
     }
 }
-function getRequestOrigin(request) {
+/**
+ * The URL a signature covers, as the request line and the raw host (`X-Forwarded-Host`, then `Host`) carried
+ * it. Never parsed, so a signed `https://EXAMPLE.com:443/guide` is forwarded
+ * byte for byte. A configured `origin` never replaces the host the agent
+ * signed. An absolute-form request target is already the whole URL. Null
+ * when there is no host to build it from.
+ */
+function createTargetUri(request) {
+    const requestPath = request.originalUrl ?? request.url;
+    // An absolute-form target is already the whole URL; any other non-path
+    // form (`*`, authority-form) is not a URL a signature can cover.
+    if (!requestPath.startsWith("/")) {
+        return /^https?:\/\//iu.test(requestPath) ? requestPath : null;
+    }
+    const host = getRequestHost(request);
+    return host ? `${getRequestOrigin(request, host)}${requestPath}` : null;
+}
+function getRequestOrigin(request, host = getRequestHost(request) ?? "localhost") {
     const protocol = getForwardedHeader(request, "x-forwarded-proto") ?? request.protocol ?? "http";
-    const host = getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host") ?? "localhost";
     return `${protocol}://${host}`;
 }
+function getRequestHost(request) {
+    return getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host");
+}
+/** Express's getter can return a repeated field as an array; like the raw headers, it reads the first value. */
 function getHeader(request, name) {
-    return request.get?.(name) ?? headerValue(request.headers[name.toLowerCase()]);
+    return headerValue(request.get?.(name)) ?? headerValue(request.headers[name.toLowerCase()]);
 }
 function getForwardedHeader(request, name) {
     const value = getHeader(request, name);
@@ -57,4 +86,27 @@ function headerValue(value) {
     }
     return value?.[0] ?? null;
 }
+/**
+ * A covered field's value, read only as an own property: the names come from
+ * a client's `Signature-Input`, so `constructor` or `__proto__` must not
+ * reach an inherited value.
+ */
+function ownCombinedHeaderValue(headers, name) {
+    const key = name.toLowerCase();
+    return Object.prototype.hasOwnProperty.call(headers, key)
+        ? combinedHeaderValue(headers[key])
+        : null;
+}
+/**
+ * Repeated values combine with ", " as RFC 9110 field combination does. Only
+ * a string or an array of strings is a value; anything else is absent.
+ */
+function combinedHeaderValue(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string")
+        ? value.join(", ")
+        : null;
+}
 //# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../express/src/express.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AA0B7B,MAAM,UAAU,uCAAuC,CAAC,OAAuC;IAC7F,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,iCAAiC,CAC/C,OAAuC,EACvC,QAAyC,EACzC,IAAiC;QAEjC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;SAC1C,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,CAAC;YAEP,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuC;IAChE,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuC,EAAE,gBAAyB;IAC1F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuC;IAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAChG,MAAM,IAAI,GACR,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;IAE/F,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,OAAuC,EAAE,IAAY;IACtE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuC,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../express/src/express.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AA2B7B,MAAM,UAAU,uCAAuC,CAAC,OAAuC;IAC7F,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,iCAAiC,CAC/C,OAAuC,EACvC,QAAyC,EACzC,IAAiC;QAEjC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;SACpC,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,CAAC;YAEP,OAAO;QACT,CAAC;QAED,wFAAwF;QACxF,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEzD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuC;IAChE,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,WAAW,CAAC,IAAI;YACd,OAAO,CACL,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAC1F,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuC,EAAE,gBAAyB;IAC1F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAuC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvD,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAuC,EACvC,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,WAAW;IAE7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAEhG,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAuC;IAC7D,OAAO,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,gHAAgH;AAChH,SAAS,SAAS,CAAC,OAAuC,EAAE,IAAY;IACtE,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuC,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAoC,EAAE,IAAY;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAE/B,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAChG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -4,6 +4,7 @@
  */
 export { DEFAULT_INGEST_ENDPOINT, DEFAULT_REGISTRY_URL, DevTuneAiTrafficClient, createDevTuneAiTraffic, createDevTuneAiTrafficMiddleware, mightBeAiBotUserAgent, withDevTuneAiTrafficRoute, type DevTuneAiTrafficEvent, type DevTuneAiTrafficLogger, type DevTuneAiTrafficMatch, type DevTuneAiTrafficOptions, type DevTuneAiTrafficRouteHandler, type HeadersLike, type RequestLike, type WaitUntilLike, } from "./client.js";
 export { SDK_VERSION, SDK_VERSION_HEADER } from "./version.js";
+export { WEB_BOT_AUTH_FORWARDED_HEADERS, type DevTuneAiTrafficWebBotAuth } from "./web-bot-auth.js";
 export { detectTrustedProxy, resolveClientIp, type DevTuneAiTrafficTrustedProxy, } from "./client-ip.js";
 export { FALLBACK_AI_BOT_REGISTRY_ENTRIES, compileAiBotRegistryEntries, matchAiBotRegistryEntry, parseAiBotRegistryPayload, type AiBotRegistryEntry, type CompiledAiBotRegistryEntry, type LlmPlatform, type MachineTrafficClass, } from "./registry.js";
 export { detectAiCrawler, detectAiReferrer, FALLBACK_AI_REFERRER_REGISTRY_ENTRIES, type AiCrawlerDetection, type AiReferrerDetection, type AiReferrerRegistryEntry, type DetectAiCrawlerOptions, type DetectAiReferrerOptions, type DetectionRequestLike, } from "./detection.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,KAAK,4BAA4B,GAClC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,qCAAqC,EACrC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,8BAA8B,EAAE,KAAK,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAEpG,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,KAAK,4BAA4B,GAClC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,qCAAqC,EACrC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -4,6 +4,7 @@
  */
 export { DEFAULT_INGEST_ENDPOINT, DEFAULT_REGISTRY_URL, DevTuneAiTrafficClient, createDevTuneAiTraffic, createDevTuneAiTrafficMiddleware, mightBeAiBotUserAgent, withDevTuneAiTrafficRoute, } from "./client.js";
 export { SDK_VERSION, SDK_VERSION_HEADER } from "./version.js";
+export { WEB_BOT_AUTH_FORWARDED_HEADERS } from "./web-bot-auth.js";
 export { detectTrustedProxy, resolveClientIp, } from "./client-ip.js";
 export { FALLBACK_AI_BOT_REGISTRY_ENTRIES, compileAiBotRegistryEntries, matchAiBotRegistryEntry, parseAiBotRegistryPayload, } from "./registry.js";
 export { detectAiCrawler, detectAiReferrer, FALLBACK_AI_REFERRER_REGISTRY_ENTRIES, } from "./detection.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,yBAAyB,GAS1B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EACL,kBAAkB,EAClB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAK1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,qCAAqC,GAOtC,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,yBAAyB,GAS1B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,8BAA8B,EAAmC,MAAM,mBAAmB,CAAC;AAEpG,OAAO,EACL,kBAAkB,EAClB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAK1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,qCAAqC,GAOtC,MAAM,gBAAgB,CAAC"}

package/dist/node.d.ts

@@ -6,6 +6,7 @@ import { type DevTuneAiTrafficOptions } from "@devtune/ai-traffic";
 type HeaderValue = string | readonly string[] | undefined;
 export interface DevTuneAiTrafficNodeRequest {
     headers: Record<string, HeaderValue>;
+    method?: string;
     socket?: {
         encrypted?: boolean;
         remoteAddress?: string;

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../node/src/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,qBAAqB,CAAC;AAE7B,KAAK,WAAW,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE;QACP,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CACtD;AAED,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,2BAA2B,IAKlF,SAAS,2BAA2B,EACpC,UAAU,4BAA4B,UAkBzC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../node/src/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,qBAAqB,CAAC;AAE7B,KAAK,WAAW,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QACP,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CACtD;AAED,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,2BAA2B,IAKlF,SAAS,2BAA2B,EACpC,UAAU,4BAA4B,UAuBzC"}

package/dist/node.js

@@ -11,13 +11,17 @@ export function createDevTuneAiTrafficNodeHandler(options) {
             headers: createHeadersLike(request),
             url: createRequestUrl(request, origin),
             ip: request.socket?.remoteAddress ?? null,
+            method: request.method,
+            targetUri: createTargetUri(request),
         };
         client.refreshRegistryIfStale();
         if (!client.mightTrackRequest(requestLike)) {
             return;
         }
+        // Recorded after the response, so keep the arrival time a signature is checked against.
+        const receivedAt = client.signedArrivalTime(requestLike);
         response.once("finish", () => {
-            client.trackRequest(requestLike, undefined, response.statusCode);
+            client.trackRequest(requestLike, undefined, response.statusCode, receivedAt);
         });
     };
 }
@@ -26,6 +30,9 @@ function createHeadersLike(request) {
         get(name) {
             return getHeader(request, name);
         },
+        getCombined(name) {
+            return ownCombinedHeaderValue(request.headers, name);
+        },
     };
 }
 function createRequestUrl(request, configuredOrigin) {
@@ -37,11 +44,30 @@ function createRequestUrl(request, configuredOrigin) {
         return requestPath;
     }
 }
-function getRequestOrigin(request) {
+/**
+ * The URL a signature covers, as the request line and the raw host (`X-Forwarded-Host`, then `Host`) carried
+ * it. Never parsed, so a signed `https://EXAMPLE.com:443/guide` is forwarded
+ * byte for byte. A configured `origin` never replaces the host the agent
+ * signed. An absolute-form request target is already the whole URL. Null
+ * when there is no host to build it from.
+ */
+function createTargetUri(request) {
+    const requestPath = request.url ?? "/";
+    // An absolute-form target is already the whole URL; any other non-path
+    // form (`*`, authority-form) is not a URL a signature can cover.
+    if (!requestPath.startsWith("/")) {
+        return /^https?:\/\//iu.test(requestPath) ? requestPath : null;
+    }
+    const host = getRequestHost(request);
+    return host ? `${getRequestOrigin(request, host)}${requestPath}` : null;
+}
+function getRequestOrigin(request, host = getRequestHost(request) || "localhost") {
     const forwardedProtocol = getForwardedHeader(request, "x-forwarded-proto");
     const protocol = forwardedProtocol ?? (request.socket?.encrypted ? "https" : "http");
-    const host = getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host");
-    return `${protocol}://${host || "localhost"}`;
+    return `${protocol}://${host}`;
+}
+function getRequestHost(request) {
+    return getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host");
 }
 function getHeader(request, name) {
     return headerValue(request.headers[name.toLowerCase()]);
@@ -56,4 +82,27 @@ function headerValue(value) {
     }
     return value?.[0] ?? null;
 }
+/**
+ * A covered field's value, read only as an own property: the names come from
+ * a client's `Signature-Input`, so `constructor` or `__proto__` must not
+ * reach an inherited value.
+ */
+function ownCombinedHeaderValue(headers, name) {
+    const key = name.toLowerCase();
+    return Object.prototype.hasOwnProperty.call(headers, key)
+        ? combinedHeaderValue(headers[key])
+        : null;
+}
+/**
+ * Repeated values combine with ", " as RFC 9110 field combination does. Only
+ * a string or an array of strings is a value; anything else is absent.
+ */
+function combinedHeaderValue(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string")
+        ? value.join(", ")
+        : null;
+}
 //# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../../node/src/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAsB7B,MAAM,UAAU,iCAAiC,CAAC,OAAoC;IACpF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,2BAA2B,CACzC,OAAoC,EACpC,QAAsC;QAEtC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;SAC1C,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoC;IAC7D,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC,EAAE,gBAAyB;IACvF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC;IAC5D,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE3F,OAAO,GAAG,QAAQ,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,OAAoC,EAAE,IAAY;IACnE,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../node/src/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAuB7B,MAAM,UAAU,iCAAiC,CAAC,OAAoC;IACpF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,2BAA2B,CACzC,OAAoC,EACpC,QAAsC;QAEtC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;SACpC,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,wFAAwF;QACxF,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEzD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoC;IAC7D,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,WAAW,CAAC,IAAI;YACd,OAAO,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC,EAAE,gBAAyB;IACvF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAoC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAoC,EACpC,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,WAAW;IAE7C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAErF,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAoC;IAC1D,OAAO,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,SAAS,CAAC,OAAoC,EAAE,IAAY;IACnE,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAoC,EAAE,IAAY;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAE/B,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAChG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}

package/dist/vercel-oidc.d.ts

@@ -0,0 +1,53 @@
+/**
+ * ABOUTME: Vercel OIDC credentials for ingest, used instead of an ingest key on Vercel.
+ * Filters the per-request token header and exchanges it for DevTune's audience with a cache.
+ */
+/** Vercel sets this on every request to a deployment that has OIDC enabled. */
+export declare const VERCEL_OIDC_TOKEN_HEADER = "x-vercel-oidc-token";
+/** Tells the ingest route which DevTune project's Vercel link to check the token against. */
+export declare const DEVTUNE_PROJECT_HEADER = "x-devtune-project";
+export declare const DEVTUNE_INGEST_AUDIENCE = "https://devtune.ai/ai-traffic-ingest";
+export declare const VERCEL_TOKEN_EXCHANGE_URL = "https://oidc.vercel.com/~token";
+/** Tokens this close to expiry are neither captured, exchanged nor served from the cache. */
+export declare const TOKEN_EXPIRY_MARGIN_MS = 60000;
+export declare function isDevTuneProjectId(value: string): boolean;
+/**
+ * Returns the token's expiry in milliseconds when the value looks like a live
+ * Vercel OIDC token, or null for anything else.
+ *
+ * The signature is not checked: the SDK has no way to, and the ingest route
+ * verifies it. This filter only keeps a client-supplied junk header, a token
+ * from another issuer or an expired token from replacing a good one.
+ */
+export declare function readVercelOidcTokenExpiry(value: string, nowMs: number): number | null;
+export type VercelOidcExchangeFailureKind = "exchange_status" | "exchange_response";
+/**
+ * Thrown when Vercel answers an exchange but not with a usable token. Carries
+ * a fixed `kind` and the status, so callers can report the failure without
+ * reading any message text.
+ */
+export declare class VercelOidcExchangeError extends Error {
+    readonly kind: VercelOidcExchangeFailureKind;
+    readonly status?: number | undefined;
+    constructor(kind: VercelOidcExchangeFailureKind, status?: number | undefined);
+}
+/**
+ * Exchanges a deployment's Vercel OIDC token for one scoped to DevTune's
+ * ingest audience.
+ *
+ * Results are cached in memory by source token until their expiry, less the
+ * margin, and expired entries are dropped on every call, so the steady state
+ * is one entry per live source token. Callers that need the same token at once
+ * share one request. Vercel's answers are reported as a
+ * `VercelOidcExchangeError`; anything the fetch itself throws is passed on.
+ */
+export declare class VercelOidcTokenExchanger {
+    private readonly fetchImpl;
+    private readonly nowMs;
+    private readonly cache;
+    private readonly inFlight;
+    constructor(fetchImpl: typeof fetch, nowMs: () => number);
+    exchange(sourceToken: string): Promise<string>;
+    private requestExchange;
+}
+//# sourceMappingURL=vercel-oidc.d.ts.map

package/dist/vercel-oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-oidc.d.ts","sourceRoot":"","sources":["../src/vercel-oidc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAC9E,eAAO,MAAM,yBAAyB,mCAAmC,CAAC;AAQ1E,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,WAE/C;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBA4BrE;AAED,MAAM,MAAM,6BAA6B,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,IAAI,EAAE,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBADf,IAAI,EAAE,6BAA6B,EACnC,MAAM,CAAC,EAAE,MAAM,YAAA;CAS3B;AAOD;;;;;;;;;GASG;AACH,qBAAa,wBAAwB;IAKjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IALxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;gBAG5C,SAAS,EAAE,OAAO,KAAK,EACvB,KAAK,EAAE,MAAM,MAAM;IAGhC,QAAQ,CAAC,WAAW,EAAE,MAAM;YA8BpB,eAAe;CAsC9B"}

package/dist/vercel-oidc.js

@@ -0,0 +1,152 @@
+/**
+ * ABOUTME: Vercel OIDC credentials for ingest, used instead of an ingest key on Vercel.
+ * Filters the per-request token header and exchanges it for DevTune's audience with a cache.
+ */
+/** Vercel sets this on every request to a deployment that has OIDC enabled. */
+export const VERCEL_OIDC_TOKEN_HEADER = "x-vercel-oidc-token";
+/** Tells the ingest route which DevTune project's Vercel link to check the token against. */
+export const DEVTUNE_PROJECT_HEADER = "x-devtune-project";
+export const DEVTUNE_INGEST_AUDIENCE = "https://devtune.ai/ai-traffic-ingest";
+export const VERCEL_TOKEN_EXCHANGE_URL = "https://oidc.vercel.com/~token";
+const VERCEL_OIDC_ISSUER = "https://oidc.vercel.com";
+const MAX_TOKEN_LENGTH = 8_192;
+const TOKEN_EXCHANGE_TIMEOUT_MS = 5_000;
+const BASE64URL_SEGMENT = /^[A-Za-z0-9_-]+$/u;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+/** Tokens this close to expiry are neither captured, exchanged nor served from the cache. */
+export const TOKEN_EXPIRY_MARGIN_MS = 60_000;
+export function isDevTuneProjectId(value) {
+    return UUID_PATTERN.test(value);
+}
+/**
+ * Returns the token's expiry in milliseconds when the value looks like a live
+ * Vercel OIDC token, or null for anything else.
+ *
+ * The signature is not checked: the SDK has no way to, and the ingest route
+ * verifies it. This filter only keeps a client-supplied junk header, a token
+ * from another issuer or an expired token from replacing a good one.
+ */
+export function readVercelOidcTokenExpiry(value, nowMs) {
+    if (value.length > MAX_TOKEN_LENGTH) {
+        return null;
+    }
+    const segments = value.split(".");
+    if (segments.length !== 3 || !segments.every((segment) => BASE64URL_SEGMENT.test(segment))) {
+        return null;
+    }
+    const claims = decodeJsonSegment(segments[1] ?? "");
+    if (!claims ||
+        typeof claims.iss !== "string" ||
+        (claims.iss !== VERCEL_OIDC_ISSUER && !claims.iss.startsWith(`${VERCEL_OIDC_ISSUER}/`)) ||
+        typeof claims.owner_id !== "string" ||
+        typeof claims.project_id !== "string" ||
+        typeof claims.exp !== "number" ||
+        !Number.isFinite(claims.exp)) {
+        return null;
+    }
+    const expiresAtMs = claims.exp * 1000;
+    return expiresAtMs - nowMs > TOKEN_EXPIRY_MARGIN_MS ? expiresAtMs : null;
+}
+/**
+ * Thrown when Vercel answers an exchange but not with a usable token. Carries
+ * a fixed `kind` and the status, so callers can report the failure without
+ * reading any message text.
+ */
+export class VercelOidcExchangeError extends Error {
+    kind;
+    status;
+    constructor(kind, status) {
+        super(kind === "exchange_status"
+            ? `Vercel OIDC token exchange failed with status ${status}`
+            : "Vercel OIDC token exchange returned an unusable response");
+        this.kind = kind;
+        this.status = status;
+        this.name = "VercelOidcExchangeError";
+    }
+}
+/**
+ * Exchanges a deployment's Vercel OIDC token for one scoped to DevTune's
+ * ingest audience.
+ *
+ * Results are cached in memory by source token until their expiry, less the
+ * margin, and expired entries are dropped on every call, so the steady state
+ * is one entry per live source token. Callers that need the same token at once
+ * share one request. Vercel's answers are reported as a
+ * `VercelOidcExchangeError`; anything the fetch itself throws is passed on.
+ */
+export class VercelOidcTokenExchanger {
+    fetchImpl;
+    nowMs;
+    cache = new Map();
+    inFlight = new Map();
+    constructor(fetchImpl, nowMs) {
+        this.fetchImpl = fetchImpl;
+        this.nowMs = nowMs;
+    }
+    async exchange(sourceToken) {
+        const nowMs = this.nowMs();
+        for (const [key, entry] of this.cache) {
+            if (entry.usableUntilMs <= nowMs) {
+                this.cache.delete(key);
+            }
+        }
+        const cached = this.cache.get(sourceToken);
+        if (cached) {
+            return cached.token;
+        }
+        const pending = this.inFlight.get(sourceToken);
+        if (pending) {
+            return pending;
+        }
+        const request = this.requestExchange(sourceToken).finally(() => {
+            this.inFlight.delete(sourceToken);
+        });
+        this.inFlight.set(sourceToken, request);
+        return request;
+    }
+    async requestExchange(sourceToken) {
+        const response = await this.fetchImpl(VERCEL_TOKEN_EXCHANGE_URL, {
+            body: JSON.stringify({ token: sourceToken, aud: DEVTUNE_INGEST_AUDIENCE }),
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json",
+            },
+            method: "POST",
+            signal: AbortSignal.timeout(TOKEN_EXCHANGE_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            throw new VercelOidcExchangeError("exchange_status", response.status);
+        }
+        const payload = await response.json().catch(() => null);
+        if (!isRecord(payload) ||
+            typeof payload.token !== "string" ||
+            payload.token.length === 0 ||
+            typeof payload.expiry !== "number" ||
+            !Number.isFinite(payload.expiry)) {
+            throw new VercelOidcExchangeError("exchange_response");
+        }
+        const usableUntilMs = payload.expiry * 1000 - TOKEN_EXPIRY_MARGIN_MS;
+        // A token that is already inside the margin would only be rejected at ingest.
+        if (usableUntilMs <= this.nowMs()) {
+            throw new VercelOidcExchangeError("exchange_response");
+        }
+        this.cache.set(sourceToken, { token: payload.token, usableUntilMs });
+        return payload.token;
+    }
+}
+function decodeJsonSegment(segment) {
+    try {
+        const base64 = segment.replace(/-/gu, "+").replace(/_/gu, "/");
+        const binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="));
+        const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+        const value = JSON.parse(new TextDecoder().decode(bytes));
+        return isRecord(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+//# sourceMappingURL=vercel-oidc.js.map

package/dist/vercel-oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-oidc.js","sourceRoot":"","sources":["../src/vercel-oidc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAE1E,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AACrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,yBAAyB,GAAG,KAAK,CAAC;AACxC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,YAAY,GAAG,kEAAkE,CAAC;AAExF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,KAAa;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,GAAG,KAAK,kBAAkB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAEtC,OAAO,WAAW,GAAG,KAAK,GAAG,sBAAsB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAID;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAErC;IACA;IAFX,YACW,IAAmC,EACnC,MAAe;QAExB,KAAK,CACH,IAAI,KAAK,iBAAiB;YACxB,CAAC,CAAC,iDAAiD,MAAM,EAAE;YAC3D,CAAC,CAAC,0DAA0D,CAC/D,CAAC;QAPO,SAAI,GAAJ,IAAI,CAA+B;QACnC,WAAM,GAAN,MAAM,CAAS;QAOxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAOD;;;;;;;;;GASG;AACH,MAAM,OAAO,wBAAwB;IAKhB;IACA;IALF,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/D,YACmB,SAAuB,EACvB,KAAmB;QADnB,cAAS,GAAT,SAAS,CAAc;QACvB,UAAK,GAAL,KAAK,CAAc;IACnC,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE/C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAExC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,WAAmB;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,yBAAyB,EAAE;YAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC;YAC1E,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,yBAAyB,CAAC;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAEjE,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,sBAAsB,CAAC;QAErE,8EAA8E;QAC9E,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAErE,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAEnE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC"}

package/dist/version.d.ts

@@ -3,7 +3,7 @@
  * Lets DevTune tell a customer when their sensor has an upgrade available.
  */
 /** Must equal `version` in package.json; a unit test and the release check enforce it. */
-export declare const SDK_VERSION = "0.10.0";
+export declare const SDK_VERSION = "0.12.0";
 /** Sent on every ingest and registry request. Carries the version only, no visitor data. */
 export declare const SDK_VERSION_HEADER = "x-devtune-sdk-version";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,7 +3,7 @@
  * Lets DevTune tell a customer when their sensor has an upgrade available.
  */
 /** Must equal `version` in package.json; a unit test and the release check enforce it. */
-export const SDK_VERSION = "0.10.0";
+export const SDK_VERSION = "0.12.0";
 /** Sent on every ingest and registry request. Carries the version only, no visitor data. */
 export const SDK_VERSION_HEADER = "x-devtune-sdk-version";
 //# sourceMappingURL=version.js.map

package/dist/web-bot-auth.d.ts

@@ -0,0 +1,56 @@
+/**
+ * ABOUTME: Collects the Web Bot Auth signature material DevTune needs to verify a signed agent request.
+ * Forwards the signature headers verbatim with the request line and covered fields; never verifies, logs or stores them.
+ */
+import type { RequestLike } from "./client.js";
+/**
+ * What DevTune's ingest needs to check one request's HTTP Message Signature
+ * (RFC 9421) as a Web Bot Auth agent signed it. The three signature headers
+ * are verbatim, `method` and `targetUri` are the request as received, which
+ * never has a query, and `headers` holds any other field the signature
+ * covers, by lowercase name. DevTune verifies it on receipt and never stores
+ * it.
+ */
+export interface DevTuneAiTrafficWebBotAuth {
+    signature: string;
+    signatureInput: string;
+    signatureAgent: string;
+    method: string;
+    targetUri: string;
+    headers?: Record<string, string>;
+}
+/**
+ * The only header fields ever forwarded with a signature: non-sensitive
+ * request headers. A request whose signature covers any other field, besides
+ * the three signature headers, forwards no signature material at all, since
+ * an unknown field may carry a credential and dropping just that field would
+ * leave a signature that can never verify. Short enough to stay within
+ * ingest's limits of 16 fields and 128-character names.
+ */
+export declare const WEB_BOT_AUTH_FORWARDED_HEADERS: readonly string[];
+/**
+ * Reads the material for a request that carries all three of `Signature`,
+ * `Signature-Input` and `Signature-Agent`, or returns null.
+ *
+ * Also returns null when anything would exceed ingest's limits or is not a
+ * value the site could have received, rather than truncating: a truncated
+ * signature can never verify, and the event is then sent exactly as an
+ * unsigned one would be.
+ *
+ * `targetUri` must carry the authority and target the agent sent. A target
+ * that differs from the event's `url` only makes DevTune's check
+ * inconclusive, but a rewritten one that happens to match `url` turns a
+ * genuine signature into a failed one.
+ *
+ * A target with a query, even a bare `?`, forwards nothing. The query can
+ * carry a reset token, an OAuth code or search terms, and DevTune could not
+ * verify the signature anyway: the event's `url` never has a query, so the
+ * target would not match it.
+ */
+export declare function readWebBotAuth(request: Pick<RequestLike, "headers" | "method" | "targetUri" | "url">): DevTuneAiTrafficWebBotAuth | null;
+/**
+ * Whether a request carries all three Web Bot Auth signature headers, the
+ * only requests whose arrival time or signature material is worth reading.
+ */
+export declare function hasWebBotAuthHeaders(request: Pick<RequestLike, "headers">): boolean;
+//# sourceMappingURL=web-bot-auth.d.ts.map

package/dist/web-bot-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-bot-auth.d.ts","sourceRoot":"","sources":["../src/web-bot-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAwBD;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAW3D,CAAC;AAWF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,KAAK,CAAC,GACrE,0BAA0B,GAAG,IAAI,CA+EnC;AA4CD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,WAMzE"}