@devtune/ai-traffic 0.11.0 → 0.12.0

package/dist/express.js

@@ -11,14 +11,18 @@ export function createDevTuneAiTrafficExpressMiddleware(options) {
             headers: createHeadersLike(request),
             url: createRequestUrl(request, origin),
             ip: request.socket?.remoteAddress ?? null,
+            method: request.method,
+            targetUri: createTargetUri(request),
         };
         client.refreshRegistryIfStale();
         if (!client.mightTrackRequest(requestLike)) {
             next();
             return;
         }
+        // Recorded after the response, so keep the arrival time a signature is checked against.
+        const receivedAt = client.signedArrivalTime(requestLike);
         response.once("finish", () => {
-            client.trackRequest(requestLike, undefined, response.statusCode);
+            client.trackRequest(requestLike, undefined, response.statusCode, receivedAt);
         });
         next();
     };
@@ -28,6 +32,11 @@ function createHeadersLike(request) {
         get(name) {
             return getHeader(request, name);
         },
+        // Express's getter reads `request.headers` with inherited properties, so
+        // its result is trusted only when it is a string or an array of strings.
+        getCombined(name) {
+            return (combinedHeaderValue(request.get?.(name)) ?? ownCombinedHeaderValue(request.headers, name));
+        },
     };
 }
 function createRequestUrl(request, configuredOrigin) {
@@ -39,13 +48,33 @@ function createRequestUrl(request, configuredOrigin) {
         return requestPath;
     }
 }
-function getRequestOrigin(request) {
+/**
+ * The URL a signature covers, as the request line and the raw host (`X-Forwarded-Host`, then `Host`) carried
+ * it. Never parsed, so a signed `https://EXAMPLE.com:443/guide` is forwarded
+ * byte for byte. A configured `origin` never replaces the host the agent
+ * signed. An absolute-form request target is already the whole URL. Null
+ * when there is no host to build it from.
+ */
+function createTargetUri(request) {
+    const requestPath = request.originalUrl ?? request.url;
+    // An absolute-form target is already the whole URL; any other non-path
+    // form (`*`, authority-form) is not a URL a signature can cover.
+    if (!requestPath.startsWith("/")) {
+        return /^https?:\/\//iu.test(requestPath) ? requestPath : null;
+    }
+    const host = getRequestHost(request);
+    return host ? `${getRequestOrigin(request, host)}${requestPath}` : null;
+}
+function getRequestOrigin(request, host = getRequestHost(request) ?? "localhost") {
     const protocol = getForwardedHeader(request, "x-forwarded-proto") ?? request.protocol ?? "http";
-    const host = getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host") ?? "localhost";
     return `${protocol}://${host}`;
 }
+function getRequestHost(request) {
+    return getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host");
+}
+/** Express's getter can return a repeated field as an array; like the raw headers, it reads the first value. */
 function getHeader(request, name) {
-    return request.get?.(name) ?? headerValue(request.headers[name.toLowerCase()]);
+    return headerValue(request.get?.(name)) ?? headerValue(request.headers[name.toLowerCase()]);
 }
 function getForwardedHeader(request, name) {
     const value = getHeader(request, name);
@@ -57,4 +86,27 @@ function headerValue(value) {
     }
     return value?.[0] ?? null;
 }
+/**
+ * A covered field's value, read only as an own property: the names come from
+ * a client's `Signature-Input`, so `constructor` or `__proto__` must not
+ * reach an inherited value.
+ */
+function ownCombinedHeaderValue(headers, name) {
+    const key = name.toLowerCase();
+    return Object.prototype.hasOwnProperty.call(headers, key)
+        ? combinedHeaderValue(headers[key])
+        : null;
+}
+/**
+ * Repeated values combine with ", " as RFC 9110 field combination does. Only
+ * a string or an array of strings is a value; anything else is absent.
+ */
+function combinedHeaderValue(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string")
+        ? value.join(", ")
+        : null;
+}
 //# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../express/src/express.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AA0B7B,MAAM,UAAU,uCAAuC,CAAC,OAAuC;IAC7F,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,iCAAiC,CAC/C,OAAuC,EACvC,QAAyC,EACzC,IAAiC;QAEjC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;SAC1C,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,CAAC;YAEP,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuC;IAChE,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuC,EAAE,gBAAyB;IAC1F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuC;IAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAChG,MAAM,IAAI,GACR,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;IAE/F,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,OAAuC,EAAE,IAAY;IACtE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuC,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../express/src/express.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AA2B7B,MAAM,UAAU,uCAAuC,CAAC,OAAuC;IAC7F,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,iCAAiC,CAC/C,OAAuC,EACvC,QAAyC,EACzC,IAAiC;QAEjC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;SACpC,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,CAAC;YAEP,OAAO;QACT,CAAC;QAED,wFAAwF;QACxF,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEzD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuC;IAChE,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,WAAW,CAAC,IAAI;YACd,OAAO,CACL,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAC1F,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuC,EAAE,gBAAyB;IAC1F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAuC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvD,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAuC,EACvC,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,WAAW;IAE7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAEhG,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAuC;IAC7D,OAAO,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,gHAAgH;AAChH,SAAS,SAAS,CAAC,OAAuC,EAAE,IAAY;IACtE,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuC,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAoC,EAAE,IAAY;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAE/B,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAChG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -4,6 +4,7 @@
  */
 export { DEFAULT_INGEST_ENDPOINT, DEFAULT_REGISTRY_URL, DevTuneAiTrafficClient, createDevTuneAiTraffic, createDevTuneAiTrafficMiddleware, mightBeAiBotUserAgent, withDevTuneAiTrafficRoute, type DevTuneAiTrafficEvent, type DevTuneAiTrafficLogger, type DevTuneAiTrafficMatch, type DevTuneAiTrafficOptions, type DevTuneAiTrafficRouteHandler, type HeadersLike, type RequestLike, type WaitUntilLike, } from "./client.js";
 export { SDK_VERSION, SDK_VERSION_HEADER } from "./version.js";
+export { WEB_BOT_AUTH_FORWARDED_HEADERS, type DevTuneAiTrafficWebBotAuth } from "./web-bot-auth.js";
 export { detectTrustedProxy, resolveClientIp, type DevTuneAiTrafficTrustedProxy, } from "./client-ip.js";
 export { FALLBACK_AI_BOT_REGISTRY_ENTRIES, compileAiBotRegistryEntries, matchAiBotRegistryEntry, parseAiBotRegistryPayload, type AiBotRegistryEntry, type CompiledAiBotRegistryEntry, type LlmPlatform, type MachineTrafficClass, } from "./registry.js";
 export { detectAiCrawler, detectAiReferrer, FALLBACK_AI_REFERRER_REGISTRY_ENTRIES, type AiCrawlerDetection, type AiReferrerDetection, type AiReferrerRegistryEntry, type DetectAiCrawlerOptions, type DetectAiReferrerOptions, type DetectionRequestLike, } from "./detection.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,KAAK,4BAA4B,GAClC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,qCAAqC,EACrC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,8BAA8B,EAAE,KAAK,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAEpG,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,KAAK,4BAA4B,GAClC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,qCAAqC,EACrC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -4,6 +4,7 @@
  */
 export { DEFAULT_INGEST_ENDPOINT, DEFAULT_REGISTRY_URL, DevTuneAiTrafficClient, createDevTuneAiTraffic, createDevTuneAiTrafficMiddleware, mightBeAiBotUserAgent, withDevTuneAiTrafficRoute, } from "./client.js";
 export { SDK_VERSION, SDK_VERSION_HEADER } from "./version.js";
+export { WEB_BOT_AUTH_FORWARDED_HEADERS } from "./web-bot-auth.js";
 export { detectTrustedProxy, resolveClientIp, } from "./client-ip.js";
 export { FALLBACK_AI_BOT_REGISTRY_ENTRIES, compileAiBotRegistryEntries, matchAiBotRegistryEntry, parseAiBotRegistryPayload, } from "./registry.js";
 export { detectAiCrawler, detectAiReferrer, FALLBACK_AI_REFERRER_REGISTRY_ENTRIES, } from "./detection.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,yBAAyB,GAS1B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EACL,kBAAkB,EAClB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAK1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,qCAAqC,GAOtC,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,yBAAyB,GAS1B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,8BAA8B,EAAmC,MAAM,mBAAmB,CAAC;AAEpG,OAAO,EACL,kBAAkB,EAClB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAK1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,qCAAqC,GAOtC,MAAM,gBAAgB,CAAC"}

package/dist/node.d.ts

@@ -6,6 +6,7 @@ import { type DevTuneAiTrafficOptions } from "@devtune/ai-traffic";
 type HeaderValue = string | readonly string[] | undefined;
 export interface DevTuneAiTrafficNodeRequest {
     headers: Record<string, HeaderValue>;
+    method?: string;
     socket?: {
         encrypted?: boolean;
         remoteAddress?: string;

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../node/src/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,qBAAqB,CAAC;AAE7B,KAAK,WAAW,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE;QACP,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CACtD;AAED,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,2BAA2B,IAKlF,SAAS,2BAA2B,EACpC,UAAU,4BAA4B,UAkBzC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../node/src/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,qBAAqB,CAAC;AAE7B,KAAK,WAAW,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QACP,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CACtD;AAED,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,2BAA2B,IAKlF,SAAS,2BAA2B,EACpC,UAAU,4BAA4B,UAuBzC"}

package/dist/node.js

@@ -11,13 +11,17 @@ export function createDevTuneAiTrafficNodeHandler(options) {
             headers: createHeadersLike(request),
             url: createRequestUrl(request, origin),
             ip: request.socket?.remoteAddress ?? null,
+            method: request.method,
+            targetUri: createTargetUri(request),
         };
         client.refreshRegistryIfStale();
         if (!client.mightTrackRequest(requestLike)) {
             return;
         }
+        // Recorded after the response, so keep the arrival time a signature is checked against.
+        const receivedAt = client.signedArrivalTime(requestLike);
         response.once("finish", () => {
-            client.trackRequest(requestLike, undefined, response.statusCode);
+            client.trackRequest(requestLike, undefined, response.statusCode, receivedAt);
         });
     };
 }
@@ -26,6 +30,9 @@ function createHeadersLike(request) {
         get(name) {
             return getHeader(request, name);
         },
+        getCombined(name) {
+            return ownCombinedHeaderValue(request.headers, name);
+        },
     };
 }
 function createRequestUrl(request, configuredOrigin) {
@@ -37,11 +44,30 @@ function createRequestUrl(request, configuredOrigin) {
         return requestPath;
     }
 }
-function getRequestOrigin(request) {
+/**
+ * The URL a signature covers, as the request line and the raw host (`X-Forwarded-Host`, then `Host`) carried
+ * it. Never parsed, so a signed `https://EXAMPLE.com:443/guide` is forwarded
+ * byte for byte. A configured `origin` never replaces the host the agent
+ * signed. An absolute-form request target is already the whole URL. Null
+ * when there is no host to build it from.
+ */
+function createTargetUri(request) {
+    const requestPath = request.url ?? "/";
+    // An absolute-form target is already the whole URL; any other non-path
+    // form (`*`, authority-form) is not a URL a signature can cover.
+    if (!requestPath.startsWith("/")) {
+        return /^https?:\/\//iu.test(requestPath) ? requestPath : null;
+    }
+    const host = getRequestHost(request);
+    return host ? `${getRequestOrigin(request, host)}${requestPath}` : null;
+}
+function getRequestOrigin(request, host = getRequestHost(request) || "localhost") {
     const forwardedProtocol = getForwardedHeader(request, "x-forwarded-proto");
     const protocol = forwardedProtocol ?? (request.socket?.encrypted ? "https" : "http");
-    const host = getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host");
-    return `${protocol}://${host || "localhost"}`;
+    return `${protocol}://${host}`;
+}
+function getRequestHost(request) {
+    return getForwardedHeader(request, "x-forwarded-host") ?? getHeader(request, "host");
 }
 function getHeader(request, name) {
     return headerValue(request.headers[name.toLowerCase()]);
@@ -56,4 +82,27 @@ function headerValue(value) {
     }
     return value?.[0] ?? null;
 }
+/**
+ * A covered field's value, read only as an own property: the names come from
+ * a client's `Signature-Input`, so `constructor` or `__proto__` must not
+ * reach an inherited value.
+ */
+function ownCombinedHeaderValue(headers, name) {
+    const key = name.toLowerCase();
+    return Object.prototype.hasOwnProperty.call(headers, key)
+        ? combinedHeaderValue(headers[key])
+        : null;
+}
+/**
+ * Repeated values combine with ", " as RFC 9110 field combination does. Only
+ * a string or an array of strings is a value; anything else is absent.
+ */
+function combinedHeaderValue(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string")
+        ? value.join(", ")
+        : null;
+}
 //# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../../node/src/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAsB7B,MAAM,UAAU,iCAAiC,CAAC,OAAoC;IACpF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,2BAA2B,CACzC,OAAoC,EACpC,QAAsC;QAEtC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;SAC1C,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoC;IAC7D,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC,EAAE,gBAAyB;IACvF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC;IAC5D,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE3F,OAAO,GAAG,QAAQ,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,OAAoC,EAAE,IAAY;IACnE,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../node/src/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAuB7B,MAAM,UAAU,iCAAiC,CAAC,OAAoC;IACpF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAErD,OAAO,SAAS,2BAA2B,CACzC,OAAoC,EACpC,QAAsC;QAEtC,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;SACpC,CAAC;QAEF,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,wFAAwF;QACxF,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEzD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoC;IAC7D,OAAO;QACL,GAAG,CAAC,IAAI;YACN,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,WAAW,CAAC,IAAI;YACd,OAAO,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoC,EAAE,gBAAyB;IACvF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAoC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAEvC,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAoC,EACpC,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,WAAW;IAE7C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAErF,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAoC;IAC1D,OAAO,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,SAAS,CAAC,OAAoC,EAAE,IAAY;IACnE,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAoC,EAAE,IAAY;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAE/B,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAChG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}

package/dist/version.d.ts

@@ -3,7 +3,7 @@
  * Lets DevTune tell a customer when their sensor has an upgrade available.
  */
 /** Must equal `version` in package.json; a unit test and the release check enforce it. */
-export declare const SDK_VERSION = "0.11.0";
+export declare const SDK_VERSION = "0.12.0";
 /** Sent on every ingest and registry request. Carries the version only, no visitor data. */
 export declare const SDK_VERSION_HEADER = "x-devtune-sdk-version";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,7 +3,7 @@
  * Lets DevTune tell a customer when their sensor has an upgrade available.
  */
 /** Must equal `version` in package.json; a unit test and the release check enforce it. */
-export const SDK_VERSION = "0.11.0";
+export const SDK_VERSION = "0.12.0";
 /** Sent on every ingest and registry request. Carries the version only, no visitor data. */
 export const SDK_VERSION_HEADER = "x-devtune-sdk-version";
 //# sourceMappingURL=version.js.map

package/dist/web-bot-auth.d.ts

@@ -0,0 +1,56 @@
+/**
+ * ABOUTME: Collects the Web Bot Auth signature material DevTune needs to verify a signed agent request.
+ * Forwards the signature headers verbatim with the request line and covered fields; never verifies, logs or stores them.
+ */
+import type { RequestLike } from "./client.js";
+/**
+ * What DevTune's ingest needs to check one request's HTTP Message Signature
+ * (RFC 9421) as a Web Bot Auth agent signed it. The three signature headers
+ * are verbatim, `method` and `targetUri` are the request as received, which
+ * never has a query, and `headers` holds any other field the signature
+ * covers, by lowercase name. DevTune verifies it on receipt and never stores
+ * it.
+ */
+export interface DevTuneAiTrafficWebBotAuth {
+    signature: string;
+    signatureInput: string;
+    signatureAgent: string;
+    method: string;
+    targetUri: string;
+    headers?: Record<string, string>;
+}
+/**
+ * The only header fields ever forwarded with a signature: non-sensitive
+ * request headers. A request whose signature covers any other field, besides
+ * the three signature headers, forwards no signature material at all, since
+ * an unknown field may carry a credential and dropping just that field would
+ * leave a signature that can never verify. Short enough to stay within
+ * ingest's limits of 16 fields and 128-character names.
+ */
+export declare const WEB_BOT_AUTH_FORWARDED_HEADERS: readonly string[];
+/**
+ * Reads the material for a request that carries all three of `Signature`,
+ * `Signature-Input` and `Signature-Agent`, or returns null.
+ *
+ * Also returns null when anything would exceed ingest's limits or is not a
+ * value the site could have received, rather than truncating: a truncated
+ * signature can never verify, and the event is then sent exactly as an
+ * unsigned one would be.
+ *
+ * `targetUri` must carry the authority and target the agent sent. A target
+ * that differs from the event's `url` only makes DevTune's check
+ * inconclusive, but a rewritten one that happens to match `url` turns a
+ * genuine signature into a failed one.
+ *
+ * A target with a query, even a bare `?`, forwards nothing. The query can
+ * carry a reset token, an OAuth code or search terms, and DevTune could not
+ * verify the signature anyway: the event's `url` never has a query, so the
+ * target would not match it.
+ */
+export declare function readWebBotAuth(request: Pick<RequestLike, "headers" | "method" | "targetUri" | "url">): DevTuneAiTrafficWebBotAuth | null;
+/**
+ * Whether a request carries all three Web Bot Auth signature headers, the
+ * only requests whose arrival time or signature material is worth reading.
+ */
+export declare function hasWebBotAuthHeaders(request: Pick<RequestLike, "headers">): boolean;
+//# sourceMappingURL=web-bot-auth.d.ts.map

package/dist/web-bot-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-bot-auth.d.ts","sourceRoot":"","sources":["../src/web-bot-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAwBD;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAW3D,CAAC;AAWF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,KAAK,CAAC,GACrE,0BAA0B,GAAG,IAAI,CA+EnC;AA4CD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,WAMzE"}

package/dist/web-bot-auth.js

@@ -0,0 +1,233 @@
+/**
+ * ABOUTME: Collects the Web Bot Auth signature material DevTune needs to verify a signed agent request.
+ * Forwards the signature headers verbatim with the request line and covered fields; never verifies, logs or stores them.
+ */
+const MAX_SIGNATURE_LENGTH = 4096;
+const MAX_SIGNATURE_INPUT_LENGTH = 4096;
+const MAX_SIGNATURE_AGENT_LENGTH = 2048;
+const MAX_METHOD_LENGTH = 16;
+const MAX_TARGET_URI_LENGTH = 8192;
+const MAX_HEADER_VALUE_LENGTH = 4096;
+const SIGNATURE_HEADERS = new Set(["signature", "signature-input", "signature-agent"]);
+/**
+ * Derived components that depend on the path, query or scheme, which a Fetch
+ * runtime may have rewritten: it normalises the path, and behind a
+ * TLS-terminating proxy its `request.url` can be `http:` for an `https:`
+ * request.
+ */
+const FETCH_REWRITTEN_COMPONENTS = new Set([
+    "@path",
+    "@query",
+    "@request-target",
+    "@scheme",
+    "@target-uri",
+]);
+/**
+ * The only header fields ever forwarded with a signature: non-sensitive
+ * request headers. A request whose signature covers any other field, besides
+ * the three signature headers, forwards no signature material at all, since
+ * an unknown field may carry a credential and dropping just that field would
+ * leave a signature that can never verify. Short enough to stay within
+ * ingest's limits of 16 fields and 128-character names.
+ */
+export const WEB_BOT_AUTH_FORWARDED_HEADERS = [
+    "accept",
+    "accept-encoding",
+    "accept-language",
+    "cache-control",
+    "content-length",
+    "content-type",
+    "date",
+    "from",
+    "host",
+    "user-agent",
+];
+const FORWARDED_HEADERS = new Set(WEB_BOT_AUTH_FORWARDED_HEADERS);
+/** RFC 9110 field-value characters: visible ASCII, SP and HTAB. */
+const FIELD_VALUE = /^[\t\x20-\x7e]*$/u;
+/** RFC 9110 method token. */
+const METHOD = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u;
+/** An absolute URI as sent on the wire: visible ASCII, no whitespace. */
+const TARGET_URI = /^[\x21-\x7e]+$/u;
+/**
+ * Reads the material for a request that carries all three of `Signature`,
+ * `Signature-Input` and `Signature-Agent`, or returns null.
+ *
+ * Also returns null when anything would exceed ingest's limits or is not a
+ * value the site could have received, rather than truncating: a truncated
+ * signature can never verify, and the event is then sent exactly as an
+ * unsigned one would be.
+ *
+ * `targetUri` must carry the authority and target the agent sent. A target
+ * that differs from the event's `url` only makes DevTune's check
+ * inconclusive, but a rewritten one that happens to match `url` turns a
+ * genuine signature into a failed one.
+ *
+ * A target with a query, even a bare `?`, forwards nothing. The query can
+ * carry a reset token, an OAuth code or search terms, and DevTune could not
+ * verify the signature anyway: the event's `url` never has a query, so the
+ * target would not match it.
+ */
+export function readWebBotAuth(request) {
+    if (!hasWebBotAuthHeaders(request)) {
+        return null;
+    }
+    const signature = request.headers.get("signature");
+    const signatureInput = request.headers.get("signature-input");
+    const signatureAgent = request.headers.get("signature-agent");
+    const { method } = request;
+    const targetUri = request.targetUri === undefined ? readFetchTargetUri(request) : request.targetUri;
+    if (targetUri === null ||
+        targetUri.includes("?") ||
+        !isFieldValue(signature, MAX_SIGNATURE_LENGTH) ||
+        !isFieldValue(signatureInput, MAX_SIGNATURE_INPUT_LENGTH) ||
+        !isFieldValue(signatureAgent, MAX_SIGNATURE_AGENT_LENGTH) ||
+        !method ||
+        method.length > MAX_METHOD_LENGTH ||
+        !METHOD.test(method) ||
+        targetUri.length > MAX_TARGET_URI_LENGTH ||
+        !TARGET_URI.test(targetUri)) {
+        return null;
+    }
+    const components = readCoveredComponents(signatureInput);
+    // A Fetch runtime has already normalised the path (`/a/../guide` arrives as
+    // `/guide`) and may report a proxied `https:` request as `http:`. The raw
+    // forms are gone, so a signature over them would be checked against a
+    // rewritten base and fail. Signatures over `@authority` and
+    // `signature-agent` alone depend on neither and still forward.
+    if (request.targetUri === undefined &&
+        components.some((component) => FETCH_REWRITTEN_COMPONENTS.has(component))) {
+        return null;
+    }
+    const coveredNames = components.filter((component) => !component.startsWith("@") && !SIGNATURE_HEADERS.has(component));
+    if (coveredNames.some((name) => !FORWARDED_HEADERS.has(name))) {
+        return null;
+    }
+    const headers = new Map();
+    for (const name of coveredNames) {
+        if (headers.has(name)) {
+            continue;
+        }
+        const value = request.headers.getCombined
+            ? request.headers.getCombined(name)
+            : request.headers.get(name);
+        if (value === null) {
+            continue;
+        }
+        if (!isFieldValue(value, MAX_HEADER_VALUE_LENGTH, true)) {
+            return null;
+        }
+        headers.set(name, value);
+    }
+    return {
+        signature,
+        signatureInput,
+        signatureAgent,
+        method,
+        targetUri,
+        ...(headers.size === 0 ? {} : { headers: Object.fromEntries(headers) }),
+    };
+}
+/**
+ * The signed target for a Fetch-compatible runtime, which hands over
+ * `request.url` already normalised: `https://DOCS.example.com:443/guide`
+ * arrives as `https://docs.example.com/guide`. The authority is put back
+ * from the raw header the runtime built `url` from, `X-Forwarded-Host` or
+ * `Host`, and falls back to the raw `Host` when neither matches, so it is
+ * never a rewritten one. The scheme and path still come from `url`, which is
+ * why a signature covering a component that depends on them is not
+ * forwarded from here. Null without a `Host` header, or when `url` has a
+ * query, which `url.search` would hide when it is a bare `?`.
+ */
+function readFetchTargetUri(request) {
+    const host = request.headers.get("host");
+    let url;
+    try {
+        url = new URL(request.url);
+    }
+    catch {
+        return null;
+    }
+    if (!host || request.url.split("#", 1)[0]?.includes("?")) {
+        return null;
+    }
+    const forwardedHost = request.headers.get("x-forwarded-host")?.split(",", 1)[0]?.trim();
+    const authority = [forwardedHost, host].find((candidate) => candidate && normalizeHost(url.protocol, candidate) === url.host) ?? host;
+    return `${url.protocol}//${authority}${url.pathname}`;
+}
+function normalizeHost(protocol, host) {
+    try {
+        return new URL(`${protocol}//${host}`).host;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a request carries all three Web Bot Auth signature headers, the
+ * only requests whose arrival time or signature material is worth reading.
+ */
+export function hasWebBotAuthHeaders(request) {
+    return (request.headers.get("signature") !== null &&
+        request.headers.get("signature-input") !== null &&
+        request.headers.get("signature-agent") !== null);
+}
+/**
+ * Component identifiers a `Signature-Input` covers, across every signature it
+ * labels: header field names and derived components such as `@path`. This is
+ * just enough of RFC 8941 to find the strings that start an inner-list item:
+ * quoted strings are skipped whole, so a parameter value such as `key="a"` or
+ * `keyid="x (y)"` is never mistaken for one. Anything odd in the input is left
+ * for the caller or DevTune's parser to reject.
+ */
+function readCoveredComponents(signatureInput) {
+    const names = [];
+    let inInnerList = false;
+    let previous = "";
+    for (let index = 0; index < signatureInput.length; index += 1) {
+        const char = signatureInput[index];
+        if (char === '"') {
+            const end = findStringEnd(signatureInput, index + 1);
+            if (end === -1) {
+                break;
+            }
+            if (inInnerList && (previous === "(" || previous === " ")) {
+                names.push(signatureInput.slice(index + 1, end).replace(/\\(["\\])/gu, "$1"));
+            }
+            index = end;
+            previous = '"';
+            continue;
+        }
+        if (char === "(") {
+            inInnerList = true;
+        }
+        else if (char === ")") {
+            inInnerList = false;
+        }
+        previous = char ?? "";
+    }
+    return names;
+}
+/** Index of the quote closing an sf-string that opened before `start`, or -1. */
+function findStringEnd(value, start) {
+    for (let index = start; index < value.length; index += 1) {
+        if (value[index] === "\\") {
+            index += 1;
+        }
+        else if (value[index] === '"') {
+            return index;
+        }
+    }
+    return -1;
+}
+/**
+ * Also rejects a non-string, which a hand-written `HeadersLike` can return
+ * for a repeated field and which ingest's schema would refuse.
+ */
+function isFieldValue(value, maxLength, allowEmpty = false) {
+    return (typeof value === "string" &&
+        (allowEmpty || value.length > 0) &&
+        value.length <= maxLength &&
+        FIELD_VALUE.test(value));
+}
+//# sourceMappingURL=web-bot-auth.js.map

package/dist/web-bot-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-bot-auth.js","sourceRoot":"","sources":["../src/web-bot-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqBH,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACvF;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO;IACP,QAAQ;IACR,iBAAiB;IACjB,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,QAAQ;IACR,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,MAAM;IACN,MAAM;IACN,MAAM;IACN,YAAY;CACb,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;AAElE,mEAAmE;AACnE,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,6BAA6B;AAC7B,MAAM,MAAM,GAAG,iCAAiC,CAAC;AACjD,yEAAyE;AACzE,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAsE;IAEtE,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAEpF,IACE,SAAS,KAAK,IAAI;QAClB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,CAAC,YAAY,CAAC,SAAS,EAAE,oBAAoB,CAAC;QAC9C,CAAC,YAAY,CAAC,cAAc,EAAE,0BAA0B,CAAC;QACzD,CAAC,YAAY,CAAC,cAAc,EAAE,0BAA0B,CAAC;QACzD,CAAC,MAAM;QACP,MAAM,CAAC,MAAM,GAAG,iBAAiB;QACjC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACpB,SAAS,CAAC,MAAM,GAAG,qBAAqB;QACxC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,4DAA4D;IAC5D,+DAA+D;IAC/D,IACE,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CACpC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAC/E,CAAC;IAEF,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW;YACvC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;YACnC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,SAAS;QACT,cAAc;QACd,cAAc;QACd,MAAM;QACN,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,OAA6C;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACxF,MAAM,SAAS,GACb,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CACxB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,IAAI,CAChF,IAAI,IAAI,CAAC;IAEZ,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAqC;IACxE,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;QACzC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI;QAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,cAAsB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,aAAa,CAAC,cAAc,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAErD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM;YACR,CAAC;YAED,IAAI,WAAW,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;YAChF,CAAC;YAED,KAAK,GAAG,GAAG,CAAC;YACZ,QAAQ,GAAG,GAAG,CAAC;YAEf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QAED,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,KAAoB,EACpB,SAAiB,EACjB,UAAU,GAAG,KAAK;IAElB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,KAAK,CAAC,MAAM,IAAI,SAAS;QACzB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CACxB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devtune/ai-traffic",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "private": false,
   "description": "Filtered edge-push sensor for DevTune AI Traffic.",
   "license": "MIT",