@osqd/bothandlerjs 0.5.0 → 0.7.0

package/dist/index.js

@@ -113,6 +113,45 @@ var init_lru = __esm({
   }
 });
 
+// src/internal/text.ts
+function safeSummary(text) {
+  let flawed = text.length > SUMMARY_CHARS;
+  if (!flawed) {
+    for (let i = 0; i < text.length; i++) {
+      const code = text.charCodeAt(i);
+      if (code < 32 || code >= 127 && code <= 159 || code >= 55296 && code <= 57343) {
+        flawed = true;
+        break;
+      }
+    }
+  }
+  if (!flawed) return text;
+  let out = "";
+  const limit = Math.min(text.length, SUMMARY_CHARS);
+  for (let i = 0; i < limit; i++) {
+    const code = text.charCodeAt(i);
+    if (code < 32 || code >= 127 && code <= 159) {
+      out += "\uFFFD";
+    } else if (code >= 55296 && code <= 56319) {
+      const next = text.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        out += text[i] + text[i + 1];
+        i++;
+      } else out += "\uFFFD";
+    } else if (code >= 56320 && code <= 57343) {
+      out += "\uFFFD";
+    } else out += text[i];
+  }
+  return text.length > SUMMARY_CHARS ? `${out}\u2026` : out;
+}
+var SUMMARY_CHARS;
+var init_text = __esm({
+  "src/internal/text.ts"() {
+    "use strict";
+    SUMMARY_CHARS = 512;
+  }
+});
+
 // src/state.ts
 function hashString(value) {
   let hash = 2166136261;
@@ -122,16 +161,50 @@ function hashString(value) {
   }
   return hash >>> 0;
 }
-var TIMESTAMP_RING, PATH_CAP, UA_CAP, MAX_TRACKED_ARRIVALS, MAX_TRACKED_PATHS, MAX_TRACKED_USER_AGENTS, ActorState, ActorRegistry;
+function walkStepOf(path) {
+  if (path.length > MAX_WALK_PATH_CHARS) return void 0;
+  let depth = 0;
+  for (let i = 0; i < path.length; i++) {
+    if (path.charCodeAt(i) === 47 && ++depth > MAX_WALK_SEGMENTS) return void 0;
+  }
+  let value;
+  const parts = [];
+  for (const segment of path.split("/")) {
+    if (segment === "") continue;
+    if (DIGITS.test(segment)) {
+      const parsed = Number(segment);
+      if (Number.isSafeInteger(parsed) && parsed <= 1e7) value = parsed;
+      parts.push("#");
+    } else {
+      parts.push(segment);
+    }
+  }
+  if (value === void 0) return void 0;
+  let template = `/${parts.join("/")}`;
+  if (template.length > TEMPLATE_CHARS) template = `${template.slice(0, TEMPLATE_CHARS)}\u2026`;
+  return { template, id: value };
+}
+var TIMESTAMP_RING, PATH_CAP, QUERY_CAP, METHOD_CAP, WALK_CAP, IDENTITY_CAP, TEMPLATE_CHARS, MAX_WALK_SEGMENTS, MAX_WALK_PATH_CHARS, MAX_QUERY_KEYS, DIGITS, UA_CAP, MAX_TRACKED_ARRIVALS, MAX_TRACKED_PATHS, MAX_TRACKED_QUERIES, MAX_TRACKED_USER_AGENTS, ActorState, ActorRegistry;
 var init_state = __esm({
   "src/state.ts"() {
     "use strict";
     init_lru();
+    init_text();
     TIMESTAMP_RING = 32;
     PATH_CAP = 64;
+    QUERY_CAP = 64;
+    METHOD_CAP = 12;
+    WALK_CAP = 4;
+    IDENTITY_CAP = 12;
+    TEMPLATE_CHARS = 120;
+    MAX_WALK_SEGMENTS = 24;
+    MAX_WALK_PATH_CHARS = 512;
+    MAX_QUERY_KEYS = 24;
+    DIGITS = /^\d+$/;
     UA_CAP = 4;
     MAX_TRACKED_ARRIVALS = TIMESTAMP_RING;
     MAX_TRACKED_PATHS = PATH_CAP;
+    MAX_TRACKED_QUERIES = QUERY_CAP;
     MAX_TRACKED_USER_AGENTS = UA_CAP;
     ActorState = class {
       key;
@@ -173,6 +246,96 @@ var init_state = __esm({
       paths = /* @__PURE__ */ new Set();
       pathsOverflowed = false;
       pathsSaturatedAtTotal = 0;
+      /**
+       * Distinct *parameterised* requests: the path together with its query.
+       *
+       * Counted apart from `paths` because the two answer different questions and a scraper
+       * lives in the gap between them. `/products?page=1` through `?page=200` is one path and
+       * two hundred requests, so breadth reads it as somebody rereading a single page — which
+       * is exactly what enumerating a catalogue looks like from the path alone.
+       */
+      queries = /* @__PURE__ */ new Set();
+      queriesOverflowed = false;
+      /**
+       * Which HTTP methods this actor has used.
+       *
+       * A browser navigating issues GET. Something that has issued nothing but HEAD across a
+       * long visit is checking what exists rather than reading it, and that is a fact about
+       * the actor rather than about any one of its requests — which is why it is kept here.
+       */
+      /**
+       * What has happened with this actor's marker cookie.
+       *
+       * Counted rather than listed: the useful questions are all "how often", and a list of
+       * marker ids would grow with a client's cookie jar for no benefit. The three drift
+       * flags are sticky — once a client has been seen claiming two different browsers under
+       * one marker it has done so, and a later request that looks tidy again does not undo
+       * it. That is the point of correlating a series rather than judging a request.
+       */
+      /**
+       * When this actor was last challenged, and how it described itself at that moment.
+       *
+       * Kept so that what a client does *in response* to being challenged can be read. That
+       * reaction is better evidence than anything observed passively, because the stimulus
+       * was ours: we chose the moment, so a change of identity that follows it within
+       * seconds is a reaction to it rather than a coincidence we went looking for.
+       */
+      /**
+       * Answers to challenges that were valid in form but wrong in a way only the series
+       * shows: a solution already spent, or one returned faster than the puzzle allows.
+       */
+      /** Requests for a path no other client had ever asked this site for. */
+      novelPaths = 0;
+      replayedSolutions = 0;
+      implausibleSolves = 0;
+      challengedAt = 0;
+      challengeShape;
+      markerIssues = 0;
+      markerReturns = 0;
+      markerForgeries = 0;
+      driftSeen = { browser: false, platform: false, language: false };
+      driftEvents = 0;
+      methods = /* @__PURE__ */ new Set();
+      /**
+       * Numeric walks in progress, by path shape: `/user/#` against the ids requested under it.
+       *
+       * Three numbers per shape, deliberately — a count, a lowest and a highest — rather than
+       * the ids themselves. What separates enumeration from reading is not which ids were
+       * asked for but whether they *cover a range*: thirty requests spanning thirty
+       * consecutive ids is a walk, and thirty scattered across a hundred thousand is somebody
+       * following links. Both are answerable from a count and a span, and only the count and
+       * the span survive an actor asking for ten thousand of them.
+       */
+      walks = /* @__PURE__ */ new Map();
+      /**
+       * Every named identity this actor has claimed, and what kind each was.
+       *
+       * Kept because the interesting question is not what one request said but what the *set*
+       * of them says. One address claiming sqlmap and nikto is a scan; one claiming Googlebot
+       * and Bingbot is a forgery, since at most one of those can be true of an address. Neither
+       * observation exists inside a single request.
+       */
+      identities = /* @__PURE__ */ new Map();
+      /**
+       * A name somebody gave this actor.
+       *
+       * Nothing in detection reads it. It exists because an address is not a memory: the
+       * person who worked out that `198.51.100.4` is the partner's price feed should be able
+       * to write that down where the next person will see it, rather than in a ticket.
+       */
+      actorLabel;
+      /** Requests from this actor that carried a scanner payload or target. */
+      probePayloads = 0;
+      /**
+       * What the application answered, for the requests anybody bothered to tell us about.
+       *
+       * The engine decides *before* the response exists, so this arrives afterwards and only
+       * when the adapter reports it. Kept as two counters rather than a list because the one
+       * question worth asking is a ratio: an actor whose requests are almost all misses is
+       * looking for something rather than reading anything.
+       */
+      responsesSeen = 0;
+      missesSeen = 0;
       userAgents = /* @__PURE__ */ new Set();
       constructor(key, now) {
         this.key = key;
@@ -192,6 +355,16 @@ var init_state = __esm({
           this.pathsOverflowed = true;
           this.pathsSaturatedAtTotal = this.total;
         }
+        const keys = Object.keys(facts.query);
+        if (keys.length > 0 && keys.length <= MAX_QUERY_KEYS) {
+          keys.sort();
+          const signature = `${facts.path}?${keys.map((key) => `${key}=${facts.query[key] ?? ""}`).join("&")}`;
+          const queryHash = hashString(signature);
+          if (this.queries.size < QUERY_CAP) this.queries.add(queryHash);
+          else if (!this.queries.has(queryHash)) this.queriesOverflowed = true;
+        }
+        if (this.methods.size < METHOD_CAP) this.methods.add(facts.method);
+        this.noteWalk(facts.path);
         const ua = facts.headers["user-agent"];
         if (ua !== void 0 && this.userAgents.size < UA_CAP) this.userAgents.add(ua);
       }
@@ -202,6 +375,145 @@ var init_state = __esm({
       get pathsSaturated() {
         return this.pathsOverflowed;
       }
+      /** Distinct path-and-query combinations seen. Saturates at {@link QUERY_CAP}. */
+      get distinctQueries() {
+        return this.queries.size;
+      }
+      get queriesSaturated() {
+        return this.queriesOverflowed;
+      }
+      /**
+       * Records what the application answered. Called after the response, if at all.
+       *
+       * 404 and 410 only. A 403 is usually this library's own doing and counting it would
+       * make the detector that reads this argue with itself; a 500 is the site's problem and
+       * says nothing about the client.
+       */
+      recordOutcome(status) {
+        this.responsesSeen++;
+        if (status === 404 || status === 410) this.missesSeen++;
+      }
+      /** Responses reported for this actor. Zero unless something is reporting them. */
+      get responses() {
+        return this.responsesSeen;
+      }
+      /** Of those, how many were 404 or 410. */
+      get misses() {
+        return this.missesSeen;
+      }
+      /** Names this actor, or clears the name when given nothing. Trimmed and bounded. */
+      setLabel(label) {
+        const trimmed = label === void 0 ? void 0 : safeSummary(label).trim().slice(0, 120);
+        this.actorLabel = trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
+      }
+      get label() {
+        return this.actorLabel;
+      }
+      /** Records a named identity this actor claimed. Called once per matching signature. */
+      noteIdentity(id, category, verifiable) {
+        if (this.identities.has(id) || this.identities.size >= IDENTITY_CAP) return;
+        this.identities.set(id, { category, verifiable });
+      }
+      /** Records that this request was for a path the site had never served to anybody. */
+      noteNovelPath() {
+        if (this.novelPaths < 1e6) this.novelPaths++;
+      }
+      /** How many of this actor's requests were for a path nobody else had ever asked for. */
+      get novelPathCount() {
+        return this.novelPaths;
+      }
+      /** Records something wrong with a submitted solution that only its history reveals. */
+      noteChallengeAnomaly(kind) {
+        if (kind === "replay") {
+          if (this.replayedSolutions < 1e6) this.replayedSolutions++;
+        } else if (this.implausibleSolves < 1e6) this.implausibleSolves++;
+      }
+      /** Solutions this actor submitted that had already been spent, and ones returned too fast. */
+      get challengeAnomalies() {
+        return { replays: this.replayedSolutions, implausible: this.implausibleSolves };
+      }
+      /** Records that a challenge went out, and the identity claimed as it did. */
+      noteChallengeIssued(at, shape) {
+        this.challengedAt = at;
+        this.challengeShape = shape;
+      }
+      /** The moment of the last challenge, and the identity claimed then. `at` is 0 for none. */
+      get lastChallenge() {
+        return { at: this.challengedAt, shape: this.challengeShape };
+      }
+      /** Records that a marker was handed to this actor on the way out. */
+      noteMarkerIssued() {
+        if (this.markerIssues < 1e6) this.markerIssues++;
+      }
+      /** Records what this request's marker cookie turned out to be. */
+      noteMarker(returned, forged, drift) {
+        if (returned && this.markerReturns < 1e6) this.markerReturns++;
+        if (forged && this.markerForgeries < 1e6) this.markerForgeries++;
+        if (drift === void 0) return;
+        if (drift.browser || drift.platform || drift.language) {
+          if (this.driftEvents < 1e6) this.driftEvents++;
+        }
+        this.driftSeen.browser ||= drift.browser;
+        this.driftSeen.platform ||= drift.platform;
+        this.driftSeen.language ||= drift.language;
+      }
+      /** Markers handed to this actor, and how many came back. */
+      get markers() {
+        return { issued: this.markerIssues, returned: this.markerReturns, forged: this.markerForgeries };
+      }
+      /** Which parts of a claimed identity have ever changed under one marker. */
+      get identityDrift() {
+        return { ...this.driftSeen, events: this.driftEvents };
+      }
+      /** Records that this request carried a scanner payload, so later requests can know. */
+      notePayloadProbe() {
+        this.probePayloads++;
+      }
+      /** Every identity claimed so far, by id. */
+      get claimedIdentities() {
+        return this.identities;
+      }
+      /** How many of this actor's requests carried a scanner payload or target. */
+      get payloadProbes() {
+        return this.probePayloads;
+      }
+      /**
+       * Files a request under the shape of its path, if that path carries a number.
+       *
+       * The last numeric segment is the one taken to be the identifier: in `/api/v2/orders/42`
+       * the version is part of the shape and the order id is what is being walked.
+       */
+      noteWalk(path) {
+        const step = walkStepOf(path);
+        if (step === void 0) return;
+        const { template, id: value } = step;
+        const existing = this.walks.get(template);
+        if (existing !== void 0) {
+          existing.count++;
+          if (value < existing.min) existing.min = value;
+          if (value > existing.max) existing.max = value;
+          return;
+        }
+        if (this.walks.size < WALK_CAP) this.walks.set(template, { count: 1, min: value, max: value });
+      }
+      /**
+       * The path shape this actor has walked hardest, with how far it reached.
+       *
+       * `span` is inclusive of both ends, so a walk of 1 to 30 spans 30. Comparing the count
+       * against it is what separates covering a range from visiting a few points in one.
+       */
+      densestWalk() {
+        let best;
+        for (const [template, walk] of this.walks) {
+          const span = walk.max - walk.min + 1;
+          if (best === void 0 || walk.count > best.count) best = { template, count: walk.count, span };
+        }
+        return best;
+      }
+      /** Every HTTP method this actor has used, in first-seen order. */
+      get methodsSeen() {
+        return [...this.methods];
+      }
       /**
        * Requests seen when {@link distinctPaths} stopped being able to grow, or 0 if it
        * still can. Over that many requests the distinct count is exact, so it is the only
@@ -290,6 +602,13 @@ var init_state = __esm({
           key: this.key,
           requests: this.total,
           distinctPaths: this.distinctPaths,
+          distinctQueries: this.distinctQueries,
+          methodsSeen: this.methodsSeen,
+          ...this.actorLabel === void 0 ? {} : { label: this.actorLabel },
+          walk: this.densestWalk(),
+          responses: this.responses,
+          misses: this.misses,
+          queriesSaturated: this.queriesSaturated,
           firstSeen: this.firstSeen,
           lastSeen: this.lastSeen,
           sinceLastMs: this.sinceLast(now),
@@ -418,6 +737,58 @@ var init_crypto = __esm({
   }
 });
 
+// src/challenge/token.ts
+function issueToken(payload, secrets) {
+  const secret = secrets[0];
+  if (secret === void 0) throw new Error("At least one signing secret is required to issue a token");
+  const body = base64UrlEncode(JSON.stringify(payload));
+  return `${body}.${sign(body, secret)}`;
+}
+function verifyToken(token, secrets, now, expectedSubject) {
+  if (token.length === 0 || token.length > MAX_TOKEN_LENGTH) return { ok: false, reason: "malformed" };
+  const separator = token.lastIndexOf(".");
+  if (separator <= 0) return { ok: false, reason: "malformed" };
+  const body = token.slice(0, separator);
+  const signature = token.slice(separator + 1);
+  let valid = false;
+  for (const secret of secrets) {
+    if (constantTimeEqual(signature, sign(body, secret))) valid = true;
+  }
+  if (!valid) return { ok: false, reason: "bad-signature" };
+  let payload;
+  try {
+    const decoded = base64UrlDecode(body).toString("utf8");
+    payload = JSON.parse(decoded);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (typeof payload !== "object" || payload === null) return { ok: false, reason: "malformed" };
+  if (typeof payload.exp !== "number" || typeof payload.sub !== "string") return { ok: false, reason: "malformed" };
+  if (payload.exp <= now) return { ok: false, reason: "expired" };
+  if (expectedSubject !== void 0) {
+    let bound = false;
+    for (const candidate of typeof expectedSubject === "string" ? [expectedSubject] : expectedSubject) {
+      if (constantTimeEqual(payload.sub, candidate)) bound = true;
+    }
+    if (!bound) return { ok: false, reason: "wrong-actor" };
+  }
+  return { ok: true, payload };
+}
+function newChallenge(subject, difficulty, ttlMs, now) {
+  return { v: 1, sub: subject, iat: now, exp: now + ttlMs, nonce: randomId(12), diff: difficulty };
+}
+function newClearance(subject, level, ttlMs, now) {
+  return { v: 1, sub: subject, iat: now, exp: now + ttlMs, jti: randomId(9), lvl: level };
+}
+var MAX_TOKEN_LENGTH;
+var init_token = __esm({
+  "src/challenge/token.ts"() {
+    "use strict";
+    init_crypto();
+    MAX_TOKEN_LENGTH = 2048;
+  }
+});
+
 // src/internal/http.ts
 function parseCookies(header) {
   const cookies = /* @__PURE__ */ Object.create(null);
@@ -532,6 +903,11 @@ function toPrometheus(snapshot, options = {}) {
   counter("downgrades_total", "Terminal actions the safety guard replaced for lack of proof.", [["", snapshot.downgrades]]);
   counter("proven_total", "Assessments resting on proven evidence.", [["", snapshot.proven]]);
   counter("detector_firings_total", "Evidence produced, by detector.", Object.entries(snapshot.detectorFirings).map(([detector, value]) => [`{detector="${escapeLabel(detector)}"}`, value]));
+  const shadowFirings = Object.entries(snapshot.shadowFirings);
+  if (shadowFirings.length > 0) {
+    counter("shadow_firings_total", "Evidence produced by shadowed detectors, which decided nothing.", shadowFirings.map(([detector, value]) => [`{detector="${escapeLabel(detector)}"}`, value]));
+    counter("shadow_verdict_changes_total", "Assessments the shadowed detectors would have moved, by the verdict they would have produced.", Object.entries(snapshot.shadowChanges).map(([verdict, value]) => [`{verdict="${verdict}"}`, value]));
+  }
   counter("detector_failures_total", "Detector errors and timeouts.", Object.entries(snapshot.detectorFailures).map(([detector, value]) => [`{detector="${escapeLabel(detector)}"}`, value]));
   const timings = Object.entries(snapshot.detectorTimings);
   if (timings.length > 0) {
@@ -599,6 +975,8 @@ var init_metrics = __esm({
       detectorFirings = /* @__PURE__ */ new Map();
       detectorFailures = /* @__PURE__ */ new Map();
       detectorTimings = /* @__PURE__ */ new Map();
+      shadowFirings = /* @__PURE__ */ new Map();
+      shadowChanges = zeroed(VERDICTS);
       challengesIssued = 0;
       challengesSolved = 0;
       challengesRejected = 0;
@@ -632,6 +1010,10 @@ var init_metrics = __esm({
         }
         for (const item of assessment.evidence) bump(this.detectorFirings, item.detector);
         for (const item of assessment.humanEvidence) bump(this.detectorFirings, item.detector);
+        for (const item of assessment.shadowEvidence) bump(this.shadowFirings, item.detector);
+        if (assessment.shadowVerdict !== void 0 && assessment.shadowVerdict.verdict !== assessment.verdict) {
+          this.shadowChanges[assessment.shadowVerdict.verdict]++;
+        }
         for (const failure of assessment.failures) bump(this.detectorFailures, failure.detector);
         const ms = assessment.durationMs;
         this.durationCount++;
@@ -698,6 +1080,8 @@ var init_metrics = __esm({
           detectorFirings: Object.fromEntries(this.detectorFirings),
           detectorFailures: Object.fromEntries(this.detectorFailures),
           detectorTimings: Object.fromEntries([...this.detectorTimings].map(([id, timing]) => [id, { ...timing }])),
+          shadowFirings: Object.fromEntries(this.shadowFirings),
+          shadowChanges: { ...this.shadowChanges },
           challenges: { issued: this.challengesIssued, solved: this.challengesSolved, rejected: this.challengesRejected },
           clearances: Object.fromEntries(this.clearances),
           challengeRejections: Object.fromEntries(this.challengeRejections),
@@ -722,8 +1106,21 @@ __export(ip_exports, {
   networkKey: () => networkKey,
   normalizeIp: () => normalizeIp,
   parseCidr: () => parseCidr,
-  parseIp: () => parseIp
+  parseIp: () => parseIp,
+  stripPort: () => stripPort
 });
+function stripPort(value) {
+  const input = value.trim();
+  if (input.startsWith("[")) {
+    const close = input.indexOf("]");
+    if (close > 0) return input.slice(1, close);
+    return input;
+  }
+  const colon = input.indexOf(":");
+  if (colon === -1 || input.indexOf(":", colon + 1) !== -1) return input;
+  const host = input.slice(0, colon);
+  return parseIpv4(host) !== null ? host : input;
+}
 function parseIp(value) {
   const input = value.trim();
   if (input.length === 0 || input.length > 45) return null;
@@ -736,11 +1133,11 @@ function parseIpv4(value) {
   if (parts.length !== 4) return null;
   const bytes = new Uint8Array(4);
   for (let i = 0; i < 4; i++) {
-    const part = parts[i];
-    if (part.length === 0 || part.length > 3) return null;
-    if (!/^\d+$/.test(part)) return null;
-    if (part.length > 1 && part[0] === "0") return null;
-    const n = Number(part);
+    const part2 = parts[i];
+    if (part2.length === 0 || part2.length > 3) return null;
+    if (!/^\d+$/.test(part2)) return null;
+    if (part2.length > 1 && part2[0] === "0") return null;
+    const n = Number(part2);
     if (n > 255) return null;
     bytes[i] = n;
   }
@@ -1007,9 +1404,13 @@ function redactAssessment(assessment, options) {
     removed,
     assessment: {
       ...assessment,
+      ...assessment.marker === void 0 ? {} : { marker: reduceMarker(assessment.marker, options) },
       actor: options.maskIp ? { ...assessment.actor, key: maskActorKey(assessment.actor.key) } : assessment.actor,
       evidence: scrubEvidence(assessment.evidence, removed),
       humanEvidence: scrubEvidence(assessment.humanEvidence, removed),
+      // Scrubbed on the same terms: a shadowed detector reads the same request as every
+      // other one, so its summary can quote the same secret out of it.
+      shadowEvidence: scrubEvidence(assessment.shadowEvidence, removed),
       facts: {
         ...assessment.facts,
         ip: options.maskIp ? maskIpValue(assessment.facts.ip) : assessment.facts.ip,
@@ -1061,6 +1462,15 @@ function maskActorKey(key) {
   if (separator === -1) return networkKey(key);
   return `${networkKey(key.slice(0, separator))}|${key.slice(separator + 1)}`;
 }
+function reduceMarker(marker, options) {
+  return {
+    ...marker,
+    reading: { kind: marker.reading.kind },
+    // The shape is three coarse parts of the User-Agent. If the User-Agent itself is
+    // being withheld, the parts of it must go too, or the setting only half applies.
+    ...options.dropUserAgent === true ? { shape: { b: "", o: "", l: "" } } : {}
+  };
+}
 var REDACTED, CREDENTIAL_HEADERS, ALWAYS_STRIP, MIN_SCRUB_LENGTH;
 var init_redact = __esm({
   "src/notify/redact.ts"() {
@@ -1683,37 +2093,50 @@ var init_dns = __esm({
 });
 
 // src/detectors/clearance.ts
-function clearanceDetector(service) {
+function withShared(shared, primary) {
+  return shared === void 0 ? primary : [primary, shared];
+}
+function clearanceDetector(service, sharingThreshold = DEFAULT_SHARING_THRESHOLD) {
   return {
     id: "clearance",
     description: "Reads a signed clearance token proving the client previously passed a check",
     cost: "cheap",
     stage: "always",
     inspect(ctx) {
-      const claims = service.read(ctx.actor.key, ctx.facts.cookies);
-      if (!claims) return void 0;
+      const { claims, boundElsewhere, presentedBy } = service.inspect(ctx.actor.key, ctx.facts.cookies);
+      const shared = presentedBy >= sharingThreshold ? {
+        detector: "clearance",
+        summary: `The clearance token presented here has now been presented by ${presentedBy} different clients`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "scraper"
+      } : void 0;
+      if (!claims) {
+        void boundElsewhere;
+        return shared;
+      }
       const ageMs = ctx.facts.timestamp - claims.iat;
       if (claims.lvl === "operator") {
-        return {
+        return withShared(shared, {
           detector: "clearance",
           summary: "Client holds an operator-granted clearance token",
           direction: "human",
           certainty: "certain",
           deterministicBasis: "The application issued this clearance itself, on evidence it holds and this library cannot see. It is an assertion by the operator, not an inference from the request, and the token's signature binds it to this actor.",
           metadata: { level: claims.lvl, ageMs }
-        };
+        });
       }
       if (claims.lvl === "interaction") {
-        return {
+        return withShared(shared, {
           detector: "clearance",
           summary: "Client holds a clearance token granted after a trusted input event",
           direction: "human",
           certainty: "strong",
           weight: 0.7,
           metadata: { level: claims.lvl, ageMs }
-        };
+        });
       }
-      return {
+      return withShared(shared, {
         detector: "clearance",
         summary: "Client holds a clearance token granted for a completed proof of work",
         direction: "human",
@@ -1724,13 +2147,389 @@ function clearanceDetector(service) {
           ageMs,
           note: "Proof of work demonstrates a JavaScript engine and spent CPU. It does not demonstrate a person."
         }
-      };
+      });
     }
   };
 }
+var DEFAULT_SHARING_THRESHOLD;
 var init_clearance = __esm({
   "src/detectors/clearance.ts"() {
     "use strict";
+    DEFAULT_SHARING_THRESHOLD = 12;
+  }
+});
+
+// src/probe/marker.ts
+function identityShape(facts, ua) {
+  const platform = facts.headers["sec-ch-ua-platform"]?.replace(/"/g, "").trim().toLowerCase();
+  const language = facts.headers["accept-language"]?.split(",")[0]?.split("-")[0]?.trim().toLowerCase();
+  return {
+    // A client that names no browser is its own category, and an empty User-Agent must
+    // not read as equal to every other empty one by accident — it reads as "none", which
+    // is exactly what it is, and changing away from it is a real change.
+    b: part(ua.browser ?? (ua.raw.length === 0 ? "none" : `t:${withoutVersions(ua.raw)}`)),
+    o: part(ua.os ?? platform ?? "none"),
+    l: part(language ?? "none")
+  };
+}
+function part(value) {
+  const trimmed = value.length > 40 ? value.slice(0, 40) : value;
+  return trimmed.toLowerCase();
+}
+function withoutVersions(raw) {
+  return raw.replace(VERSION_NUMBERS, "#");
+}
+function driftBetween(issued, now) {
+  return { browser: issued.b !== now.b, platform: issued.o !== now.o, language: issued.l !== now.l };
+}
+function newMarker(shape, ttlMs, now) {
+  return { v: 1, sub: randomId(9), iat: now, exp: now + ttlMs, ...shape };
+}
+function markerCookie(name, claims, secrets, options) {
+  return serializeCookie(name, issueToken(claims, secrets), {
+    maxAgeMs: claims.exp - claims.iat,
+    sameSite: options.sameSite ?? "Lax",
+    secure: options.secure ?? true,
+    // Nothing in a page needs to read this, and a marker readable by script is one a
+    // cross-site script can lift.
+    httpOnly: true,
+    ...options.domain === void 0 ? {} : { domain: options.domain }
+  });
+}
+function readMarker(value, secrets, now) {
+  if (value === void 0 || value.length === 0) return { kind: "absent" };
+  if (!TOKEN_SHAPE.test(value)) return { kind: "absent" };
+  const verified = verifyToken(value, secrets, now);
+  if (verified.ok) return { kind: "valid", claims: verified.payload };
+  return verified.reason === "expired" ? { kind: "expired" } : { kind: "forged" };
+}
+var VERSION_NUMBERS, TOKEN_SHAPE;
+var init_marker = __esm({
+  "src/probe/marker.ts"() {
+    "use strict";
+    init_token();
+    init_crypto();
+    init_http();
+    VERSION_NUMBERS = /\d+(?:[._]\d+)*/g;
+    TOKEN_SHAPE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+  }
+});
+
+// src/detectors/challenge-reaction.ts
+function challengeReactionDetector(options = {}) {
+  const windowMs = options.windowMs ?? 6e4;
+  const minUnsolved = options.minUnsolved ?? 4;
+  return {
+    id: "challenge-reaction",
+    description: "Reads how a client responded to being challenged: a changed identity, or never answering at all",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const found = [];
+      const { at, shape } = ctx.state.lastChallenge;
+      const since = at === 0 ? Number.POSITIVE_INFINITY : ctx.facts.timestamp - at;
+      if (shape !== void 0 && since >= 0 && since <= windowMs) {
+        const now = ctx.marker?.shape ?? identityShape(ctx.facts, ctx.ua);
+        if (now.b !== shape.b) {
+          const proven = ctx.marker?.reading.kind === "valid";
+          found.push({
+            detector: "challenge-reaction",
+            summary: proven ? `Client changed the browser it claims to be within ${Math.round(since / 1e3)}s of being challenged, holding the same marker throughout` : `A client at this address changed the browser it claims to be within ${Math.round(since / 1e3)}s of being challenged`,
+            direction: "bot",
+            certainty: proven ? "strong" : "moderate",
+            botClass: "impersonator",
+            // One cause with `identity-drift`: this client changed what it claims to be.
+            // Both fire together whenever a challenge is what prompted the change.
+            family: "identity-change"
+          });
+        }
+      }
+      if (ctx.state.unsolvedChallenges >= minUnsolved) {
+        found.push({
+          detector: "challenge-reaction",
+          summary: `Challenged ${ctx.state.unsolvedChallenges} times and has never returned a solution`,
+          direction: "bot",
+          certainty: "moderate",
+          botClass: "unknown"
+        });
+      }
+      return found.length > 0 ? found : void 0;
+    }
+  };
+}
+var init_challenge_reaction = __esm({
+  "src/detectors/challenge-reaction.ts"() {
+    "use strict";
+    init_marker();
+  }
+});
+
+// src/detectors/challenge-integrity.ts
+function challengeIntegrityDetector(options = {}) {
+  const minReplays = options.minReplays ?? 3;
+  const minImplausible = options.minImplausible ?? 1;
+  return {
+    id: "challenge-integrity",
+    description: "Reports solutions that were replayed, or returned faster than the proof of work allows",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const { replays, implausible } = ctx.state.challengeAnomalies;
+      const found = [];
+      if (replays >= minReplays) {
+        found.push({
+          detector: "challenge-integrity",
+          summary: `Submitted ${replays} solutions for challenges that had already been solved`,
+          direction: "bot",
+          certainty: "moderate",
+          botClass: "unknown"
+        });
+      }
+      if (implausible >= minImplausible) {
+        found.push({
+          detector: "challenge-integrity",
+          summary: implausible > 1 ? `Returned ${implausible} solutions faster than the proof of work can be computed in a browser` : "Returned a solution faster than the proof of work can be computed in a browser",
+          direction: "bot",
+          certainty: "moderate",
+          botClass: "automation"
+        });
+      }
+      return found.length > 0 ? found : void 0;
+    }
+  };
+}
+var init_challenge_integrity = __esm({
+  "src/detectors/challenge-integrity.ts"() {
+    "use strict";
+  }
+});
+
+// src/detectors/site-baseline.ts
+function distributedWalkDetector(options = {}) {
+  const minActors = options.minActors ?? 8;
+  const minIds = options.minIds ?? 150;
+  const minCoverage = options.minCoverage ?? 0.6;
+  const maxRevisitRatio = options.maxRevisitRatio ?? 1.3;
+  const minRevisitRatio = options.minRevisitRatio ?? 0.7;
+  return {
+    id: "distributed-walk",
+    description: "Reports a numeric range being walked across many clients, none of which walks enough of it alone",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      if (ctx.site === void 0 || !ctx.site.warm) return void 0;
+      const step = walkStepOf(ctx.facts.path);
+      if (step === void 0) return void 0;
+      const spread = ctx.site.spreadOf(step.template);
+      if (spread === void 0) return void 0;
+      if (spread.actors < minActors || spread.ids < minIds) return void 0;
+      if (spread.coverage < minCoverage) return void 0;
+      const revisits = spread.visits / spread.ids;
+      if (revisits > maxRevisitRatio || revisits < minRevisitRatio) return void 0;
+      return {
+        detector: "distributed-walk",
+        summary: `${spread.actors} clients between them have requested ${spread.ids} ids under ${step.template}, covering ${(spread.coverage * 100).toFixed(0)}% of the range and almost none of them twice`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "scraper"
+      };
+    }
+  };
+}
+function pathNoveltyDetector(options = {}) {
+  const minRequests = options.minRequests ?? 30;
+  const minNovelShare = options.minNovelShare ?? 0.95;
+  return {
+    id: "path-novelty",
+    description: "Reports a client whose requests are almost all for paths this site has never been asked for",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      if (ctx.site === void 0 || !ctx.site.warm) return void 0;
+      const total = ctx.state.total;
+      if (total < minRequests) return void 0;
+      const share = ctx.state.novelPathCount / total;
+      if (share < minNovelShare) return void 0;
+      return {
+        detector: "path-novelty",
+        summary: `${(share * 100).toFixed(0)}% of this client's ${total} requests were for paths no other client has ever asked this site for`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "scanner",
+        // The same cause `probe-signature` names when a path is on a list it ships: this
+        // client is walking a list rather than reading a site.
+        family: "wordlist-probe"
+      };
+    }
+  };
+}
+function missBaselineDetector(options = {}) {
+  const minResponses = options.minResponses ?? 20;
+  const minRatio = options.minRatio ?? 5;
+  const floor = options.floor ?? 0.5;
+  return {
+    id: "miss-baseline",
+    description: 'Compares how often a client is answered "not found" with how often this site answers that at all',
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const siteRate = ctx.site?.missRate;
+      if (siteRate === void 0) return void 0;
+      const { responses, misses } = ctx.state;
+      if (responses < minResponses) return void 0;
+      const rate = misses / responses;
+      if (rate < floor) return void 0;
+      if (siteRate > 0 && rate / siteRate < minRatio) return void 0;
+      return {
+        detector: "miss-baseline",
+        summary: siteRate > 0 ? `${(rate * 100).toFixed(0)}% of this client's requests were answered "not found", against ${(siteRate * 100).toFixed(1)}% across the site` : `${(rate * 100).toFixed(0)}% of this client's requests were answered "not found", on a site that otherwise never answers that`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "scanner",
+        // `probe-volume` reads the same misses against a fixed threshold. Two readings
+        // of one cause, so the stronger stands and they do not sum.
+        family: "misses"
+      };
+    }
+  };
+}
+function pathCampaignDetector(options = {}) {
+  const minClients = options.minClients ?? 12;
+  const minMissShare = options.minMissShare ?? 0.9;
+  const minAnswered = options.minAnswered ?? 10;
+  return {
+    id: "path-campaign",
+    description: "Reports a path this site never served that many unrelated clients have suddenly begun requesting",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const surge = ctx.site?.surgeOf(ctx.facts.path);
+      if (surge === void 0) return void 0;
+      if (surge.clients < minClients || surge.answered < minAnswered) return void 0;
+      if (surge.misses / surge.answered < minMissShare) return void 0;
+      return {
+        detector: "path-campaign",
+        summary: `${surge.clients} unrelated clients have requested ${ctx.facts.path} since it first appeared ${Math.round(surge.ageMs / 6e4)} minutes ago, and the site has answered "not found" to almost all of them`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "scanner"
+      };
+    }
+  };
+}
+var init_site_baseline = __esm({
+  "src/detectors/site-baseline.ts"() {
+    "use strict";
+    init_state();
+  }
+});
+
+// src/detectors/marker.ts
+function identityDriftDetector(options = {}) {
+  const reportSoft = options.reportSoftDrift ?? true;
+  return {
+    id: "identity-drift",
+    description: "Compares the identity a client claims now with the one it claimed when it was given its marker",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const drift = ctx.marker?.drift;
+      if (drift === void 0) return void 0;
+      if (drift.browser) {
+        return {
+          detector: "identity-drift",
+          summary: "Client is holding a marker this server issued to a different browser, so one of the two identities it has claimed is false",
+          direction: "bot",
+          certainty: "strong",
+          botClass: "impersonator"
+        };
+      }
+      if (!reportSoft || !(drift.platform || drift.language)) return void 0;
+      const what = drift.platform && drift.language ? "platform and language" : drift.platform ? "platform" : "language";
+      return {
+        detector: "identity-drift",
+        // Named precisely, because the operator reading this needs to know it is the
+        // soft case: a person switching to the desktop site produces exactly this.
+        summary: `Client's claimed ${what} changed while holding one marker, which a person can also do deliberately`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "unknown"
+      };
+    }
+  };
+}
+function markerIntegrityDetector(options = {}) {
+  const minForgeries = options.minForgeries ?? 1;
+  return {
+    id: "marker-integrity",
+    description: "Reports a marker cookie presented with a signature this server could not have produced",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      if (ctx.marker?.reading.kind !== "forged") return void 0;
+      const { forged } = ctx.state.markers;
+      if (forged < minForgeries) return void 0;
+      return {
+        detector: "marker-integrity",
+        summary: forged > 1 ? `Presented a marker cookie this server never signed, ${forged} times` : "Presented a marker cookie this server never signed",
+        direction: "bot",
+        certainty: "strong",
+        botClass: "scanner"
+      };
+    }
+  };
+}
+function markerPersistenceDetector(options = {}) {
+  const minIssued = options.minIssued ?? 5;
+  return {
+    id: "marker-persistence",
+    description: "Reports a client that has been handed a marker repeatedly and has never returned one",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      if (ctx.marker === void 0) return void 0;
+      if (ctx.facts.headers["cookie"] === void 0) return void 0;
+      const { issued, returned } = ctx.state.markers;
+      if (returned > 0 || issued < minIssued) return void 0;
+      return {
+        detector: "marker-persistence",
+        summary: `Sends cookies but has never returned the one this server set, across ${issued} responses that offered it`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "http-client",
+        // The same cause `session-integrity` reports when it sees no cookie at all: one
+        // client that does not keep state. Without this they are two moderate signals
+        // for one observation, and the population that produces it is people who block
+        // cookies — so the double count landed squarely on them. Measured on the corpus:
+        // it took `cookies-blocked` from 21 to 38 before the family was named.
+        family: "no-session"
+      };
+    }
+  };
+}
+function markerFanoutDetector(options = {}) {
+  const minNetworks = options.minNetworks ?? 16;
+  return {
+    id: "marker-fanout",
+    description: "Counts the distinct networks one marker cookie has been presented from",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const networks = ctx.marker?.networks ?? 0;
+      if (networks < minNetworks) return void 0;
+      return {
+        detector: "marker-fanout",
+        summary: `One client has presented the same marker from ${networks} different networks`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "scraper"
+      };
+    }
+  };
+}
+var init_marker2 = __esm({
+  "src/detectors/marker.ts"() {
+    "use strict";
   }
 });
 
@@ -1883,7 +2682,7 @@ function compileSignatures(signatures = BOT_SIGNATURES) {
 function indexSignatures(signatures = BOT_SIGNATURES) {
   return new Map(signatures.map((signature) => [signature.id, signature]));
 }
-var BOT_CATEGORIES, SEARCH, AI, SEO, SOCIAL, MONITORING, ARCHIVE, FEED, SECURITY, LIBRARY, HEADLESS, EMBEDDED, ADVERTISING, COMMERCE, ACADEMIC, ACCESSIBILITY, BOT_SIGNATURES, BENIGN_CATEGORIES;
+var BOT_CATEGORIES, SEARCH, AI, SEO, SOCIAL, MONITORING, ARCHIVE, FEED, SECURITY, LIBRARY, HEADLESS, EMBEDDED, ADVERTISING, COMMERCE, ACADEMIC, EMAIL_SECURITY, ACCESSIBILITY, BOT_SIGNATURES, BENIGN_CATEGORIES;
 var init_known_bots = __esm({
   "src/detectors/known-bots.ts"() {
     "use strict";
@@ -1904,6 +2703,7 @@ var init_known_bots = __esm({
       "commerce",
       "accessibility",
       "academic",
+      "email-security",
       "other"
     ];
     SEARCH = [
@@ -1928,6 +2728,13 @@ var init_known_bots = __esm({
       { id: "yisouspider", name: "Shenma (Yisou) Spider", tokens: ["yisouspider"], category: "search", benign: true, robotsAgent: "YisouSpider", verification: { kind: "none" } },
       { id: "yahoo-slurp", name: "Yahoo! Slurp", tokens: ["yahoo! slurp"], category: "search", benign: true, robotsAgent: "Slurp", verification: { kind: "fcrdns", domains: ["crawl.yahoo.net", "yahoo.com"] } },
       { id: "mail-ru", name: "Mail.Ru bot", tokens: ["mail.ru_bot"], category: "search", benign: true, verification: { kind: "none" } },
+      { id: "brave-search", name: "Brave Search", tokens: ["bravesearchbot"], category: "search", benign: true, robotsAgent: "BraveSearchBot", verification: { kind: "none" } },
+      { id: "ecosia", name: "Ecosia", tokens: ["ecosiabot"], category: "search", benign: true, verification: { kind: "none" } },
+      { id: "startpage", name: "Startpage", tokens: ["startpagebot"], category: "search", benign: true, verification: { kind: "none" } },
+      { id: "daum", name: "Daumoa", tokens: ["daumoa"], category: "search", benign: true, verification: { kind: "none" } },
+      { id: "stract", name: "Stract", tokens: ["stractbot"], category: "search", benign: true, verification: { kind: "none" } },
+      { id: "rightdao", name: "RightDao", tokens: ["rightdaobot"], category: "search", benign: true, verification: { kind: "none" } },
+      { id: "gigablast", name: "Gigablast", tokens: ["gigablastopensource"], category: "search", benign: true, verification: { kind: "none" } },
       { id: "exabot", name: "Exabot (Exalead)", tokens: ["exabot"], category: "search", benign: true, verification: { kind: "none" } },
       { id: "kagibot", name: "Kagi", tokens: ["kagibot"], category: "search", benign: true, robotsAgent: "KagiBot", verification: { kind: "none" } }
     ];
@@ -1998,11 +2805,15 @@ var init_known_bots = __esm({
       { id: "pinterestbot", name: "Pinterestbot", tokens: ["pinterest/", "pinterestbot"], category: "social", benign: true, verification: { kind: "fcrdns", domains: ["pinterest.com"] } },
       { id: "mastodon", name: "Mastodon / Fediverse", tokens: ["mastodon/", "pleroma", "misskey/", "akkoma"], category: "social", benign: true, verification: { kind: "none" } },
       { id: "embedly", name: "Embedly", tokens: ["embedly"], category: "social", benign: true, verification: { kind: "none" } },
-      { id: "bluesky", name: "Bluesky card fetcher", tokens: ["bluesky cardyb", "cardyb/"], category: "social", benign: true, verification: { kind: "none" } },
+      { id: "bluesky", name: "Bluesky card fetcher", tokens: ["bluesky cardyb", "cardyb/", "blueskybot"], category: "social", benign: true, verification: { kind: "none" } },
       { id: "iframely", name: "Iframely", tokens: ["iframely"], category: "social", benign: true, verification: { kind: "none" } },
       { id: "skype-preview", name: "Skype URI preview", tokens: ["skypeuripreview"], category: "social", benign: true, verification: { kind: "none" } },
       { id: "vk-share", name: "VK / Odnoklassniki preview", tokens: ["vkshare", "odklbot"], category: "social", benign: true, verification: { kind: "none" } },
       { id: "discourse-onebox", name: "Discourse Onebox", tokens: ["discourse forum onebox"], category: "social", benign: true, verification: { kind: "none" } },
+      { id: "microsoft-preview", name: "Microsoft Teams preview", tokens: ["microsoftpreview"], category: "social", benign: true, verification: { kind: "none" } },
+      { id: "zoom-preview", name: "Zoom link preview", tokens: ["zoombot"], category: "social", benign: true, verification: { kind: "none" } },
+      { id: "signal-preview", name: "Signal link preview", tokens: ["signalbot"], category: "social", benign: true, verification: { kind: "none" } },
+      { id: "matrix-synapse", name: "Matrix (Synapse) preview", tokens: ["synapse/"], category: "social", benign: true, verification: { kind: "none" } },
       { id: "yahoo-preview", name: "Yahoo Link Preview", tokens: ["yahoo link preview"], category: "social", benign: true, verification: { kind: "none" } }
     ];
     MONITORING = [
@@ -2042,6 +2853,10 @@ var init_known_bots = __esm({
       { id: "smartnews", name: "SmartNews", tokens: ["smartnewsbot"], category: "feed", benign: true, verification: { kind: "none" } },
       { id: "flipboard", name: "Flipboard", tokens: ["flipboardproxy"], category: "feed", benign: true, verification: { kind: "none" } },
       { id: "podcast-index", name: "Podcast Index", tokens: ["podcastindexbot"], category: "feed", benign: true, verification: { kind: "none" } },
+      // Spotify's podcast fetcher sends `Spotify/1.0` — and so does the Spotify desktop app,
+      // with a person driving it. There is no token that separates them, so this one is left
+      // unnamed rather than named wrongly: the corpus proved the point immediately by blocking
+      // a human under `protect-auth`, `indexers-only` and `under-attack` at once.
       { id: "freshrss", name: "FreshRSS", tokens: ["freshrss"], category: "feed", benign: true, verification: { kind: "none" } },
       { id: "netnewswire", name: "NetNewsWire", tokens: ["netnewswire"], category: "feed", benign: true, verification: { kind: "none" } },
       { id: "overcast", name: "Overcast", tokens: ["overcast/"], category: "feed", benign: true, verification: { kind: "none" } },
@@ -2168,7 +2983,23 @@ var init_known_bots = __esm({
     ];
     ADVERTISING = [
       { id: "adsbot-google", name: "AdsBot-Google", tokens: ["adsbot-google", "mediapartners-google", "adsbot"], category: "advertising", benign: true, verification: { kind: "fcrdns", domains: ["googlebot.com", "google.com"] } },
-      { id: "criteo", name: "Criteo", tokens: ["criteobot"], category: "advertising", benign: true, verification: { kind: "none" } }
+      { id: "criteo", name: "Criteo", tokens: ["criteobot"], category: "advertising", benign: true, verification: { kind: "none" } },
+      // Verification and contextual classification: they read a page to decide whether an ad
+      // may appear beside it, or what the page is about. A publisher usually wants these and a
+      // site with no advertising has no reason to.
+      { id: "doubleverify", name: "DoubleVerify", tokens: ["doubleverifybot"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "ias", name: "Integral Ad Science", tokens: ["ias crawler"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "moat", name: "Moat", tokens: ["moatbot"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "comscore", name: "comScore (Proximic)", tokens: ["proximic"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "grapeshot", name: "Grapeshot", tokens: ["grapeshotcrawler"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "peer39", name: "Peer39", tokens: ["peer39bot"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "taboola", name: "Taboola", tokens: ["taboolabot"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "outbrain", name: "Outbrain", tokens: ["outbrainbot"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "pubmatic", name: "PubMatic", tokens: ["pubmaticbot"], category: "advertising", benign: true, verification: { kind: "none" } },
+      { id: "thetradedesk", name: "The Trade Desk", tokens: ["ttd-content"], category: "advertising", benign: true, verification: { kind: "none" } },
+      // Competitive ad intelligence rather than verification: it collects what everyone else
+      // is running. Named, and left for the operator to decide about.
+      { id: "adbeat", name: "Adbeat", tokens: ["adbeat_bot"], category: "advertising", benign: false, verification: { kind: "none" } }
     ];
     COMMERCE = [
       { id: "idealo", name: "idealo", tokens: ["idealo-bot"], category: "commerce", benign: false, verification: { kind: "none" } },
@@ -2184,6 +3015,12 @@ var init_known_bots = __esm({
       { id: "openalex", name: "OpenAlex", tokens: ["openalexbot"], category: "academic", benign: true, verification: { kind: "none" } },
       { id: "webis", name: "Webis research crawler", tokens: ["webisbot"], category: "academic", benign: true, verification: { kind: "none" } }
     ];
+    EMAIL_SECURITY = [
+      { id: "proofpoint", name: "Proofpoint URL Defense", tokens: ["proofpointurldefensebot"], category: "email-security", benign: true, verification: { kind: "none" } },
+      { id: "mimecast", name: "Mimecast URL Protect", tokens: ["mimecasturlprotectbot"], category: "email-security", benign: true, verification: { kind: "none" } },
+      { id: "barracuda", name: "Barracuda Link Protect", tokens: ["barracudalinkprotectbot"], category: "email-security", benign: true, verification: { kind: "none" } },
+      { id: "cisco-esa", name: "Cisco Secure Email", tokens: ["ciscosecureemailbot"], category: "email-security", benign: true, verification: { kind: "none" } }
+    ];
     ACCESSIBILITY = [
       { id: "siteimprove", name: "Siteimprove", tokens: ["siteimprovebot"], category: "accessibility", benign: true, robotsAgent: "SiteimproveBot", verification: { kind: "none" } }
     ];
@@ -2202,7 +3039,8 @@ var init_known_bots = __esm({
       ...EMBEDDED,
       ...COMMERCE,
       ...ACADEMIC,
-      ...ACCESSIBILITY
+      ...ACCESSIBILITY,
+      ...EMAIL_SECURITY
     ]);
     BENIGN_CATEGORIES = /* @__PURE__ */ new Set(["search", "social", "monitoring", "feed", "archive", "advertising"]);
   }
@@ -2779,10 +3617,241 @@ function crawlBreadthDetector(options = {}) {
     }
   };
 }
-var init_crawl_breadth = __esm({
-  "src/detectors/crawl-breadth.ts"() {
+var init_crawl_breadth = __esm({
+  "src/detectors/crawl-breadth.ts"() {
+    "use strict";
+    init_state();
+  }
+});
+
+// src/detectors/parameter-sweep.ts
+function parameterSweepDetector(options = {}) {
+  const threshold = options.threshold ?? 25;
+  const variantsPerPath = options.variantsPerPath ?? 8;
+  const minRequests = options.minRequests ?? 20;
+  if (threshold > MAX_TRACKED_QUERIES) {
+    throw new RangeError(
+      `parameterSweepDetector threshold ${threshold} can never be reached: an actor's distinct-query count saturates at ${MAX_TRACKED_QUERIES}. Use ${MAX_TRACKED_QUERIES} or fewer.`
+    );
+  }
+  return {
+    id: "parameter-sweep",
+    description: "Counts distinct query strings against the paths they sit on, to catch enumeration that leaves the path unchanged",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const { distinctPaths, distinctQueries, queriesSaturated, total } = ctx.state;
+      if (total < minRequests || distinctQueries < threshold) return void 0;
+      const spread = distinctQueries / Math.max(1, distinctPaths);
+      if (spread < variantsPerPath) return void 0;
+      return {
+        detector: "parameter-sweep",
+        summary: queriesSaturated ? `at least ${distinctQueries} distinct query strings across only ${distinctPaths} path(s)` : `${distinctQueries} distinct query strings across only ${distinctPaths} path(s) in ${total} requests`,
+        direction: "bot",
+        certainty: "weak",
+        // Saturation means the count stopped being able to grow, so the real spread is
+        // wider than the one reported — the same argument breadth makes for itself.
+        weight: queriesSaturated ? 0.25 : 0.15,
+        botClass: "scraper",
+        metadata: {
+          distinctQueries,
+          distinctPaths,
+          variantsPerPath: Number(spread.toFixed(1)),
+          totalRequests: total,
+          saturated: queriesSaturated
+        }
+      };
+    }
+  };
+}
+var init_parameter_sweep = __esm({
+  "src/detectors/parameter-sweep.ts"() {
+    "use strict";
+    init_state();
+  }
+});
+
+// src/detectors/transport-coherence.ts
+function transportCoherenceDetector(options = {}) {
+  const checkLegacyHttp = options.legacyHttp ?? true;
+  const minHeadRequests = options.minHeadRequests ?? 8;
+  return {
+    id: "transport-coherence",
+    description: "Reads the HTTP version and the methods across a visit against the client the request claims to be",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      if (!claimsBrowser(ctx.ua)) return void 0;
+      const results = [];
+      const version = ctx.facts.httpVersion;
+      if (checkLegacyHttp && version !== void 0 && LEGACY_VERSIONS.has(version)) {
+        results.push({
+          detector: "transport-coherence",
+          summary: `Client claims to be a browser but negotiated HTTP/${version}, which no shipping browser has offered in over a decade`,
+          direction: "bot",
+          certainty: "moderate",
+          botClass: "impersonator",
+          // One downgrading proxy in front of the application does this to every request
+          // that passes through it, so this must count once rather than once per reason.
+          family: "legacy-transport",
+          metadata: { httpVersion: version, browser: ctx.ua.browser }
+        });
+      }
+      const methods = ctx.state.methodsSeen;
+      if (ctx.state.total >= minHeadRequests && methods.length > 0 && methods.every((method) => method === "HEAD")) {
+        results.push({
+          detector: "transport-coherence",
+          summary: `Client claims to be a browser but has issued nothing but HEAD across ${ctx.state.total} requests`,
+          direction: "bot",
+          certainty: "moderate",
+          botClass: "scraper",
+          metadata: { requests: ctx.state.total, browser: ctx.ua.browser }
+        });
+      }
+      return results.length > 0 ? results : void 0;
+    }
+  };
+}
+var LEGACY_VERSIONS;
+var init_transport_coherence = __esm({
+  "src/detectors/transport-coherence.ts"() {
+    "use strict";
+    init_ua();
+    LEGACY_VERSIONS = /* @__PURE__ */ new Set(["0.9", "1.0"]);
+  }
+});
+
+// src/detectors/probe-volume.ts
+function probeVolumeDetector(options = {}) {
+  const minResponses = options.minResponses ?? 20;
+  const missRatio = options.missRatio ?? 0.8;
+  return {
+    id: "probe-volume",
+    description: "Reads the share of an actor's requests that were answered 404 or 410, where the application reports them",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const { responses, misses } = ctx.state;
+      if (responses < minResponses) return void 0;
+      const ratio = misses / responses;
+      if (ratio < missRatio) return void 0;
+      return {
+        detector: "probe-volume",
+        summary: `${misses} of this client's last ${responses} requests were answered "not found" (${(ratio * 100).toFixed(0)}%)`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "scanner",
+        // `miss-baseline` reads the same misses relative to the site's own rate. One
+        // cause, so the stronger reading stands rather than the two summing.
+        family: "misses",
+        metadata: { responses, misses, missRatio: Number(ratio.toFixed(3)) }
+      };
+    }
+  };
+}
+var init_probe_volume = __esm({
+  "src/detectors/probe-volume.ts"() {
+    "use strict";
+  }
+});
+
+// src/detectors/id-enumeration.ts
+function idEnumerationDetector(options = {}) {
+  const minRequests = options.minRequests ?? 30;
+  const density = options.density ?? 0.9;
+  return {
+    id: "id-enumeration",
+    description: "Reports an actor covering a contiguous range of numeric identifiers under one path shape",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const walk = ctx.state.densestWalk();
+      if (walk === void 0 || walk.count < minRequests) return void 0;
+      if (walk.span < minRequests) return void 0;
+      const covered = Math.min(1, walk.count / walk.span);
+      if (covered < density) return void 0;
+      return {
+        detector: "id-enumeration",
+        summary: `${walk.count} requests to ${walk.template} covering ${(covered * 100).toFixed(0)}% of a ${walk.span}-wide range of ids`,
+        direction: "bot",
+        certainty: "moderate",
+        botClass: "scraper",
+        metadata: { template: walk.template, requests: walk.count, span: walk.span, coverage: Number(covered.toFixed(3)) }
+      };
+    }
+  };
+}
+var init_id_enumeration = __esm({
+  "src/detectors/id-enumeration.ts"() {
+    "use strict";
+  }
+});
+
+// src/detectors/blended-identity.ts
+function blendedIdentityDetector(options = {}) {
+  const scannerFloor = options.scannerIdentities ?? 2;
+  const crawlerFloor = options.crawlerIdentities ?? 2;
+  return {
+    id: "blended-identity",
+    description: "Reads the set of identities one actor has claimed across requests for combinations that cannot all be true",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const claimed = ctx.state.claimedIdentities;
+      if (claimed.size === 0) return void 0;
+      const scanners = [];
+      const crawlers = [];
+      const benignCrawlers = [];
+      for (const [id, what] of claimed) {
+        if (what.category === "security") scanners.push(id);
+        if (what.verifiable) crawlers.push(id);
+        if (what.category === "search" || what.category === "ai" || what.category === "social") benignCrawlers.push(id);
+      }
+      const results = [];
+      if (scanners.length >= scannerFloor) {
+        results.push({
+          detector: "blended-identity",
+          summary: `One client has arrived as ${scanners.length} different security tools: ${scanners.join(", ")}`,
+          direction: "bot",
+          certainty: "strong",
+          weight: 0.7,
+          botClass: "scanner",
+          metadata: { identities: scanners }
+        });
+      }
+      if (crawlers.length >= crawlerFloor) {
+        results.push({
+          detector: "blended-identity",
+          summary: `One client has claimed ${crawlers.length} crawler identities that publish address proofs: ${crawlers.join(", ")}`,
+          direction: "bot",
+          certainty: "strong",
+          weight: 0.7,
+          botClass: "impersonator",
+          // Not `certain`, and the line is worth holding. Each operator publishes a proof
+          // tied to addresses it controls, so at most one claim can be true — but a shared
+          // egress in front of two genuinely different clients would produce the same set,
+          // and this library refuses to deny anybody on an inference.
+          metadata: { identities: crawlers }
+        });
+      }
+      if (ctx.state.payloadProbes > 0 && benignCrawlers.length > 0) {
+        results.push({
+          detector: "blended-identity",
+          summary: `Client claims to be ${benignCrawlers.join(", ")} and has sent ${ctx.state.payloadProbes} scanner payload(s)`,
+          direction: "bot",
+          certainty: "strong",
+          weight: 0.75,
+          botClass: "impersonator",
+          metadata: { identities: benignCrawlers, payloadProbes: ctx.state.payloadProbes }
+        });
+      }
+      return results.length > 0 ? results : void 0;
+    }
+  };
+}
+var init_blended_identity = __esm({
+  "src/detectors/blended-identity.ts"() {
     "use strict";
-    init_state();
   }
 });
 
@@ -3366,14 +4435,16 @@ function findPayload(path, query) {
   for (const { pattern, what, tier } of PAYLOADS) {
     if (pattern.test(path)) return { what, where: "path", sample: path, tier };
   }
-  for (const [key, value] of Object.entries(query)) {
+  for (const key in query) {
+    const value = query[key];
+    if (!PAYLOAD_GATE.test(value)) continue;
     for (const { pattern, what, tier } of PAYLOADS) {
       if (pattern.test(value)) return { what, where: `query parameter "${key.slice(0, 40)}"`, sample: value, tier };
     }
   }
   return void 0;
 }
-var EXPLOIT_PATHS, EXPLOIT_SUFFIXES, PLATFORM_PATHS, PAYLOADS, INJECTION_PUNCTUATION, PROBE_METHODS;
+var EXPLOIT_PATHS, EXPLOIT_SUFFIXES, PLATFORM_PATHS, PAYLOADS, PAYLOAD_GATE, INJECTION_PUNCTUATION, PROBE_METHODS;
 var init_probe_signature = __esm({
   "src/detectors/probe-signature.ts"() {
     "use strict";
@@ -3447,11 +4518,74 @@ var init_probe_signature = __esm({
       { pattern: /<script[\s>]/i, what: "an inline script tag", tier: "markup" },
       { pattern: /\bon(?:error|load|mouseover)\s*=/i, what: "an inline event handler", tier: "markup" }
     ];
+    PAYLOAD_GATE = /[$`:(<=\s]/;
     INJECTION_PUNCTUATION = /['"]|--\s|\/\*|;|%27|%22/;
     PROBE_METHODS = /* @__PURE__ */ new Set(["TRACE", "TRACK", "DEBUG", "CONNECT"]);
   }
 });
 
+// src/detectors/target-integrity.ts
+function targetIntegrityDetector(options = {}) {
+  const reportPlain = options.reportPlainTraversal ?? true;
+  return {
+    id: "target-integrity",
+    description: "Reports a request target spelled to get past something rather than to fetch something",
+    cost: "cheap",
+    stage: "always",
+    inspect(ctx) {
+      const raw = ctx.facts.rawPath;
+      if (raw === void 0) return void 0;
+      const findings = [];
+      if (ABSOLUTE_FORM.test(raw)) {
+        findings.push({ what: "asked this server to fetch a URL elsewhere, which is a request addressed to a proxy", certainty: "strong" });
+      }
+      if (DOUBLE_ENCODED.test(raw)) {
+        findings.push({ what: "encoded its own encoding, so one round of decoding leaves it still encoded", certainty: "strong" });
+      }
+      if (ENCODED_CONTROL.test(raw)) {
+        findings.push({ what: "carried a control character in the target", certainty: "strong" });
+      }
+      if (TRAVERSAL.test(raw)) {
+        if (ENCODED_SEPARATOR.test(raw)) {
+          findings.push({ what: "spelled the dots and slashes of a directory traversal in percent-encoding", certainty: "strong" });
+        } else if (reportPlain) {
+          findings.push({ what: "walked up out of the site root", certainty: "moderate" });
+        }
+      } else if (ENCODED_SLASH.test(raw)) {
+        findings.push({ what: "hid a path separator inside a segment by encoding it", certainty: "moderate" });
+      }
+      if (findings.length === 0) return void 0;
+      const certainty = findings.some((finding) => finding.certainty === "strong") ? "strong" : "moderate";
+      const what = findings.map((finding) => finding.what);
+      const listed = what.length === 1 ? what[0] : `${what.slice(0, -1).join(", ")}, and ${what[what.length - 1]}`;
+      return {
+        detector: "target-integrity",
+        summary: `The request target ${listed}`,
+        direction: "bot",
+        certainty,
+        botClass: "scanner",
+        // One act, however many ways it shows. A traversal is usually encoded and an
+        // encoded traversal is often double-encoded; compounding them would turn one
+        // request into three independent reasons to be suspicious.
+        family: "evasive-target",
+        metadata: { target: raw.length > 200 ? `${raw.slice(0, 200)}\u2026` : raw }
+      };
+    }
+  };
+}
+var ENCODED_SEPARATOR, ENCODED_SLASH, DOUBLE_ENCODED, ENCODED_CONTROL, TRAVERSAL, ABSOLUTE_FORM;
+var init_target_integrity = __esm({
+  "src/detectors/target-integrity.ts"() {
+    "use strict";
+    ENCODED_SEPARATOR = /%2e|%2f|%5c/i;
+    ENCODED_SLASH = /%2f|%5c/i;
+    DOUBLE_ENCODED = /%25[0-9a-f]{2}/i;
+    ENCODED_CONTROL = /%0[0-9a-f]|%1[0-9a-f]|%7f/i;
+    TRAVERSAL = /\.\.|%2e%2e|%2e\.|\.%2e/i;
+    ABSOLUTE_FORM = /^[a-z][a-z0-9+.-]*:\/\//i;
+  }
+});
+
 // src/detectors/rate-anomaly.ts
 function rateAnomalyDetector(options = {}) {
   const windowMs = options.windowMs ?? 1e4;
@@ -3733,7 +4867,10 @@ function submittedFields(extra) {
   const source = extra?.[TRAP_FIELD_SOURCE];
   return typeof source === "object" && source !== null ? source : void 0;
 }
-function renderTrapLink(path, options = {}) {
+function renderTrapLink(path = DEFAULT_TRAP_PATHS[0], options = {}) {
+  if (!path.startsWith("/")) {
+    throw new TypeError(`A trap path must begin with "/" \u2014 it is matched against the request path. Received: ${JSON.stringify(path.slice(0, 60))}`);
+  }
   const label = escapeHtml2(options.label ?? "Archive index");
   const href = escapeHtml2(path);
   return `<a href="${href}" rel="nofollow noindex" aria-hidden="true" tabindex="-1" style="position:absolute;left:-10000px;top:auto;width:1px;height:1px;overflow:hidden">${label}</a>`;
@@ -4154,20 +5291,26 @@ function defaultDetectors(options = {}) {
     // Identity first: a self-declaration or a verified crawler settles the question
     // outright, and the engine can then skip everything that would only add nuance.
     selfIdentifiedDetector(),
+    blendedIdentityDetector(),
     trapDetector(),
     ipIntelligenceDetector(),
     probeSignatureDetector(),
+    targetIntegrityDetector(),
     // Single-request consistency.
     headerIntegrityDetector(),
     uaCoherenceDetector(),
     clientHintsDetector(),
     fetchMetadataDetector(),
     acceptSignatureDetector(),
+    transportCoherenceDetector(),
     headerOrderDetector(),
     // Behaviour across requests.
     rateAnomalyDetector(),
     cadenceDetector(),
     crawlBreadthDetector(),
+    parameterSweepDetector(),
+    probeVolumeDetector(),
+    idEnumerationDetector(),
     sessionIntegrityDetector(),
     // The other side of the argument: what a real browsing session looks like.
     browsingCoherenceDetector(),
@@ -4183,12 +5326,18 @@ var init_detectors = __esm({
     init_cadence();
     init_client_hints();
     init_crawl_breadth();
+    init_parameter_sweep();
+    init_transport_coherence();
+    init_probe_volume();
+    init_id_enumeration();
+    init_blended_identity();
     init_crawler_verification();
     init_fetch_metadata();
     init_header_integrity();
     init_header_order();
     init_ip_intelligence();
     init_probe_signature();
+    init_target_integrity();
     init_rate_anomaly();
     init_self_identified();
     init_session_integrity();
@@ -4205,6 +5354,15 @@ var init_detectors = __esm({
     init_rate_anomaly();
     init_cadence();
     init_crawl_breadth();
+    init_parameter_sweep();
+    init_transport_coherence();
+    init_probe_volume();
+    init_id_enumeration();
+    init_blended_identity();
+    init_challenge_reaction();
+    init_challenge_integrity();
+    init_site_baseline();
+    init_marker2();
     init_session_integrity();
     init_identity_rotation();
     init_trap();
@@ -4212,6 +5370,7 @@ var init_detectors = __esm({
     init_tls_fingerprint();
     init_clearance();
     init_ua_coherence();
+    init_target_integrity();
     init_probe_signature();
     init_browsing_coherence();
     init_client_signals();
@@ -4466,6 +5625,7 @@ function resolveConfig(config = {}) {
     }
     seen.add(detector.id);
   }
+  const shadowDetectors = new Set(config.shadowDetectors ?? []);
   const rules = [...config.rules ?? []];
   if (config.preset !== void 0) {
     const preset = PRESETS[config.preset];
@@ -4494,6 +5654,36 @@ function resolveConfig(config = {}) {
   if (proxyConfig.trustProxy !== true && (trustedProxies !== void 0 || proxyConfig.hops !== void 0)) {
     warnings.push("proxy.trustedProxies / proxy.hops are configured but proxy.trustProxy is not enabled, so the forwarded header is ignored and the socket address is used.");
   }
+  if (config.probe !== void 0) {
+    if (config.probe.cookieName !== void 0 && config.probe.cookieName === config.challenge?.cookieName) {
+      throw new ConfigError(
+        `probe.cookieName and challenge.cookieName are both "${config.probe.cookieName}". One would overwrite the other on every response, so clearance and the marker would each destroy the other.`
+      );
+    }
+    if (config.probe.secure === false) {
+      warnings.push(
+        "probe.secure is false, so the marker cookie will travel over plain HTTP and can be read by anything on the path. It is meant for local development; leave it unset in production."
+      );
+    }
+    if (config.probe.domain !== void 0 && config.probe.domain.startsWith(".") === false && config.probe.domain.includes(".") === false) {
+      warnings.push(`probe.domain is "${config.probe.domain}", which is not a domain a browser will accept, so the marker will never be stored or returned.`);
+    }
+    if (config.probe.ttlMs !== void 0 && config.probe.ttlMs < 6e4) {
+      warnings.push(
+        `probe.ttlMs is ${config.probe.ttlMs}ms. A marker that expires within a minute is re-issued on almost every request, which makes responses uncacheable and leaves nothing long enough to correlate.`
+      );
+    }
+  }
+  if (config.site !== void 0 && config.site.warmupRequests !== void 0 && config.site.warmupRequests < 500) {
+    warnings.push(
+      `site.warmupRequests is ${config.site.warmupRequests}. A baseline drawn from so little traffic is not one \u2014 every path is rare when nothing has been seen \u2014 so the site detectors will report ordinary visitors until real traffic arrives.`
+    );
+  }
+  if (config.actorKey === void 0 && detectors.some((detector) => detector.id === "identity-rotation")) {
+    warnings.push(
+      "identity-rotation is enabled while `actorKey` is left as the client address, so one actor means one address. A NAT gateway \u2014 an office, a campus, a mobile carrier \u2014 presents many people's browsers under a single address, which is this detector's exact signature and is entirely innocent. Give `actorKey` something narrower than an address (a session cookie, an authenticated user id, or an address combined with a TLS fingerprint), or take the detector out."
+    );
+  }
   const strictEvidence = config.strictEvidence ?? process.env["NODE_ENV"] !== "production";
   const falsePositivePolicy = config.falsePositivePolicy ?? "strict";
   if (falsePositivePolicy === "aggressive") {
@@ -4508,6 +5698,7 @@ function resolveConfig(config = {}) {
   }
   return {
     detectors,
+    shadowDetectors,
     rules,
     ranges,
     signatures,
@@ -4545,11 +5736,11 @@ function clamp(value, min, max) {
   return Math.min(max, Math.max(min, value));
 }
 function resolveClientIp(socketAddress, headers, proxy) {
-  const direct = socketAddress !== void 0 ? normalizeIp(socketAddress) ?? socketAddress : "";
+  const direct = socketAddress !== void 0 ? normalizeIp(stripPort(socketAddress)) ?? socketAddress : "";
   if (!proxy.trustProxy) return direct;
   const header = headers[proxy.header];
   if (header === void 0) return direct;
-  const chain = header.slice(0, 2048).split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0 && parseIp(entry) !== null).map((entry) => normalizeIp(entry));
+  const chain = header.slice(0, 2048).split(",").map((entry) => stripPort(entry)).filter((entry) => entry.length > 0 && parseIp(entry) !== null).map((entry) => normalizeIp(entry));
   if (chain.length === 0) return direct;
   if (proxy.trustedProxies) {
     if (direct !== "" && !proxy.trustedProxies.contains(direct)) return direct;
@@ -4782,11 +5973,15 @@ var init_feed = __esm({
           certain: assessment.certain,
           durationMs: Number(assessment.durationMs.toFixed(3)),
           bypass: assessment.bypass,
-          evidence: [...assessment.evidence, ...assessment.humanEvidence].map((item) => ({
+          // Shadowed findings ride in the same list, flagged. They belong on the same screen
+          // as the evidence that did decide — the comparison is the point — and the flag is
+          // what stops the page, and `previewAssessment`, from treating them as such.
+          evidence: [...assessment.evidence, ...assessment.humanEvidence, ...assessment.shadowEvidence].map((item) => ({
             detector: item.detector,
             summary: item.summary,
             certainty: item.certainty,
             direction: item.direction,
+            ...item.shadow === true ? { shadow: true } : {},
             family: item.family,
             deterministicBasis: item.deterministicBasis,
             identity: item.identity,
@@ -4795,6 +5990,7 @@ var init_feed = __esm({
             category: typeof item.metadata?.["category"] === "string" ? item.metadata["category"] : void 0,
             weight: item.weight
           })),
+          ...assessment.shadowVerdict === void 0 ? {} : { shadowVerdict: assessment.shadowVerdict },
           failures: assessment.failures.map((failure) => ({ detector: failure.detector, reason: failure.reason, message: failure.message })),
           actorStats: {
             requests: assessment.actor.requests,
@@ -5004,6 +6200,7 @@ function isDenial(action) {
 function assessmentFromEntry(entry) {
   const evidence2 = [];
   const humanEvidence = [];
+  const shadowEvidence = [];
   for (const item of entry.evidence) {
     const rebuilt = {
       detector: item.detector,
@@ -5014,9 +6211,11 @@ function assessmentFromEntry(entry) {
       ...item.identity !== void 0 ? { identity: item.identity } : {},
       ...item.family !== void 0 ? { family: item.family } : {},
       // `category` is read off metadata by the matcher, so it has to go back there.
-      ...item.category !== void 0 ? { metadata: { category: item.category } } : {}
+      ...item.category !== void 0 ? { metadata: { category: item.category } } : {},
+      ...item.shadow === true ? { shadow: true } : {}
     };
-    (item.direction === "human" ? humanEvidence : evidence2).push(rebuilt);
+    if (item.shadow === true) shadowEvidence.push(rebuilt);
+    else (item.direction === "human" ? humanEvidence : evidence2).push(rebuilt);
   }
   return {
     requestId: entry.requestId,
@@ -5028,10 +6227,17 @@ function assessmentFromEntry(entry) {
     certain: entry.certain,
     evidence: evidence2,
     humanEvidence,
+    shadowEvidence,
+    ...entry.shadowVerdict === void 0 ? {} : { shadowVerdict: entry.shadowVerdict },
     actor: {
       key: entry.actor,
       requests: entry.actorStats.requests,
       distinctPaths: entry.actorStats.distinctPaths,
+      distinctQueries: 0,
+      queriesSaturated: false,
+      methodsSeen: ["GET"],
+      responses: 0,
+      misses: 0,
       firstSeen: entry.actorStats.firstSeen,
       lastSeen: entry.at,
       ...entry.actorStats.sinceLastMs !== void 0 ? { sinceLastMs: entry.actorStats.sinceLastMs } : {},
@@ -5080,7 +6286,7 @@ var CLIENT_SCRIPT;
 var init_client_generated = __esm({
   "src/dashboard/client.generated.ts"() {
     "use strict";
-    CLIENT_SCRIPT = '"use strict";\n(() => {\n  // src/dashboard/client/css.ts\n  function cssEscape(value) {\n    return typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(value) : String(value).replace(/[^\\w-]/g, "\\\\$&");\n  }\n\n  // src/dashboard/client/dom.ts\n  function el(tag, className, value) {\n    const node = document.createElement(tag);\n    if (className !== void 0 && className !== null && className !== "") node.className = className;\n    if (value !== void 0 && value !== null) node.textContent = String(value);\n    return node;\n  }\n  function svgEl(name, attributes = {}) {\n    const node = document.createElementNS("http://www.w3.org/2000/svg", name);\n    for (const [key, value] of Object.entries(attributes)) node.setAttribute(key, String(value));\n    return node;\n  }\n  function svgText(attributes, text) {\n    const node = svgEl("text", attributes);\n    node.textContent = String(text);\n    return node;\n  }\n  function clear(node) {\n    while (node.firstChild) node.removeChild(node.firstChild);\n  }\n  var root = typeof document === "undefined" ? void 0 : document;\n  var themeHost = typeof document === "undefined" ? void 0 : document.documentElement;\n  var embedded = false;\n  function isEmbedded() {\n    return embedded;\n  }\n  function eventTarget() {\n    return embedded ? root : globalThis;\n  }\n  function rootNode() {\n    return root;\n  }\n  function themeElement() {\n    return themeHost;\n  }\n  function $(id) {\n    const node = root.querySelector(`#${cssEscape(id)}`);\n    if (node === null || node === void 0) throw new Error(`dashboard: no element #${id}`);\n    return node;\n  }\n  function byId(id) {\n    return $(id);\n  }\n  function css(name) {\n    return getComputedStyle(themeHost).getPropertyValue(name).trim();\n  }\n  var sequence = 0;\n  function label(text, control) {\n    const node = document.createElement("label");\n    node.textContent = text;\n    const single = Array.isArray(control) ? control.length === 1 ? control[0] : void 0 : control;\n    if (single !== void 0 && /^(input|select|textarea)$/i.test(single.tagName)) {\n      if (single.id === "") single.id = `field-${++sequence}`;\n      node.htmlFor = single.id;\n    } else {\n      const group = Array.isArray(control) ? control : [control];\n      for (const node_ of group) if (!node_.hasAttribute("aria-label")) node_.setAttribute("aria-label", text);\n    }\n    return node;\n  }\n\n  // src/dashboard/client/boot.ts\n  var raw = globalThis.__BOOTSTRAP__;\n  var BOOT = raw ?? {\n    base: "",\n    title: "bothandlerjs",\n    allowReset: false,\n    allowEdit: false,\n    allowGuardEdit: false,\n    allowActing: false,\n    peers: [],\n    sections: { feed: true, evidence: true, actors: true, registry: true, tester: true, statistics: true, audit: true, notices: true, changes: true, policy: true, guard: true, robots: true, ranges: true },\n    links: []\n  };\n  var API = BOOT.base;\n  var SECTIONS = BOOT.sections;\n\n  // src/dashboard/client/app.ts\n  var app = {\n    draw: () => {\n    },\n    drawNow: () => {\n    },\n    showTab: () => {\n    },\n    syncUrl: () => {\n    }\n  };\n  function toast(kind, title, detail = "") {\n    const node = el("div", `toast ${kind}`);\n    node.appendChild(el("b", null, title));\n    if (detail !== "") node.appendChild(el("span", null, detail));\n    const host = rootNode().querySelector("#toasts");\n    if (host === null) return;\n    host.appendChild(node);\n    setTimeout(() => node.remove(), 6e3);\n  }\n  function download(text, filename, type) {\n    const blob = new Blob([text], { type });\n    const url = URL.createObjectURL(blob);\n    const anchor = el("a");\n    anchor.href = url;\n    anchor.download = filename;\n    anchor.click();\n    setTimeout(() => URL.revokeObjectURL(url), 1e3);\n  }\n  function today() {\n    return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);\n  }\n\n  // src/dashboard/client/outcome.ts\n  var DENY = /* @__PURE__ */ new Set(["block", "drop", "redirect"]);\n  var MITIGATE = /* @__PURE__ */ new Set(["challenge", "rate-limit", "delay"]);\n  function outcome(entry) {\n    return actionKind(entry.action);\n  }\n  function actionKind(action) {\n    if (action === void 0) return "pending";\n    if (DENY.has(action)) return "deny";\n    if (MITIGATE.has(action)) return "mitigate";\n    return "allow";\n  }\n  function verdictBadge(entry) {\n    if (entry.verdict === "verified-bot" || entry.verdict === "confirmed-bot") return ["b-proven", entry.verdict];\n    if (entry.verdict === "suspected-bot") return ["b-suspected", "suspected-bot"];\n    if (entry.verdict === "human") return ["b-human", "human"];\n    return ["b-unknown", entry.bypass !== void 0 ? `skipped \xB7 ${entry.bypass}` : "unknown"];\n  }\n  function provenBots(verdicts) {\n    return (verdicts["confirmed-bot"] ?? 0) + (verdicts["verified-bot"] ?? 0);\n  }\n\n  // src/dashboard/client/query.ts\n  var FIELDS = {\n    path: "path",\n    url: "path",\n    actor: "actor",\n    ip: "actor",\n    ua: "userAgent",\n    useragent: "userAgent",\n    agent: "userAgent",\n    verdict: "verdict",\n    action: "action",\n    rule: "rule",\n    detector: "detector",\n    identity: "identity",\n    method: "method",\n    class: "botClass",\n    botclass: "botClass",\n    id: "requestId",\n    request: "requestId",\n    bypass: "bypass",\n    score: "score",\n    outcome: "outcome",\n    certain: "certain"\n  };\n  var NUMERIC = /* @__PURE__ */ new Set(["score"]);\n  function tokenize(input) {\n    const tokens = [];\n    let current = "";\n    let quoted = false;\n    for (const character of input) {\n      if (character === \'"\') {\n        quoted = !quoted;\n        continue;\n      }\n      if (!quoted && /\\s/.test(character)) {\n        if (current !== "") tokens.push(current);\n        current = "";\n        continue;\n      }\n      current += character;\n    }\n    if (current !== "") tokens.push(current);\n    return tokens;\n  }\n  function parseQuery(input) {\n    const terms = [];\n    for (const token of tokenize(input.trim())) {\n      const negated = token.startsWith("-") || token.startsWith("!");\n      const body = negated ? token.slice(1) : token;\n      if (body === "") continue;\n      const colon = body.indexOf(":");\n      const name = colon === -1 ? "" : body.slice(0, colon).toLowerCase();\n      const field2 = FIELDS[name];\n      if (colon === -1 || field2 === void 0) {\n        terms.push({ field: void 0, value: body.toLowerCase(), negated });\n        continue;\n      }\n      let value = body.slice(colon + 1).toLowerCase();\n      let compare;\n      if (NUMERIC.has(field2)) {\n        compare = value.startsWith(">") ? ">" : value.startsWith("<") ? "<" : "=";\n        if (compare !== "=") value = value.slice(1);\n      }\n      if (value === "") continue;\n      terms.push({ field: field2, value, negated, compare });\n    }\n    return terms;\n  }\n  function searchableText(entry) {\n    const parts = [\n      entry.method,\n      entry.path,\n      entry.actor,\n      entry.userAgent,\n      entry.verdict,\n      entry.botClass,\n      entry.identity ?? "",\n      entry.action ?? "",\n      entry.rule ?? "",\n      entry.requestId\n    ];\n    for (const item of entry.evidence) parts.push(item.detector, item.summary);\n    return parts.join(" ").toLowerCase();\n  }\n  function fieldValue(entry, field2) {\n    switch (field2) {\n      case "path":\n        return entry.path;\n      case "actor":\n        return entry.actor;\n      case "userAgent":\n        return entry.userAgent;\n      case "verdict":\n        return entry.verdict;\n      case "action":\n        return entry.action ?? "";\n      case "rule":\n        return entry.rule ?? "";\n      case "identity":\n        return entry.identity ?? "";\n      case "method":\n        return entry.method;\n      case "botClass":\n        return entry.botClass;\n      case "requestId":\n        return entry.requestId;\n      case "bypass":\n        return entry.bypass ?? "";\n      case "outcome":\n        return outcome(entry);\n      case "certain":\n        return String(entry.certain);\n      case "detector":\n        return entry.evidence.map((item) => item.detector).join(" ");\n      default:\n        return "";\n    }\n  }\n  function matchesTerm(term, entry, haystack) {\n    if (term.field === void 0) return haystack.includes(term.value);\n    if (term.field === "score") {\n      const wanted = Number(term.value);\n      if (Number.isNaN(wanted)) return false;\n      if (term.compare === ">") return entry.score > wanted;\n      if (term.compare === "<") return entry.score < wanted;\n      return entry.score === wanted;\n    }\n    return fieldValue(entry, term.field).toLowerCase().includes(term.value);\n  }\n  function matchesQuery(terms, entry, haystack) {\n    for (const term of terms) {\n      if (matchesTerm(term, entry, haystack) === term.negated) return false;\n    }\n    return true;\n  }\n  function matchesFilter(filter, entry) {\n    switch (filter) {\n      case "proven":\n        return entry.certain;\n      case "suspected":\n        return entry.verdict === "suspected-bot";\n      case "human":\n        return entry.verdict === "human";\n      case "guard":\n        return entry.downgradedFrom !== void 0;\n      case "deny":\n        return outcome(entry) === "deny";\n      case "mitigate":\n        return outcome(entry) === "mitigate";\n      case "allow":\n        return outcome(entry) === "allow";\n      default:\n        return true;\n    }\n  }\n\n  // src/dashboard/client/store.ts\n  var MAX_ROWS = 1e3;\n  var state = {\n    rows: [],\n    byId: /* @__PURE__ */ new Map(),\n    snapshot: void 0,\n    policy: void 0,\n    actors: [],\n    actorsTracked: 0,\n    paused: false,\n    filter: "all",\n    search: "",\n    terms: [],\n    tab: "live",\n    open: /* @__PURE__ */ new Set(),\n    actor: void 0,\n    rangeMs: 3e5,\n    scoreScope: "run",\n    editorRules: [],\n    editorDirty: false,\n    editorMode: "gui",\n    guardDirty: false,\n    bufferedWhilePaused: 0,\n    laggedDrops: 0,\n    feedPage: 0,\n    feedFrozen: void 0,\n    actorsPage: 0,\n    feedPageSize: 50,\n    actorsPageSize: 25,\n    caughtUp: 0\n  };\n  function ingest(entry) {\n    const existing = state.byId.get(entry.requestId);\n    if (existing !== void 0) {\n      existing.entry = entry;\n      existing.rev++;\n      existing.text = void 0;\n      return;\n    }\n    const row = { entry, rev: 0 };\n    state.byId.set(entry.requestId, row);\n    state.rows.push(row);\n    if (state.rows.length > MAX_ROWS) {\n      for (const dropped of state.rows.splice(0, state.rows.length - MAX_ROWS)) {\n        state.byId.delete(dropped.entry.requestId);\n        state.open.delete(dropped.entry.requestId);\n      }\n    }\n  }\n  function clearFeed() {\n    state.rows = [];\n    state.byId = /* @__PURE__ */ new Map();\n    state.open.clear();\n    state.actor = void 0;\n    state.bufferedWhilePaused = 0;\n    state.laggedDrops = 0;\n    resetPaging();\n  }\n  function setSearch(value) {\n    state.search = value;\n    state.terms = parseQuery(value);\n    resetPaging();\n  }\n  function resetPaging() {\n    state.feedPage = 0;\n    state.feedFrozen = void 0;\n  }\n  function textOf(row) {\n    if (row.text === void 0) row.text = searchableText(row.entry);\n    return row.text;\n  }\n  function sortRows() {\n    state.rows.sort((a, b) => a.entry.at - b.entry.at);\n  }\n  function matches(row) {\n    return matchesFilter(state.filter, row.entry) && matchesQuery(state.terms, row.entry, textOf(row));\n  }\n  function matchingRows(limit = Number.POSITIVE_INFINITY) {\n    const shown = [];\n    for (let i = state.rows.length - 1; i >= 0 && shown.length < limit; i--) {\n      const row = state.rows[i];\n      if (row !== void 0 && matches(row)) shown.push(row);\n    }\n    return shown;\n  }\n  function feedPage(size) {\n    const all = state.feedPage === 0 || state.feedFrozen === void 0 ? matchingRows() : state.feedFrozen;\n    const pages = Math.max(1, Math.ceil(all.length / size));\n    const page = Math.min(Math.max(0, state.feedPage), pages - 1);\n    if (page !== state.feedPage) state.feedPage = page;\n    return { rows: all.slice(page * size, page * size + size), page, pages, total: all.length };\n  }\n  function goToFeedPage(page) {\n    const next = Math.max(0, page);\n    if (next === 0) {\n      state.feedFrozen = void 0;\n    } else if (state.feedFrozen === void 0) {\n      state.feedFrozen = matchingRows();\n    }\n    state.feedPage = next;\n  }\n  function matchingCount() {\n    let count = 0;\n    for (const row of state.rows) if (matches(row)) count++;\n    return count;\n  }\n  function oldestAt() {\n    return state.rows[0]?.entry.at;\n  }\n  function bump(counter, key) {\n    counter.set(key, (counter.get(key) ?? 0) + 1);\n  }\n  function aggregate(rows) {\n    const totals = {\n      detectors: /* @__PURE__ */ new Map(),\n      actors: /* @__PURE__ */ new Map(),\n      identities: /* @__PURE__ */ new Map(),\n      paths: /* @__PURE__ */ new Map(),\n      deniedPaths: /* @__PURE__ */ new Map(),\n      guardStops: /* @__PURE__ */ new Map(),\n      ruleHits: /* @__PURE__ */ new Map(),\n      bypassed: /* @__PURE__ */ new Map()\n    };\n    for (const { entry } of rows) {\n      for (const item of entry.evidence) bump(totals.detectors, item.detector);\n      bump(totals.actors, entry.actor);\n      if (entry.bypass !== void 0) {\n        bump(totals.bypassed, `${entry.path}  (${entry.bypass})`);\n        continue;\n      }\n      bump(totals.paths, entry.path);\n      if (entry.identity !== void 0 && entry.identity !== "") {\n        bump(totals.identities, `${entry.identity} \xB7 ${entry.verdict === "verified-bot" ? "verified" : "claimed"}`);\n      }\n      if (outcome(entry) === "deny") bump(totals.deniedPaths, entry.path);\n      if (entry.downgradedFrom !== void 0 && entry.rule !== void 0) bump(totals.guardStops, `${entry.rule} \u2192 ${entry.downgradedFrom}`);\n      if (entry.rule !== void 0) bump(totals.ruleHits, entry.rule);\n    }\n    return totals;\n  }\n\n  // src/dashboard/client/api.ts\n  async function getJson(path) {\n    const response = await fetch(API + path);\n    if (!response.ok) throw new Error(await errorFrom(response));\n    return await response.json();\n  }\n  async function postJson(path, body) {\n    const response = await fetch(API + path, {\n      method: "POST",\n      headers: { "content-type": "application/json" },\n      body: JSON.stringify(body)\n    });\n    const data = await response.json().catch(() => ({}));\n    return response.ok ? { ok: true, data } : { ok: false, data, error: String(data.error ?? "The server refused this.") };\n  }\n  async function errorFrom(response) {\n    const body = await response.json().catch(() => ({}));\n    return body.error ?? `${response.status} ${response.statusText}`;\n  }\n\n  // src/dashboard/client/actions.ts\n  var armed = 0;\n  function isConfirming() {\n    return armed > 0;\n  }\n  function actorActions(key, after) {\n    if (!BOOT.allowActing) return [];\n    const forget = el("button", null, "Forget");\n    forget.title = "Discard this actor\'s history \u2014 the cure for a false positive that has stuck";\n    forget.addEventListener("click", () => {\n      void act({ key, action: "forget" }, `Forgot ${key}`, "Its next request is assessed as a first request.", after);\n    });\n    const clear2 = el("button", null, "Clear as human");\n    clear2.title = "Grant this actor human clearance for an hour, as though it had solved a challenge";\n    clear2.addEventListener("click", () => {\n      void act({ key, action: "clear", forMs: 60 * 6e4 }, `Cleared ${key}`, "Held as human for an hour, then reassessed.", after);\n    });\n    return [confirmingButton("Allowlist", `Allowlist ${key} \u2014 it stops being assessed at all`, () => allowlist(key, after)), forget, clear2];\n  }\n  function confirmingButton(label2, confirmation, run2) {\n    const button = el("button", "danger", label2);\n    let pending2 = false;\n    let timer2;\n    const disarm = () => {\n      if (!pending2) return;\n      pending2 = false;\n      armed--;\n      button.textContent = label2;\n      button.className = "danger";\n    };\n    button.addEventListener("click", () => {\n      if (pending2) {\n        if (timer2 !== void 0) clearTimeout(timer2);\n        disarm();\n        run2();\n        return;\n      }\n      pending2 = true;\n      armed++;\n      button.textContent = confirmation;\n      button.className = "danger primary";\n      timer2 = setTimeout(disarm, 5e3);\n    });\n    return button;\n  }\n  async function allowlist(key, after) {\n    const result = await postJson("/api/ranges", { name: "allowlist", add: [key] });\n    if (!result.ok) {\n      toast("bad", "Not allowlisted", result.error ?? "");\n      return;\n    }\n    toast("warn", `Allowlisted ${key}`, "Requests from it are no longer assessed at all.");\n    after();\n  }\n  async function act(body, title, detail, after) {\n    const result = await postJson("/api/actor", body);\n    if (!result.ok) {\n      toast("bad", "Refused", result.error ?? "");\n      return;\n    }\n    toast("ok", title, detail);\n    after();\n  }\n\n  // src/dashboard/client/format.ts\n  var numbers = new Intl.NumberFormat();\n  function n(value) {\n    return numbers.format(value ?? 0);\n  }\n  function pct(part, whole) {\n    return whole > 0 ? `${Math.round(part / whole * 100)}%` : "\u2014";\n  }\n  function ms(value) {\n    return value >= 10 ? `${value.toFixed(1)}ms` : `${value.toFixed(2)}ms`;\n  }\n  function uptime(milliseconds) {\n    const seconds = Math.max(0, Math.round(milliseconds / 1e3));\n    if (seconds < 90) return `${seconds}s`;\n    const minutes = Math.round(seconds / 60);\n    if (minutes < 90) return `${minutes}m`;\n    return `${Math.round(minutes / 60)}h`;\n  }\n  function rangeLabel(milliseconds) {\n    const seconds = Math.round(milliseconds / 1e3);\n    if (seconds < 90) return `${seconds}s`;\n    const minutes = Math.round(seconds / 60);\n    return minutes < 90 ? `${minutes} min` : `${Math.round(minutes / 60)}h`;\n  }\n  function clockTime(at) {\n    const when = new Date(at);\n    return `${pad(when.getHours())}:${pad(when.getMinutes())}:${pad(when.getSeconds())}`;\n  }\n  function clockDate(at) {\n    const when = new Date(at);\n    return `${pad(when.getDate())}-${pad(when.getMonth() + 1)}-${when.getFullYear()}`;\n  }\n  function clockStamp(at) {\n    return `${clockDate(at)} ${clockTime(at)}`;\n  }\n  function pad(value) {\n    return String(value).padStart(2, "0");\n  }\n  function windowLabel(count, oldestAt2, now) {\n    if (count === 0) return "this window \xB7 empty";\n    const span = oldestAt2 === void 0 ? 0 : Math.max(0, now - oldestAt2);\n    return `last ${n(count)} requests \xB7 ${rangeLabel(span)}`;\n  }\n\n  // src/dashboard/client/bars.ts\n  function drawBars(target, rows, emptyText) {\n    clear(target);\n    const filtered = [...rows].filter(([, value]) => value > 0);\n    if (filtered.length === 0) {\n      target.appendChild(el("div", "note", emptyText));\n      return;\n    }\n    filtered.sort((a, b) => b[1] - a[1]);\n    const max = filtered[0]?.[1] ?? 1;\n    for (const [label2, value] of filtered.slice(0, 14)) {\n      const bar = el("div", "bar");\n      const track = el("div", "track");\n      const fill = el("div", "fill");\n      fill.style.width = `${Math.max(2, Math.round(value / max * 100))}%`;\n      track.appendChild(fill);\n      track.appendChild(el("div", "lbl", label2));\n      bar.appendChild(track);\n      bar.appendChild(el("div", "v tnum", n(value)));\n      target.appendChild(bar);\n    }\n  }\n  function pairs(record) {\n    return Object.entries(record ?? {});\n  }\n\n  // src/dashboard/client/actor.ts\n  function initActor() {\n    if (!SECTIONS.actors) return;\n    $("actor-close").addEventListener("click", closeActor);\n  }\n  function openActor(key) {\n    state.actor = key;\n    app.drawNow();\n    $("actor-panel").scrollIntoView({ block: "nearest" });\n  }\n  function closeActor() {\n    state.actor = void 0;\n    app.drawNow();\n  }\n  function drawActor() {\n    if (!SECTIONS.actors) return;\n    const panel = $("actor-panel");\n    if (state.actor === void 0) {\n      panel.hidden = true;\n      return;\n    }\n    panel.hidden = false;\n    $("actor-key").textContent = state.actor;\n    const mine = state.rows.filter((row) => row.entry.actor === state.actor).map((row) => row.entry);\n    const latest = mine[mine.length - 1];\n    const stats = latest?.actorStats;\n    const gaps = [];\n    for (let i = 1; i < mine.length; i++) gaps.push(mine[i].at - mine[i - 1].at);\n    const meanGap = gaps.length > 0 ? gaps.reduce((a, b) => a + b, 0) / gaps.length : 0;\n    const box = $("actor-stats");\n    clear(box);\n    const rows = [\n      ["In this window", `${n(mine.length)} requests`],\n      ["Engine sees", stats !== void 0 ? `${n(stats.requests)} requests, ${n(stats.distinctPaths)} distinct paths` : "\u2014"],\n      ["Prior confirmations", stats !== void 0 ? n(stats.priorConfirmations) : "\u2014"],\n      ["Holds clearance", stats !== void 0 ? stats.cleared ? "yes" : "no" : "\u2014"],\n      ["First seen", stats !== void 0 ? clockStamp(stats.firstSeen) : "\u2014"],\n      ["Mean gap", gaps.length > 0 ? `${Math.round(meanGap)}ms over ${n(gaps.length)} gaps` : "one request only"]\n    ];\n    for (const [key, value] of rows) {\n      box.appendChild(el("dt", null, key));\n      box.appendChild(el("dd", null, value));\n    }\n    const verdicts = /* @__PURE__ */ new Map();\n    const actions = /* @__PURE__ */ new Map();\n    for (const entry of mine) {\n      verdicts.set(entry.verdict, (verdicts.get(entry.verdict) ?? 0) + 1);\n      if (entry.action !== void 0) actions.set(entry.action, (actions.get(entry.action) ?? 0) + 1);\n    }\n    drawBars($("actor-mix"), [...verdicts, ...actions], "Nothing yet.");\n    const bar = $("actor-actions");\n    clear(bar);\n    const buttons = actorActions(state.actor, () => app.drawNow());\n    bar.hidden = buttons.length === 0;\n    for (const button of buttons) bar.appendChild(button);\n  }\n\n  // src/dashboard/client/pager.ts\n  var painted = /* @__PURE__ */ new WeakMap();\n  function renderPager(host, model, options) {\n    const signature = JSON.stringify([model.page, model.from, model.to, model.total, model.atStart, model.atEnd, model.held ?? "", options.withSize, model.size?.current]);\n    if (painted.get(host) === signature && host.childElementCount > 0) return;\n    painted.set(host, signature);\n    clear(host);\n    const steps = [\n      { to: model.page - 1, glyph: "\u2039", label: "Previous page", disabled: model.atStart },\n      { to: model.page + 1, glyph: "\u203A", label: "Next page", disabled: model.atEnd }\n    ];\n    const [previous, next] = steps;\n    host.appendChild(stepButton(previous, model));\n    const range = model.total === void 0 ? `${n(model.from)}\u2013${n(model.to)}` : `${n(model.from)}\u2013${n(model.to)} of ${n(model.total)}`;\n    const where = el("span", "where", range);\n    where.setAttribute("aria-live", "polite");\n    host.appendChild(where);\n    host.appendChild(stepButton(next, model));\n    if (model.held !== void 0) {\n      const held = el("span", "held", model.held);\n      held.title = "New requests are still arriving and are still counted. They appear when you return to the first page.";\n      host.appendChild(held);\n    }\n    if (options.withSize && model.size !== void 0) {\n      const size = model.size;\n      const label2 = el("label", "size");\n      label2.appendChild(document.createTextNode("Per page"));\n      const select2 = document.createElement("select");\n      for (const choice of size.choices) {\n        const option = document.createElement("option");\n        option.value = String(choice);\n        option.textContent = String(choice);\n        option.selected = choice === size.current;\n        select2.appendChild(option);\n      }\n      select2.addEventListener("change", () => {\n        const chosen = Number(select2.value);\n        if (Number.isFinite(chosen) && chosen > 0) size.set(chosen);\n      });\n      label2.appendChild(select2);\n      host.appendChild(label2);\n    }\n  }\n  function stepButton(step, model) {\n    const button = el("button", "step", step.glyph);\n    const element = button;\n    element.type = "button";\n    element.disabled = step.disabled;\n    button.setAttribute("aria-label", step.label);\n    button.title = step.label;\n    button.addEventListener("click", () => model.go(Math.max(0, step.to)));\n    return button;\n  }\n\n  // src/dashboard/client/replay.ts\n  function replayLine(entry) {\n    const headers = {};\n    for (const [name, value] of entry.headers ?? []) headers[name] = value;\n    const query = Object.keys(entry.query).map((name) => `${encodeURIComponent(name)}=${encodeURIComponent(entry.query[name] ?? "")}`).join("&");\n    return JSON.stringify({\n      method: entry.method,\n      url: entry.path + (query === "" ? "" : `?${query}`),\n      headers,\n      ip: entry.actor,\n      timestamp: new Date(entry.at).toISOString(),\n      protocol: entry.protocol ?? "https",\n      httpVersion: entry.httpVersion ?? "1.1"\n    });\n  }\n  function replayFile(entries) {\n    return entries.map(replayLine).join("\\n");\n  }\n  function corpusCase(entry) {\n    const headers = (entry.headers ?? []).map((pair) => `        [${JSON.stringify(pair[0])}, ${JSON.stringify(pair[1])}]`).join(",\\n");\n    return [\n      "bot({",\n      `  id: ${JSON.stringify(`case-${entry.requestId.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`)},`,\n      `  title: ${JSON.stringify(`${entry.method} ${entry.path} from ${entry.userAgent.slice(0, 60)}`)},`,\n      \'  audience: "unwanted-bot",   // human | benign-bot | declared-bot | unwanted-bot | hostile | infrastructure\',\n      \'  category: "observed",\',\n      `  provenance: "Captured from the live dashboard on ${new Date(entry.at).toISOString().slice(0, 10)}",`,\n      "  requests: [",\n      "    {",\n      "      headers: [",\n      headers,\n      "      ],",\n      `      protocol: ${JSON.stringify(entry.protocol ?? "https")},`,\n      `      httpVersion: ${JSON.stringify(entry.httpVersion ?? "1.1")},`,\n      `      path: ${JSON.stringify(entry.path)},`,\n      "    },",\n      "  ],",\n      `  expect: { verdict: ${JSON.stringify(entry.verdict)}, certain: ${String(entry.certain)} },`,\n      "}),"\n    ].join("\\n");\n  }\n\n  // src/dashboard/client/result.ts\n  function showResult(kind, build) {\n    const box = $("policy-result");\n    box.hidden = false;\n    box.className = `result ${kind}`;\n    clear(box);\n    build(box);\n  }\n  function renderPreview(preview, notes = []) {\n    showResult(preview.newDenials > 0 ? "warn" : "ok", (box) => {\n      const head = el("div");\n      head.appendChild(el("b", null, `${n(preview.changed)} of ${n(preview.evaluated)} requests would be treated differently.`));\n      box.appendChild(head);\n      for (const note of notes) box.appendChild(el("div", "ev-meta", note));\n      if (preview.newDenials > 0) {\n        box.appendChild(el("div", null, `${n(preview.newDenials)} request(s) that are served today would be denied. Read the samples before applying this.`));\n      }\n      for (const warning of preview.warnings) box.appendChild(el("div", "ev-meta", warning));\n      const dead = preview.ruleHits.filter((row) => row.hits === 0 && row.rule !== "default");\n      if (dead.length > 0) box.appendChild(el("div", "ev-meta", `Never matched in this window: ${dead.map((row) => row.rule).join(", ")}`));\n      if (preview.samples.length > 0) {\n        const table = el("table", "diff");\n        const head2 = el("tr");\n        for (const label2 of ["Request", "Now", "Would be"]) head2.appendChild(el("th", null, label2));\n        table.appendChild(head2);\n        for (const sample of preview.samples) {\n          const row = el("tr");\n          const what = el("td");\n          what.appendChild(el("div", "mono", sample.path));\n          what.appendChild(el("div", "ev-meta", `${sample.verdict} \xB7 ${sample.userAgent.slice(0, 48)}`));\n          row.appendChild(what);\n          const from = el("td", "from");\n          from.appendChild(el("div", null, sample.from));\n          from.appendChild(el("div", "ev-meta", sample.fromRule));\n          row.appendChild(from);\n          const kind = sample.to === "block" || sample.to === "drop" || sample.to === "redirect" ? "deny" : sample.to === "allow" ? "allow" : "";\n          const to = el("td", `to ${kind}`);\n          to.appendChild(el("div", null, sample.to));\n          to.appendChild(el("div", "ev-meta", sample.toRule));\n          row.appendChild(to);\n          table.appendChild(row);\n        }\n        box.appendChild(table);\n      } else if (preview.evaluated === 0) {\n        box.appendChild(el("div", "ev-meta", "No traffic in the window to preview against \u2014 send some requests first."));\n      }\n    });\n  }\n\n  // src/dashboard/client/guard.ts\n  var draft;\n  var MODE_NOTES = {\n    strict: "A terminal action survives only on proven evidence. Nothing is ever denied on a guess. This is the default, and it is the claim this library makes about itself.",\n    balanced: "A terminal action also survives on a probabilistic verdict that clears the score threshold with at least two independent strong signals. Real people do trip two signals \u2014 a hardened browser behind a corporate proxy is the usual pair \u2014 so this setting will eventually deny somebody who should have been served.",\n    aggressive: "The guard is off. Every rule does exactly what it says, on proof or on suspicion alike, and the people it turns away first are the ones with the most unusual and most legitimate setups."\n  };\n  function drawGuard() {\n    if (!SECTIONS.guard) return;\n    const document_ = state.policy;\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    const editable = document_?.guardEditable === true;\n    const panel = $("stat-policy");\n    clear(panel);\n    if (!editable || document_ === void 0) {\n      const rows = [\n        ["False-positive policy", snapshot.policy.falsePositivePolicy],\n        ["Fallback when the guard stops a rule", snapshot.policy.fallbackAction],\n        ["Terminal score threshold", String(snapshot.policy.terminalScoreThreshold)],\n        ["Suspect threshold", String(snapshot.policy.suspectThreshold)],\n        ["Action when no rule matches", snapshot.policy.defaultAction],\n        ["Challenge configured", snapshot.policy.challengeEnabled ? "yes" : "no"],\n        ["Range sets", snapshot.ranges.length === 0 ? "none" : snapshot.ranges.map((range) => `${range.name} (${range.size})`).join(", ")]\n      ];\n      for (const [key, value] of rows) {\n        const line = el("div", "stat-row");\n        line.appendChild(el("span", "k", key));\n        line.appendChild(el("span", "v", value));\n        panel.appendChild(line);\n      }\n      $("guard-mode").textContent = "not editable here";\n      $("guard-note").textContent = "These are fixed at construction on this dashboard. It can change which rules exist; it cannot change how far a rule is allowed to go, because relaxing that is the one edit that can start denying people. Enable it deliberately with controls: { editGuard: true }.";\n      return;\n    }\n    if (draft === void 0) draft = { ...document_.guard };\n    const vocabulary = document_.vocabulary;\n    $("guard-mode").textContent = state.guardDirty ? "unsaved changes" : "editable";\n    $("guard-note").textContent = "Changing these changes what every rule is allowed to do, on the next request. Preview it against the traffic in the window first \u2014 that is the only view you get of who it would start turning away.";\n    panel.appendChild(\n      guardField(\n        // "Mode" rather than "Guard": the panel is already called that, and a field\n        // repeating its own panel\'s name reads as a heading rather than as a control.\n        "Mode",\n        segmented(\n          vocabulary.falsePositivePolicies.map((mode) => [mode, mode]),\n          draft.falsePositivePolicy,\n          (value) => {\n            setDraft({ falsePositivePolicy: value });\n            drawGuard();\n          }\n        )\n      )\n    );\n    panel.appendChild(el("div", "note guard-explains", MODE_NOTES[draft.falsePositivePolicy] ?? ""));\n    panel.appendChild(\n      guardField(\n        "Fallback",\n        select(vocabulary.fallbackActions, draft.fallbackAction, (value) => setDraft({ fallbackAction: value })),\n        "what a stopped rule becomes \u2014 the terminal actions are absent because a terminal fallback would deny the request the guard just protected"\n      )\n    );\n    panel.appendChild(\n      guardField(\n        "Default action",\n        select(vocabulary.actions, draft.defaultAction, (value) => setDraft({ defaultAction: value })),\n        "when no rule matches"\n      )\n    );\n    panel.appendChild(\n      guardField(\n        "Terminal score",\n        number(draft.terminalScoreThreshold, (value) => setDraft({ terminalScoreThreshold: value })),\n        "balanced mode only: the score a probabilistic verdict must clear"\n      )\n    );\n    panel.appendChild(\n      guardField(\n        "Suspect at",\n        number(draft.suspectThreshold, (value) => setDraft({ suspectThreshold: value })),\n        "the score at which a request becomes suspected-bot"\n      )\n    );\n    const bar = el("div", "bar-actions");\n    const preview = el("button", null, "Preview");\n    preview.addEventListener("click", () => {\n      void previewGuard();\n    });\n    const apply = el("button", "primary", "Apply");\n    apply.addEventListener("click", () => {\n      void applyGuard();\n    });\n    const revert = el("button", null, "Revert");\n    revert.addEventListener("click", () => {\n      draft = { ...document_.guard };\n      state.guardDirty = false;\n      drawGuard();\n    });\n    bar.appendChild(preview);\n    bar.appendChild(apply);\n    bar.appendChild(revert);\n    panel.appendChild(bar);\n  }\n  function setDraft(change) {\n    if (draft === void 0) return;\n    draft = { ...draft, ...change };\n    state.guardDirty = true;\n    $("guard-mode").textContent = "unsaved changes";\n  }\n  function resetGuardDraft() {\n    draft = void 0;\n    state.guardDirty = false;\n  }\n  function liveRules() {\n    return (state.policy?.rules ?? []).filter((row) => row.editable && row.rule !== void 0).map((row) => row.rule);\n  }\n  async function previewGuard() {\n    if (draft === void 0) return;\n    const result = await postJson("/api/policy/preview", { rules: liveRules(), guard: draft });\n    if (!result.ok) {\n      showResult("bad", (box) => box.appendChild(el("div", null, result.error ?? "")));\n      toast("bad", "Refused", result.error ?? "");\n      return;\n    }\n    renderPreview(result.data, state.editorDirty ? ["Previewed against the rules currently in force, not the unsaved edits in the editor."] : []);\n    app.showTab("policy");\n  }\n  async function applyGuard() {\n    if (draft === void 0) return;\n    const result = await postJson("/api/guard", draft);\n    if (!result.ok) {\n      showResult("bad", (box) => box.appendChild(el("div", null, result.error ?? "")));\n      toast("bad", "Guard unchanged", result.error ?? "");\n      return;\n    }\n    state.guardDirty = false;\n    draft = { ...result.data.guard };\n    if (state.policy !== void 0) state.policy.guard = { ...result.data.guard };\n    toast("ok", "Guard changed", `${result.data.guard.falsePositivePolicy}, falling back to ${result.data.guard.fallbackAction}.`);\n    showResult("warn", (box) => {\n      box.appendChild(el("div", null, "The guard changed. It applies from the next request, and it is in the notices panel and in your logs."));\n      if (result.data.guard.falsePositivePolicy !== "strict") {\n        box.appendChild(\n          el(\n            "div",\n            "ev-meta",\n            "Requests can now be denied without proof. The guard-stop count is the series to watch: every stop that no longer happens is a request that used to be recoverable and is not any more."\n          )\n        );\n      }\n    });\n    app.draw();\n  }\n  function guardField(name, control, hint) {\n    const row = el("div", "field");\n    row.appendChild(label(name, control));\n    const right = el("div", "field-row");\n    right.appendChild(control);\n    if (hint !== void 0) right.appendChild(el("span", "hint", hint));\n    row.appendChild(right);\n    return row;\n  }\n  function segmented(options, value, onChange) {\n    const box = el("div", "seg");\n    for (const [label2, option] of options) {\n      const button = el("button", null, label2);\n      button.type = "button";\n      button.setAttribute("aria-pressed", String(option === value));\n      button.addEventListener("click", () => onChange(option));\n      box.appendChild(button);\n    }\n    return box;\n  }\n  function select(options, value, onChange) {\n    const node = el("select");\n    for (const option of options) {\n      const item = el("option", null, option);\n      item.value = option;\n      if (option === value) item.selected = true;\n      node.appendChild(item);\n    }\n    node.addEventListener("change", () => onChange(node.value));\n    return node;\n  }\n  function number(value, onChange) {\n    const input = el("input");\n    input.type = "number";\n    input.min = "1";\n    input.max = "100";\n    input.value = String(value);\n    input.addEventListener("input", () => {\n      if (input.value !== "") onChange(Number(input.value));\n    });\n    return input;\n  }\n\n  // src/dashboard/client/ranges.ts\n  var sets = [];\n  async function loadRanges() {\n    if (!SECTIONS.ranges) return;\n    try {\n      const body = await getJson("/api/ranges");\n      sets = body.ranges;\n      drawRanges();\n    } catch {\n    }\n  }\n  function drawRanges() {\n    if (!SECTIONS.ranges) return;\n    const body = $("ranges-body");\n    clear(body);\n    $("ranges-mode").textContent = BOOT.allowActing ? "editable" : "read-only";\n    $("ranges-note").textContent = BOOT.allowActing ? "An address on the allowlist is not judged leniently \u2014 it is not judged at all. Detection does not run on it, no evidence is produced, and no rule sees it." : "These come from the code that constructed the handler. Enable controls.editRanges to add an address from here.";\n    if (sets.length === 0) {\n      body.appendChild(el("div", "note", "No range sets are configured. Add an address to the allowlist and one appears."));\n    }\n    for (const set of sets) {\n      const block = el("div", "rangeset");\n      const heading = el("h3");\n      heading.appendChild(document.createTextNode(set.name));\n      heading.appendChild(el("span", null, `${n(set.size)} entr${set.size === 1 ? "y" : "ies"}`));\n      block.appendChild(heading);\n      const list = el("div", "cidrs");\n      for (const entry of set.entries) {\n        const chip = el("span", BOOT.allowActing ? "cidr" : "cidr readonly");\n        chip.appendChild(document.createTextNode(entry));\n        if (BOOT.allowActing) {\n          const remove = el("button", null, "\xD7");\n          remove.title = `Remove ${entry} from ${set.name}`;\n          remove.setAttribute("aria-label", `Remove ${entry} from ${set.name}`);\n          remove.addEventListener("click", () => void update(set.name, { remove: [entry] }));\n          chip.appendChild(remove);\n        }\n        list.appendChild(chip);\n      }\n      if (set.entries.length === 0) list.appendChild(el("span", "hint", "empty"));\n      block.appendChild(list);\n      body.appendChild(block);\n    }\n    if (!BOOT.allowActing) return;\n    const form = el("div", "rangeset");\n    const row = el("div", "field-row");\n    const name = el("input", "mono-input");\n    name.type = "text";\n    name.value = "allowlist";\n    name.setAttribute("aria-label", "Range set");\n    name.style.maxWidth = "150px";\n    const value = el("input", "mono-input");\n    value.type = "text";\n    value.placeholder = "203.0.113.0/24";\n    value.setAttribute("aria-label", "Address or CIDR to add");\n    const add = el("button", null, "Add");\n    const submit = () => {\n      const entry = value.value.trim();\n      if (entry === "") return;\n      value.value = "";\n      void update(name.value.trim(), { add: [entry] });\n    };\n    add.addEventListener("click", submit);\n    value.addEventListener("keydown", (event) => {\n      if (event.key === "Enter") submit();\n    });\n    row.appendChild(name);\n    row.appendChild(value);\n    row.appendChild(add);\n    form.appendChild(row);\n    body.appendChild(form);\n  }\n  async function update(name, change) {\n    const result = await postJson("/api/ranges", { name, ...change });\n    if (!result.ok) {\n      toast("bad", "Ranges unchanged", result.error ?? "");\n      return;\n    }\n    toast(name === "allowlist" && change.add !== void 0 ? "warn" : "ok", `\u201C${name}\u201D updated`, `${n(result.data.entries?.length ?? 0)} entr${result.data.entries?.length === 1 ? "y" : "ies"} now.`);\n    await loadRanges();\n  }\n\n  // src/dashboard/client/draft.ts\n  function draftRule(entry, existingIds = []) {\n    const match = {};\n    let because;\n    let stem;\n    const proven = entry.evidence.filter((item) => item.certainty === "certain" && item.direction !== "human");\n    const detectors = [...new Set((proven.length > 0 ? proven : entry.evidence.filter((item) => item.direction !== "human")).map((item) => item.detector))];\n    if (entry.identity !== void 0 && entry.identity !== "") {\n      match["identity"] = [entry.identity];\n      if (entry.certain) match["certain"] = true;\n      stem = entry.identity;\n      because = entry.certain ? `Matched on the identity \u201C${entry.identity}\u201D, and on proof \u2014 so a client merely claiming that name does not match.` : `Matched on the claimed identity \u201C${entry.identity}\u201D. Nothing has verified it, so this matches anything that says so.`;\n    } else if (proven.length > 0) {\n      match["detector"] = detectors;\n      match["certain"] = true;\n      stem = detectors[0] ?? "proven";\n      because = `Matched on proof from ${detectors.join(", ")}. Only requests that carry the same proof match.`;\n    } else if (detectors.length > 0) {\n      match["verdict"] = [entry.verdict];\n      match["detector"] = detectors;\n      match["minScore"] = Math.max(0, Math.floor(entry.score / 10) * 10);\n      stem = detectors[0] ?? entry.verdict;\n      because = `Matched on ${entry.verdict} at score ${String(match["minScore"])} or more, from ${detectors.join(", ")}. Every one of those is probabilistic, so the guard will not let this rule deny anybody.`;\n    } else {\n      match["verdict"] = [entry.verdict];\n      stem = entry.verdict;\n      because = `Nothing fired on this request, so there is nothing sharper to match on than the verdict itself. Narrow it before you use it.`;\n    }\n    return {\n      rule: {\n        id: uniqueId(`from-${slug(stem)}`, existingIds),\n        match,\n        action: "tag",\n        reason: "Drafted from a request on the dashboard.",\n        _open: true\n      },\n      because\n    };\n  }\n  function slug(value) {\n    const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");\n    return cleaned === "" ? "request" : cleaned.slice(0, 40);\n  }\n  function uniqueId(wanted, taken) {\n    if (!taken.includes(wanted)) return wanted;\n    for (let suffix = 2; suffix < 1e3; suffix++) {\n      const candidate = `${wanted}-${suffix}`;\n      if (!taken.includes(candidate)) return candidate;\n    }\n    return `${wanted}-${Date.now()}`;\n  }\n\n  // src/dashboard/client/policy.ts\n  async function loadPolicy() {\n    if (!SECTIONS.policy) return;\n    try {\n      const document_ = await getJson("/api/policy");\n      state.policy = document_;\n      if (!state.editorDirty) {\n        setEditorRules(document_.rules.filter((row) => row.editable).map((row) => row.rule));\n      }\n      if (!state.guardDirty) resetGuardDraft();\n      drawPolicyTab();\n    } catch {\n    }\n  }\n  function setEditorRules(rules) {\n    state.editorRules = JSON.parse(JSON.stringify(rules ?? []));\n    renderEditor();\n  }\n  function markDirty() {\n    state.editorDirty = true;\n    $("policy-dirty").hidden = false;\n  }\n  function editorRules() {\n    if (state.editorMode === "json") {\n      try {\n        const parsed = JSON.parse(byId("policy-json").value);\n        if (!Array.isArray(parsed)) return { error: "The JSON must be an array of rules." };\n        return { rules: parsed };\n      } catch (error) {\n        return { error: `The editor does not contain valid JSON: ${String(error)}` };\n      }\n    }\n    return { rules: state.editorRules };\n  }\n  function cleanRule(rule) {\n    const match = {};\n    for (const [key, value] of Object.entries(rule.match ?? {})) {\n      if (value === void 0 || value === null || value === "") continue;\n      if (Array.isArray(value) && value.length === 0) continue;\n      match[key] = value;\n    }\n    const params = {};\n    for (const [key, value] of Object.entries(rule.params ?? {})) {\n      if (value === void 0 || value === null || value === "") continue;\n      if (key === "limit") {\n        const limit = value;\n        if (limit.max === void 0 || limit.windowMs === void 0) continue;\n      }\n      params[key] = value;\n    }\n    const out = { id: rule.id, match, action: rule.action };\n    if (Object.keys(params).length > 0) out["params"] = params;\n    if (rule.reason !== void 0 && rule.reason !== "") out["reason"] = rule.reason;\n    return out;\n  }\n  function cleanRules(rules) {\n    return rules.map(cleanRule);\n  }\n  function field(name, control, hint) {\n    const row = el("div", "field");\n    row.appendChild(label(name, control));\n    const right = el("div", "field-row");\n    for (const node of Array.isArray(control) ? control : [control]) right.appendChild(node);\n    if (hint !== void 0) right.appendChild(el("span", "hint", hint));\n    row.appendChild(right);\n    return row;\n  }\n  function chipSelect(options, selected, onChange) {\n    const box = el("div", "chips-select");\n    const chosen = Array.isArray(selected) ? [...selected] : selected === void 0 ? [] : [String(selected)];\n    for (const option of options) {\n      const button = el("button", null, option);\n      button.type = "button";\n      button.setAttribute("aria-pressed", String(chosen.includes(option)));\n      button.addEventListener("click", () => {\n        const at = chosen.indexOf(option);\n        if (at === -1) chosen.push(option);\n        else chosen.splice(at, 1);\n        button.setAttribute("aria-pressed", String(at === -1));\n        onChange(chosen.length === 0 ? void 0 : [...chosen]);\n      });\n      box.appendChild(button);\n    }\n    return box;\n  }\n  function segmented2(options, value, onChange) {\n    const box = el("div", "seg");\n    for (const [label2, option] of options) {\n      const button = el("button", null, label2);\n      button.type = "button";\n      button.setAttribute("aria-pressed", String(option === value));\n      button.addEventListener("click", () => {\n        for (const other of Array.from(box.children)) other.setAttribute("aria-pressed", "false");\n        button.setAttribute("aria-pressed", "true");\n        onChange(option);\n      });\n      box.appendChild(button);\n    }\n    return box;\n  }\n  function textInput(value, placeholder, onChange, mono = false) {\n    const input = el("input", mono ? "mono-input" : null);\n    input.type = "text";\n    input.value = value === void 0 || value === null ? "" : String(value);\n    input.placeholder = placeholder;\n    input.addEventListener("input", () => onChange(input.value.trim() === "" ? void 0 : input.value));\n    return input;\n  }\n  function listInput(value, placeholder, onChange) {\n    const current = value === void 0 ? "" : Array.isArray(value) ? value.join(", ") : String(value);\n    const input = textInput(current, placeholder, () => {\n    }, true);\n    input.addEventListener("input", () => {\n      const parts = input.value.split(",").map((part) => part.trim()).filter(Boolean);\n      onChange(parts.length === 0 ? void 0 : parts.length === 1 ? parts[0] : parts);\n    });\n    return input;\n  }\n  function numberInput(value, placeholder, onChange) {\n    const input = el("input");\n    input.type = "number";\n    input.value = value === void 0 || value === null ? "" : String(value);\n    input.placeholder = placeholder;\n    input.addEventListener("input", () => onChange(input.value === "" ? void 0 : Number(input.value)));\n    return input;\n  }\n  function matchSummary(rule) {\n    const box = el("div", "rule-summary");\n    const match = rule.match ?? {};\n    const parts = [];\n    for (const key of ["verdict", "botClass", "category", "identity", "detector", "method", "path"]) {\n      const value = match[key];\n      if (value === void 0) continue;\n      parts.push([key, Array.isArray(value) ? value.join(", ") : String(value)]);\n    }\n    if (match["certain"] !== void 0) parts.push(["certain", String(match["certain"])]);\n    if (match["minScore"] !== void 0 || match["maxScore"] !== void 0) {\n      parts.push(["score", `${String(match["minScore"] ?? 0)}\u2013${String(match["maxScore"] ?? 99)}`]);\n    }\n    if (match["minPriorConfirmations"] !== void 0) parts.push(["prior", String(match["minPriorConfirmations"])]);\n    if (match["minUnsolvedChallenges"] !== void 0) parts.push(["unsolved", String(match["minUnsolvedChallenges"])]);\n    if (parts.length === 0) {\n      box.appendChild(el("span", "none", "matches everything"));\n      return box;\n    }\n    for (const [key, value] of parts.slice(0, 4)) box.appendChild(el("span", "t", `${key}: ${value}`));\n    if (parts.length > 4) box.appendChild(el("span", "k", `+${parts.length - 4} more`));\n    return box;\n  }\n  function ruleCard(rule, index) {\n    const vocabulary = state.policy?.vocabulary;\n    const open = rule._open === true;\n    const card = el("div", `rule${open ? "" : " collapsed"}`);\n    const head = el("div", "rule-head");\n    const chevron = el("button", "chev", open ? "\u25BE" : "\u25B8");\n    chevron.title = open ? "Collapse" : "Expand";\n    chevron.setAttribute("aria-expanded", String(open));\n    chevron.addEventListener("click", () => {\n      rule._open = !open;\n      renderEditor();\n    });\n    head.appendChild(chevron);\n    head.appendChild(el("span", "ord", index + 1));\n    const id = textInput(rule.id, "rule-id", (value) => {\n      rule.id = value ?? "";\n      markDirty();\n    }, true);\n    id.setAttribute("aria-label", "Rule id");\n    head.appendChild(id);\n    if (open) {\n      const action = el("select");\n      action.setAttribute("aria-label", "Action");\n      for (const name of vocabulary?.actions ?? []) {\n        const option = el("option", null, name);\n        option.value = name;\n        if (name === rule.action) option.selected = true;\n        action.appendChild(option);\n      }\n      action.addEventListener("change", () => {\n        rule.action = action.value;\n        rule.params = {};\n        markDirty();\n        renderEditor();\n      });\n      head.appendChild(action);\n    } else {\n      head.appendChild(matchSummary(rule));\n      head.appendChild(el("span", `act-pill ${actionKind(rule.action)}`, rule.action));\n    }\n    const up = el("button", "icon", "\u2191");\n    up.title = "Move earlier \u2014 the first matching rule wins";\n    up.addEventListener("click", () => moveRule(index, -1));\n    const down = el("button", "icon", "\u2193");\n    down.title = "Move later";\n    down.addEventListener("click", () => moveRule(index, 1));\n    const remove = el("button", "icon danger", "Remove");\n    remove.addEventListener("click", () => {\n      state.editorRules.splice(index, 1);\n      markDirty();\n      renderEditor();\n    });\n    head.appendChild(up);\n    head.appendChild(down);\n    head.appendChild(remove);\n    card.appendChild(head);\n    if (!open) return card;\n    const body = el("div", "rule-body");\n    rule.match = rule.match ?? {};\n    const match = rule.match;\n    body.appendChild(field("Verdict", chipSelect(vocabulary?.verdicts ?? [], match["verdict"], (value) => {\n      match["verdict"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Bot class", chipSelect(vocabulary?.botClasses ?? [], match["botClass"], (value) => {\n      match["botClass"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Category", chipSelect(vocabulary?.categories ?? [], match["category"], (value) => {\n      match["category"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Detector", chipSelect(vocabulary?.detectors ?? [], match["detector"], (value) => {\n      match["detector"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Method", chipSelect(vocabulary?.methods ?? [], match["method"], (value) => {\n      match["method"] = value;\n      markDirty();\n    })));\n    body.appendChild(\n      field(\n        "Evidence",\n        segmented2(\n          [\n            ["any", void 0],\n            ["proven", true],\n            ["unproven", false]\n          ],\n          match["certain"],\n          (value) => {\n            match["certain"] = value;\n            markDirty();\n          }\n        ),\n        "proven means at least one piece of certain evidence \u2014 including a proven human"\n      )\n    );\n    body.appendChild(\n      field("Score", [\n        numberInput(match["minScore"], "min", (value) => {\n          match["minScore"] = value;\n          markDirty();\n        }),\n        el("span", "hint", "to"),\n        numberInput(match["maxScore"], "max", (value) => {\n          match["maxScore"] = value;\n          markDirty();\n        })\n      ])\n    );\n    body.appendChild(field("Identity", listInput(match["identity"], "googlebot, gptbot", (value) => {\n      match["identity"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Path", listInput(match["path"], "/api/, /search", (value) => {\n      match["path"] = value;\n      markDirty();\n    }), "a string matches as a prefix"));\n    body.appendChild(\n      field(\n        "Prior bots",\n        numberInput(match["minPriorConfirmations"], "0", (value) => {\n          match["minPriorConfirmations"] = value;\n          markDirty();\n        }),\n        "times this actor was already proven a bot"\n      )\n    );\n    body.appendChild(\n      field(\n        "Unsolved",\n        numberInput(match["minUnsolvedChallenges"], "0", (value) => {\n          match["minUnsolvedChallenges"] = value;\n          markDirty();\n        }),\n        "challenges issued to this actor that were never answered \u2014 solving one clears the count"\n      )\n    );\n    rule.params = rule.params ?? {};\n    const params = rule.params;\n    for (const node of paramFields(rule.action, params)) body.appendChild(node);\n    body.appendChild(field("Reason", textInput(rule.reason, "shown in the decision and in your logs", (value) => {\n      rule.reason = value ?? "";\n      markDirty();\n    })));\n    card.appendChild(body);\n    return card;\n  }\n  function paramFields(action, params) {\n    switch (action) {\n      case "block":\n        return [\n          field("Status", numberInput(params["status"], "403", (value) => {\n            params["status"] = value;\n            markDirty();\n          })),\n          field("Body", textInput(params["body"], "Automated traffic is not served here.", (value) => {\n            params["body"] = value;\n            markDirty();\n          }))\n        ];\n      case "redirect":\n        return [field("Location", textInput(params["location"], "/too-fast", (value) => {\n          params["location"] = value;\n          markDirty();\n        }, true))];\n      case "delay":\n        return [field("Delay", numberInput(params["delayMs"], "250", (value) => {\n          params["delayMs"] = value;\n          markDirty();\n        }), "milliseconds")];\n      case "rate-limit": {\n        const limit = params["limit"] ?? {};\n        params["limit"] = limit;\n        return [\n          field("Limit", [\n            numberInput(limit["max"], "60", (value) => {\n              limit["max"] = value;\n              markDirty();\n            }),\n            el("span", "hint", "requests per"),\n            numberInput(limit["windowMs"], "60000", (value) => {\n              limit["windowMs"] = value;\n              markDirty();\n            }),\n            el("span", "hint", "ms")\n          ])\n        ];\n      }\n      case "custom":\n        return [field("Handler", textInput(params["handler"], "handler-id", (value) => {\n          params["handler"] = value;\n          markDirty();\n        }, true), "id of a handler you registered")];\n      default:\n        return [];\n    }\n  }\n  function lockedCard(row) {\n    const card = el("div", "rule locked");\n    const head = el("div", "rule-head");\n    head.appendChild(el("span", "ord", `#${row.index + 1}`));\n    head.appendChild(el("span", "mono", row.id));\n    head.appendChild(el("span", "grow"));\n    head.appendChild(el("span", "pill", "predicate \u2014 locked"));\n    card.appendChild(head);\n    card.appendChild(\n      el("div", "rule-body", "This rule matches with a function, which cannot be represented here or sent over HTTP. It stays exactly as it is, at this position, whatever else you change.")\n    );\n    return card;\n  }\n  function moveRule(index, delta) {\n    const target = index + delta;\n    if (target < 0 || target >= state.editorRules.length) return;\n    const moved = state.editorRules.splice(index, 1)[0];\n    if (moved === void 0) return;\n    state.editorRules.splice(target, 0, moved);\n    markDirty();\n    renderEditor();\n  }\n  function renderEditor() {\n    if (!SECTIONS.policy) return;\n    const list = $("rulelist");\n    clear(list);\n    const locked = (state.policy?.rules ?? []).filter((row) => !row.editable);\n    if (state.editorRules.length === 0 && locked.length === 0) {\n      list.appendChild(el("div", "note", "No rules. Every request takes the default action \u2014 add one, or import a set."));\n    }\n    const rendered2 = state.editorRules.map((rule, index) => ruleCard(rule, index));\n    for (const row of locked) rendered2.splice(Math.min(row.index, rendered2.length), 0, lockedCard(row));\n    for (const node of rendered2) list.appendChild(node);\n    if (state.editorMode === "json") byId("policy-json").value = JSON.stringify(cleanRules(state.editorRules), null, 2);\n  }\n  function drawPolicyTab() {\n    const document_ = state.policy;\n    if (document_ === void 0) return;\n    const editable = document_.editable;\n    $("policy-apply").hidden = !editable;\n    byId("policy-json").readOnly = !editable;\n    $("policy-mode").textContent = editable ? "editable" : "read-only";\n    $("rule-add").hidden = !editable;\n    $("policy-import").hidden = !editable;\n    const preserved = document_.rules.filter((row) => !row.editable);\n    let note = editable ? "First match wins \u2014 order matters." : "Read-only. Enable controls.editPolicy to change these.";\n    if (preserved.length > 0) note += ` ${preserved.length} rule(s) use a predicate function and are locked.`;\n    $("policy-note").textContent = note;\n    renderPresetButtons();\n    drawGuard();\n    drawRanges();\n    if (SECTIONS.robots) {\n      $("robots-preview").textContent = document_.robots === "" ? "(this policy declines no crawler by name)" : document_.robots;\n      const notes = $("robots-notes");\n      clear(notes);\n      for (const note_ of document_.robotsNotes) notes.appendChild(el("div", "ev-meta", `${note_.rule}: ${note_.reason}`));\n    }\n    const rules = $("stat-rules");\n    clear(rules);\n    const installed = state.snapshot?.rules ?? [];\n    if (installed.length === 0) rules.appendChild(el("div", "note", "No rules configured \u2014 every request takes the default action."));\n    else installed.forEach((rule, index) => rules.appendChild(el("span", "chip", `${index + 1}. ${rule}`)));\n  }\n  async function draftIntoEditor(entry) {\n    if (state.policy === void 0) await loadPolicy();\n    const drafted = draftRule(entry, state.editorRules.map((rule) => rule.id));\n    state.editorRules.push(drafted.rule);\n    markDirty();\n    if (state.editorMode === "json") byId("policy-json").value = JSON.stringify(cleanRules(state.editorRules), null, 2);\n    renderEditor();\n    app.showTab("policy");\n    const notes = [\n      `Drafted \u201C${drafted.rule.id}\u201D, tagging only. Nothing is applied \u2014 read it, choose the action, then apply.`,\n      drafted.because,\n      "It was added last, which is the only position that cannot change what an existing rule does. Move it up with \u2191 if it needs to win."\n    ];\n    showResult("warn", (box) => {\n      for (const note of notes) box.appendChild(el("div", note === notes[0] ? null : "ev-meta", note));\n    });\n    toast("ok", "Rule drafted", "In the editor, tagging only, not applied.");\n    await runPreview(notes);\n  }\n  function switchToGui() {\n    if (state.editorMode === "gui") return;\n    const parsed = editorRules();\n    if (parsed.error !== void 0) {\n      toast("bad", "That JSON will not parse", parsed.error);\n      return;\n    }\n    state.editorRules = parsed.rules ?? [];\n    state.editorMode = "gui";\n    $("mode-gui").setAttribute("aria-pressed", "true");\n    $("mode-json").setAttribute("aria-pressed", "false");\n    $("editor-gui").hidden = false;\n    $("editor-json").hidden = true;\n    renderEditor();\n  }\n  function switchToJson() {\n    state.editorMode = "json";\n    $("mode-gui").setAttribute("aria-pressed", "false");\n    $("mode-json").setAttribute("aria-pressed", "true");\n    $("editor-gui").hidden = true;\n    $("editor-json").hidden = false;\n    byId("policy-json").value = JSON.stringify(cleanRules(state.editorRules), null, 2);\n  }\n  async function exportSettings() {\n    try {\n      const response = await fetch(`${API}/api/settings`);\n      const text = await response.text();\n      if (!response.ok) throw new Error(text);\n      download(text, `bothandler-settings-${today()}.json`, "application/json");\n      toast("ok", "Settings exported", "Rules, plus a record of the configuration around them.");\n    } catch (error) {\n      toast("bad", "Export failed", String(error));\n    }\n  }\n  function readSettingsFile(file) {\n    const reader = new FileReader();\n    reader.onload = () => {\n      try {\n        applyImported(JSON.parse(String(reader.result)), file.name);\n      } catch (error) {\n        toast("bad", "That file is not JSON", String(error));\n      }\n    };\n    reader.onerror = () => toast("bad", "Could not read that file", "");\n    reader.readAsText(file);\n  }\n  function applyImported(document_, name) {\n    const rules = Array.isArray(document_) ? document_ : Array.isArray(document_.rules) ? document_.rules : void 0;\n    if (rules === void 0) {\n      toast("bad", "Nothing to import", "Expected an array of rules, or a settings file with a rules array.");\n      return;\n    }\n    setEditorRules(rules);\n    markDirty();\n    switchToGui();\n    const ignored = [];\n    const readOnly = document_.readOnly;\n    if (readOnly !== void 0) {\n      ignored.push("the guard, the detectors, the ranges and the audit \u2014 those come from the code that built the handler, not from a file");\n      if (Array.isArray(readOnly.lockedRules) && readOnly.lockedRules.length > 0) {\n        ignored.push(`${readOnly.lockedRules.length} predicate rule(s), which stay as they are`);\n      }\n    }\n    showResult("warn", (box) => {\n      box.appendChild(el("div", null, `Loaded ${rules.length} rule(s) from ${name}. Nothing has been applied yet \u2014 preview it first.`));\n      for (const line of ignored) box.appendChild(el("div", "ev-meta", `Ignored: ${line}`));\n    });\n    toast("ok", `Imported ${rules.length} rule(s)`, "Review, preview, then apply.");\n  }\n  function collectForSubmit() {\n    const parsed = editorRules();\n    if (parsed.error !== void 0) {\n      showResult("bad", (box) => box.appendChild(el("div", null, parsed.error ?? "")));\n      toast("bad", "That JSON will not parse", parsed.error);\n      return void 0;\n    }\n    const cleaned = cleanRules(parsed.rules ?? []);\n    const blank = cleaned.filter((rule) => rule["id"] === void 0 || rule["id"] === "").length;\n    if (blank > 0) {\n      toast("bad", "Every rule needs an id", "It is what every decision and log line names.");\n      return void 0;\n    }\n    return cleaned;\n  }\n  async function runPreview(notes = []) {\n    const rules = collectForSubmit();\n    if (rules === void 0) return;\n    const result = await postJson("/api/policy/preview", { rules });\n    if (!result.ok) {\n      showResult("bad", (box) => box.appendChild(el("div", null, result.error ?? "")));\n      toast("bad", "Refused", result.error ?? "");\n      return;\n    }\n    renderPreview(result.data, notes);\n  }\n  async function applyPolicy() {\n    const rules = collectForSubmit();\n    if (rules === void 0) return;\n    const result = await postJson("/api/policy/apply", { rules });\n    if (!result.ok) {\n      showResult("bad", (box) => box.appendChild(el("div", null, result.error ?? "")));\n      toast("bad", "Refused", result.error ?? "");\n      return;\n    }\n    state.editorDirty = false;\n    $("policy-dirty").hidden = true;\n    await loadPolicy();\n    toast("ok", "Applied", `${n(result.data.rules)} rule(s) now in force.`);\n    showResult("ok", (box) => {\n      box.appendChild(el("div", null, `Applied. ${n(result.data.rules)} rule(s) are now in force.`));\n      for (const warning of result.data.warnings ?? []) box.appendChild(el("div", "ev-meta", warning));\n    });\n  }\n  function renderPresetButtons() {\n    const box = $("preset-buttons");\n    const presets = state.policy?.vocabulary.presets ?? [];\n    if (box.childElementCount === presets.length) return;\n    clear(box);\n    for (const preset of presets) {\n      const button = el("button", null, preset);\n      button.addEventListener("click", () => {\n        void (async () => {\n          const result = await postJson("/api/policy/preview", { preset });\n          if (!result.ok) {\n            toast("bad", "Refused", result.error ?? "");\n            return;\n          }\n          renderPreview(result.data);\n        })();\n      });\n      box.appendChild(button);\n    }\n  }\n  function initPolicy() {\n    if (!SECTIONS.policy) return;\n    $("mode-gui").addEventListener("click", switchToGui);\n    $("mode-json").addEventListener("click", switchToJson);\n    $("rule-add").addEventListener("click", () => {\n      state.editorRules.push({ id: `new-rule-${state.editorRules.length + 1}`, match: {}, action: "tag", params: {}, _open: true });\n      markDirty();\n      renderEditor();\n    });\n    $("rule-expand").addEventListener("click", () => {\n      const anyClosed = state.editorRules.some((rule) => rule._open !== true);\n      for (const rule of state.editorRules) rule._open = anyClosed;\n      $("rule-expand").textContent = anyClosed ? "Collapse all" : "Expand all";\n      renderEditor();\n    });\n    byId("policy-json").addEventListener("input", markDirty);\n    $("policy-preview").addEventListener("click", () => void runPreview());\n    $("policy-apply").addEventListener("click", () => void applyPolicy());\n    $("policy-revert").addEventListener("click", () => {\n      state.editorDirty = false;\n      $("policy-dirty").hidden = true;\n      $("policy-result").hidden = true;\n      resetGuardDraft();\n      void loadPolicy();\n    });\n    $("policy-export").addEventListener("click", () => void exportSettings());\n    $("policy-import").addEventListener("click", () => byId("policy-file").click());\n    byId("policy-file").addEventListener("change", () => {\n      const input = byId("policy-file");\n      const file = input.files?.[0];\n      if (file !== void 0) readSettingsFile(file);\n      input.value = "";\n    });\n    const panel = $("editor-panel");\n    for (const name of ["dragenter", "dragover"]) {\n      panel.addEventListener(name, (event) => {\n        if (state.policy?.editable !== true) return;\n        event.preventDefault();\n        panel.classList.add("drop");\n      });\n    }\n    for (const name of ["dragleave", "drop"]) {\n      panel.addEventListener(name, (event) => {\n        panel.classList.remove("drop");\n        if (name !== "drop") return;\n        event.preventDefault();\n        const file = event.dataTransfer?.files?.[0];\n        if (file !== void 0) readSettingsFile(file);\n      });\n    }\n  }\n\n  // src/dashboard/client/feed.ts\n  var FILTERS = [\n    ["all", "All"],\n    ["proven", "Proven"],\n    ["suspected", "Suspected"],\n    ["human", "Human"],\n    ["guard", "Guard stops"],\n    ["deny", "Denied"],\n    ["mitigate", "Mitigated"],\n    ["allow", "Served"]\n  ];\n  var rendered = /* @__PURE__ */ new Map();\n  function initFeed() {\n    const loadThem = byId("feed-load-skipped");\n    loadThem.addEventListener("click", () => {\n      loadThem.disabled = true;\n      void loadSkipped().finally(() => {\n        loadThem.disabled = false;\n      });\n    });\n    const filters = $("filters");\n    for (const [name, label2] of FILTERS) {\n      const button = el("button", null, label2);\n      button.setAttribute("aria-pressed", String(name === state.filter));\n      button.dataset["filter"] = name;\n      button.addEventListener("click", () => {\n        state.filter = name;\n        resetPaging();\n        for (const other of Array.from(filters.children)) other.setAttribute("aria-pressed", "false");\n        button.setAttribute("aria-pressed", "true");\n        app.syncUrl();\n        app.drawNow();\n      });\n      filters.appendChild(button);\n    }\n    const search = byId("search");\n    search.addEventListener("input", () => {\n      setSearch(search.value.trim());\n      app.syncUrl();\n      app.drawNow();\n    });\n    const exportShown = byId("feed-export");\n    exportShown.hidden = !SECTIONS.evidence;\n    exportShown.addEventListener("click", () => {\n      const rows = matchingRows();\n      if (rows.length === 0) {\n        toast("warn", "Nothing to export", "No request in the window matches this filter.");\n        return;\n      }\n      const entries = rows.map((row) => row.entry).reverse();\n      download(`${replayFile(entries)}\n`, `bothandler-feed-${today()}.jsonl`, "application/x-ndjson");\n      toast("ok", `Exported ${n(entries.length)} request(s)`, "Replay them with `bothandlerjs replay`.");\n    });\n  }\n  function reflectFilterButtons() {\n    for (const button of Array.from($("filters").children)) {\n      button.setAttribute("aria-pressed", String(button instanceof HTMLElement && button.dataset["filter"] === state.filter));\n    }\n    const search = byId("search");\n    if (search.value !== state.search) search.value = state.search;\n  }\n  async function loadSkipped() {\n    const before = state.rows.length;\n    try {\n      const body = await getJson("/api/feed");\n      for (const entry of body.entries) ingest(entry);\n      sortRows();\n    } catch {\n      toast("bad", "Could not load them", "The dashboard did not answer. The entries are still in the window; try again.");\n      return;\n    }\n    state.caughtUp = (state.snapshot?.skipped ?? 0) + state.laggedDrops;\n    const added = state.rows.length - before;\n    resetPaging();\n    app.drawNow();\n    toast(\n      added > 0 ? "ok" : "warn",\n      added > 0 ? `Loaded ${n(added)}` : "Nothing left to load",\n      added > 0 ? "They are in the feed now, in the order they happened." : "The window no longer holds them; the ring had already rotated past."\n    );\n  }\n  var FEED_PAGE_SIZES = [25, 50, 100, 200];\n  function drawPager(paged) {\n    const size = state.feedPageSize;\n    const hidden = paged.pages <= 1;\n    const model = {\n      page: paged.page,\n      from: paged.page * size + 1,\n      to: Math.min(paged.total, (paged.page + 1) * size),\n      total: paged.total,\n      atStart: paged.page === 0,\n      atEnd: paged.page >= paged.pages - 1,\n      ...paged.page > 0 ? { held: "held while you read" } : {},\n      go: (page) => {\n        goToFeedPage(page);\n        app.drawNow();\n      },\n      size: {\n        current: size,\n        choices: FEED_PAGE_SIZES,\n        set: (next) => {\n          state.feedPageSize = next;\n          resetPaging();\n          app.drawNow();\n        }\n      }\n    };\n    for (const [id, withSize] of [\n      ["feed-pager-top", true],\n      ["feed-pager", false]\n    ]) {\n      const host = $(id);\n      host.hidden = hidden;\n      if (hidden) clear(host);\n      else renderPager(host, model, { withSize });\n    }\n  }\n  function drawFeed() {\n    const body = byId("rows");\n    const paged = feedPage(state.feedPageSize);\n    const shown = paged.rows;\n    let index = 0;\n    const place = (node) => {\n      const current = body.childNodes[index] ?? null;\n      if (current !== node) body.insertBefore(node, current);\n      index++;\n    };\n    for (const row of shown) {\n      const id = row.entry.requestId;\n      const open = state.open.has(id);\n      let cached = rendered.get(id);\n      if (cached === void 0 || cached.rev !== row.rev || cached.open !== open) {\n        cached = {\n          row: buildRow(row.entry, open),\n          detail: open ? buildDetail(row.entry) : void 0,\n          rev: row.rev,\n          open\n        };\n        rendered.set(id, cached);\n      }\n      place(cached.row);\n      if (cached.detail !== void 0) place(cached.detail);\n    }\n    while (body.childNodes.length > index) body.removeChild(body.childNodes[index]);\n    if (rendered.size > shown.length * 2 + 100) {\n      const live = new Set(shown.map((row) => row.entry.requestId));\n      for (const id of Array.from(rendered.keys())) if (!live.has(id)) rendered.delete(id);\n    }\n    const total = state.rows.length;\n    const matching = matchingCount();\n    $("empty").hidden = total > 0;\n    $("feed-count").textContent = matching === total ? `${n(total)} in this window` : `${n(matching)} of ${n(total)}`;\n    drawPager(paged);\n    const skipped = Math.max(0, (state.snapshot?.skipped ?? 0) + state.laggedDrops - state.caughtUp);\n    const note = $("feed-skipped");\n    note.hidden = skipped === 0;\n    note.textContent = `${n(skipped)} not streamed`;\n    byId("feed-load-skipped").hidden = skipped === 0;\n    note.title = state.laggedDrops > 0 ? `${n(state.laggedDrops)} were skipped because this connection could not keep up, and the rest by the rate cap. All of them are still in the window, the preview and the export.` : "Entries the rate cap kept off this stream. They are still in the window, the preview and the export \u2014 raise maxEventsPerSecond to see them live.";\n  }\n  function resetFeedCache() {\n    rendered.clear();\n  }\n  function buildRow(entry, open) {\n    const out = outcome(entry);\n    const tr = el("tr", `row a-${entry.downgradedFrom !== void 0 ? "guard" : out}${open ? " open" : ""}`);\n    tr.appendChild(el("td", "num mono tnum when", clockTime(entry.at)));\n    const request = el("td", "edge req");\n    const toggle = el("button", "row-toggle", `${entry.method} ${entry.path}`);\n    toggle.type = "button";\n    toggle.setAttribute("aria-expanded", String(open));\n    toggle.setAttribute("aria-label", `${entry.method} ${entry.path}, ${entry.verdict}. Evidence.`);\n    toggle.dataset["request"] = entry.requestId;\n    request.appendChild(toggle);\n    const ua = el("span", "ua");\n    if (SECTIONS.actors) {\n      const actorLink = el("a", null, entry.actor);\n      actorLink.href = "#actor";\n      actorLink.title = "Show everything from this actor";\n      actorLink.addEventListener("click", (event) => {\n        event.preventDefault();\n        event.stopPropagation();\n        openActor(entry.actor);\n      });\n      ua.appendChild(actorLink);\n      ua.appendChild(document.createTextNode(` \xB7 ${entry.userAgent}`));\n    } else {\n      ua.appendChild(document.createTextNode(`${entry.actor} \xB7 ${entry.userAgent}`));\n    }\n    ua.title = `${entry.actor} \xB7 ${entry.userAgent}`;\n    request.appendChild(ua);\n    tr.appendChild(request);\n    const verdictCell = el("td");\n    const [badgeClass, badgeLabel] = verdictBadge(entry);\n    verdictCell.appendChild(el("span", `badge ${badgeClass}`, badgeLabel));\n    if (entry.identity !== void 0) verdictCell.appendChild(el("span", "sub", entry.identity));\n    tr.appendChild(verdictCell);\n    tr.appendChild(el("td", "num mono tnum", entry.certain ? "proven" : String(entry.score)));\n    const actionCell = el("td");\n    if (entry.action !== void 0) {\n      const kind = out === "deny" ? "act-deny" : out === "mitigate" ? "act-mitigate" : out === "allow" ? "act-allow" : "act-tag";\n      actionCell.appendChild(el("span", `act ${kind}`, entry.action));\n      if (entry.rule !== void 0) {\n        const ruleLabel = el("span", "sub", entry.rule);\n        ruleLabel.title = entry.rule;\n        actionCell.appendChild(ruleLabel);\n      }\n      if (entry.downgradedFrom !== void 0) actionCell.appendChild(el("span", "guard", `guard stopped ${entry.downgradedFrom}`));\n    } else {\n      actionCell.appendChild(el("span", "sub", "assessed only"));\n    }\n    tr.appendChild(actionCell);\n    tr.appendChild(el("td", "num mono tnum", entry.durationMs.toFixed(2)));\n    tr.dataset["request"] = entry.requestId;\n    const flip = () => {\n      if (state.open.has(entry.requestId)) state.open.delete(entry.requestId);\n      else state.open.add(entry.requestId);\n      app.drawNow();\n      rootNode().querySelector(`button.row-toggle[data-request="${cssEscape(entry.requestId)}"]`)?.focus();\n    };\n    toggle.addEventListener("click", (event) => {\n      event.stopPropagation();\n      flip();\n    });\n    tr.addEventListener("click", flip);\n    return tr;\n  }\n  function buildDetail(entry) {\n    const tr = el("tr", "detail");\n    const cell = el("td");\n    cell.colSpan = 6;\n    if (!SECTIONS.evidence) {\n      cell.appendChild(\n        el(\n          "div",\n          "ev-meta",\n          "The evidence section is switched off on this dashboard, so the reasons behind this verdict are not sent to it. What fired, and why, is on a dashboard that has `sections: { evidence: true }`."\n        )\n      );\n    } else if (entry.evidence.length === 0) {\n      cell.appendChild(\n        el(\n          "div",\n          "ev-meta",\n          entry.bypass !== void 0 ? `Detection was skipped for this request: ${entry.bypass}.` : "No detector produced any evidence. This is what ordinary traffic looks like."\n        )\n      );\n    } else {\n      const list = el("div", "ev");\n      for (const item of entry.evidence) {\n        const row = el("div", `ev-item${item.direction === "human" ? " human" : ""}`);\n        row.appendChild(el("div", `tier t-${item.certainty}`, item.certainty));\n        const body = el("div");\n        body.appendChild(el("div", null, item.summary));\n        let meta = `${item.detector} \xB7 points to ${item.direction}`;\n        if (item.family !== void 0) meta += ` \xB7 family \u201C${item.family}\u201D, counted once with its siblings`;\n        body.appendChild(el("div", "ev-meta", meta));\n        if (item.deterministicBasis !== void 0) body.appendChild(el("div", "basis", item.deterministicBasis));\n        row.appendChild(body);\n        list.appendChild(row);\n      }\n      cell.appendChild(list);\n    }\n    for (const failure of entry.failures) {\n      cell.appendChild(el("div", "ev-meta", `Detector ${failure.detector} ${failure.reason}: ${failure.message}`));\n    }\n    if (entry.downgradeReason !== void 0) cell.appendChild(el("div", "basis", `Guard: ${entry.downgradeReason}`));\n    const queryNames = Object.keys(entry.query);\n    if (queryNames.length > 0) {\n      const queryTable = el("table", "hdr");\n      for (const name of queryNames) {\n        const value = entry.query[name] ?? "";\n        const row = el("tr");\n        row.appendChild(el("td", "n", `?${name}`));\n        row.appendChild(el("td", `v${value === "[redacted]" ? " red" : ""}`, value));\n        queryTable.appendChild(row);\n      }\n      cell.appendChild(queryTable);\n    }\n    if (entry.headers !== void 0 && entry.headers.length > 0) {\n      const table = el("table", "hdr");\n      for (const [name, value] of entry.headers) {\n        const row = el("tr");\n        row.appendChild(el("td", "n", `${name}:`));\n        row.appendChild(el("td", `v${value === "[redacted]" ? " red" : ""}`, value));\n        table.appendChild(row);\n      }\n      cell.appendChild(table);\n    }\n    const tools = el("div", "tools");\n    if (SECTIONS.evidence) {\n      tools.appendChild(copyButton("Copy replay line", () => replayLine(entry)));\n      tools.appendChild(downloadButton("Download replay line", () => replayLine(entry), `request-${entry.requestId}.jsonl`));\n      tools.appendChild(copyButton("Copy corpus case", () => corpusCase(entry)));\n    }\n    if (SECTIONS.policy) {\n      const draft2 = el("button", null, "Draft a rule");\n      draft2.title = "Start a rule from this request, in the policy editor";\n      draft2.addEventListener("click", (event) => {\n        event.stopPropagation();\n        void draftIntoEditor(entry);\n      });\n      tools.appendChild(draft2);\n    }\n    if (SECTIONS.actors) {\n      const actorButton = el("button", null, "Show this actor");\n      actorButton.addEventListener("click", (event) => {\n        event.stopPropagation();\n        openActor(entry.actor);\n      });\n      tools.appendChild(actorButton);\n    }\n    cell.appendChild(tools);\n    const foot = el("div", "detail-foot");\n    foot.appendChild(el("span", null, clockTime(entry.at)));\n    foot.appendChild(el("span", null, `actor ${entry.actor}`));\n    if (entry.rule !== void 0) foot.appendChild(el("span", null, `rule \u201C${entry.rule}\u201D`));\n    foot.appendChild(el("span", null, `assessed in ${entry.durationMs.toFixed(3)}ms`));\n    foot.appendChild(el("span", "mono", entry.requestId));\n    cell.appendChild(foot);\n    tr.appendChild(cell);\n    return tr;\n  }\n  function copyButton(label2, produce) {\n    const button = el("button", null, label2);\n    button.addEventListener("click", (event) => {\n      event.stopPropagation();\n      const text = produce();\n      const done = () => {\n        button.textContent = "Copied";\n        setTimeout(() => {\n          button.textContent = label2;\n        }, 1200);\n      };\n      if (navigator.clipboard?.writeText !== void 0) navigator.clipboard.writeText(text).then(done, () => showText(text));\n      else showText(text);\n    });\n    return button;\n  }\n  function downloadButton(label2, produce, filename) {\n    const button = el("button", null, label2);\n    button.addEventListener("click", (event) => {\n      event.stopPropagation();\n      download(`${produce()}\n`, filename, "application/x-ndjson");\n    });\n    return button;\n  }\n  function showText(text) {\n    const box = el("pre", "code", text);\n    const host = $("policy-result");\n    host.hidden = false;\n    host.className = "result";\n    clear(host);\n    host.appendChild(el("div", "ev-meta", "Copying needs a secure context; here is the text."));\n    host.appendChild(box);\n    const selection = getSelection();\n    if (selection !== null) {\n      const range = document.createRange();\n      range.selectNodeContents(box);\n      selection.removeAllRanges();\n      selection.addRange(range);\n    }\n  }\n\n  // src/dashboard/client/stream.ts\n  var source;\n  function connectStream() {\n    if (!SECTIONS.feed) {\n      $("dot").className = "dot";\n      $("conn").textContent = "feed off";\n      return;\n    }\n    if (source !== void 0) return;\n    source = new EventSource(`${API}/api/stream`);\n    source.addEventListener("open", () => {\n      $("dot").className = "dot on";\n      $("conn").textContent = "live";\n    });\n    source.addEventListener("sync", (event) => {\n      const detail = JSON.parse(event.data);\n      if (!detail.replace) return;\n      clearFeed();\n      resetFeedCache();\n    });\n    source.addEventListener("entry", (event) => {\n      ingest(JSON.parse(event.data));\n      if (state.paused) {\n        state.bufferedWhilePaused++;\n        $("pause").textContent = `Resume (${state.bufferedWhilePaused})`;\n      }\n      app.draw();\n    });\n    source.addEventListener("update", (event) => {\n      ingest(JSON.parse(event.data));\n      app.draw();\n    });\n    source.addEventListener("reset", () => {\n      clearFeed();\n      resetFeedCache();\n      app.draw();\n    });\n    source.addEventListener("lagged", (event) => {\n      const detail = JSON.parse(event.data);\n      state.laggedDrops += detail.dropped;\n      app.draw();\n    });\n    source.addEventListener("stats", (event) => {\n      state.snapshot = JSON.parse(event.data);\n      app.draw();\n    });\n    source.addEventListener("error", () => {\n      $("dot").className = "dot off";\n      $("conn").textContent = "reconnecting\u2026";\n    });\n  }\n  async function loadInitialSnapshot() {\n    try {\n      state.snapshot = await getJson("/api/stats");\n      app.drawNow();\n    } catch {\n    }\n  }\n\n  // src/dashboard/client/panels.ts\n  var paintedSnapshot;\n  function drawTiles(force = false) {\n    if (!SECTIONS.statistics) return;\n    const box = $("tiles");\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    if (!force && paintedSnapshot === snapshot) return;\n    paintedSnapshot = snapshot;\n    const metrics = snapshot.metrics;\n    clear(box);\n    if (metrics === void 0) {\n      box.appendChild(el("div", "note", "Counters are switched off on this handler (metrics: false). The live feed still works."));\n      return;\n    }\n    const actions = metrics.actions;\n    const denied = actions.block + actions.drop + actions.redirect;\n    const mitigated = actions.challenge + actions["rate-limit"] + actions.delay;\n    const served = actions.allow + actions.tag + actions.log;\n    const total = metrics.requests;\n    const unremarkable = metrics.verdicts.unknown + metrics.verdicts.human;\n    const provenBotCount = provenBots(metrics.verdicts);\n    const actors = SECTIONS.registry ? { tab: "actors", label: "Actors" } : void 0;\n    const tiles = [\n      ["", n(total), "Requests", "since start", void 0],\n      ["proven", n(provenBotCount), "Proven bots", `${pct(provenBotCount, total)} of traffic`, void 0],\n      ["warn", n(metrics.verdicts["suspected-bot"]), "Suspected", "never denied alone", void 0],\n      ["", n(unremarkable), "Unremarkable", `${pct(unremarkable, total)} of traffic`, void 0],\n      ["warn", n(metrics.downgrades), "Guard stops", metrics.downgrades > 0 ? "a rule over-reached" : "no rule overreached", void 0],\n      ["crit", n(denied), "Denied", `${pct(denied, total)} of traffic`, void 0],\n      [\n        "",\n        n(mitigated),\n        "Mitigated",\n        metrics.challenges.issued > 0 ? `${n(metrics.challenges.solved)} of ${n(metrics.challenges.issued)} challenges solved` : "challenged or limited",\n        void 0\n      ],\n      ["good", n(served), "Served", `${pct(served, total)} of traffic`, void 0],\n      ["", n(metrics.actorsTracked), "Actors tracked", "in the registry now", actors]\n    ];\n    for (const [kind, value, key, sub, goes] of tiles) {\n      const tile = goes === void 0 ? el("div", `tile ${kind}`) : el("button", `tile ${kind} go`);\n      tile.appendChild(el("div", "v tnum", value));\n      tile.appendChild(el("div", "k", key));\n      tile.appendChild(el("div", "s", sub));\n      if (goes !== void 0) {\n        tile.type = "button";\n        tile.appendChild(el("span", "sr-only", `. Show the ${goes.label} screen`));\n        tile.addEventListener("click", () => app.showTab(goes.tab, { replace: false }));\n      }\n      box.appendChild(tile);\n    }\n  }\n  function drawChips() {\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    const box = $("chips");\n    clear(box);\n    const facts = [\n      // Which process this is, first, because everything after it is a fact about this\n      // process and nothing else. Behind a load balancer there are as many of these\n      // dashboards as there are pods, each showing its own share of the traffic.\n      ["instance", snapshot.instance],\n      ["guard", snapshot.policy.falsePositivePolicy],\n      ["suspect at", String(snapshot.policy.suspectThreshold)]\n    ];\n    if (SECTIONS.statistics) facts.push(["detectors", String(snapshot.detectors.length)]);\n    if (SECTIONS.policy) facts.push(["rules", String(snapshot.rules.length)]);\n    facts.push(["uptime", uptime(snapshot.now - snapshot.startedAt)]);\n    for (const [label2, value] of facts) {\n      const fact = el("span");\n      fact.appendChild(document.createTextNode(`${label2} `));\n      fact.appendChild(el("b", null, value));\n      box.appendChild(fact);\n    }\n  }\n  function updateWindowLabels() {\n    const label2 = windowLabel(state.rows.length, oldestAt(), Date.now());\n    for (const node of Array.from(rootNode().querySelectorAll(".win"))) node.textContent = label2;\n  }\n  function drawLivePanels() {\n    if (!SECTIONS.statistics) return;\n    const totals = aggregate(state.rows);\n    drawBars($("live-detectors"), totals.detectors, "Nothing has fired in this window.");\n    if (SECTIONS.actors) drawBars($("live-actors"), totals.actors, "No traffic in this window.");\n  }\n  function drawStatsPanels() {\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    const metrics = snapshot.metrics;\n    if (metrics !== void 0) {\n      drawBars($("stat-verdicts"), pairs(metrics.verdicts), "Nothing assessed yet.");\n      drawBars($("stat-actions"), pairs(metrics.actions), "No decisions yet.");\n      drawBars($("stat-classes"), pairs(metrics.botClasses), "Nothing classified yet.");\n      drawBars($("stat-detectors"), pairs(metrics.detectorFirings), "No detector has produced evidence yet.");\n      const challenges = $("stat-challenges");\n      clear(challenges);\n      if (!snapshot.policy.challengeEnabled) {\n        challenges.appendChild(el("div", "note", "No challenge is configured, so a rule asking for one degrades to a tag. Set challenge.secrets to enable it."));\n      } else {\n        const funnel = [\n          ["Issued", n(metrics.challenges.issued)],\n          ["Solved", n(metrics.challenges.solved)],\n          ["Rejected", n(metrics.challenges.rejected)],\n          ["Solve rate", metrics.challenges.issued > 0 ? pct(metrics.challenges.solved, metrics.challenges.issued) : "\u2014"]\n        ];\n        for (const [key, value] of funnel) challenges.appendChild(statRow(key, value));\n      }\n      const health = $("stat-health");\n      clear(health);\n      const bypassed = metrics.bypassed.allowlist + metrics.bypassed["ignored-path"];\n      const rows = [\n        ["Requests assessed", n(metrics.requests)],\n        ["Bypassed \u2014 allowlist", n(metrics.bypassed.allowlist)],\n        ["Bypassed \u2014 ignored path", n(metrics.bypassed["ignored-path"])],\n        ["Detection ran on", pct(metrics.requests - bypassed, metrics.requests)],\n        ["Actors tracked", n(metrics.actorsTracked)],\n        ["Guard stops", n(metrics.downgrades)]\n      ];\n      const failures = pairs(metrics.detectorFailures);\n      for (const [detector, count] of failures) rows.push([`Detector failures \u2014 ${detector}`, n(count)]);\n      for (const [key, value] of rows) health.appendChild(statRow(key, value));\n      if (failures.length === 0) health.appendChild(el("div", "note", "No detector has thrown or timed out."));\n    }\n    const totals = aggregate(state.rows);\n    if (SECTIONS.actors) drawBars($("stat-identities"), totals.identities, "No client has named itself in this window.");\n    drawBars($("stat-paths"), totals.paths, "No traffic in this window.");\n    drawBars($("stat-denied-paths"), totals.deniedPaths, "Nothing has been denied in this window.");\n    drawBars($("stat-guard"), totals.guardStops, "No rule has asked for more than its evidence supports.");\n    drawBars($("stat-bypassed"), totals.bypassed, "Nothing bypassed detection.");\n    drawRuleHits(totals);\n    const list = $("stat-detector-list");\n    clear(list);\n    $("detector-count").textContent = `${snapshot.detectors.length} installed`;\n    for (const detector of snapshot.detectors) {\n      const row = el("div", "det");\n      const left = el("div");\n      left.appendChild(el("div", "mono", detector.id));\n      left.appendChild(el("div", "d", detector.description));\n      row.appendChild(left);\n      const fires = metrics?.detectorFirings[detector.id] ?? 0;\n      const timing = metrics?.detectorTimings[detector.id];\n      let right = `${n(fires)} \xB7 ${detector.cost} \xB7 ${detector.stage}`;\n      if (timing !== void 0 && timing.count > 0) right += ` \xB7 ${ms(timing.totalMs / timing.count)} avg`;\n      row.appendChild(el("div", "n", right));\n      list.appendChild(row);\n    }\n  }\n  function statRow(key, value) {\n    const line = el("div", "stat-row");\n    line.appendChild(el("span", "k", key));\n    line.appendChild(el("span", "v", value));\n    return line;\n  }\n  function drawRuleHits(totals) {\n    const target = $("stat-rule-hits");\n    clear(target);\n    const rules = state.snapshot?.rules ?? [];\n    if (rules.length === 0) {\n      target.appendChild(el("div", "note", "No rules configured."));\n      return;\n    }\n    let max = 1;\n    for (const rule of rules) max = Math.max(max, totals.ruleHits.get(rule) ?? 0);\n    for (const rule of rules) {\n      const value = totals.ruleHits.get(rule) ?? 0;\n      const bar = el("div", `bar${value === 0 ? " dead" : ""}`);\n      const track = el("div", "track");\n      if (value > 0) {\n        const fill = el("div", "fill");\n        fill.style.width = `${Math.max(2, Math.round(value / max * 100))}%`;\n        track.appendChild(fill);\n      }\n      track.appendChild(el("div", "lbl", rule));\n      bar.appendChild(track);\n      bar.appendChild(el("div", "v tnum", value === 0 ? "never" : n(value)));\n      target.appendChild(bar);\n    }\n  }\n  function drawAudit() {\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    const body = $("audit-body");\n    const checks = $("audit-checks");\n    clear(body);\n    clear(checks);\n    const audit = snapshot.audit;\n    if (audit === void 0) {\n      $("audit-spans").textContent = "";\n      body.appendChild(\n        el(\n          "div",\n          "note",\n          "The traffic audit is switched off on this handler (audit: false). It watches the shape of your traffic rather than any one request \u2014 a spike in automation, a collapse in human traffic, a policy suddenly denying far more than usual."\n        )\n      );\n      return;\n    }\n    const current = audit.window;\n    const baseline = audit.baseline;\n    $("audit-spans").textContent = `last ${rangeLabel(current.spanMs)} against the ${rangeLabel(baseline.spanMs)} before`;\n    const rows = [\n      ["Requests", n(current.requests), n(baseline.requests)],\n      ["Rate", `${current.rate.toFixed(1)}/min`, `${baseline.rate.toFixed(1)}/min`],\n      ["Bot share", `${Math.round(current.botShare * 100)}%`, `${Math.round(baseline.botShare * 100)}%`],\n      ["Bots", n(current.bots), n(baseline.bots)],\n      ["Humans", n(current.humans), n(baseline.humans)],\n      ["Denials", n(current.denials), n(baseline.denials)],\n      ["Challenges", n(current.challenges), n(baseline.challenges)],\n      ["Guard stops", n(current.downgrades), n(baseline.downgrades)],\n      ["Detector failures", n(current.failures), n(baseline.failures)],\n      ["Bypassed", n(current.bypassed), n(baseline.bypassed)]\n    ];\n    for (const [key, now, was] of rows) {\n      const line = el("div", "stat-row");\n      line.appendChild(el("span", "k", key));\n      const values = el("span", "v");\n      values.appendChild(el("b", null, now));\n      values.appendChild(el("span", "was", ` was ${was}`));\n      line.appendChild(values);\n      body.appendChild(line);\n    }\n    if (audit.checks.length === 0) {\n      checks.appendChild(el("div", "note", "No checks are installed, so nothing here will ever raise an anomaly."));\n      return;\n    }\n    for (const check of audit.checks) {\n      const row = el("div", "det");\n      const left = el("div");\n      left.appendChild(el("div", "mono", check.id));\n      left.appendChild(el("div", "d", check.description));\n      row.appendChild(left);\n      checks.appendChild(row);\n    }\n  }\n  function drawNoticeBadge() {\n    const notices = state.snapshot?.notices ?? [];\n    const badge = $("notice-badge");\n    badge.hidden = notices.length === 0 || !SECTIONS.notices;\n    badge.textContent = String(notices.length);\n  }\n  function drawNotices() {\n    const box = $("stat-notices");\n    const notices = state.snapshot?.notices ?? [];\n    clear(box);\n    $("notice-count").textContent = notices.length > 0 ? `${notices.length} total` : "";\n    if (notices.length === 0) {\n      box.appendChild(el("div", "note", "Nothing to report: no startup warnings, no detector errors."));\n      return;\n    }\n    for (const notice of notices.slice().reverse().slice(0, 40)) {\n      const row = el("div", `notice ${notice.kind}`);\n      const when = el("div", "when");\n      when.appendChild(el("div", "tag", notice.kind));\n      when.appendChild(el("div", null, clockTime(notice.at)));\n      row.appendChild(when);\n      const body = el("div");\n      body.appendChild(el("div", null, notice.message));\n      if (notice.source !== void 0) body.appendChild(el("div", "ev-meta", notice.source));\n      row.appendChild(body);\n      box.appendChild(row);\n    }\n  }\n  function drawChanges() {\n    if (!SECTIONS.changes) return;\n    const box = $("stat-changes");\n    const changes = state.snapshot?.changes ?? [];\n    clear(box);\n    $("change-count").textContent = changes.length > 0 ? `${changes.length} this run` : "";\n    if (changes.length === 0) {\n      box.appendChild(el("div", "note", "Nothing has been changed at runtime. Rules, guard and ranges are as the code that built this handler left them."));\n      return;\n    }\n    for (const change of changes.slice().reverse()) {\n      const row = el("div", "notice");\n      const when = el("div", "when");\n      when.appendChild(el("div", "tag", change.kind));\n      when.appendChild(el("div", null, clockTime(change.at)));\n      row.appendChild(when);\n      const body = el("div");\n      body.appendChild(el("div", null, change.summary));\n      body.appendChild(el("div", "ev-meta", change.by === void 0 || change.by === "" ? "by an unnamed viewer \u2014 this listener\'s auth carries no identity" : `by ${change.by}`));\n      row.appendChild(body);\n      box.appendChild(row);\n    }\n  }\n  function drawPeers() {\n    const box = $("peers");\n    if (BOOT.peers.length === 0) {\n      box.hidden = true;\n      return;\n    }\n    if (box.childElementCount > 0) return;\n    box.appendChild(el("span", "hint", "also:"));\n    for (const peer of BOOT.peers) {\n      const link = el("a", "linkbtn", peer.label);\n      link.href = peer.href;\n      link.rel = "noreferrer noopener";\n      box.appendChild(link);\n    }\n  }\n\n  // src/dashboard/client/charts.ts\n  var BUCKETS = 60;\n  var LATENCY_BOUNDS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 25, 50, 100];\n  var SCORE_BOUNDS = 10;\n  function positionTip(tip, host, clientX, boxLeft) {\n    tip.style.opacity = "1";\n    tip.style.left = `${Math.min(host.clientWidth - 150, Math.max(4, clientX - boxLeft - 60))}px`;\n    tip.style.top = "14px";\n  }\n  function tipRow(label2, value, colour) {\n    const line = el("div", "r");\n    const left = el("em");\n    if (colour !== void 0) {\n      const swatch = el("span", "swatch");\n      swatch.style.background = colour;\n      left.appendChild(swatch);\n    }\n    left.appendChild(document.createTextNode(label2));\n    line.appendChild(left);\n    line.appendChild(el("b", null, value));\n    return line;\n  }\n  function timeline() {\n    const bucketMs = state.rangeMs / BUCKETS;\n    const now = Date.now();\n    const start2 = now - state.rangeMs;\n    const buckets = [];\n    for (let i = 0; i < BUCKETS; i++) buckets.push({ at: start2 + i * bucketMs, served: 0, mitigated: 0, denied: 0, total: 0 });\n    for (const { entry } of state.rows) {\n      const index = Math.floor((entry.at - start2) / bucketMs);\n      if (index < 0 || index >= BUCKETS) continue;\n      const bucket = buckets[index];\n      if (bucket === void 0) continue;\n      bucket.total++;\n      const out = outcome(entry);\n      if (out === "deny") bucket.denied++;\n      else if (out === "mitigate") bucket.mitigated++;\n      else bucket.served++;\n    }\n    return buckets;\n  }\n  function drawTraffic() {\n    const host = $("traffic-chart");\n    const svg = $("traffic");\n    const width = Math.max(320, host.clientWidth - 30);\n    const height = 190;\n    const padBottom = 26;\n    const markerRow = 8;\n    const plot = height - padBottom - markerRow;\n    const buckets = timeline();\n    const now = Date.now();\n    const start2 = now - state.rangeMs;\n    let peak = 1;\n    for (const bucket of buckets) if (bucket.total > peak) peak = bucket.total;\n    const max = Math.max(2, Math.ceil(peak / 2) * 2);\n    clear(svg);\n    svg.setAttribute("viewBox", `0 0 ${width} ${height}`);\n    svg.setAttribute("height", String(height));\n    const s1 = css("--s1");\n    const s2 = css("--s2");\n    const crit = css("--crit");\n    const grid = css("--grid");\n    const muted = css("--muted");\n    const step = width / BUCKETS;\n    const barWidth = Math.max(2, step - 2);\n    for (const fraction of [0, 0.5, 1]) {\n      const y = markerRow + plot - fraction * plot;\n      svg.appendChild(svgEl("line", { class: "gridline", x1: 0, x2: width, y1: y, y2: y, stroke: grid, "stroke-width": 1 }));\n      if (fraction > 0) svg.appendChild(svgText({ x: 2, y: y - 3, fill: muted, "font-size": 10 }, Math.round(max * fraction)));\n    }\n    buckets.forEach((bucket, index) => {\n      const x = index * step + 1;\n      const servedHeight = bucket.served / max * plot;\n      const mitigatedHeight = bucket.mitigated / max * plot;\n      let y = markerRow + plot;\n      if (servedHeight > 0) {\n        y -= servedHeight;\n        svg.appendChild(svgEl("rect", { x, y, width: barWidth, height: servedHeight, fill: s1, rx: 2 }));\n      }\n      if (mitigatedHeight > 0) {\n        y -= mitigatedHeight + (servedHeight > 0 ? 2 : 0);\n        svg.appendChild(svgEl("rect", { x, y: Math.max(markerRow, y), width: barWidth, height: mitigatedHeight, fill: s2, rx: 2 }));\n      }\n      if (bucket.denied > 0) svg.appendChild(svgEl("rect", { x, y: 0, width: barWidth, height: 5, fill: crit, rx: 2 }));\n    });\n    svg.appendChild(svgEl("line", { x1: 0, x2: width, y1: markerRow + plot, y2: markerRow + plot, stroke: css("--line"), "stroke-width": 1 }));\n    const span = rangeLabel(state.rangeMs);\n    const labels = [\n      [0, `${span} ago`],\n      [BUCKETS / 2, rangeLabel(state.rangeMs / 2)],\n      [BUCKETS - 1, "now"]\n    ];\n    for (const [position, text] of labels) {\n      svg.appendChild(svgText({ x: Math.min(width - 26, Math.max(0, position * step)), y: height - 8, fill: muted, "font-size": 10 }, text));\n    }\n    const changes = (state.snapshot?.changes ?? []).filter((change) => change.at >= start2 && change.at <= now);\n    const markColour = css("--proven-text");\n    for (const change of changes) {\n      const x = (change.at - start2) / state.rangeMs * width;\n      svg.appendChild(svgEl("line", { x1: x, x2: x, y1: 0, y2: markerRow + plot, stroke: markColour, "stroke-width": 1.5, "stroke-dasharray": "3 2", opacity: 0.85 }));\n      const dot = svgEl("circle", { cx: x, cy: 3, r: 3, fill: markColour });\n      const title = svgEl("title");\n      title.textContent = `${clockTime(change.at)} \xB7 ${change.kind}: ${change.summary}${change.by === void 0 ? "" : ` (by ${change.by})`}`;\n      dot.appendChild(title);\n      svg.appendChild(dot);\n    }\n    const hover = svgEl("rect", { x: 0, y: 0, width: 0, height: markerRow + plot, fill: css("--ink"), opacity: 0.06 });\n    svg.appendChild(hover);\n    const tip = $("traffic-tip");\n    host.onmousemove = (event) => {\n      const box = svg.getBoundingClientRect();\n      const index = Math.floor((event.clientX - box.left) / box.width * BUCKETS);\n      const bucket = buckets[index];\n      if (bucket === void 0) {\n        tip.style.opacity = "0";\n        hover.setAttribute("width", "0");\n        return;\n      }\n      hover.setAttribute("x", String(index * step));\n      hover.setAttribute("width", String(step));\n      clear(tip);\n      tip.appendChild(el("div", "t", `${clockTime(bucket.at)} \xB7 ${Math.round(state.rangeMs / BUCKETS / 1e3)}s`));\n      tip.appendChild(tipRow("Served", n(bucket.served), s1));\n      tip.appendChild(tipRow("Mitigated", n(bucket.mitigated), s2));\n      tip.appendChild(tipRow("Denied", n(bucket.denied), crit));\n      positionTip(tip, host, event.clientX, box.left);\n    };\n    host.onmouseleave = () => {\n      tip.style.opacity = "0";\n      hover.setAttribute("width", "0");\n    };\n    const total = buckets.reduce((sum, bucket) => sum + bucket.total, 0);\n    $("traffic-window").textContent = `last ${rangeLabel(state.rangeMs)}`;\n    const served = buckets.reduce((sum, bucket) => sum + bucket.served, 0);\n    const mitigated = buckets.reduce((sum, bucket) => sum + bucket.mitigated, 0);\n    const denied = buckets.reduce((sum, bucket) => sum + bucket.denied, 0);\n    const busiest = buckets.reduce((best, bucket) => bucket.total > best.total ? bucket : best, buckets[0] ?? { at: now, total: 0, served: 0, mitigated: 0, denied: 0 });\n    $("traffic-alt").textContent = `Traffic over the last ${rangeLabel(state.rangeMs)}: ${n(total)} requests \u2014 ${n(served)} served, ${n(mitigated)} mitigated, ${n(denied)} denied. ` + (total === 0 ? "No traffic in this range." : `Busiest ${Math.round(state.rangeMs / BUCKETS / 1e3)}-second interval: ${n(busiest.total)} requests at ${clockTime(busiest.at)}.`) + (changes.length === 0 ? "" : ` ${n(changes.length)} runtime change${changes.length === 1 ? "" : "s"} in this range: ${changes.map((change) => `${change.kind}, ${change.summary}`).join("; ")}.`);\n    const legend = $("traffic-legend");\n    clear(legend);\n    legend.appendChild(el("span", null, `${n(total)} requests in the last ${rangeLabel(state.rangeMs)} \xB7`));\n    const oldest = oldestAt();\n    if (oldest !== void 0 && Date.now() - oldest < state.rangeMs * 0.9) {\n      legend.appendChild(el("span", null, `window holds ${rangeLabel(Date.now() - oldest)} \xB7`));\n    }\n    for (const [label2, colour] of [\n      ["Served", s1],\n      ["Mitigated \u2014 challenged, limited or delayed", s2],\n      ["Denied", crit]\n    ]) {\n      const item = el("span");\n      const swatch = el("span", "swatch");\n      swatch.style.background = colour;\n      item.appendChild(swatch);\n      item.appendChild(document.createTextNode(label2));\n      legend.appendChild(item);\n    }\n    if (changes.length > 0) {\n      const item = el("span");\n      item.appendChild(el("span", "mark"));\n      item.appendChild(document.createTextNode(`${n(changes.length)} runtime change${changes.length === 1 ? "" : "s"} \u2014 hover a marker`));\n      legend.appendChild(item);\n    }\n  }\n  function differences(cumulative) {\n    const counts = [];\n    for (let i = 0; i < cumulative.length; i++) counts.push((cumulative[i] ?? 0) - (i > 0 ? cumulative[i - 1] ?? 0 : 0));\n    return counts;\n  }\n  function drawScores() {\n    const host = $("score-chart");\n    const svg = $("scores");\n    clear(svg);\n    const metrics = state.snapshot?.metrics;\n    const fromRun = state.scoreScope === "run" && metrics !== void 0;\n    let buckets;\n    let scored;\n    let proven;\n    if (fromRun && metrics !== void 0) {\n      buckets = differences(metrics.scores.buckets);\n      scored = metrics.scores.count;\n      proven = metrics.proven;\n    } else {\n      buckets = new Array(SCORE_BOUNDS).fill(0);\n      scored = 0;\n      proven = 0;\n      for (const { entry } of state.rows) {\n        if (entry.bypass !== void 0) continue;\n        if (entry.certain) {\n          proven++;\n          continue;\n        }\n        const index = Math.min(SCORE_BOUNDS - 1, Math.floor(entry.score / 10));\n        buckets[index] = (buckets[index] ?? 0) + 1;\n        scored++;\n      }\n    }\n    const width = Math.max(280, host.clientWidth - 30);\n    const height = 190;\n    const padBottom = 30;\n    const plot = height - padBottom;\n    let max = 1;\n    for (const value of buckets) if (value > max) max = value;\n    svg.setAttribute("viewBox", `0 0 ${width} ${height}`);\n    svg.setAttribute("height", String(height));\n    const fill = css("--s1");\n    const muted = css("--muted");\n    const grid = css("--grid");\n    const crit = css("--crit");\n    svg.appendChild(svgEl("line", { class: "gridline", x1: 0, x2: width, y1: plot, y2: plot, stroke: grid, "stroke-width": 1 }));\n    const step = width / SCORE_BOUNDS;\n    buckets.forEach((value, index) => {\n      const barHeight = value / max * (plot - 8);\n      const barWidth = Math.max(2, Math.min(step - 6, 56));\n      if (barHeight > 0) {\n        svg.appendChild(svgEl("rect", { x: index * step + (step - barWidth) / 2, y: plot - barHeight, width: barWidth, height: barHeight, fill, rx: 3 }));\n      }\n      svg.appendChild(svgText({ x: index * step + 1, y: height - 14, fill: muted, "font-size": 9.5 }, index * 10));\n    });\n    const threshold = state.snapshot?.policy.suspectThreshold ?? 60;\n    const x = threshold / 100 * width;\n    svg.appendChild(svgEl("line", { x1: x, x2: x, y1: 0, y2: plot, stroke: crit, "stroke-width": 2, "stroke-dasharray": "4 3" }));\n    svg.appendChild(svgText({ x: Math.min(width - 92, x + 5), y: 11, fill: crit, "font-size": 10 }, `suspect at ${threshold}`));\n    svg.appendChild(svgText({ x: 0, y: height - 2, fill: muted, "font-size": 10 }, "score (probabilistic requests only)"));\n    const tip = $("score-tip");\n    host.onmousemove = (event) => {\n      const box = svg.getBoundingClientRect();\n      const index = Math.floor((event.clientX - box.left) / box.width * SCORE_BOUNDS);\n      const value = buckets[index];\n      if (value === void 0) {\n        tip.style.opacity = "0";\n        return;\n      }\n      clear(tip);\n      tip.appendChild(el("div", "t", `score ${index * 10}\u2013${index * 10 + 9}`));\n      tip.appendChild(tipRow("requests", n(value)));\n      tip.appendChild(tipRow("share", pct(value, scored)));\n      positionTip(tip, host, event.clientX, box.left);\n    };\n    host.onmouseleave = () => {\n      tip.style.opacity = "0";\n    };\n    let over = 0;\n    for (let bucket = 0; bucket < SCORE_BOUNDS; bucket++) if (bucket * 10 >= threshold) over += buckets[bucket] ?? 0;\n    const legend = $("score-legend");\n    clear(legend);\n    legend.appendChild(el("span", null, `${n(scored)} scored \xB7 ${n(over)} at or over the threshold \xB7 ${n(proven)} proven, which carry no score`));\n    $("score-alt").textContent = `Distribution of probabilistic scores ${fromRun ? "since start" : "in the retained window"}, with the suspect threshold at ${threshold}. ${n(scored)} scored requests, ${n(over)} at or over the threshold, ${n(proven)} proven and therefore unscored. ` + (scored === 0 ? "Nothing scored yet." : `By ten-point band: ${buckets.map((value, index) => `${index * 10}\u2013${index * 10 + 9}: ${n(value)}`).join(", ")}.`);\n    $("score-window").textContent = fromRun ? "since start" : windowLabel(state.rows.length, oldestAt(), Date.now());\n    if (state.scoreScope === "run" && metrics === void 0) {\n      legend.appendChild(el("span", null, "\xB7 counters are off on this handler, so this is the retained window"));\n    }\n  }\n  function drawLatency() {\n    const host = $("latency-chart");\n    const svg = $("latency");\n    clear(svg);\n    const metrics = state.snapshot?.metrics;\n    if (metrics === void 0 || metrics.duration.count === 0) {\n      $("latency-summary").textContent = "No assessments yet.";\n      $("latency-alt").textContent = "Assessment latency: no assessments yet.";\n      svg.setAttribute("viewBox", "0 0 100 40");\n      svg.setAttribute("height", "40");\n      svg.appendChild(svgText({ x: 0, y: 20, fill: css("--muted"), "font-size": 11 }, "No assessments yet."));\n      return;\n    }\n    const cumulative = metrics.duration.buckets;\n    const counts = differences(cumulative);\n    const width = Math.max(280, host.clientWidth - 30);\n    const height = 190;\n    const padBottom = 30;\n    const plot = height - padBottom;\n    let max = 1;\n    for (const value of counts) if (value > max) max = value;\n    svg.setAttribute("viewBox", `0 0 ${width} ${height}`);\n    svg.setAttribute("height", String(height));\n    const fill = css("--s1");\n    const muted = css("--muted");\n    const grid = css("--grid");\n    svg.appendChild(svgEl("line", { class: "gridline", x1: 0, x2: width, y1: plot, y2: plot, stroke: grid, "stroke-width": 1 }));\n    const step = width / counts.length;\n    counts.forEach((value, index) => {\n      const barHeight = value / max * (plot - 6);\n      if (barHeight > 0) {\n        svg.appendChild(svgEl("rect", { x: index * step + 1, y: plot - barHeight, width: Math.max(2, step - 3), height: barHeight, fill, rx: 3 }));\n      }\n      if (index % 2 === 0) {\n        svg.appendChild(svgText({ x: index * step + 1, y: height - 14, fill: muted, "font-size": 9.5 }, index < LATENCY_BOUNDS.length ? String(LATENCY_BOUNDS[index]) : "more"));\n      }\n    });\n    svg.appendChild(svgText({ x: 0, y: height - 2, fill: muted, "font-size": 10 }, "milliseconds (upper bound of each bucket)"));\n    const tip = $("latency-tip");\n    host.onmousemove = (event) => {\n      const box = svg.getBoundingClientRect();\n      const index = Math.floor((event.clientX - box.left) / box.width * counts.length);\n      const value = counts[index];\n      if (value === void 0) {\n        tip.style.opacity = "0";\n        return;\n      }\n      clear(tip);\n      tip.appendChild(el("div", "t", index < LATENCY_BOUNDS.length ? `\u2264 ${LATENCY_BOUNDS[index]}ms` : "over 100ms"));\n      tip.appendChild(tipRow("requests", n(value)));\n      tip.appendChild(tipRow("share", pct(value, metrics.duration.count)));\n      positionTip(tip, host, event.clientX, box.left);\n    };\n    host.onmouseleave = () => {\n      tip.style.opacity = "0";\n    };\n    const mean = metrics.duration.totalMs / metrics.duration.count;\n    const p95 = percentile(cumulative, metrics.duration.count, 0.95);\n    $("latency-summary").textContent = `Time spent in detection, per request \xB7 mean ${ms(mean)} \xB7 p95 ${ms(p95)} \xB7 max ${ms(metrics.duration.maxMs)}`;\n    $("latency-alt").textContent = `Assessment latency since start over ${n(metrics.duration.count)} requests: mean ${ms(mean)}, 95th percentile ${ms(p95)}, maximum ${ms(metrics.duration.maxMs)}. By bucket: ${counts.map((value, index) => `${index < LATENCY_BOUNDS.length ? `up to ${LATENCY_BOUNDS[index]}ms` : "over 100ms"}: ${n(value)}`).join(", ")}.`;\n  }\n  function percentile(cumulative, count, fraction) {\n    const target = count * fraction;\n    const last = LATENCY_BOUNDS[LATENCY_BOUNDS.length - 1] ?? 100;\n    for (let i = 0; i < cumulative.length; i++) {\n      if ((cumulative[i] ?? 0) >= target) return i < LATENCY_BOUNDS.length ? LATENCY_BOUNDS[i] ?? last : last;\n    }\n    return last;\n  }\n\n  // src/dashboard/client/registry.ts\n  var timer;\n  async function loadActors() {\n    if (!SECTIONS.registry) return;\n    try {\n      const body = await getJson(`/api/actors?limit=${state.actorsPageSize}&offset=${state.actorsPage * state.actorsPageSize}`);\n      state.actors = body.actors;\n      state.actorsTracked = body.tracked;\n      drawActors();\n    } catch {\n    }\n  }\n  function trackActors() {\n    if (timer !== void 0) clearInterval(timer);\n    timer = void 0;\n    if (state.tab !== "actors") return;\n    void loadActors();\n    timer = setInterval(() => {\n      if (state.tab !== "actors" || state.paused || isConfirming()) return;\n      void loadActors();\n    }, 4e3);\n  }\n  var ACTORS_PAGE_SIZES = [25, 50, 100, 200];\n  function drawActorsPager(full) {\n    const page = state.actorsPage;\n    const hidden = page === 0 && !full;\n    const from = page * state.actorsPageSize + 1;\n    const model = {\n      page,\n      from,\n      to: from + state.actors.length - 1,\n      total: state.actorsTracked,\n      atStart: page === 0,\n      atEnd: !full,\n      go: (next) => {\n        state.actorsPage = Math.max(0, next);\n        void loadActors();\n      },\n      size: {\n        current: state.actorsPageSize,\n        choices: ACTORS_PAGE_SIZES,\n        set: (next) => {\n          state.actorsPageSize = next;\n          state.actorsPage = 0;\n          void loadActors();\n        }\n      }\n    };\n    for (const [id, withSize] of [\n      ["actors-pager-top", true],\n      ["actors-pager", false]\n    ]) {\n      const host = $(id);\n      host.hidden = hidden;\n      if (hidden) clear(host);\n      else renderPager(host, model, { withSize });\n    }\n  }\n  function drawActors() {\n    if (!SECTIONS.registry) return;\n    if (isConfirming()) return;\n    const body = byId("actor-rows");\n    clear(body);\n    const actors = state.actors;\n    $("actors-count").textContent = `${n(actors.length)} shown \xB7 ${n(state.actorsTracked)} tracked`;\n    drawActorsPager(actors.length === state.actorsPageSize);\n    byId("actors-empty").hidden = actors.length > 0;\n    for (const actor of actors) {\n      const row = el("tr");\n      row.appendChild(el("td", "who", actor.key));\n      row.appendChild(el("td", "num tnum", n(actor.requests)));\n      row.appendChild(el("td", "num tnum", n(actor.recentRate)));\n      row.appendChild(el("td", "num tnum", n(actor.distinctPaths)));\n      const cadence = el("td", "num tnum", actor.cadenceCv === void 0 ? "\u2014" : actor.cadenceCv.toFixed(2));\n      if (actor.cadenceCv !== void 0 && actor.cadenceCv < 0.15) cadence.className += " warn-text";\n      row.appendChild(cadence);\n      row.appendChild(el("td", "num tnum", n(actor.priorConfirmations)));\n      const unsolved = el("td", "num tnum", n(actor.unsolvedChallenges));\n      if (actor.unsolvedChallenges >= 3) unsolved.className += " warn-text";\n      row.appendChild(unsolved);\n      const stateCell = el("td");\n      const tags = [];\n      if (actor.cleared) tags.push("cleared as human");\n      if (actor.distinctUserAgents > 1) tags.push(`${actor.distinctUserAgents} User-Agents`);\n      tags.push(`first seen ${clockStamp(actor.firstSeen)}`);\n      stateCell.appendChild(el("div", "tagline", tags.join(" \xB7 ")));\n      row.appendChild(stateCell);\n      const actions = el("td", "acts");\n      const inFeed = el("button", null, "In feed");\n      inFeed.title = "Show this actor\'s requests in the live feed";\n      inFeed.addEventListener("click", () => {\n        setSearch(`actor:${actor.key}`);\n        const search = byId("search");\n        search.value = state.search;\n        app.showTab("live");\n        app.syncUrl();\n      });\n      actions.appendChild(inFeed);\n      for (const button of actorActions(actor.key, () => void loadActors())) actions.appendChild(button);\n      row.appendChild(actions);\n      body.appendChild(row);\n    }\n  }\n\n  // src/dashboard/client/tester.ts\n  function initTester() {\n    if (!SECTIONS.tester) return;\n    $("test-run").addEventListener("click", () => void run());\n    byId("test-input").addEventListener("keydown", (event) => {\n      if (event.key === "Enter" && (event.metaKey || event.ctrlKey)) {\n        event.preventDefault();\n        void run();\n      }\n    });\n  }\n  async function run() {\n    const raw2 = byId("test-input").value;\n    if (raw2.trim() === "") {\n      toast("warn", "Nothing to assess", "Paste a User-Agent, a curl command, or a header block.");\n      return;\n    }\n    const result = await postJson("/api/test", {\n      raw: raw2,\n      ip: byId("test-ip").value.trim(),\n      url: byId("test-url").value.trim()\n    });\n    const box = $("test-result");\n    box.hidden = false;\n    clear(box);\n    if (!result.ok) {\n      box.className = "result bad";\n      box.appendChild(el("div", null, result.error ?? "The server could not read that."));\n      return;\n    }\n    const { entry, reason, assumed } = result.data;\n    const out = outcome(entry);\n    box.className = `result ${out === "deny" ? "bad" : out === "mitigate" ? "warn" : "ok"}`;\n    const head = el("div");\n    const [badgeClass, badgeLabel] = verdictBadge(entry);\n    head.appendChild(el("span", `badge ${badgeClass}`, badgeLabel));\n    head.appendChild(document.createTextNode(" "));\n    head.appendChild(el("b", null, entry.action ?? "no decision"));\n    if (entry.rule !== void 0) head.appendChild(el("span", "ev-meta", ` via ${entry.rule}`));\n    box.appendChild(head);\n    box.appendChild(el("div", "ev-meta", `${entry.certain ? "proven" : `score ${entry.score}`} \xB7 assessed in ${ms(entry.durationMs)}`));\n    if (entry.downgradedFrom !== void 0) {\n      box.appendChild(el("div", "guard", `The guard stopped ${entry.downgradedFrom} here.`));\n      if (entry.downgradeReason !== void 0) box.appendChild(el("div", "basis", entry.downgradeReason));\n    }\n    if (entry.evidence.length === 0) {\n      box.appendChild(el("div", "ev-meta", entry.bypass !== void 0 ? `Detection was skipped: ${entry.bypass}.` : "No detector produced any evidence."));\n    } else {\n      const list = el("div", "ev");\n      for (const item of entry.evidence) {\n        const row = el("div", `ev-item${item.direction === "human" ? " human" : ""}`);\n        row.appendChild(el("div", `tier t-${item.certainty}`, item.certainty));\n        const detail = el("div");\n        detail.appendChild(el("div", null, item.summary));\n        detail.appendChild(el("div", "ev-meta", `${item.detector} \xB7 points to ${item.direction}`));\n        if (item.deterministicBasis !== void 0) detail.appendChild(el("div", "basis", item.deterministicBasis));\n        row.appendChild(detail);\n        list.appendChild(row);\n      }\n      box.appendChild(list);\n    }\n    box.appendChild(el("div", "ev-meta", reason));\n    const notes = [...assumed, "no history: this is assessed as a first request, so cadence and crawl breadth have nothing to read"];\n    box.appendChild(el("div", "assumed", `Assumed \u2014 ${notes.join("; ")}.`));\n  }\n\n  // src/dashboard/client/index.ts\n  var TABS = [\n    ["tab-live", "live", SECTIONS.feed],\n    ["tab-actors", "actors", SECTIONS.registry],\n    ["tab-stats", "stats", SECTIONS.statistics],\n    ["tab-policy", "policy", SECTIONS.policy]\n  ];\n  var available = TABS.filter(([, , enabled]) => enabled);\n  var FIRST = available[0]?.[1] ?? "live";\n  function tabIndexOf(name) {\n    const at = available.findIndex(([, tab]) => tab === name);\n    return at === -1 ? 0 : at;\n  }\n  function isTab(value) {\n    return available.some(([, name]) => name === value);\n  }\n  function initSkipLink() {\n    if (!isEmbedded()) return;\n    const skip = rootNode().querySelector("a.skip");\n    if (skip === null) return;\n    skip.addEventListener("click", (event) => {\n      event.preventDefault();\n      const target = rootNode().querySelector(`#view-${state.tab}`) ?? rootNode().querySelector("#view-live");\n      if (target === null) return;\n      target.tabIndex = -1;\n      target.focus();\n      target.scrollIntoView({ block: "start" });\n    });\n  }\n  function initHeader() {\n    const box = $("links");\n    for (const link of BOOT.links) {\n      const anchor = el("a", "linkbtn", link.label);\n      anchor.href = link.href;\n      anchor.rel = "noreferrer noopener";\n      box.appendChild(anchor);\n    }\n    let stored = null;\n    try {\n      stored = localStorage.getItem("bothandler-dashboard-theme");\n    } catch {\n      stored = null;\n    }\n    if (stored === "dark" || stored === "light") themeElement().setAttribute("data-theme", stored);\n    $("theme").addEventListener("click", () => {\n      let current = themeElement().getAttribute("data-theme");\n      if (current === null) current = matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light";\n      const next = current === "dark" ? "light" : "dark";\n      themeElement().setAttribute("data-theme", next);\n      try {\n        localStorage.setItem("bothandler-dashboard-theme", next);\n      } catch {\n      }\n      drawNow();\n    });\n    const pause = byId("pause");\n    pause.hidden = !SECTIONS.feed;\n    pause.addEventListener("click", () => {\n      state.paused = !state.paused;\n      pause.setAttribute("aria-pressed", String(state.paused));\n      pause.textContent = state.paused ? `Resume${state.bufferedWhilePaused > 0 ? ` (${state.bufferedWhilePaused})` : ""}` : "Pause";\n      if (!state.paused) {\n        state.bufferedWhilePaused = 0;\n        drawNow();\n      }\n    });\n    if (BOOT.allowReset) {\n      const reset = byId("reset");\n      reset.hidden = false;\n      reset.addEventListener("click", () => {\n        reset.disabled = true;\n        void fetch(`${API}/api/reset`, { method: "POST", headers: { "content-type": "application/json" }, body: "{}" }).then(async (response) => {\n          if (!response.ok) {\n            const body = await response.json().catch(() => ({}));\n            toast("bad", "Reset refused", body.error ?? String(response.status));\n            return;\n          }\n          clearFeed();\n          resetFeedCache();\n          drawNow();\n        }).catch(() => {\n        }).finally(() => {\n          reset.disabled = false;\n        });\n      });\n    }\n    const header = rootNode().querySelector("header");\n    if (header !== null) {\n      const apply = () => {\n        themeElement().style.setProperty("--header-h", `${header.getBoundingClientRect().height}px`);\n      };\n      apply();\n      if (typeof ResizeObserver === "function") new ResizeObserver(apply).observe(header);\n      else addEventListener("resize", apply);\n    }\n  }\n  function syncUrl(replace = true) {\n    if (isEmbedded()) return;\n    const params = new URLSearchParams();\n    if (state.filter !== "all") params.set("f", state.filter);\n    if (state.search !== "") params.set("q", state.search);\n    const query = params.toString();\n    const hash = `#${state.tab}${query === "" ? "" : `?${query}`}`;\n    if (location.hash === hash) return;\n    history[replace ? "replaceState" : "pushState"]({ tab: state.tab }, "", hash);\n  }\n  function readUrl() {\n    const raw2 = isEmbedded() ? "" : location.hash.slice(1);\n    const split = raw2.indexOf("?");\n    const name = split === -1 ? raw2 : raw2.slice(0, split);\n    const params = new URLSearchParams(split === -1 ? "" : raw2.slice(split + 1));\n    const filter = params.get("f") ?? "all";\n    return {\n      tab: isTab(name) ? name : FIRST,\n      filter,\n      search: params.get("q") ?? ""\n    };\n  }\n  function showTab(name, options = {}) {\n    const target = isTab(name) ? name : FIRST;\n    state.tab = target;\n    for (const [id, tab, enabled] of TABS) {\n      const selected = tab === target;\n      const node = $(id);\n      node.hidden = !enabled;\n      node.setAttribute("aria-selected", String(selected));\n      node.tabIndex = selected ? 0 : -1;\n      $(`view-${tab}`).hidden = !selected || !enabled;\n    }\n    if (options.focus === true) $(available[tabIndexOf(target)]?.[0] ?? "tab-live").focus();\n    if (target === "policy" && state.policy === void 0) {\n      void loadPolicy();\n      void loadRanges();\n    }\n    trackActors();\n    if (options.push !== false) syncUrl(options.replace !== false);\n    drawNow();\n  }\n  function initTabs() {\n    available.forEach(([id, name], index) => {\n      const tab = $(id);\n      tab.addEventListener("click", () => showTab(name, { replace: false }));\n      tab.addEventListener("keydown", (event) => {\n        let next = -1;\n        if (event.key === "ArrowRight") next = (index + 1) % available.length;\n        else if (event.key === "ArrowLeft") next = (index - 1 + available.length) % available.length;\n        else if (event.key === "Home") next = 0;\n        else if (event.key === "End") next = available.length - 1;\n        if (next === -1) return;\n        event.preventDefault();\n        showTab(available[next]?.[1] ?? FIRST, { focus: true, replace: false });\n      });\n    });\n    if (isEmbedded()) return;\n    addEventListener("popstate", () => {\n      const url = readUrl();\n      state.filter = url.filter;\n      setSearch(url.search);\n      reflectFilterButtons();\n      showTab(url.tab, { push: false });\n    });\n  }\n  function initKeyboard() {\n    eventTarget().addEventListener("keydown", ((event) => {\n      const target = event.target;\n      const typing = target !== null && (target.tagName === "INPUT" || target.tagName === "TEXTAREA" || target.tagName === "SELECT");\n      if (event.key === "Escape") {\n        if (typing && target?.id === "search" && target.value !== "") {\n          target.value = "";\n          setSearch("");\n          syncUrl();\n          drawNow();\n          return;\n        }\n        if (typing) {\n          target?.blur();\n          return;\n        }\n        if (state.actor !== void 0) {\n          state.actor = void 0;\n          drawNow();\n          return;\n        }\n        if (state.open.size > 0) {\n          state.open.clear();\n          drawNow();\n        }\n        return;\n      }\n      if (typing || event.metaKey || event.ctrlKey || event.altKey) return;\n      if (event.key === "/" && SECTIONS.feed) {\n        event.preventDefault();\n        showTab("live");\n        const search = byId("search");\n        search.focus();\n        search.select();\n        return;\n      }\n      const digit = ["1", "2", "3", "4"].indexOf(event.key);\n      if (digit !== -1 && digit < available.length) {\n        event.preventDefault();\n        showTab(available[digit]?.[1] ?? FIRST, { focus: true, replace: false });\n      }\n    }));\n  }\n  function initRanges() {\n    const ranges = [\n      ["1m", 6e4],\n      ["5m", 3e5],\n      ["15m", 9e5],\n      ["1h", 36e5]\n    ];\n    const host = $("traffic-range");\n    for (const [label2, value] of ranges) {\n      const button = el("button", null, label2);\n      button.setAttribute("aria-pressed", String(value === state.rangeMs));\n      button.addEventListener("click", () => {\n        state.rangeMs = value;\n        for (const other of Array.from(host.children)) other.setAttribute("aria-pressed", "false");\n        button.setAttribute("aria-pressed", "true");\n        drawTraffic();\n      });\n      host.appendChild(button);\n    }\n    const scopes = [\n      ["since start", "run"],\n      ["this window", "window"]\n    ];\n    const scopeHost = $("score-scope");\n    for (const [label2, value] of scopes) {\n      const button = el("button", null, label2);\n      button.setAttribute("aria-pressed", String(value === state.scoreScope));\n      button.addEventListener("click", () => {\n        state.scoreScope = value;\n        for (const other of Array.from(scopeHost.children)) other.setAttribute("aria-pressed", "false");\n        button.setAttribute("aria-pressed", "true");\n        drawScores();\n      });\n      scopeHost.appendChild(button);\n    }\n  }\n  var pending = false;\n  function schedule() {\n    if (state.paused || pending) return;\n    pending = true;\n    requestAnimationFrame(() => {\n      pending = false;\n      draw();\n    });\n  }\n  function draw() {\n    drawChips();\n    drawTiles();\n    drawNoticeBadge();\n    updateWindowLabels();\n    if (state.tab === "live") {\n      drawActor();\n      drawFeed();\n      drawLivePanels();\n    } else if (state.tab === "actors") {\n      drawActors();\n    } else if (state.tab === "stats") {\n      drawTraffic();\n      drawLatency();\n      drawScores();\n      drawStatsPanels();\n      if (SECTIONS.audit) drawAudit();\n    } else {\n      drawPolicyTab();\n      if (SECTIONS.notices) drawNotices();\n      if (SECTIONS.changes) drawChanges();\n    }\n  }\n  function drawNow() {\n    draw();\n  }\n  function applySections() {\n    const gated = [\n      ["tiles", SECTIONS.statistics],\n      ["tester-panel", SECTIONS.tester],\n      ["ranges-panel", SECTIONS.ranges],\n      ["changes-panel", SECTIONS.changes],\n      ["actor-panel", SECTIONS.actors],\n      ["live-actors-panel", SECTIONS.actors],\n      ["audit-panel", SECTIONS.audit],\n      ["audit-checks-panel", SECTIONS.audit],\n      ["notices-panel", SECTIONS.notices],\n      ["guard-panel", SECTIONS.guard],\n      ["robots-panel", SECTIONS.robots],\n      ["identities-panel", SECTIONS.actors],\n      ["evidence-legend", SECTIONS.evidence]\n    ];\n    for (const [id, enabled] of gated) {\n      const node = rootNode().querySelector(`#${id}`);\n      if (node !== null && !enabled) node.remove();\n    }\n  }\n  function start() {\n    app.draw = schedule;\n    app.drawNow = drawNow;\n    app.showTab = showTab;\n    app.syncUrl = () => syncUrl();\n    applySections();\n    initHeader();\n    drawPeers();\n    initTabs();\n    initSkipLink();\n    initKeyboard();\n    initRanges();\n    if (SECTIONS.feed) initFeed();\n    initActor();\n    initTester();\n    initPolicy();\n    let resizeTimer;\n    addEventListener("resize", () => {\n      if (resizeTimer !== void 0) clearTimeout(resizeTimer);\n      resizeTimer = setTimeout(() => {\n        if (state.tab === "stats") {\n          drawTraffic();\n          drawLatency();\n          drawScores();\n        }\n      }, 120);\n    });\n    const url = readUrl();\n    state.filter = url.filter;\n    setSearch(url.search);\n    if (SECTIONS.feed) reflectFilterButtons();\n    showTab(url.tab, { replace: true });\n    suspendScrollAnchoring();\n    void loadInitialSnapshot().finally(settleScrollAnchoring);\n    connectStream();\n  }\n  function htmlElement() {\n    const root2 = rootNode();\n    return root2 instanceof Document ? root2.documentElement : void 0;\n  }\n  function suspendScrollAnchoring() {\n    htmlElement()?.classList.add("settling");\n  }\n  function settleScrollAnchoring() {\n    const html = htmlElement();\n    if (html === void 0) return;\n    requestAnimationFrame(() => {\n      requestAnimationFrame(() => {\n        html.classList.remove("settling");\n      });\n    });\n  }\n  start();\n})();\n';
+    CLIENT_SCRIPT = '"use strict";\n(() => {\n  // src/dashboard/client/css.ts\n  function cssEscape(value) {\n    return typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(value) : String(value).replace(/[^\\w-]/g, "\\\\$&");\n  }\n\n  // src/dashboard/client/dom.ts\n  function el(tag, className, value) {\n    const node = document.createElement(tag);\n    if (className !== void 0 && className !== null && className !== "") node.className = className;\n    if (value !== void 0 && value !== null) node.textContent = String(value);\n    return node;\n  }\n  function svgEl(name, attributes = {}) {\n    const node = document.createElementNS("http://www.w3.org/2000/svg", name);\n    for (const [key, value] of Object.entries(attributes)) node.setAttribute(key, String(value));\n    return node;\n  }\n  function svgText(attributes, text) {\n    const node = svgEl("text", attributes);\n    node.textContent = String(text);\n    return node;\n  }\n  function clear(node) {\n    while (node.firstChild) node.removeChild(node.firstChild);\n  }\n  var root = typeof document === "undefined" ? void 0 : document;\n  var themeHost = typeof document === "undefined" ? void 0 : document.documentElement;\n  var embedded = false;\n  function isEmbedded() {\n    return embedded;\n  }\n  function eventTarget() {\n    return embedded ? root : globalThis;\n  }\n  function rootNode() {\n    return root;\n  }\n  function themeElement() {\n    return themeHost;\n  }\n  function $(id) {\n    const node = root.querySelector(`#${cssEscape(id)}`);\n    if (node === null || node === void 0) throw new Error(`dashboard: no element #${id}`);\n    return node;\n  }\n  function byId(id) {\n    return $(id);\n  }\n  function css(name) {\n    return getComputedStyle(themeHost).getPropertyValue(name).trim();\n  }\n  var sequence = 0;\n  function label(text, control) {\n    const node = document.createElement("label");\n    node.textContent = text;\n    const single = Array.isArray(control) ? control.length === 1 ? control[0] : void 0 : control;\n    if (single !== void 0 && /^(input|select|textarea)$/i.test(single.tagName)) {\n      if (single.id === "") single.id = `field-${++sequence}`;\n      node.htmlFor = single.id;\n    } else {\n      const group = Array.isArray(control) ? control : [control];\n      for (const node_ of group) if (!node_.hasAttribute("aria-label")) node_.setAttribute("aria-label", text);\n    }\n    return node;\n  }\n\n  // src/dashboard/client/boot.ts\n  var FALLBACK = {\n    base: "",\n    title: "bothandlerjs",\n    allowReset: false,\n    allowEdit: false,\n    allowGuardEdit: false,\n    allowActing: false,\n    peers: [],\n    sections: { feed: true, evidence: true, actors: true, registry: true, tester: true, statistics: true, audit: true, notices: true, changes: true, policy: true, guard: true, robots: true, ranges: true },\n    links: []\n  };\n  var BOOT = globalThis.__BOOTSTRAP__ ?? FALLBACK;\n  var API = BOOT.base;\n  var SECTIONS = BOOT.sections;\n\n  // src/dashboard/client/app.ts\n  var app = {\n    draw: () => {\n    },\n    drawNow: () => {\n    },\n    showTab: () => {\n    },\n    syncUrl: () => {\n    }\n  };\n  function toast(kind, title, detail = "") {\n    const node = el("div", `toast ${kind}`);\n    node.appendChild(el("b", null, title));\n    if (detail !== "") node.appendChild(el("span", null, detail));\n    const host = rootNode().querySelector("#toasts");\n    if (host === null) return;\n    host.appendChild(node);\n    setTimeout(() => node.remove(), 6e3);\n  }\n  function download(text, filename, type) {\n    const blob = new Blob([text], { type });\n    const url = URL.createObjectURL(blob);\n    const anchor = el("a");\n    anchor.href = url;\n    anchor.download = filename;\n    anchor.click();\n    setTimeout(() => URL.revokeObjectURL(url), 1e3);\n  }\n  function today() {\n    return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);\n  }\n\n  // src/dashboard/client/outcome.ts\n  var DENY = /* @__PURE__ */ new Set(["block", "drop", "redirect"]);\n  var MITIGATE = /* @__PURE__ */ new Set(["challenge", "rate-limit", "delay"]);\n  function outcome(entry) {\n    return actionKind(entry.action);\n  }\n  function actionKind(action) {\n    if (action === void 0) return "pending";\n    if (DENY.has(action)) return "deny";\n    if (MITIGATE.has(action)) return "mitigate";\n    return "allow";\n  }\n  function verdictBadge(entry) {\n    if (entry.verdict === "verified-bot" || entry.verdict === "confirmed-bot") return ["b-proven", entry.verdict];\n    if (entry.verdict === "suspected-bot") return ["b-suspected", "suspected-bot"];\n    if (entry.verdict === "human") return ["b-human", "human"];\n    return ["b-unknown", entry.bypass !== void 0 ? `skipped \xB7 ${entry.bypass}` : "unknown"];\n  }\n  function provenBots(verdicts) {\n    return (verdicts["confirmed-bot"] ?? 0) + (verdicts["verified-bot"] ?? 0);\n  }\n\n  // src/dashboard/client/query.ts\n  var FIELDS = {\n    path: "path",\n    url: "path",\n    actor: "actor",\n    ip: "actor",\n    ua: "userAgent",\n    useragent: "userAgent",\n    agent: "userAgent",\n    verdict: "verdict",\n    action: "action",\n    rule: "rule",\n    detector: "detector",\n    identity: "identity",\n    method: "method",\n    class: "botClass",\n    botclass: "botClass",\n    id: "requestId",\n    request: "requestId",\n    bypass: "bypass",\n    score: "score",\n    outcome: "outcome",\n    certain: "certain"\n  };\n  var NUMERIC = /* @__PURE__ */ new Set(["score"]);\n  var FIELD_NAMES = Object.keys(FIELDS).sort();\n  var FIELD_VALUES = {\n    verdict: ["confirmed-bot", "verified-bot", "suspected-bot", "human", "unknown"],\n    class: ["scanner", "scraper", "impersonator", "automation", "http-client", "declared-bot", "verified-bot", "human", "unknown"],\n    botclass: ["scanner", "scraper", "impersonator", "automation", "http-client", "declared-bot", "verified-bot", "human", "unknown"],\n    action: ["allow", "tag", "log", "challenge", "rate-limit", "delay", "block", "drop", "redirect"],\n    outcome: ["allow", "mitigate", "deny", "pending"],\n    certain: ["true", "false"],\n    method: ["GET", "POST", "HEAD", "PUT", "PATCH", "DELETE", "OPTIONS"]\n  };\n  function suggestFor(input, caret) {\n    const before = input.slice(0, caret);\n    const start2 = Math.max(before.lastIndexOf(" ") + 1, 0);\n    const token = before.slice(start2);\n    const to = caret;\n    const negated = token.startsWith("-") || token.startsWith("!");\n    const body = negated ? token.slice(1) : token;\n    const colon = body.indexOf(":");\n    if (colon === -1) {\n      const partial2 = body.toLowerCase();\n      if (partial2.startsWith("$")) {\n        return { options: OPERATORS.filter((name) => name.startsWith(partial2)), from: start2, to };\n      }\n      const options2 = FIELD_NAMES.filter((name) => name.startsWith(partial2)).map((name) => `${negated ? token[0] : ""}${name}:`);\n      return { options: options2, from: start2, to };\n    }\n    const field2 = body.slice(0, colon).toLowerCase();\n    const values = FIELD_VALUES[field2];\n    if (values === void 0) return { options: [], from: start2, to };\n    const partial = body.slice(colon + 1).toLowerCase();\n    const prefix = `${negated ? token[0] : ""}${field2}:`;\n    const forms = partial.startsWith("$") ? ["$in(", "$notin("].filter((form) => form.startsWith(partial)).map((form) => `${prefix}${form}`) : [];\n    const options = [...forms, ...values.filter((value) => value.toLowerCase().startsWith(partial)).map((value) => `${prefix}${value}`)];\n    return { options, from: start2, to };\n  }\n  var OPERATORS = ["$and", "$or", "$not", "$in", "$notin"];\n  var MAX_GROUP_DEPTH = 32;\n  function tokenize(input) {\n    const tokens = [];\n    let current = "";\n    let quoted = false;\n    let depth = 0;\n    const flush = () => {\n      if (current === "") return;\n      const lower = current.toLowerCase();\n      if (lower === "$and" || lower === "$or" || lower === "$not") tokens.push({ kind: "op", op: lower.slice(1) });\n      else tokens.push({ kind: "word", text: current });\n      current = "";\n    };\n    for (let i = 0; i < input.length; i++) {\n      const character = input[i];\n      if (character === \'"\') {\n        quoted = !quoted;\n        continue;\n      }\n      if (quoted) {\n        current += character;\n        continue;\n      }\n      if (depth > 0) {\n        current += character;\n        if (character === "(") depth++;\n        else if (character === ")") {\n          depth--;\n          if (depth === 0) flush();\n        }\n        continue;\n      }\n      if (character === "(") {\n        if (/\\$(in|notin)$/i.test(current)) {\n          current += character;\n          depth = 1;\n          continue;\n        }\n        flush();\n        tokens.push({ kind: "open" });\n        continue;\n      }\n      if (character === ")") {\n        flush();\n        tokens.push({ kind: "close" });\n        continue;\n      }\n      if (/\\s/.test(character)) {\n        flush();\n        continue;\n      }\n      current += character;\n    }\n    flush();\n    return tokens;\n  }\n  function toTerm(word) {\n    const negated = word.startsWith("-") || word.startsWith("!");\n    const body = negated ? word.slice(1) : word;\n    if (body === "") return void 0;\n    const colon = body.indexOf(":");\n    const name = colon === -1 ? "" : body.slice(0, colon).toLowerCase();\n    const field2 = FIELDS[name];\n    if (colon === -1 || field2 === void 0) return { field: void 0, value: body.toLowerCase(), negated };\n    const rest = body.slice(colon + 1);\n    const set = /^\\$(in|notin)\\(([\\s\\S]*)$/i.exec(rest);\n    if (set !== null) {\n      const inside = set[2].endsWith(")") ? set[2].slice(0, -1) : set[2];\n      const values = inside.split(",").map((entry) => entry.trim().toLowerCase()).filter((entry) => entry !== "");\n      const inverted = set[1].toLowerCase() === "notin";\n      return { field: field2, value: values[0] ?? "", negated: negated !== inverted, values };\n    }\n    let value = rest.toLowerCase();\n    let compare;\n    if (NUMERIC.has(field2)) {\n      compare = value.startsWith(">") ? ">" : value.startsWith("<") ? "<" : "=";\n      if (compare !== "=") value = value.slice(1);\n    }\n    if (value === "") return void 0;\n    return { field: field2, value, negated, compare };\n  }\n  function parseTokens(tokens) {\n    let at = 0;\n    let depth = 0;\n    const parseUnary = () => {\n      const token = tokens[at];\n      if (token === void 0) return void 0;\n      if (token.kind === "op" && token.op === "not") {\n        at++;\n        const of = parseUnary();\n        return of === void 0 ? void 0 : { kind: "not", of };\n      }\n      if (token.kind === "open") {\n        at++;\n        if (depth >= MAX_GROUP_DEPTH) return void 0;\n        depth++;\n        const inner = parseOr();\n        depth--;\n        if (tokens[at]?.kind === "close") at++;\n        return inner.kind === "all" ? void 0 : inner;\n      }\n      if (token.kind === "close") return void 0;\n      if (token.kind === "op") {\n        at++;\n        return parseUnary();\n      }\n      at++;\n      const term = toTerm(token.text);\n      return term === void 0 ? void 0 : { kind: "term", term };\n    };\n    const parseAnd = () => {\n      const parts = [];\n      while (at < tokens.length) {\n        const token = tokens[at];\n        if (token === void 0 || token.kind === "close") break;\n        if (token.kind === "op" && token.op === "or") break;\n        if (token.kind === "op" && token.op === "and") {\n          at++;\n          continue;\n        }\n        const before = at;\n        const part = parseUnary();\n        if (part !== void 0) parts.push(part);\n        if (at === before) at++;\n      }\n      return parts.length === 0 ? { kind: "all" } : parts.length === 1 ? parts[0] : { kind: "and", parts };\n    };\n    const parseOr = () => {\n      const parts = [parseAnd()];\n      while (tokens[at]?.kind === "op" && tokens[at].op === "or") {\n        at++;\n        parts.push(parseAnd());\n      }\n      const real = parts.filter((part) => part.kind !== "all");\n      if (real.length === 0) return { kind: "all" };\n      return real.length === 1 ? real[0] : { kind: "or", parts: real };\n    };\n    return parseOr();\n  }\n  var MAX_QUERY_CHARS = 8192;\n  function parseFilter(input) {\n    const trimmed = input.trim();\n    return parseTokens(tokenize(trimmed.length > MAX_QUERY_CHARS ? trimmed.slice(0, MAX_QUERY_CHARS) : trimmed));\n  }\n  function searchableText(entry) {\n    const parts = [\n      entry.method,\n      entry.path,\n      entry.actor,\n      entry.userAgent,\n      entry.verdict,\n      entry.botClass,\n      entry.identity ?? "",\n      entry.action ?? "",\n      entry.rule ?? "",\n      entry.requestId\n    ];\n    for (const item of entry.evidence) parts.push(item.detector, item.summary);\n    return parts.join(" ").toLowerCase();\n  }\n  function fieldValue(entry, field2) {\n    switch (field2) {\n      case "path":\n        return entry.path;\n      case "actor":\n        return entry.actor;\n      case "userAgent":\n        return entry.userAgent;\n      case "verdict":\n        return entry.verdict;\n      case "action":\n        return entry.action ?? "";\n      case "rule":\n        return entry.rule ?? "";\n      case "identity":\n        return entry.identity ?? "";\n      case "method":\n        return entry.method;\n      case "botClass":\n        return entry.botClass;\n      case "requestId":\n        return entry.requestId;\n      case "bypass":\n        return entry.bypass ?? "";\n      case "outcome":\n        return outcome(entry);\n      case "certain":\n        return String(entry.certain);\n      case "detector":\n        return entry.evidence.map((item) => item.detector).join(" ");\n      default:\n        return "";\n    }\n  }\n  function matchesTerm(term, entry, haystack) {\n    if (term.field === void 0) return haystack.includes(term.value);\n    if (term.values !== void 0) {\n      if (term.values.length === 0) return false;\n      const actual = fieldValue(entry, term.field).toLowerCase();\n      return term.values.some((value) => actual.includes(value));\n    }\n    if (term.field === "score") {\n      const wanted = Number(term.value);\n      if (Number.isNaN(wanted)) return false;\n      if (term.compare === ">") return entry.score > wanted;\n      if (term.compare === "<") return entry.score < wanted;\n      return entry.score === wanted;\n    }\n    return fieldValue(entry, term.field).toLowerCase().includes(term.value);\n  }\n  function matches(filter, entry, haystack) {\n    switch (filter.kind) {\n      case "all":\n        return true;\n      case "term":\n        return matchesTerm(filter.term, entry, haystack) !== filter.term.negated;\n      case "not":\n        return !matches(filter.of, entry, haystack);\n      case "and":\n        return filter.parts.every((part) => matches(part, entry, haystack));\n      case "or":\n        return filter.parts.some((part) => matches(part, entry, haystack));\n    }\n  }\n  function matchesFilter(filter, entry) {\n    switch (filter) {\n      case "proven":\n        return entry.certain;\n      case "suspected":\n        return entry.verdict === "suspected-bot";\n      case "human":\n        return entry.verdict === "human";\n      case "guard":\n        return entry.downgradedFrom !== void 0;\n      case "deny":\n        return outcome(entry) === "deny";\n      case "mitigate":\n        return outcome(entry) === "mitigate";\n      case "allow":\n        return outcome(entry) === "allow";\n      default:\n        return true;\n    }\n  }\n\n  // src/dashboard/client/store.ts\n  var MAX_ROWS = 1e3;\n  var state = {\n    rows: [],\n    byId: /* @__PURE__ */ new Map(),\n    snapshot: void 0,\n    policy: void 0,\n    actors: [],\n    actorsTracked: 0,\n    actorScope: "tracked",\n    paused: false,\n    filter: "all",\n    search: "",\n    query: { kind: "all" },\n    tab: "live",\n    open: /* @__PURE__ */ new Set(),\n    actor: void 0,\n    rangeMs: 3e5,\n    scoreScope: "run",\n    editorRules: [],\n    editorDirty: false,\n    editorMode: "gui",\n    guardDirty: false,\n    bufferedWhilePaused: 0,\n    laggedDrops: 0,\n    feedPage: 0,\n    feedFrozen: void 0,\n    actorsPage: 0,\n    feedPageSize: 50,\n    actorsPageSize: 25,\n    fromMs: void 0,\n    toMs: void 0,\n    caughtUp: 0\n  };\n  function ingest(entry) {\n    const existing = state.byId.get(entry.requestId);\n    if (existing !== void 0) {\n      existing.entry = entry;\n      existing.rev++;\n      existing.text = void 0;\n      return;\n    }\n    const row = { entry, rev: 0 };\n    state.byId.set(entry.requestId, row);\n    state.rows.push(row);\n    if (state.rows.length > MAX_ROWS) {\n      for (const dropped of state.rows.splice(0, state.rows.length - MAX_ROWS)) {\n        state.byId.delete(dropped.entry.requestId);\n        state.open.delete(dropped.entry.requestId);\n      }\n    }\n  }\n  function clearFeed() {\n    state.rows = [];\n    state.byId = /* @__PURE__ */ new Map();\n    state.open.clear();\n    state.actor = void 0;\n    state.bufferedWhilePaused = 0;\n    state.laggedDrops = 0;\n    resetPaging();\n  }\n  function setSearch(value) {\n    state.search = value;\n    state.query = parseFilter(value);\n    resetPaging();\n  }\n  function setTimeframe(from, to) {\n    state.fromMs = from;\n    state.toMs = to;\n    resetPaging();\n  }\n  function resetPaging() {\n    state.feedPage = 0;\n    state.feedFrozen = void 0;\n  }\n  function textOf(row) {\n    if (row.text === void 0) row.text = searchableText(row.entry);\n    return row.text;\n  }\n  function sortRows() {\n    state.rows.sort((a, b) => a.entry.at - b.entry.at);\n  }\n  function matches2(row) {\n    if (state.fromMs !== void 0 && row.entry.at < state.fromMs) return false;\n    if (state.toMs !== void 0 && row.entry.at > state.toMs) return false;\n    return matchesFilter(state.filter, row.entry) && matches(state.query, row.entry, textOf(row));\n  }\n  function matchingRows(limit = Number.POSITIVE_INFINITY) {\n    const shown = [];\n    for (let i = state.rows.length - 1; i >= 0 && shown.length < limit; i--) {\n      const row = state.rows[i];\n      if (row !== void 0 && matches2(row)) shown.push(row);\n    }\n    return shown;\n  }\n  function feedPage(size) {\n    const all = state.feedPage === 0 || state.feedFrozen === void 0 ? matchingRows() : state.feedFrozen;\n    const pages = Math.max(1, Math.ceil(all.length / size));\n    const page = Math.min(Math.max(0, state.feedPage), pages - 1);\n    if (page !== state.feedPage) state.feedPage = page;\n    return { rows: all.slice(page * size, page * size + size), page, pages, total: all.length };\n  }\n  function goToFeedPage(page) {\n    const next = Math.max(0, page);\n    if (next === 0) {\n      state.feedFrozen = void 0;\n    } else if (state.feedFrozen === void 0) {\n      state.feedFrozen = matchingRows();\n    }\n    state.feedPage = next;\n  }\n  function matchingCount() {\n    let count = 0;\n    for (const row of state.rows) if (matches2(row)) count++;\n    return count;\n  }\n  function oldestAt() {\n    return state.rows[0]?.entry.at;\n  }\n  function bump(counter, key) {\n    counter.set(key, (counter.get(key) ?? 0) + 1);\n  }\n  function aggregate(rows) {\n    const totals = {\n      detectors: /* @__PURE__ */ new Map(),\n      actors: /* @__PURE__ */ new Map(),\n      identities: /* @__PURE__ */ new Map(),\n      paths: /* @__PURE__ */ new Map(),\n      deniedPaths: /* @__PURE__ */ new Map(),\n      guardStops: /* @__PURE__ */ new Map(),\n      ruleHits: /* @__PURE__ */ new Map(),\n      bypassed: /* @__PURE__ */ new Map()\n    };\n    for (const { entry } of rows) {\n      for (const item of entry.evidence) bump(totals.detectors, item.detector);\n      bump(totals.actors, entry.actor);\n      if (entry.bypass !== void 0) {\n        bump(totals.bypassed, `${entry.path}  (${entry.bypass})`);\n        continue;\n      }\n      bump(totals.paths, entry.path);\n      if (entry.identity !== void 0 && entry.identity !== "") {\n        bump(totals.identities, `${entry.identity} \xB7 ${entry.verdict === "verified-bot" ? "verified" : "claimed"}`);\n      }\n      if (outcome(entry) === "deny") bump(totals.deniedPaths, entry.path);\n      if (entry.downgradedFrom !== void 0 && entry.rule !== void 0) bump(totals.guardStops, `${entry.rule} \u2192 ${entry.downgradedFrom}`);\n      if (entry.rule !== void 0) bump(totals.ruleHits, entry.rule);\n    }\n    return totals;\n  }\n\n  // src/dashboard/client/api.ts\n  async function getJson(path) {\n    const response = await fetch(API + path);\n    if (!response.ok) throw new Error(await errorFrom(response));\n    return await response.json();\n  }\n  async function postJson(path, body) {\n    const response = await fetch(API + path, {\n      method: "POST",\n      headers: { "content-type": "application/json" },\n      body: JSON.stringify(body)\n    });\n    const data = await response.json().catch(() => ({}));\n    return response.ok ? { ok: true, data } : { ok: false, data, error: String(data.error ?? "The server refused this.") };\n  }\n  async function errorFrom(response) {\n    const body = await response.json().catch(() => ({}));\n    return body.error ?? `${response.status} ${response.statusText}`;\n  }\n\n  // src/dashboard/client/actions.ts\n  var armed = 0;\n  function isConfirming() {\n    return armed > 0;\n  }\n  function actorActions(key, after, current) {\n    if (!BOOT.allowActing) return [];\n    const forget = el("button", null, "Forget");\n    forget.title = "Discard this actor\'s history \u2014 the cure for a false positive that has stuck";\n    forget.addEventListener("click", () => {\n      void act({ key, action: "forget" }, `Forgot ${key}`, "Its next request is assessed as a first request.", after);\n    });\n    const clear2 = el("button", null, "Clear as human");\n    clear2.title = "Grant this actor human clearance for an hour, as though it had solved a challenge";\n    clear2.addEventListener("click", () => {\n      void act({ key, action: "clear", forMs: 60 * 6e4 }, `Cleared ${key}`, "Held as human for an hour, then reassessed.", after);\n    });\n    const label2 = labelControl(key, current, after);\n    return [confirmingButton("Allowlist", `Allowlist ${key} \u2014 it stops being assessed at all`, () => allowlist(key, after)), forget, clear2, label2];\n  }\n  function labelControl(key, current, after) {\n    const host = el("span", "label-edit");\n    const button = el("button", null, current === void 0 ? "Label" : "Relabel");\n    button.title = "Give this actor a name, for whoever reads this next. It never changes a verdict.";\n    const commit = (value) => {\n      const trimmed = value.trim().slice(0, 120);\n      void act(\n        { key, action: "label", ...trimmed === "" ? {} : { label: trimmed } },\n        trimmed === "" ? `Cleared the label on ${key}` : `Labelled ${key}`,\n        trimmed === "" ? "It shows as its address again." : `Shown as "${trimmed}" wherever it appears.`,\n        after\n      );\n    };\n    button.addEventListener("click", () => {\n      const container = host.parentElement;\n      clear(host);\n      const input = el("input", "label-input");\n      input.type = "text";\n      input.value = current ?? "";\n      input.placeholder = "A name for this client";\n      input.setAttribute("aria-label", `Name for ${key}`);\n      input.maxLength = 120;\n      const save = el("button", "label-save", "Save");\n      save.title = "Save this name";\n      const cancel = el("button", null, "Cancel");\n      cancel.title = "Leave the name as it was";\n      input.title = "Enter to save, Escape to cancel";\n      armed++;\n      container?.classList.add("editing");\n      let settled = false;\n      const finish = (accept) => {\n        if (settled) return;\n        settled = true;\n        armed--;\n        container?.classList.remove("editing");\n        if (accept) commit(input.value);\n        else {\n          clear(host);\n          host.appendChild(button);\n        }\n      };\n      for (const control of [input, save, cancel]) {\n        control.addEventListener("keydown", (event) => {\n          const pressed = event.key;\n          if (pressed === "Escape") {\n            event.preventDefault();\n            finish(false);\n          } else if (pressed === "Enter" && control === input) {\n            event.preventDefault();\n            finish(true);\n          }\n        });\n      }\n      for (const control of [save, cancel]) control.addEventListener("mousedown", (event) => event.preventDefault());\n      save.addEventListener("click", () => finish(true));\n      cancel.addEventListener("click", () => finish(false));\n      host.addEventListener("focusout", (event) => {\n        const next = event.relatedTarget;\n        if (next !== null && host.contains(next)) return;\n        finish(false);\n      });\n      host.append(input, save, cancel);\n      input.focus();\n      input.select();\n    });\n    host.appendChild(button);\n    return host;\n  }\n  function confirmingButton(label2, confirmation, run2) {\n    const button = el("button", "danger", label2);\n    let pending2 = false;\n    let timer2;\n    const disarm = () => {\n      if (!pending2) return;\n      pending2 = false;\n      armed--;\n      button.textContent = label2;\n      button.className = "danger";\n    };\n    button.addEventListener("click", () => {\n      if (pending2) {\n        if (timer2 !== void 0) clearTimeout(timer2);\n        disarm();\n        run2();\n        return;\n      }\n      pending2 = true;\n      armed++;\n      button.textContent = confirmation;\n      button.className = "danger primary";\n      timer2 = setTimeout(disarm, 5e3);\n    });\n    return button;\n  }\n  async function allowlist(key, after) {\n    const result = await postJson("/api/ranges", { name: "allowlist", add: [key] });\n    if (!result.ok) {\n      toast("bad", "Not allowlisted", result.error ?? "");\n      return;\n    }\n    toast("warn", `Allowlisted ${key}`, "Requests from it are no longer assessed at all.");\n    after();\n  }\n  async function act(body, title, detail, after) {\n    const result = await postJson("/api/actor", body);\n    if (!result.ok) {\n      toast("bad", "Refused", result.error ?? "");\n      return;\n    }\n    toast("ok", title, detail);\n    after();\n  }\n\n  // src/dashboard/client/format.ts\n  var numbers = new Intl.NumberFormat();\n  function n(value) {\n    return numbers.format(value ?? 0);\n  }\n  function pct(part, whole) {\n    return whole > 0 ? `${Math.round(part / whole * 100)}%` : "\u2014";\n  }\n  function ms(value) {\n    return value >= 10 ? `${value.toFixed(1)}ms` : `${value.toFixed(2)}ms`;\n  }\n  function uptime(milliseconds) {\n    const seconds = Math.max(0, Math.round(milliseconds / 1e3));\n    if (seconds < 90) return `${seconds}s`;\n    const minutes = Math.round(seconds / 60);\n    if (minutes < 90) return `${minutes}m`;\n    return `${Math.round(minutes / 60)}h`;\n  }\n  function rangeLabel(milliseconds) {\n    const seconds = Math.round(milliseconds / 1e3);\n    if (seconds < 90) return `${seconds}s`;\n    const minutes = Math.round(seconds / 60);\n    return minutes < 90 ? `${minutes} min` : `${Math.round(minutes / 60)}h`;\n  }\n  function clockTime(at) {\n    const when = new Date(at);\n    return `${pad(when.getHours())}:${pad(when.getMinutes())}:${pad(when.getSeconds())}`;\n  }\n  function clockDate(at) {\n    const when = new Date(at);\n    return `${pad(when.getDate())}-${pad(when.getMonth() + 1)}-${when.getFullYear()}`;\n  }\n  function clockStamp(at) {\n    return `${clockDate(at)} ${clockTime(at)}`;\n  }\n  function pad(value) {\n    return String(value).padStart(2, "0");\n  }\n  function windowLabel(count, oldestAt2, now) {\n    if (count === 0) return "this window \xB7 empty";\n    const span = oldestAt2 === void 0 ? 0 : Math.max(0, now - oldestAt2);\n    return `last ${n(count)} requests \xB7 ${rangeLabel(span)}`;\n  }\n\n  // src/dashboard/client/bars.ts\n  function drawBars(target, rows, emptyText) {\n    clear(target);\n    const filtered = [...rows].filter(([, value]) => value > 0);\n    if (filtered.length === 0) {\n      target.appendChild(el("div", "note", emptyText));\n      return;\n    }\n    filtered.sort((a, b) => b[1] - a[1]);\n    const max = filtered[0]?.[1] ?? 1;\n    for (const [label2, value] of filtered.slice(0, 14)) {\n      const bar = el("div", "bar");\n      const track = el("div", "track");\n      const fill = el("div", "fill");\n      fill.style.width = `${Math.max(2, Math.round(value / max * 100))}%`;\n      track.appendChild(fill);\n      track.appendChild(el("div", "lbl", label2));\n      bar.appendChild(track);\n      bar.appendChild(el("div", "v tnum", n(value)));\n      target.appendChild(bar);\n    }\n  }\n  function pairs(record) {\n    return Object.entries(record ?? {});\n  }\n\n  // src/dashboard/client/actor.ts\n  function initActor() {\n    if (!SECTIONS.actors) return;\n    $("actor-close").addEventListener("click", closeActor);\n  }\n  function openActor(key) {\n    state.actor = key;\n    app.drawNow();\n    $("actor-panel").scrollIntoView({ block: "nearest" });\n  }\n  function closeActor() {\n    state.actor = void 0;\n    app.drawNow();\n  }\n  function drawActor() {\n    if (!SECTIONS.actors) return;\n    const panel = $("actor-panel");\n    if (state.actor === void 0) {\n      panel.hidden = true;\n      return;\n    }\n    panel.hidden = false;\n    $("actor-key").textContent = state.actor;\n    const mine = state.rows.filter((row) => row.entry.actor === state.actor).map((row) => row.entry);\n    const latest = mine[mine.length - 1];\n    const stats = latest?.actorStats;\n    const gaps = [];\n    for (let i = 1; i < mine.length; i++) gaps.push(mine[i].at - mine[i - 1].at);\n    const meanGap = gaps.length > 0 ? gaps.reduce((a, b) => a + b, 0) / gaps.length : 0;\n    const box = $("actor-stats");\n    clear(box);\n    const rows = [\n      ["In this window", `${n(mine.length)} requests`],\n      ["Engine sees", stats !== void 0 ? `${n(stats.requests)} requests, ${n(stats.distinctPaths)} distinct paths` : "\u2014"],\n      ["Prior confirmations", stats !== void 0 ? n(stats.priorConfirmations) : "\u2014"],\n      ["Holds clearance", stats !== void 0 ? stats.cleared ? "yes" : "no" : "\u2014"],\n      ["First seen", stats !== void 0 ? clockStamp(stats.firstSeen) : "\u2014"],\n      ["Mean gap", gaps.length > 0 ? `${Math.round(meanGap)}ms over ${n(gaps.length)} gaps` : "one request only"]\n    ];\n    for (const [key, value] of rows) {\n      box.appendChild(el("dt", null, key));\n      box.appendChild(el("dd", null, value));\n    }\n    const verdicts = /* @__PURE__ */ new Map();\n    const actions = /* @__PURE__ */ new Map();\n    for (const entry of mine) {\n      verdicts.set(entry.verdict, (verdicts.get(entry.verdict) ?? 0) + 1);\n      if (entry.action !== void 0) actions.set(entry.action, (actions.get(entry.action) ?? 0) + 1);\n    }\n    drawBars($("actor-mix"), [...verdicts, ...actions], "Nothing yet.");\n    const bar = $("actor-actions");\n    clear(bar);\n    const buttons = actorActions(state.actor, () => app.drawNow());\n    bar.hidden = buttons.length === 0;\n    for (const button of buttons) bar.appendChild(button);\n  }\n\n  // src/dashboard/client/saved.ts\n  var FILTERS_KEY = "bothandler.filters";\n  var MAX_SAVED = 50;\n  function read(key, fallback) {\n    if (isEmbedded()) return fallback;\n    try {\n      const raw = localStorage.getItem(key);\n      if (raw === null) return fallback;\n      const parsed = JSON.parse(raw);\n      return Array.isArray(parsed) ? parsed : fallback;\n    } catch {\n      return fallback;\n    }\n  }\n  function write(key, value) {\n    if (isEmbedded()) return;\n    try {\n      localStorage.setItem(key, JSON.stringify(value));\n    } catch {\n    }\n  }\n  function savedFilters() {\n    return read(FILTERS_KEY, []).filter((entry) => typeof entry?.name === "string");\n  }\n  function saveFilter(entry) {\n    const kept = savedFilters().filter((existing) => existing.name !== entry.name);\n    const next = [entry, ...kept].slice(0, MAX_SAVED);\n    write(FILTERS_KEY, next);\n    return next;\n  }\n  function deleteFilter(name) {\n    const next = savedFilters().filter((entry) => entry.name !== name);\n    write(FILTERS_KEY, next);\n    return next;\n  }\n\n  // src/dashboard/client/pager.ts\n  var painted = /* @__PURE__ */ new WeakMap();\n  function renderPager(host, model, options) {\n    const signature = JSON.stringify([model.page, model.from, model.to, model.total, model.atStart, model.atEnd, model.held ?? "", options.withSize, model.size?.current]);\n    if (painted.get(host) === signature && host.childElementCount > 0) return;\n    painted.set(host, signature);\n    clear(host);\n    const steps = [\n      { to: model.page - 1, glyph: "\u2039", label: "Previous page", disabled: model.atStart },\n      { to: model.page + 1, glyph: "\u203A", label: "Next page", disabled: model.atEnd }\n    ];\n    const [previous, next] = steps;\n    host.appendChild(stepButton(previous, model));\n    const range = model.total === void 0 ? `${n(model.from)}\u2013${n(model.to)}` : `${n(model.from)}\u2013${n(model.to)} of ${n(model.total)}`;\n    const where = el("span", "where", range);\n    where.setAttribute("aria-live", "polite");\n    host.appendChild(where);\n    host.appendChild(stepButton(next, model));\n    if (model.held !== void 0) {\n      const held = el("span", "held", model.held);\n      held.title = "New requests are still arriving and are still counted. They appear when you return to the first page.";\n      host.appendChild(held);\n    }\n    if (options.withSize && model.size !== void 0) {\n      const size = model.size;\n      const label2 = el("label", "size");\n      label2.appendChild(document.createTextNode("Per page"));\n      const select2 = document.createElement("select");\n      for (const choice of size.choices) {\n        const option = document.createElement("option");\n        option.value = String(choice);\n        option.textContent = String(choice);\n        option.selected = choice === size.current;\n        select2.appendChild(option);\n      }\n      select2.addEventListener("change", () => {\n        const chosen = Number(select2.value);\n        if (Number.isFinite(chosen) && chosen > 0) size.set(chosen);\n      });\n      label2.appendChild(select2);\n      host.appendChild(label2);\n    }\n  }\n  function stepButton(step, model) {\n    const button = el("button", "step", step.glyph);\n    const element = button;\n    element.type = "button";\n    element.disabled = step.disabled;\n    button.setAttribute("aria-label", step.label);\n    button.title = step.label;\n    button.addEventListener("click", () => model.go(Math.max(0, step.to)));\n    return button;\n  }\n\n  // src/dashboard/client/replay.ts\n  function replayLine(entry) {\n    const headers = {};\n    for (const [name, value] of entry.headers ?? []) headers[name] = value;\n    const query = Object.keys(entry.query).map((name) => `${encodeURIComponent(name)}=${encodeURIComponent(entry.query[name] ?? "")}`).join("&");\n    return JSON.stringify({\n      method: entry.method,\n      url: entry.path + (query === "" ? "" : `?${query}`),\n      headers,\n      ip: entry.actor,\n      timestamp: new Date(entry.at).toISOString(),\n      protocol: entry.protocol ?? "https",\n      httpVersion: entry.httpVersion ?? "1.1"\n    });\n  }\n  function replayFile(entries) {\n    return entries.map(replayLine).join("\\n");\n  }\n  function corpusCase(entry) {\n    const headers = (entry.headers ?? []).map((pair) => `        [${JSON.stringify(pair[0])}, ${JSON.stringify(pair[1])}]`).join(",\\n");\n    return [\n      "bot({",\n      `  id: ${JSON.stringify(`case-${entry.requestId.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`)},`,\n      `  title: ${JSON.stringify(`${entry.method} ${entry.path} from ${entry.userAgent.slice(0, 60)}`)},`,\n      \'  audience: "unwanted-bot",   // human | benign-bot | declared-bot | unwanted-bot | hostile | infrastructure\',\n      \'  category: "observed",\',\n      `  provenance: "Captured from the live dashboard on ${new Date(entry.at).toISOString().slice(0, 10)}",`,\n      "  requests: [",\n      "    {",\n      "      headers: [",\n      headers,\n      "      ],",\n      `      protocol: ${JSON.stringify(entry.protocol ?? "https")},`,\n      `      httpVersion: ${JSON.stringify(entry.httpVersion ?? "1.1")},`,\n      `      path: ${JSON.stringify(entry.path)},`,\n      "    },",\n      "  ],",\n      `  expect: { verdict: ${JSON.stringify(entry.verdict)}, certain: ${String(entry.certain)} },`,\n      "}),"\n    ].join("\\n");\n  }\n\n  // src/dashboard/client/result.ts\n  function showResult(kind, build) {\n    const box = $("policy-result");\n    box.hidden = false;\n    box.className = `result ${kind}`;\n    clear(box);\n    build(box);\n  }\n  function renderPreview(preview, notes = []) {\n    showResult(preview.newDenials > 0 ? "warn" : "ok", (box) => {\n      const head = el("div");\n      head.appendChild(el("b", null, `${n(preview.changed)} of ${n(preview.evaluated)} requests would be treated differently.`));\n      box.appendChild(head);\n      for (const note of notes) box.appendChild(el("div", "ev-meta", note));\n      if (preview.newDenials > 0) {\n        box.appendChild(el("div", null, `${n(preview.newDenials)} request(s) that are served today would be denied. Read the samples before applying this.`));\n      }\n      for (const warning of preview.warnings) box.appendChild(el("div", "ev-meta", warning));\n      const dead = preview.ruleHits.filter((row) => row.hits === 0 && row.rule !== "default");\n      if (dead.length > 0) box.appendChild(el("div", "ev-meta", `Never matched in this window: ${dead.map((row) => row.rule).join(", ")}`));\n      if (preview.samples.length > 0) {\n        const table = el("table", "diff");\n        const head2 = el("tr");\n        for (const label2 of ["Request", "Now", "Would be"]) head2.appendChild(el("th", null, label2));\n        table.appendChild(head2);\n        for (const sample of preview.samples) {\n          const row = el("tr");\n          const what = el("td");\n          what.appendChild(el("div", "mono", sample.path));\n          what.appendChild(el("div", "ev-meta", `${sample.verdict} \xB7 ${sample.userAgent.slice(0, 48)}`));\n          row.appendChild(what);\n          const from = el("td", "from");\n          from.appendChild(el("div", null, sample.from));\n          from.appendChild(el("div", "ev-meta", sample.fromRule));\n          row.appendChild(from);\n          const kind = sample.to === "block" || sample.to === "drop" || sample.to === "redirect" ? "deny" : sample.to === "allow" ? "allow" : "";\n          const to = el("td", `to ${kind}`);\n          to.appendChild(el("div", null, sample.to));\n          to.appendChild(el("div", "ev-meta", sample.toRule));\n          row.appendChild(to);\n          table.appendChild(row);\n        }\n        box.appendChild(table);\n      } else if (preview.evaluated === 0) {\n        box.appendChild(el("div", "ev-meta", "No traffic in the window to preview against \u2014 send some requests first."));\n      }\n    });\n  }\n\n  // src/dashboard/client/guard.ts\n  var draft;\n  var MODE_NOTES = {\n    strict: "A terminal action survives only on proven evidence. Nothing is ever denied on a guess. This is the default, and it is the claim this library makes about itself.",\n    balanced: "A terminal action also survives on a probabilistic verdict that clears the score threshold with at least two independent strong signals. Real people do trip two signals \u2014 a hardened browser behind a corporate proxy is the usual pair \u2014 so this setting will eventually deny somebody who should have been served.",\n    aggressive: "The guard is off. Every rule does exactly what it says, on proof or on suspicion alike, and the people it turns away first are the ones with the most unusual and most legitimate setups."\n  };\n  function drawGuard() {\n    if (!SECTIONS.guard) return;\n    const document_ = state.policy;\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    const editable = document_?.guardEditable === true;\n    const panel = $("stat-policy");\n    clear(panel);\n    if (!editable || document_ === void 0) {\n      const rows = [\n        ["False-positive policy", snapshot.policy.falsePositivePolicy],\n        ["Fallback when the guard stops a rule", snapshot.policy.fallbackAction],\n        ["Terminal score threshold", String(snapshot.policy.terminalScoreThreshold)],\n        ["Suspect threshold", String(snapshot.policy.suspectThreshold)],\n        ["Action when no rule matches", snapshot.policy.defaultAction],\n        ["Challenge configured", snapshot.policy.challengeEnabled ? "yes" : "no"],\n        ["Range sets", snapshot.ranges.length === 0 ? "none" : snapshot.ranges.map((range) => `${range.name} (${range.size})`).join(", ")]\n      ];\n      for (const [key, value] of rows) {\n        const line = el("div", "stat-row");\n        line.appendChild(el("span", "k", key));\n        line.appendChild(el("span", "v", value));\n        panel.appendChild(line);\n      }\n      $("guard-mode").textContent = "not editable here";\n      $("guard-note").textContent = "These are fixed at construction on this dashboard. It can change which rules exist; it cannot change how far a rule is allowed to go, because relaxing that is the one edit that can start denying people. Enable it deliberately with controls: { editGuard: true }.";\n      return;\n    }\n    if (draft === void 0) draft = { ...document_.guard };\n    const vocabulary = document_.vocabulary;\n    $("guard-mode").textContent = state.guardDirty ? "unsaved changes" : "editable";\n    $("guard-note").textContent = "Changing these changes what every rule is allowed to do, on the next request. Preview it against the traffic in the window first \u2014 that is the only view you get of who it would start turning away.";\n    panel.appendChild(\n      guardField(\n        // "Mode" rather than "Guard": the panel is already called that, and a field\n        // repeating its own panel\'s name reads as a heading rather than as a control.\n        "Mode",\n        segmented(\n          vocabulary.falsePositivePolicies.map((mode) => [mode, mode]),\n          draft.falsePositivePolicy,\n          (value) => {\n            setDraft({ falsePositivePolicy: value });\n            drawGuard();\n          }\n        )\n      )\n    );\n    panel.appendChild(el("div", "note guard-explains", MODE_NOTES[draft.falsePositivePolicy] ?? ""));\n    panel.appendChild(\n      guardField(\n        "Fallback",\n        select(vocabulary.fallbackActions, draft.fallbackAction, (value) => setDraft({ fallbackAction: value })),\n        "what a stopped rule becomes \u2014 the terminal actions are absent because a terminal fallback would deny the request the guard just protected"\n      )\n    );\n    panel.appendChild(\n      guardField(\n        "Default action",\n        select(vocabulary.actions, draft.defaultAction, (value) => setDraft({ defaultAction: value })),\n        "when no rule matches"\n      )\n    );\n    panel.appendChild(\n      guardField(\n        "Terminal score",\n        number(draft.terminalScoreThreshold, (value) => setDraft({ terminalScoreThreshold: value })),\n        "balanced mode only: the score a probabilistic verdict must clear"\n      )\n    );\n    panel.appendChild(\n      guardField(\n        "Suspect at",\n        number(draft.suspectThreshold, (value) => setDraft({ suspectThreshold: value })),\n        "the score at which a request becomes suspected-bot"\n      )\n    );\n    const bar = el("div", "bar-actions");\n    const preview = el("button", null, "Preview");\n    preview.addEventListener("click", () => {\n      void previewGuard();\n    });\n    const apply2 = el("button", "primary", "Apply");\n    apply2.addEventListener("click", () => {\n      void applyGuard();\n    });\n    const revert = el("button", null, "Revert");\n    revert.addEventListener("click", () => {\n      draft = { ...document_.guard };\n      state.guardDirty = false;\n      drawGuard();\n    });\n    bar.appendChild(preview);\n    bar.appendChild(apply2);\n    bar.appendChild(revert);\n    panel.appendChild(bar);\n  }\n  function setDraft(change) {\n    if (draft === void 0) return;\n    draft = { ...draft, ...change };\n    state.guardDirty = true;\n    $("guard-mode").textContent = "unsaved changes";\n  }\n  function resetGuardDraft() {\n    draft = void 0;\n    state.guardDirty = false;\n  }\n  function liveRules() {\n    return (state.policy?.rules ?? []).filter((row) => row.editable && row.rule !== void 0).map((row) => row.rule);\n  }\n  async function previewGuard() {\n    if (draft === void 0) return;\n    const result = await postJson("/api/policy/preview", { rules: liveRules(), guard: draft });\n    if (!result.ok) {\n      showResult("bad", (box) => box.appendChild(el("div", null, result.error ?? "")));\n      toast("bad", "Refused", result.error ?? "");\n      return;\n    }\n    renderPreview(result.data, state.editorDirty ? ["Previewed against the rules currently in force, not the unsaved edits in the editor."] : []);\n    app.showTab("policy");\n  }\n  async function applyGuard() {\n    if (draft === void 0) return;\n    const result = await postJson("/api/guard", draft);\n    if (!result.ok) {\n      showResult("bad", (box) => box.appendChild(el("div", null, result.error ?? "")));\n      toast("bad", "Guard unchanged", result.error ?? "");\n      return;\n    }\n    state.guardDirty = false;\n    draft = { ...result.data.guard };\n    if (state.policy !== void 0) state.policy.guard = { ...result.data.guard };\n    toast("ok", "Guard changed", `${result.data.guard.falsePositivePolicy}, falling back to ${result.data.guard.fallbackAction}.`);\n    showResult("warn", (box) => {\n      box.appendChild(el("div", null, "The guard changed. It applies from the next request, and it is in the notices panel and in your logs."));\n      if (result.data.guard.falsePositivePolicy !== "strict") {\n        box.appendChild(\n          el(\n            "div",\n            "ev-meta",\n            "Requests can now be denied without proof. The guard-stop count is the series to watch: every stop that no longer happens is a request that used to be recoverable and is not any more."\n          )\n        );\n      }\n    });\n    app.draw();\n  }\n  function guardField(name, control, hint) {\n    const row = el("div", "field");\n    row.appendChild(label(name, control));\n    const right = el("div", "field-row");\n    right.appendChild(control);\n    if (hint !== void 0) right.appendChild(el("span", "hint", hint));\n    row.appendChild(right);\n    return row;\n  }\n  function segmented(options, value, onChange) {\n    const box = el("div", "seg");\n    for (const [label2, option] of options) {\n      const button = el("button", null, label2);\n      button.type = "button";\n      button.setAttribute("aria-pressed", String(option === value));\n      button.addEventListener("click", () => onChange(option));\n      box.appendChild(button);\n    }\n    return box;\n  }\n  function select(options, value, onChange) {\n    const node = el("select");\n    for (const option of options) {\n      const item = el("option", null, option);\n      item.value = option;\n      if (option === value) item.selected = true;\n      node.appendChild(item);\n    }\n    node.addEventListener("change", () => onChange(node.value));\n    return node;\n  }\n  function number(value, onChange) {\n    const input = el("input");\n    input.type = "number";\n    input.min = "1";\n    input.max = "100";\n    input.value = String(value);\n    input.addEventListener("input", () => {\n      if (input.value !== "") onChange(Number(input.value));\n    });\n    return input;\n  }\n\n  // src/dashboard/client/ranges.ts\n  var sets = [];\n  async function loadRanges() {\n    if (!SECTIONS.ranges) return;\n    try {\n      const body = await getJson("/api/ranges");\n      sets = body.ranges;\n      drawRanges();\n    } catch {\n    }\n  }\n  function drawRanges() {\n    if (!SECTIONS.ranges) return;\n    const body = $("ranges-body");\n    clear(body);\n    $("ranges-mode").textContent = BOOT.allowActing ? "editable" : "read-only";\n    $("ranges-note").textContent = BOOT.allowActing ? "An address on the allowlist is not judged leniently \u2014 it is not judged at all. Detection does not run on it, no evidence is produced, and no rule sees it." : "These come from the code that constructed the handler. Enable controls.editRanges to add an address from here.";\n    if (sets.length === 0) {\n      body.appendChild(el("div", "note", "No range sets are configured. Add an address to the allowlist and one appears."));\n    }\n    for (const set of sets) {\n      const block = el("div", "rangeset");\n      const heading = el("h3");\n      heading.appendChild(document.createTextNode(set.name));\n      heading.appendChild(el("span", null, `${n(set.size)} entr${set.size === 1 ? "y" : "ies"}`));\n      block.appendChild(heading);\n      const list = el("div", "cidrs");\n      for (const entry of set.entries) {\n        const chip = el("span", BOOT.allowActing ? "cidr" : "cidr readonly");\n        chip.appendChild(document.createTextNode(entry));\n        if (BOOT.allowActing) {\n          const remove = el("button", null, "\xD7");\n          remove.title = `Remove ${entry} from ${set.name}`;\n          remove.setAttribute("aria-label", `Remove ${entry} from ${set.name}`);\n          remove.addEventListener("click", () => void update(set.name, { remove: [entry] }));\n          chip.appendChild(remove);\n        }\n        list.appendChild(chip);\n      }\n      if (set.entries.length === 0) list.appendChild(el("span", "hint", "empty"));\n      block.appendChild(list);\n      body.appendChild(block);\n    }\n    if (!BOOT.allowActing) return;\n    const form = el("div", "rangeset");\n    const row = el("div", "field-row");\n    const name = el("input", "mono-input");\n    name.type = "text";\n    name.value = "allowlist";\n    name.setAttribute("aria-label", "Range set");\n    name.style.maxWidth = "150px";\n    const value = el("input", "mono-input");\n    value.type = "text";\n    value.placeholder = "203.0.113.0/24";\n    value.setAttribute("aria-label", "Address or CIDR to add");\n    const add = el("button", null, "Add");\n    const submit = () => {\n      const entry = value.value.trim();\n      if (entry === "") return;\n      value.value = "";\n      void update(name.value.trim(), { add: [entry] });\n    };\n    add.addEventListener("click", submit);\n    value.addEventListener("keydown", (event) => {\n      if (event.key === "Enter") submit();\n    });\n    row.appendChild(name);\n    row.appendChild(value);\n    row.appendChild(add);\n    form.appendChild(row);\n    body.appendChild(form);\n  }\n  async function update(name, change) {\n    const result = await postJson("/api/ranges", { name, ...change });\n    if (!result.ok) {\n      toast("bad", "Ranges unchanged", result.error ?? "");\n      return;\n    }\n    toast(name === "allowlist" && change.add !== void 0 ? "warn" : "ok", `\u201C${name}\u201D updated`, `${n(result.data.entries?.length ?? 0)} entr${result.data.entries?.length === 1 ? "y" : "ies"} now.`);\n    await loadRanges();\n  }\n\n  // src/dashboard/client/draft.ts\n  function draftRule(entry, existingIds = []) {\n    const match = {};\n    let because;\n    let stem;\n    const proven = entry.evidence.filter((item) => item.certainty === "certain" && item.direction !== "human");\n    const detectors = [...new Set((proven.length > 0 ? proven : entry.evidence.filter((item) => item.direction !== "human")).map((item) => item.detector))];\n    if (entry.identity !== void 0 && entry.identity !== "") {\n      match["identity"] = [entry.identity];\n      if (entry.certain) match["certain"] = true;\n      stem = entry.identity;\n      because = entry.certain ? `Matched on the identity \u201C${entry.identity}\u201D, and on proof \u2014 so a client merely claiming that name does not match.` : `Matched on the claimed identity \u201C${entry.identity}\u201D. Nothing has verified it, so this matches anything that says so.`;\n    } else if (proven.length > 0) {\n      match["detector"] = detectors;\n      match["certain"] = true;\n      stem = detectors[0] ?? "proven";\n      because = `Matched on proof from ${detectors.join(", ")}. Only requests that carry the same proof match.`;\n    } else if (detectors.length > 0) {\n      match["verdict"] = [entry.verdict];\n      match["detector"] = detectors;\n      match["minScore"] = Math.max(0, Math.floor(entry.score / 10) * 10);\n      stem = detectors[0] ?? entry.verdict;\n      because = `Matched on ${entry.verdict} at score ${String(match["minScore"])} or more, from ${detectors.join(", ")}. Every one of those is probabilistic, so the guard will not let this rule deny anybody.`;\n    } else {\n      match["verdict"] = [entry.verdict];\n      stem = entry.verdict;\n      because = `Nothing fired on this request, so there is nothing sharper to match on than the verdict itself. Narrow it before you use it.`;\n    }\n    return {\n      rule: {\n        id: uniqueId(`from-${slug(stem)}`, existingIds),\n        match,\n        action: "tag",\n        reason: "Drafted from a request on the dashboard.",\n        _open: true\n      },\n      because\n    };\n  }\n  function slug(value) {\n    const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");\n    return cleaned === "" ? "request" : cleaned.slice(0, 40);\n  }\n  function uniqueId(wanted, taken) {\n    if (!taken.includes(wanted)) return wanted;\n    for (let suffix = 2; suffix < 1e3; suffix++) {\n      const candidate = `${wanted}-${suffix}`;\n      if (!taken.includes(candidate)) return candidate;\n    }\n    return `${wanted}-${Date.now()}`;\n  }\n\n  // src/dashboard/client/policy.ts\n  async function loadPolicy() {\n    if (!SECTIONS.policy) return;\n    try {\n      const document_ = await getJson("/api/policy");\n      state.policy = document_;\n      if (!state.editorDirty) {\n        setEditorRules(document_.rules.filter((row) => row.editable).map((row) => row.rule));\n      }\n      if (!state.guardDirty) resetGuardDraft();\n      drawPolicyTab();\n    } catch {\n    }\n  }\n  function setEditorRules(rules) {\n    state.editorRules = JSON.parse(JSON.stringify(rules ?? []));\n    renderEditor();\n  }\n  function markDirty() {\n    state.editorDirty = true;\n    $("policy-dirty").hidden = false;\n  }\n  function editorRules() {\n    if (state.editorMode === "json") {\n      try {\n        const parsed = JSON.parse(byId("policy-json").value);\n        if (!Array.isArray(parsed)) return { error: "The JSON must be an array of rules." };\n        return { rules: parsed };\n      } catch (error) {\n        return { error: `The editor does not contain valid JSON: ${String(error)}` };\n      }\n    }\n    return { rules: state.editorRules };\n  }\n  function cleanRule(rule) {\n    const match = {};\n    for (const [key, value] of Object.entries(rule.match ?? {})) {\n      if (value === void 0 || value === null || value === "") continue;\n      if (Array.isArray(value) && value.length === 0) continue;\n      match[key] = value;\n    }\n    const params = {};\n    for (const [key, value] of Object.entries(rule.params ?? {})) {\n      if (value === void 0 || value === null || value === "") continue;\n      if (key === "limit") {\n        const limit = value;\n        if (limit.max === void 0 || limit.windowMs === void 0) continue;\n      }\n      params[key] = value;\n    }\n    const out = { id: rule.id, match, action: rule.action };\n    if (Object.keys(params).length > 0) out["params"] = params;\n    if (rule.reason !== void 0 && rule.reason !== "") out["reason"] = rule.reason;\n    return out;\n  }\n  function cleanRules(rules) {\n    return rules.map(cleanRule);\n  }\n  function field(name, control, hint) {\n    const row = el("div", "field");\n    row.appendChild(label(name, control));\n    const right = el("div", "field-row");\n    for (const node of Array.isArray(control) ? control : [control]) right.appendChild(node);\n    if (hint !== void 0) right.appendChild(el("span", "hint", hint));\n    row.appendChild(right);\n    return row;\n  }\n  function chipSelect(options, selected, onChange) {\n    const box = el("div", "chips-select");\n    const chosen = Array.isArray(selected) ? [...selected] : selected === void 0 ? [] : [String(selected)];\n    for (const option of options) {\n      const button = el("button", null, option);\n      button.type = "button";\n      button.setAttribute("aria-pressed", String(chosen.includes(option)));\n      button.addEventListener("click", () => {\n        const at = chosen.indexOf(option);\n        if (at === -1) chosen.push(option);\n        else chosen.splice(at, 1);\n        button.setAttribute("aria-pressed", String(at === -1));\n        onChange(chosen.length === 0 ? void 0 : [...chosen]);\n      });\n      box.appendChild(button);\n    }\n    return box;\n  }\n  function segmented2(options, value, onChange) {\n    const box = el("div", "seg");\n    for (const [label2, option] of options) {\n      const button = el("button", null, label2);\n      button.type = "button";\n      button.setAttribute("aria-pressed", String(option === value));\n      button.addEventListener("click", () => {\n        for (const other of Array.from(box.children)) other.setAttribute("aria-pressed", "false");\n        button.setAttribute("aria-pressed", "true");\n        onChange(option);\n      });\n      box.appendChild(button);\n    }\n    return box;\n  }\n  function textInput(value, placeholder, onChange, mono = false) {\n    const input = el("input", mono ? "mono-input" : null);\n    input.type = "text";\n    input.value = value === void 0 || value === null ? "" : String(value);\n    input.placeholder = placeholder;\n    input.addEventListener("input", () => onChange(input.value.trim() === "" ? void 0 : input.value));\n    return input;\n  }\n  function listInput(value, placeholder, onChange) {\n    const current = value === void 0 ? "" : Array.isArray(value) ? value.join(", ") : String(value);\n    const input = textInput(current, placeholder, () => {\n    }, true);\n    input.addEventListener("input", () => {\n      const parts = input.value.split(",").map((part) => part.trim()).filter(Boolean);\n      onChange(parts.length === 0 ? void 0 : parts.length === 1 ? parts[0] : parts);\n    });\n    return input;\n  }\n  function numberInput(value, placeholder, onChange) {\n    const input = el("input");\n    input.type = "number";\n    input.value = value === void 0 || value === null ? "" : String(value);\n    input.placeholder = placeholder;\n    input.addEventListener("input", () => onChange(input.value === "" ? void 0 : Number(input.value)));\n    return input;\n  }\n  function matchSummary(rule) {\n    const box = el("div", "rule-summary");\n    const match = rule.match ?? {};\n    const parts = [];\n    for (const key of ["verdict", "botClass", "category", "identity", "detector", "method", "path"]) {\n      const value = match[key];\n      if (value === void 0) continue;\n      parts.push([key, Array.isArray(value) ? value.join(", ") : String(value)]);\n    }\n    if (match["certain"] !== void 0) parts.push(["certain", String(match["certain"])]);\n    if (match["minScore"] !== void 0 || match["maxScore"] !== void 0) {\n      parts.push(["score", `${String(match["minScore"] ?? 0)}\u2013${String(match["maxScore"] ?? 99)}`]);\n    }\n    if (match["minPriorConfirmations"] !== void 0) parts.push(["prior", String(match["minPriorConfirmations"])]);\n    if (match["minUnsolvedChallenges"] !== void 0) parts.push(["unsolved", String(match["minUnsolvedChallenges"])]);\n    if (parts.length === 0) {\n      box.appendChild(el("span", "none", "matches everything"));\n      return box;\n    }\n    for (const [key, value] of parts.slice(0, 4)) box.appendChild(el("span", "t", `${key}: ${value}`));\n    if (parts.length > 4) box.appendChild(el("span", "k", `+${parts.length - 4} more`));\n    return box;\n  }\n  function ruleCard(rule, index) {\n    const vocabulary = state.policy?.vocabulary;\n    const open = rule._open === true;\n    const card = el("div", `rule${open ? "" : " collapsed"}`);\n    const head = el("div", "rule-head");\n    const chevron = el("button", "chev", open ? "\u25BE" : "\u25B8");\n    chevron.title = open ? "Collapse" : "Expand";\n    chevron.setAttribute("aria-expanded", String(open));\n    chevron.addEventListener("click", () => {\n      rule._open = !open;\n      renderEditor();\n    });\n    head.appendChild(chevron);\n    head.appendChild(el("span", "ord", index + 1));\n    const id = textInput(rule.id, "rule-id", (value) => {\n      rule.id = value ?? "";\n      markDirty();\n    }, true);\n    id.setAttribute("aria-label", "Rule id");\n    head.appendChild(id);\n    if (open) {\n      const action = el("select");\n      action.setAttribute("aria-label", "Action");\n      for (const name of vocabulary?.actions ?? []) {\n        const option = el("option", null, name);\n        option.value = name;\n        if (name === rule.action) option.selected = true;\n        action.appendChild(option);\n      }\n      action.addEventListener("change", () => {\n        rule.action = action.value;\n        rule.params = {};\n        markDirty();\n        renderEditor();\n      });\n      head.appendChild(action);\n    } else {\n      head.appendChild(matchSummary(rule));\n      head.appendChild(el("span", `act-pill ${actionKind(rule.action)}`, rule.action));\n    }\n    const up = el("button", "icon", "\u2191");\n    up.title = "Move earlier \u2014 the first matching rule wins";\n    up.addEventListener("click", () => moveRule(index, -1));\n    const down = el("button", "icon", "\u2193");\n    down.title = "Move later";\n    down.addEventListener("click", () => moveRule(index, 1));\n    const remove = el("button", "icon danger", "Remove");\n    remove.addEventListener("click", () => {\n      state.editorRules.splice(index, 1);\n      markDirty();\n      renderEditor();\n    });\n    head.appendChild(up);\n    head.appendChild(down);\n    head.appendChild(remove);\n    card.appendChild(head);\n    if (!open) return card;\n    const body = el("div", "rule-body");\n    rule.match = rule.match ?? {};\n    const match = rule.match;\n    body.appendChild(field("Verdict", chipSelect(vocabulary?.verdicts ?? [], match["verdict"], (value) => {\n      match["verdict"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Bot class", chipSelect(vocabulary?.botClasses ?? [], match["botClass"], (value) => {\n      match["botClass"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Category", chipSelect(vocabulary?.categories ?? [], match["category"], (value) => {\n      match["category"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Detector", chipSelect(vocabulary?.detectors ?? [], match["detector"], (value) => {\n      match["detector"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Method", chipSelect(vocabulary?.methods ?? [], match["method"], (value) => {\n      match["method"] = value;\n      markDirty();\n    })));\n    body.appendChild(\n      field(\n        "Evidence",\n        segmented2(\n          [\n            ["any", void 0],\n            ["proven", true],\n            ["unproven", false]\n          ],\n          match["certain"],\n          (value) => {\n            match["certain"] = value;\n            markDirty();\n          }\n        ),\n        "proven means at least one piece of certain evidence \u2014 including a proven human"\n      )\n    );\n    body.appendChild(\n      field("Score", [\n        numberInput(match["minScore"], "min", (value) => {\n          match["minScore"] = value;\n          markDirty();\n        }),\n        el("span", "hint", "to"),\n        numberInput(match["maxScore"], "max", (value) => {\n          match["maxScore"] = value;\n          markDirty();\n        })\n      ])\n    );\n    body.appendChild(field("Identity", listInput(match["identity"], "googlebot, gptbot", (value) => {\n      match["identity"] = value;\n      markDirty();\n    })));\n    body.appendChild(field("Path", listInput(match["path"], "/api/, /search", (value) => {\n      match["path"] = value;\n      markDirty();\n    }), "a string matches as a prefix"));\n    body.appendChild(\n      field(\n        "Prior bots",\n        numberInput(match["minPriorConfirmations"], "0", (value) => {\n          match["minPriorConfirmations"] = value;\n          markDirty();\n        }),\n        "times this actor was already proven a bot"\n      )\n    );\n    body.appendChild(\n      field(\n        "Unsolved",\n        numberInput(match["minUnsolvedChallenges"], "0", (value) => {\n          match["minUnsolvedChallenges"] = value;\n          markDirty();\n        }),\n        "challenges issued to this actor that were never answered \u2014 solving one clears the count"\n      )\n    );\n    rule.params = rule.params ?? {};\n    const params = rule.params;\n    for (const node of paramFields(rule.action, params)) body.appendChild(node);\n    body.appendChild(field("Reason", textInput(rule.reason, "shown in the decision and in your logs", (value) => {\n      rule.reason = value ?? "";\n      markDirty();\n    })));\n    card.appendChild(body);\n    return card;\n  }\n  function paramFields(action, params) {\n    switch (action) {\n      case "block":\n        return [\n          field("Status", numberInput(params["status"], "403", (value) => {\n            params["status"] = value;\n            markDirty();\n          })),\n          field("Body", textInput(params["body"], "Automated traffic is not served here.", (value) => {\n            params["body"] = value;\n            markDirty();\n          }))\n        ];\n      case "redirect":\n        return [field("Location", textInput(params["location"], "/too-fast", (value) => {\n          params["location"] = value;\n          markDirty();\n        }, true))];\n      case "delay":\n        return [field("Delay", numberInput(params["delayMs"], "250", (value) => {\n          params["delayMs"] = value;\n          markDirty();\n        }), "milliseconds")];\n      case "rate-limit": {\n        const limit = params["limit"] ?? {};\n        params["limit"] = limit;\n        return [\n          field("Limit", [\n            numberInput(limit["max"], "60", (value) => {\n              limit["max"] = value;\n              markDirty();\n            }),\n            el("span", "hint", "requests per"),\n            numberInput(limit["windowMs"], "60000", (value) => {\n              limit["windowMs"] = value;\n              markDirty();\n            }),\n            el("span", "hint", "ms")\n          ])\n        ];\n      }\n      case "custom":\n        return [field("Handler", textInput(params["handler"], "handler-id", (value) => {\n          params["handler"] = value;\n          markDirty();\n        }, true), "id of a handler you registered")];\n      default:\n        return [];\n    }\n  }\n  function lockedCard(row) {\n    const card = el("div", "rule locked");\n    const head = el("div", "rule-head");\n    head.appendChild(el("span", "ord", `#${row.index + 1}`));\n    head.appendChild(el("span", "mono", row.id));\n    head.appendChild(el("span", "grow"));\n    head.appendChild(el("span", "pill", "predicate \u2014 locked"));\n    card.appendChild(head);\n    card.appendChild(\n      el("div", "rule-body", "This rule matches with a function, which cannot be represented here or sent over HTTP. It stays exactly as it is, at this position, whatever else you change.")\n    );\n    return card;\n  }\n  function moveRule(index, delta) {\n    const target = index + delta;\n    if (target < 0 || target >= state.editorRules.length) return;\n    const moved = state.editorRules.splice(index, 1)[0];\n    if (moved === void 0) return;\n    state.editorRules.splice(target, 0, moved);\n    markDirty();\n    renderEditor();\n  }\n  function renderEditor() {\n    if (!SECTIONS.policy) return;\n    const list = $("rulelist");\n    clear(list);\n    const locked = (state.policy?.rules ?? []).filter((row) => !row.editable);\n    if (state.editorRules.length === 0 && locked.length === 0) {\n      list.appendChild(el("div", "note", "No rules. Every request takes the default action \u2014 add one, or import a set."));\n    }\n    const rendered2 = state.editorRules.map((rule, index) => ruleCard(rule, index));\n    for (const row of locked) rendered2.splice(Math.min(row.index, rendered2.length), 0, lockedCard(row));\n    for (const node of rendered2) list.appendChild(node);\n    if (state.editorMode === "json") byId("policy-json").value = JSON.stringify(cleanRules(state.editorRules), null, 2);\n  }\n  function drawPolicyTab() {\n    const document_ = state.policy;\n    if (document_ === void 0) return;\n    const editable = document_.editable;\n    $("policy-apply").hidden = !editable;\n    byId("policy-json").readOnly = !editable;\n    $("policy-mode").textContent = editable ? "editable" : "read-only";\n    $("rule-add").hidden = !editable;\n    $("policy-import").hidden = !editable;\n    const preserved = document_.rules.filter((row) => !row.editable);\n    let note = editable ? "First match wins \u2014 order matters." : "Read-only. Enable controls.editPolicy to change these.";\n    if (preserved.length > 0) note += ` ${preserved.length} rule(s) use a predicate function and are locked.`;\n    $("policy-note").textContent = note;\n    renderPresetButtons();\n    drawGuard();\n    drawRanges();\n    if (SECTIONS.robots) {\n      $("robots-preview").textContent = document_.robots === "" ? "(this policy declines no crawler by name)" : document_.robots;\n      const notes = $("robots-notes");\n      clear(notes);\n      for (const note_ of document_.robotsNotes) notes.appendChild(el("div", "ev-meta", `${note_.rule}: ${note_.reason}`));\n    }\n    const rules = $("stat-rules");\n    clear(rules);\n    const installed = state.snapshot?.rules ?? [];\n    if (installed.length === 0) rules.appendChild(el("div", "note", "No rules configured \u2014 every request takes the default action."));\n    else installed.forEach((rule, index) => rules.appendChild(el("span", "chip", `${index + 1}. ${rule}`)));\n  }\n  async function draftIntoEditor(entry) {\n    if (state.policy === void 0) await loadPolicy();\n    const drafted = draftRule(entry, state.editorRules.map((rule) => rule.id));\n    state.editorRules.push(drafted.rule);\n    markDirty();\n    if (state.editorMode === "json") byId("policy-json").value = JSON.stringify(cleanRules(state.editorRules), null, 2);\n    renderEditor();\n    app.showTab("policy");\n    const notes = [\n      `Drafted \u201C${drafted.rule.id}\u201D, tagging only. Nothing is applied \u2014 read it, choose the action, then apply.`,\n      drafted.because,\n      "It was added last, which is the only position that cannot change what an existing rule does. Move it up with \u2191 if it needs to win."\n    ];\n    showResult("warn", (box) => {\n      for (const note of notes) box.appendChild(el("div", note === notes[0] ? null : "ev-meta", note));\n    });\n    toast("ok", "Rule drafted", "In the editor, tagging only, not applied.");\n    await runPreview(notes);\n  }\n  function switchToGui() {\n    if (state.editorMode === "gui") return;\n    const parsed = editorRules();\n    if (parsed.error !== void 0) {\n      toast("bad", "That JSON will not parse", parsed.error);\n      return;\n    }\n    state.editorRules = parsed.rules ?? [];\n    state.editorMode = "gui";\n    $("mode-gui").setAttribute("aria-pressed", "true");\n    $("mode-json").setAttribute("aria-pressed", "false");\n    $("editor-gui").hidden = false;\n    $("editor-json").hidden = true;\n    renderEditor();\n  }\n  function switchToJson() {\n    state.editorMode = "json";\n    $("mode-gui").setAttribute("aria-pressed", "false");\n    $("mode-json").setAttribute("aria-pressed", "true");\n    $("editor-gui").hidden = true;\n    $("editor-json").hidden = false;\n    byId("policy-json").value = JSON.stringify(cleanRules(state.editorRules), null, 2);\n  }\n  async function exportSettings() {\n    try {\n      const response = await fetch(`${API}/api/settings`);\n      const text = await response.text();\n      if (!response.ok) throw new Error(text);\n      download(text, `bothandler-settings-${today()}.json`, "application/json");\n      toast("ok", "Settings exported", "Rules, plus a record of the configuration around them.");\n    } catch (error) {\n      toast("bad", "Export failed", String(error));\n    }\n  }\n  function readSettingsFile(file) {\n    const reader = new FileReader();\n    reader.onload = () => {\n      try {\n        applyImported(JSON.parse(String(reader.result)), file.name);\n      } catch (error) {\n        toast("bad", "That file is not JSON", String(error));\n      }\n    };\n    reader.onerror = () => toast("bad", "Could not read that file", "");\n    reader.readAsText(file);\n  }\n  function applyImported(document_, name) {\n    const rules = Array.isArray(document_) ? document_ : Array.isArray(document_.rules) ? document_.rules : void 0;\n    if (rules === void 0) {\n      toast("bad", "Nothing to import", "Expected an array of rules, or a settings file with a rules array.");\n      return;\n    }\n    setEditorRules(rules);\n    markDirty();\n    switchToGui();\n    const ignored = [];\n    const readOnly = document_.readOnly;\n    if (readOnly !== void 0) {\n      ignored.push("the guard, the detectors, the ranges and the audit \u2014 those come from the code that built the handler, not from a file");\n      if (Array.isArray(readOnly.lockedRules) && readOnly.lockedRules.length > 0) {\n        ignored.push(`${readOnly.lockedRules.length} predicate rule(s), which stay as they are`);\n      }\n    }\n    showResult("warn", (box) => {\n      box.appendChild(el("div", null, `Loaded ${rules.length} rule(s) from ${name}. Nothing has been applied yet \u2014 preview it first.`));\n      for (const line of ignored) box.appendChild(el("div", "ev-meta", `Ignored: ${line}`));\n    });\n    toast("ok", `Imported ${rules.length} rule(s)`, "Review, preview, then apply.");\n  }\n  function collectForSubmit() {\n    const parsed = editorRules();\n    if (parsed.error !== void 0) {\n      showResult("bad", (box) => box.appendChild(el("div", null, parsed.error ?? "")));\n      toast("bad", "That JSON will not parse", parsed.error);\n      return void 0;\n    }\n    const cleaned = cleanRules(parsed.rules ?? []);\n    const blank = cleaned.filter((rule) => rule["id"] === void 0 || rule["id"] === "").length;\n    if (blank > 0) {\n      toast("bad", "Every rule needs an id", "It is what every decision and log line names.");\n      return void 0;\n    }\n    return cleaned;\n  }\n  async function runPreview(notes = []) {\n    const rules = collectForSubmit();\n    if (rules === void 0) return;\n    const result = await postJson("/api/policy/preview", { rules });\n    if (!result.ok) {\n      showResult("bad", (box) => box.appendChild(el("div", null, result.error ?? "")));\n      toast("bad", "Refused", result.error ?? "");\n      return;\n    }\n    renderPreview(result.data, notes);\n  }\n  async function applyPolicy() {\n    const rules = collectForSubmit();\n    if (rules === void 0) return;\n    const result = await postJson("/api/policy/apply", { rules });\n    if (!result.ok) {\n      showResult("bad", (box) => box.appendChild(el("div", null, result.error ?? "")));\n      toast("bad", "Refused", result.error ?? "");\n      return;\n    }\n    state.editorDirty = false;\n    $("policy-dirty").hidden = true;\n    await loadPolicy();\n    toast("ok", "Applied", `${n(result.data.rules)} rule(s) now in force.`);\n    showResult("ok", (box) => {\n      box.appendChild(el("div", null, `Applied. ${n(result.data.rules)} rule(s) are now in force.`));\n      for (const warning of result.data.warnings ?? []) box.appendChild(el("div", "ev-meta", warning));\n    });\n  }\n  function renderPresetButtons() {\n    const box = $("preset-buttons");\n    const presets = state.policy?.vocabulary.presets ?? [];\n    if (box.childElementCount === presets.length) return;\n    clear(box);\n    for (const preset of presets) {\n      const button = el("button", null, preset);\n      button.addEventListener("click", () => {\n        void (async () => {\n          const result = await postJson("/api/policy/preview", { preset });\n          if (!result.ok) {\n            toast("bad", "Refused", result.error ?? "");\n            return;\n          }\n          renderPreview(result.data);\n        })();\n      });\n      box.appendChild(button);\n    }\n  }\n  function initPolicy() {\n    if (!SECTIONS.policy) return;\n    $("mode-gui").addEventListener("click", switchToGui);\n    $("mode-json").addEventListener("click", switchToJson);\n    $("rule-add").addEventListener("click", () => {\n      state.editorRules.push({ id: `new-rule-${state.editorRules.length + 1}`, match: {}, action: "tag", params: {}, _open: true });\n      markDirty();\n      renderEditor();\n    });\n    $("rule-expand").addEventListener("click", () => {\n      const anyClosed = state.editorRules.some((rule) => rule._open !== true);\n      for (const rule of state.editorRules) rule._open = anyClosed;\n      $("rule-expand").textContent = anyClosed ? "Collapse all" : "Expand all";\n      renderEditor();\n    });\n    byId("policy-json").addEventListener("input", markDirty);\n    $("policy-preview").addEventListener("click", () => void runPreview());\n    $("policy-apply").addEventListener("click", () => void applyPolicy());\n    $("policy-revert").addEventListener("click", () => {\n      state.editorDirty = false;\n      $("policy-dirty").hidden = true;\n      $("policy-result").hidden = true;\n      resetGuardDraft();\n      void loadPolicy();\n    });\n    $("policy-export").addEventListener("click", () => void exportSettings());\n    $("policy-import").addEventListener("click", () => byId("policy-file").click());\n    byId("policy-file").addEventListener("change", () => {\n      const input = byId("policy-file");\n      const file = input.files?.[0];\n      if (file !== void 0) readSettingsFile(file);\n      input.value = "";\n    });\n    const panel = $("editor-panel");\n    for (const name of ["dragenter", "dragover"]) {\n      panel.addEventListener(name, (event) => {\n        if (state.policy?.editable !== true) return;\n        event.preventDefault();\n        panel.classList.add("drop");\n      });\n    }\n    for (const name of ["dragleave", "drop"]) {\n      panel.addEventListener(name, (event) => {\n        panel.classList.remove("drop");\n        if (name !== "drop") return;\n        event.preventDefault();\n        const file = event.dataTransfer?.files?.[0];\n        if (file !== void 0) readSettingsFile(file);\n      });\n    }\n  }\n\n  // src/dashboard/client/feed.ts\n  var FILTERS = [\n    ["all", "All"],\n    ["proven", "Proven"],\n    ["suspected", "Suspected"],\n    ["human", "Human"],\n    ["guard", "Guard stops"],\n    ["deny", "Denied"],\n    ["mitigate", "Mitigated"],\n    ["allow", "Served"]\n  ];\n  var rendered = /* @__PURE__ */ new Map();\n  function initFeed() {\n    const loadThem = byId("feed-load-skipped");\n    loadThem.addEventListener("click", () => {\n      loadThem.disabled = true;\n      void loadSkipped().finally(() => {\n        loadThem.disabled = false;\n      });\n    });\n    const filters = $("filters");\n    for (const [name, label2] of FILTERS) {\n      const button = el("button", null, label2);\n      button.setAttribute("aria-pressed", String(name === state.filter));\n      button.dataset["filter"] = name;\n      button.addEventListener("click", () => {\n        state.filter = name;\n        resetPaging();\n        for (const other of Array.from(filters.children)) other.setAttribute("aria-pressed", "false");\n        button.setAttribute("aria-pressed", "true");\n        app.syncUrl();\n        app.drawNow();\n      });\n      filters.appendChild(button);\n    }\n    const search = byId("search");\n    search.addEventListener("input", () => {\n      setSearch(search.value.trim());\n      app.syncUrl();\n      app.drawNow();\n      showSuggestions(search);\n    });\n    initSuggestions(search);\n    initTimeframe();\n    initSavedFilters(search);\n    const exportShown = byId("feed-export");\n    exportShown.hidden = !SECTIONS.evidence;\n    exportShown.addEventListener("click", () => {\n      const rows = matchingRows();\n      if (rows.length === 0) {\n        toast("warn", "Nothing to export", "No request in the window matches this filter.");\n        return;\n      }\n      const entries = rows.map((row) => row.entry).reverse();\n      download(`${replayFile(entries)}\n`, `bothandler-feed-${today()}.jsonl`, "application/x-ndjson");\n      toast("ok", `Exported ${n(entries.length)} request(s)`, "Replay them with `bothandlerjs replay`.");\n    });\n  }\n  function reflectFilterButtons() {\n    for (const button of Array.from($("filters").children)) {\n      button.setAttribute("aria-pressed", String(button instanceof HTMLElement && button.dataset["filter"] === state.filter));\n    }\n    const search = byId("search");\n    if (search.value !== state.search) search.value = state.search;\n  }\n  async function loadSkipped() {\n    const before = state.rows.length;\n    let served;\n    try {\n      const body = await getJson("/api/feed");\n      for (const entry of body.entries) ingest(entry);\n      served = body.skipped;\n      sortRows();\n    } catch {\n      toast("bad", "Could not load them", "The dashboard did not answer. The entries are still in the window; try again.");\n      return;\n    }\n    state.caughtUp = (served ?? state.snapshot?.skipped ?? 0) + state.laggedDrops;\n    const added = state.rows.length - before;\n    resetPaging();\n    app.drawNow();\n    toast(\n      added > 0 ? "ok" : "warn",\n      added > 0 ? `Loaded ${n(added)}` : "Nothing left to load",\n      added > 0 ? "They are in the feed now, in the order they happened." : "The window no longer holds them; the ring had already rotated past."\n    );\n  }\n  var highlighted = -1;\n  function suggestionList() {\n    return $("search-suggest");\n  }\n  function closeSuggestions(input) {\n    const list = suggestionList();\n    list.hidden = true;\n    clear(list);\n    highlighted = -1;\n    input.setAttribute("aria-expanded", "false");\n  }\n  function showSuggestions(input) {\n    const caret = input.selectionStart ?? input.value.length;\n    const { options, from, to } = suggestFor(input.value, caret);\n    const list = suggestionList();\n    if (options.length === 0 || input.value.slice(from, to) === options[0]) {\n      closeSuggestions(input);\n      return;\n    }\n    clear(list);\n    highlighted = -1;\n    options.slice(0, 12).forEach((option, index) => {\n      const item = el("li", null, option);\n      item.setAttribute("role", "option");\n      item.setAttribute("aria-selected", "false");\n      item.addEventListener("mousedown", (event) => {\n        event.preventDefault();\n        apply(input, option, from, to);\n      });\n      item.dataset["index"] = String(index);\n      list.appendChild(item);\n    });\n    list.hidden = false;\n    input.setAttribute("aria-expanded", "true");\n  }\n  function apply(input, option, from, to) {\n    const before = input.value.slice(0, from);\n    const after = input.value.slice(to);\n    input.value = `${before}${option}${after}`;\n    const caret = before.length + option.length;\n    input.setSelectionRange(caret, caret);\n    setSearch(input.value.trim());\n    app.syncUrl();\n    app.drawNow();\n    closeSuggestions(input);\n    showSuggestions(input);\n    input.focus();\n  }\n  function initSuggestions(input) {\n    input.addEventListener("keydown", (event) => {\n      const list = suggestionList();\n      const items = Array.from(list.querySelectorAll("li"));\n      if (list.hidden || items.length === 0) return;\n      if (event.key === "Escape") {\n        closeSuggestions(input);\n        return;\n      }\n      if (event.key === "ArrowDown" || event.key === "ArrowUp") {\n        event.preventDefault();\n        highlighted = (highlighted + (event.key === "ArrowDown" ? 1 : items.length - 1) + (highlighted === -1 && event.key === "ArrowUp" ? 1 : 0)) % items.length;\n        items.forEach((item, index) => item.setAttribute("aria-selected", String(index === highlighted)));\n        return;\n      }\n      if ((event.key === "Enter" || event.key === "Tab") && highlighted >= 0) {\n        const chosen = items[highlighted]?.textContent ?? "";\n        const caret = input.selectionStart ?? input.value.length;\n        const { from, to } = suggestFor(input.value, caret);\n        event.preventDefault();\n        apply(input, chosen, from, to);\n      }\n    });\n    input.addEventListener("blur", () => {\n      setTimeout(() => closeSuggestions(input), 120);\n    });\n    input.addEventListener("focus", () => showSuggestions(input));\n  }\n  function initSavedFilters(input) {\n    const host = $("saved-filters");\n    const redraw = () => {\n      clear(host);\n      const entries = savedFilters();\n      const select2 = document.createElement("select");\n      select2.setAttribute("aria-label", "Saved filters");\n      const first = document.createElement("option");\n      first.value = "";\n      first.textContent = entries.length === 0 ? "No saved filters" : "Saved filters\u2026";\n      select2.appendChild(first);\n      for (const entry of entries) {\n        const option = document.createElement("option");\n        option.value = entry.name;\n        option.textContent = entry.name;\n        select2.appendChild(option);\n      }\n      select2.addEventListener("change", () => {\n        const chosen = entries.find((entry) => entry.name === select2.value);\n        if (chosen === void 0) return;\n        input.value = chosen.query;\n        setSearch(chosen.query);\n        state.filter = chosen.filter;\n        reflectFilterButtons();\n        resetPaging();\n        app.syncUrl();\n        app.drawNow();\n      });\n      host.appendChild(select2);\n      const save = el("button", null, "Save");\n      save.type = "button";\n      save.title = "Save this filter, in this browser, under a name";\n      save.addEventListener("click", () => {\n        const name = prompt("Save this filter as:")?.trim();\n        if (name === void 0 || name === "") return;\n        saveFilter({ name, query: input.value.trim(), filter: state.filter });\n        redraw();\n        toast("ok", "Filter saved", `"${name}" is in this browser. It is not shared with anybody else.`);\n      });\n      host.appendChild(save);\n      if (select2.value !== "") {\n        const remove = el("button", null, "Delete");\n        remove.type = "button";\n        remove.addEventListener("click", () => {\n          deleteFilter(select2.value);\n          redraw();\n        });\n        host.appendChild(remove);\n      }\n    };\n    redraw();\n  }\n  function initTimeframe() {\n    const from = byId("from-at");\n    const to = byId("to-at");\n    const clearButton = byId("timeframe-clear");\n    const read2 = (input) => {\n      if (input.value === "") return void 0;\n      const parsed = new Date(input.value).getTime();\n      return Number.isFinite(parsed) ? parsed : void 0;\n    };\n    const apply2 = () => {\n      const start2 = read2(from);\n      const end = read2(to);\n      if (start2 !== void 0 && end !== void 0 && end < start2) {\n        toast("warn", "That window runs backwards", "The end is before the start, so nothing can fall inside it.");\n      }\n      setTimeframe(start2, end);\n      clearButton.hidden = start2 === void 0 && end === void 0;\n      app.drawNow();\n    };\n    from.addEventListener("change", apply2);\n    to.addEventListener("change", apply2);\n    clearButton.addEventListener("click", () => {\n      from.value = "";\n      to.value = "";\n      apply2();\n    });\n  }\n  var FEED_PAGE_SIZES = [25, 50, 100, 200];\n  function drawPager(paged) {\n    const size = state.feedPageSize;\n    const hidden = paged.pages <= 1;\n    const model = {\n      page: paged.page,\n      from: paged.page * size + 1,\n      to: Math.min(paged.total, (paged.page + 1) * size),\n      total: paged.total,\n      atStart: paged.page === 0,\n      atEnd: paged.page >= paged.pages - 1,\n      ...paged.page > 0 ? { held: "held while you read" } : {},\n      go: (page) => {\n        goToFeedPage(page);\n        app.drawNow();\n      },\n      size: {\n        current: size,\n        choices: FEED_PAGE_SIZES,\n        set: (next) => {\n          state.feedPageSize = next;\n          resetPaging();\n          app.drawNow();\n        }\n      }\n    };\n    for (const [id, withSize] of [\n      ["feed-pager-top", true],\n      ["feed-pager", false]\n    ]) {\n      const host = $(id);\n      host.hidden = hidden;\n      if (hidden) clear(host);\n      else renderPager(host, model, { withSize });\n    }\n  }\n  function drawFeed() {\n    const body = byId("rows");\n    const paged = feedPage(state.feedPageSize);\n    const shown = paged.rows;\n    let index = 0;\n    const place = (node) => {\n      const current = body.childNodes[index] ?? null;\n      if (current !== node) body.insertBefore(node, current);\n      index++;\n    };\n    for (const row of shown) {\n      const id = row.entry.requestId;\n      const open = state.open.has(id);\n      let cached = rendered.get(id);\n      if (cached === void 0 || cached.rev !== row.rev || cached.open !== open) {\n        cached = {\n          row: buildRow(row.entry, open),\n          detail: open ? buildDetail(row.entry) : void 0,\n          rev: row.rev,\n          open\n        };\n        rendered.set(id, cached);\n      }\n      place(cached.row);\n      if (cached.detail !== void 0) place(cached.detail);\n    }\n    while (body.childNodes.length > index) body.removeChild(body.childNodes[index]);\n    if (rendered.size > shown.length * 2 + 100) {\n      const live = new Set(shown.map((row) => row.entry.requestId));\n      for (const id of Array.from(rendered.keys())) if (!live.has(id)) rendered.delete(id);\n    }\n    const total = state.rows.length;\n    const matching = matchingCount();\n    $("empty").hidden = total > 0;\n    $("feed-count").textContent = matching === total ? `${n(total)} in this window` : `${n(matching)} of ${n(total)}`;\n    drawPager(paged);\n    const skipped = Math.max(0, (state.snapshot?.skipped ?? 0) + state.laggedDrops - state.caughtUp);\n    const note = $("feed-skipped");\n    note.hidden = skipped === 0;\n    note.textContent = `${n(skipped)} not streamed`;\n    byId("feed-load-skipped").hidden = skipped === 0;\n    note.title = state.laggedDrops > 0 ? `${n(state.laggedDrops)} were skipped because this connection could not keep up, and the rest by the rate cap. All of them are still in the window, the preview and the export.` : "Entries the rate cap kept off this stream. They are still in the window, the preview and the export \u2014 raise maxEventsPerSecond to see them live.";\n  }\n  function resetFeedCache() {\n    rendered.clear();\n  }\n  function buildRow(entry, open) {\n    const out = outcome(entry);\n    const tr = el("tr", `row a-${entry.downgradedFrom !== void 0 ? "guard" : out}${open ? " open" : ""}`);\n    tr.appendChild(el("td", "num mono tnum when", clockTime(entry.at)));\n    const request = el("td", "edge req");\n    const toggle = el("button", "row-toggle", `${entry.method} ${entry.path}`);\n    toggle.type = "button";\n    toggle.setAttribute("aria-expanded", String(open));\n    toggle.setAttribute("aria-label", `${entry.method} ${entry.path}, ${entry.verdict}. Evidence.`);\n    toggle.dataset["request"] = entry.requestId;\n    request.appendChild(toggle);\n    const ua = el("span", "ua");\n    if (SECTIONS.actors) {\n      const actorLink = el("a", null, entry.actor);\n      actorLink.href = "#actor";\n      actorLink.title = "Show everything from this actor";\n      actorLink.addEventListener("click", (event) => {\n        event.preventDefault();\n        event.stopPropagation();\n        openActor(entry.actor);\n      });\n      ua.appendChild(actorLink);\n      ua.appendChild(document.createTextNode(` \xB7 ${entry.userAgent}`));\n    } else {\n      ua.appendChild(document.createTextNode(`${entry.actor} \xB7 ${entry.userAgent}`));\n    }\n    ua.title = `${entry.actor} \xB7 ${entry.userAgent}`;\n    request.appendChild(ua);\n    tr.appendChild(request);\n    const verdictCell = el("td");\n    const [badgeClass, badgeLabel] = verdictBadge(entry);\n    verdictCell.appendChild(el("span", `badge ${badgeClass}`, badgeLabel));\n    if (entry.identity !== void 0) verdictCell.appendChild(el("span", "sub", entry.identity));\n    tr.appendChild(verdictCell);\n    tr.appendChild(el("td", "num mono tnum", entry.certain ? "proven" : String(entry.score)));\n    const actionCell = el("td");\n    if (entry.action !== void 0) {\n      const kind = out === "deny" ? "act-deny" : out === "mitigate" ? "act-mitigate" : out === "allow" ? "act-allow" : "act-tag";\n      actionCell.appendChild(el("span", `act ${kind}`, entry.action));\n      if (entry.rule !== void 0) {\n        const ruleLabel = el("span", "sub", entry.rule);\n        ruleLabel.title = entry.rule;\n        actionCell.appendChild(ruleLabel);\n      }\n      if (entry.downgradedFrom !== void 0) actionCell.appendChild(el("span", "guard", `guard stopped ${entry.downgradedFrom}`));\n    } else {\n      actionCell.appendChild(el("span", "sub", "assessed only"));\n    }\n    tr.appendChild(actionCell);\n    tr.appendChild(el("td", "num mono tnum", entry.durationMs.toFixed(2)));\n    tr.dataset["request"] = entry.requestId;\n    const flip = () => {\n      if (state.open.has(entry.requestId)) state.open.delete(entry.requestId);\n      else state.open.add(entry.requestId);\n      app.drawNow();\n      rootNode().querySelector(`button.row-toggle[data-request="${cssEscape(entry.requestId)}"]`)?.focus();\n    };\n    toggle.addEventListener("click", (event) => {\n      event.stopPropagation();\n      flip();\n    });\n    tr.addEventListener("click", flip);\n    return tr;\n  }\n  function buildDetail(entry) {\n    const tr = el("tr", "detail");\n    const cell = el("td");\n    cell.colSpan = 6;\n    if (!SECTIONS.evidence) {\n      cell.appendChild(\n        el(\n          "div",\n          "ev-meta",\n          "The evidence section is switched off on this dashboard, so the reasons behind this verdict are not sent to it. What fired, and why, is on a dashboard that has `sections: { evidence: true }`."\n        )\n      );\n    } else if (entry.evidence.length === 0) {\n      cell.appendChild(\n        el(\n          "div",\n          "ev-meta",\n          entry.bypass !== void 0 ? `Detection was skipped for this request: ${entry.bypass}.` : "No detector produced any evidence. This is what ordinary traffic looks like."\n        )\n      );\n    } else {\n      const list = el("div", "ev");\n      for (const item of entry.evidence) {\n        const row = el("div", `ev-item${item.direction === "human" ? " human" : ""}${item.shadow === true ? " shadow" : ""}`);\n        row.appendChild(el("div", `tier t-${item.certainty}`, item.certainty));\n        const body = el("div");\n        body.appendChild(el("div", null, item.summary));\n        let meta = `${item.detector} \xB7 points to ${item.direction}`;\n        if (item.family !== void 0) meta += ` \xB7 family \u201C${item.family}\u201D, counted once with its siblings`;\n        if (item.shadow === true) meta += " \xB7 shadowed: counted, and part of no decision";\n        body.appendChild(el("div", "ev-meta", meta));\n        if (item.deterministicBasis !== void 0) body.appendChild(el("div", "basis", item.deterministicBasis));\n        row.appendChild(body);\n        list.appendChild(row);\n      }\n      cell.appendChild(list);\n    }\n    if (entry.shadowVerdict !== void 0) {\n      const would = entry.shadowVerdict;\n      const changed = would.verdict !== entry.verdict;\n      cell.appendChild(\n        el(\n          "div",\n          `ev-meta shadow-verdict${changed ? " changed" : ""}`,\n          changed ? `With the shadowed detectors counted, this request would have been ${would.verdict} at ${would.score} instead of ${entry.verdict} at ${entry.score}.` : `With the shadowed detectors counted, this request would still have been ${would.verdict}${would.score === entry.score ? "" : `, at ${would.score} rather than ${entry.score}`}.`\n        )\n      );\n    }\n    for (const failure of entry.failures) {\n      cell.appendChild(el("div", "ev-meta", `Detector ${failure.detector} ${failure.reason}: ${failure.message}`));\n    }\n    if (entry.downgradeReason !== void 0) cell.appendChild(el("div", "basis", `Guard: ${entry.downgradeReason}`));\n    const queryNames = Object.keys(entry.query);\n    if (queryNames.length > 0) {\n      const queryTable = el("table", "hdr");\n      for (const name of queryNames) {\n        const value = entry.query[name] ?? "";\n        const row = el("tr");\n        row.appendChild(el("td", "n", `?${name}`));\n        row.appendChild(el("td", `v${value === "[redacted]" ? " red" : ""}`, value));\n        queryTable.appendChild(row);\n      }\n      cell.appendChild(queryTable);\n    }\n    if (entry.headers !== void 0 && entry.headers.length > 0) {\n      const table = el("table", "hdr");\n      for (const [name, value] of entry.headers) {\n        const row = el("tr");\n        row.appendChild(el("td", "n", `${name}:`));\n        row.appendChild(el("td", `v${value === "[redacted]" ? " red" : ""}`, value));\n        table.appendChild(row);\n      }\n      cell.appendChild(table);\n    }\n    const tools = el("div", "tools");\n    if (SECTIONS.evidence) {\n      tools.appendChild(copyButton("Copy replay line", () => replayLine(entry)));\n      tools.appendChild(downloadButton("Download replay line", () => replayLine(entry), `request-${entry.requestId}.jsonl`));\n      tools.appendChild(copyButton("Copy corpus case", () => corpusCase(entry)));\n    }\n    if (SECTIONS.policy) {\n      const draft2 = el("button", null, "Draft a rule");\n      draft2.title = "Start a rule from this request, in the policy editor";\n      draft2.addEventListener("click", (event) => {\n        event.stopPropagation();\n        void draftIntoEditor(entry);\n      });\n      tools.appendChild(draft2);\n    }\n    if (SECTIONS.actors) {\n      const actorButton = el("button", null, "Show this actor");\n      actorButton.addEventListener("click", (event) => {\n        event.stopPropagation();\n        openActor(entry.actor);\n      });\n      tools.appendChild(actorButton);\n    }\n    cell.appendChild(tools);\n    const foot = el("div", "detail-foot");\n    foot.appendChild(el("span", null, clockTime(entry.at)));\n    foot.appendChild(el("span", null, `actor ${entry.actor}`));\n    if (entry.rule !== void 0) foot.appendChild(el("span", null, `rule \u201C${entry.rule}\u201D`));\n    foot.appendChild(el("span", null, `assessed in ${entry.durationMs.toFixed(3)}ms`));\n    foot.appendChild(el("span", "mono", entry.requestId));\n    cell.appendChild(foot);\n    tr.appendChild(cell);\n    return tr;\n  }\n  function copyButton(label2, produce) {\n    const button = el("button", null, label2);\n    button.addEventListener("click", (event) => {\n      event.stopPropagation();\n      const text = produce();\n      const done = () => {\n        button.textContent = "Copied";\n        setTimeout(() => {\n          button.textContent = label2;\n        }, 1200);\n      };\n      if (navigator.clipboard?.writeText !== void 0) navigator.clipboard.writeText(text).then(done, () => showText(text));\n      else showText(text);\n    });\n    return button;\n  }\n  function downloadButton(label2, produce, filename) {\n    const button = el("button", null, label2);\n    button.addEventListener("click", (event) => {\n      event.stopPropagation();\n      download(`${produce()}\n`, filename, "application/x-ndjson");\n    });\n    return button;\n  }\n  function showText(text) {\n    const box = el("pre", "code", text);\n    const host = $("policy-result");\n    host.hidden = false;\n    host.className = "result";\n    clear(host);\n    host.appendChild(el("div", "ev-meta", "Copying needs a secure context; here is the text."));\n    host.appendChild(box);\n    const selection = getSelection();\n    if (selection !== null) {\n      const range = document.createRange();\n      range.selectNodeContents(box);\n      selection.removeAllRanges();\n      selection.addRange(range);\n    }\n  }\n\n  // src/dashboard/client/stream.ts\n  var source;\n  function connectStream() {\n    if (!SECTIONS.feed) {\n      $("dot").className = "dot";\n      $("conn").textContent = "feed off";\n      return;\n    }\n    if (source !== void 0) return;\n    source = new EventSource(`${API}/api/stream`);\n    source.addEventListener("open", () => {\n      $("dot").className = "dot on";\n      $("conn").textContent = "live";\n    });\n    source.addEventListener("sync", (event) => {\n      const detail = JSON.parse(event.data);\n      if (!detail.replace) return;\n      clearFeed();\n      resetFeedCache();\n    });\n    source.addEventListener("entry", (event) => {\n      ingest(JSON.parse(event.data));\n      if (state.paused) {\n        state.bufferedWhilePaused++;\n        $("pause").textContent = `Resume (${state.bufferedWhilePaused})`;\n      }\n      app.draw();\n    });\n    source.addEventListener("update", (event) => {\n      ingest(JSON.parse(event.data));\n      app.draw();\n    });\n    source.addEventListener("reset", () => {\n      clearFeed();\n      resetFeedCache();\n      app.draw();\n    });\n    source.addEventListener("lagged", (event) => {\n      const detail = JSON.parse(event.data);\n      state.laggedDrops += detail.dropped;\n      app.draw();\n    });\n    source.addEventListener("stats", (event) => {\n      state.snapshot = JSON.parse(event.data);\n      app.draw();\n    });\n    source.addEventListener("error", () => {\n      $("dot").className = "dot off";\n      $("conn").textContent = "reconnecting\u2026";\n    });\n  }\n  async function loadInitialSnapshot() {\n    try {\n      state.snapshot = await getJson("/api/stats");\n      app.drawNow();\n    } catch {\n    }\n  }\n\n  // src/dashboard/client/panels.ts\n  var paintedSnapshot;\n  function drawTiles(force = false) {\n    if (!SECTIONS.statistics) return;\n    const box = $("tiles");\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    if (!force && paintedSnapshot === snapshot) return;\n    paintedSnapshot = snapshot;\n    const metrics = snapshot.metrics;\n    clear(box);\n    if (metrics === void 0) {\n      box.appendChild(el("div", "note", "Counters are switched off on this handler (metrics: false). The live feed still works."));\n      return;\n    }\n    const actions = metrics.actions;\n    const denied = actions.block + actions.drop + actions.redirect;\n    const mitigated = actions.challenge + actions["rate-limit"] + actions.delay;\n    const served = actions.allow + actions.tag + actions.log;\n    const total = metrics.requests;\n    const unremarkable = metrics.verdicts.unknown + metrics.verdicts.human;\n    const provenBotCount = provenBots(metrics.verdicts);\n    const actors = SECTIONS.registry ? { tab: "actors", label: "Actors" } : void 0;\n    const tiles = [\n      ["", n(total), "Requests", "since start", void 0],\n      ["proven", n(provenBotCount), "Proven bots", `${pct(provenBotCount, total)} of traffic`, void 0],\n      ["warn", n(metrics.verdicts["suspected-bot"]), "Suspected", "never denied alone", void 0],\n      ["", n(unremarkable), "Unremarkable", `${pct(unremarkable, total)} of traffic`, void 0],\n      ["warn", n(metrics.downgrades), "Guard stops", metrics.downgrades > 0 ? "a rule over-reached" : "no rule overreached", void 0],\n      ["crit", n(denied), "Denied", `${pct(denied, total)} of traffic`, void 0],\n      [\n        "",\n        n(mitigated),\n        "Mitigated",\n        metrics.challenges.issued > 0 ? `${n(metrics.challenges.solved)} of ${n(metrics.challenges.issued)} challenges solved` : "challenged or limited",\n        void 0\n      ],\n      ["good", n(served), "Served", `${pct(served, total)} of traffic`, void 0],\n      ["", n(metrics.actorsTracked), "Actors tracked", "in the registry now", actors]\n    ];\n    for (const [kind, value, key, sub, goes] of tiles) {\n      const tile = goes === void 0 ? el("div", `tile ${kind}`) : el("button", `tile ${kind} go`);\n      tile.appendChild(el("div", "v tnum", value));\n      tile.appendChild(el("div", "k", key));\n      tile.appendChild(el("div", "s", sub));\n      if (goes !== void 0) {\n        tile.type = "button";\n        tile.appendChild(el("span", "sr-only", `. Show the ${goes.label} screen`));\n        tile.addEventListener("click", () => app.showTab(goes.tab, { replace: false }));\n      }\n      box.appendChild(tile);\n    }\n  }\n  function drawChips() {\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    const box = $("chips");\n    clear(box);\n    const facts = [\n      // Which process this is, first, because everything after it is a fact about this\n      // process and nothing else. Behind a load balancer there are as many of these\n      // dashboards as there are pods, each showing its own share of the traffic.\n      ["instance", snapshot.instance],\n      ["guard", snapshot.policy.falsePositivePolicy],\n      ["suspect at", String(snapshot.policy.suspectThreshold)]\n    ];\n    if (SECTIONS.statistics) facts.push(["detectors", String(snapshot.detectors.length)]);\n    if (SECTIONS.policy) facts.push(["rules", String(snapshot.rules.length)]);\n    facts.push(["uptime", uptime(snapshot.now - snapshot.startedAt)]);\n    for (const [label2, value] of facts) {\n      const fact = el("span");\n      fact.appendChild(document.createTextNode(`${label2} `));\n      fact.appendChild(el("b", null, value));\n      box.appendChild(fact);\n    }\n  }\n  function updateWindowLabels() {\n    const label2 = windowLabel(state.rows.length, oldestAt(), Date.now());\n    for (const node of Array.from(rootNode().querySelectorAll(".win"))) node.textContent = label2;\n  }\n  function drawLivePanels() {\n    if (!SECTIONS.statistics) return;\n    const totals = aggregate(state.rows);\n    drawBars($("live-detectors"), totals.detectors, "Nothing has fired in this window.");\n    if (SECTIONS.actors) drawBars($("live-actors"), totals.actors, "No traffic in this window.");\n  }\n  function drawStatsPanels() {\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    const metrics = snapshot.metrics;\n    if (metrics !== void 0) {\n      drawBars($("stat-verdicts"), pairs(metrics.verdicts), "Nothing assessed yet.");\n      drawBars($("stat-actions"), pairs(metrics.actions), "No decisions yet.");\n      drawBars($("stat-classes"), pairs(metrics.botClasses), "Nothing classified yet.");\n      drawBars($("stat-detectors"), pairs(metrics.detectorFirings), "No detector has produced evidence yet.");\n      const challenges = $("stat-challenges");\n      clear(challenges);\n      if (!snapshot.policy.challengeEnabled) {\n        challenges.appendChild(el("div", "note", "No challenge is configured, so a rule asking for one degrades to a tag. Set challenge.secrets to enable it."));\n      } else {\n        const funnel = [\n          ["Issued", n(metrics.challenges.issued)],\n          ["Solved", n(metrics.challenges.solved)],\n          ["Rejected", n(metrics.challenges.rejected)],\n          ["Solve rate", metrics.challenges.issued > 0 ? pct(metrics.challenges.solved, metrics.challenges.issued) : "\u2014"]\n        ];\n        for (const [key, value] of funnel) challenges.appendChild(statRow(key, value));\n      }\n      const health = $("stat-health");\n      clear(health);\n      const bypassed = metrics.bypassed.allowlist + metrics.bypassed["ignored-path"];\n      const rows = [\n        ["Requests assessed", n(metrics.requests)],\n        ["Bypassed \u2014 allowlist", n(metrics.bypassed.allowlist)],\n        ["Bypassed \u2014 ignored path", n(metrics.bypassed["ignored-path"])],\n        ["Detection ran on", pct(metrics.requests - bypassed, metrics.requests)],\n        ["Actors tracked", n(metrics.actorsTracked)],\n        ["Guard stops", n(metrics.downgrades)]\n      ];\n      const shadowed = pairs(metrics.shadowFirings);\n      if (shadowed.length > 0) {\n        const moved = Object.entries(metrics.shadowChanges).filter(([, count]) => count > 0);\n        rows.push(["Shadowed findings", n(shadowed.reduce((total, [, count]) => total + count, 0))]);\n        for (const [verdict, count] of moved) rows.push([`Would have become ${verdict}`, n(count)]);\n        if (moved.length === 0) rows.push(["Verdicts they would have changed", "none"]);\n      }\n      const failures = pairs(metrics.detectorFailures);\n      for (const [detector, count] of failures) rows.push([`Detector failures \u2014 ${detector}`, n(count)]);\n      for (const [key, value] of rows) health.appendChild(statRow(key, value));\n      if (failures.length === 0) health.appendChild(el("div", "note", "No detector has thrown or timed out."));\n    }\n    const totals = aggregate(state.rows);\n    if (SECTIONS.actors) drawBars($("stat-identities"), totals.identities, "No client has named itself in this window.");\n    drawBars($("stat-paths"), totals.paths, "No traffic in this window.");\n    drawBars($("stat-denied-paths"), totals.deniedPaths, "Nothing has been denied in this window.");\n    drawBars($("stat-guard"), totals.guardStops, "No rule has asked for more than its evidence supports.");\n    drawBars($("stat-bypassed"), totals.bypassed, "Nothing bypassed detection.");\n    drawRuleHits(totals);\n    const list = $("stat-detector-list");\n    clear(list);\n    $("detector-count").textContent = `${snapshot.detectors.length} installed`;\n    for (const detector of snapshot.detectors) {\n      const row = el("div", `det${detector.shadow === true ? " shadow" : ""}`);\n      const left = el("div");\n      left.appendChild(el("div", "mono", detector.id));\n      left.appendChild(el("div", "d", detector.description));\n      row.appendChild(left);\n      const fires = (detector.shadow === true ? metrics?.shadowFirings[detector.id] : metrics?.detectorFirings[detector.id]) ?? 0;\n      const timing = metrics?.detectorTimings[detector.id];\n      let right = `${n(fires)}${detector.shadow === true ? " shadowed" : ""} \xB7 ${detector.cost} \xB7 ${detector.stage}`;\n      if (timing !== void 0 && timing.count > 0) right += ` \xB7 ${ms(timing.totalMs / timing.count)} avg`;\n      row.appendChild(el("div", "n", right));\n      list.appendChild(row);\n    }\n  }\n  function statRow(key, value) {\n    const line = el("div", "stat-row");\n    line.appendChild(el("span", "k", key));\n    line.appendChild(el("span", "v", value));\n    return line;\n  }\n  function drawRuleHits(totals) {\n    const target = $("stat-rule-hits");\n    clear(target);\n    const rules = state.snapshot?.rules ?? [];\n    if (rules.length === 0) {\n      target.appendChild(el("div", "note", "No rules configured."));\n      return;\n    }\n    let max = 1;\n    for (const rule of rules) max = Math.max(max, totals.ruleHits.get(rule) ?? 0);\n    for (const rule of rules) {\n      const value = totals.ruleHits.get(rule) ?? 0;\n      const bar = el("div", `bar${value === 0 ? " dead" : ""}`);\n      const track = el("div", "track");\n      if (value > 0) {\n        const fill = el("div", "fill");\n        fill.style.width = `${Math.max(2, Math.round(value / max * 100))}%`;\n        track.appendChild(fill);\n      }\n      track.appendChild(el("div", "lbl", rule));\n      bar.appendChild(track);\n      bar.appendChild(el("div", "v tnum", value === 0 ? "never" : n(value)));\n      target.appendChild(bar);\n    }\n  }\n  function drawAudit() {\n    const snapshot = state.snapshot;\n    if (snapshot === void 0) return;\n    const body = $("audit-body");\n    const checks = $("audit-checks");\n    clear(body);\n    clear(checks);\n    const audit = snapshot.audit;\n    if (audit === void 0) {\n      $("audit-spans").textContent = "";\n      body.appendChild(\n        el(\n          "div",\n          "note",\n          "The traffic audit is switched off on this handler (audit: false). It watches the shape of your traffic rather than any one request \u2014 a spike in automation, a collapse in human traffic, a policy suddenly denying far more than usual."\n        )\n      );\n      return;\n    }\n    const current = audit.window;\n    const baseline = audit.baseline;\n    $("audit-spans").textContent = `last ${rangeLabel(current.spanMs)} against the ${rangeLabel(baseline.spanMs)} before`;\n    const rows = [\n      ["Requests", n(current.requests), n(baseline.requests)],\n      ["Rate", `${current.rate.toFixed(1)}/min`, `${baseline.rate.toFixed(1)}/min`],\n      ["Bot share", `${Math.round(current.botShare * 100)}%`, `${Math.round(baseline.botShare * 100)}%`],\n      ["Bots", n(current.bots), n(baseline.bots)],\n      ["Humans", n(current.humans), n(baseline.humans)],\n      ["Denials", n(current.denials), n(baseline.denials)],\n      ["Challenges", n(current.challenges), n(baseline.challenges)],\n      ["Guard stops", n(current.downgrades), n(baseline.downgrades)],\n      ["Detector failures", n(current.failures), n(baseline.failures)],\n      ["Bypassed", n(current.bypassed), n(baseline.bypassed)]\n    ];\n    for (const [key, now, was] of rows) {\n      const line = el("div", "stat-row");\n      line.appendChild(el("span", "k", key));\n      const values = el("span", "v");\n      values.appendChild(el("b", null, now));\n      values.appendChild(el("span", "was", ` was ${was}`));\n      line.appendChild(values);\n      body.appendChild(line);\n    }\n    if (audit.checks.length === 0) {\n      checks.appendChild(el("div", "note", "No checks are installed, so nothing here will ever raise an anomaly."));\n      return;\n    }\n    for (const check of audit.checks) {\n      const row = el("div", "det");\n      const left = el("div");\n      left.appendChild(el("div", "mono", check.id));\n      left.appendChild(el("div", "d", check.description));\n      row.appendChild(left);\n      checks.appendChild(row);\n    }\n  }\n  function drawNoticeBadge() {\n    const notices = state.snapshot?.notices ?? [];\n    const badge = $("notice-badge");\n    badge.hidden = notices.length === 0 || !SECTIONS.notices;\n    badge.textContent = String(notices.length);\n  }\n  function drawNotices() {\n    const box = $("stat-notices");\n    const notices = state.snapshot?.notices ?? [];\n    clear(box);\n    $("notice-count").textContent = notices.length > 0 ? `${notices.length} total` : "";\n    if (notices.length === 0) {\n      box.appendChild(el("div", "note", "Nothing to report: no startup warnings, no detector errors."));\n      return;\n    }\n    for (const notice of notices.slice().reverse().slice(0, 40)) {\n      const row = el("div", `notice ${notice.kind}`);\n      const when = el("div", "when");\n      when.appendChild(el("div", "tag", notice.kind));\n      when.appendChild(el("div", null, clockTime(notice.at)));\n      row.appendChild(when);\n      const body = el("div");\n      body.appendChild(el("div", null, notice.message));\n      if (notice.source !== void 0) body.appendChild(el("div", "ev-meta", notice.source));\n      row.appendChild(body);\n      box.appendChild(row);\n    }\n  }\n  function drawChanges() {\n    if (!SECTIONS.changes) return;\n    const box = $("stat-changes");\n    const changes = state.snapshot?.changes ?? [];\n    clear(box);\n    $("change-count").textContent = changes.length > 0 ? `${changes.length} this run` : "";\n    if (changes.length === 0) {\n      box.appendChild(el("div", "note", "Nothing has been changed at runtime. Rules, guard and ranges are as the code that built this handler left them."));\n      return;\n    }\n    for (const change of changes.slice().reverse()) {\n      const row = el("div", "notice");\n      const when = el("div", "when");\n      when.appendChild(el("div", "tag", change.kind));\n      when.appendChild(el("div", null, clockTime(change.at)));\n      row.appendChild(when);\n      const body = el("div");\n      body.appendChild(el("div", null, change.summary));\n      body.appendChild(el("div", "ev-meta", change.by === void 0 || change.by === "" ? "by an unnamed viewer \u2014 this listener\'s auth carries no identity" : `by ${change.by}`));\n      row.appendChild(body);\n      box.appendChild(row);\n    }\n  }\n  function drawPeers() {\n    const box = $("peers");\n    if (BOOT.peers.length === 0) {\n      box.hidden = true;\n      return;\n    }\n    if (box.childElementCount > 0) return;\n    box.appendChild(el("span", "hint", "also:"));\n    for (const peer of BOOT.peers) {\n      const link = el("a", "linkbtn", peer.label);\n      link.href = peer.href;\n      link.rel = "noreferrer noopener";\n      box.appendChild(link);\n    }\n  }\n\n  // src/dashboard/client/charts.ts\n  var BUCKETS = 60;\n  var LATENCY_BOUNDS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 25, 50, 100];\n  var SCORE_BOUNDS = 10;\n  function positionTip(tip, host, clientX, boxLeft) {\n    tip.style.opacity = "1";\n    tip.style.left = `${Math.min(host.clientWidth - 150, Math.max(4, clientX - boxLeft - 60))}px`;\n    tip.style.top = "14px";\n  }\n  function tipRow(label2, value, colour) {\n    const line = el("div", "r");\n    const left = el("em");\n    if (colour !== void 0) {\n      const swatch = el("span", "swatch");\n      swatch.style.background = colour;\n      left.appendChild(swatch);\n    }\n    left.appendChild(document.createTextNode(label2));\n    line.appendChild(left);\n    line.appendChild(el("b", null, value));\n    return line;\n  }\n  function timeline() {\n    const bucketMs = state.rangeMs / BUCKETS;\n    const now = Date.now();\n    const start2 = now - state.rangeMs;\n    const buckets = [];\n    for (let i = 0; i < BUCKETS; i++) buckets.push({ at: start2 + i * bucketMs, served: 0, mitigated: 0, denied: 0, total: 0 });\n    for (const { entry } of state.rows) {\n      const index = Math.floor((entry.at - start2) / bucketMs);\n      if (index < 0 || index >= BUCKETS) continue;\n      const bucket = buckets[index];\n      if (bucket === void 0) continue;\n      bucket.total++;\n      const out = outcome(entry);\n      if (out === "deny") bucket.denied++;\n      else if (out === "mitigate") bucket.mitigated++;\n      else bucket.served++;\n    }\n    return buckets;\n  }\n  function drawTraffic() {\n    const host = $("traffic-chart");\n    const svg = $("traffic");\n    const width = Math.max(320, host.clientWidth - 30);\n    const height = 190;\n    const padBottom = 26;\n    const markerRow = 8;\n    const plot = height - padBottom - markerRow;\n    const buckets = timeline();\n    const now = Date.now();\n    const start2 = now - state.rangeMs;\n    let peak = 1;\n    for (const bucket of buckets) if (bucket.total > peak) peak = bucket.total;\n    const max = Math.max(2, Math.ceil(peak / 2) * 2);\n    clear(svg);\n    svg.setAttribute("viewBox", `0 0 ${width} ${height}`);\n    svg.setAttribute("height", String(height));\n    const s1 = css("--s1");\n    const s2 = css("--s2");\n    const crit = css("--crit");\n    const grid = css("--grid");\n    const muted = css("--muted");\n    const step = width / BUCKETS;\n    const barWidth = Math.max(2, step - 2);\n    for (const fraction of [0, 0.5, 1]) {\n      const y = markerRow + plot - fraction * plot;\n      svg.appendChild(svgEl("line", { class: "gridline", x1: 0, x2: width, y1: y, y2: y, stroke: grid, "stroke-width": 1 }));\n      if (fraction > 0) svg.appendChild(svgText({ x: 2, y: y - 3, fill: muted, "font-size": 10 }, Math.round(max * fraction)));\n    }\n    buckets.forEach((bucket, index) => {\n      const x = index * step + 1;\n      const servedHeight = bucket.served / max * plot;\n      const mitigatedHeight = bucket.mitigated / max * plot;\n      let y = markerRow + plot;\n      if (servedHeight > 0) {\n        y -= servedHeight;\n        svg.appendChild(svgEl("rect", { x, y, width: barWidth, height: servedHeight, fill: s1, rx: 2 }));\n      }\n      if (mitigatedHeight > 0) {\n        y -= mitigatedHeight + (servedHeight > 0 ? 2 : 0);\n        svg.appendChild(svgEl("rect", { x, y: Math.max(markerRow, y), width: barWidth, height: mitigatedHeight, fill: s2, rx: 2 }));\n      }\n      if (bucket.denied > 0) svg.appendChild(svgEl("rect", { x, y: 0, width: barWidth, height: 5, fill: crit, rx: 2 }));\n    });\n    svg.appendChild(svgEl("line", { x1: 0, x2: width, y1: markerRow + plot, y2: markerRow + plot, stroke: css("--line"), "stroke-width": 1 }));\n    const span = rangeLabel(state.rangeMs);\n    const labels = [\n      [0, `${span} ago`],\n      [BUCKETS / 2, rangeLabel(state.rangeMs / 2)],\n      [BUCKETS - 1, "now"]\n    ];\n    for (const [position, text] of labels) {\n      svg.appendChild(svgText({ x: Math.min(width - 26, Math.max(0, position * step)), y: height - 8, fill: muted, "font-size": 10 }, text));\n    }\n    const changes = (state.snapshot?.changes ?? []).filter((change) => change.at >= start2 && change.at <= now);\n    const markColour = css("--proven-text");\n    for (const change of changes) {\n      const x = (change.at - start2) / state.rangeMs * width;\n      svg.appendChild(svgEl("line", { x1: x, x2: x, y1: 0, y2: markerRow + plot, stroke: markColour, "stroke-width": 1.5, "stroke-dasharray": "3 2", opacity: 0.85 }));\n      const dot = svgEl("circle", { cx: x, cy: 3, r: 3, fill: markColour });\n      const title = svgEl("title");\n      title.textContent = `${clockTime(change.at)} \xB7 ${change.kind}: ${change.summary}${change.by === void 0 ? "" : ` (by ${change.by})`}`;\n      dot.appendChild(title);\n      svg.appendChild(dot);\n    }\n    const hover = svgEl("rect", { x: 0, y: 0, width: 0, height: markerRow + plot, fill: css("--ink"), opacity: 0.06 });\n    svg.appendChild(hover);\n    const tip = $("traffic-tip");\n    host.onmousemove = (event) => {\n      const box = svg.getBoundingClientRect();\n      const index = Math.floor((event.clientX - box.left) / box.width * BUCKETS);\n      const bucket = buckets[index];\n      if (bucket === void 0) {\n        tip.style.opacity = "0";\n        hover.setAttribute("width", "0");\n        return;\n      }\n      hover.setAttribute("x", String(index * step));\n      hover.setAttribute("width", String(step));\n      clear(tip);\n      tip.appendChild(el("div", "t", `${clockTime(bucket.at)} \xB7 ${Math.round(state.rangeMs / BUCKETS / 1e3)}s`));\n      tip.appendChild(tipRow("Served", n(bucket.served), s1));\n      tip.appendChild(tipRow("Mitigated", n(bucket.mitigated), s2));\n      tip.appendChild(tipRow("Denied", n(bucket.denied), crit));\n      positionTip(tip, host, event.clientX, box.left);\n    };\n    host.onmouseleave = () => {\n      tip.style.opacity = "0";\n      hover.setAttribute("width", "0");\n    };\n    const total = buckets.reduce((sum, bucket) => sum + bucket.total, 0);\n    $("traffic-window").textContent = `last ${rangeLabel(state.rangeMs)}`;\n    const served = buckets.reduce((sum, bucket) => sum + bucket.served, 0);\n    const mitigated = buckets.reduce((sum, bucket) => sum + bucket.mitigated, 0);\n    const denied = buckets.reduce((sum, bucket) => sum + bucket.denied, 0);\n    const busiest = buckets.reduce((best, bucket) => bucket.total > best.total ? bucket : best, buckets[0] ?? { at: now, total: 0, served: 0, mitigated: 0, denied: 0 });\n    $("traffic-alt").textContent = `Traffic over the last ${rangeLabel(state.rangeMs)}: ${n(total)} requests \u2014 ${n(served)} served, ${n(mitigated)} mitigated, ${n(denied)} denied. ` + (total === 0 ? "No traffic in this range." : `Busiest ${Math.round(state.rangeMs / BUCKETS / 1e3)}-second interval: ${n(busiest.total)} requests at ${clockTime(busiest.at)}.`) + (changes.length === 0 ? "" : ` ${n(changes.length)} runtime change${changes.length === 1 ? "" : "s"} in this range: ${changes.map((change) => `${change.kind}, ${change.summary}`).join("; ")}.`);\n    const legend = $("traffic-legend");\n    clear(legend);\n    legend.appendChild(el("span", null, `${n(total)} requests in the last ${rangeLabel(state.rangeMs)} \xB7`));\n    const oldest = oldestAt();\n    if (oldest !== void 0 && Date.now() - oldest < state.rangeMs * 0.9) {\n      legend.appendChild(el("span", null, `window holds ${rangeLabel(Date.now() - oldest)} \xB7`));\n    }\n    for (const [label2, colour] of [\n      ["Served", s1],\n      ["Mitigated \u2014 challenged, limited or delayed", s2],\n      ["Denied", crit]\n    ]) {\n      const item = el("span");\n      const swatch = el("span", "swatch");\n      swatch.style.background = colour;\n      item.appendChild(swatch);\n      item.appendChild(document.createTextNode(label2));\n      legend.appendChild(item);\n    }\n    if (changes.length > 0) {\n      const item = el("span");\n      item.appendChild(el("span", "mark"));\n      item.appendChild(document.createTextNode(`${n(changes.length)} runtime change${changes.length === 1 ? "" : "s"} \u2014 hover a marker`));\n      legend.appendChild(item);\n    }\n  }\n  function differences(cumulative) {\n    const counts = [];\n    for (let i = 0; i < cumulative.length; i++) counts.push((cumulative[i] ?? 0) - (i > 0 ? cumulative[i - 1] ?? 0 : 0));\n    return counts;\n  }\n  function drawScores() {\n    const host = $("score-chart");\n    const svg = $("scores");\n    clear(svg);\n    const metrics = state.snapshot?.metrics;\n    const fromRun = state.scoreScope === "run" && metrics !== void 0;\n    let buckets;\n    let scored;\n    let proven;\n    if (fromRun && metrics !== void 0) {\n      buckets = differences(metrics.scores.buckets);\n      scored = metrics.scores.count;\n      proven = metrics.proven;\n    } else {\n      buckets = new Array(SCORE_BOUNDS).fill(0);\n      scored = 0;\n      proven = 0;\n      for (const { entry } of state.rows) {\n        if (entry.bypass !== void 0) continue;\n        if (entry.certain) {\n          proven++;\n          continue;\n        }\n        const index = Math.min(SCORE_BOUNDS - 1, Math.floor(entry.score / 10));\n        buckets[index] = (buckets[index] ?? 0) + 1;\n        scored++;\n      }\n    }\n    const width = Math.max(280, host.clientWidth - 30);\n    const height = 190;\n    const padBottom = 30;\n    const plot = height - padBottom;\n    let max = 1;\n    for (const value of buckets) if (value > max) max = value;\n    svg.setAttribute("viewBox", `0 0 ${width} ${height}`);\n    svg.setAttribute("height", String(height));\n    const fill = css("--s1");\n    const muted = css("--muted");\n    const grid = css("--grid");\n    const crit = css("--crit");\n    svg.appendChild(svgEl("line", { class: "gridline", x1: 0, x2: width, y1: plot, y2: plot, stroke: grid, "stroke-width": 1 }));\n    const step = width / SCORE_BOUNDS;\n    buckets.forEach((value, index) => {\n      const barHeight = value / max * (plot - 8);\n      const barWidth = Math.max(2, Math.min(step - 6, 56));\n      if (barHeight > 0) {\n        svg.appendChild(svgEl("rect", { x: index * step + (step - barWidth) / 2, y: plot - barHeight, width: barWidth, height: barHeight, fill, rx: 3 }));\n      }\n      svg.appendChild(svgText({ x: index * step + 1, y: height - 14, fill: muted, "font-size": 9.5 }, index * 10));\n    });\n    const threshold = state.snapshot?.policy.suspectThreshold ?? 60;\n    const x = threshold / 100 * width;\n    svg.appendChild(svgEl("line", { x1: x, x2: x, y1: 0, y2: plot, stroke: crit, "stroke-width": 2, "stroke-dasharray": "4 3" }));\n    svg.appendChild(svgText({ x: Math.min(width - 92, x + 5), y: 11, fill: crit, "font-size": 10 }, `suspect at ${threshold}`));\n    svg.appendChild(svgText({ x: 0, y: height - 2, fill: muted, "font-size": 10 }, "score (probabilistic requests only)"));\n    const tip = $("score-tip");\n    host.onmousemove = (event) => {\n      const box = svg.getBoundingClientRect();\n      const index = Math.floor((event.clientX - box.left) / box.width * SCORE_BOUNDS);\n      const value = buckets[index];\n      if (value === void 0) {\n        tip.style.opacity = "0";\n        return;\n      }\n      clear(tip);\n      tip.appendChild(el("div", "t", `score ${index * 10}\u2013${index * 10 + 9}`));\n      tip.appendChild(tipRow("requests", n(value)));\n      tip.appendChild(tipRow("share", pct(value, scored)));\n      positionTip(tip, host, event.clientX, box.left);\n    };\n    host.onmouseleave = () => {\n      tip.style.opacity = "0";\n    };\n    let over = 0;\n    for (let bucket = 0; bucket < SCORE_BOUNDS; bucket++) if (bucket * 10 >= threshold) over += buckets[bucket] ?? 0;\n    const legend = $("score-legend");\n    clear(legend);\n    legend.appendChild(el("span", null, `${n(scored)} scored \xB7 ${n(over)} at or over the threshold \xB7 ${n(proven)} proven, which carry no score`));\n    $("score-alt").textContent = `Distribution of probabilistic scores ${fromRun ? "since start" : "in the retained window"}, with the suspect threshold at ${threshold}. ${n(scored)} scored requests, ${n(over)} at or over the threshold, ${n(proven)} proven and therefore unscored. ` + (scored === 0 ? "Nothing scored yet." : `By ten-point band: ${buckets.map((value, index) => `${index * 10}\u2013${index * 10 + 9}: ${n(value)}`).join(", ")}.`);\n    $("score-window").textContent = fromRun ? "since start" : windowLabel(state.rows.length, oldestAt(), Date.now());\n    if (state.scoreScope === "run" && metrics === void 0) {\n      legend.appendChild(el("span", null, "\xB7 counters are off on this handler, so this is the retained window"));\n    }\n  }\n  function drawLatency() {\n    const host = $("latency-chart");\n    const svg = $("latency");\n    clear(svg);\n    const metrics = state.snapshot?.metrics;\n    if (metrics === void 0 || metrics.duration.count === 0) {\n      $("latency-summary").textContent = "No assessments yet.";\n      $("latency-alt").textContent = "Assessment latency: no assessments yet.";\n      svg.setAttribute("viewBox", "0 0 100 40");\n      svg.setAttribute("height", "40");\n      svg.appendChild(svgText({ x: 0, y: 20, fill: css("--muted"), "font-size": 11 }, "No assessments yet."));\n      return;\n    }\n    const cumulative = metrics.duration.buckets;\n    const counts = differences(cumulative);\n    const width = Math.max(280, host.clientWidth - 30);\n    const height = 190;\n    const padBottom = 30;\n    const plot = height - padBottom;\n    let max = 1;\n    for (const value of counts) if (value > max) max = value;\n    svg.setAttribute("viewBox", `0 0 ${width} ${height}`);\n    svg.setAttribute("height", String(height));\n    const fill = css("--s1");\n    const muted = css("--muted");\n    const grid = css("--grid");\n    svg.appendChild(svgEl("line", { class: "gridline", x1: 0, x2: width, y1: plot, y2: plot, stroke: grid, "stroke-width": 1 }));\n    const step = width / counts.length;\n    counts.forEach((value, index) => {\n      const barHeight = value / max * (plot - 6);\n      if (barHeight > 0) {\n        svg.appendChild(svgEl("rect", { x: index * step + 1, y: plot - barHeight, width: Math.max(2, step - 3), height: barHeight, fill, rx: 3 }));\n      }\n      if (index % 2 === 0) {\n        svg.appendChild(svgText({ x: index * step + 1, y: height - 14, fill: muted, "font-size": 9.5 }, index < LATENCY_BOUNDS.length ? String(LATENCY_BOUNDS[index]) : "more"));\n      }\n    });\n    svg.appendChild(svgText({ x: 0, y: height - 2, fill: muted, "font-size": 10 }, "milliseconds (upper bound of each bucket)"));\n    const tip = $("latency-tip");\n    host.onmousemove = (event) => {\n      const box = svg.getBoundingClientRect();\n      const index = Math.floor((event.clientX - box.left) / box.width * counts.length);\n      const value = counts[index];\n      if (value === void 0) {\n        tip.style.opacity = "0";\n        return;\n      }\n      clear(tip);\n      tip.appendChild(el("div", "t", index < LATENCY_BOUNDS.length ? `\u2264 ${LATENCY_BOUNDS[index]}ms` : "over 100ms"));\n      tip.appendChild(tipRow("requests", n(value)));\n      tip.appendChild(tipRow("share", pct(value, metrics.duration.count)));\n      positionTip(tip, host, event.clientX, box.left);\n    };\n    host.onmouseleave = () => {\n      tip.style.opacity = "0";\n    };\n    const mean = metrics.duration.totalMs / metrics.duration.count;\n    const p95 = percentile(cumulative, metrics.duration.count, 0.95);\n    $("latency-summary").textContent = `Time spent in detection, per request \xB7 mean ${ms(mean)} \xB7 p95 ${ms(p95)} \xB7 max ${ms(metrics.duration.maxMs)}`;\n    $("latency-alt").textContent = `Assessment latency since start over ${n(metrics.duration.count)} requests: mean ${ms(mean)}, 95th percentile ${ms(p95)}, maximum ${ms(metrics.duration.maxMs)}. By bucket: ${counts.map((value, index) => `${index < LATENCY_BOUNDS.length ? `up to ${LATENCY_BOUNDS[index]}ms` : "over 100ms"}: ${n(value)}`).join(", ")}.`;\n  }\n  function percentile(cumulative, count, fraction) {\n    const target = count * fraction;\n    const last = LATENCY_BOUNDS[LATENCY_BOUNDS.length - 1] ?? 100;\n    for (let i = 0; i < cumulative.length; i++) {\n      if ((cumulative[i] ?? 0) >= target) return i < LATENCY_BOUNDS.length ? LATENCY_BOUNDS[i] ?? last : last;\n    }\n    return last;\n  }\n\n  // src/dashboard/client/registry.ts\n  var timer;\n  async function loadActors() {\n    if (!SECTIONS.registry) return;\n    try {\n      const body = await getJson(`/api/actors?limit=${state.actorsPageSize}&offset=${state.actorsPage * state.actorsPageSize}`);\n      state.actors = body.actors;\n      state.actorsTracked = body.tracked;\n      drawActors();\n    } catch {\n    }\n  }\n  function trackActors() {\n    if (timer !== void 0) clearInterval(timer);\n    timer = void 0;\n    if (state.tab !== "actors") return;\n    void loadActors();\n    timer = setInterval(() => {\n      if (state.tab !== "actors" || state.paused || isConfirming()) return;\n      if (state.actorScope === "feed") return;\n      void loadActors();\n    }, 4e3);\n  }\n  var ACTORS_PAGE_SIZES = [25, 50, 100, 200];\n  function drawActorsPager(full) {\n    const page = state.actorsPage;\n    const hidden = page === 0 && !full;\n    const from = page * state.actorsPageSize + 1;\n    const model = {\n      page,\n      from,\n      to: from + state.actors.length - 1,\n      total: state.actorsTracked,\n      atStart: page === 0,\n      atEnd: !full,\n      go: (next) => {\n        state.actorsPage = Math.max(0, next);\n        void loadActors();\n      },\n      size: {\n        current: state.actorsPageSize,\n        choices: ACTORS_PAGE_SIZES,\n        set: (next) => {\n          state.actorsPageSize = next;\n          state.actorsPage = 0;\n          void loadActors();\n        }\n      }\n    };\n    for (const [id, withSize] of [\n      ["actors-pager-top", true],\n      ["actors-pager", false]\n    ]) {\n      const host = $(id);\n      host.hidden = hidden;\n      if (hidden) clear(host);\n      else renderPager(host, model, { withSize });\n    }\n  }\n  function feedActors() {\n    const byKey = /* @__PURE__ */ new Map();\n    for (const row of matchingRows()) {\n      const entry = row.entry;\n      let seen = byKey.get(entry.actor);\n      if (seen === void 0) {\n        seen = { rows: 0, paths: /* @__PURE__ */ new Set(), agents: /* @__PURE__ */ new Set(), first: entry.at, last: entry.at };\n        byKey.set(entry.actor, seen);\n      }\n      seen.rows++;\n      seen.paths.add(entry.path);\n      seen.agents.add(entry.userAgent);\n      if (entry.at < seen.first) seen.first = entry.at;\n      if (entry.at > seen.last) seen.last = entry.at;\n      seen.stats = entry.actorStats ?? seen.stats;\n    }\n    const labels = new Map(state.actors.filter((actor) => actor.label !== void 0).map((actor) => [actor.key, actor.label]));\n    const out = [];\n    for (const [key, seen] of byKey) {\n      const label2 = labels.get(key);\n      out.push({\n        key,\n        ...label2 === void 0 ? {} : { label: label2 },\n        requests: seen.rows,\n        recentRate: Number.NaN,\n        distinctPaths: seen.paths.size,\n        distinctUserAgents: seen.agents.size,\n        cadenceCv: void 0,\n        // A dash where the feed cannot know, like the three columns below it. A confident\n        // zero under a heading that means "how many times has this client been proven a bot"\n        // is worse than an admission, and it was the only column here still guessing.\n        priorConfirmations: seen.stats?.priorConfirmations ?? Number.NaN,\n        unsolvedChallenges: Number.NaN,\n        cleared: seen.stats?.cleared ?? false,\n        firstSeen: seen.stats?.firstSeen ?? seen.first,\n        lastSeen: seen.last\n      });\n    }\n    return out.sort((a, b) => b.requests - a.requests);\n  }\n  function applyActorScope(scope) {\n    if (!SECTIONS.registry) return;\n    state.actorScope = scope;\n    for (const [id, on] of [\n      ["actors-scope-tracked", scope === "tracked"],\n      ["actors-scope-feed", scope === "feed"]\n    ]) {\n      byId(id).className = on ? "on" : "";\n      byId(id).setAttribute("aria-pressed", String(on));\n    }\n    drawActors();\n  }\n  function initActorScope() {\n    if (!SECTIONS.registry) return;\n    const choose = (scope) => {\n      applyActorScope(scope);\n      app.syncUrl({ replace: false });\n    };\n    $("actors-scope-tracked").addEventListener("click", () => choose("tracked"));\n    $("actors-scope-feed").addEventListener("click", () => choose("feed"));\n  }\n  function drawActors() {\n    if (!SECTIONS.registry) return;\n    if (isConfirming()) return;\n    const body = byId("actor-rows");\n    clear(body);\n    const fromFeed = state.actorScope === "feed";\n    const actors = fromFeed ? feedActors() : state.actors;\n    $("actors-count").textContent = fromFeed ? `${n(actors.length)} in the feed you are looking at \xB7 ${n(state.actorsTracked)} tracked` : `${n(actors.length)} shown \xB7 ${n(state.actorsTracked)} tracked`;\n    drawActorsPager(!fromFeed && actors.length === state.actorsPageSize);\n    if (fromFeed) for (const id of ["actors-pager-top", "actors-pager"]) byId(id).hidden = true;\n    byId("actors-empty").hidden = actors.length > 0;\n    for (const actor of actors) {\n      const row = el("tr");\n      const who = el("td", "who");\n      if (actor.label === void 0) who.textContent = actor.key;\n      else {\n        who.appendChild(el("div", "label", actor.label));\n        who.appendChild(el("div", "sub", actor.key));\n      }\n      row.appendChild(who);\n      row.appendChild(el("td", "num tnum", n(actor.requests)));\n      row.appendChild(el("td", "num tnum", Number.isNaN(actor.recentRate) ? "\u2014" : n(actor.recentRate)));\n      row.appendChild(el("td", "num tnum", n(actor.distinctPaths)));\n      const cadence = el("td", "num tnum", actor.cadenceCv === void 0 ? "\u2014" : actor.cadenceCv.toFixed(2));\n      if (actor.cadenceCv !== void 0 && actor.cadenceCv < 0.15) cadence.className += " warn-text";\n      row.appendChild(cadence);\n      row.appendChild(el("td", "num tnum", Number.isNaN(actor.priorConfirmations) ? "\u2014" : n(actor.priorConfirmations)));\n      const unsolved = el("td", "num tnum", Number.isNaN(actor.unsolvedChallenges) ? "\u2014" : n(actor.unsolvedChallenges));\n      if (actor.unsolvedChallenges >= 3) unsolved.className += " warn-text";\n      row.appendChild(unsolved);\n      const stateCell = el("td");\n      const tags = [];\n      if (actor.cleared) tags.push("cleared as human");\n      if (actor.distinctUserAgents > 1) tags.push(`${actor.distinctUserAgents} User-Agents`);\n      tags.push(`first seen ${clockStamp(actor.firstSeen)}`);\n      stateCell.appendChild(el("div", "tagline", tags.join(" \xB7 ")));\n      row.appendChild(stateCell);\n      const actions = el("td", "acts");\n      const inFeed = el("button", null, "In feed");\n      inFeed.title = "Show this actor\'s requests in the live feed";\n      inFeed.addEventListener("click", () => {\n        setSearch(`actor:${actor.key}`);\n        const search = byId("search");\n        search.value = state.search;\n        app.showTab("live");\n        app.syncUrl();\n      });\n      actions.appendChild(inFeed);\n      for (const button of actorActions(actor.key, () => void loadActors(), actor.label)) actions.appendChild(button);\n      row.appendChild(actions);\n      body.appendChild(row);\n    }\n  }\n\n  // src/dashboard/client/tester.ts\n  function initTester() {\n    if (!SECTIONS.tester) return;\n    $("test-run").addEventListener("click", () => void run());\n    byId("test-input").addEventListener("keydown", (event) => {\n      if (event.key === "Enter" && (event.metaKey || event.ctrlKey)) {\n        event.preventDefault();\n        void run();\n      }\n    });\n  }\n  async function run() {\n    const raw = byId("test-input").value;\n    if (raw.trim() === "") {\n      toast("warn", "Nothing to assess", "Paste a User-Agent, a curl command, or a header block.");\n      return;\n    }\n    const result = await postJson("/api/test", {\n      raw,\n      ip: byId("test-ip").value.trim(),\n      url: byId("test-url").value.trim()\n    });\n    const box = $("test-result");\n    box.hidden = false;\n    clear(box);\n    if (!result.ok) {\n      box.className = "result bad";\n      box.appendChild(el("div", null, result.error ?? "The server could not read that."));\n      return;\n    }\n    const { entry, reason, assumed } = result.data;\n    const out = outcome(entry);\n    box.className = `result ${out === "deny" ? "bad" : out === "mitigate" ? "warn" : "ok"}`;\n    const head = el("div");\n    const [badgeClass, badgeLabel] = verdictBadge(entry);\n    head.appendChild(el("span", `badge ${badgeClass}`, badgeLabel));\n    head.appendChild(document.createTextNode(" "));\n    head.appendChild(el("b", null, entry.action ?? "no decision"));\n    if (entry.rule !== void 0) head.appendChild(el("span", "ev-meta", ` via ${entry.rule}`));\n    box.appendChild(head);\n    box.appendChild(el("div", "ev-meta", `${entry.certain ? "proven" : `score ${entry.score}`} \xB7 assessed in ${ms(entry.durationMs)}`));\n    if (entry.downgradedFrom !== void 0) {\n      box.appendChild(el("div", "guard", `The guard stopped ${entry.downgradedFrom} here.`));\n      if (entry.downgradeReason !== void 0) box.appendChild(el("div", "basis", entry.downgradeReason));\n    }\n    if (entry.evidence.length === 0) {\n      box.appendChild(el("div", "ev-meta", entry.bypass !== void 0 ? `Detection was skipped: ${entry.bypass}.` : "No detector produced any evidence."));\n    } else {\n      const list = el("div", "ev");\n      for (const item of entry.evidence) {\n        const row = el("div", `ev-item${item.direction === "human" ? " human" : ""}`);\n        row.appendChild(el("div", `tier t-${item.certainty}`, item.certainty));\n        const detail = el("div");\n        detail.appendChild(el("div", null, item.summary));\n        detail.appendChild(el("div", "ev-meta", `${item.detector} \xB7 points to ${item.direction}`));\n        if (item.deterministicBasis !== void 0) detail.appendChild(el("div", "basis", item.deterministicBasis));\n        row.appendChild(detail);\n        list.appendChild(row);\n      }\n      box.appendChild(list);\n    }\n    box.appendChild(el("div", "ev-meta", reason));\n    const notes = [...assumed, "no history: this is assessed as a first request, so cadence and crawl breadth have nothing to read"];\n    box.appendChild(el("div", "assumed", `Assumed \u2014 ${notes.join("; ")}.`));\n  }\n\n  // src/dashboard/client/index.ts\n  var TABS = [\n    ["tab-live", "live", SECTIONS.feed],\n    ["tab-actors", "actors", SECTIONS.registry],\n    ["tab-stats", "stats", SECTIONS.statistics],\n    ["tab-policy", "policy", SECTIONS.policy]\n  ];\n  var available = TABS.filter(([, , enabled]) => enabled);\n  var FIRST = available[0]?.[1] ?? "live";\n  function tabIndexOf(name) {\n    const at = available.findIndex(([, tab]) => tab === name);\n    return at === -1 ? 0 : at;\n  }\n  function isTab(value) {\n    return available.some(([, name]) => name === value);\n  }\n  function initSkipLink() {\n    if (!isEmbedded()) return;\n    const skip = rootNode().querySelector("a.skip");\n    if (skip === null) return;\n    skip.addEventListener("click", (event) => {\n      event.preventDefault();\n      const target = rootNode().querySelector(`#view-${state.tab}`) ?? rootNode().querySelector("#view-live");\n      if (target === null) return;\n      target.tabIndex = -1;\n      target.focus();\n      target.scrollIntoView({ block: "start" });\n    });\n  }\n  function initHeader() {\n    const box = $("links");\n    for (const link of BOOT.links) {\n      const anchor = el("a", "linkbtn", link.label);\n      anchor.href = link.href;\n      anchor.rel = "noreferrer noopener";\n      box.appendChild(anchor);\n    }\n    let stored = null;\n    try {\n      stored = localStorage.getItem("bothandler-dashboard-theme");\n    } catch {\n      stored = null;\n    }\n    if (stored === "dark" || stored === "light") themeElement().setAttribute("data-theme", stored);\n    $("theme").addEventListener("click", () => {\n      let current = themeElement().getAttribute("data-theme");\n      if (current === null) current = matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light";\n      const next = current === "dark" ? "light" : "dark";\n      themeElement().setAttribute("data-theme", next);\n      try {\n        localStorage.setItem("bothandler-dashboard-theme", next);\n      } catch {\n      }\n      drawNow();\n    });\n    const pause = byId("pause");\n    pause.hidden = !SECTIONS.feed;\n    pause.addEventListener("click", () => {\n      state.paused = !state.paused;\n      pause.setAttribute("aria-pressed", String(state.paused));\n      pause.textContent = state.paused ? `Resume${state.bufferedWhilePaused > 0 ? ` (${state.bufferedWhilePaused})` : ""}` : "Pause";\n      if (!state.paused) {\n        state.bufferedWhilePaused = 0;\n        drawNow();\n      }\n    });\n    if (BOOT.allowReset) {\n      const reset = byId("reset");\n      reset.hidden = false;\n      reset.addEventListener("click", () => {\n        reset.disabled = true;\n        void fetch(`${API}/api/reset`, { method: "POST", headers: { "content-type": "application/json" }, body: "{}" }).then(async (response) => {\n          if (!response.ok) {\n            const body = await response.json().catch(() => ({}));\n            toast("bad", "Reset refused", body.error ?? String(response.status));\n            return;\n          }\n          clearFeed();\n          resetFeedCache();\n          drawNow();\n        }).catch(() => {\n        }).finally(() => {\n          reset.disabled = false;\n        });\n      });\n    }\n    const header = rootNode().querySelector("header");\n    if (header !== null) {\n      const apply2 = () => {\n        themeElement().style.setProperty("--header-h", `${header.getBoundingClientRect().height}px`);\n      };\n      apply2();\n      if (typeof ResizeObserver === "function") new ResizeObserver(apply2).observe(header);\n      else addEventListener("resize", apply2);\n    }\n  }\n  function syncUrl(replace = true) {\n    if (isEmbedded()) return;\n    const params = new URLSearchParams();\n    if (state.filter !== "all") params.set("f", state.filter);\n    if (state.search !== "") params.set("q", state.search);\n    if (state.actorScope !== "tracked") params.set("a", state.actorScope);\n    const query = params.toString();\n    const hash = `#${state.tab}${query === "" ? "" : `?${query}`}`;\n    if (location.hash === hash) return;\n    history[replace ? "replaceState" : "pushState"]({ tab: state.tab }, "", hash);\n  }\n  function readUrl() {\n    const raw = isEmbedded() ? "" : location.hash.slice(1);\n    const split = raw.indexOf("?");\n    const name = split === -1 ? raw : raw.slice(0, split);\n    const params = new URLSearchParams(split === -1 ? "" : raw.slice(split + 1));\n    const filter = params.get("f") ?? "all";\n    return {\n      tab: isTab(name) ? name : FIRST,\n      filter,\n      search: params.get("q") ?? "",\n      // Anything but the one alternative reads as the default rather than as an error:\n      // a hand-edited URL should land somewhere, and this is the somewhere it lands.\n      actorScope: params.get("a") === "feed" ? "feed" : "tracked"\n    };\n  }\n  function showTab(name, options = {}) {\n    const target = isTab(name) ? name : FIRST;\n    state.tab = target;\n    for (const [id, tab, enabled] of TABS) {\n      const selected = tab === target;\n      const node = $(id);\n      node.hidden = !enabled;\n      node.setAttribute("aria-selected", String(selected));\n      node.tabIndex = selected ? 0 : -1;\n      $(`view-${tab}`).hidden = !selected || !enabled;\n    }\n    if (options.focus === true) $(available[tabIndexOf(target)]?.[0] ?? "tab-live").focus();\n    if (target === "policy" && state.policy === void 0) {\n      void loadPolicy();\n      void loadRanges();\n    }\n    trackActors();\n    if (options.push !== false) syncUrl(options.replace !== false);\n    drawNow();\n  }\n  function initTabs() {\n    available.forEach(([id, name], index) => {\n      const tab = $(id);\n      tab.addEventListener("click", () => showTab(name, { replace: false }));\n      tab.addEventListener("keydown", (event) => {\n        let next = -1;\n        if (event.key === "ArrowRight") next = (index + 1) % available.length;\n        else if (event.key === "ArrowLeft") next = (index - 1 + available.length) % available.length;\n        else if (event.key === "Home") next = 0;\n        else if (event.key === "End") next = available.length - 1;\n        if (next === -1) return;\n        event.preventDefault();\n        showTab(available[next]?.[1] ?? FIRST, { focus: true, replace: false });\n      });\n    });\n    if (isEmbedded()) return;\n    addEventListener("popstate", () => {\n      const url = readUrl();\n      state.filter = url.filter;\n      setSearch(url.search);\n      reflectFilterButtons();\n      applyActorScope(url.actorScope);\n      showTab(url.tab, { push: false });\n    });\n  }\n  function initKeyboard() {\n    eventTarget().addEventListener("keydown", ((event) => {\n      const target = event.target;\n      const typing = target !== null && (target.tagName === "INPUT" || target.tagName === "TEXTAREA" || target.tagName === "SELECT");\n      if (event.key === "Escape") {\n        if (typing && target?.id === "search" && target.value !== "") {\n          target.value = "";\n          setSearch("");\n          syncUrl();\n          drawNow();\n          return;\n        }\n        if (typing) {\n          target?.blur();\n          return;\n        }\n        if (state.actor !== void 0) {\n          state.actor = void 0;\n          drawNow();\n          return;\n        }\n        if (state.open.size > 0) {\n          state.open.clear();\n          drawNow();\n        }\n        return;\n      }\n      if (typing || event.metaKey || event.ctrlKey || event.altKey) return;\n      if (event.key === "/" && SECTIONS.feed) {\n        event.preventDefault();\n        showTab("live");\n        const search = byId("search");\n        search.focus();\n        search.select();\n        return;\n      }\n      const digit = ["1", "2", "3", "4"].indexOf(event.key);\n      if (digit !== -1 && digit < available.length) {\n        event.preventDefault();\n        showTab(available[digit]?.[1] ?? FIRST, { focus: true, replace: false });\n      }\n    }));\n  }\n  function initRanges() {\n    const ranges = [\n      ["1m", 6e4],\n      ["5m", 3e5],\n      ["15m", 9e5],\n      ["1h", 36e5]\n    ];\n    const host = $("traffic-range");\n    for (const [label2, value] of ranges) {\n      const button = el("button", null, label2);\n      button.setAttribute("aria-pressed", String(value === state.rangeMs));\n      button.addEventListener("click", () => {\n        state.rangeMs = value;\n        for (const other of Array.from(host.children)) other.setAttribute("aria-pressed", "false");\n        button.setAttribute("aria-pressed", "true");\n        drawTraffic();\n      });\n      host.appendChild(button);\n    }\n    const scopes = [\n      ["since start", "run"],\n      ["this window", "window"]\n    ];\n    const scopeHost = $("score-scope");\n    for (const [label2, value] of scopes) {\n      const button = el("button", null, label2);\n      button.setAttribute("aria-pressed", String(value === state.scoreScope));\n      button.addEventListener("click", () => {\n        state.scoreScope = value;\n        for (const other of Array.from(scopeHost.children)) other.setAttribute("aria-pressed", "false");\n        button.setAttribute("aria-pressed", "true");\n        drawScores();\n      });\n      scopeHost.appendChild(button);\n    }\n  }\n  var pending = false;\n  function schedule() {\n    if (state.paused || pending) return;\n    pending = true;\n    requestAnimationFrame(() => {\n      pending = false;\n      draw();\n    });\n  }\n  function draw() {\n    drawChips();\n    drawTiles();\n    drawNoticeBadge();\n    updateWindowLabels();\n    if (state.tab === "live") {\n      drawActor();\n      drawFeed();\n      drawLivePanels();\n    } else if (state.tab === "actors") {\n      drawActors();\n    } else if (state.tab === "stats") {\n      drawTraffic();\n      drawLatency();\n      drawScores();\n      drawStatsPanels();\n      if (SECTIONS.audit) drawAudit();\n    } else {\n      drawPolicyTab();\n      if (SECTIONS.notices) drawNotices();\n      if (SECTIONS.changes) drawChanges();\n    }\n  }\n  function drawNow() {\n    draw();\n  }\n  function applySections() {\n    const gated = [\n      ["tiles", SECTIONS.statistics],\n      ["tester-panel", SECTIONS.tester],\n      ["ranges-panel", SECTIONS.ranges],\n      ["changes-panel", SECTIONS.changes],\n      ["actor-panel", SECTIONS.actors],\n      ["live-actors-panel", SECTIONS.actors],\n      ["audit-panel", SECTIONS.audit],\n      ["audit-checks-panel", SECTIONS.audit],\n      ["notices-panel", SECTIONS.notices],\n      ["guard-panel", SECTIONS.guard],\n      ["robots-panel", SECTIONS.robots],\n      ["identities-panel", SECTIONS.actors],\n      ["evidence-legend", SECTIONS.evidence]\n    ];\n    for (const [id, enabled] of gated) {\n      const node = rootNode().querySelector(`#${id}`);\n      if (node !== null && !enabled) node.remove();\n    }\n  }\n  function start() {\n    app.draw = schedule;\n    app.drawNow = drawNow;\n    app.showTab = showTab;\n    app.syncUrl = (options) => syncUrl(options?.replace !== false);\n    applySections();\n    initHeader();\n    drawPeers();\n    initTabs();\n    initSkipLink();\n    initKeyboard();\n    initRanges();\n    if (SECTIONS.feed) initFeed();\n    initActor();\n    initActorScope();\n    initTester();\n    initPolicy();\n    let resizeTimer;\n    addEventListener("resize", () => {\n      if (resizeTimer !== void 0) clearTimeout(resizeTimer);\n      resizeTimer = setTimeout(() => {\n        if (state.tab === "stats") {\n          drawTraffic();\n          drawLatency();\n          drawScores();\n        }\n      }, 120);\n    });\n    const url = readUrl();\n    state.filter = url.filter;\n    setSearch(url.search);\n    if (SECTIONS.feed) reflectFilterButtons();\n    applyActorScope(url.actorScope);\n    showTab(url.tab, { replace: true });\n    suspendScrollAnchoring();\n    void loadInitialSnapshot().finally(settleScrollAnchoring);\n    connectStream();\n  }\n  function htmlElement() {\n    const root2 = rootNode();\n    return root2 instanceof Document ? root2.documentElement : void 0;\n  }\n  function suspendScrollAnchoring() {\n    htmlElement()?.classList.add("settling");\n  }\n  function settleScrollAnchoring() {\n    const html = htmlElement();\n    if (html === void 0) return;\n    requestAnimationFrame(() => {\n      requestAnimationFrame(() => {\n        html.classList.remove("settling");\n      });\n    });\n  }\n  start();\n})();\n';
   }
 });
 
@@ -5300,7 +6506,10 @@ button[disabled] { opacity: .5; cursor: default; }
 .tab[aria-selected="true"] { color: var(--ink); border-bottom-color: var(--s1); }
 
 /* --- layout ------------------------------------------------------------- */
-main { padding: 18px 20px 64px; max-width: 1680px; margin: 0 auto; }
+/* The top padding is the gap under the sticky header. At 18px the counter row sat almost
+   against the header's border and read as part of it; the tiles carry their own border, so
+   two lines were meeting with nothing between them. */
+main { padding: 28px 20px 64px; max-width: 1680px; margin: 0 auto; }
 .stack { display: grid; gap: 16px; }
 /* Everything above the feed is drawn by script once the first snapshot arrives, which
    inserts a block of content above what is already laid out. The browser's scroll
@@ -5331,6 +6540,33 @@ button.tile {
   cursor: pointer; appearance: none; transition: border-color .12s, box-shadow .12s;
 }
 button.tile:hover { border-color: var(--focus); }
+/* The suggestion list under the search box, positioned against the search wrapper. */
+.search { position: relative; }
+.suggest {
+  position: absolute; top: calc(100% + 4px); left: 0; z-index: 30; margin: 0; padding: 4px;
+  list-style: none; min-width: 220px; max-height: 260px; overflow-y: auto;
+  background: var(--surface); border: 1px solid var(--line); border-radius: 9px; box-shadow: var(--shadow);
+}
+.suggest li { padding: 4px 9px; border-radius: 6px; cursor: pointer; font-size: 12px; }
+.suggest li[aria-selected="true"] { background: color-mix(in srgb, var(--focus) 18%, transparent); }
+
+/* Saved filters: a list of small removable things. Quiet, because it is not what
+   somebody came to the page to look at. */
+.saved { display: flex; align-items: center; gap: 6px; }
+/* Two open-ended bounds rather than a list of durations: "from the incident until now",
+   "everything up to when it stopped" and "between these two moments" are the same control
+   with one end left empty. */
+.timeframe { display: flex; align-items: center; gap: 8px; font-size: 11.5px; color: var(--muted); }
+.timeframe label { display: inline-flex; align-items: center; gap: 4px; }
+.timeframe input {
+  font: inherit; font-size: 11.5px; padding: 2px 5px; border-radius: 6px;
+  border: 1px solid var(--line); background: var(--surface); color: var(--ink);
+}
+.timeframe button { font: inherit; font-size: 11.5px; padding: 3px 9px; border-radius: 7px; border: 1px solid var(--line); background: var(--surface); color: var(--ink); cursor: pointer; }
+.saved select { font: inherit; font-size: 11.5px; padding: 3px 6px; border-radius: 7px; border: 1px solid var(--line); background: var(--surface); color: var(--ink); max-width: 170px; }
+.saved button { font: inherit; font-size: 11.5px; padding: 3px 9px; border-radius: 7px; border: 1px solid var(--line); background: var(--surface); color: var(--ink); cursor: pointer; }
+.saved button:hover { border-color: var(--focus); }
+
 /* The badge's companion: fetches the entries the stream skipped. Sits inline with the
    heading, so it is styled to read as part of the sentence rather than as a form control. */
 .load-skipped {
@@ -5352,6 +6588,10 @@ button.tile:hover { border-color: var(--focus); }
 .pager button:hover:not(:disabled) { border-color: var(--focus); }
 .pager button:disabled { opacity: .45; cursor: default; }
 .pager .where { font-variant-numeric: tabular-nums; }
+/* A labelled actor leads with its name and keeps the key underneath: whoever named it did
+   so because the key was not the useful part, and the key is still what you search for. */
+td.who .label { font-weight: 560; }
+td.who .sub { color: var(--muted); font-size: 11px; }
 .pager.pager-top { padding: 2px 2px 9px; border-bottom: 1px solid var(--line); margin-bottom: 9px; }
 /* The feed's upper pager rides in the toolbar rather than owning a row of its own, which
    was thirty-six pixels of mostly empty rule above every screenful of requests. */
@@ -5472,7 +6712,29 @@ input[type="search"] {
 }
 input[type="search"]::placeholder { color: var(--muted); }
 
-table { width: 100%; border-collapse: collapse; }
+/* separate with zero spacing rather than collapse, and the difference is the whole
+   reason the column headers work in Safari.
+
+   Collapsed borders and sticky table cells are a long-standing sore point in WebKit: the
+   CSSWG has an open issue on collapsed borders not following a cell when it sticks
+   (csswg-drafts#3136), and Safari is widely reported to drop the stickiness of a th
+   altogether under a collapsed table. Separating the borders is the standard remedy.
+
+   What was actually measured: the header sticks correctly in Chromium and in Firefox,
+   both before and after this change, and it was reported adrift in Safari — which is what
+   a sticky element that has stopped sticking looks like. WebKit could not be run on the
+   machine this was written on, so the Safari half of it rests on that report and on the
+   documented behaviour rather than on a measurement taken here.
+
+   The rendering is all but unchanged. Every border in these tables is a bottom border on
+   the cell itself, plus the per-cell left accent on td.edge; no border is shared between
+   two cells, so there is nothing for collapsing to merge and nothing for separating to
+   double, and zero spacing keeps the cells touching. The one measurable difference is the
+   accent column, which moves two pixels: collapsing centres that 3px border on the cell
+   edge and leaves half of it outside the box, while separating puts all of it inside.
+   Measured rather than assumed, and the leftmost column starting two pixels earlier is
+   both imperceptible and the more correct of the two. */
+table { width: 100%; border-collapse: separate; border-spacing: 0; }
 thead th {
   /* Measured at runtime — see trackHeaderHeight(). The literal is the fallback for
      the instant before the first measurement, and for the tab strip wrapping. */
@@ -5764,9 +7026,44 @@ input::placeholder { color: color-mix(in srgb, var(--muted) 80%, transparent); }
 #actor-rows td { font-size: 12.5px; }
 #actor-rows td.who { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; overflow-wrap: anywhere; }
 #actor-rows td.acts { text-align: right; white-space: nowrap; }
+/* The tracked/shown toggle above the actors table. A segmented pair rather than a
+   dropdown: there are two answers and both are worth reading at a glance. */
+.scope { display: flex; gap: 6px; padding: 0 14px 10px; }
+.scope button { font-size: 11.5px; padding: 4px 10px; }
+.scope button.on { background: var(--accent); color: var(--on-accent, #fff); border-color: var(--accent); }
+
 #actor-rows td.acts button { font-size: 11px; padding: 3px 8px; margin-left: 4px; }
+/* The Label control, which becomes a text box with a Save and a Cancel in place.
+
+   The cell does not wrap, so an editor that sat beside the row's other four buttons put
+   Save off the right edge of the panel, where it could be seen and not clicked. While
+   the editor is open it stands in for those buttons instead — which is also the right
+   thing on its own, since Allowlist and Forget are not what somebody naming a client is
+   reaching for. */
+.acts.editing > :not(.label-edit), .bar-actions.editing > :not(.label-edit) { display: none; }
+/* inline-flex rather than inline-block: the row is three fixed-size controls and a flex
+   line is the layout that cannot spill them past its own edge. */
+.label-edit { display: inline-flex; align-items: center; gap: 4px; }
+.label-edit button { flex: 0 0 auto; }
+#actor-rows td.acts .label-save, #actor-actions .label-save { border-color: var(--accent); color: var(--accent); }
+/* Qualified with the element name on purpose: input[type="text"] { width: 100% } above
+   outranks a bare class, so the width here was quietly ignored and the box grew to fill
+   whatever it was in — which is what put Save and Cancel outside the panel. */
+input.label-input {
+  font: inherit; font-size: 11px; padding: 3px 8px; width: 15ch; flex: 0 0 auto; box-sizing: border-box;
+  color: var(--ink); background: var(--surface); border: 1px solid var(--accent); border-radius: 6px;
+}
+input.label-input:focus { outline: 2px solid var(--accent); outline-offset: 1px; }
+
 /* A tag, not a warning: a cleared actor is a decision somebody made, and a metronomic
    one is a measurement. Neither is a verdict, so neither gets a verdict's colour. */
+/* A shadowed finding: shown at full detail, and visibly not part of the decision. Dimmed
+   and set behind a rule rather than coloured, because every colour on this page already
+   means something about a verdict and this one took no part in a verdict. */
+.det.shadow { opacity: 0.72; }
+.ev-item.shadow { opacity: 0.72; border-left: 2px dashed var(--line); padding-left: 8px; }
+.shadow-verdict { margin-top: 8px; font-style: italic; }
+.shadow-verdict.changed { color: var(--ink-2); font-style: normal; }
 .tagline { font-size: 11px; color: var(--muted); }
 .tagline b { color: var(--ink-2); font-weight: 600; }
 
@@ -5864,8 +7161,16 @@ input::placeholder { color: color-mix(in srgb, var(--muted) 80%, transparent); }
         <div class="toolbar">
           <div class="filters" id="filters"></div>
           <div class="search">
-            <input type="search" id="search" placeholder="path:/api  actor:203.0.113.4  -rule:allow-crawlers" spellcheck="false" autocomplete="off">
+            <input type="search" id="search" placeholder="path:/api  actor:203.0.113.4  -rule:allow-crawlers" spellcheck="false" autocomplete="off"
+                   role="combobox" aria-expanded="false" aria-controls="search-suggest" aria-autocomplete="list">
             <kbd aria-hidden="true">/</kbd>
+            <ul class="suggest" id="search-suggest" role="listbox" aria-label="Filter suggestions" hidden></ul>
+          </div>
+          <div class="saved" id="saved-filters"></div>
+          <div class="timeframe" id="timeframe">
+            <label>From <input type="datetime-local" id="from-at" step="1"></label>
+            <label>To <input type="datetime-local" id="to-at" step="1"></label>
+            <button type="button" id="timeframe-clear" hidden>Clear</button>
           </div>
           <button id="feed-export" title="Download every request matching this filter as replay JSONL">Export</button>
           <div class="pager pager-inline" id="feed-pager-top" hidden></div>
@@ -5929,6 +7234,12 @@ input::placeholder { color: color-mix(in srgb, var(--muted) 80%, transparent); }
       <div class="note" id="actors-note">Everyone the engine is currently remembering, busiest first — a far larger
          population than the feed's ring, which holds requests rather than clients. This is
          what <code>cadence</code>, <code>crawl-breadth</code> and <code>rate-anomaly</code> are reading.</div>
+      <div class="scope" role="group" aria-label="Which actors to list">
+        <button id="actors-scope-tracked" class="on" aria-pressed="true"
+          title="Every client the engine is remembering, busiest first">Tracked</button>
+        <button id="actors-scope-feed" aria-pressed="false"
+          title="Only the clients that appear in the feed you are looking at, after its filter">Shown in the feed</button>
+      </div>
       <div class="pager pager-top" id="actors-pager-top" hidden></div>
       <div class="feed-scroll">
         <table>
@@ -6242,18 +7553,21 @@ function createFacts(input) {
   const rawPath = queryStart === -1 ? url : url.slice(0, queryStart);
   const headers = /* @__PURE__ */ Object.create(null);
   for (const [name, value] of Object.entries(input.headers)) {
-    const joined = joinHeaderValue(value);
-    if (joined !== void 0) headers[name.toLowerCase()] = joined;
+    const lower = name.toLowerCase();
+    const joined = lower === "cookie" && Array.isArray(value) ? value.join("; ") : joinHeaderValue(value);
+    if (joined !== void 0) headers[lower] = joined;
   }
+  const normalized = normalizePath(rawPath);
   const facts = {
     method: (input.method ?? "GET").toUpperCase(),
-    path: normalizePath(rawPath),
+    path: normalized,
     query: parseQuery(queryStart === -1 ? "" : url.slice(queryStart + 1)),
     headers,
     headerOrder: extractOrder(input.rawHeaders, headers),
     ip: normalizeIp(input.ip) ?? input.ip,
     timestamp: input.timestamp ?? Date.now()
   };
+  if (rawPath !== normalized) facts.rawPath = rawPath.length > MAX_RAW_PATH ? rawPath.slice(0, MAX_RAW_PATH) : rawPath;
   const cookieHeader = headers["cookie"];
   if (cookieHeader !== void 0) facts.cookies = parseCookies(cookieHeader);
   if (input.protocol !== void 0) facts.protocol = input.protocol;
@@ -6286,12 +7600,23 @@ function parseQuery(search) {
   const query = /* @__PURE__ */ Object.create(null);
   if (search.length === 0) return query;
   let count = 0;
-  for (const [key, value] of new URLSearchParams(search)) {
+  for (const [key, value] of new URLSearchParams(boundedSearch(search))) {
     if (count++ >= MAX_QUERY_PARAMS) break;
     query[key] = value.length > 1024 ? value.slice(0, 1024) : value;
   }
   return query;
 }
+function boundedSearch(search) {
+  let seen = 0;
+  let at = search.charCodeAt(0) === 63 ? 1 : 0;
+  while (at < search.length) {
+    let end = search.indexOf("&", at);
+    if (end === -1) end = search.length;
+    if (end !== at && ++seen > MAX_QUERY_PARAMS) return search.slice(0, at - 1);
+    at = end + 1;
+  }
+  return search;
+}
 function extractOrder(rawHeaders, headers) {
   if (!rawHeaders || rawHeaders.length === 0) return EMPTY_ORDER;
   let isNodeStyle = rawHeaders.length % 2 === 0;
@@ -6327,13 +7652,14 @@ function isHeaderName(value) {
   }
   return true;
 }
-var MAX_URL_LENGTH, MAX_QUERY_PARAMS, MAX_ORDERED_HEADERS, EMPTY_ORDER;
+var MAX_URL_LENGTH, MAX_RAW_PATH, MAX_QUERY_PARAMS, MAX_ORDERED_HEADERS, EMPTY_ORDER;
 var init_facts = __esm({
   "src/facts.ts"() {
     "use strict";
     init_http();
     init_ip();
     MAX_URL_LENGTH = 8192;
+    MAX_RAW_PATH = 512;
     MAX_QUERY_PARAMS = 64;
     MAX_ORDERED_HEADERS = 64;
     EMPTY_ORDER = Object.freeze([]);
@@ -6618,7 +7944,7 @@ function buildDashboard(handler, options, host) {
         return send(response, 200, "application/json; charset=utf-8", JSON.stringify(snapshot()));
       case "/api/feed":
         if (!sections.feed) return sectionOff(response, "feed");
-        return send(response, 200, "application/json; charset=utf-8", JSON.stringify({ entries: feed.backlog().map(project) }));
+        return send(response, 200, "application/json; charset=utf-8", JSON.stringify({ entries: feed.backlog().map(project), skipped: feed.skipped }));
       case "/api/stream":
         if (!sections.feed) return sectionOff(response, "feed");
         return stream(request, url, response);
@@ -6696,8 +8022,11 @@ function buildDashboard(handler, options, host) {
         } else if (action === "clear") {
           const forMs = typeof payload?.forMs === "number" && Number.isFinite(payload.forMs) ? Math.min(24 * 60 * 6e4, Math.max(0, payload.forMs)) : DEFAULT_CLEARANCE_MS;
           handler.clearActor(key, forMs, { by });
+        } else if (action === "label") {
+          const label = typeof payload?.label === "string" ? payload.label : void 0;
+          handler.labelActor(key, label, { by });
         } else {
-          sendError(response, 400, 'Expected `action` to be "forget" or "clear".');
+          sendError(response, 400, 'Expected `action` to be "forget", "clear" or "label".');
           return;
         }
         send(response, 200, "application/json; charset=utf-8", JSON.stringify({ ok: true }));
@@ -7132,7 +8461,7 @@ function headerValue(request, name) {
   if (value === void 0) return void 0;
   return (Array.isArray(value) ? value[0] : value)?.trim().toLowerCase();
 }
-function stripPort(host) {
+function stripPort2(host) {
   if (host.startsWith("[")) {
     const end = host.indexOf("]");
     return end === -1 ? host : host.slice(0, end + 1);
@@ -7144,15 +8473,15 @@ function stripPort(host) {
 function resolveAllowedHosts(host, extra) {
   if (extra?.includes("*")) return void 0;
   if (!LOOPBACK_HOSTS.has(host)) return void 0;
-  const allowed = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1", stripPort(host).toLowerCase()]);
-  for (const entry of extra ?? []) allowed.add(stripPort(entry).toLowerCase());
+  const allowed = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1", stripPort2(host).toLowerCase()]);
+  for (const entry of extra ?? []) allowed.add(stripPort2(entry).toLowerCase());
   return allowed;
 }
 function hostAllowed(request, allowed) {
   if (allowed === void 0) return true;
   const host = headerValue(request, "host");
   if (host === void 0) return false;
-  return allowed.has(stripPort(host));
+  return allowed.has(stripPort2(host));
 }
 function isSameOrigin(request) {
   const site = headerValue(request, "sec-fetch-site");
@@ -7195,7 +8524,7 @@ function rangeUpdate(body, handler) {
 }
 function resolveMountedHosts(extra) {
   if (extra === void 0 || extra.length === 0 || extra.includes("*")) return void 0;
-  return new Set(extra.map((name) => stripPort(name).toLowerCase()));
+  return new Set(extra.map((name) => stripPort2(name).toLowerCase()));
 }
 function validateClients(entries) {
   const set = new IpRangeSet(entries);
@@ -7668,6 +8997,12 @@ function renderChallengePage(options) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="robots" content="noindex, nofollow">
+<!-- An empty icon, so the browser does not go looking for /favicon.ico on its own. It
+     is the browser that makes that request rather than this page, and under
+     default-src 'none' it is refused \u2014 which Firefox reports to the console as a
+     security error on a page whose entire purpose is to reassure somebody that nothing
+     is wrong. Declaring one stops the request being made at all. -->
+<link rel="icon" href="data:,">
 <title>${title}</title>
 <style>
   :root { color-scheme: light dark; --fg: #16181d; --muted: #5b6270; --bg: #fbfbfc; --line: #e2e5ea; --accent: #2f6feb; }
@@ -7853,8 +9188,8 @@ function parseAcceptLanguage(header) {
   if (header === void 0 || header.trim() === "") return [];
   const entries = [];
   const parts = header.split(",").slice(0, MAX_TAGS);
-  parts.forEach((part, order) => {
-    const [rawTag, ...parameters] = part.trim().split(";");
+  parts.forEach((part2, order) => {
+    const [rawTag, ...parameters] = part2.trim().split(";");
     const tag = (rawTag ?? "").trim().toLowerCase();
     if (tag === "" || tag === "*" || !/^[a-z]{1,8}(-[a-z\d]{1,8})*$/.test(tag)) return;
     let q = 1;
@@ -7920,51 +9255,8 @@ function clampDifficulty(difficulty) {
   return Math.min(MAX_DIFFICULTY, Math.max(1, Math.round(difficulty)));
 }
 
-// src/challenge/token.ts
-init_crypto();
-var MAX_TOKEN_LENGTH = 2048;
-function issueToken(payload, secrets) {
-  const secret = secrets[0];
-  if (secret === void 0) throw new Error("At least one signing secret is required to issue a token");
-  const body = base64UrlEncode(JSON.stringify(payload));
-  return `${body}.${sign(body, secret)}`;
-}
-function verifyToken(token, secrets, now, expectedSubject) {
-  if (token.length === 0 || token.length > MAX_TOKEN_LENGTH) return { ok: false, reason: "malformed" };
-  const separator = token.lastIndexOf(".");
-  if (separator <= 0) return { ok: false, reason: "malformed" };
-  const body = token.slice(0, separator);
-  const signature = token.slice(separator + 1);
-  let valid = false;
-  for (const secret of secrets) {
-    if (constantTimeEqual(signature, sign(body, secret))) valid = true;
-  }
-  if (!valid) return { ok: false, reason: "bad-signature" };
-  let payload;
-  try {
-    const decoded = base64UrlDecode(body).toString("utf8");
-    payload = JSON.parse(decoded);
-  } catch {
-    return { ok: false, reason: "malformed" };
-  }
-  if (typeof payload !== "object" || payload === null) return { ok: false, reason: "malformed" };
-  if (typeof payload.exp !== "number" || typeof payload.sub !== "string") return { ok: false, reason: "malformed" };
-  if (payload.exp <= now) return { ok: false, reason: "expired" };
-  if (expectedSubject !== void 0) {
-    let bound = false;
-    for (const candidate of typeof expectedSubject === "string" ? [expectedSubject] : expectedSubject) {
-      if (constantTimeEqual(payload.sub, candidate)) bound = true;
-    }
-    if (!bound) return { ok: false, reason: "wrong-actor" };
-  }
-  return { ok: true, payload };
-}
-function newChallenge(subject, difficulty, ttlMs, now) {
-  return { v: 1, sub: subject, iat: now, exp: now + ttlMs, nonce: randomId(12), diff: difficulty };
-}
-function newClearance(subject, level, ttlMs, now) {
-  return { v: 1, sub: subject, iat: now, exp: now + ttlMs, jti: randomId(9), lvl: level };
-}
+// src/challenge/index.ts
+init_token();
 
 // src/challenge/interaction.ts
 init_crypto();
@@ -8048,7 +9340,14 @@ function analyseMovement(path) {
     timingVariation: coefficientOfVariation(gaps),
     accelerationChanges,
     straightness: pathLength === 0 ? 1 : Math.min(1, Math.hypot(netX, netY) / pathLength),
-    fractionalShare: fractional / samples.length,
+    // Over the samples this actually looked at, not over everything that arrived. The
+    // two differ by however many discontinuities were dropped above, and using the raw
+    // count meant a path with pauses in it reported a *lower* fractional share than the
+    // samples it was computed from — which reads as "these coordinates are integers"
+    // when what happened is that most of them were never examined. It costs the people
+    // most likely to have pauses: somebody who moved the pointer, stopped to read, and
+    // moved again.
+    fractionalShare: distances.length === 0 ? 0 : fractional / distances.length,
     totalTurning
   };
 }
@@ -8143,9 +9442,10 @@ function verifyInteraction(report, elapsedMs, settings = DEFAULT_INTERACTION_SET
   const failed = Object.keys(CAPABILITY_WEIGHTS).filter((name) => report.capabilities[name] !== true);
   notes.push(failed.length === 0 ? "capabilities 100%" : `capabilities ${(capabilityScore * 100).toFixed(0)}% (missing: ${failed.join(", ")})`);
   let score = capabilityScore * 0.6;
-  const measurable = report.via === "pointer" && report.path.length >= 4;
+  const analysis = analyseMovement(report.path);
+  const measurable = report.via === "pointer" && analysis.samples >= 4;
   if (measurable) {
-    const movement = scoreMovement(analyseMovement(report.path));
+    const movement = scoreMovement(analysis);
     notes.push(`movement ${(movement * 100).toFixed(0)}%`);
     score += movement * 0.4;
   } else {
@@ -8161,7 +9461,12 @@ function verifyInteraction(report, elapsedMs, settings = DEFAULT_INTERACTION_SET
 // src/challenge/index.ts
 init_http();
 init_crypto();
+init_lru();
 init_clock();
+init_token();
+var IMPLAUSIBLE_HASHES_PER_MS = 2e4;
+var MAX_TRACKED_TOKENS = 2e4;
+var MAX_BEARERS = 64;
 var ChallengeService = class {
   constructor(options) {
     this.options = options;
@@ -8177,11 +9482,14 @@ var ChallengeService = class {
     this.verifyPath = options.verifyPath ?? "/__bothandler/verify";
     this.cookieName = options.cookieName ?? "__bh_clearance";
     this.clock = options.clock ?? systemClock;
+    this.bearers = new TtlLru(MAX_TRACKED_TOKENS, this.clearanceTtlMs, this.clock);
     this.store = options.store;
     this.interaction = !wantsGesture ? void 0 : { ...DEFAULT_INTERACTION_SETTINGS, ...options.interaction === true ? {} : options.interaction };
   }
   options;
   secrets;
+  /** Clearance token id to the actors that have presented it. Bounded both ways. */
+  bearers;
   difficulty;
   challengeTtlMs;
   clock;
@@ -8264,7 +9572,11 @@ var ChallengeService = class {
         "cache-control": "no-store, private",
         // The page carries one inline script and nothing else. Locking the policy
         // this far down means the interstitial cannot be turned into a fetch primitive.
-        "content-security-policy": `default-src 'none'; script-src 'nonce-${rendered.scriptNonce}'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+        // `img-src data:` permits nothing off this machine — a data: URI is inline by
+        // definition — and exists only so the empty icon the page declares is honoured.
+        // Without it the browser asks for /favicon.ico by itself and is refused, which
+        // Firefox prints as a security error in the console of every person challenged.
+        "content-security-policy": `default-src 'none'; script-src 'nonce-${rendered.scriptNonce}'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
         "referrer-policy": "no-referrer",
         "x-content-type-options": "nosniff",
         "x-robots-tag": "noindex, nofollow"
@@ -8309,6 +9621,11 @@ var ChallengeService = class {
       interactionScore = outcome.score;
       notes = outcome.notes;
     }
+    const elapsedSinceIssue = this.clock.now() - verified.payload.iat;
+    const floorMs = 2 ** verified.payload.diff / IMPLAUSIBLE_HASHES_PER_MS | 0;
+    if (elapsedSinceIssue >= 0 && elapsedSinceIssue < floorMs) {
+      return { ok: false, status: 400, reason: "solution returned faster than the puzzle allows", signal: "implausible-speed" };
+    }
     if (this.store) {
       let claimed;
       try {
@@ -8316,7 +9633,7 @@ var ChallengeService = class {
       } catch {
         claimed = true;
       }
-      if (!claimed) return { ok: false, status: 409, reason: "challenge already solved" };
+      if (!claimed) return { ok: false, status: 409, reason: "challenge already solved", signal: "replay" };
     }
     return {
       ok: true,
@@ -8346,10 +9663,55 @@ var ChallengeService = class {
   }
   /** Reads and validates the clearance cookie for an actor. Returns `undefined` if there is none valid. */
   read(actorKey, cookies) {
+    const inspected = this.inspect(actorKey, cookies);
+    return inspected.claims;
+  }
+  /**
+   * Reads a clearance token and says what became of it.
+   *
+   * `read` answers the only question the clearance detector used to ask — is this client
+   * cleared — and throws away the reason when the answer is no. One of those reasons is
+   * worth keeping: a token whose *signature* is ours but whose subject is somebody
+   * else's has been moved between clients. Usually that is innocent and extremely
+   * common, because the subject is derived from the address and a phone changing
+   * networks changes its address. It stops being innocent when one token turns up under
+   * a great many different actors, which is a token being handed around.
+   */
+  inspect(actorKey, cookies) {
     const token = cookies?.[this.cookieName];
-    if (token === void 0) return void 0;
-    const verified = verifyToken(token, this.secrets, this.clock.now(), this.subjectsFor(actorKey));
-    return verified.ok ? verified.payload : void 0;
+    if (token === void 0) return { presentedBy: 0 };
+    const now = this.clock.now();
+    const verified = verifyToken(token, this.secrets, now, this.subjectsFor(actorKey));
+    if (verified.ok) return { claims: verified.payload, presentedBy: this.noteBearer(verified.payload.jti, actorKey) };
+    if (verified.reason !== "wrong-actor") return { presentedBy: 0 };
+    const claims = this.claimsOf(token);
+    return claims === void 0 ? { presentedBy: 0 } : { boundElsewhere: true, presentedBy: this.noteBearer(claims.jti, actorKey) };
+  }
+  /** The claims inside a token whose signature has already been checked. */
+  claimsOf(token) {
+    const separator = token.lastIndexOf(".");
+    if (separator <= 0) return void 0;
+    try {
+      const claims = JSON.parse(base64UrlDecode(token.slice(0, separator)).toString("utf8"));
+      return typeof claims?.jti === "string" ? claims : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Files this presentation under the token's own id, returning how many distinct actors
+   * have now presented it. Bounded in both directions, and in process for the reason
+   * given in `state.ts`: a store round trip per request buys precision nobody asked for.
+   */
+  noteBearer(jti, actorKey) {
+    if (this.bearers === void 0) return 0;
+    let seen = this.bearers.get(jti);
+    if (seen === void 0) {
+      seen = /* @__PURE__ */ new Set();
+      this.bearers.set(jti, seen);
+    }
+    if (seen.size < MAX_BEARERS) seen.add(actorKey);
+    return seen.size;
   }
   /** A `Set-Cookie` that removes any clearance. Call it on logout. */
   revoke() {
@@ -8871,6 +10233,10 @@ var NotificationHub = class {
 init_policy();
 init_dns();
 init_clearance();
+init_challenge_reaction();
+init_challenge_integrity();
+init_site_baseline();
+init_marker2();
 init_evidence();
 init_known_bots();
 init_types2();
@@ -9048,6 +10414,301 @@ function defineHandler(handler) {
 init_ua();
 init_pattern();
 init_crypto();
+init_text();
+
+// src/probe/index.ts
+init_marker();
+init_lru();
+init_ip();
+init_marker();
+var DEFAULT_TTL_MS = 12 * 60 * 6e4;
+var FANOUT_WORDS = 4;
+var FANOUT_BITS = FANOUT_WORDS * 32;
+function hashToBit(value) {
+  let hash = 2166136261;
+  for (let i = 0; i < value.length; i++) {
+    hash ^= value.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0) % FANOUT_BITS;
+}
+function estimateDistinct(sketch, cap) {
+  let set = 0;
+  for (let word = 0; word < FANOUT_WORDS; word++) {
+    let bits = sketch[word];
+    while (bits !== 0) {
+      bits &= bits - 1;
+      set++;
+    }
+  }
+  if (set >= FANOUT_BITS) return cap;
+  const estimate = Math.round(-FANOUT_BITS * Math.log(1 - set / FANOUT_BITS));
+  return Math.min(estimate, cap);
+}
+var MarkerProbe = class {
+  cookieName;
+  secrets;
+  ttlMs;
+  cookieOptions;
+  clock;
+  /**
+   * Marker id to a 128-bit sketch of the networks it has been presented from.
+   *
+   * A `Set` of network strings is the obvious structure and measured at **55.6 MB** with
+   * both caps full — twenty thousand markers each seen from a few dozen networks — which
+   * is far too much to hand somebody for switching on a detector. The question being
+   * asked is only ever "has this marker come from more than about sixteen networks", and
+   * a bitmap answers that in sixteen bytes by linear counting: hash each network to a
+   * bit, then estimate the distinct count from how many bits are set.
+   *
+   * The estimate carries a few percent of error in **either** direction — measured, 16
+   * real networks read as 17 and 32 read as 33 — so the threshold it feeds is a soft
+   * boundary rather than a hard one. That is honest for this signal in particular, which
+   * cannot separate a proxy pool from a heavily mobile person at any resolution, and is
+   * why it is capped at `moderate` and never denies anybody by itself.
+   */
+  fanout;
+  maxNetworks;
+  /**
+   * Markers already verified, by the exact cookie value that verified.
+   *
+   * A browsing session sends one identical cookie on every request, and verifying it is
+   * an HMAC — which measured at roughly twenty microseconds, nearly doubling the cost of
+   * an assessment to re-establish a fact that had not changed. The cache is only ever
+   * populated with *successes*: caching failures would let anyone flood it with unique
+   * junk, and a failure is cheap to reach anyway.
+   *
+   * Expiry is still checked on every hit, so a cached marker stops being accepted at the
+   * moment it should. The key is the whole signed value, so a cache hit is only possible
+   * for a string that already carried a valid signature.
+   */
+  verified;
+  constructor(options) {
+    if (options.secrets.length === 0) throw new Error("A marker probe requires at least one secret");
+    for (const secret of options.secrets) {
+      if (secret.length < 32) {
+        throw new Error("Each marker secret must be at least 32 characters; generate one with `crypto.randomBytes(32).toString('base64url')`");
+      }
+    }
+    this.secrets = options.secrets;
+    this.cookieName = options.cookieName ?? "__bh_m";
+    this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    this.clock = options.clock;
+    const tracked = options.maxTrackedMarkers ?? 2e4;
+    this.maxNetworks = options.maxNetworksPerMarker ?? 96;
+    this.fanout = tracked > 0 ? new TtlLru(tracked, this.ttlMs, options.clock) : void 0;
+    const cached = options.maxVerifiedMarkers ?? 5e3;
+    this.verified = cached > 0 ? new TtlLru(cached, this.ttlMs, options.clock) : void 0;
+    this.cookieOptions = {
+      ...options.sameSite === void 0 ? {} : { sameSite: options.sameSite },
+      ...options.secure === void 0 ? {} : { secure: options.secure },
+      ...options.domain === void 0 ? {} : { domain: options.domain }
+    };
+    try {
+      markerCookie(this.cookieName, newMarker({ b: "x", o: "x", l: "x" }, this.ttlMs, 0), this.secrets, this.cookieOptions);
+    } catch (error) {
+      throw new Error(`The marker probe cannot issue a cookie with this configuration: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  /** Reads the marker this request carried, and measures it against the request. */
+  observe(facts, ua) {
+    const shape = identityShape(facts, ua);
+    const reading = this.read(facts.cookies?.[this.cookieName]);
+    const drift = reading.kind === "valid" ? driftBetween({ b: reading.claims.b, o: reading.claims.o, l: reading.claims.l }, shape) : void 0;
+    const networks = reading.kind === "valid" ? this.noteNetwork(reading.claims.sub, facts.ip) : 0;
+    return { reading, drift, shape, networks };
+  }
+  /**
+   * Whether this response should carry a marker.
+   *
+   * Only when the client is not already holding a good one. An ordinary visitor is
+   * therefore issued a cookie once and then browses with uncached-by-`Set-Cookie`
+   * responses never again; a client that discards cookies is issued one every time,
+   * which is itself the observation `marker-persistence` is built on.
+   */
+  shouldIssue(observation) {
+    return observation.reading.kind !== "valid";
+  }
+  /** Verifies a presented marker, reusing an earlier verification of the same value. */
+  read(value) {
+    if (value === void 0 || value.length === 0) return { kind: "absent" };
+    const now = this.clock.now();
+    const remembered = this.verified?.get(value);
+    if (remembered !== void 0) return remembered.exp > now ? { kind: "valid", claims: remembered } : { kind: "expired" };
+    const reading = readMarker(value, this.secrets, now);
+    if (reading.kind === "valid") this.verified?.set(value, reading.claims);
+    return reading;
+  }
+  /**
+   * Files this presentation under the marker's own id and returns how many distinct
+   * networks it has now come from.
+   *
+   * A `/24` rather than an address, because a single visitor's address changes for
+   * ordinary reasons all day — a phone moving between cells, a router relearning a
+   * lease — while the network it sits behind usually does not. Counting addresses would
+   * report every commuter.
+   */
+  noteNetwork(markerId, ip) {
+    if (this.fanout === void 0) return 0;
+    let sketch = this.fanout.get(markerId);
+    if (sketch === void 0) {
+      sketch = new Uint32Array(FANOUT_WORDS);
+      this.fanout.set(markerId, sketch);
+    }
+    const bit = hashToBit(networkKey(ip));
+    sketch[bit >>> 5] = sketch[bit >>> 5] | 1 << (bit & 31);
+    return estimateDistinct(sketch, this.maxNetworks);
+  }
+  /** The `Set-Cookie` handing this client a marker bound to the identity it just claimed. */
+  issue(observation) {
+    return markerCookie(this.cookieName, newMarker(observation.shape, this.ttlMs, this.clock.now()), this.secrets, this.cookieOptions);
+  }
+};
+
+// src/site/index.ts
+init_lru();
+var WALK_BUCKETS = 1024;
+function bucketSet(record, bucket) {
+  record.bits[bucket >>> 5] = record.bits[bucket >>> 5] | 1 << (bucket & 31);
+}
+function bucketGet(record, bucket) {
+  return (record.bits[bucket >>> 5] & 1 << (bucket & 31)) !== 0;
+}
+function coarsen(record) {
+  const merged = new Uint32Array(WALK_BUCKETS / 32);
+  for (let bucket = 0; bucket < WALK_BUCKETS / 2; bucket++) {
+    const low = bucket * 2;
+    if (bucketGet(record, low) || bucketGet(record, low + 1)) {
+      merged[bucket >>> 5] = merged[bucket >>> 5] | 1 << (bucket & 31);
+    }
+  }
+  record.bits = merged;
+  record.scale *= 2;
+}
+var DEFAULTS = {
+  warmupRequests: 5e3,
+  maxPaths: 5e4,
+  maxTemplates: 256,
+  maxActorsPerTemplate: 64,
+  windowMs: 60 * 6e4,
+  maxWatchedPaths: 2048,
+  maxActorsPerPath: 64
+};
+var SiteProfile = class {
+  options;
+  paths;
+  walks;
+  watched;
+  clock;
+  observed = 0;
+  misses = 0;
+  answered = 0;
+  constructor(options) {
+    this.options = { ...DEFAULTS, ...stripUndefined2(options) };
+    this.paths = new TtlLru(this.options.maxPaths, this.options.windowMs, options.clock);
+    this.walks = new TtlLru(this.options.maxTemplates, this.options.windowMs, options.clock);
+    this.clock = options.clock;
+    this.watched = this.options.maxWatchedPaths > 0 ? new TtlLru(this.options.maxWatchedPaths, this.options.windowMs, options.clock) : void 0;
+  }
+  /**
+   * Whether enough traffic has been seen for any of this to mean anything.
+   *
+   * Every reader checks this. A profile that answers during warmup is worse than one
+   * that does not exist, because it answers confidently and wrongly.
+   */
+  get warm() {
+    return this.observed >= this.options.warmupRequests;
+  }
+  get requestsObserved() {
+    return this.observed;
+  }
+  /** The share of answered requests that were misses, or `undefined` before warmup. */
+  get missRate() {
+    return this.warm && this.answered > 0 ? this.misses / this.answered : void 0;
+  }
+  /** Files a request. Called once per assessed request, before the detectors run. */
+  record(path, actorKey) {
+    if (this.observed < Number.MAX_SAFE_INTEGER) this.observed++;
+    const seen = this.paths.get(path);
+    this.paths.set(path, (seen ?? 0) + 1);
+    if (this.watched === void 0 || !this.warm) return;
+    let surge = this.watched.get(path);
+    if (surge === void 0) {
+      if (seen !== void 0) return;
+      surge = { actors: /* @__PURE__ */ new Set(), firstSeen: this.clock.now(), answered: 0, misses: 0 };
+      this.watched.set(path, surge);
+    }
+    if (surge.actors.size < this.options.maxActorsPerPath) surge.actors.add(actorKey);
+  }
+  /** Files what the application answered, for the site's miss rate and each watched path. */
+  recordOutcome(path, status) {
+    if (this.answered < Number.MAX_SAFE_INTEGER) this.answered++;
+    const missed = status === 404 || status === 410;
+    if (missed) this.misses++;
+    const surge = this.watched?.get(path);
+    if (surge === void 0) return;
+    surge.answered++;
+    if (missed) surge.misses++;
+  }
+  /** What has happened to a path since it first appeared. `undefined` if not watched. */
+  surgeOf(path) {
+    if (!this.warm) return void 0;
+    const surge = this.watched?.get(path);
+    if (surge === void 0) return void 0;
+    return { clients: surge.actors.size, ageMs: this.clock.now() - surge.firstSeen, answered: surge.answered, misses: surge.misses };
+  }
+  /**
+   * How many times the site has served this path, to anybody.
+   *
+   * `undefined` before warmup, and `0` for a path this process has not seen — which is
+   * not the same as one the site does not have, and is why the detector reading this
+   * needs a great many of them before it says anything.
+   */
+  timesSeen(path) {
+    return this.warm ? this.paths.get(path) ?? 0 : void 0;
+  }
+  /** Files one step of a numeric walk against the shape it belongs to. */
+  recordWalk(template, id, actorKey) {
+    let record = this.walks.get(template);
+    if (record === void 0) {
+      record = { actors: /* @__PURE__ */ new Set(), bits: new Uint32Array(WALK_BUCKETS / 32), scale: 1, min: id, max: id, visits: 0 };
+      this.walks.set(template, record);
+    }
+    record.visits++;
+    if (record.actors.size < this.options.maxActorsPerTemplate) record.actors.add(actorKey);
+    if (id < record.min) record.min = id;
+    if (id > record.max) record.max = id;
+    while (Math.floor(record.max / record.scale) >= WALK_BUCKETS) coarsen(record);
+    bucketSet(record, Math.floor(id / record.scale));
+  }
+  /** What the whole site has done with one numeric shape. `undefined` before warmup. */
+  spreadOf(template) {
+    if (!this.warm) return void 0;
+    const record = this.walks.get(template);
+    if (record === void 0) return void 0;
+    const lowest = Math.floor(record.min / record.scale);
+    const highest = Math.floor(record.max / record.scale);
+    let touched = 0;
+    for (let bucket = lowest; bucket <= highest; bucket++) if (bucketGet(record, bucket)) touched++;
+    const window = highest - lowest + 1;
+    return {
+      actors: record.actors.size,
+      ids: touched * record.scale,
+      buckets: touched,
+      scale: record.scale,
+      visits: record.visits,
+      coverage: touched / window
+    };
+  }
+};
+function stripUndefined2(value) {
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) if (entry !== void 0) out[key] = entry;
+  return out;
+}
+
+// src/core.ts
+init_state();
 init_config();
 
 // src/internal/async.ts
@@ -9072,12 +10733,22 @@ function withTimeout(work, ms, fallback) {
 // src/core.ts
 init_ip();
 var TIMED_OUT = /* @__PURE__ */ Symbol("bothandler.timeout");
+function sanitize(item) {
+  const summary = safeSummary(item.summary);
+  const basis = item.deterministicBasis === void 0 ? void 0 : safeSummary(item.deterministicBasis);
+  if (summary === item.summary && basis === item.deterministicBasis) return item;
+  return { ...item, summary, ...basis === void 0 ? {} : { deterministicBasis: basis } };
+}
 var BotHandler = class {
   config;
   registry;
   store;
   policy;
   challenge;
+  /** The marker-cookie probe, when the operator asked for one. See `probe` in the config. */
+  probe;
+  /** The site-wide baseline, when the operator asked for one. See `site` in the config. */
+  site;
   notifications;
   /**
    * The traffic audit, or `undefined` when it was switched off with `audit: false`.
@@ -9093,6 +10764,8 @@ var BotHandler = class {
   cheapDetectors = [];
   ioDetectors = [];
   confirmingDetectors = [];
+  /** Hoisted from the resolved config: read once per detector per request. */
+  shadowIds;
   events;
   ignoreExact;
   ignorePatterns;
@@ -9107,12 +10780,15 @@ var BotHandler = class {
     this.store = options.store ?? new MemoryStore({ clock: this.config.clock });
     this.registry = new ActorRegistry(this.config.clock, { windowMs: this.config.actorWindowMs, maxActors: this.config.maxActors });
     this.signatures = compileSignatures(this.config.signatures);
+    this.shadowIds = this.config.shadowDetectors;
     this.resolver = cachingResolver(options.resolver ?? nodeDnsResolver(this.config.detectorTimeoutMs));
     this.handlers = new Map((options.handlers ?? []).map((handler) => [handler.id, handler]));
     this.isHuman = options.isHuman;
     this.meter = options.metrics === false ? void 0 : new Metrics(typeof options.metrics === "object" ? options.metrics : {});
     this.timing = this.meter?.perDetectorTiming === true;
     this.challenge = options.challenge ? new ChallengeService({ ...options.challenge, store: this.store, clock: this.config.clock }) : void 0;
+    this.probe = options.probe !== void 0 ? new MarkerProbe({ ...options.probe, clock: this.config.clock }) : void 0;
+    this.site = options.site !== void 0 ? new SiteProfile({ ...options.site, clock: this.config.clock }) : void 0;
     this.notifications = new NotificationHub({
       ...options.notifications,
       clock: this.config.clock,
@@ -9133,12 +10809,35 @@ var BotHandler = class {
     const detectors = [...this.config.detectors];
     if (this.challenge && !detectors.some((detector) => detector.id === "clearance")) {
       detectors.unshift(clearanceDetector(this.challenge));
+      if (!detectors.some((detector) => detector.id === "challenge-reaction")) {
+        detectors.unshift(challengeReactionDetector());
+      }
+      if (!detectors.some((detector) => detector.id === "challenge-integrity")) {
+        detectors.unshift(challengeIntegrityDetector());
+      }
+    }
+    if (this.site !== void 0) {
+      for (const detector of [distributedWalkDetector(), pathNoveltyDetector(), missBaselineDetector(), pathCampaignDetector()]) {
+        if (!detectors.some((installed) => installed.id === detector.id)) detectors.unshift(detector);
+      }
+    }
+    if (this.probe !== void 0) {
+      for (const detector of [identityDriftDetector(), markerIntegrityDetector(), markerPersistenceDetector(), markerFanoutDetector()]) {
+        if (!detectors.some((installed) => installed.id === detector.id)) detectors.unshift(detector);
+      }
     }
     for (const detector of detectors) {
       if (detector.stage === "confirming") this.confirmingDetectors.push(detector);
       else if (detector.cost === "io") this.ioDetectors.push(detector);
       else this.cheapDetectors.push(detector);
     }
+    for (const id of this.shadowIds) {
+      if (!detectors.some((detector) => detector.id === id)) {
+        this.warn(
+          `shadowDetectors names "${id}", which is not an installed detector, so nothing is being shadowed by that entry. Installed: ${detectors.map((detector) => detector.id).join(", ")}.`
+        );
+      }
+    }
     if (options.shareConfirmations === true) {
       this.registry.onFirstSight = (state) => this.loadSharedConfirmations(state);
     }
@@ -9293,6 +10992,45 @@ var BotHandler = class {
     this.warn(`Actor "${key}" was cleared as human at runtime${attribute(context)}, until ${new Date(until).toISOString()}.`);
     this.events.emit("actor-change", { key, action: "clear", until, by: context.by });
   }
+  /**
+   * Tells the engine what the application answered.
+   *
+   * The one thing detection cannot see for itself. Every verdict here is reached *before*
+   * the response exists — that is what makes it useful, since it can shape the response —
+   * and so the status is knowledge only the application holds. Handed back, it closes the
+   * oldest gap in reading a scanner: an actor whose requests are almost all misses is
+   * looking for something rather than reading anything, and no amount of header analysis
+   * shows that.
+   *
+   * Optional, and silent when the actor has already been forgotten. Nothing about
+   * detection depends on it being called; supplying it sharpens `probe-volume` and
+   * nothing else. The bundled Node adapter wires it up for you.
+   */
+  recordOutcome(facts, status) {
+    if (!this.isIgnoredPath(facts.path) && !this.isAllowlisted(facts.ip)) {
+      this.site?.recordOutcome(facts.path, status);
+    }
+    if (!Number.isFinite(status)) return;
+    this.registry.peek(this.actorKeyFor(facts))?.recordOutcome(status);
+  }
+  /**
+   * Gives an actor a name, or clears it with `undefined`.
+   *
+   * Detection never reads it — a label cannot make anybody more or less suspicious, and
+   * that separation is deliberate: the moment a note changes a verdict, writing notes
+   * becomes a way to be wrong about people at scale. It is for the humans reading the
+   * dashboard, and it survives exactly as long as the actor does.
+   *
+   * Available from code so a deployment can label what it already knows — its own
+   * monitoring, a partner's feed, the office egress — rather than waiting for somebody to
+   * recognise the address twice.
+   */
+  labelActor(key, label, context = {}) {
+    const state = this.registry.peek(key);
+    if (state === void 0) return;
+    state.setLabel(label);
+    this.warn(`Actor "${key}" was ${label === void 0 ? "unlabelled" : `labelled "${state.label ?? ""}"`} at runtime${attribute(context)}.`);
+  }
   /** Convenience for `updateRanges("crawler:<id>", …)`, matching a signature id. */
   updateCrawlerRanges(signatureId, entries, context = {}) {
     this.updateRanges(`crawler:${signatureId}`, entries, context);
@@ -9405,7 +11143,10 @@ var BotHandler = class {
       id: detector.id,
       description: detector.description,
       cost: detector.cost ?? "cheap",
-      stage: detector.stage ?? "always"
+      stage: detector.stage ?? "always",
+      // Present only when it is true, so a deployment shadowing nothing lists exactly
+      // what it listed before.
+      ...this.shadowIds.has(detector.id) ? { shadow: true } : {}
     }));
   }
   /** Recovers the client address from a socket address and headers, honouring the proxy config. */
@@ -9448,8 +11189,22 @@ var BotHandler = class {
     const state = record ? this.registry.observe(actorKey, facts) : detachedActor(actorKey, facts);
     const ua = parseUserAgent(facts.headers["user-agent"]);
     const signatureMatches = ua.lower.length > 0 ? this.signatures.matchAll(ua.lower) : [];
+    for (const match of signatureMatches) state.noteIdentity(match.id, match.category, match.verification.kind !== "none");
+    const marker = this.probe?.observe(facts, ua);
+    if (marker !== void 0 && record) {
+      state.noteMarker(marker.reading.kind === "valid", marker.reading.kind === "forged", marker.drift);
+    }
+    if (this.site !== void 0 && record) {
+      const seenBefore = this.site.timesSeen(facts.path);
+      this.site.record(facts.path, actorKey);
+      if (seenBefore === 0) state.noteNovelPath();
+      const step = walkStepOf(facts.path);
+      if (step !== void 0) this.site.recordWalk(step.template, step.id, actorKey);
+    }
     const context = {
       facts,
+      marker,
+      site: this.site,
       ua,
       actor: state.snapshot(facts.timestamp),
       state,
@@ -9461,21 +11216,22 @@ var BotHandler = class {
       shared: /* @__PURE__ */ new Map()
     };
     const evidence2 = [];
+    const shadowEvidence = [];
     const failures = [];
     let pending;
     for (const detector of this.cheapDetectors) {
-      const inFlight = this.run(detector, context, evidence2, failures, 0);
+      const inFlight = this.run(detector, context, evidence2, shadowEvidence, failures, 0);
       if (inFlight !== void 0) (pending ??= []).push(inFlight);
     }
     for (const detector of this.ioDetectors) {
-      const inFlight = this.run(detector, context, evidence2, failures, this.config.detectorTimeoutMs);
+      const inFlight = this.run(detector, context, evidence2, shadowEvidence, failures, this.config.detectorTimeoutMs);
       if (inFlight !== void 0) (pending ??= []).push(inFlight);
     }
     if (pending !== void 0) await Promise.all(pending);
     if (signatureMatches.length > 0 && this.confirmingDetectors.length > 0) {
       let confirming;
       for (const detector of this.confirmingDetectors) {
-        const inFlight = this.run(detector, context, evidence2, failures, this.config.detectorTimeoutMs);
+        const inFlight = this.run(detector, context, evidence2, shadowEvidence, failures, this.config.detectorTimeoutMs);
         if (inFlight !== void 0) (confirming ??= []).push(inFlight);
       }
       if (confirming !== void 0) await Promise.all(confirming);
@@ -9495,11 +11251,23 @@ var BotHandler = class {
         this.fail(error, "isHuman");
       }
     }
+    if (evidence2.some((item) => item.detector === "probe-signature")) state.notePayloadProbe();
     const combined = combineEvidence(evidence2, {
       suspectThreshold: this.config.suspectThreshold,
       strictEvidence: this.config.strictEvidence,
       onEvidenceViolation: (message) => this.warn(message)
     });
+    let shadowVerdict;
+    if (shadowEvidence.length > 0) {
+      const wouldBe = combineEvidence([...evidence2, ...shadowEvidence], {
+        suspectThreshold: this.config.suspectThreshold,
+        strictEvidence: this.config.strictEvidence,
+        onEvidenceViolation: (message, item) => {
+          if (item.shadow === true) this.warn(message);
+        }
+      });
+      shadowVerdict = { verdict: wouldBe.verdict, botClass: wouldBe.botClass, score: wouldBe.score, certain: wouldBe.certain };
+    }
     const actor = state.snapshot(facts.timestamp);
     if (combined.verdict === "confirmed-bot" && record) {
       state.confirmations++;
@@ -9515,10 +11283,13 @@ var BotHandler = class {
       certain: combined.certain,
       evidence: combined.botEvidence,
       humanEvidence: combined.humanEvidence,
+      shadowEvidence: sortEvidence(shadowEvidence),
+      ...shadowVerdict === void 0 ? {} : { shadowVerdict },
       actor,
       durationMs: this.config.clock.now() - started,
       failures,
-      facts
+      facts,
+      ...marker === void 0 ? {} : { marker }
     };
     if (!record) return assessment;
     this.meter?.recordAssessment(assessment);
@@ -9555,15 +11326,46 @@ var BotHandler = class {
       onChallenge: (event) => {
         this.meter?.recordChallenge(event);
         const state = this.registry.peek(assessment.actor.key);
-        if (state !== void 0) state.unsolvedChallenges++;
+        if (state !== void 0) {
+          state.unsolvedChallenges++;
+          state.noteChallengeIssued(
+            this.config.clock.now(),
+            assessment.marker?.shape ?? identityShape(assessment.facts, parseUserAgent(assessment.facts.headers["user-agent"]))
+          );
+        }
         this.events.emit("challenge", { phase: event, actorKey: assessment.actor.key });
       }
     });
+    const issued = this.markerFor(assessment);
+    if (issued !== void 0) {
+      if (outcome.kind === "continue" && outcome.responseHeaders?.["set-cookie"] === void 0) {
+        outcome.responseHeaders = { ...outcome.responseHeaders, "set-cookie": issued };
+      } else if (outcome.kind === "respond" && outcome.headers["set-cookie"] === void 0) {
+        outcome.headers = { ...outcome.headers, "set-cookie": issued };
+      }
+    }
     if (this.notifications.enabled && (outcome.kind !== "continue" || outcome.delayMs !== void 0)) {
       this.notifications.emit({ type: "action", at: new Date(facts.timestamp).toISOString(), assessment, decision });
     }
     return { assessment, decision, outcome };
   }
+  /**
+   * The `Set-Cookie` this response should carry, if any.
+   *
+   * Nothing is issued to a client that already holds a valid marker, because a
+   * `Set-Cookie` on every response makes every response uncacheable by shared caches —
+   * a detection feature is not worth a site's cache-hit ratio. Nothing is issued to a
+   * verified crawler either: Googlebot does not keep cookies, so a marker sent to it is
+   * a header that will never come back and an issuance count that means nothing.
+   */
+  markerFor(assessment) {
+    if (this.probe === void 0 || assessment.marker === void 0) return void 0;
+    if (assessment.botClass === "verified-bot") return void 0;
+    if (!this.probe.shouldIssue(assessment.marker)) return void 0;
+    const state = this.registry.peek(assessment.actor.key);
+    state?.noteMarkerIssued();
+    return this.probe.issue(assessment.marker);
+  }
   /** True when this request is the challenge verification endpoint. */
   isChallengeEndpoint(facts) {
     return this.challenge !== void 0 && facts.method === "POST" && facts.path === this.challenge.verifyPath;
@@ -9582,6 +11384,9 @@ var BotHandler = class {
     this.meter?.recordChallenge(outcome.ok ? "solved" : "rejected");
     if (outcome.ok) this.meter?.recordClearance(outcome.level);
     else this.meter?.recordChallengeRejection(outcome.reason);
+    if (!outcome.ok && outcome.signal !== void 0) {
+      this.registry.peek(actorKey)?.noteChallengeAnomaly(outcome.signal);
+    }
     if (outcome.interactionScore !== void 0) this.meter?.recordInteractionScore(outcome.interactionScore);
     if (outcome.ok) this.audit?.recordChallengeSolved(this.config.clock.now());
     this.events.emit("challenge", {
@@ -9618,7 +11423,9 @@ var BotHandler = class {
    * await. Failures are absorbed here in both paths: a detector can throw, reject or
    * hang, and none of those may reach the request.
    */
-  run(detector, context, sink, failures, timeoutMs) {
+  run(detector, context, sink, shadowSink, failures, timeoutMs) {
+    const shadowed = this.shadowIds.has(detector.id);
+    const target = shadowed ? shadowSink : sink;
     const startedAt = this.timing ? this.config.clock.now() : 0;
     let raw;
     try {
@@ -9629,7 +11436,7 @@ var BotHandler = class {
       return void 0;
     }
     if (!(raw instanceof Promise)) {
-      this.collect(raw, sink);
+      this.collect(raw, target, shadowed);
       if (startedAt !== 0) this.meter?.recordDetectorTiming(detector.id, this.config.clock.now() - startedAt);
       return void 0;
     }
@@ -9644,7 +11451,7 @@ var BotHandler = class {
           this.events.emit("detector-failure", { detector: detector.id, reason: "timeout", message, requestId: "" });
           return;
         }
-        this.collect(result, sink);
+        this.collect(result, target, shadowed);
       },
       (error) => {
         if (startedAt !== 0) this.meter?.recordDetectorTiming(detector.id, this.config.clock.now() - startedAt);
@@ -9652,13 +11459,14 @@ var BotHandler = class {
       }
     );
   }
-  collect(result, sink) {
+  collect(result, sink, shadowed = false) {
     if (result === void 0 || result === null) return;
+    const mark = (item) => shadowed ? { ...sanitize(item), shadow: true } : sanitize(item);
     if (Array.isArray(result)) {
-      for (let i = 0; i < result.length; i++) sink.push(result[i]);
+      for (let i = 0; i < result.length; i++) sink.push(mark(result[i]));
       return;
     }
-    sink.push(result);
+    sink.push(mark(result));
   }
   recordFailure(detector, failures, error, requestId = "") {
     const message = error instanceof Error ? error.message : String(error);
@@ -9678,10 +11486,16 @@ var BotHandler = class {
       certain: false,
       evidence: [],
       humanEvidence: [],
+      shadowEvidence: [],
       actor: existing?.snapshot(facts.timestamp) ?? {
         key: actorKey,
         requests: 0,
         distinctPaths: 0,
+        distinctQueries: 0,
+        queriesSaturated: false,
+        methodsSeen: ["GET"],
+        responses: 0,
+        misses: 0,
         firstSeen: facts.timestamp,
         lastSeen: facts.timestamp,
         priorConfirmations: 0,
@@ -9753,6 +11567,12 @@ var MAX_V6_BLOCK = 19;
 var MAX_PREFIXES = 1e4;
 var MAX_BYTES = 4 * 1024 * 1024;
 async function fetchCrawlerRanges(source, options = {}) {
+  return fetchPrefixes(source, options, { maxPrefixes: MAX_PREFIXES, subject: `a crawler's address list`, id: source.id });
+}
+async function fetchAddressList(source, options = {}) {
+  return fetchPrefixes(source, options, { maxPrefixes: options.maxPrefixes ?? 1e5, subject: "an address list", id: source.id });
+}
+async function fetchPrefixes(source, options, limits) {
   const url = new URL(source.url);
   if (url.protocol !== "https:") throw new ConfigError(`Crawler ranges must be published over HTTPS. "${source.url}" is not.`);
   const fetcher = options.fetch ?? globalThis.fetch;
@@ -9763,10 +11583,40 @@ async function fetchCrawlerRanges(source, options = {}) {
     redirect: "follow"
   });
   if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
-  const text = await response.text();
-  if (text.length > MAX_BYTES) throw new Error(`the list is ${Math.round(text.length / 1024)} kB, which is not a list of prefixes`);
+  const text = await readCapped(response);
   const prefixes = text.trimStart().startsWith("{") ? fromJson(text) : fromLines(text);
-  return validate(prefixes, source.id);
+  return validate(prefixes, limits);
+}
+async function readCapped(response) {
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > MAX_BYTES) {
+    throw new Error(`the list declares ${Math.round(declared / 1024)} kB, which is not a list of prefixes`);
+  }
+  const body = response.body;
+  if (body === null || body === void 0 || typeof body.getReader !== "function") {
+    const whole = await response.text();
+    if (whole.length > MAX_BYTES) throw new Error(`the list is ${Math.round(whole.length / 1024)} kB, which is not a list of prefixes`);
+    return whole;
+  }
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > MAX_BYTES) {
+        throw new Error(`the list is over ${Math.round(MAX_BYTES / 1024)} kB, which is not a list of prefixes`);
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+  return text + decoder.decode();
 }
 function fromJson(text) {
   const document = JSON.parse(text);
@@ -9779,24 +11629,24 @@ function fromJson(text) {
   return out;
 }
 function fromLines(text) {
-  return text.split("\n").map((line) => line.split("#")[0]?.trim() ?? "").filter((line) => line !== "");
+  return text.split("\n").map((line) => (line.split("#")[0] ?? "").split(";")[0]?.trim() ?? "").filter((line) => line !== "");
 }
-function validate(prefixes, id) {
+function validate(prefixes, limits) {
   if (prefixes.length === 0) throw new Error("the list is empty");
-  if (prefixes.length > MAX_PREFIXES) throw new Error(`${prefixes.length} prefixes is not a crawler's address list`);
+  if (prefixes.length > limits.maxPrefixes) throw new Error(`${prefixes.length} prefixes is not ${limits.subject}`);
   const accepted = [];
   for (const prefix of prefixes) {
     const cidr = parseCidr(prefix);
     if (cidr === void 0 || cidr === null) continue;
     const isV4 = cidr.bytes.length === 4;
     if (cidr.prefix < (isV4 ? MAX_V4_BLOCK : MAX_V6_BLOCK)) {
-      throw new Error(`"${prefix}" covers more of the internet than any crawler owns \u2014 refusing the whole list rather than verifying strangers`);
+      throw new Error(`"${prefix}" covers more of the internet than any published list should \u2014 refusing the whole list rather than acting on it`);
     }
     accepted.push(prefix);
   }
   if (accepted.length === 0) throw new Error(`nothing in the list parsed as an address or CIDR (first entry: "${prefixes[0]}")`);
   const set = new IpRangeSet(accepted);
-  if (set.size === 0) throw new Error(`nothing in the list loaded for ${id}`);
+  if (set.size === 0) throw new Error(`nothing in the list loaded for ${limits.id}`);
   return accepted;
 }
 async function refreshCrawlerRanges(handler, options = {}) {
@@ -9859,11 +11709,40 @@ var RedisStore = class {
   client;
   prefix;
   clock;
+  /**
+   * Counts one request into the fixed window `key` is bucketed by.
+   *
+   * This used to be `INCR`, then `PEXPIRE` when the count came back as 1 — which is
+   * correct only if the process survives long enough to send the second command. A
+   * deploy, an OOM kill or a dropped connection in between left a counter key behind
+   * with no expiry at all, and nothing would ever clean it up: the next request falls
+   * into the next bucket, under a different key, so the orphan is never touched again.
+   * One per unlucky restart is nothing; the point is that it accumulates forever, in a
+   * Redis the operator may well be running with `noeviction`.
+   *
+   * So the expiry is armed by the command that *creates* the key rather than by a
+   * follow-up. `SET … PX … NX` writes the seed only if nothing is there, always with a
+   * lifetime, and does nothing at all once the bucket exists — so it neither costs a
+   * count nor re-arms a window under load. The `INCR` is issued without waiting for its
+   * reply, so both commands are on the wire together and this stays one round trip.
+   * Ordering holds because a Redis client writes commands to its connection in call
+   * order and Redis executes them in arrival order, which means the key has a lifetime
+   * from the instant it exists.
+   *
+   * Not a Lua script, which would make it a single command: `eval` is the one thing
+   * `ioredis` and `node-redis` spell differently enough that this interface could not
+   * describe both, and staying client-agnostic is worth more than the last round trip.
+   */
   async increment(key, windowMs) {
     const bucket = Math.floor(this.clock.now() / windowMs);
     const full = `${this.prefix}c:${key}:${bucket}`;
+    const remaining = (bucket + 1) * windowMs - this.clock.now();
+    const ttl = Number.isFinite(remaining) && remaining > 0 ? remaining : windowMs;
+    const armed = this.client.set(full, "0", "PX", ttl, "NX");
+    armed.catch(() => {
+    });
     const count = await this.client.incr(full);
-    if (count === 1) await this.client.pexpire(full, windowMs);
+    await armed;
     return count;
   }
   async consumeOnce(key, ttlMs) {
@@ -9895,6 +11774,10 @@ function consoleNotifier(options = {}) {
         return;
       }
       const { assessment, decision } = event;
+      if (event.error !== void 0) {
+        target.error(`[bothandler] error ${event.error.source} \u2014 ${event.error.message}`);
+        return;
+      }
       if (assessment === void 0) {
         target.warn(`[bothandler] ${event.type} ${event.anomaly?.id ?? "unknown"} \u2014 ${event.anomaly?.summary ?? ""}`);
         return;
@@ -10066,6 +11949,7 @@ export {
   MAX_DIFFICULTY,
   MAX_USER_AGENT_LENGTH,
   ManualClock,
+  MarkerProbe,
   MemoryStore,
   Metrics,
   MultiPatternMatcher,
@@ -10076,6 +11960,7 @@ export {
   RedisStore,
   SCORE_BUCKETS,
   SPECIAL_USE_RANGES,
+  SiteProfile,
   TERMINAL_ACTIONS,
   TRAP_FIELD_SOURCE,
   TrafficAudit,
@@ -10086,9 +11971,12 @@ export {
   agentFor,
   allowCrawlers,
   analyseMovement,
+  blendedIdentityDetector,
   browsingCoherenceDetector,
   cachingResolver,
   cadenceDetector,
+  challengeIntegrityDetector,
+  challengeReactionDetector,
   cidrContains,
   claimsBrowser,
   clampDifficulty,
@@ -10107,8 +11995,10 @@ export {
   declineAiTraining,
   defaultDetectors,
   defineHandler,
+  distributedWalkDetector,
   evidence,
   executeAction,
+  fetchAddressList,
   fetchCrawlerRanges,
   fetchMetadataDetector,
   formatIp,
@@ -10117,6 +12007,8 @@ export {
   headerIntegrityDetector,
   headerOrderDetector,
   headerOrderFingerprint,
+  idEnumerationDetector,
+  identityDriftDetector,
   identityRotationDetector,
   independentStrongSignals,
   indexSignatures,
@@ -10124,6 +12016,10 @@ export {
   ipIntelligenceDetector,
   isSpecialUse,
   issueToken,
+  markerFanoutDetector,
+  markerIntegrityDetector,
+  markerPersistenceDetector,
+  missBaselineDetector,
   monitorOnly,
   networkKey,
   newChallenge,
@@ -10132,15 +12028,19 @@ export {
   noisyOr,
   normalizeIp,
   notifyJsNotifier,
+  parameterSweepDetector,
   parseAcceptLanguage,
   parseCidr,
   parseCookies,
   parseInteractionReport,
   parseIp,
   parseUserAgent,
+  pathCampaignDetector,
+  pathNoveltyDetector,
   pickTranslation,
   probeShapeFor,
   probeSignatureDetector,
+  probeVolumeDetector,
   protectApi,
   protectAuth,
   protectContent,
@@ -10167,8 +12067,10 @@ export {
   startCrawlerRangeRefresh,
   startDashboard,
   systemClock,
+  targetIntegrityDetector,
   tlsFingerprintDetector,
   toPrometheus,
+  transportCoherenceDetector,
   trapDetector,
   trapRobotsEntries,
   uaCoherenceDetector,