traffic-guard 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1119 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  BotGate: () => BotGate,
+  DEFAULT_POLICIES: () => DEFAULT_POLICIES,
+  TrafficGuard: () => TrafficGuard,
+  botgate: () => botgate,
+  calculateShannonEntropy: () => calculateShannonEntropy,
+  checkHeaderOrderAnomaly: () => checkHeaderOrderAnomaly,
+  createBotGateBattery: () => createBotGateBattery,
+  createClientHash: () => createClientHash,
+  createPoWChallenge: () => createPoWChallenge,
+  default: () => index_default,
+  evaluateDecision: () => evaluateDecision,
+  generateChallengeHtml: () => generateChallengeHtml,
+  heuristicAssessment: () => heuristicAssessment,
+  normalizeRequest: () => normalizeRequest,
+  resolvePolicy: () => resolvePolicy,
+  signBotToken: () => signBotToken,
+  trafficGuard: () => trafficGuard,
+  trafficguard: () => trafficguard,
+  verifyBotToken: () => verifyBotToken,
+  verifyPoW: () => verifyPoW
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/battery.ts
+var sdkChoice = null;
+var sdkNoul = null;
+var sdkScore = null;
+var sdkLoaded = false;
+async function loadTypeSafePrimitives() {
+  if (!sdkLoaded) {
+    try {
+      const sdk = await import("@typesafe-ai/sdk");
+      sdkChoice = sdk.choice;
+      sdkNoul = sdk.noul;
+      sdkScore = sdk.score;
+      sdkLoaded = true;
+    } catch {
+      sdkLoaded = true;
+    }
+  }
+  return { choice: sdkChoice, noul: sdkNoul, score: sdkScore };
+}
+function createBotGateBattery() {
+  if (sdkNoul && sdkChoice && sdkScore) {
+    return {
+      is_bot: sdkNoul(
+        "Evaluate whether the incoming HTTP request in `request` is generated by an automated bot, script, crawler, scraper, or headless browser, rather than a genuine human user interacting with a standard web browser.",
+        {
+          true: "Clear indicators of automation, scripting libraries, automated headless execution, scraper activity, or non-human interaction patterns.",
+          false: "Natural human interactive web browser navigation."
+        }
+      ),
+      is_attack: sdkNoul(
+        "Evaluate whether the request contains an attack payload, exploit attempt, injection, path traversal, probe for sensitive files, or vulnerability scan.",
+        {
+          true: "Malicious payloads, SQLi, XSS, SSRF, command injection, path traversal, exploit probes, or sensitive credential/file hunting.",
+          false: "Safe, legitimate, benign application interaction without exploitation intent."
+        }
+      ),
+      is_spoofed: sdkNoul(
+        "Evaluate whether the request headers exhibit spoofing or client impersonation (such as claiming a browser User-Agent while lacking standard browser headers, or conflicting platform tokens).",
+        {
+          true: "Mismatched, counterfeit, or contradictory headers indicating spoofed client identity.",
+          false: "Headers are coherent and authentic for the specified client."
+        }
+      ),
+      traffic_type: sdkChoice(
+        "Classify the primary nature of this incoming HTTP traffic.",
+        {
+          human: "Legitimate human visitor navigating the website.",
+          good_bot: "Beneficial search engine indexer, feed fetcher, or uptime monitor (e.g. Googlebot, Bingbot, Slackbot).",
+          bad_bot: "Automated scraper, content scraper, spam bot, or unauthorized scraping tool.",
+          attack: "Hostile attacker executing vulnerability scans, exploit probes, or injection attacks."
+        }
+      ),
+      risk_level: sdkScore(
+        "Rate the security and operational risk this request poses to the website or service.",
+        [
+          "Level 0: Safe - normal human traffic or well-behaved verified search crawler.",
+          "Level 1: Low risk - minor header anomaly or benign unfamiliar crawler without malicious activity.",
+          "Level 2: Suspicious - aggressive automated scraping, suspicious probes, or inconsistent headers.",
+          "Level 3: Dangerous - active exploitation, injection payload, unauthorized sensitive path probe, or credential abuse."
+        ]
+      )
+    };
+  }
+  return {
+    is_bot: { type: "noul", instructions: "Is bot?" },
+    is_attack: { type: "noul", instructions: "Is attack?" },
+    is_spoofed: { type: "noul", instructions: "Is spoofed?" },
+    traffic_type: { type: "choice", instructions: "Traffic type" },
+    risk_level: { type: "score", instructions: "Risk level" }
+  };
+}
+function calculateShannonEntropy(str) {
+  if (!str || str.length === 0) return 0;
+  const len = str.length;
+  const frequencies = new Uint16Array(256);
+  for (let i = 0; i < len; i++) {
+    frequencies[str.charCodeAt(i) & 255]++;
+  }
+  let entropy = 0;
+  for (let i = 0; i < 256; i++) {
+    const count = frequencies[i];
+    if (count > 0) {
+      const p = count / len;
+      entropy -= p * Math.log2(p);
+    }
+  }
+  return entropy;
+}
+function heuristicAssessment(request, context) {
+  const userAgent = (request.headers["user-agent"] || "").toLowerCase();
+  const path = request.path.toLowerCase();
+  const queryStr = JSON.stringify(request.query).toLowerCase();
+  const bodyStr = typeof request.body === "string" ? request.body.toLowerCase() : JSON.stringify(request.body || "").toLowerCase();
+  const headersStr = JSON.stringify(request.headers).toLowerCase();
+  const fullTarget = `${path} ${queryStr} ${bodyStr} ${headersStr}`;
+  let botScore = 0.05;
+  let attackScore = 0.02;
+  let spoofScore = 0.05;
+  if (context.isKnownSearchBot) {
+    botScore = 0.95;
+    attackScore = 0.01;
+    return {
+      isBotProbability: botScore,
+      isAttackProbability: attackScore,
+      isSpoofedProbability: 0.02,
+      trafficType: "good_bot",
+      trafficTypeConfidence: 0.96,
+      trafficTypeDistribution: { good_bot: 0.94, human: 0.02, bad_bot: 0.03, attack: 0.01 },
+      riskScore: 0.1,
+      riskConfidence: 0.95,
+      riskLevelDistribution: { "0": 0.92, "1": 0.07, "2": 0.01, "3": 0 }
+    };
+  }
+  if (context.suspiciousSignatures.length > 0) {
+    botScore = 0.99;
+    attackScore = 0.98;
+    spoofScore = 0.85;
+  }
+  const cliTools = [
+    "curl/",
+    "python-requests",
+    "aiohttp",
+    "httpx",
+    "wget/",
+    "go-http-client",
+    "axios/",
+    "node-fetch",
+    "libwww-perl",
+    "postmanruntime",
+    "scrapy"
+  ];
+  if (cliTools.some((t) => userAgent.includes(t))) {
+    botScore = Math.max(botScore, 0.92);
+  }
+  if (userAgent.includes("headlesschrome") || userAgent.includes("phantomjs") || userAgent.includes("selenium") || userAgent.includes("puppeteer")) {
+    botScore = Math.max(botScore, 0.97);
+    spoofScore = Math.max(spoofScore, 0.8);
+  }
+  if (context.claimsBrowser && context.missingBrowserHeaders.length > 0) {
+    spoofScore = Math.max(spoofScore, 0.4 + context.missingBrowserHeaders.length * 0.2);
+    botScore = Math.max(botScore, 0.65);
+  }
+  const sensitivePaths = [
+    "/.env",
+    "/wp-login.php",
+    "/wp-admin",
+    "/.git",
+    "/actuator",
+    "/phpmyadmin",
+    "/config.json",
+    "/database.yml",
+    "/.aws/credentials"
+  ];
+  if (sensitivePaths.some((p) => path.includes(p))) {
+    attackScore = Math.max(attackScore, 0.85);
+    botScore = Math.max(botScore, 0.8);
+  }
+  const sqliSignatures = [
+    "' or 1=1",
+    '" or 1=1',
+    "union select",
+    "union all select",
+    "sleep(",
+    "benchmark(",
+    "information_schema",
+    "select sleep"
+  ];
+  const xssSignatures = ["<script>", "javascript:", "<svg onload", "onerror=alert"];
+  const traversalSignatures = ["../", "..\\", "%2e%2e%2f", "%252e%252e"];
+  const cmdSignatures = ["; cat ", "| whoami", "&& id", "`whoami`", "${jndi:"];
+  if (sqliSignatures.some((sig) => fullTarget.includes(sig))) {
+    attackScore = Math.max(attackScore, 0.96);
+    botScore = Math.max(botScore, 0.75);
+  }
+  if (xssSignatures.some((sig) => fullTarget.includes(sig))) {
+    attackScore = Math.max(attackScore, 0.92);
+  }
+  if (traversalSignatures.some((sig) => fullTarget.includes(sig))) {
+    attackScore = Math.max(attackScore, 0.95);
+    botScore = Math.max(botScore, 0.8);
+  }
+  if (cmdSignatures.some((sig) => fullTarget.includes(sig))) {
+    attackScore = Math.max(attackScore, 0.98);
+  }
+  if (queryStr.length > 30) {
+    const entropy = calculateShannonEntropy(queryStr);
+    if (entropy > 4.6 && attackScore < 0.6) {
+      attackScore = Math.max(attackScore, 0.65);
+    }
+  }
+  let trafficType = "human";
+  if (attackScore >= 0.7) {
+    trafficType = "attack";
+  } else if (botScore >= 0.6) {
+    trafficType = "bad_bot";
+  }
+  let calculatedRisk = attackScore * 2.8 + botScore * 0.7;
+  if (calculatedRisk > 3) calculatedRisk = 3;
+  const typeDistribution = {
+    human: trafficType === "human" ? 0.85 : 0.05,
+    good_bot: 0.02,
+    bad_bot: trafficType === "bad_bot" ? 0.8 : 0.1,
+    attack: trafficType === "attack" ? 0.9 : 0.05
+  };
+  const total = Object.values(typeDistribution).reduce((a, b) => a + b, 0);
+  for (const k of Object.keys(typeDistribution)) {
+    typeDistribution[k] = Math.round(typeDistribution[k] / total * 100) / 100;
+  }
+  return {
+    isBotProbability: Math.min(1, Math.round(botScore * 100) / 100),
+    isAttackProbability: Math.min(1, Math.round(attackScore * 100) / 100),
+    isSpoofedProbability: Math.min(1, Math.round(spoofScore * 100) / 100),
+    trafficType,
+    trafficTypeConfidence: 0.88,
+    trafficTypeDistribution: typeDistribution,
+    riskScore: Math.round(calculatedRisk * 100) / 100,
+    riskConfidence: 0.85,
+    riskLevelDistribution: {
+      "0": calculatedRisk < 0.5 ? 0.9 : 0.05,
+      "1": calculatedRisk >= 0.5 && calculatedRisk < 1.5 ? 0.8 : 0.1,
+      "2": calculatedRisk >= 1.5 && calculatedRisk < 2.5 ? 0.85 : 0.1,
+      "3": calculatedRisk >= 2.5 ? 0.9 : 0.05
+    }
+  };
+}
+
+// src/crypto.ts
+var import_node_crypto = require("node:crypto");
+var DEFAULT_SECRET = "traffic-guard-default-secret-key-32b!";
+function createClientHash(ip = "", userAgent = "") {
+  return (0, import_node_crypto.createHash)("sha256").update(`${ip}::${userAgent.toLowerCase()}`).digest("hex").slice(0, 16);
+}
+function signBotToken(payload, secret = DEFAULT_SECRET) {
+  const jsonStr = JSON.stringify(payload);
+  const b64Payload = Buffer.from(jsonStr, "utf8").toString("base64url");
+  const signature = (0, import_node_crypto.createHmac)("sha256", secret).update(b64Payload).digest("base64url");
+  return `${b64Payload}.${signature}`;
+}
+function verifyBotToken(token, secret = DEFAULT_SECRET) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 2) return null;
+    const [b64Payload, signature] = parts;
+    const expectedSig = (0, import_node_crypto.createHmac)("sha256", secret).update(b64Payload).digest("base64url");
+    if (signature !== expectedSig) return null;
+    const jsonStr = Buffer.from(b64Payload, "base64url").toString("utf8");
+    return JSON.parse(jsonStr);
+  } catch {
+    return null;
+  }
+}
+function parseCookies(cookieHeader = "") {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  const pairs = cookieHeader.split(";");
+  for (const pair of pairs) {
+    const idx = pair.indexOf("=");
+    if (idx > 0) {
+      const key = pair.slice(0, idx).trim();
+      const val = pair.slice(idx + 1).trim();
+      cookies[key] = val;
+    }
+  }
+  return cookies;
+}
+function createPoWChallenge(secret = DEFAULT_SECRET, difficulty = 4) {
+  const ts = Date.now();
+  const rand = (0, import_node_crypto.randomBytes)(8).toString("hex");
+  const payload = `${ts}:${rand}:${difficulty}`;
+  const sig = (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("hex").slice(0, 16);
+  const seed = `${payload}:${sig}`;
+  return { seed, difficulty };
+}
+function verifyPoW(seed, nonce, minDifficulty = 1, secret = DEFAULT_SECRET) {
+  try {
+    const parts = seed.split(":");
+    if (parts.length !== 4) return false;
+    const [tsStr, rand, diffStr, sig] = parts;
+    const payload = `${tsStr}:${rand}:${diffStr}`;
+    const expectedSig = (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("hex").slice(0, 16);
+    if (sig !== expectedSig) return false;
+    const ts = parseInt(tsStr, 10);
+    if (Date.now() - ts > 18e4) return false;
+    const diff = parseInt(diffStr, 10);
+    if (diff < minDifficulty) return false;
+    const hash = (0, import_node_crypto.createHash)("sha256").update(`${seed}:${nonce}`).digest("hex");
+    return hash.startsWith("0".repeat(diff));
+  } catch {
+    return false;
+  }
+}
+function generateChallengeHtml(seed, difficulty, returnUrl = "/") {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Verifying Connection...</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #fafafa; color: #222; }
+    .card { background: #fff; border: 1px solid #e0e0e0; border-radius: 8px; padding: 32px; max-width: 400px; text-align: center; box-shadow: 0 4px 12px rgba(0,0,0,0.05); }
+    .spinner { border: 3px solid #f3f3f3; border-top: 3px solid #111; border-radius: 50%; width: 32px; height: 32px; animation: spin 0.8s linear infinite; margin: 20px auto; }
+    @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } }
+    h2 { font-size: 18px; margin-bottom: 8px; }
+    p { font-size: 14px; color: #666; margin: 0; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h2>Verifying Connection</h2>
+    <p>Please wait a moment while your browser verifies your session...</p>
+    <div class="spinner"></div>
+  </div>
+  <script>
+    (async function() {
+      const seed = "${seed}";
+      const difficulty = ${difficulty};
+      const returnUrl = "${returnUrl}";
+      const targetPrefix = "0".repeat(difficulty);
+
+      // Automated browser checks
+      const isAutomated = !!(navigator.webdriver || window._phantom || window.__nightmare || !window.chrome);
+
+      async function sha256(message) {
+        const msgBuffer = new TextEncoder().encode(message);
+        const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+      }
+
+      let nonce = 0;
+      while (true) {
+        const hash = await sha256(seed + ":" + nonce);
+        if (hash.startsWith(targetPrefix)) break;
+        nonce++;
+        if (nonce > 500000) break;
+      }
+
+      try {
+        const res = await fetch("/__trafficguard/verify", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ seed, nonce: String(nonce), isAutomated, returnUrl })
+        });
+        if (res.ok) {
+          window.location.href = returnUrl;
+        } else {
+          document.querySelector("p").innerText = "Verification challenge failed.";
+        }
+      } catch (e) {
+        window.location.reload();
+      }
+    })();
+  </script>
+</body>
+</html>`;
+}
+
+// src/normalizer.ts
+var KNOWN_GOOD_BOTS = [
+  "googlebot",
+  "bingbot",
+  "yandexbot",
+  "duckduckbot",
+  "slurp",
+  "baiduspider",
+  "facebookexternalhit",
+  "twitterbot",
+  "linkedinbot",
+  "embedly",
+  "quora link preview",
+  "showyoubot",
+  "outbrain",
+  "pinterest",
+  "slackbot",
+  "vkshare",
+  "w3c_validator",
+  "uptime"
+];
+var KNOWN_ATTACK_TOOLS = [
+  "sqlmap",
+  "nikto",
+  "nmap",
+  "masscan",
+  "acunetix",
+  "dirbuster",
+  "gobuster",
+  "wfuzz",
+  "burpcollaborator",
+  "hydra",
+  "havij"
+];
+function checkHeaderOrderAnomaly(rawHeaders, userAgent) {
+  if (!rawHeaders || rawHeaders.length < 6) return false;
+  const order = [];
+  for (let i = 0; i < rawHeaders.length; i += 2) {
+    order.push(rawHeaders[i].toLowerCase());
+  }
+  const ua = userAgent.toLowerCase();
+  const claimsChromium = ua.includes("chrome/") || ua.includes("edg/");
+  const hostIdx = order.indexOf("host");
+  const uaIdx = order.indexOf("user-agent");
+  const secChUaIdx = order.indexOf("sec-ch-ua");
+  if (uaIdx !== -1 && hostIdx !== -1 && uaIdx < hostIdx) {
+    return true;
+  }
+  if (claimsChromium && secChUaIdx !== -1 && uaIdx !== -1) {
+    const acceptEncIdx = order.indexOf("accept-encoding");
+    if (acceptEncIdx !== -1 && secChUaIdx > acceptEncIdx + 2) {
+      return true;
+    }
+  }
+  return false;
+}
+function normalizeRequest(input) {
+  let method = "GET";
+  let path = "/";
+  let query = {};
+  const headers = {};
+  let rawHeaders;
+  let body = null;
+  let ip;
+  let cookies = {};
+  if (typeof input === "string") {
+    try {
+      const parsed = new URL(input, "http://localhost");
+      path = parsed.pathname;
+      parsed.searchParams.forEach((v, k) => {
+        query[k] = v;
+      });
+    } catch {
+      path = input;
+    }
+  } else if (typeof input === "object" && input !== null) {
+    const raw = input;
+    method = (raw.method || "GET").toUpperCase();
+    const rawUrl = raw.url || raw.originalUrl || raw.path || "/";
+    try {
+      const parsed = new URL(rawUrl, "http://localhost");
+      path = parsed.pathname;
+      parsed.searchParams.forEach((v, k) => {
+        query[k] = v;
+      });
+    } catch {
+      path = typeof rawUrl === "string" ? rawUrl : "/";
+    }
+    if (raw.query && typeof raw.query === "object") {
+      query = { ...query, ...raw.query };
+    }
+    if (raw.headers && typeof raw.headers === "object") {
+      for (const [k, v] of Object.entries(raw.headers)) {
+        if (typeof v === "string") {
+          headers[k.toLowerCase()] = v;
+        } else if (Array.isArray(v)) {
+          headers[k.toLowerCase()] = v.join(", ");
+        }
+      }
+    }
+    rawHeaders = raw.rawHeaders;
+    body = raw.body ?? null;
+    ip = raw.ip || raw.socket?.remoteAddress || headers["x-forwarded-for"]?.split(",")[0]?.trim();
+    cookies = raw.cookies || parseCookies(headers["cookie"]);
+  }
+  const userAgent = (headers["user-agent"] || "").toLowerCase();
+  const claimsBrowser = userAgent.includes("mozilla/") && (userAgent.includes("chrome/") || userAgent.includes("safari/") || userAgent.includes("firefox/") || userAgent.includes("edg/"));
+  const isKnownSearchBot = KNOWN_GOOD_BOTS.some((bot) => userAgent.includes(bot));
+  const missingBrowserHeaders = [];
+  if (claimsBrowser && !isKnownSearchBot) {
+    if (!headers["accept-language"]) missingBrowserHeaders.push("accept-language");
+    if (!headers["accept-encoding"]) missingBrowserHeaders.push("accept-encoding");
+    const isChromium = userAgent.includes("chrome/") || userAgent.includes("edg/");
+    if (isChromium && !headers["sec-ch-ua"]) {
+      missingBrowserHeaders.push("sec-ch-ua");
+    }
+  }
+  const suspiciousSignatures = [];
+  for (const tool of KNOWN_ATTACK_TOOLS) {
+    if (userAgent.includes(tool)) {
+      suspiciousSignatures.push(`known_attack_tool:${tool}`);
+    }
+  }
+  const headerOrderAnomaly = checkHeaderOrderAnomaly(rawHeaders, userAgent);
+  const targetForEntropy = path + " " + JSON.stringify(query);
+  const shannonEntropy = calculateShannonEntropy(targetForEntropy);
+  const normalized = {
+    method,
+    path,
+    query,
+    headers,
+    rawHeaders,
+    body,
+    ip,
+    url: path,
+    cookies
+  };
+  const context = {
+    missingBrowserHeaders,
+    suspiciousSignatures,
+    claimsBrowser,
+    isKnownSearchBot,
+    headerOrderAnomaly,
+    shannonEntropy
+  };
+  return { request: normalized, context };
+}
+
+// src/policy.ts
+var DEFAULT_POLICIES = {
+  balanced: {
+    attackThreshold: 0.75,
+    botThreshold: 0.85,
+    challengeThreshold: 0.5,
+    riskBlock: 2.2,
+    riskChallenge: 1.4,
+    spoofThreshold: 0.6,
+    velocityBurstLimit: 40
+    // requests per 10s window
+  },
+  strict: {
+    attackThreshold: 0.6,
+    botThreshold: 0.7,
+    challengeThreshold: 0.35,
+    riskBlock: 1.8,
+    riskChallenge: 1,
+    spoofThreshold: 0.4,
+    velocityBurstLimit: 20
+  },
+  permissive: {
+    attackThreshold: 0.88,
+    botThreshold: 0.92,
+    challengeThreshold: 0.7,
+    riskBlock: 2.6,
+    riskChallenge: 2,
+    spoofThreshold: 0.75,
+    velocityBurstLimit: 80
+  }
+};
+function resolvePolicy(policy) {
+  if (typeof policy === "string") {
+    return DEFAULT_POLICIES[policy] || DEFAULT_POLICIES.balanced;
+  }
+  if (typeof policy === "object" && policy !== null) {
+    return {
+      ...DEFAULT_POLICIES.balanced,
+      ...policy
+    };
+  }
+  return DEFAULT_POLICIES.balanced;
+}
+function evaluateDecision(assessment, policy, options, durationMs, context) {
+  const allowGoodBots = options.allowGoodBots !== false;
+  const reasons = [];
+  if (context?.isHoneypot) {
+    return {
+      action: "block",
+      shouldBlock: true,
+      shouldChallenge: false,
+      shouldTarpit: false,
+      isBot: true,
+      isAttack: true,
+      category: "attack",
+      riskScore: 3,
+      confidence: 1,
+      reasons: ["Visited canary honeypot URL trap intended for crawlers"],
+      assessment: {
+        ...assessment,
+        isAttackProbability: 1,
+        isBotProbability: 1,
+        riskScore: 3
+      },
+      durationMs
+    };
+  }
+  if (allowGoodBots && assessment.trafficType === "good_bot" && assessment.isAttackProbability < 0.4) {
+    return {
+      action: "allow",
+      shouldBlock: false,
+      shouldChallenge: false,
+      shouldTarpit: false,
+      isBot: true,
+      isAttack: false,
+      category: "good_bot",
+      riskScore: assessment.riskScore,
+      confidence: assessment.trafficTypeConfidence,
+      reasons: ["Verified legitimate crawler allowed by policy"],
+      assessment,
+      durationMs
+    };
+  }
+  let action = "allow";
+  if (assessment.isAttackProbability >= policy.attackThreshold) {
+    action = "block";
+    reasons.push(
+      `Detected malicious attack payload or exploit attempt (probability: ${Math.round(assessment.isAttackProbability * 100)}%)`
+    );
+  }
+  if (assessment.riskScore >= policy.riskBlock) {
+    action = "block";
+    reasons.push(`High risk severity score (${assessment.riskScore.toFixed(2)} >= ${policy.riskBlock})`);
+  } else if (assessment.riskScore >= policy.riskChallenge && action !== "block") {
+    action = "challenge";
+    reasons.push(`Elevated risk severity score (${assessment.riskScore.toFixed(2)} >= ${policy.riskChallenge})`);
+  }
+  if (context?.rateCount && context.rateCount > policy.velocityBurstLimit) {
+    if (action !== "block") {
+      action = "tarpit";
+      reasons.push(
+        `High request burst velocity (${context.rateCount} reqs in window > ${policy.velocityBurstLimit} limit)`
+      );
+    }
+  }
+  if (assessment.isBotProbability >= policy.botThreshold && assessment.trafficType === "bad_bot") {
+    if (action !== "block") {
+      action = "block";
+      reasons.push(
+        `Unapproved automated bot/scraper detected (probability: ${Math.round(assessment.isBotProbability * 100)}%)`
+      );
+    }
+  } else if (assessment.isBotProbability >= policy.challengeThreshold && action === "allow") {
+    action = "challenge";
+    reasons.push(
+      `Possible automated traffic requiring verification (probability: ${Math.round(assessment.isBotProbability * 100)}%)`
+    );
+  }
+  if (context?.headerOrderAnomaly) {
+    reasons.push("Abnormal HTTP header sequence inconsistent with declared browser");
+    if (action === "allow") {
+      action = "challenge";
+    }
+  }
+  if (assessment.isSpoofedProbability >= policy.spoofThreshold && action === "allow") {
+    action = "challenge";
+    reasons.push(
+      `Suspicious header inconsistency or impersonation detected (probability: ${Math.round(assessment.isSpoofedProbability * 100)}%)`
+    );
+  }
+  if (action === "allow" && reasons.length === 0) {
+    reasons.push("Traffic matches expected legitimate profile");
+  }
+  const shouldBlock = action === "block";
+  const shouldChallenge = action === "challenge";
+  const shouldTarpit = action === "tarpit";
+  const isBot = assessment.isBotProbability >= 0.5;
+  const isAttack = assessment.isAttackProbability >= 0.5;
+  const decision = {
+    action,
+    shouldBlock,
+    shouldChallenge,
+    shouldTarpit,
+    isBot,
+    isAttack,
+    category: assessment.trafficType,
+    riskScore: assessment.riskScore,
+    confidence: assessment.trafficTypeConfidence,
+    reasons,
+    assessment,
+    durationMs,
+    async respond(res) {
+      if (!res || typeof res.status !== "function") return false;
+      if (shouldTarpit) {
+        if (options.onTarpit) {
+          options.onTarpit(decision, null, res);
+        } else {
+          const delay = options.tarpitMs || 3e3;
+          await new Promise((r) => setTimeout(r, delay));
+          res.status(429).json({
+            error: "Too Many Requests",
+            message: "Request velocity exceeded threshold",
+            action: "tarpit",
+            reasons: decision.reasons
+          });
+        }
+        return true;
+      }
+      if (shouldBlock) {
+        if (options.onBlock) {
+          options.onBlock(decision, null, res);
+        } else {
+          res.status(403).json({
+            error: "Forbidden",
+            message: "Access blocked by BotGate security policy",
+            reasons: decision.reasons
+          });
+        }
+        return true;
+      }
+      if (shouldChallenge) {
+        if (options.onChallenge) {
+          options.onChallenge(decision, null, res);
+        } else if (options.enablePoWChallenge !== false && decision.challengeHtml) {
+          res.status(428);
+          res.setHeader("Content-Type", "text/html; charset=utf-8");
+          res.end(decision.challengeHtml);
+        } else {
+          res.status(428).json({
+            error: "Precondition Required",
+            message: "Traffic verification or challenge required",
+            reasons: decision.reasons
+          });
+        }
+        return true;
+      }
+      return false;
+    }
+  };
+  return decision;
+}
+
+// src/gate.ts
+var sdkLoaded2 = false;
+var TypeSafeClientClass = null;
+async function getTypeSafeClientClass() {
+  if (!sdkLoaded2) {
+    try {
+      const sdk = await import("@typesafe-ai/sdk");
+      TypeSafeClientClass = sdk.TypeSafeClient;
+      await loadTypeSafePrimitives();
+    } catch {
+      TypeSafeClientClass = null;
+    }
+    sdkLoaded2 = true;
+  }
+  return TypeSafeClientClass;
+}
+var BotGate = class {
+  client = null;
+  clientInitAttempted = false;
+  options;
+  battery = createBotGateBattery();
+  constructor(options = {}) {
+    this.options = options;
+  }
+  async getClient() {
+    if (!this.clientInitAttempted) {
+      this.clientInitAttempted = true;
+      const apiKey = this.options.apiKey || process.env.TYPESAFE_API_KEY;
+      if (apiKey) {
+        const ClientClass = await getTypeSafeClientClass();
+        if (ClientClass) {
+          this.client = new ClientClass({
+            apiKey,
+            baseURL: this.options.endpoint || process.env.TYPESAFE_ENDPOINT,
+            timeout: this.options.timeout || 15e3
+          });
+          this.battery = createBotGateBattery();
+        }
+      }
+    }
+    return this.client;
+  }
+  async inspect(input, runtimeOptions = {}) {
+    const startTime = performance.now();
+    const opts = { ...this.options, ...runtimeOptions };
+    const policy = resolvePolicy(opts.policy);
+    const { request, context } = normalizeRequest(input);
+    if (opts.whitelistedPaths) {
+      for (const pattern of opts.whitelistedPaths) {
+        if (typeof pattern === "string" && request.path === pattern) {
+          return this.createAllowedDecision("Path whitelisted", startTime);
+        }
+        if (pattern instanceof RegExp && pattern.test(request.path)) {
+          return this.createAllowedDecision("Path matched whitelist pattern", startTime);
+        }
+      }
+    }
+    if (opts.whitelistedIps && request.ip && opts.whitelistedIps.includes(request.ip)) {
+      return this.createAllowedDecision("Client IP whitelisted", startTime);
+    }
+    if (opts.honeypotPaths && opts.honeypotPaths.includes(request.path)) {
+      context.isHoneypot = true;
+    }
+    const secret = opts.secretKey || process.env.TRAFFICGUARD_SECRET || process.env.BOTGATE_SECRET || "traffic-guard-default-secret-key-32b!";
+    const userAgent = request.headers["user-agent"] || "";
+    const clientHash = createClientHash(request.ip, userAgent);
+    const rawCookie = request.cookies?.["__trafficguard"] || request.cookies?.["__botgate"];
+    const now = Date.now();
+    let cookiePayload = null;
+    if (rawCookie) {
+      cookiePayload = verifyBotToken(rawCookie, secret);
+    }
+    if (cookiePayload && cookiePayload.h === clientHash && cookiePayload.v && cookiePayload.v > now) {
+      return this.createAllowedDecision("Client passed cryptographic verification", startTime);
+    }
+    let currentCount = 1;
+    let windowStart = now;
+    if (cookiePayload && cookiePayload.h === clientHash) {
+      if (now - cookiePayload.ws < 1e4) {
+        currentCount = cookiePayload.c + 1;
+        windowStart = cookiePayload.ws;
+      }
+    }
+    context.rateCount = currentCount;
+    let assessment;
+    const client = await this.getClient();
+    if (client && !context.isHoneypot) {
+      try {
+        const state = {
+          request: {
+            method: request.method,
+            path: request.path,
+            headers: request.headers,
+            query: request.query,
+            body: request.body ?? null,
+            ip: request.ip ?? null
+          },
+          context: {
+            missing_browser_headers: context.missingBrowserHeaders,
+            suspicious_signatures: context.suspiciousSignatures,
+            claims_browser: context.claimsBrowser,
+            is_known_search_bot: context.isKnownSearchBot,
+            header_order_anomaly: context.headerOrderAnomaly,
+            shannon_entropy: context.shannonEntropy,
+            rate_count: context.rateCount
+          }
+        };
+        const response = await client.systemOne({
+          model: opts.model || "jev-latest",
+          state,
+          questions: this.battery
+        });
+        const answers = response.answers;
+        const isBotProb = answers.is_bot?.noul ?? 0.1;
+        const isAttackProb = answers.is_attack?.noul ?? 0.05;
+        const isSpoofedProb = answers.is_spoofed?.noul ?? 0.05;
+        const trafficTypeAnswer = answers.traffic_type;
+        const trafficType = trafficTypeAnswer?.choice || "human";
+        const trafficTypeConfidence = trafficTypeAnswer?.confidence ?? 0.8;
+        const trafficTypeDist = trafficTypeAnswer?.probabilities ?? {};
+        const riskAnswer = answers.risk_level;
+        const riskScore = riskAnswer?.score ?? 0;
+        const riskConfidence = riskAnswer?.confidence ?? 0.8;
+        const riskDist = riskAnswer?.probabilities ?? {};
+        assessment = {
+          isBotProbability: isBotProb,
+          isAttackProbability: isAttackProb,
+          isSpoofedProbability: isSpoofedProb,
+          trafficType,
+          trafficTypeConfidence,
+          trafficTypeDistribution: trafficTypeDist,
+          riskScore,
+          riskConfidence,
+          riskLevelDistribution: riskDist
+        };
+      } catch (err) {
+        if (opts.fallback === "block") {
+          return this.createBlockedDecision("TypeSafe API unavailable (fallback: block)", startTime);
+        }
+        if (opts.fallback === "allow") {
+          return this.createAllowedDecision("TypeSafe API unavailable (fallback: allow)", startTime);
+        }
+        assessment = heuristicAssessment(request, context);
+      }
+    } else {
+      assessment = heuristicAssessment(request, context);
+    }
+    const durationMs = Math.round((performance.now() - startTime) * 100) / 100;
+    const decision = evaluateDecision(assessment, policy, opts, durationMs, context);
+    const updatedPayload = {
+      h: clientHash,
+      c: currentCount,
+      ws: windowStart
+    };
+    const newToken = signBotToken(updatedPayload, secret);
+    decision.setCookieHeader = `__trafficguard=${newToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=3600`;
+    if (decision.shouldChallenge) {
+      const pow = createPoWChallenge(secret, 4);
+      decision.challengeHtml = generateChallengeHtml(pow.seed, pow.difficulty, request.url || "/");
+    }
+    return decision;
+  }
+  middleware(middlewareOptions = {}) {
+    const opts = { ...this.options, ...middlewareOptions };
+    const secret = opts.secretKey || process.env.TRAFFICGUARD_SECRET || process.env.BOTGATE_SECRET || "traffic-guard-default-secret-key-32b!";
+    return async (req, res, next) => {
+      try {
+        if (req.method === "POST" && (req.url === "/__trafficguard/verify" || req.path === "/__trafficguard/verify" || req.url === "/__botgate/verify" || req.path === "/__botgate/verify")) {
+          let body = req.body;
+          if (typeof body === "string") {
+            try {
+              body = JSON.parse(body);
+            } catch {
+            }
+          }
+          const { seed, nonce, isAutomated, returnUrl } = body || {};
+          const isValid = !isAutomated && verifyPoW(seed, nonce, 1, secret);
+          if (isValid) {
+            const userAgent = req.headers["user-agent"] || "";
+            const ip = req.ip || req.socket?.remoteAddress || "";
+            const clientHash = createClientHash(ip, userAgent);
+            const token = signBotToken({ h: clientHash, c: 1, ws: Date.now(), v: Date.now() + 18e5 }, secret);
+            res.setHeader("Set-Cookie", `__trafficguard=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=1800`);
+            return res.status(200).json({ status: "ok", redirect: returnUrl || "/" });
+          } else {
+            return res.status(403).json({ error: "Verification failed" });
+          }
+        }
+        const decision = await this.inspect(req, opts);
+        req.trafficGuard = decision;
+        req.botGate = decision;
+        if (decision.setCookieHeader) {
+          res.setHeader("Set-Cookie", decision.setCookieHeader);
+        }
+        if (decision.shouldTarpit) {
+          if (opts.onTarpit) {
+            return opts.onTarpit(decision, req, res);
+          }
+          const delay = opts.tarpitMs || 3e3;
+          await new Promise((r) => setTimeout(r, delay));
+          return res.status(429).json({
+            error: "Too Many Requests",
+            message: "Velocity exceeded threshold",
+            action: decision.action,
+            reasons: decision.reasons
+          });
+        }
+        if (decision.shouldBlock) {
+          if (opts.onBlock) {
+            return opts.onBlock(decision, req, res);
+          }
+          return res.status(403).json({
+            error: "Forbidden",
+            message: "Access blocked by BotGate security policy",
+            action: decision.action,
+            reasons: decision.reasons,
+            category: decision.category,
+            riskScore: decision.riskScore
+          });
+        }
+        if (decision.shouldChallenge) {
+          if (opts.onChallenge) {
+            return opts.onChallenge(decision, req, res);
+          }
+          if (opts.enablePoWChallenge !== false && decision.challengeHtml) {
+            res.status(428);
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            return res.end(decision.challengeHtml);
+          }
+          res.setHeader("X-BotGate-Action", "challenge");
+          res.setHeader("X-BotGate-Risk", decision.riskScore.toString());
+        } else {
+          res.setHeader("X-BotGate-Action", "allow");
+        }
+        next();
+      } catch (err) {
+        next(err);
+      }
+    };
+  }
+  createAllowedDecision(reason, startTime) {
+    const durationMs = Math.round((performance.now() - startTime) * 100) / 100;
+    return {
+      action: "allow",
+      shouldBlock: false,
+      shouldChallenge: false,
+      shouldTarpit: false,
+      isBot: false,
+      isAttack: false,
+      category: "human",
+      riskScore: 0,
+      confidence: 1,
+      reasons: [reason],
+      assessment: {
+        isBotProbability: 0,
+        isAttackProbability: 0,
+        isSpoofedProbability: 0,
+        trafficType: "human",
+        trafficTypeConfidence: 1,
+        trafficTypeDistribution: { human: 1 },
+        riskScore: 0,
+        riskConfidence: 1,
+        riskLevelDistribution: { "0": 1 }
+      },
+      durationMs,
+      respond: () => false
+    };
+  }
+  createBlockedDecision(reason, startTime) {
+    const durationMs = Math.round((performance.now() - startTime) * 100) / 100;
+    return {
+      action: "block",
+      shouldBlock: true,
+      shouldChallenge: false,
+      shouldTarpit: false,
+      isBot: true,
+      isAttack: true,
+      category: "attack",
+      riskScore: 3,
+      confidence: 1,
+      reasons: [reason],
+      assessment: {
+        isBotProbability: 1,
+        isAttackProbability: 1,
+        isSpoofedProbability: 1,
+        trafficType: "attack",
+        trafficTypeConfidence: 1,
+        trafficTypeDistribution: { attack: 1 },
+        riskScore: 3,
+        riskConfidence: 1,
+        riskLevelDistribution: { "3": 1 }
+      },
+      durationMs,
+      respond: (res) => {
+        if (res && typeof res.status === "function") {
+          res.status(403).json({ error: "Forbidden", message: reason });
+          return true;
+        }
+        return false;
+      }
+    };
+  }
+};
+var TrafficGuard = BotGate;
+
+// src/index.ts
+var defaultGuard = null;
+function getDefaultGuard() {
+  if (!defaultGuard) {
+    defaultGuard = new TrafficGuard();
+  }
+  return defaultGuard;
+}
+async function trafficguard(input, options) {
+  if (options) {
+    const guard = new TrafficGuard(options);
+    return guard.inspect(input);
+  }
+  return getDefaultGuard().inspect(input);
+}
+trafficguard.create = (options) => new TrafficGuard(options);
+trafficguard.inspect = (input, options) => {
+  return trafficguard(input, options);
+};
+trafficguard.middleware = (options) => {
+  const guard = options ? new TrafficGuard(options) : getDefaultGuard();
+  return guard.middleware(options);
+};
+trafficguard.TrafficGuard = TrafficGuard;
+trafficguard.BotGate = BotGate;
+var botgate = trafficguard;
+var trafficGuard = trafficguard;
+var index_default = trafficguard;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BotGate,
+  DEFAULT_POLICIES,
+  TrafficGuard,
+  botgate,
+  calculateShannonEntropy,
+  checkHeaderOrderAnomaly,
+  createBotGateBattery,
+  createClientHash,
+  createPoWChallenge,
+  evaluateDecision,
+  generateChallengeHtml,
+  heuristicAssessment,
+  normalizeRequest,
+  resolvePolicy,
+  signBotToken,
+  trafficGuard,
+  trafficguard,
+  verifyBotToken,
+  verifyPoW
+});
+//# sourceMappingURL=index.cjs.map