"""
Bot User-Agent Database for Axiom Zero
Production-grade database of bot User-Agent signatures across security, scraping, and crawling tiers.
"""

from enum import Enum
import random


class BotTier(str, Enum):
    KNOWN_GOOD = 'KNOWN_GOOD'           # Legitimate crawlers (Googlebot, Bingbot, etc.)
    TIER_1_SCRIPTED = 'TIER_1_SCRIPTED' # Raw HTTP tools (cURL, Python requests, Wget)
    TIER_2_CDP = 'TIER_2_CDP'           # Headless browsers via DevTools Protocol (Puppeteer, Playwright, Selenium)
    TIER_3_STEALTH = 'TIER_3_STEALTH'   # Patched/stealth browsers (puppeteer-extra-stealth, undetected-chromedriver)
    TIER_4_ENGINE = 'TIER_4_ENGINE'     # Engine-level modified browsers (Custom C++ Gecko/Blink builds)
    SCANNER = 'SCANNER'                 # Vulnerability scanners (Nikto, sqlmap, Nessus, ZAP)
    CREDENTIAL_STUFFER = 'CREDENTIAL_STUFFER' # Credential stuffing tools (Sentry MBA, SNIPR, OpenBullet)
    SCRAPER = 'SCRAPER'                 # Scrapers and SEO tools (SemrushBot, AhrefsBot, Bytespider)


BOT_UA_DATABASE = [
    # -------------------------------------------------------------------------
    # 1. KNOWN_GOOD (Legitimate Search Engine & Indexer Crawlers)
    # -------------------------------------------------------------------------
    {
        'ua': 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Googlebot Desktop',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate Google web crawler. Should NOT be blocked.',
        'keywords': ['googlebot']
    },
    {
        'ua': 'Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.99 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Googlebot Mobile',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate Google mobile web crawler.',
        'keywords': ['googlebot']
    },
    {
        'ua': 'Googlebot-Image/1.0',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Googlebot Image',
        'detection_difficulty': 0.0,
        'notes': 'Google Image Search indexing crawler.',
        'keywords': ['googlebot-image']
    },
    {
        'ua': 'Googlebot-News',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Googlebot News',
        'detection_difficulty': 0.0,
        'notes': 'Google News indexing crawler.',
        'keywords': ['googlebot-news']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Bingbot Desktop',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate Microsoft Bing web crawler.',
        'keywords': ['bingbot']
    },
    {
        'ua': 'Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Mobile/15E148 Safari/604.1 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Bingbot Mobile',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate Microsoft Bing mobile crawler.',
        'keywords': ['bingbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Yahoo Slurp',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate Yahoo indexing crawler.',
        'keywords': ['yahoo! slurp', 'slurp']
    },
    {
        'ua': 'DuckDuckBot/1.0; (+http://duckduckgo.com/duckduckbot.html)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'DuckDuckBot',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate DuckDuckGo crawler.',
        'keywords': ['duckduckbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Baiduspider',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate Baidu search engine spider.',
        'keywords': ['baiduspider']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'YandexBot',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate Yandex web search crawler.',
        'keywords': ['yandexbot']
    },
    {
        'ua': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Applebot',
        'detection_difficulty': 0.0,
        'notes': 'Legitimate Apple Siri and Spotlight indexer.',
        'keywords': ['applebot']
    },
    {
        'ua': 'facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Facebook Crawler',
        'detection_difficulty': 0.0,
        'notes': 'Facebook link preview and open-graph scraper.',
        'keywords': ['facebookexternalhit']
    },
    {
        'ua': 'LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient/4.5.13; +http://www.linkedin.com)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'LinkedInBot',
        'detection_difficulty': 0.0,
        'notes': 'LinkedIn link preview fetcher.',
        'keywords': ['linkedinbot']
    },
    {
        'ua': 'Twitterbot/1.0',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Twitterbot',
        'detection_difficulty': 0.0,
        'notes': 'Twitter Card preview crawler.',
        'keywords': ['twitterbot']
    },
    {
        'ua': 'Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)',
        'tier': BotTier.KNOWN_GOOD,
        'name': 'Slackbot',
        'detection_difficulty': 0.0,
        'notes': 'Slack URL preview expanding bot.',
        'keywords': ['slackbot']
    },

    # -------------------------------------------------------------------------
    # 2. TIER_1_SCRIPTED (Raw HTTP Tools & Programming Libraries)
    # -------------------------------------------------------------------------
    {
        'ua': 'curl/7.68.0',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'cURL 7.68',
        'detection_difficulty': 0.1,
        'notes': 'Default cURL HTTP tool User-Agent on Linux Ubuntu 20.04.',
        'keywords': ['curl/7.68']
    },
    {
        'ua': 'curl/8.4.0',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'cURL 8.4',
        'detection_difficulty': 0.1,
        'notes': 'Default cURL HTTP tool User-Agent on modern systems.',
        'keywords': ['curl/8.4']
    },
    {
        'ua': 'python-requests/2.31.0',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Python Requests 2.31',
        'detection_difficulty': 0.1,
        'notes': 'Default Python requests library HTTP header.',
        'keywords': ['python-requests']
    },
    {
        'ua': 'python-requests/2.28.1',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Python Requests 2.28',
        'detection_difficulty': 0.1,
        'notes': 'Legacy Python requests library HTTP header.',
        'keywords': ['python-requests']
    },
    {
        'ua': 'Python-urllib/3.10',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Python urllib 3.10',
        'detection_difficulty': 0.1,
        'notes': 'Standard Python 3.10 urllib library.',
        'keywords': ['python-urllib']
    },
    {
        'ua': 'Python-urllib/3.11',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Python urllib 3.11',
        'detection_difficulty': 0.1,
        'notes': 'Standard Python 3.11 urllib library.',
        'keywords': ['python-urllib']
    },
    {
        'ua': 'Wget/1.21.2',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'GNU Wget',
        'detection_difficulty': 0.1,
        'notes': 'Default GNU Wget command-line file retriever.',
        'keywords': ['wget']
    },
    {
        'ua': 'HTTPie/3.2.1',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'HTTPie CLI',
        'detection_difficulty': 0.1,
        'notes': 'Modern HTTP CLI client for API testing.',
        'keywords': ['httpie']
    },
    {
        'ua': 'Go-http-client/1.1',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Go HTTP Client 1.1',
        'detection_difficulty': 0.1,
        'notes': 'Golang standard net/http package default signature.',
        'keywords': ['go-http-client']
    },
    {
        'ua': 'Go-http-client/2.0',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Go HTTP Client 2.0',
        'detection_difficulty': 0.1,
        'notes': 'Golang HTTP/2 standard library signature.',
        'keywords': ['go-http-client']
    },
    {
        'ua': 'Java/17.0.2',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Java 17 HttpClient',
        'detection_difficulty': 0.1,
        'notes': 'Oracle/Open JDK 17 standard HTTP client.',
        'keywords': ['java/17']
    },
    {
        'ua': 'Java/1.8.0_351',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Java 8 HttpURLConnection',
        'detection_difficulty': 0.1,
        'notes': 'Legacy Java 8 HttpURLConnection header.',
        'keywords': ['java/1.8']
    },
    {
        'ua': 'libwww-perl/6.52',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Perl LWP',
        'detection_difficulty': 0.1,
        'notes': 'Perl World Wide Web library default.',
        'keywords': ['libwww-perl']
    },
    {
        'ua': 'PostmanRuntime/7.32.3',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Postman Runtime',
        'detection_difficulty': 0.1,
        'notes': 'Postman API client default request header.',
        'keywords': ['postmanruntime']
    },
    {
        'ua': 'axios/1.6.2',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Axios Node.js',
        'detection_difficulty': 0.1,
        'notes': 'Popular Node.js Axios HTTP client package.',
        'keywords': ['axios']
    },
    {
        'ua': 'node-fetch/3.3.0',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Node Fetch',
        'detection_difficulty': 0.1,
        'notes': 'Lightweight Node.js fetch module signature.',
        'keywords': ['node-fetch']
    },
    {
        'ua': 'PHP-curl/8.2.0',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'PHP cURL 8.2',
        'detection_difficulty': 0.1,
        'notes': 'PHP cURL binding default User-Agent.',
        'keywords': ['php-curl']
    },
    {
        'ua': 'Ruby/3.2.0',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Ruby Net::HTTP',
        'detection_difficulty': 0.1,
        'notes': 'Ruby Net::HTTP standard library client.',
        'keywords': ['ruby/']
    },
    {
        'ua': 'GuzzleHttp/7.5.0',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'PHP GuzzleHttp',
        'detection_difficulty': 0.1,
        'notes': 'PHP Guzzle HTTP client library default.',
        'keywords': ['guzzlehttp']
    },
    {
        'ua': 'Apache-HttpClient/4.5.13 (Java/11.0.19)',
        'tier': BotTier.TIER_1_SCRIPTED,
        'name': 'Apache HttpClient',
        'detection_difficulty': 0.1,
        'notes': 'Apache Java HTTP components client package.',
        'keywords': ['apache-httpclient']
    },

    # -------------------------------------------------------------------------
    # 3. TIER_2_CDP (Headless Browsers via Chrome DevTools Protocol & Automation)
    # -------------------------------------------------------------------------
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.94 Safari/537.36',
        'tier': BotTier.TIER_2_CDP,
        'name': 'HeadlessChrome Linux',
        'detection_difficulty': 0.4,
        'notes': 'Default Puppeteer/Selenium HeadlessChrome signature on Linux.',
        'keywords': ['headlesschrome']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.6167.85 Safari/537.36',
        'tier': BotTier.TIER_2_CDP,
        'name': 'HeadlessChrome Windows',
        'detection_difficulty': 0.4,
        'notes': 'Default Puppeteer/Selenium HeadlessChrome signature on Windows.',
        'keywords': ['headlesschrome']
    },
    {
        'ua': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.109 Safari/537.36',
        'tier': BotTier.TIER_2_CDP,
        'name': 'HeadlessChrome macOS',
        'detection_difficulty': 0.4,
        'notes': 'Default Puppeteer HeadlessChrome signature on macOS.',
        'keywords': ['headlesschrome']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Playwright/1.42.1',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Playwright Chromium',
        'detection_difficulty': 0.5,
        'notes': 'Playwright default browser signature with framework token.',
        'keywords': ['playwright']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Puppeteer/21.6.0',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Puppeteer Library',
        'detection_difficulty': 0.5,
        'notes': 'Puppeteer Node library default explicit token.',
        'keywords': ['puppeteer']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Selenium/4.16.0',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Selenium WebDriver',
        'detection_difficulty': 0.4,
        'notes': 'Selenium WebDriver browser automation token.',
        'keywords': ['selenium']
    },
    {
        'ua': 'Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1',
        'tier': BotTier.TIER_2_CDP,
        'name': 'PhantomJS',
        'detection_difficulty': 0.3,
        'notes': 'Legacy PhantomJS headless browser signature.',
        'keywords': ['phantomjs']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/13.6.0 Chrome/118.0.5993.88 Electron/27.0.3 Safari/537.36',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Cypress E2E',
        'detection_difficulty': 0.4,
        'notes': 'Cypress web automation testing runner.',
        'keywords': ['cypress']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 marionette',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Firefox Marionette',
        'detection_difficulty': 0.4,
        'notes': 'Firefox GeckoDriver / Marionette automation driver signature.',
        'keywords': ['marionette']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64; rv:59.0) Gecko/20100101 Firefox/59.0 SlimerJS/1.0.0',
        'tier': BotTier.TIER_2_CDP,
        'name': 'SlimerJS',
        'detection_difficulty': 0.3,
        'notes': 'Scriptable Gecko headless browser (SlimerJS).',
        'keywords': ['slimerjs']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 HtmlUnit/2.63.0',
        'tier': BotTier.TIER_2_CDP,
        'name': 'HtmlUnit',
        'detection_difficulty': 0.3,
        'notes': 'Java GUI-less browser for testing web applications.',
        'keywords': ['htmlunit']
    },
    {
        'ua': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15 (safaridriver/16.0)',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Apple SafariDriver',
        'detection_difficulty': 0.4,
        'notes': 'Apple macOS native SafariDriver automation token.',
        'keywords': ['safaridriver']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/108.0.5359.71 Safari/537.36',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Legacy HeadlessChrome Linux',
        'detection_difficulty': 0.4,
        'notes': 'Older HeadlessChrome signature often found in Docker scrapers.',
        'keywords': ['headlesschrome']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/114.0.5735.198 Safari/537.36',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Legacy HeadlessChrome Win',
        'detection_difficulty': 0.4,
        'notes': 'Older Windows HeadlessChrome build signature.',
        'keywords': ['headlesschrome']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Electron/23.1.0 Safari/537.36',
        'tier': BotTier.TIER_2_CDP,
        'name': 'Electron Automation Client',
        'detection_difficulty': 0.4,
        'notes': 'Electron desktop automation framework default User-Agent.',
        'keywords': ['electron/']
    },

    # -------------------------------------------------------------------------
    # 4. TIER_3_STEALTH (Patched/Stealth Browsers & Anti-Detect Frameworks)
    # -------------------------------------------------------------------------
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Undetected Chromedriver Default',
        'detection_difficulty': 0.8,
        'notes': 'undetected-chromedriver default spoofed zero-patch Chrome UA.',
        'keywords': ['chrome/122.0.0.0']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 (puppeteer-stealth)',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Puppeteer Stealth Plugin',
        'detection_difficulty': 0.8,
        'notes': 'puppeteer-extra-plugin-stealth injected User-Agent signature.',
        'keywords': ['puppeteer-stealth']
    },
    {
        'ua': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 stealth/2.4.9',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Stealth macOS Variant',
        'detection_difficulty': 0.85,
        'notes': 'Stealth plugin variant with explicit stealth version marker.',
        'keywords': ['stealth/']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Anonymouse/3.0',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Anonymouse Proxy Browser',
        'detection_difficulty': 0.75,
        'notes': 'Stealth proxy browser spoofing standard Chrome.',
        'keywords': ['anonymouse']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 (undetected_chromedriver/3.5.0)',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Undetected Chromedriver Marker',
        'detection_difficulty': 0.8,
        'notes': 'Undetected chromedriver explicit build tag.',
        'keywords': ['undetected_chromedriver']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 (fingerprint-suite)',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Fingerprint Suite Bot',
        'detection_difficulty': 0.85,
        'notes': 'Fingerprint masking and JS injection toolkit.',
        'keywords': ['fingerprint-suite']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36 AntiDetect/7.1',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'AntiDetect Browser 7.1',
        'detection_difficulty': 0.9,
        'notes': 'Commercial anti-detect browser suite signature.',
        'keywords': ['antidetect']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Multilogin/6.2.1',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Multilogin Stealth Profile',
        'detection_difficulty': 0.9,
        'notes': 'Multilogin multi-account stealth browser profile.',
        'keywords': ['multilogin']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.217 Safari/537.36 GoLogin/3.2.14',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'GoLogin Anti-Detect',
        'detection_difficulty': 0.9,
        'notes': 'GoLogin anti-detect browser profile for stealth scraping.',
        'keywords': ['gologin']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 Dolphin-anty/4.1.2',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Dolphin Anty Browser',
        'detection_difficulty': 0.9,
        'notes': 'Dolphin Anty browser spoofing profile.',
        'keywords': ['dolphin-anty']
    },
    {
        'ua': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Incogniton/3.0',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Incogniton Anti-Detect',
        'detection_difficulty': 0.85,
        'notes': 'Incogniton stealth profile browser.',
        'keywords': ['incogniton']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 AdsPower/5.4',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'AdsPower Stealth Browser',
        'detection_difficulty': 0.85,
        'notes': 'AdsPower multi-account anti-detect browser.',
        'keywords': ['adspower']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 OctoBrowser/1.8',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Octo Browser',
        'detection_difficulty': 0.85,
        'notes': 'Octo anti-detect browser suite profile.',
        'keywords': ['octobrowser']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0 Kameleo/3.1',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'Kameleo Stealth Profile',
        'detection_difficulty': 0.85,
        'notes': 'Kameleo Firefox stealth spoofing engine.',
        'keywords': ['kameleo']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 StealthDriver/1.0',
        'tier': BotTier.TIER_3_STEALTH,
        'name': 'StealthDriver Python Extension',
        'detection_difficulty': 0.8,
        'notes': 'Custom Python selenium stealth driver module.',
        'keywords': ['stealthdriver']
    },

    # -------------------------------------------------------------------------
    # 5. TIER_4_ENGINE (Engine-Level Modified Browsers / Custom C++ Builds)
    # -------------------------------------------------------------------------
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0 AxiomEngine/1.0',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Axiom Engine Gecko v142',
        'detection_difficulty': 0.95,
        'notes': 'Custom C++ Gecko v142 patched engine build.',
        'keywords': ['axiomengine']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) CustomBlink/120.0.0.0 Safari/537.36 EnginePatch/4.2',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Custom Blink Engine Build',
        'detection_difficulty': 0.95,
        'notes': 'Custom Blink source modified headless build.',
        'keywords': ['customblink', 'enginepatch']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 (PhantomShim/151.0)',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Gecko Dual-Brain Phantom Shim',
        'detection_difficulty': 0.95,
        'notes': 'Gecko engine v142 with v151 Phantom Shim privileged polyfills.',
        'keywords': ['phantomshim']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 EngineNativeHook/2.1',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Gecko Native Hook Build',
        'detection_difficulty': 0.95,
        'notes': 'Gecko binary with native C++ hooks for DOM forgery.',
        'keywords': ['enginenativehook']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) BlinkCore/122.0.0.0 Chrome/122.0.0.0 Safari/537.36',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Modified Blink Core Binaries',
        'detection_difficulty': 0.9,
        'notes': 'Modified Blink core library compiled from C++ source.',
        'keywords': ['blinkcore']
    },
    {
        'ua': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) CustomWebkit/605.1.15 EngineMod/1.0',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Custom WebKit Native Build',
        'detection_difficulty': 0.95,
        'notes': 'Custom compiled WebKit engine for macOS automation.',
        'keywords': ['customwebkit', 'enginemod']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0 SpoofedEngine/151.0',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Gecko Source Patched Build',
        'detection_difficulty': 0.95,
        'notes': 'Gecko engine modified directly at moz.build level.',
        'keywords': ['spoofedengine']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) NativePatchChromium/120.0.6099.109 Safari/537.36',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Chromium C++ Patch Fork',
        'detection_difficulty': 0.95,
        'notes': 'Chromium source fork with DevTools protocol stealth modifications.',
        'keywords': ['nativepatchchromium']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 CustomV8Bridge/1.0',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Custom JS Engine Bridge Build',
        'detection_difficulty': 0.9,
        'notes': 'Gecko/V8 hybrid bridge with native bindings.',
        'keywords': ['customv8bridge']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 AxiomZeroEngine/0.9',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Axiom Zero Custom Engine',
        'detection_difficulty': 0.95,
        'notes': 'Axiom Zero prototype engine binary.',
        'keywords': ['axiomzeroengine']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) EngineLevelSpoof/2.0 Chrome/122.0.0.0 Safari/537.36',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Engine-Level C++ Spoofing Binary',
        'detection_difficulty': 0.95,
        'notes': 'C++ engine-level spoofing compiled binary.',
        'keywords': ['enginelevelspoof']
    },
    {
        'ua': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/605.1.15 (KHTML, like Gecko) WebKitEngineFork/3.0 Safari/605.1.15',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'WebKit C++ Engine Fork',
        'detection_difficulty': 0.95,
        'notes': 'WebKit C++ source code fork for macOS bot automation.',
        'keywords': ['webkitenginefork']
    },
    {
        'ua': 'Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 OraclePass/1.0',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Gecko Oracle-Passing C++ Build',
        'detection_difficulty': 0.98,
        'notes': 'Gecko build engineered to pass Prototype Oracles.',
        'keywords': ['oraclepass']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) NativeDevToolsBypass/1.0 Chrome/120.0.0.0 Safari/537.36',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'C++ DevTools Native Bypass',
        'detection_difficulty': 0.95,
        'notes': 'Native C++ patch neutralizing DevTools detection flags.',
        'keywords': ['nativedevtoolsbypass']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0 ZeroFootprint/1.0',
        'tier': BotTier.TIER_4_ENGINE,
        'name': 'Zero Footprint Custom Engine',
        'detection_difficulty': 0.98,
        'notes': 'Zero-footprint custom C++ engine build.',
        'keywords': ['zerofootprint']
    },

    # -------------------------------------------------------------------------
    # 6. SCANNER (Vulnerability Scanners & Reconnaissance Tools)
    # -------------------------------------------------------------------------
    {
        'ua': 'Mozilla/5.00 (Nikto/2.1.6) (Evasion:None) (Test:Port Check)',
        'tier': BotTier.SCANNER,
        'name': 'Nikto Web Scanner 2.1.6',
        'detection_difficulty': 0.1,
        'notes': 'Nikto web server vulnerability scanner default signature.',
        'keywords': ['nikto']
    },
    {
        'ua': 'Nikto/2.1.5',
        'tier': BotTier.SCANNER,
        'name': 'Nikto Scanner 2.1.5',
        'detection_difficulty': 0.1,
        'notes': 'Nikto web scanner legacy signature.',
        'keywords': ['nikto']
    },
    {
        'ua': 'sqlmap/1.7.11#stable (https://sqlmap.org)',
        'tier': BotTier.SCANNER,
        'name': 'sqlmap 1.7',
        'detection_difficulty': 0.1,
        'notes': 'sqlmap automatic SQL injection tool signature.',
        'keywords': ['sqlmap']
    },
    {
        'ua': 'sqlmap/1.4.7#stable',
        'tier': BotTier.SCANNER,
        'name': 'sqlmap 1.4',
        'detection_difficulty': 0.1,
        'notes': 'sqlmap legacy SQL injection scanner header.',
        'keywords': ['sqlmap']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; Nessus/10.6.0; +https://www.tenable.com/products/nessus)',
        'tier': BotTier.SCANNER,
        'name': 'Nessus Vulnerability Scanner',
        'detection_difficulty': 0.1,
        'notes': 'Tenable Nessus vulnerability scanner web probe.',
        'keywords': ['nessus']
    },
    {
        'ua': 'Nessus SOAP Client',
        'tier': BotTier.SCANNER,
        'name': 'Nessus SOAP Client',
        'detection_difficulty': 0.1,
        'notes': 'Tenable Nessus legacy SOAP client identifier.',
        'keywords': ['nessus']
    },
    {
        'ua': 'OWASP ZAP/2.14.0',
        'tier': BotTier.SCANNER,
        'name': 'OWASP ZAP Scanner',
        'detection_difficulty': 0.1,
        'notes': 'OWASP Zed Attack Proxy automated web scanner signature.',
        'keywords': ['owasp zap', 'zap/']
    },
    {
        'ua': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) OWASP ZAP/2.12.0',
        'tier': BotTier.SCANNER,
        'name': 'OWASP ZAP Browser',
        'detection_difficulty': 0.1,
        'notes': 'OWASP ZAP proxy browser mode user agent.',
        'keywords': ['owasp zap']
    },
    {
        'ua': 'Nuclei - Open-source project (github.com/projectdiscovery/nuclei)',
        'tier': BotTier.SCANNER,
        'name': 'Nuclei Vulnerability Scanner',
        'detection_difficulty': 0.1,
        'notes': 'Project Discovery Nuclei template-based vulnerability scanner.',
        'keywords': ['nuclei']
    },
    {
        'ua': 'nuclei/v3.1.0',
        'tier': BotTier.SCANNER,
        'name': 'Nuclei CLI',
        'detection_difficulty': 0.1,
        'notes': 'Nuclei scanner CLI default user agent.',
        'keywords': ['nuclei']
    },
    {
        'ua': 'Acunetix-Aspect-Website-Vulnerability-Scanner/v15.0',
        'tier': BotTier.SCANNER,
        'name': 'Acunetix Scanner v15',
        'detection_difficulty': 0.1,
        'notes': 'Acunetix commercial web vulnerability scanner.',
        'keywords': ['acunetix']
    },
    {
        'ua': 'Acunetix/14.0',
        'tier': BotTier.SCANNER,
        'name': 'Acunetix Scanner v14',
        'detection_difficulty': 0.1,
        'notes': 'Acunetix web scanner legacy signature.',
        'keywords': ['acunetix']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)',
        'tier': BotTier.SCANNER,
        'name': 'Nmap Scripting Engine',
        'detection_difficulty': 0.1,
        'notes': 'Nmap NSE http scripts default User-Agent.',
        'keywords': ['nmap scripting engine', 'nmap']
    },
    {
        'ua': 'WPScan v3.8.22 (https://wpscan.com/wordpress-security-scanner)',
        'tier': BotTier.SCANNER,
        'name': 'WPScan WordPress Scanner',
        'detection_difficulty': 0.1,
        'notes': 'WPScan WordPress vulnerability scanner.',
        'keywords': ['wpscan']
    },
    {
        'ua': 'gobuster/3.6.0',
        'tier': BotTier.SCANNER,
        'name': 'Gobuster',
        'detection_difficulty': 0.1,
        'notes': 'Gobuster directory and DNS brute-force scanner.',
        'keywords': ['gobuster']
    },
    {
        'ua': 'DirBuster-1.0-RC1 (http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project)',
        'tier': BotTier.SCANNER,
        'name': 'OWASP DirBuster',
        'detection_difficulty': 0.1,
        'notes': 'OWASP DirBuster path bruteforce scanner.',
        'keywords': ['dirbuster']
    },
    {
        'ua': 'masscan/1.3.2 (https://github.com/robertdavidgraham/masscan)',
        'tier': BotTier.SCANNER,
        'name': 'Masscan Port Scanner',
        'detection_difficulty': 0.1,
        'notes': 'Masscan high-speed port scanner signature.',
        'keywords': ['masscan']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; QualysGuard/2.4)',
        'tier': BotTier.SCANNER,
        'name': 'QualysGuard Scanner',
        'detection_difficulty': 0.1,
        'notes': 'QualysGuard Enterprise Security Scanner header.',
        'keywords': ['qualysguard']
    },
    {
        'ua': 'OpenVAS-Scanner/22.4.0',
        'tier': BotTier.SCANNER,
        'name': 'OpenVAS Scanner',
        'detection_difficulty': 0.1,
        'notes': 'Greenbone OpenVAS vulnerability assessment scanner.',
        'keywords': ['openvas']
    },
    {
        'ua': 'Netsparker/6.3.0 (https://www.netsparker.com)',
        'tier': BotTier.SCANNER,
        'name': 'Netsparker Web Scanner',
        'detection_difficulty': 0.1,
        'notes': 'Invicti Netsparker automated vulnerability scanner.',
        'keywords': ['netsparker']
    },

    # -------------------------------------------------------------------------
    # 7. CREDENTIAL_STUFFER (Credential Stuffing & Account Takeover Tools)
    # -------------------------------------------------------------------------
    {
        'ua': 'SentryMBA/1.4.1',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'Sentry MBA 1.4.1',
        'detection_difficulty': 0.2,
        'notes': 'Sentry MBA automated credential stuffing tool default signature.',
        'keywords': ['sentrymba', 'sentry mba']
    },
    {
        'ua': 'Sentry MBA',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'Sentry MBA Generic',
        'detection_difficulty': 0.2,
        'notes': 'Sentry MBA brute force suite header.',
        'keywords': ['sentry mba']
    },
    {
        'ua': 'OpenBullet/1.4.4',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'OpenBullet 1.4.4',
        'detection_difficulty': 0.2,
        'notes': 'OpenBullet web testing and credential stuffing suite signature.',
        'keywords': ['openbullet']
    },
    {
        'ua': 'OpenBullet 2',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'OpenBullet 2',
        'detection_difficulty': 0.2,
        'notes': 'OpenBullet 2 cross-platform credential stuffer.',
        'keywords': ['openbullet']
    },
    {
        'ua': 'RuriLib/1.0.0',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'RuriLib Core Engine',
        'detection_difficulty': 0.2,
        'notes': 'RuriLib request engine powering OpenBullet configurations.',
        'keywords': ['rurilib']
    },
    {
        'ua': 'SNIPR/v1.0',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'SNIPR Stuffer v1.0',
        'detection_difficulty': 0.2,
        'notes': 'SNIPR credential cracking tool header.',
        'keywords': ['snipr']
    },
    {
        'ua': 'SNIPR',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'SNIPR Generic',
        'detection_difficulty': 0.2,
        'notes': 'SNIPR account takeover tool identifier.',
        'keywords': ['snipr']
    },
    {
        'ua': 'Storm/1.0',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'Storm Cracker 1.0',
        'detection_difficulty': 0.2,
        'notes': 'Storm Cracker credential stuffing tool signature.',
        'keywords': ['storm/']
    },
    {
        'ua': 'Storm Crack',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'Storm Crack Identifier',
        'detection_difficulty': 0.2,
        'notes': 'Storm cracking tool User-Agent marker.',
        'keywords': ['storm crack']
    },
    {
        'ua': 'Hydra/9.2',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'THC-Hydra 9.2',
        'detection_difficulty': 0.2,
        'notes': 'THC-Hydra password brute force tool HTTP header.',
        'keywords': ['hydra']
    },
    {
        'ua': 'THC-Hydra/9.5',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'THC-Hydra 9.5',
        'detection_difficulty': 0.2,
        'notes': 'THC-Hydra login cracker suite signature.',
        'keywords': ['thc-hydra', 'hydra']
    },
    {
        'ua': 'BlackBullet/2.0',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'BlackBullet Stuffer',
        'detection_difficulty': 0.2,
        'notes': 'BlackBullet account credential checker.',
        'keywords': ['blackbullet']
    },
    {
        'ua': 'Private KB/1.0',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'Private Combo Checker',
        'detection_difficulty': 0.25,
        'notes': 'Private combo checker automated stuffer signature.',
        'keywords': ['private kb']
    },
    {
        'ua': 'SentryMBA/1.5.0 (Windows NT 10.0; Win64; x64)',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'Sentry MBA Windows',
        'detection_difficulty': 0.2,
        'notes': 'Sentry MBA Windows platform custom UA variant.',
        'keywords': ['sentrymba']
    },
    {
        'ua': 'AccountChecker/3.1',
        'tier': BotTier.CREDENTIAL_STUFFER,
        'name': 'AccountChecker Bot',
        'detection_difficulty': 0.2,
        'notes': 'Automated account validation bot tool.',
        'keywords': ['accountchecker']
    },

    # -------------------------------------------------------------------------
    # 8. SCRAPER (Commercial / Aggressive Scrapers & AI Indexers)
    # -------------------------------------------------------------------------
    {
        'ua': 'Mozilla/5.0 (compatible; SemrushBot/7.0; +http://www.semrush.com/bot.html)',
        'tier': BotTier.SCRAPER,
        'name': 'SemrushBot',
        'detection_difficulty': 0.2,
        'notes': 'Semrush SEO audit and backlink crawler.',
        'keywords': ['semrushbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)',
        'tier': BotTier.SCRAPER,
        'name': 'SemrushBot Backlink',
        'detection_difficulty': 0.2,
        'notes': 'Semrush backlink audit bot.',
        'keywords': ['semrushbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)',
        'tier': BotTier.SCRAPER,
        'name': 'AhrefsBot',
        'detection_difficulty': 0.2,
        'notes': 'Ahrefs web analysis and SEO crawler.',
        'keywords': ['ahrefsbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)',
        'tier': BotTier.SCRAPER,
        'name': 'MJ12bot',
        'detection_difficulty': 0.2,
        'notes': 'Majestic 12 link intelligence web scraper.',
        'keywords': ['mj12bot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot, help@moz.com)',
        'tier': BotTier.SCRAPER,
        'name': 'DotBot / Moz',
        'detection_difficulty': 0.2,
        'notes': 'Moz Open Site Explorer indexer bot.',
        'keywords': ['dotbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; BLEXBot/1.0; +http://webmeup-crawler.com/)',
        'tier': BotTier.SCRAPER,
        'name': 'BLEXBot',
        'detection_difficulty': 0.2,
        'notes': 'WebMeUp BLEXBot SEO crawler.',
        'keywords': ['blexbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)',
        'tier': BotTier.SCRAPER,
        'name': 'PetalBot',
        'detection_difficulty': 0.2,
        'notes': 'Huawei PetalSearch indexing scraper.',
        'keywords': ['petalbot']
    },
    {
        'ua': 'Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Mobile Safari/537.36 Bytespider',
        'tier': BotTier.SCRAPER,
        'name': 'Bytespider',
        'detection_difficulty': 0.3,
        'notes': 'ByteDance / TikTok content web scraper.',
        'keywords': ['bytespider']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)',
        'tier': BotTier.SCRAPER,
        'name': 'Amazonbot',
        'detection_difficulty': 0.2,
        'notes': 'Amazon web crawler for Alexa services.',
        'keywords': ['amazonbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; SerpstatBot/1.0; +http://serpstatbot.com/)',
        'tier': BotTier.SCRAPER,
        'name': 'SerpstatBot',
        'detection_difficulty': 0.2,
        'notes': 'Serpstat SEO analytics crawler.',
        'keywords': ['serpstatbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; DataForSeoBot/1.0; +https://dataforseo.com/dataforseo-bot)',
        'tier': BotTier.SCRAPER,
        'name': 'DataForSeoBot',
        'detection_difficulty': 0.2,
        'notes': 'DataForSEO API web scraper bot.',
        'keywords': ['dataforseobot']
    },
    {
        'ua': 'Screaming Frog SEO Spider/19.2',
        'tier': BotTier.SCRAPER,
        'name': 'Screaming Frog SEO Spider',
        'detection_difficulty': 0.1,
        'notes': 'Screaming Frog desktop SEO audit crawler.',
        'keywords': ['screaming frog']
    },
    {
        'ua': 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot',
        'tier': BotTier.SCRAPER,
        'name': 'ChatGPT User Fetcher',
        'detection_difficulty': 0.2,
        'notes': 'OpenAI ChatGPT real-time user browsing fetcher.',
        'keywords': ['chatgpt-user']
    },
    {
        'ua': 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.1; +https://openai.com/gptbot',
        'tier': BotTier.SCRAPER,
        'name': 'GPTBot AI Scraper',
        'detection_difficulty': 0.2,
        'notes': 'OpenAI automated web crawler for model training.',
        'keywords': ['gptbot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; ClaudeBot/1.0; +https://anthropic.com/claudebot)',
        'tier': BotTier.SCRAPER,
        'name': 'ClaudeBot Anthropic',
        'detection_difficulty': 0.2,
        'notes': 'Anthropic Claude web indexing crawler.',
        'keywords': ['claudebot']
    },
    {
        'ua': 'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot',
        'tier': BotTier.SCRAPER,
        'name': 'PerplexityBot',
        'detection_difficulty': 0.2,
        'notes': 'Perplexity AI search engine scraper.',
        'keywords': ['perplexitybot']
    },
    {
        'ua': 'Mozilla/5.0 (compatible; SeekportBot; +https://bot.seekport.com)',
        'tier': BotTier.SCRAPER,
        'name': 'SeekportBot',
        'detection_difficulty': 0.2,
        'notes': 'Seekport commercial web crawler.',
        'keywords': ['seekportbot']
    },
    {
        'ua': 'Scrapy/2.11.0 (+https://scrapy.org)',
        'tier': BotTier.SCRAPER,
        'name': 'Scrapy Framework',
        'detection_difficulty': 0.1,
        'notes': 'Python Scrapy web scraping framework default UA.',
        'keywords': ['scrapy']
    }
]


def _get_keywords(entry: dict) -> list:
    """Extract keyword matching patterns for a bot entry."""
    if 'keywords' in entry and entry['keywords']:
        return entry['keywords']
    return [entry['name']]


def get_by_tier(tier: BotTier) -> list:
    """Return all bot entries belonging to a given BotTier."""
    return [entry for entry in BOT_UA_DATABASE if entry['tier'] == tier]


def get_random_ua(tier: BotTier = None) -> dict:
    """Return a random bot entry from the full database or filtered by tier."""
    pool = BOT_UA_DATABASE if tier is None else get_by_tier(tier)
    return random.choice(pool) if pool else None


def classify_ua(user_agent: str) -> dict:
    """
    Given a UA string, check if it matches any known bot signature.
    Returns {'matched': bool, 'entry': dict or None, 'tier': BotTier or None}
    """
    if not user_agent:
        return {'matched': False, 'entry': None, 'tier': None}
    
    ua_lower = user_agent.lower()
    
    # 1. Exact Match Check
    for entry in BOT_UA_DATABASE:
        if entry['ua'].lower() == ua_lower:
            return {'matched': True, 'entry': entry, 'tier': entry['tier']}

    # 2. Keyword / Substring Match Check
    for entry in BOT_UA_DATABASE:
        keywords = _get_keywords(entry)
        if any(kw.lower() in ua_lower for kw in keywords):
            return {'matched': True, 'entry': entry, 'tier': entry['tier']}

    return {'matched': False, 'entry': None, 'tier': None}


if __name__ == '__main__':
    print("=" * 70)
    print("        AXIOM ZERO - BOT USER-AGENT DATABASE SUMMARY          ")
    print("=" * 70)
    
    total_entries = len(BOT_UA_DATABASE)
    print(f"Total Bot User-Agent Signatures: {total_entries}")
    print("-" * 70)
    print(f"{'Bot Tier':<25} | {'Count':<6} | {'Avg Detection Difficulty':<25}")
    print("-" * 70)

    for tier in BotTier:
        entries = get_by_tier(tier)
        count = len(entries)
        avg_diff = sum(e['detection_difficulty'] for e in entries) / count if count > 0 else 0.0
        print(f"{tier.value:<25} | {count:<6} | {avg_diff:.2f}")

    print("-" * 70)
    print("\n[+] Verification Test Samples:")
    
    test_uas = [
        "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
        "python-requests/2.31.0",
        "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.94 Safari/537.36",
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 (puppeteer-stealth)",
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0 AxiomEngine/1.0",
        "sqlmap/1.7.11#stable (https://sqlmap.org)",
        "SentryMBA/1.4.1",
        "Mozilla/5.0 (compatible; SemrushBot/7.0; +http://www.semrush.com/bot.html)",
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
    ]

    for ua in test_uas:
        res = classify_ua(ua)
        tier_str = res['tier'].value if res['tier'] else 'UNKNOWN'
        name_str = res['entry']['name'] if res['entry'] else 'Unmatched'
        print(f"UA: {ua[:60]}...")
        print(f" -> Matched: {res['matched']} | Tier: {tier_str} | Name: {name_str}\n")