Amazon CloudFront setup

import cf from 'cloudfront';

// Keep this list in sync with the supported assistants in the Profound docs.
var BOT_RE = /duckassistbot|chatgpt-user|gemini-deep-research|perplexity-user|amzn-user|mistralai-user|claude-user|claude-code|codex/i;

// Replace with reviewed public, non-personalized page paths.
var PUBLIC_PATHS = ['/', '/pricing', '/docs', '/docs/getting-started'];
var PUBLIC_HOSTS = ['www.example.com'];

function handler(event) {
    var request = event.request;
    var headers = request.headers;

    // Never trust these from a client. The API key and host come from the
    // origin's custom headers; the route marker feeds the cache key, so a
    // spoofed value could pollute the assistant cache entry.
    delete headers['x-concierge-api-key'];
    delete headers['x-concierge-host'];
    delete headers['x-concierge-url'];
    delete headers['x-concierge-route'];

    // Loop protection: Profound stamps x-concierge-request on its own origin
    // fetches. Never route those back to Profound.
    if (request.method !== 'GET' || headers['x-concierge-request']) {
        return request;
    }

    // CloudFront exposes cookies separately from request.headers.
    if (headers.authorization || Object.keys(request.cookies || {}).length > 0) {
        return request;
    }

    var ua = headers['user-agent'] ? headers['user-agent'].value : '';

    var isAssistant = BOT_RE.test(ua);
    var isPublicPage = PUBLIC_PATHS.indexOf(request.uri) !== -1;
    var host = headers.host ? headers.host.value : '';

    if (!isAssistant || !isPublicPage || PUBLIC_HOSTS.indexOf(host) === -1) {
        return request;
    }

    // Split the cache key. This header is in the behavior's cache policy,
    // so assistant responses never collide with human cache entries.
    headers['x-concierge-route'] = { value: 'bot' };

    // Multi-domain distributions only (see Step 1): derive the host from
    // the viewer Host header instead of a static origin custom header.
    // headers['x-concierge-host'] = { value: headers.host.value };

    // Try Profound first; fall back to your own origin if Profound is down
    // or misconfigured. CloudFront accepts 400, 403, 404, 416, 429, 500,
    // 502, 503 and 504 as failover criteria. 401 is not allowed, so a 401
    // from a bad API key surfaces to the assistant instead of failing over.
    // 404 is deliberately omitted: Profound fails open internally and
    // returns your origin's own status, so a 404 is your real 404 and
    // retrying would double-fetch. 429 is also omitted and passes through.
    cf.createRequestOriginGroup({
        originIds: [
            { originId: 'Profound_Origin' },
            { originId: 'YOUR_DEFAULT_ORIGIN' }
        ],
        failoverCriteria: {
            statusCodes: [400, 403, 500, 502, 503, 504]
        }
    });

    return request;
}

curl -sD - -o /dev/null https://www.example.com/pricing -A 'chatgpt-user'