ESI: Akamai, Fastly, Varnish

<esi:include src="https://api.shftd2.com/v1/fragment?partner_id=<your account id>" onerror="continue" />

sub vcl_recv {
    if (req.esi_level == 0) {
        # Agent or human — decided on EVERY request, cache hit or miss.
        if (req.http.User-Agent ~ "(?i)\b(GPTBot|ChatGPT-User|OAI-SearchBot|ClaudeBot|Claude-User|Claude-SearchBot|Google-CloudVertexBot|PerplexityBot|Perplexity-User|CCBot|Meta-ExternalAgent|meta-externalfetcher|Bytespider|YouBot|Diffbot|MistralAI-User|Amazonbot)\b") {
            set req.http.X-ABC-Agent = "1";
            # No 304 for agents: a validator from a human copy would drop the card.
            unset req.http.If-None-Match;
            unset req.http.If-Modified-Since;
        } else {
            unset req.http.X-ABC-Agent;
            set req.esi = false; # humans: the tag stays inert, no card request
        }
        # With shielding, ESI runs at the edge POP only, never at the shield.
        if (fastly.ff.visits_this_service > 0) {
            set req.esi = false;
        }
    }
    if (req.esi_level > 0 && req.url.path == "/v1/fragment") {
        # page_url: scheme + host + path of the page, query dropped, encoded ONCE.
        set req.http.X-Page-Url = urlencode("https://news-site.example" + regsub(req.topurl, "[?#].*$", ""));
        set req.url = req.url + "&page_url=" + req.http.X-Page-Url;
        unset req.http.X-Page-Url;
        set req.backend = F_doubleshift; # the backend you created for api.shftd2.com
        # Header rewrite: key in the header (better: from an edge dictionary),
        # real agent in X-Agent-UA, benign User-Agent, no visitor credentials.
        set req.http.X-API-Key = "YOUR_API_KEY";
        set req.http.X-Agent-UA = req.http.User-Agent;
        set req.http.User-Agent = "abc-esi-adapter";
        unset req.http.Cookie;
        unset req.http.Authorization;
    }
}

sub vcl_miss {
    # ESI cannot parse a compressed body: ask the origin for identity HTML.
    if (req.esi_level == 0) { unset bereq.http.Accept-Encoding; }
    unset bereq.http.X-ABC-Agent;
}

sub vcl_pass {
    if (req.esi_level == 0) { unset bereq.http.Accept-Encoding; }
    unset bereq.http.X-ABC-Agent;
}

sub vcl_fetch {
    # Parse EVERY HTML page, humans included: the cached copy is the same
    # whoever fills it; req.esi above decides per request whether it resolves.
    if (req.esi_level == 0 && beresp.http.Content-Type ~ "text/html") {
        set beresp.do_esi = true;
    }
}

sub vcl_deliver {
    # The composed page is the agent's alone: no validators, no shared caching.
    if (req.esi_level == 0 && req.http.X-ABC-Agent == "1") {
        unset resp.http.ETag;
        unset resp.http.Last-Modified;
        set resp.http.Cache-Control = "private, no-store";
    }
}