@absolutejs/auth 0.56.19 → 0.57.0

package/dist/fingerprint-client/index.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../../src/fingerprint-client/index.ts"],
   "sourcesContent": [
-    "// Browser-side device fingerprint collector.\n//\n// `collectDeviceFingerprint()` reads ~10 signals from the browser (canvas render,\n// AudioContext, WebGL renderer, font enumeration, screen geometry, navigator.languages,\n// timezone, hardware concurrency, device memory, pixel ratio), normalizes them, and\n// hashes the canonical JSON into a stable base64url SHA-256 `deviceId`.\n//\n// Self-hosted equivalent of FingerprintJS's open-source library. Each individual signal\n// is weak on its own — but their combination is highly stable across sessions for the\n// same browser+device, and varies sharply across different browsers/devices. The same\n// algorithms underpin every commercial fingerprinter; only the proprietary data network\n// (cross-customer reputation) is what SaaS vendors charge for, and that's a non-goal here.\n//\n// Imported via `@absolutejs/auth/fingerprint-client` — server bundle does NOT pull this in\n// (browser globals like `window` would explode there). The client SDK + your sign-in form\n// call this, send the result as `x-client-fingerprint`, and the server (riskConfig / adaptive)\n// uses it as the deviceId instead of the weak UA+IP fallback.\n\nconst CANVAS_TEXT = 'absoluteAuth-fp 🔐';\nconst CANVAS_WIDTH = 280;\nconst CANVAS_HEIGHT = 60;\nconst AUDIO_SAMPLES_COUNT = 4500;\nconst AUDIO_OSC_FREQ = 10_000;\nconst AUDIO_COMPRESSOR_THRESHOLD = -50;\nconst AUDIO_COMPRESSOR_KNEE = 40;\nconst AUDIO_COMPRESSOR_RATIO = 12;\nconst AUDIO_COMPRESSOR_ATTACK = 0;\nconst AUDIO_COMPRESSOR_RELEASE = 0.25;\nconst AUDIO_SAMPLE_RATE = 44_100;\nconst FONT_PROBE = 'mmmmmmmmmlli';\nconst FONT_PROBE_PX = '72px';\nconst FONT_PROBE_OFFSCREEN_PX = -9999;\nconst FONT_BASE_FAMILIES = ['monospace', 'sans-serif', 'serif'] as const;\nconst POPULAR_FONTS = [\n\t'Arial',\n\t'Arial Black',\n\t'Comic Sans MS',\n\t'Courier New',\n\t'Georgia',\n\t'Helvetica',\n\t'Impact',\n\t'Lucida Console',\n\t'Times New Roman',\n\t'Trebuchet MS',\n\t'Verdana',\n\t'monospace',\n\t'sans-serif',\n\t'serif'\n];\n\nexport type FingerprintSignals = {\n\taudio?: number;\n\tcanvas?: string;\n\tdeviceMemory?: number;\n\tfonts?: string[];\n\thardwareConcurrency?: number;\n\tlanguages?: readonly string[];\n\tpixelRatio?: number;\n\tplatform?: string;\n\tscreen?: { colorDepth: number; height: number; width: number };\n\ttimezone?: string;\n\tuserAgent?: string;\n\twebgl?: { renderer?: string; vendor?: string };\n};\n\nexport type DeviceFingerprint = {\n\tdeviceId: string;\n\tsignals: FingerprintSignals;\n};\n\n// Canvas hash: render text + a curve + a couple of rectangles + return the data URL\n// (its pixel content hashes differently across GPUs, drivers, browser versions, font\n// renderers). Wrapped in try/catch because privacy-mode browsers throw on getContext.\nconst readCanvas = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tcanvas.width = CANVAS_WIDTH;\n\t\tcanvas.height = CANVAS_HEIGHT;\n\t\tconst context = canvas.getContext('2d');\n\t\tif (context === null) return undefined;\n\t\tcontext.textBaseline = 'top';\n\t\tcontext.font = '14px Arial';\n\t\tcontext.fillStyle = '#f60';\n\t\tcontext.fillRect(125, 1, 62, 20);\n\t\tcontext.fillStyle = '#069';\n\t\tcontext.fillText(CANVAS_TEXT, 2, 15);\n\t\tcontext.fillStyle = 'rgba(102, 204, 0, 0.7)';\n\t\tcontext.fillText(CANVAS_TEXT, 4, 17);\n\n\t\treturn canvas.toDataURL();\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\ntype LegacyOfflineCtxGlobal = {\n\twebkitOfflineAudioContext?: typeof OfflineAudioContext;\n};\n\nconst resolveOfflineAudioContextCtor = () => {\n\tif (typeof OfflineAudioContext !== 'undefined') return OfflineAudioContext;\n\t// eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- vendor-prefixed legacy API; no TS type ships for it\n\tconst legacy = globalThis as LegacyOfflineCtxGlobal;\n\n\treturn legacy.webkitOfflineAudioContext;\n};\n\nconst sumAbs = (samples: Float32Array) => {\n\tlet total = 0;\n\tfor (const sample of samples) total += Math.abs(sample);\n\n\treturn total;\n};\n\n// Audio hash: instantiate an offline audio context, push a brief oscillator + dynamics\n// compressor through it, read back the rendered buffer's sum. Different audio stacks\n// produce subtly different floating-point outputs.\nconst readAudio = async () => {\n\ttry {\n\t\tconst ContextCtor = resolveOfflineAudioContextCtor();\n\t\tif (ContextCtor === undefined) return undefined;\n\t\tconst context = new ContextCtor(\n\t\t\t1,\n\t\t\tAUDIO_SAMPLES_COUNT,\n\t\t\tAUDIO_SAMPLE_RATE\n\t\t);\n\t\tconst oscillator = context.createOscillator();\n\t\toscillator.type = 'triangle';\n\t\toscillator.frequency.value = AUDIO_OSC_FREQ;\n\t\tconst compressor = context.createDynamicsCompressor();\n\t\tcompressor.threshold.value = AUDIO_COMPRESSOR_THRESHOLD;\n\t\tcompressor.knee.value = AUDIO_COMPRESSOR_KNEE;\n\t\tcompressor.ratio.value = AUDIO_COMPRESSOR_RATIO;\n\t\t// `reduction` is read-only on the modern spec (the constant exists for the\n\t\t// outdated browsers that originally exposed it as a writable AudioParam;\n\t\t// we don't bother setting it — the fingerprint is plenty stable without).\n\t\tcompressor.attack.value = AUDIO_COMPRESSOR_ATTACK;\n\t\tcompressor.release.value = AUDIO_COMPRESSOR_RELEASE;\n\t\toscillator.connect(compressor);\n\t\tcompressor.connect(context.destination);\n\t\toscillator.start(0);\n\t\tconst buffer = await context.startRendering();\n\n\t\treturn sumAbs(buffer.getChannelData(0));\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// WebGL hash: the renderer + vendor strings include GPU model + driver — highly stable,\n// highly distinctive. Behind the WEBGL_debug_renderer_info extension on most browsers.\nconst readWebgl = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tconst context =\n\t\t\tcanvas.getContext('webgl') ??\n\t\t\tcanvas.getContext('experimental-webgl');\n\t\tif (\n\t\t\tcontext === null ||\n\t\t\t!('getExtension' in context) ||\n\t\t\t!('getParameter' in context)\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst debug = context.getExtension('WEBGL_debug_renderer_info');\n\t\tif (debug === null) return undefined;\n\n\t\treturn {\n\t\t\trenderer: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_RENDERER_WEBGL) ?? ''\n\t\t\t),\n\t\t\tvendor: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_VENDOR_WEBGL) ?? ''\n\t\t\t)\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Width of `probe` rendered in `family` on the given span — used to detect installed\n// fonts (different widths than the fallback ⇒ font is present).\nconst measureFamily = (span: HTMLSpanElement, family: string) => {\n\tspan.style.fontFamily = family;\n\n\treturn span.offsetWidth;\n};\n\nconst detectFontPresent = (\n\tspan: HTMLSpanElement,\n\tfont: string,\n\tbaseline: Record<string, number>\n) =>\n\tFONT_BASE_FAMILIES.some(\n\t\t(family) =>\n\t\t\tmeasureFamily(span, `'${font}', ${family}`) !== baseline[family]\n\t);\n\n// Font enumeration: a font is \"installed\" if the rendered width of a probe string differs\n// from the same string in a known fallback. Compares against monospace + sans-serif +\n// serif and counts a match if any of them produce a different width.\nconst readFonts = () => {\n\ttry {\n\t\tconst span = document.createElement('span');\n\t\tspan.style.position = 'absolute';\n\t\tspan.style.left = `${FONT_PROBE_OFFSCREEN_PX}px`;\n\t\tspan.style.fontSize = FONT_PROBE_PX;\n\t\tspan.textContent = FONT_PROBE;\n\t\tdocument.body.appendChild(span);\n\n\t\tconst baseline: Record<string, number> = Object.fromEntries(\n\t\t\tFONT_BASE_FAMILIES.map((family) => [\n\t\t\t\tfamily,\n\t\t\t\tmeasureFamily(span, family)\n\t\t\t])\n\t\t);\n\t\tconst present = POPULAR_FONTS.filter((font) =>\n\t\t\tdetectFontPresent(span, font, baseline)\n\t\t);\n\n\t\tdocument.body.removeChild(span);\n\n\t\treturn present;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst readScreen = () => {\n\tif (typeof screen === 'undefined') return undefined;\n\n\treturn {\n\t\tcolorDepth: screen.colorDepth,\n\t\theight: screen.height,\n\t\twidth: screen.width\n\t};\n};\n\nconst readTimezone = () => {\n\ttry {\n\t\treturn Intl.DateTimeFormat().resolvedOptions().timeZone;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Canonical JSON identical to the server-side `fingerprintDevice` canonicalizer: keys\n// sorted at every depth so identical signals produce identical hashes regardless of\n// insertion order. Inlined here to keep the client bundle free of server-side imports.\nconst canonical = (signals: FingerprintSignals) =>\n\tJSON.stringify(signals, (_key, value) =>\n\t\tvalue === null || typeof value !== 'object' || Array.isArray(value)\n\t\t\t? value\n\t\t\t: Object.fromEntries(\n\t\t\t\t\tObject.entries(value).sort((left, right) =>\n\t\t\t\t\t\tleft[0].localeCompare(right[0])\n\t\t\t\t\t)\n\t\t\t\t)\n\t);\n\nconst sha256Base64Url = async (input: string) => {\n\tconst bytes = await crypto.subtle.digest(\n\t\t'SHA-256',\n\t\tnew TextEncoder().encode(input)\n\t);\n\tconst binary = String.fromCharCode(...new Uint8Array(bytes));\n\n\treturn btoa(binary)\n\t\t.replace(/\\+/g, '-')\n\t\t.replace(/\\//g, '_')\n\t\t.replace(/=+$/, '');\n};\n\n// Collect every signal we can, hash them, return both so the caller can persist the raw\n// signals (for debugging / drift detection) while sending just the deviceId on the wire.\nexport const collectDeviceFingerprint =\n\tasync (): Promise<DeviceFingerprint> => {\n\t\tif (typeof window === 'undefined' || typeof document === 'undefined') {\n\t\t\tthrow new Error(\n\t\t\t\t'collectDeviceFingerprint must run in a browser — server-side use the @absolutejs/auth fingerprintDevice helper instead'\n\t\t\t);\n\t\t}\n\t\tconst [canvas, audio, webgl, fonts] = await Promise.all([\n\t\t\tPromise.resolve(readCanvas()),\n\t\t\treadAudio(),\n\t\t\tPromise.resolve(readWebgl()),\n\t\t\tPromise.resolve(readFonts())\n\t\t]);\n\n\t\tconst deviceMemory =\n\t\t\t'deviceMemory' in navigator\n\t\t\t\t? Reflect.get(navigator, 'deviceMemory')\n\t\t\t\t: undefined;\n\t\tconst signals: FingerprintSignals = {\n\t\t\taudio,\n\t\t\tcanvas,\n\t\t\tdeviceMemory:\n\t\t\t\ttypeof deviceMemory === 'number' ? deviceMemory : undefined,\n\t\t\tfonts,\n\t\t\thardwareConcurrency: navigator.hardwareConcurrency,\n\t\t\tlanguages: navigator.languages,\n\t\t\tpixelRatio: window.devicePixelRatio,\n\t\t\tplatform: navigator.platform,\n\t\t\tscreen: readScreen(),\n\t\t\ttimezone: readTimezone(),\n\t\t\tuserAgent: navigator.userAgent,\n\t\t\twebgl\n\t\t};\n\n\t\treturn { deviceId: await sha256Base64Url(canonical(signals)), signals };\n\t};\n"
+    "// Browser-side device fingerprint collector.\n//\n// `collectDeviceFingerprint()` reads ~10 signals from the browser (canvas render,\n// AudioContext, WebGL renderer, font enumeration, screen geometry, navigator.languages,\n// timezone, hardware concurrency, device memory, pixel ratio), normalizes them, and\n// hashes the canonical JSON into a stable base64url SHA-256 `deviceId`.\n//\n// Self-hosted equivalent of FingerprintJS's open-source library. Each individual signal\n// is weak on its own — but their combination is highly stable across sessions for the\n// same browser+device, and varies sharply across different browsers/devices. The same\n// algorithms underpin every commercial fingerprinter; only the proprietary data network\n// (cross-customer reputation) is what SaaS vendors charge for, and that's a non-goal here.\n//\n// Imported via `@absolutejs/auth/fingerprint-client` — server bundle does NOT pull this in\n// (browser globals like `window` would explode there). The client SDK + your sign-in form\n// call this, send the result as `x-client-fingerprint`, and the server (riskConfig / adaptive)\n// uses it as the deviceId instead of the weak UA+IP fallback.\n\nconst CANVAS_TEXT = 'absoluteAuth-fp 🔐';\nconst CANVAS_WIDTH = 280;\nconst CANVAS_HEIGHT = 60;\nconst AUDIO_SAMPLES_COUNT = 4500;\nconst AUDIO_OSC_FREQ = 10_000;\nconst AUDIO_COMPRESSOR_THRESHOLD = -50;\nconst AUDIO_COMPRESSOR_KNEE = 40;\nconst AUDIO_COMPRESSOR_RATIO = 12;\nconst AUDIO_COMPRESSOR_ATTACK = 0;\nconst AUDIO_COMPRESSOR_RELEASE = 0.25;\nconst AUDIO_SAMPLE_RATE = 44_100;\nconst FONT_PROBE = 'mmmmmmmmmlli';\nconst FONT_PROBE_PX = '72px';\nconst FONT_PROBE_OFFSCREEN_PX = -9999;\nconst FONT_BASE_FAMILIES = ['monospace', 'sans-serif', 'serif'] as const;\nconst POPULAR_FONTS = [\n\t'Arial',\n\t'Arial Black',\n\t'Comic Sans MS',\n\t'Courier New',\n\t'Georgia',\n\t'Helvetica',\n\t'Impact',\n\t'Lucida Console',\n\t'Times New Roman',\n\t'Trebuchet MS',\n\t'Verdana',\n\t'monospace',\n\t'sans-serif',\n\t'serif'\n];\n\nexport type FingerprintSignals = {\n\taudio?: number;\n\tcanvas?: string;\n\tdeviceMemory?: number;\n\tfonts?: string[];\n\thardwareConcurrency?: number;\n\tlanguages?: readonly string[];\n\tpixelRatio?: number;\n\tplatform?: string;\n\tscreen?: { colorDepth: number; height: number; width: number };\n\ttimezone?: string;\n\tuserAgent?: string;\n\twebgl?: { renderer?: string; vendor?: string };\n};\n\nexport type DeviceFingerprint = {\n\tdeviceId: string;\n\tsignals: FingerprintSignals;\n};\n\n// Canvas hash: render text + a curve + a couple of rectangles + return the data URL\n// (its pixel content hashes differently across GPUs, drivers, browser versions, font\n// renderers). Wrapped in try/catch because privacy-mode browsers throw on getContext.\nconst readCanvas = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tcanvas.width = CANVAS_WIDTH;\n\t\tcanvas.height = CANVAS_HEIGHT;\n\t\tconst context = canvas.getContext('2d');\n\t\tif (context === null) return undefined;\n\t\tcontext.textBaseline = 'top';\n\t\tcontext.font = '14px Arial';\n\t\tcontext.fillStyle = '#f60';\n\t\tcontext.fillRect(125, 1, 62, 20);\n\t\tcontext.fillStyle = '#069';\n\t\tcontext.fillText(CANVAS_TEXT, 2, 15);\n\t\tcontext.fillStyle = 'rgba(102, 204, 0, 0.7)';\n\t\tcontext.fillText(CANVAS_TEXT, 4, 17);\n\n\t\treturn canvas.toDataURL();\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst isOfflineAudioContextCtor = (\n\tvalue: unknown\n): value is typeof OfflineAudioContext => typeof value === 'function';\n\nconst resolveOfflineAudioContextCtor = () => {\n\tif (typeof OfflineAudioContext !== 'undefined') return OfflineAudioContext;\n\tconst legacy: unknown = Reflect.get(\n\t\tglobalThis,\n\t\t'webkitOfflineAudioContext'\n\t);\n\n\treturn isOfflineAudioContextCtor(legacy) ? legacy : undefined;\n};\n\nconst sumAbs = (samples: Float32Array) => {\n\tlet total = 0;\n\tfor (const sample of samples) total += Math.abs(sample);\n\n\treturn total;\n};\n\n// Audio hash: instantiate an offline audio context, push a brief oscillator + dynamics\n// compressor through it, read back the rendered buffer's sum. Different audio stacks\n// produce subtly different floating-point outputs.\nconst readAudio = async () => {\n\ttry {\n\t\tconst ContextCtor = resolveOfflineAudioContextCtor();\n\t\tif (ContextCtor === undefined) return undefined;\n\t\tconst context = new ContextCtor(\n\t\t\t1,\n\t\t\tAUDIO_SAMPLES_COUNT,\n\t\t\tAUDIO_SAMPLE_RATE\n\t\t);\n\t\tconst oscillator = context.createOscillator();\n\t\toscillator.type = 'triangle';\n\t\toscillator.frequency.value = AUDIO_OSC_FREQ;\n\t\tconst compressor = context.createDynamicsCompressor();\n\t\tcompressor.threshold.value = AUDIO_COMPRESSOR_THRESHOLD;\n\t\tcompressor.knee.value = AUDIO_COMPRESSOR_KNEE;\n\t\tcompressor.ratio.value = AUDIO_COMPRESSOR_RATIO;\n\t\t// `reduction` is read-only on the modern spec (the constant exists for the\n\t\t// outdated browsers that originally exposed it as a writable AudioParam;\n\t\t// we don't bother setting it — the fingerprint is plenty stable without).\n\t\tcompressor.attack.value = AUDIO_COMPRESSOR_ATTACK;\n\t\tcompressor.release.value = AUDIO_COMPRESSOR_RELEASE;\n\t\toscillator.connect(compressor);\n\t\tcompressor.connect(context.destination);\n\t\toscillator.start(0);\n\t\tconst buffer = await context.startRendering();\n\n\t\treturn sumAbs(buffer.getChannelData(0));\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// WebGL hash: the renderer + vendor strings include GPU model + driver — highly stable,\n// highly distinctive. Behind the WEBGL_debug_renderer_info extension on most browsers.\nconst readWebgl = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tconst context =\n\t\t\tcanvas.getContext('webgl') ??\n\t\t\tcanvas.getContext('experimental-webgl');\n\t\tif (\n\t\t\tcontext === null ||\n\t\t\t!('getExtension' in context) ||\n\t\t\t!('getParameter' in context)\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst debug = context.getExtension('WEBGL_debug_renderer_info');\n\t\tif (debug === null) return undefined;\n\n\t\treturn {\n\t\t\trenderer: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_RENDERER_WEBGL) ?? ''\n\t\t\t),\n\t\t\tvendor: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_VENDOR_WEBGL) ?? ''\n\t\t\t)\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Width of `probe` rendered in `family` on the given span — used to detect installed\n// fonts (different widths than the fallback ⇒ font is present).\nconst measureFamily = (span: HTMLSpanElement, family: string) => {\n\tspan.style.fontFamily = family;\n\n\treturn span.offsetWidth;\n};\n\nconst detectFontPresent = (\n\tspan: HTMLSpanElement,\n\tfont: string,\n\tbaseline: Record<string, number>\n) =>\n\tFONT_BASE_FAMILIES.some(\n\t\t(family) =>\n\t\t\tmeasureFamily(span, `'${font}', ${family}`) !== baseline[family]\n\t);\n\n// Font enumeration: a font is \"installed\" if the rendered width of a probe string differs\n// from the same string in a known fallback. Compares against monospace + sans-serif +\n// serif and counts a match if any of them produce a different width.\nconst readFonts = () => {\n\ttry {\n\t\tconst span = document.createElement('span');\n\t\tspan.style.position = 'absolute';\n\t\tspan.style.left = `${FONT_PROBE_OFFSCREEN_PX}px`;\n\t\tspan.style.fontSize = FONT_PROBE_PX;\n\t\tspan.textContent = FONT_PROBE;\n\t\tdocument.body.appendChild(span);\n\n\t\tconst baseline: Record<string, number> = Object.fromEntries(\n\t\t\tFONT_BASE_FAMILIES.map((family) => [\n\t\t\t\tfamily,\n\t\t\t\tmeasureFamily(span, family)\n\t\t\t])\n\t\t);\n\t\tconst present = POPULAR_FONTS.filter((font) =>\n\t\t\tdetectFontPresent(span, font, baseline)\n\t\t);\n\n\t\tdocument.body.removeChild(span);\n\n\t\treturn present;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst readScreen = () => {\n\tif (typeof screen === 'undefined') return undefined;\n\n\treturn {\n\t\tcolorDepth: screen.colorDepth,\n\t\theight: screen.height,\n\t\twidth: screen.width\n\t};\n};\n\nconst readTimezone = () => {\n\ttry {\n\t\treturn Intl.DateTimeFormat().resolvedOptions().timeZone;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Canonical JSON identical to the server-side `fingerprintDevice` canonicalizer: keys\n// sorted at every depth so identical signals produce identical hashes regardless of\n// insertion order. Inlined here to keep the client bundle free of server-side imports.\nconst canonical = (signals: FingerprintSignals) =>\n\tJSON.stringify(signals, (_key, value) =>\n\t\tvalue === null || typeof value !== 'object' || Array.isArray(value)\n\t\t\t? value\n\t\t\t: Object.fromEntries(\n\t\t\t\t\tObject.entries(value).sort((left, right) =>\n\t\t\t\t\t\tleft[0].localeCompare(right[0])\n\t\t\t\t\t)\n\t\t\t\t)\n\t);\n\nconst sha256Base64Url = async (input: string) => {\n\tconst bytes = await crypto.subtle.digest(\n\t\t'SHA-256',\n\t\tnew TextEncoder().encode(input)\n\t);\n\tconst binary = String.fromCharCode(...new Uint8Array(bytes));\n\n\treturn btoa(binary)\n\t\t.replace(/\\+/g, '-')\n\t\t.replace(/\\//g, '_')\n\t\t.replace(/=+$/, '');\n};\n\n// Collect every signal we can, hash them, return both so the caller can persist the raw\n// signals (for debugging / drift detection) while sending just the deviceId on the wire.\nexport const collectDeviceFingerprint =\n\tasync (): Promise<DeviceFingerprint> => {\n\t\tif (typeof window === 'undefined' || typeof document === 'undefined') {\n\t\t\tthrow new Error(\n\t\t\t\t'collectDeviceFingerprint must run in a browser — server-side use the @absolutejs/auth fingerprintDevice helper instead'\n\t\t\t);\n\t\t}\n\t\tconst [canvas, audio, webgl, fonts] = await Promise.all([\n\t\t\tPromise.resolve(readCanvas()),\n\t\t\treadAudio(),\n\t\t\tPromise.resolve(readWebgl()),\n\t\t\tPromise.resolve(readFonts())\n\t\t]);\n\n\t\tconst deviceMemory =\n\t\t\t'deviceMemory' in navigator\n\t\t\t\t? Reflect.get(navigator, 'deviceMemory')\n\t\t\t\t: undefined;\n\t\tconst signals: FingerprintSignals = {\n\t\t\taudio,\n\t\t\tcanvas,\n\t\t\tdeviceMemory:\n\t\t\t\ttypeof deviceMemory === 'number' ? deviceMemory : undefined,\n\t\t\tfonts,\n\t\t\thardwareConcurrency: navigator.hardwareConcurrency,\n\t\t\tlanguages: navigator.languages,\n\t\t\tpixelRatio: window.devicePixelRatio,\n\t\t\tplatform: navigator.platform,\n\t\t\tscreen: readScreen(),\n\t\t\ttimezone: readTimezone(),\n\t\t\tuserAgent: navigator.userAgent,\n\t\t\twebgl\n\t\t};\n\n\t\treturn { deviceId: await sha256Base64Url(canonical(signals)), signals };\n\t};\n"
   ],
-  "mappings": ";AAkBA,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,6BAA6B;AACnC,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAC/B,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,0BAA0B;AAChC,IAAM,qBAAqB,CAAC,aAAa,cAAc,OAAO;AAC9D,IAAM,gBAAgB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAyBA,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,MAAM,UAAU,OAAO,WAAW,IAAI;AAAA,IACtC,IAAI,YAAY;AAAA,MAAM;AAAA,IACtB,QAAQ,eAAe;AAAA,IACvB,QAAQ,OAAO;AAAA,IACf,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,KAAK,GAAG,IAAI,EAAE;AAAA,IAC/B,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IACnC,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IAEnC,OAAO,OAAO,UAAU;AAAA,IACvB,MAAM;AAAA,IACP;AAAA;AAAA;AAQF,IAAM,iCAAiC,MAAM;AAAA,EAC5C,IAAI,OAAO,wBAAwB;AAAA,IAAa,OAAO;AAAA,EAEvD,MAAM,SAAS;AAAA,EAEf,OAAO,OAAO;AAAA;AAGf,IAAM,SAAS,CAAC,YAA0B;AAAA,EACzC,IAAI,QAAQ;AAAA,EACZ,WAAW,UAAU;AAAA,IAAS,SAAS,KAAK,IAAI,MAAM;AAAA,EAEtD,OAAO;AAAA;AAMR,IAAM,YAAY,YAAY;AAAA,EAC7B,IAAI;AAAA,IACH,MAAM,cAAc,+BAA+B;AAAA,IACnD,IAAI,gBAAgB;AAAA,MAAW;AAAA,IAC/B,MAAM,UAAU,IAAI,YACnB,GACA,qBACA,iBACD;AAAA,IACA,MAAM,aAAa,QAAQ,iBAAiB;AAAA,IAC5C,WAAW,OAAO;AAAA,IAClB,WAAW,UAAU,QAAQ;AAAA,IAC7B,MAAM,aAAa,QAAQ,yBAAyB;AAAA,IACpD,WAAW,UAAU,QAAQ;AAAA,IAC7B,WAAW,KAAK,QAAQ;AAAA,IACxB,WAAW,MAAM,QAAQ;AAAA,IAIzB,WAAW,OAAO,QAAQ;AAAA,IAC1B,WAAW,QAAQ,QAAQ;AAAA,IAC3B,WAAW,QAAQ,UAAU;AAAA,IAC7B,WAAW,QAAQ,QAAQ,WAAW;AAAA,IACtC,WAAW,MAAM,CAAC;AAAA,IAClB,MAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,IAE5C,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC;AAAA,IACrC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,MAAM,UACL,OAAO,WAAW,OAAO,KACzB,OAAO,WAAW,oBAAoB;AAAA,IACvC,IACC,YAAY,QACZ,EAAE,kBAAkB,YACpB,EAAE,kBAAkB,UACnB;AAAA,MACD;AAAA,IACD;AAAA,IACA,MAAM,QAAQ,QAAQ,aAAa,2BAA2B;AAAA,IAC9D,IAAI,UAAU;AAAA,MAAM;AAAA,IAEpB,OAAO;AAAA,MACN,UAAU,OACT,QAAQ,aAAa,MAAM,uBAAuB,KAAK,EACxD;AAAA,MACA,QAAQ,OACP,QAAQ,aAAa,MAAM,qBAAqB,KAAK,EACtD;AAAA,IACD;AAAA,IACC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,gBAAgB,CAAC,MAAuB,WAAmB;AAAA,EAChE,KAAK,MAAM,aAAa;AAAA,EAExB,OAAO,KAAK;AAAA;AAGb,IAAM,oBAAoB,CACzB,MACA,MACA,aAEA,mBAAmB,KAClB,CAAC,WACA,cAAc,MAAM,IAAI,UAAU,QAAQ,MAAM,SAAS,OAC3D;AAKD,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,OAAO,SAAS,cAAc,MAAM;AAAA,IAC1C,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,MAAM,OAAO,GAAG;AAAA,IACrB,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,cAAc;AAAA,IACnB,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,MAAM,WAAmC,OAAO,YAC/C,mBAAmB,IAAI,CAAC,WAAW;AAAA,MAClC;AAAA,MACA,cAAc,MAAM,MAAM;AAAA,IAC3B,CAAC,CACF;AAAA,IACA,MAAM,UAAU,cAAc,OAAO,CAAC,SACrC,kBAAkB,MAAM,MAAM,QAAQ,CACvC;AAAA,IAEA,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,OAAO;AAAA,IACN,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI,OAAO,WAAW;AAAA,IAAa;AAAA,EAEnC,OAAO;AAAA,IACN,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO;AAAA,EACf;AAAA;AAGD,IAAM,eAAe,MAAM;AAAA,EAC1B,IAAI;AAAA,IACH,OAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE;AAAA,IAC9C,MAAM;AAAA,IACP;AAAA;AAAA;AAOF,IAAM,YAAY,CAAC,YAClB,KAAK,UAAU,SAAS,CAAC,MAAM,UAC9B,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,IAC/D,QACA,OAAO,YACP,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,MAAM,UACjC,KAAK,GAAG,cAAc,MAAM,EAAE,CAC/B,CACD,CACH;AAED,IAAM,kBAAkB,OAAO,UAAkB;AAAA,EAChD,MAAM,QAAQ,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,EAAE,OAAO,KAAK,CAC/B;AAAA,EACA,MAAM,SAAS,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC;AAAA,EAE3D,OAAO,KAAK,MAAM,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAAA;AAKb,IAAM,2BACZ,YAAwC;AAAA,EACvC,IAAI,OAAO,WAAW,eAAe,OAAO,aAAa,aAAa;AAAA,IACrE,MAAM,IAAI,MACT,wHACD;AAAA,EACD;AAAA,EACA,OAAO,QAAQ,OAAO,OAAO,SAAS,MAAM,QAAQ,IAAI;AAAA,IACvD,QAAQ,QAAQ,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC3B,QAAQ,QAAQ,UAAU,CAAC;AAAA,EAC5B,CAAC;AAAA,EAED,MAAM,eACL,kBAAkB,YACf,QAAQ,IAAI,WAAW,cAAc,IACrC;AAAA,EACJ,MAAM,UAA8B;AAAA,IACnC;AAAA,IACA;AAAA,IACA,cACC,OAAO,iBAAiB,WAAW,eAAe;AAAA,IACnD;AAAA,IACA,qBAAqB,UAAU;AAAA,IAC/B,WAAW,UAAU;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,UAAU,aAAa;AAAA,IACvB,WAAW,UAAU;AAAA,IACrB;AAAA,EACD;AAAA,EAEA,OAAO,EAAE,UAAU,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,QAAQ;AAAA;",
-  "debugId": "58DA2A773086368664756E2164756E21",
+  "mappings": ";AAkBA,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,6BAA6B;AACnC,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAC/B,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,0BAA0B;AAChC,IAAM,qBAAqB,CAAC,aAAa,cAAc,OAAO;AAC9D,IAAM,gBAAgB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAyBA,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,MAAM,UAAU,OAAO,WAAW,IAAI;AAAA,IACtC,IAAI,YAAY;AAAA,MAAM;AAAA,IACtB,QAAQ,eAAe;AAAA,IACvB,QAAQ,OAAO;AAAA,IACf,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,KAAK,GAAG,IAAI,EAAE;AAAA,IAC/B,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IACnC,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IAEnC,OAAO,OAAO,UAAU;AAAA,IACvB,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,4BAA4B,CACjC,UACyC,OAAO,UAAU;AAE3D,IAAM,iCAAiC,MAAM;AAAA,EAC5C,IAAI,OAAO,wBAAwB;AAAA,IAAa,OAAO;AAAA,EACvD,MAAM,SAAkB,QAAQ,IAC/B,YACA,2BACD;AAAA,EAEA,OAAO,0BAA0B,MAAM,IAAI,SAAS;AAAA;AAGrD,IAAM,SAAS,CAAC,YAA0B;AAAA,EACzC,IAAI,QAAQ;AAAA,EACZ,WAAW,UAAU;AAAA,IAAS,SAAS,KAAK,IAAI,MAAM;AAAA,EAEtD,OAAO;AAAA;AAMR,IAAM,YAAY,YAAY;AAAA,EAC7B,IAAI;AAAA,IACH,MAAM,cAAc,+BAA+B;AAAA,IACnD,IAAI,gBAAgB;AAAA,MAAW;AAAA,IAC/B,MAAM,UAAU,IAAI,YACnB,GACA,qBACA,iBACD;AAAA,IACA,MAAM,aAAa,QAAQ,iBAAiB;AAAA,IAC5C,WAAW,OAAO;AAAA,IAClB,WAAW,UAAU,QAAQ;AAAA,IAC7B,MAAM,aAAa,QAAQ,yBAAyB;AAAA,IACpD,WAAW,UAAU,QAAQ;AAAA,IAC7B,WAAW,KAAK,QAAQ;AAAA,IACxB,WAAW,MAAM,QAAQ;AAAA,IAIzB,WAAW,OAAO,QAAQ;AAAA,IAC1B,WAAW,QAAQ,QAAQ;AAAA,IAC3B,WAAW,QAAQ,UAAU;AAAA,IAC7B,WAAW,QAAQ,QAAQ,WAAW;AAAA,IACtC,WAAW,MAAM,CAAC;AAAA,IAClB,MAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,IAE5C,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC;AAAA,IACrC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,MAAM,UACL,OAAO,WAAW,OAAO,KACzB,OAAO,WAAW,oBAAoB;AAAA,IACvC,IACC,YAAY,QACZ,EAAE,kBAAkB,YACpB,EAAE,kBAAkB,UACnB;AAAA,MACD;AAAA,IACD;AAAA,IACA,MAAM,QAAQ,QAAQ,aAAa,2BAA2B;AAAA,IAC9D,IAAI,UAAU;AAAA,MAAM;AAAA,IAEpB,OAAO;AAAA,MACN,UAAU,OACT,QAAQ,aAAa,MAAM,uBAAuB,KAAK,EACxD;AAAA,MACA,QAAQ,OACP,QAAQ,aAAa,MAAM,qBAAqB,KAAK,EACtD;AAAA,IACD;AAAA,IACC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,gBAAgB,CAAC,MAAuB,WAAmB;AAAA,EAChE,KAAK,MAAM,aAAa;AAAA,EAExB,OAAO,KAAK;AAAA;AAGb,IAAM,oBAAoB,CACzB,MACA,MACA,aAEA,mBAAmB,KAClB,CAAC,WACA,cAAc,MAAM,IAAI,UAAU,QAAQ,MAAM,SAAS,OAC3D;AAKD,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,OAAO,SAAS,cAAc,MAAM;AAAA,IAC1C,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,MAAM,OAAO,GAAG;AAAA,IACrB,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,cAAc;AAAA,IACnB,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,MAAM,WAAmC,OAAO,YAC/C,mBAAmB,IAAI,CAAC,WAAW;AAAA,MAClC;AAAA,MACA,cAAc,MAAM,MAAM;AAAA,IAC3B,CAAC,CACF;AAAA,IACA,MAAM,UAAU,cAAc,OAAO,CAAC,SACrC,kBAAkB,MAAM,MAAM,QAAQ,CACvC;AAAA,IAEA,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,OAAO;AAAA,IACN,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI,OAAO,WAAW;AAAA,IAAa;AAAA,EAEnC,OAAO;AAAA,IACN,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO;AAAA,EACf;AAAA;AAGD,IAAM,eAAe,MAAM;AAAA,EAC1B,IAAI;AAAA,IACH,OAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE;AAAA,IAC9C,MAAM;AAAA,IACP;AAAA;AAAA;AAOF,IAAM,YAAY,CAAC,YAClB,KAAK,UAAU,SAAS,CAAC,MAAM,UAC9B,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,IAC/D,QACA,OAAO,YACP,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,MAAM,UACjC,KAAK,GAAG,cAAc,MAAM,EAAE,CAC/B,CACD,CACH;AAED,IAAM,kBAAkB,OAAO,UAAkB;AAAA,EAChD,MAAM,QAAQ,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,EAAE,OAAO,KAAK,CAC/B;AAAA,EACA,MAAM,SAAS,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC;AAAA,EAE3D,OAAO,KAAK,MAAM,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAAA;AAKb,IAAM,2BACZ,YAAwC;AAAA,EACvC,IAAI,OAAO,WAAW,eAAe,OAAO,aAAa,aAAa;AAAA,IACrE,MAAM,IAAI,MACT,wHACD;AAAA,EACD;AAAA,EACA,OAAO,QAAQ,OAAO,OAAO,SAAS,MAAM,QAAQ,IAAI;AAAA,IACvD,QAAQ,QAAQ,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC3B,QAAQ,QAAQ,UAAU,CAAC;AAAA,EAC5B,CAAC;AAAA,EAED,MAAM,eACL,kBAAkB,YACf,QAAQ,IAAI,WAAW,cAAc,IACrC;AAAA,EACJ,MAAM,UAA8B;AAAA,IACnC;AAAA,IACA;AAAA,IACA,cACC,OAAO,iBAAiB,WAAW,eAAe;AAAA,IACnD;AAAA,IACA,qBAAqB,UAAU;AAAA,IAC/B,WAAW,UAAU;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,UAAU,aAAa;AAAA,IACvB,WAAW,UAAU;AAAA,IACrB;AAAA,EACD;AAAA,EAEA,OAAO,EAAE,UAAU,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,QAAQ;AAAA;",
+  "debugId": "5AAB5F70FF6848B464756E2164756E21",
   "names": []
 }

package/dist/index.d.ts

@@ -563,7 +563,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                 query: unknown;
                 headers: unknown;
                 response: {
-                    [x: string]: any;
+                    [x: number]: {};
                 };
             };
         };
@@ -745,7 +745,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                 query: unknown;
                 headers: unknown;
                 response: {
-                    [x: string]: any;
+                    [x: number]: {};
                 };
             };
         };
@@ -3434,7 +3434,7 @@ export { createInMemoryVaultStore } from './vault/inMemoryVaultStore';
 export { createNeonVaultStore, createPostgresVaultStore, vaultEntriesTable } from './vault/postgresVaultStore';
 export { createFederatedTokenStore, getOrRefreshFederatedTokens } from './federation/tokenStore';
 export type { FederatedTokenRefresher, FederatedTokenSet, FederatedTokenStore } from './federation/tokenStore';
-export type { AuthSessionStore } from './session/types';
+export { decodeSessionUserRecord, type AuthSessionStore, type SessionUserDecoder } from './session/types';
 export { isAuthIntent, isUserSessionId, isValidUser } from './typeGuards';
 export { AuthIdentityConflictError } from './errors';
 export { sessionStore } from './session/state';