@aientrophy/sdk 0.2.1 → 0.3.0

package/dist/npm/index.es.js

@@ -7,33 +7,100 @@ const CONFIG = {
   RSA_PUBLIC_KEY: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqbBCvDqyUtfhgI/Lo5pDtn1phwA6qczAyp8N1ZgQ68OTxgbJUGiXV6N67p15bBdME1R4va51P2Czq2IbRby/N+GHTciTaXvmusV8IjnIOGtKlGxWCuKIPrCS+rGjGA2j1irxBbNpqItltFxjhxBGOzsyQAF6LNIz5IKA7sC6cSH8zUyLuFrV96udc801Zc4nCJG64ZljNbDvlVbJJZ6ex5OLLS6AnrVAXpjEDR/MI/I8JvAPe/psHj6EpXgvKrBYMBOH3jzQRzMFoR79jXyGNgPjdy0A+f6RVuEG8H5sUXKeyy+cFvaT+pm6h+t6RPED11tCOwQxYZ2pExhhPxDGeQIDAQAB"
 };
 class CryptoUtils {
-  // Base64
+  // 2 = ECDH, 1 = RSA
   /**
-   * Initialize session key if not exists
+   * Initialize session key using ECDH + HKDF (PFS) or RSA fallback.
    */
   static async init() {
     if (this.sessionKey) return;
-    this.sessionKey = await window.crypto.subtle.generateKey(
+    try {
+      await this.initECDH();
+    } catch (e) {
+      await this.initRSA();
+    }
+  }
+  /**
+   * ECDH + HKDF key exchange — provides Perfect Forward Secrecy.
+   *
+   * 1. Generate ephemeral ECDH key pair (P-256)
+   * 2. Fetch server's ephemeral ECDH public key from /key-exchange
+   * 3. Derive shared secret via ECDH
+   * 4. Derive AES-256-GCM key via HKDF-SHA256
+   */
+  static async initECDH() {
+    const keyPair = await window.crypto.subtle.generateKey(
+      { name: "ECDH", namedCurve: "P-256" },
+      true,
+      ["deriveBits"]
+    );
+    const clientPubRaw = await window.crypto.subtle.exportKey("raw", keyPair.publicKey);
+    this.ecdhPublicKeyBase64 = this.arrayBufferToBase64(clientPubRaw);
+    const endpoint = window.__securitySDKEndpoint || "";
+    const baseUrl = endpoint.replace(/\/events$/, "");
+    const res = await fetch(`${baseUrl}/key-exchange`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientPublicKey: this.ecdhPublicKeyBase64 })
+    });
+    if (!res.ok) throw new Error("Key exchange failed");
+    const { serverPublicKey, salt } = await res.json();
+    const serverPubBytes = this.base64ToArrayBuffer(serverPublicKey);
+    const serverPubKey = await window.crypto.subtle.importKey(
+      "raw",
+      serverPubBytes,
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      []
+    );
+    const sharedBits = await window.crypto.subtle.deriveBits(
+      { name: "ECDH", public: serverPubKey },
+      keyPair.privateKey,
+      256
+    );
+    const hkdfKey = await window.crypto.subtle.importKey(
+      "raw",
+      sharedBits,
+      "HKDF",
+      false,
+      ["deriveKey"]
+    );
+    const saltBytes = this.base64ToArrayBuffer(salt);
+    this.sessionKey = await window.crypto.subtle.deriveKey(
       {
-        name: "AES-GCM",
-        length: 256
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: saltBytes,
+        info: new TextEncoder().encode("aientrophy-session-enc")
       },
+      hkdfKey,
+      { name: "AES-GCM", length: 256 },
       true,
       ["encrypt", "decrypt"]
     );
-    const publicKey = await this.importPublicKey(CONFIG.RSA_PUBLIC_KEY);
+    this.protocolVersion = 2;
+  }
+  /**
+   * RSA-OAEP key exchange (legacy fallback, no PFS).
+   */
+  static async initRSA() {
+    this.sessionKey = await window.crypto.subtle.generateKey(
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    const publicKey = await this.importRSAPublicKey(CONFIG.RSA_PUBLIC_KEY);
     const rawSessionKey = await window.crypto.subtle.exportKey("raw", this.sessionKey);
     const encryptedKeyBuffer = await window.crypto.subtle.encrypt(
-      {
-        name: "RSA-OAEP"
-      },
+      { name: "RSA-OAEP" },
       publicKey,
       rawSessionKey
     );
     this.encryptedSessionKey = this.arrayBufferToBase64(encryptedKeyBuffer);
+    this.protocolVersion = 1;
   }
   /**
-   * Encrypt Payload using AES-GCM
+   * Encrypt Payload using AES-GCM.
+   * Returns envelope with version indicator for server-side dispatch.
    */
   static async encrypt(data) {
     if (!this.sessionKey) await this.init();
@@ -41,10 +108,7 @@ class CryptoUtils {
     const encodedData = new TextEncoder().encode(jsonString);
     const iv = window.crypto.getRandomValues(new Uint8Array(12));
     const encryptedBuffer = await window.crypto.subtle.encrypt(
-      {
-        name: "AES-GCM",
-        iv
-      },
+      { name: "AES-GCM", iv },
       this.sessionKey,
       encodedData
     );
@@ -52,12 +116,16 @@ class CryptoUtils {
     const tagLength = 16;
     const ciphertext = encryptedBytes.slice(0, encryptedBytes.length - tagLength);
     const tag = encryptedBytes.slice(encryptedBytes.length - tagLength);
-    return {
-      ek: this.encryptedSessionKey,
+    const envelope = {
+      ek: this.protocolVersion === 2 ? this.ecdhPublicKeyBase64 : this.encryptedSessionKey,
       d: this.arrayBufferToBase64(ciphertext.buffer),
       iv: this.arrayBufferToBase64(iv.buffer),
       tag: this.arrayBufferToBase64(tag.buffer)
     };
+    if (this.protocolVersion === 2) {
+      envelope.v = 2;
+    }
+    return envelope;
   }
   /**
    * Decrypt Response using AES-GCM
@@ -71,26 +139,27 @@ class CryptoUtils {
     combinedBuffer.set(new Uint8Array(ciphertext), 0);
     combinedBuffer.set(new Uint8Array(tag), ciphertext.byteLength);
     const decryptedBuffer = await window.crypto.subtle.decrypt(
-      {
-        name: "AES-GCM",
-        iv
-      },
+      { name: "AES-GCM", iv },
       this.sessionKey,
       combinedBuffer
     );
     const decodedString = new TextDecoder().decode(decryptedBuffer);
     return JSON.parse(decodedString);
   }
-  static async importPublicKey(pemContent) {
+  /**
+   * Store the endpoint URL for ECDH key exchange.
+   * Called from Transmitter.setConfig().
+   */
+  static setEndpoint(endpoint) {
+    window.__securitySDKEndpoint = endpoint;
+  }
+  static async importRSAPublicKey(pemContent) {
     const binaryDerString = window.atob(pemContent);
     const binaryDer = this.str2ab(binaryDerString);
     return await window.crypto.subtle.importKey(
       "spki",
       binaryDer,
-      {
-        name: "RSA-OAEP",
-        hash: "SHA-256"
-      },
+      { name: "RSA-OAEP", hash: "SHA-256" },
       true,
       ["encrypt"]
     );
@@ -123,7 +192,10 @@ class CryptoUtils {
   }
 }
 __publicField(CryptoUtils, "sessionKey", null);
+__publicField(CryptoUtils, "ecdhPublicKeyBase64", null);
 __publicField(CryptoUtils, "encryptedSessionKey", null);
+// RSA fallback
+__publicField(CryptoUtils, "protocolVersion", 2);
 const THREAT_EVENTS = /* @__PURE__ */ new Set([
   "rapid_click",
   "honeypot_triggered",
@@ -136,7 +208,10 @@ const THREAT_EVENTS = /* @__PURE__ */ new Set([
   "input_metrics",
   "keystroke_dynamics",
   "environmental_integrity",
-  "init_signals"
+  "init_signals",
+  "automation_detected",
+  "cross_context_mismatch",
+  "headless_probe"
 ]);
 class CallbackManager {
   constructor() {
@@ -256,13 +331,16 @@ class Transmitter {
     __publicField(this, "encryptionRequired", false);
     __publicField(this, "currentNonce", "");
     __publicField(this, "buffer", []);
-    __publicField(this, "batchSize", 10);
-    __publicField(this, "flushInterval", 3e3);
+    __publicField(this, "batchSize", 20);
+    __publicField(this, "flushInterval", 5e3);
     __publicField(this, "intervalId");
     __publicField(this, "responseHandler", null);
     __publicField(this, "callbackManager", null);
     __publicField(this, "flushing", false);
     __publicField(this, "pendingFlush", false);
+    __publicField(this, "backoffMs", 0);
+    __publicField(this, "maxBackoffMs", 6e4);
+    __publicField(this, "_lastBackoffStart", 0);
     this.startFlushInterval();
   }
   setConfig(config) {
@@ -271,6 +349,7 @@ class Transmitter {
     this.clientKey = config.clientKey;
     this.encryptionRequired = ((_a = config.serverConfig) == null ? void 0 : _a.encryptionRequired) ?? false;
     this.currentNonce = ((_b = config.serverConfig) == null ? void 0 : _b.initialNonce) ?? "";
+    CryptoUtils.setEndpoint(config.endpoint);
   }
   setResponseHandler(handler) {
     this.responseHandler = handler;
@@ -295,6 +374,12 @@ class Transmitter {
   }
   async flush() {
     if (this.buffer.length === 0 || !this.endpoint) return;
+    if (this.backoffMs > 0) {
+      const now = Date.now();
+      if (!this._lastBackoffStart) this._lastBackoffStart = now;
+      if (now - this._lastBackoffStart < this.backoffMs) return;
+      this._lastBackoffStart = 0;
+    }
     if (this.flushing) {
       this.pendingFlush = true;
       return;
@@ -325,6 +410,13 @@ class Transmitter {
           headers: requestHeaders,
           keepalive: true
         });
+        if (res.status === 429) {
+          this.buffer = rawPayload.concat(this.buffer).slice(0, 500);
+          this.backoffMs = this.backoffMs === 0 ? 5e3 : Math.min(this.backoffMs * 2, this.maxBackoffMs);
+          this._lastBackoffStart = Date.now();
+          return;
+        }
+        this.backoffMs = 0;
         if (res.ok && this.callbackManager) {
           this.callbackManager.emit("allow", { action: "allow" });
         }
@@ -380,149 +472,19 @@ class Transmitter {
     }, this.flushInterval);
   }
 }
-class EventCollector {
-  constructor(transmitter) {
-    __publicField(this, "transmitter");
-    __publicField(this, "listeners", {});
-    this.transmitter = transmitter;
-  }
-  start() {
-    this.attachListeners();
-  }
-  stop() {
-    this.detachListeners();
-  }
-  attachListeners() {
-    this.listeners["mousemove"] = this.throttle((e) => {
-      const mouseEvent = e;
-      this.transmitter.send("mousemove", {
-        x: mouseEvent.clientX,
-        y: mouseEvent.clientY,
-        timestamp: Date.now()
-      });
-    }, 100);
-    this.listeners["click"] = (e) => {
-      const mouseEvent = e;
-      this.transmitter.send("click", {
-        x: mouseEvent.clientX,
-        y: mouseEvent.clientY,
-        target: mouseEvent.target.tagName,
-        timestamp: Date.now()
-      });
-    };
-    this.listeners["keydown"] = (e) => {
-      const keyEvent = e;
-      this.transmitter.send("keydown", {
-        key: keyEvent.key,
-        timestamp: Date.now()
-      });
-    };
-    window.addEventListener("mousemove", this.listeners["mousemove"]);
-    window.addEventListener("click", this.listeners["click"]);
-    window.addEventListener("keydown", this.listeners["keydown"]);
-  }
-  detachListeners() {
-    if (this.listeners["mousemove"]) {
-      window.removeEventListener("mousemove", this.listeners["mousemove"]);
-    }
-    if (this.listeners["click"]) {
-      window.removeEventListener("click", this.listeners["click"]);
-    }
-    if (this.listeners["keydown"]) {
-      window.removeEventListener("keydown", this.listeners["keydown"]);
-    }
-  }
-  throttle(func, limit) {
-    let inThrottle;
-    return function(...args) {
-      if (!inThrottle) {
-        func.apply(this, args);
-        inThrottle = true;
-        setTimeout(() => inThrottle = false, limit);
-      }
-    };
-  }
-}
 class BehaviorCollector {
   constructor(transmitter) {
+    // @ts-ignore kept for future extension (mouse/keyboard-외 행동 수집)
     __publicField(this, "transmitter");
-    __publicField(this, "trajectoryBuffer", []);
-    __publicField(this, "keystrokeBuffer", []);
     __publicField(this, "isCollecting", false);
-    __publicField(this, "flushInterval", 3e3);
-    // Send batch every 3 seconds
-    __publicField(this, "flushTimer");
-    __publicField(this, "lastMouseMoveTime", 0);
-    __publicField(this, "onMouseMove", (e) => {
-      const now = Date.now();
-      if (now - this.lastMouseMoveTime > 50) {
-        this.trajectoryBuffer.push({
-          x: e.clientX,
-          y: e.clientY,
-          t: now
-        });
-        this.lastMouseMoveTime = now;
-      }
-    });
-    __publicField(this, "onKeyDown", (e) => {
-      this.keystrokeBuffer.push({
-        code: e.code,
-        t: Date.now(),
-        type: "down"
-      });
-    });
-    __publicField(this, "onKeyUp", (e) => {
-      this.keystrokeBuffer.push({
-        code: e.code,
-        t: Date.now(),
-        type: "up"
-      });
-    });
     this.transmitter = transmitter;
   }
   start() {
     if (this.isCollecting) return;
     this.isCollecting = true;
-    this.attachListeners();
-    this.startFlushTimer();
   }
   stop() {
     this.isCollecting = false;
-    this.detachListeners();
-    this.stopFlushTimer();
-    this.flush();
-  }
-  attachListeners() {
-    window.addEventListener("mousemove", this.onMouseMove);
-    window.addEventListener("keydown", this.onKeyDown);
-    window.addEventListener("keyup", this.onKeyUp);
-  }
-  detachListeners() {
-    window.removeEventListener("mousemove", this.onMouseMove);
-    window.removeEventListener("keydown", this.onKeyDown);
-    window.removeEventListener("keyup", this.onKeyUp);
-  }
-  startFlushTimer() {
-    this.flushTimer = setInterval(() => {
-      this.flush();
-    }, this.flushInterval);
-  }
-  stopFlushTimer() {
-    if (this.flushTimer) {
-      clearInterval(this.flushTimer);
-      this.flushTimer = null;
-    }
-  }
-  flush() {
-    if (this.trajectoryBuffer.length === 0 && this.keystrokeBuffer.length === 0) return;
-    const data = {
-      trajectory: [...this.trajectoryBuffer],
-      keystrokes: [...this.keystrokeBuffer],
-      url: window.location.href
-    };
-    this.trajectoryBuffer = [];
-    this.keystrokeBuffer = [];
-    this.transmitter.send("behavior_data", data);
   }
 }
 class RapidClickDetector {
@@ -617,10 +579,14 @@ class MouseTracker {
     __publicField(this, "transmitter");
     __publicField(this, "wasmService");
     __publicField(this, "buffer", []);
-    __publicField(this, "BUFFER_SIZE", 10);
-    __publicField(this, "SAMPLE_INTERVAL", 50);
-    // ms
+    __publicField(this, "BUFFER_SIZE", 50);
+    // 50 points for accurate entropy (was 10)
+    __publicField(this, "SAMPLE_INTERVAL", 100);
+    // 100ms between samples (was 50)
+    __publicField(this, "SEND_COOLDOWN", 5e3);
+    // 5s between server transmissions
     __publicField(this, "lastSampleTime", 0);
+    __publicField(this, "lastSendTime", 0);
     __publicField(this, "handleMouseMove", (e) => {
       const now = Date.now();
       if (now - this.lastSampleTime < this.SAMPLE_INTERVAL) return;
@@ -628,7 +594,10 @@ class MouseTracker {
       this.buffer.push({ x: e.clientX, y: e.clientY, time: now });
       if (this.buffer.length > this.BUFFER_SIZE) {
         this.buffer.shift();
+      }
+      if (this.buffer.length >= this.BUFFER_SIZE && now - this.lastSendTime >= this.SEND_COOLDOWN) {
         this.analyze();
+        this.lastSendTime = now;
       }
     });
     this.transmitter = transmitter;
@@ -645,15 +614,17 @@ class MouseTracker {
     }
   }
   analyze() {
-    if (this.buffer.length < 5) return;
+    if (this.buffer.length < 20) return;
     const entropy = this.wasmService.calculateEntropy(this.buffer);
     const speedVariance = this.calculateSpeedVariance();
+    const rawTrajectory = this.buffer.map((p) => ({ x: p.x, y: p.y, t: p.time }));
     this.transmitter.send("behavior_metrics", {
       entropy,
       speedVariance,
-      timestamp: Date.now()
+      sampleSize: this.buffer.length,
+      timestamp: Date.now(),
+      rawTrajectory
     });
-    this.buffer = [];
   }
   // Speed Variance is simple enough to keep in JS or move to Wasm later.
   calculateSpeedVariance() {
@@ -674,8 +645,6 @@ class MouseTracker {
   }
 }
 class InputTracker {
-  // Buffer for raw input events - currently unused but kept for potential future raw data analysis
-  // private inputBuffer: any[] = []; 
   constructor(transmitter) {
     __publicField(this, "lastInteractionTime", 0);
     __publicField(this, "lastInteractionType", "none");
@@ -690,6 +659,8 @@ class InputTracker {
     // Suspicious focus tracking
     __publicField(this, "suspiciousFocusCount", 0);
     __publicField(this, "suspiciousFocusResetTimer", null);
+    // Raw keystroke buffer for ML training
+    __publicField(this, "rawKeystrokes", []);
     this.transmitter = transmitter;
     this.isMobile = this.detectMobile();
   }
@@ -714,6 +685,7 @@ class InputTracker {
         this.checkFocusIntegrity();
         this.flightTimes = [];
         this.dwellTimes = [];
+        this.rawKeystrokes = [];
         this.lastKeyUpTime = 0;
       }
     }, { capture: true });
@@ -722,6 +694,7 @@ class InputTracker {
       if (target.tagName !== "INPUT" && target.tagName !== "TEXTAREA") return;
       const now = Date.now();
       this.keyPressTimes.set(e.code, now);
+      this.rawKeystrokes.push({ code: e.code, t: now, type: "down" });
       if (this.lastKeyUpTime > 0) {
         const flight = now - this.lastKeyUpTime;
         if (flight < 2e3) {
@@ -734,6 +707,7 @@ class InputTracker {
       if (target.tagName !== "INPUT" && target.tagName !== "TEXTAREA") return;
       const now = Date.now();
       this.lastKeyUpTime = now;
+      this.rawKeystrokes.push({ code: e.code, t: now, type: "up" });
       const startTime = this.keyPressTimes.get(e.code);
       if (startTime) {
         const dwell = now - startTime;
@@ -754,7 +728,7 @@ class InputTracker {
   checkFocusIntegrity() {
     const now = Date.now();
     const timeDiff = now - this.lastInteractionTime;
-    if (performance.now() < 2e3) return;
+    if (performance.now() < 5e3) return;
     if (timeDiff > 200) {
       this.suspiciousFocusCount++;
       clearTimeout(this.suspiciousFocusResetTimer);
@@ -768,15 +742,6 @@ class InputTracker {
         consecutiveCount: this.suspiciousFocusCount,
         timestamp: now
       });
-      if (this.suspiciousFocusCount >= 3) {
-        this.transmitter.send("integrity_violation", {
-          type: "programmatic_focus",
-          details: `${this.suspiciousFocusCount} consecutive input focuses without click/tab`,
-          consecutiveCount: this.suspiciousFocusCount,
-          timestamp: now
-        });
-        this.suspiciousFocusCount = 0;
-      }
     } else {
       this.suspiciousFocusCount = 0;
     }
@@ -798,10 +763,13 @@ class InputTracker {
         variance: varDwell
       },
       isMobile: this.isMobile,
-      timestamp: Date.now()
+      timestamp: Date.now(),
+      rawKeystrokes: [...this.rawKeystrokes]
+      // ML training data (~10-20 entries, ~800B)
     });
     this.flightTimes = [];
     this.dwellTimes = [];
+    this.rawKeystrokes = [];
   }
   average(data) {
     if (data.length === 0) return 0;
@@ -876,22 +844,32 @@ class WasmService {
   }
 }
 class CanvasFingerprinter {
-  constructor(transmitter, wasmService) {
+  // wasmService kept in constructor signature for backward compatibility
+  // but no longer used — fingerprint hashing upgraded to SHA-256 via Web Crypto
+  constructor(transmitter, _wasmService) {
     __publicField(this, "transmitter");
-    __publicField(this, "wasmService");
     __publicField(this, "hasRun", false);
     this.transmitter = transmitter;
-    this.wasmService = wasmService;
   }
   start() {
     if (this.hasRun || typeof document === "undefined") return;
-    setTimeout(() => {
-      const fingerprint = this.generateFingerprint();
-      this.transmitter.send("fingerprint_collected", { hash: fingerprint });
+    setTimeout(async () => {
+      const canvasHash = await this.generateFingerprint();
+      const webglFp = this.collectWebGLFingerprint();
+      const audioFp = this.collectAudioFingerprint();
+      this.transmitter.send("fingerprint_collected", {
+        hash: canvasHash,
+        webgl: webglFp,
+        audio: audioFp
+      });
       this.hasRun = true;
     }, 500);
   }
-  generateFingerprint() {
+  /**
+   * Generate canvas fingerprint using SHA-256 (upgraded from 32-bit FNV hash).
+   * SHA-256 eliminates collision risk at scale (2^128 vs ~77K for 32-bit).
+   */
+  async generateFingerprint() {
     try {
       const canvas = document.createElement("canvas");
       const ctx = canvas.getContext("2d");
@@ -922,18 +900,75 @@ class CanvasFingerprinter {
       ctx.closePath();
       ctx.fill();
       const dataUrl = canvas.toDataURL();
-      const hash = this.wasmService.simpleHash(dataUrl);
-      return Math.abs(hash).toString(16);
+      const hash = await this.sha256(dataUrl);
+      return hash;
     } catch (e) {
       return "error";
     }
   }
+  /**
+   * Compute SHA-256 hex digest using Web Crypto API.
+   */
+  async sha256(data) {
+    const encoded = new TextEncoder().encode(data);
+    const hashBuffer = await window.crypto.subtle.digest("SHA-256", encoded);
+    const hashArray = new Uint8Array(hashBuffer);
+    return Array.from(hashArray).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  /**
+   * Collect WebGL fingerprint data for cross-signal consistency validation.
+   * Includes renderer, vendor, and hardware parameter profile.
+   */
+  collectWebGLFingerprint() {
+    try {
+      const canvas = document.createElement("canvas");
+      const gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl");
+      if (!gl) return { available: false };
+      const g = gl;
+      const result = { available: true };
+      const debugInfo = g.getExtension("WEBGL_debug_renderer_info");
+      if (debugInfo) {
+        result.renderer = g.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL);
+        result.vendor = g.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL);
+      }
+      result.maxTextureSize = g.getParameter(g.MAX_TEXTURE_SIZE);
+      result.maxViewportDims = Array.from(g.getParameter(g.MAX_VIEWPORT_DIMS));
+      result.maxRenderbufferSize = g.getParameter(g.MAX_RENDERBUFFER_SIZE);
+      result.maxVertexAttribs = g.getParameter(g.MAX_VERTEX_ATTRIBS);
+      result.extensions = (g.getSupportedExtensions() || []).length;
+      return result;
+    } catch (e) {
+      return { available: false, error: true };
+    }
+  }
+  /**
+   * AudioContext fingerprint — the audio stack produces unique output
+   * per hardware/OS/browser combination, even for silent oscillators.
+   */
+  collectAudioFingerprint() {
+    try {
+      const AudioCtx = window.AudioContext || window.webkitAudioContext;
+      if (!AudioCtx) return { available: false };
+      const ctx = new AudioCtx();
+      const result = {
+        available: true,
+        sampleRate: ctx.sampleRate,
+        state: ctx.state,
+        maxChannels: ctx.destination.maxChannelCount
+      };
+      ctx.close();
+      return result;
+    } catch (e) {
+      return { available: false };
+    }
+  }
 }
 class ChallengeHandler {
   constructor(endpoint) {
     __publicField(this, "originalFetch");
     __publicField(this, "endpoint");
     __publicField(this, "callbackManager", null);
+    __publicField(this, "challengeInProgress", null);
     this.endpoint = endpoint;
     this.originalFetch = window.fetch.bind(window);
   }
@@ -960,7 +995,13 @@ class ChallengeHandler {
                 return this.originalFetch(input, init);
               }
             }
-            const passed = await this.showCaptchaModal();
+            if (!this.challengeInProgress) {
+              this.challengeInProgress = this.showCaptchaModal().finally(() => {
+                this.challengeInProgress = null;
+              });
+            } else {
+            }
+            const passed = await this.challengeInProgress;
             if (passed) {
               return this.originalFetch(input, init);
             } else {
@@ -1174,10 +1215,1315 @@ class InvisibleInteraction {
     return null;
   }
 }
+class AutomationDetector {
+  constructor(transmitter) {
+    __publicField(this, "transmitter");
+    __publicField(this, "hasRun", false);
+    this.transmitter = transmitter;
+  }
+  start() {
+    if (this.hasRun || typeof window === "undefined") return;
+    setTimeout(() => this.detect(), 1500);
+    this.hasRun = true;
+  }
+  detect() {
+    var _a, _b;
+    const signals = {};
+    let score = 0;
+    if (navigator.webdriver === true) {
+      signals.webdriver = true;
+      score += 40;
+    }
+    try {
+      const cdpResult = this.detectCDP();
+      if (cdpResult) {
+        signals.cdp = true;
+        score += 50;
+      }
+    } catch (e) {
+    }
+    const globals = this.detectAutomationGlobals();
+    if (globals.length > 0) {
+      signals.automationGlobals = globals;
+      score += 30;
+    }
+    const webglInfo = this.checkWebGL();
+    if (webglInfo.suspicious) {
+      signals.webgl = webglInfo;
+      score += 25;
+    }
+    const inconsistencies = this.checkInconsistencies();
+    if (inconsistencies.length > 0) {
+      signals.inconsistencies = inconsistencies;
+      score += 15;
+    }
+    const headlessSignals = this.checkHeadless();
+    if (headlessSignals.score > 0) {
+      signals.headless = headlessSignals.flags;
+      score += headlessSignals.score;
+    }
+    if (score > 0) {
+      this.transmitter.send("automation_detected", {
+        signals,
+        score,
+        timestamp: Date.now()
+      });
+    }
+    this.transmitter.send("init_signals", {
+      webdriver: !!navigator.webdriver,
+      plugins: ((_a = navigator.plugins) == null ? void 0 : _a.length) ?? 0,
+      languages: ((_b = navigator.languages) == null ? void 0 : _b.length) ?? 0,
+      platform: navigator.platform,
+      hardwareConcurrency: navigator.hardwareConcurrency,
+      deviceMemory: navigator.deviceMemory,
+      maxTouchPoints: navigator.maxTouchPoints,
+      webglRenderer: webglInfo.renderer,
+      webglVendor: webglInfo.vendor,
+      timestamp: Date.now()
+    });
+  }
+  /**
+   * CDP serialization detection.
+   * When CDP's Runtime domain is active (Playwright/Puppeteer),
+   * console.log triggers serialization of objects, invoking getters.
+   * In normal browsers without DevTools open, getters are NOT invoked.
+   */
+  detectCDP() {
+    let detected = false;
+    const orig = console.debug;
+    console.debug = orig;
+    return detected;
+  }
+  /**
+   * Check for automation framework globals injected into window.
+   */
+  detectAutomationGlobals() {
+    const found = [];
+    const checks = [
+      // Selenium
+      ["selenium", () => !!window._selenium],
+      ["selenium_unwrapped", () => !!document.__selenium_unwrapped],
+      ["driver_evaluate", () => !!document.__driver_evaluate],
+      ["webdriver_evaluate", () => !!document.__webdriver_evaluate],
+      ["driver_unwrapped", () => !!document.__driver_unwrapped],
+      ["fxdriver", () => !!document.__fxdriver_evaluate],
+      // Playwright
+      ["playwright", () => !!window.__playwright],
+      ["playwright_binding", () => !!window.__playwright__binding__],
+      ["pwInitScripts", () => !!window.__pwInitScripts],
+      // Puppeteer
+      ["puppeteer", () => !!window.__puppeteer_evaluation_script__],
+      // PhantomJS
+      ["phantom", () => !!window.callPhantom || !!window._phantom],
+      // Nightmare
+      ["nightmare", () => !!window.__nightmare],
+      // Generic CDP
+      ["cdc", () => {
+        return Object.keys(document).some((k) => k.startsWith("cdc_") || k.startsWith("$cdc_"));
+      }]
+    ];
+    for (const [name, check] of checks) {
+      try {
+        if (check()) found.push(name);
+      } catch (e) {
+      }
+    }
+    return found;
+  }
+  /**
+   * Check WebGL renderer for headless indicators.
+   * SwiftShader, Mesa OffScreen, and ANGLE (software) are headless markers.
+   */
+  checkWebGL() {
+    try {
+      const canvas = document.createElement("canvas");
+      const gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl");
+      if (!gl) return { suspicious: false, renderer: "unavailable", vendor: "unavailable" };
+      const debugInfo = gl.getExtension("WEBGL_debug_renderer_info");
+      if (!debugInfo) return { suspicious: false, renderer: "no_debug_info", vendor: "no_debug_info" };
+      const renderer = gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) || "";
+      const vendor = gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL) || "";
+      const suspicious = /SwiftShader/i.test(renderer) || /Mesa OffScreen/i.test(renderer) || /llvmpipe/i.test(renderer);
+      return { suspicious, renderer, vendor };
+    } catch (e) {
+      return { suspicious: false, renderer: "error", vendor: "error" };
+    }
+  }
+  /**
+   * Cross-signal consistency checks.
+   * Compares multiple browser properties that should be correlated.
+   */
+  checkInconsistencies() {
+    const issues = [];
+    try {
+      const ua = navigator.userAgent;
+      const platform = navigator.platform;
+      if (/Windows/.test(ua) && /Mac/.test(platform)) {
+        issues.push("ua_platform_mismatch_win_mac");
+      }
+      if (/Macintosh/.test(ua) && /Win/.test(platform)) {
+        issues.push("ua_platform_mismatch_mac_win");
+      }
+      if (/Mobile|Android|iPhone/.test(ua) && navigator.maxTouchPoints === 0) {
+        issues.push("mobile_ua_no_touch");
+      }
+      if (/Chrome/.test(ua) && navigator.plugins && navigator.plugins.length === 0) {
+        issues.push("chrome_no_plugins");
+      }
+      if (!navigator.languages || navigator.languages.length === 0) {
+        issues.push("no_languages");
+      }
+    } catch (e) {
+    }
+    return issues;
+  }
+  /**
+   * Additional headless Chrome detection signals.
+   */
+  checkHeadless() {
+    const flags = [];
+    let score = 0;
+    try {
+      if (/HeadlessChrome/.test(navigator.userAgent)) {
+        flags.push("headless_ua");
+        score += 40;
+      }
+      if (/Chrome/.test(navigator.userAgent) && !window.chrome) {
+        flags.push("chrome_ua_no_chrome_obj");
+        score += 15;
+      }
+      if (window.screen && window.screen.width === 800 && window.screen.height === 600) {
+        flags.push("default_screen_size");
+        score += 10;
+      }
+      if ("Notification" in window) {
+        const perm = window.Notification.permission;
+        if (perm === "denied" && navigator.userAgent.includes("Chrome")) {
+          flags.push("notification_denied_default");
+          score += 5;
+        }
+      }
+      const conn = navigator.connection;
+      if (conn && conn.rtt === 0) {
+        flags.push("zero_rtt");
+        score += 10;
+      }
+    } catch (e) {
+    }
+    return { score, flags };
+  }
+}
+class SessionAnalyzer {
+  constructor(transmitter) {
+    __publicField(this, "transmitter");
+    __publicField(this, "sessionStart", 0);
+    __publicField(this, "pageTransitions", []);
+    __publicField(this, "interactionTimestamps", []);
+    __publicField(this, "lastPageUrl", "");
+    __publicField(this, "formStartTimes", /* @__PURE__ */ new Map());
+    // @ts-ignore
+    __publicField(this, "reportInterval", null);
+    this.transmitter = transmitter;
+  }
+  start() {
+    if (typeof window === "undefined") return;
+    this.sessionStart = Date.now();
+    this.lastPageUrl = window.location.href;
+    const events = ["mousedown", "keydown", "touchstart", "scroll"];
+    events.forEach((evt) => {
+      document.addEventListener(evt, () => {
+        this.interactionTimestamps.push(Date.now());
+        if (this.interactionTimestamps.length > 500) {
+          this.interactionTimestamps.shift();
+        }
+      }, { passive: true, capture: true });
+    });
+    this.observeNavigation();
+    this.observeForms();
+    this.reportInterval = setInterval(() => this.report(), 15e3);
+  }
+  observeNavigation() {
+    const origPushState = history.pushState;
+    const origReplaceState = history.replaceState;
+    const self = this;
+    history.pushState = function(data, unused, url) {
+      origPushState.call(this, data, unused, url);
+      self.onPageTransition();
+    };
+    history.replaceState = function(data, unused, url) {
+      origReplaceState.call(this, data, unused, url);
+      self.onPageTransition();
+    };
+    window.addEventListener("popstate", () => this.onPageTransition());
+  }
+  onPageTransition() {
+    const now = Date.now();
+    const newUrl = window.location.href;
+    if (newUrl !== this.lastPageUrl) {
+      this.pageTransitions.push(now);
+      this.lastPageUrl = newUrl;
+    }
+  }
+  observeForms() {
+    document.addEventListener("focus", (e) => {
+      const target = e.target;
+      if (target.tagName === "INPUT" || target.tagName === "TEXTAREA" || target.tagName === "SELECT") {
+        const form = target.closest("form");
+        const formId = (form == null ? void 0 : form.id) || (form == null ? void 0 : form.action) || "anonymous_form";
+        if (!this.formStartTimes.has(formId)) {
+          this.formStartTimes.set(formId, Date.now());
+        }
+      }
+    }, { capture: true });
+    document.addEventListener("submit", (e) => {
+      const form = e.target;
+      const formId = form.id || form.action || "anonymous_form";
+      const startTime = this.formStartTimes.get(formId);
+      if (startTime) {
+        const duration = Date.now() - startTime;
+        this.transmitter.send("session_metrics", {
+          type: "form_completion",
+          formId,
+          duration,
+          timestamp: Date.now()
+        });
+        this.formStartTimes.delete(formId);
+      }
+    }, { capture: true });
+  }
+  report() {
+    const now = Date.now();
+    const sessionDuration = now - this.sessionStart;
+    if (this.interactionTimestamps.length < 10) return;
+    const intervals = this.calculateIntervals(this.interactionTimestamps);
+    const timingMetrics = this.analyzeTimingDistribution(intervals);
+    const pageMetrics = this.analyzePageTransitions();
+    this.transmitter.send("session_metrics", {
+      type: "session_analysis",
+      sessionDuration,
+      totalInteractions: this.interactionTimestamps.length,
+      pageTransitions: this.pageTransitions.length,
+      timing: timingMetrics,
+      pages: pageMetrics,
+      timestamp: now
+    });
+  }
+  calculateIntervals(timestamps) {
+    const intervals = [];
+    for (let i = 1; i < timestamps.length; i++) {
+      intervals.push(timestamps[i] - timestamps[i - 1]);
+    }
+    return intervals;
+  }
+  analyzeTimingDistribution(intervals) {
+    if (intervals.length < 5) return { samples: intervals.length };
+    const mean = intervals.reduce((a, b) => a + b, 0) / intervals.length;
+    const variance = intervals.reduce((a, b) => a + Math.pow(b - mean, 2), 0) / intervals.length;
+    const stdDev = Math.sqrt(variance);
+    const cv = mean > 0 ? stdDev / mean : 0;
+    const entropy = this.shannonEntropy(intervals, 50);
+    const autocorr = this.autocorrelation(intervals);
+    return {
+      mean: Math.round(mean),
+      stdDev: Math.round(stdDev),
+      cv: parseFloat(cv.toFixed(4)),
+      entropy: parseFloat(entropy.toFixed(4)),
+      autocorrelation: parseFloat(autocorr.toFixed(4)),
+      samples: intervals.length
+    };
+  }
+  analyzePageTransitions() {
+    if (this.pageTransitions.length < 2) {
+      return { count: this.pageTransitions.length };
+    }
+    const intervals = this.calculateIntervals(this.pageTransitions);
+    const mean = intervals.reduce((a, b) => a + b, 0) / intervals.length;
+    const variance = intervals.reduce((a, b) => a + Math.pow(b - mean, 2), 0) / intervals.length;
+    const cv = mean > 0 ? Math.sqrt(variance) / mean : 0;
+    return {
+      count: this.pageTransitions.length,
+      avgInterval: Math.round(mean),
+      cv: parseFloat(cv.toFixed(4))
+    };
+  }
+  /**
+   * Shannon entropy of intervals binned into buckets.
+   * Low entropy = predictable/regular timing = bot-like.
+   */
+  shannonEntropy(values, binSize) {
+    const bins = /* @__PURE__ */ new Map();
+    for (const v of values) {
+      const bin = Math.floor(v / binSize);
+      bins.set(bin, (bins.get(bin) || 0) + 1);
+    }
+    const total = values.length;
+    let entropy = 0;
+    for (const count of bins.values()) {
+      const p = count / total;
+      if (p > 0) entropy -= p * Math.log2(p);
+    }
+    return entropy;
+  }
+  /**
+   * Autocorrelation at lag-1.
+   * Human timing: moderate positive autocorrelation (motor control inertia).
+   * Random delays: near-zero autocorrelation.
+   */
+  autocorrelation(values) {
+    if (values.length < 3) return 0;
+    const mean = values.reduce((a, b) => a + b, 0) / values.length;
+    let numerator = 0;
+    let denominator = 0;
+    for (let i = 0; i < values.length - 1; i++) {
+      numerator += (values[i] - mean) * (values[i + 1] - mean);
+    }
+    for (let i = 0; i < values.length; i++) {
+      denominator += Math.pow(values[i] - mean, 2);
+    }
+    return denominator === 0 ? 0 : numerator / denominator;
+  }
+}
+class TabNavigationAnalyzer {
+  // Also report when 20+ Tabs accumulated
+  constructor(transmitter) {
+    __publicField(this, "transmitter");
+    // Tab event tracking
+    __publicField(this, "tabTimestamps", []);
+    __publicField(this, "shiftTabCount", 0);
+    __publicField(this, "tabCount", 0);
+    __publicField(this, "isShiftDown", false);
+    // Burst detection
+    __publicField(this, "BURST_THRESHOLD_MS", 80);
+    // Consecutive Tabs under 80ms = burst
+    // Reporting
+    __publicField(this, "reportInterval", null);
+    __publicField(this, "REPORT_INTERVAL_MS", 1e4);
+    // Report every 10 seconds
+    __publicField(this, "MIN_TABS_TO_REPORT", 5);
+    // Need at least 5 Tabs to analyze
+    __publicField(this, "TAB_TRIGGER_COUNT", 20);
+    __publicField(this, "onKeyDown", (e) => {
+      if (e.key === "Shift") {
+        this.isShiftDown = true;
+        return;
+      }
+      if (e.key === "Tab") {
+        const now = Date.now();
+        if (this.isShiftDown) {
+          this.shiftTabCount++;
+        } else {
+          this.tabCount++;
+          this.tabTimestamps.push(now);
+          if (this.tabTimestamps.length > 100) {
+            this.tabTimestamps.shift();
+          }
+        }
+        if (this.tabCount + this.shiftTabCount >= this.TAB_TRIGGER_COUNT) {
+          this.report();
+        }
+      }
+    });
+    __publicField(this, "onKeyUp", (e) => {
+      if (e.key === "Shift") {
+        this.isShiftDown = false;
+      }
+    });
+    this.transmitter = transmitter;
+  }
+  start() {
+    if (typeof document === "undefined") return;
+    document.addEventListener("keydown", this.onKeyDown, { passive: true, capture: true });
+    document.addEventListener("keyup", this.onKeyUp, { passive: true, capture: true });
+    this.reportInterval = setInterval(() => this.report(), this.REPORT_INTERVAL_MS);
+  }
+  stop() {
+    if (typeof document === "undefined") return;
+    document.removeEventListener("keydown", this.onKeyDown, { capture: true });
+    document.removeEventListener("keyup", this.onKeyUp, { capture: true });
+    if (this.reportInterval) {
+      clearInterval(this.reportInterval);
+      this.reportInterval = null;
+    }
+    this.report();
+  }
+  report() {
+    const totalTabs = this.tabCount + this.shiftTabCount;
+    if (totalTabs < this.MIN_TABS_TO_REPORT) return;
+    const intervals = this.calculateIntervals(this.tabTimestamps);
+    if (intervals.length < 3) {
+      this.resetBuffers();
+      return;
+    }
+    const intervalStats = this.analyzeIntervals(intervals);
+    const burstStats = this.analyzeBursts(intervals);
+    const shiftTabRatio = totalTabs > 0 ? this.shiftTabCount / totalTabs : 0;
+    this.transmitter.send("tab_navigation_metrics", {
+      tabCount: this.tabCount,
+      shiftTabCount: this.shiftTabCount,
+      shiftTabRatio: parseFloat(shiftTabRatio.toFixed(4)),
+      intervals: intervalStats,
+      bursts: burstStats,
+      timestamp: Date.now()
+    });
+    this.resetBuffers();
+  }
+  resetBuffers() {
+    this.tabTimestamps = [];
+    this.tabCount = 0;
+    this.shiftTabCount = 0;
+  }
+  calculateIntervals(timestamps) {
+    const intervals = [];
+    for (let i = 1; i < timestamps.length; i++) {
+      const interval = timestamps[i] - timestamps[i - 1];
+      if (interval < 5e3) {
+        intervals.push(interval);
+      }
+    }
+    return intervals;
+  }
+  analyzeIntervals(intervals) {
+    if (intervals.length === 0) {
+      return { avg: 0, variance: 0, cv: 0, min: 0, samples: 0 };
+    }
+    const avg = intervals.reduce((a, b) => a + b, 0) / intervals.length;
+    const variance = intervals.reduce((a, b) => a + Math.pow(b - avg, 2), 0) / intervals.length;
+    const stdDev = Math.sqrt(variance);
+    const cv = avg > 0 ? stdDev / avg : 0;
+    const min = Math.min(...intervals);
+    return {
+      avg: parseFloat(avg.toFixed(2)),
+      variance: parseFloat(variance.toFixed(2)),
+      cv: parseFloat(cv.toFixed(4)),
+      min,
+      samples: intervals.length
+    };
+  }
+  analyzeBursts(intervals) {
+    let burstCount = 0;
+    let currentBurstLength = 0;
+    let totalBurstLength = 0;
+    let totalBurstInterval = 0;
+    let burstIntervalCount = 0;
+    for (const interval of intervals) {
+      if (interval < this.BURST_THRESHOLD_MS) {
+        currentBurstLength++;
+        totalBurstInterval += interval;
+        burstIntervalCount++;
+      } else {
+        if (currentBurstLength >= 3) {
+          burstCount++;
+          totalBurstLength += currentBurstLength;
+        }
+        currentBurstLength = 0;
+      }
+    }
+    if (currentBurstLength >= 3) {
+      burstCount++;
+      totalBurstLength += currentBurstLength;
+    }
+    return {
+      count: burstCount,
+      avgLength: burstCount > 0 ? parseFloat((totalBurstLength / burstCount).toFixed(1)) : 0,
+      avgInterval: burstIntervalCount > 0 ? parseFloat((totalBurstInterval / burstIntervalCount).toFixed(2)) : 0
+    };
+  }
+}
+class CloudEnvironmentDetector {
+  constructor(transmitter) {
+    __publicField(this, "transmitter");
+    __publicField(this, "hasRun", false);
+    this.transmitter = transmitter;
+  }
+  start() {
+    if (this.hasRun || typeof window === "undefined") return;
+    this.hasRun = true;
+    setTimeout(() => this.detect(), 2e3);
+  }
+  async detect() {
+    try {
+      const gpu = this.analyzeGPU();
+      const hardware = this.analyzeHardware();
+      const screen2 = this.analyzeScreen();
+      const media = await this.analyzeMedia();
+      const performance2 = this.benchmarkCanvas();
+      let vmIndicatorCount = 0;
+      if (gpu.category === "virtual_gpu" || gpu.category === "software_render" || gpu.category === "cloud_gpu") {
+        vmIndicatorCount += 2;
+      }
+      if (hardware.cores <= 2) vmIndicatorCount++;
+      if (hardware.memory !== null && hardware.memory <= 2) vmIndicatorCount++;
+      if (hardware.colorDepth === 24) vmIndicatorCount++;
+      if (hardware.pixelRatio === 1) vmIndicatorCount++;
+      if (screen2.noTaskbar) vmIndicatorCount++;
+      if (screen2.isVMResolution) vmIndicatorCount++;
+      if (media.cameras === 0 && media.microphones === 0) vmIndicatorCount++;
+      if (!media.hasBluetooth && !media.hasUSB) vmIndicatorCount++;
+      if (performance2.canvasRenderTime > 50) vmIndicatorCount++;
+      const { classification, confidence } = this.classify(gpu, hardware, vmIndicatorCount);
+      this.transmitter.send("cloud_environment", {
+        classification,
+        confidence,
+        signals: {
+          gpu: { renderer: gpu.renderer, vendor: gpu.vendor, category: gpu.category },
+          hardware,
+          screen: screen2,
+          media,
+          performance: performance2
+        },
+        vmIndicatorCount,
+        timestamp: Date.now()
+      });
+    } catch (e) {
+    }
+  }
+  /**
+   * Analyze WebGL renderer to identify virtual GPUs.
+   */
+  analyzeGPU() {
+    try {
+      const canvas = document.createElement("canvas");
+      const gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl");
+      if (!gl) return { renderer: "unavailable", vendor: "unavailable", category: "unknown" };
+      const debugInfo = gl.getExtension("WEBGL_debug_renderer_info");
+      if (!debugInfo) return { renderer: "no_debug_info", vendor: "no_debug_info", category: "unknown" };
+      const renderer = gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) || "";
+      const vendor = gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL) || "";
+      const category = this.categorizeGPU(renderer, vendor);
+      return { renderer, vendor, category };
+    } catch (e) {
+      return { renderer: "error", vendor: "error", category: "unknown" };
+    }
+  }
+  /**
+   * Categorize GPU renderer string into environment type.
+   */
+  categorizeGPU(renderer, vendor) {
+    const r = renderer.toLowerCase();
+    const v = vendor.toLowerCase();
+    if (/swiftshader|llvmpipe|mesa offscreen|softpipe/.test(r)) {
+      return "software_render";
+    }
+    if (/svga3d|svga|vmware/.test(r)) return "virtual_gpu";
+    if (/virtualbox/.test(r)) return "virtual_gpu";
+    if (/parallels/.test(r)) return "virtual_gpu";
+    if (/qxl|virtio|red hat|spice/.test(r)) return "virtual_gpu";
+    if (/hyper-v|microsoft basic render/i.test(r)) return "virtual_gpu";
+    if (/citrix/.test(r)) return "virtual_gpu";
+    if (/amazon|elastic|aws/.test(r) || /amazon|elastic|aws/.test(v)) return "cloud_gpu";
+    if (/google cloud|gce/.test(r) || /google cloud|gce/.test(v)) return "cloud_gpu";
+    if (/azure/.test(r) || /azure/.test(v)) return "cloud_gpu";
+    return "physical";
+  }
+  /**
+   * Collect hardware characteristics.
+   */
+  analyzeHardware() {
+    return {
+      cores: navigator.hardwareConcurrency || 0,
+      memory: navigator.deviceMemory ?? null,
+      colorDepth: screen.colorDepth,
+      pixelRatio: window.devicePixelRatio || 1
+    };
+  }
+  /**
+   * Analyze screen properties for VM indicators.
+   */
+  analyzeScreen() {
+    const width = screen.width;
+    const height = screen.height;
+    const availHeight = screen.availHeight;
+    const noTaskbar = height === availHeight && height === window.innerHeight;
+    const vmResolutions = [
+      [800, 600],
+      [1024, 768],
+      [1280, 1024],
+      [1280, 800],
+      [1920, 1080]
+      // Also common physical, but combined with other signals
+    ];
+    const isVMResolution = vmResolutions.some(
+      ([w, h]) => width === w && height === h && !(w === 1920 && h === 1080)
+    );
+    return { width, height, availHeight, noTaskbar, isVMResolution };
+  }
+  /**
+   * Check media device availability (cameras, microphones, peripherals).
+   */
+  async analyzeMedia() {
+    let cameras = -1;
+    let microphones = -1;
+    try {
+      if (navigator.mediaDevices && navigator.mediaDevices.enumerateDevices) {
+        const devices = await navigator.mediaDevices.enumerateDevices();
+        cameras = devices.filter((d) => d.kind === "videoinput").length;
+        microphones = devices.filter((d) => d.kind === "audioinput").length;
+      }
+    } catch (e) {
+    }
+    const hasBluetooth = !!navigator.bluetooth;
+    const hasUSB = !!navigator.usb;
+    let hasBattery = null;
+    try {
+      if (navigator.getBattery) {
+        const battery = await navigator.getBattery();
+        hasBattery = !(battery.charging && battery.level === 1 && battery.chargingTime === 0);
+      }
+    } catch (e) {
+    }
+    return { cameras, microphones, hasBluetooth, hasUSB, hasBattery };
+  }
+  /**
+   * Quick canvas rendering benchmark.
+   * Software rendering (VM without GPU) is significantly slower.
+   */
+  benchmarkCanvas() {
+    try {
+      const canvas = document.createElement("canvas");
+      canvas.width = 200;
+      canvas.height = 200;
+      const ctx = canvas.getContext("2d");
+      if (!ctx) return { canvasRenderTime: -1 };
+      const start = performance.now();
+      for (let i = 0; i < 500; i++) {
+        ctx.fillStyle = `rgb(${i % 256},${i * 3 % 256},${i * 7 % 256})`;
+        ctx.fillRect(i * 13 % 200, i * 7 % 200, 10, 10);
+      }
+      ctx.getImageData(0, 0, 1, 1);
+      const elapsed = performance.now() - start;
+      return { canvasRenderTime: Math.round(elapsed * 100) / 100 };
+    } catch (e) {
+      return { canvasRenderTime: -1 };
+    }
+  }
+  /**
+   * Classify the environment based on collected signals.
+   */
+  classify(gpu, hardware, vmIndicatorCount) {
+    if (gpu.category === "virtual_gpu") {
+      if (hardware.colorDepth === 24) {
+        return { classification: "rdp_likely", confidence: 0.85 };
+      }
+      return { classification: "vm_detected", confidence: 0.95 };
+    }
+    if (gpu.category === "cloud_gpu") {
+      return { classification: "cloud_likely", confidence: 0.9 };
+    }
+    if (gpu.category === "software_render") {
+      return { classification: "vm_detected", confidence: 0.9 };
+    }
+    if (vmIndicatorCount >= 5) {
+      return { classification: "vm_likely", confidence: 0.8 };
+    }
+    if (vmIndicatorCount >= 3) {
+      return { classification: "vm_likely", confidence: 0.6 };
+    }
+    return { classification: "physical", confidence: 1 - vmIndicatorCount * 0.1 };
+  }
+}
+class CrossContextDetector {
+  constructor(transmitter) {
+    __publicField(this, "transmitter");
+    __publicField(this, "hasRun", false);
+    this.transmitter = transmitter;
+  }
+  start() {
+    if (this.hasRun || typeof window === "undefined") return;
+    this.hasRun = true;
+    setTimeout(() => this.detect(), 2500);
+  }
+  async detect() {
+    var _a, _b;
+    const signals = {};
+    let score = 0;
+    const main = {
+      webdriver: !!navigator.webdriver,
+      languages: ((_a = navigator.languages) == null ? void 0 : _a.join(",")) || "",
+      platform: navigator.platform || "",
+      hardwareConcurrency: navigator.hardwareConcurrency || 0,
+      userAgent: navigator.userAgent || "",
+      pluginsLength: ((_b = navigator.plugins) == null ? void 0 : _b.length) ?? 0
+    };
+    const iframeResult = this.checkIframe(main);
+    if (iframeResult.score > 0) {
+      signals.iframe = iframeResult.mismatches;
+      score += iframeResult.score;
+    }
+    try {
+      const workerResult = await this.checkWorker(main);
+      if (workerResult.score > 0) {
+        signals.worker = workerResult.mismatches;
+        score += workerResult.score;
+      }
+    } catch (_e) {
+    }
+    if (score > 0) {
+      this.transmitter.send("cross_context_mismatch", {
+        signals,
+        score,
+        timestamp: Date.now()
+      });
+    }
+  }
+  /**
+   * Create a sandboxed iframe and compare navigator values.
+   */
+  checkIframe(main) {
+    var _a, _b;
+    const mismatches = [];
+    let score = 0;
+    try {
+      const iframe = document.createElement("iframe");
+      iframe.style.display = "none";
+      iframe.sandbox = "allow-same-origin";
+      document.body.appendChild(iframe);
+      const iframeWindow = iframe.contentWindow;
+      if (!iframeWindow) {
+        document.body.removeChild(iframe);
+        return { score: 0, mismatches: [] };
+      }
+      const iframeNav = iframeWindow.navigator;
+      if (iframeNav.webdriver !== navigator.webdriver) {
+        mismatches.push("webdriver_mismatch");
+        score += 40;
+      }
+      if (!navigator.webdriver && iframeNav.webdriver === true) {
+        mismatches.push("webdriver_spoofed_in_main");
+        score += 30;
+      }
+      const iframeLangs = ((_a = iframeNav.languages) == null ? void 0 : _a.join(",")) || "";
+      if (iframeLangs !== main.languages) {
+        mismatches.push("languages_mismatch");
+        score += 15;
+      }
+      if (iframeNav.platform !== main.platform) {
+        mismatches.push("platform_mismatch");
+        score += 15;
+      }
+      const iframePlugins = ((_b = iframeNav.plugins) == null ? void 0 : _b.length) ?? 0;
+      if (iframePlugins !== main.pluginsLength) {
+        mismatches.push("plugins_mismatch");
+        score += 10;
+      }
+      document.body.removeChild(iframe);
+    } catch (_e) {
+    }
+    return { score, mismatches };
+  }
+  /**
+   * Spin up a WebWorker and compare navigator values.
+   * Workers have their own navigator which is harder to spoof.
+   */
+  checkWorker(main) {
+    return new Promise((resolve) => {
+      try {
+        const workerCode = `
+                    self.onmessage = function() {
+                        var nav = self.navigator;
+                        self.postMessage({
+                            webdriver: !!nav.webdriver,
+                            languages: (nav.languages || []).join(','),
+                            platform: nav.platform || '',
+                            hardwareConcurrency: nav.hardwareConcurrency || 0,
+                            userAgent: nav.userAgent || ''
+                        });
+                    };
+                `;
+        const blob = new Blob([workerCode], { type: "application/javascript" });
+        const url = URL.createObjectURL(blob);
+        const worker = new Worker(url);
+        const timeout = setTimeout(() => {
+          worker.terminate();
+          URL.revokeObjectURL(url);
+          resolve({ score: 0, mismatches: [] });
+        }, 3e3);
+        worker.onmessage = (e) => {
+          clearTimeout(timeout);
+          worker.terminate();
+          URL.revokeObjectURL(url);
+          const w = e.data;
+          const mismatches = [];
+          let score = 0;
+          if (w.webdriver !== main.webdriver) {
+            mismatches.push("worker_webdriver_mismatch");
+            score += 35;
+          }
+          if (w.languages !== main.languages) {
+            mismatches.push("worker_languages_mismatch");
+            score += 15;
+          }
+          if (w.platform !== main.platform) {
+            mismatches.push("worker_platform_mismatch");
+            score += 15;
+          }
+          if (w.hardwareConcurrency !== main.hardwareConcurrency) {
+            mismatches.push("worker_concurrency_mismatch");
+            score += 10;
+          }
+          if (w.userAgent !== main.userAgent) {
+            mismatches.push("worker_ua_mismatch");
+            score += 20;
+          }
+          resolve({ score, mismatches });
+        };
+        worker.onerror = () => {
+          clearTimeout(timeout);
+          worker.terminate();
+          URL.revokeObjectURL(url);
+          resolve({ score: 0, mismatches: [] });
+        };
+        worker.postMessage("check");
+      } catch (_e) {
+        resolve({ score: 0, mismatches: [] });
+      }
+    });
+  }
+}
+class HeadlessProbeDetector {
+  constructor(transmitter) {
+    __publicField(this, "transmitter");
+    __publicField(this, "hasRun", false);
+    this.transmitter = transmitter;
+  }
+  start() {
+    if (this.hasRun || typeof window === "undefined") return;
+    this.hasRun = true;
+    setTimeout(() => this.detect(), 2e3);
+  }
+  async detect() {
+    const signals = {};
+    let score = 0;
+    const brokenImg = await this.checkBrokenImage();
+    if (brokenImg.suspicious) {
+      signals.brokenImage = brokenImg;
+      score += 25;
+    }
+    const clientHints = await this.checkClientHints();
+    if (clientHints.suspicious) {
+      signals.clientHints = clientHints;
+      score += 20;
+    }
+    const cdpMouse = this.checkCDPMouseSignature();
+    if (cdpMouse.suspicious) {
+      signals.cdpMouse = cdpMouse;
+      score += 30;
+    }
+    const hairline = this.checkHairlineSupport();
+    if (hairline.suspicious) {
+      signals.hairline = hairline;
+      score += 10;
+    }
+    const extraFrameworks = this.checkExtraFrameworks();
+    if (extraFrameworks.length > 0) {
+      signals.extraFrameworks = extraFrameworks;
+      score += 20;
+    }
+    const workerCDP = await this.checkWorkerCDP();
+    if (workerCDP.suspicious) {
+      signals.workerCDP = true;
+      score += 35;
+    }
+    if (score > 0) {
+      this.transmitter.send("headless_probe", {
+        signals,
+        score,
+        timestamp: Date.now()
+      });
+    }
+  }
+  /**
+   * Broken image dimensions test.
+   * Normal browsers render a placeholder for broken images (typically 16x16 or 24x24).
+   * Headless Chrome returns 0x0.
+   */
+  checkBrokenImage() {
+    return new Promise((resolve) => {
+      try {
+        const img = document.createElement("img");
+        img.src = "data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==___invalid";
+        const timeout = setTimeout(() => {
+          resolve({ suspicious: false, width: -1, height: -1 });
+        }, 2e3);
+        img.onerror = () => {
+          clearTimeout(timeout);
+          const w = img.width;
+          const h = img.height;
+          resolve({
+            suspicious: w === 0 && h === 0,
+            width: w,
+            height: h
+          });
+        };
+        img.onload = () => {
+          clearTimeout(timeout);
+          resolve({ suspicious: false, width: img.width, height: img.height });
+        };
+        img.style.position = "absolute";
+        img.style.left = "-9999px";
+        document.body.appendChild(img);
+        setTimeout(() => {
+          try {
+            document.body.removeChild(img);
+          } catch (_e) {
+          }
+        }, 100);
+      } catch (_e) {
+        resolve({ suspicious: false, width: -1, height: -1 });
+      }
+    });
+  }
+  /**
+   * Client Hints consistency check.
+   * navigator.userAgentData (if available) should match UA string.
+   * Bots that spoof UA often forget to update Client Hints.
+   */
+  async checkClientHints() {
+    const mismatches = [];
+    try {
+      const uad = navigator.userAgentData;
+      if (!uad) return { suspicious: false, mismatches: [] };
+      const ua = navigator.userAgent;
+      const brands = uad.brands || [];
+      const brandNames = brands.map((b) => b.brand);
+      if (/Chrome\/\d/.test(ua) && !brandNames.some((b) => /Chromium|Google Chrome|Chrome/.test(b))) {
+        mismatches.push("ua_chrome_no_brand");
+      }
+      if (uad.platform) {
+        if (/Windows/.test(ua) && uad.platform !== "Windows") {
+          mismatches.push("ua_windows_brand_mismatch");
+        }
+        if (/Macintosh/.test(ua) && uad.platform !== "macOS") {
+          mismatches.push("ua_mac_brand_mismatch");
+        }
+        if (/Linux/.test(ua) && !/Linux|Android|ChromeOS/.test(uad.platform)) {
+          mismatches.push("ua_linux_brand_mismatch");
+        }
+      }
+      if (/Mobile/.test(ua) && uad.mobile === false) {
+        mismatches.push("ua_mobile_brand_mismatch");
+      }
+    } catch (_e) {
+    }
+    return { suspicious: mismatches.length > 0, mismatches };
+  }
+  /**
+   * CDP mouse event signature detection.
+   * CDP's Input.dispatchMouseEvent creates events where:
+   *   - movementX/Y are always 0 (no real mouse delta)
+   *   - screenX/Y may not match clientX/Y + window offset
+   *   - Multiple rapid mousemove without mousedown have consistent offsets
+   *
+   * We collect a few mouse events and check for CDP patterns.
+   */
+  checkCDPMouseSignature() {
+    let zeroMovementCount = 0;
+    let totalEvents = 0;
+    let suspicious = false;
+    try {
+      const events = [];
+      const handler = (e) => {
+        events.push(e);
+        totalEvents++;
+        if (e.movementX === 0 && e.movementY === 0) {
+          zeroMovementCount++;
+        }
+      };
+      document.addEventListener("mousemove", handler, { passive: true });
+      setTimeout(() => {
+        document.removeEventListener("mousemove", handler);
+      }, 5e3);
+      if (totalEvents > 10 && zeroMovementCount / totalEvents > 0.9) {
+        suspicious = true;
+      }
+    } catch (_e) {
+    }
+    return { suspicious, zeroMovementCount, totalEvents };
+  }
+  /**
+   * Hairline (0.5px border) support test.
+   * HiDPI devices support 0.5px borders. Headless Chrome may not.
+   */
+  checkHairlineSupport() {
+    try {
+      const div = document.createElement("div");
+      div.style.border = ".5px solid transparent";
+      div.style.position = "absolute";
+      div.style.left = "-9999px";
+      document.body.appendChild(div);
+      const height = div.offsetHeight;
+      document.body.removeChild(div);
+      return { suspicious: height === 0, offsetHeight: height };
+    } catch (_e) {
+      return { suspicious: false, offsetHeight: -1 };
+    }
+  }
+  /**
+   * Additional automation framework globals.
+   */
+  checkExtraFrameworks() {
+    const found = [];
+    try {
+      const ext = window.external;
+      if (ext && typeof ext.toString === "function") {
+        try {
+          const extStr = ext.toString();
+          if (/Sequentum/i.test(extStr)) found.push("sequentum");
+        } catch (_e) {
+        }
+      }
+      const webdriverKeys = [
+        "__webdriver_script_fn",
+        "__webdriver_script_func",
+        "__webdriver_evaluate",
+        "__selenium_evaluate",
+        "__fxdriver_evaluate",
+        "__driver_evaluate",
+        "__webdriver_unwrapped",
+        "__selenium_unwrapped",
+        "__fxdriver_unwrapped",
+        "__driver_unwrapped",
+        "_Selenium_IDE_Recorder",
+        "_selenium",
+        "calledSelenium",
+        "_WEBDRIVER_ELEM_CACHE",
+        "ChromeDriverw",
+        "driver-hierarchical",
+        "__$webdriverAsyncExecutor",
+        "__lastWatirAlert",
+        "__lastWatirConfirm",
+        "__lastWatirPrompt",
+        "_WEBDRIVER_ELEM_CACHE",
+        "webdriver",
+        "_phantom",
+        "__nightmare",
+        "_selenium"
+      ];
+      for (const key of webdriverKeys) {
+        if (key in document || key in window) {
+          found.push(`global_${key}`);
+        }
+      }
+      const navKeys = Object.getOwnPropertyNames(navigator);
+      for (const key of navKeys) {
+        if (/webdriver|selenium|puppeteer|playwright|phantom/i.test(key)) {
+          found.push(`nav_${key}`);
+        }
+      }
+    } catch (_e) {
+    }
+    return found;
+  }
+  /**
+   * CDP detection within WebWorker context.
+   * Same getter-trap technique but inside a Worker where it's harder to intercept.
+   */
+  checkWorkerCDP() {
+    return new Promise((resolve) => {
+      try {
+        const workerCode = `
+                    self.onmessage = function() {
+                        var detected = false;
+                        try {
+                            var marker = {};
+                            Object.defineProperty(marker, 'stack', {
+                                get: function() { detected = true; return ''; }
+                            });
+                            console.debug(marker);
+                        } catch(e) {}
+                        self.postMessage({ cdp: detected });
+                    };
+                `;
+        const blob = new Blob([workerCode], { type: "application/javascript" });
+        const url = URL.createObjectURL(blob);
+        const worker = new Worker(url);
+        const timeout = setTimeout(() => {
+          worker.terminate();
+          URL.revokeObjectURL(url);
+          resolve({ suspicious: false });
+        }, 3e3);
+        worker.onmessage = (e) => {
+          clearTimeout(timeout);
+          worker.terminate();
+          URL.revokeObjectURL(url);
+          resolve({ suspicious: e.data.cdp === true });
+        };
+        worker.onerror = () => {
+          clearTimeout(timeout);
+          worker.terminate();
+          URL.revokeObjectURL(url);
+          resolve({ suspicious: false });
+        };
+        worker.postMessage("check");
+      } catch (_e) {
+        resolve({ suspicious: false });
+      }
+    });
+  }
+}
+const COOKIE_NAME = "__aie_token";
+const RENEWAL_MARGIN_MS = 5 * 60 * 1e3;
+class CrawlProtect {
+  constructor(config) {
+    __publicField(this, "config");
+    __publicField(this, "renewTimer", null);
+    __publicField(this, "verified", false);
+    this.config = config;
+  }
+  async start() {
+    const existing = this.getToken();
+    if (existing && !this.isExpired(existing)) {
+      this.verified = true;
+      this.scheduleRenewal(existing);
+      this.revealContent();
+      if (this.config.debug) ;
+      return true;
+    }
+    this.hideContent();
+    const success = await this.solveChallenge();
+    if (success) {
+      this.verified = true;
+      this.revealContent();
+    } else {
+      if (this.config.insertHoneypot) {
+        this.insertHoneypotData();
+      }
+    }
+    return success;
+  }
+  isVerified() {
+    return this.verified;
+  }
+  stop() {
+    if (this.renewTimer) {
+      clearTimeout(this.renewTimer);
+      this.renewTimer = null;
+    }
+  }
+  // ── Challenge Flow ──
+  async solveChallenge() {
+    try {
+      const challengeRes = await fetch(`${this.config.apiBase}/crawl-protect/challenge`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "x-client-id": this.config.clientId }
+      });
+      if (!challengeRes.ok) return false;
+      const { id, challenges } = await challengeRes.json();
+      const solutions = [];
+      for (const ch of challenges) {
+        if (ch.type === "math") {
+          const result = ch.op === "add" ? ch.a + ch.b : ch.a * ch.b;
+          solutions.push(String(result));
+        } else if (ch.type === "crypto") {
+          const hash = await this.sha256(ch.nonce);
+          solutions.push(hash.slice(0, 8));
+        }
+      }
+      const solution = solutions.join(":");
+      const fp = await this.getFingerprint();
+      const verifyRes = await fetch(`${this.config.apiBase}/crawl-protect/verify`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "x-client-id": this.config.clientId },
+        body: JSON.stringify({ id, solution, fingerprint: fp }),
+        credentials: "include"
+        // Accept cookie
+      });
+      if (!verifyRes.ok) return false;
+      const data = await verifyRes.json();
+      if (data.success && data.token) {
+        this.setToken(data.token);
+        this.scheduleRenewal(data.token);
+        if (this.config.debug) ;
+        return true;
+      }
+      return false;
+    } catch (e) {
+      if (this.config.debug) ;
+      return false;
+    }
+  }
+  // ── Content Protection (FE-only mode) ──
+  hideContent() {
+    var _a;
+    if (!((_a = this.config.protectSelectors) == null ? void 0 : _a.length)) return;
+    for (const selector of this.config.protectSelectors) {
+      const elements = document.querySelectorAll(selector);
+      elements.forEach((el) => {
+        el.dataset.aieOrigDisplay = el.style.display;
+        el.style.display = "none";
+      });
+    }
+  }
+  revealContent() {
+    var _a;
+    if (!((_a = this.config.protectSelectors) == null ? void 0 : _a.length)) return;
+    for (const selector of this.config.protectSelectors) {
+      const elements = document.querySelectorAll(selector);
+      elements.forEach((el) => {
+        el.style.display = el.dataset.aieOrigDisplay || "";
+        delete el.dataset.aieOrigDisplay;
+      });
+    }
+  }
+  insertHoneypotData() {
+    const honeypot = document.createElement("div");
+    honeypot.style.cssText = "position:absolute;left:-9999px;top:-9999px;opacity:0;pointer-events:none;";
+    honeypot.setAttribute("aria-hidden", "true");
+    honeypot.innerHTML = `
+            <span class="price" data-aie-honeypot="1">₩999,999,999</span>
+            <span class="stock" data-aie-honeypot="1">재고: 0개</span>
+            <a href="mailto:honeypot@aientrophy.com" data-aie-honeypot="1">contact</a>
+        `;
+    document.body.appendChild(honeypot);
+  }
+  // ── Token Management ──
+  getToken() {
+    const match = document.cookie.match(new RegExp(`(?:^|; )${COOKIE_NAME}=([^;]*)`));
+    return match ? decodeURIComponent(match[1]) : null;
+  }
+  setToken(token) {
+    const expires = new Date(Date.now() + 30 * 60 * 1e3).toUTCString();
+    document.cookie = `${COOKIE_NAME}=${encodeURIComponent(token)};path=/;expires=${expires};SameSite=None;Secure`;
+  }
+  isExpired(token) {
+    try {
+      const [payloadStr] = token.split(".");
+      const payload = JSON.parse(atob(payloadStr.replace(/-/g, "+").replace(/_/g, "/")));
+      return Date.now() > payload.exp;
+    } catch {
+      return true;
+    }
+  }
+  scheduleRenewal(token) {
+    try {
+      const [payloadStr] = token.split(".");
+      const payload = JSON.parse(atob(payloadStr.replace(/-/g, "+").replace(/_/g, "/")));
+      const renewAt = payload.exp - RENEWAL_MARGIN_MS;
+      const delay = renewAt - Date.now();
+      if (delay > 0) {
+        this.renewTimer = setTimeout(() => this.solveChallenge(), delay);
+      }
+    } catch {
+    }
+  }
+  // ── Crypto Helpers ──
+  async sha256(data) {
+    const encoder = new TextEncoder();
+    const buffer = await crypto.subtle.digest("SHA-256", encoder.encode(data));
+    return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  async getFingerprint() {
+    const parts = [
+      navigator.userAgent,
+      navigator.language,
+      screen.width + "x" + screen.height,
+      Intl.DateTimeFormat().resolvedOptions().timeZone
+    ];
+    return this.sha256(parts.join("|"));
+  }
+}
 class SecuritySDK {
   constructor() {
     __publicField(this, "transmitter");
-    __publicField(this, "collector");
     __publicField(this, "behaviorCollector");
     // @ts-ignore
     __publicField(this, "rapidClickDetector");
@@ -1189,6 +2535,13 @@ class SecuritySDK {
     // @ts-ignore
     __publicField(this, "challengeHandler");
     __publicField(this, "invisibleInteraction");
+    __publicField(this, "automationDetector");
+    __publicField(this, "sessionAnalyzer");
+    __publicField(this, "tabNavigationAnalyzer");
+    __publicField(this, "cloudEnvironmentDetector");
+    __publicField(this, "crossContextDetector");
+    __publicField(this, "headlessProbeDetector");
+    __publicField(this, "crawlProtect", null);
     __publicField(this, "initialized", false);
     __publicField(this, "wasmService");
     __publicField(this, "callbackManager");
@@ -1196,7 +2549,6 @@ class SecuritySDK {
     this.wasmService = new WasmService();
     this.callbackManager = new CallbackManager();
     this.transmitter.setCallbackManager(this.callbackManager);
-    this.collector = new EventCollector(this.transmitter);
     this.behaviorCollector = new BehaviorCollector(this.transmitter);
     this.rapidClickDetector = new RapidClickDetector(this.transmitter);
     this.honeypot = new Honeypot(this.transmitter);
@@ -1204,6 +2556,12 @@ class SecuritySDK {
     this.canvasFingerprinter = new CanvasFingerprinter(this.transmitter, this.wasmService);
     this.inputTracker = new InputTracker(this.transmitter);
     this.invisibleInteraction = new InvisibleInteraction(this.transmitter);
+    this.automationDetector = new AutomationDetector(this.transmitter);
+    this.sessionAnalyzer = new SessionAnalyzer(this.transmitter);
+    this.tabNavigationAnalyzer = new TabNavigationAnalyzer(this.transmitter);
+    this.cloudEnvironmentDetector = new CloudEnvironmentDetector(this.transmitter);
+    this.crossContextDetector = new CrossContextDetector(this.transmitter);
+    this.headlessProbeDetector = new HeadlessProbeDetector(this.transmitter);
   }
   async init(config) {
     var _a, _b;
@@ -1227,13 +2585,25 @@ class SecuritySDK {
       if (devtoolsEnabled) {
         import("../anti-debug-CRuvY4WC.js").then(({ AntiDebug }) => {
           AntiDebug.start();
-          import("../console-BRZJJX1_.js").then(({ ConsoleDetector }) => {
+          import("../console-DbZZ4Ctg.js").then(({ ConsoleDetector }) => {
             new ConsoleDetector(() => {
               this.transmitter.send("devtools_open", { detected: true });
             }).start();
           });
         });
       }
+      if (config.crawlProtect) {
+        this.crawlProtect = new CrawlProtect({
+          apiBase: baseApiUrl,
+          clientId: config.clientKey,
+          protectSelectors: config.crawlProtect.protectSelectors,
+          insertHoneypot: config.crawlProtect.insertHoneypot,
+          debug: config.debug
+        });
+        this.crawlProtect.start().catch((err) => {
+          if (config.debug) ;
+        });
+      }
       this.initialized = true;
       if (config.debug) {
       }
@@ -1257,13 +2627,18 @@ class SecuritySDK {
     this.callbackManager.once(event, handler);
   }
   startDetectors() {
-    this.collector.start();
     this.behaviorCollector.start();
     this.honeypot.start();
     this.mouseTracker.start();
     this.canvasFingerprinter.start();
     this.inputTracker.start();
     this.invisibleInteraction.start();
+    this.automationDetector.start();
+    this.sessionAnalyzer.start();
+    this.tabNavigationAnalyzer.start();
+    this.cloudEnvironmentDetector.start();
+    this.crossContextDetector.start();
+    this.headlessProbeDetector.start();
   }
 }
 const securitySDK = new SecuritySDK();