@nodaro/sdk 2.25.0 → 2.27.0

package/dist/signup-signals.cjs

@@ -0,0 +1,88 @@
+'use strict';
+
+// src/signup-signals.ts
+var DEVICE_KEY_VERSION = "v1";
+var SIGNUP_SIGNALS_TIMEOUT_MS = 3e3;
+async function sha256Hex(value) {
+  try {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) return null;
+    const digest = await subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  } catch {
+    return null;
+  }
+}
+function webglRenderer() {
+  try {
+    const canvas = document.createElement("canvas");
+    const gl = canvas.getContext("webgl") ?? canvas.getContext("experimental-webgl");
+    if (!gl) return "";
+    const debugInfo = gl.getExtension("WEBGL_debug_renderer_info");
+    const renderer = debugInfo ? gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) : gl.getParameter(gl.RENDERER);
+    return typeof renderer === "string" ? renderer : "";
+  } catch {
+    return "";
+  }
+}
+function canonicalDeviceString() {
+  const nav = navigator;
+  return [
+    DEVICE_KEY_VERSION,
+    `gl=${webglRenderer()}`,
+    `hc=${nav.hardwareConcurrency ?? ""}`,
+    `dm=${nav.deviceMemory ?? ""}`,
+    `sw=${screen.width ?? ""}`,
+    `sh=${screen.height ?? ""}`,
+    `cd=${screen.colorDepth ?? ""}`,
+    `dpr=${window.devicePixelRatio ?? ""}`,
+    `pf=${nav.platform ?? ""}`,
+    `tz=${Intl.DateTimeFormat().resolvedOptions().timeZone ?? ""}`
+  ].join("|");
+}
+async function computeDeviceKey() {
+  try {
+    return await sha256Hex(canonicalDeviceString());
+  } catch {
+    return null;
+  }
+}
+async function computeBrowserKey() {
+  try {
+    const { load } = await import('@fingerprintjs/fingerprintjs');
+    const agent = await load({ monitoring: false });
+    const { visitorId } = await agent.get();
+    return visitorId ? await sha256Hex(visitorId) : null;
+  } catch {
+    return null;
+  }
+}
+async function collectSignupKeys(timeoutMs = SIGNUP_SIGNALS_TIMEOUT_MS) {
+  const keys = {};
+  let timer;
+  const settled = Promise.allSettled([
+    computeBrowserKey().then((key) => {
+      if (key) keys.browserKey = key;
+    }),
+    computeDeviceKey().then((key) => {
+      if (key) keys.deviceKey = key;
+    })
+  ]);
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(resolve, timeoutMs);
+  });
+  try {
+    await Promise.race([settled, deadline]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+  return { ...keys };
+}
+
+exports.SIGNUP_SIGNALS_TIMEOUT_MS = SIGNUP_SIGNALS_TIMEOUT_MS;
+exports.collectSignupKeys = collectSignupKeys;
+exports.computeBrowserKey = computeBrowserKey;
+exports.computeDeviceKey = computeDeviceKey;
+exports.sha256Hex = sha256Hex;
+//# sourceMappingURL=signup-signals.cjs.map
+//# sourceMappingURL=signup-signals.cjs.map

package/dist/signup-signals.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/signup-signals.ts"],"names":[],"mappings":";;;AAuBA,IAAM,kBAAA,GAAqB,IAAA;AAGpB,IAAM,yBAAA,GAA4B;AASzC,eAAsB,UAAU,KAAA,EAAuC;AACrE,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,WAAW,MAAA,EAAQ,MAAA;AAClC,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AAC7E,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CACrC,IAAI,CAAC,IAAA,KAAS,KAAK,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAChD,KAAK,EAAE,CAAA;AAAA,EACZ,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASA,SAAS,aAAA,GAAwB;AAC/B,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAM,KAAM,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,IACnC,MAAA,CAAO,WAAW,oBAAoB,CAAA;AACxC,IAAA,IAAI,CAAC,IAAI,OAAO,EAAA;AAChB,IAAA,MAAM,SAAA,GAAY,EAAA,CAAG,YAAA,CAAa,2BAA2B,CAAA;AAC7D,IAAA,MAAM,QAAA,GAAW,SAAA,GACb,EAAA,CAAG,YAAA,CAAa,SAAA,CAAU,uBAAuB,CAAA,GACjD,EAAA,CAAG,YAAA,CAAa,EAAA,CAAG,QAAQ,CAAA;AAC/B,IAAA,OAAO,OAAO,QAAA,KAAa,QAAA,GAAW,QAAA,GAAW,EAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF;AAOA,SAAS,qBAAA,GAAgC;AACvC,EAAA,MAAM,GAAA,GAAM,SAAA;AACZ,EAAA,OAAO;AAAA,IACL,kBAAA;AAAA,IACA,CAAA,GAAA,EAAM,eAAe,CAAA,CAAA;AAAA,IACrB,CAAA,GAAA,EAAM,GAAA,CAAI,mBAAA,IAAuB,EAAE,CAAA,CAAA;AAAA,IACnC,CAAA,GAAA,EAAM,GAAA,CAAI,YAAA,IAAgB,EAAE,CAAA,CAAA;AAAA,IAC5B,CAAA,GAAA,EAAM,MAAA,CAAO,KAAA,IAAS,EAAE,CAAA,CAAA;AAAA,IACxB,CAAA,GAAA,EAAM,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA,CAAA;AAAA,IACzB,CAAA,GAAA,EAAM,MAAA,CAAO,UAAA,IAAc,EAAE,CAAA,CAAA;AAAA,IAC7B,CAAA,IAAA,EAAO,MAAA,CAAO,gBAAA,IAAoB,EAAE,CAAA,CAAA;AAAA,IACpC,CAAA,GAAA,EAAM,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA,CAAA;AAAA,IACxB,MAAM,IAAA,CAAK,cAAA,GAAiB,eAAA,EAAgB,CAAE,YAAY,EAAE,CAAA;AAAA,GAC9D,CAAE,KAAK,GAAG,CAAA;AACZ;AAQA,eAAsB,gBAAA,GAA2C;AAC/D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAA,CAAU,qBAAA,EAAuB,CAAA;AAAA,EAChD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAWA,eAAsB,iBAAA,GAA4C;AAChE,EAAA,IAAI;AAGF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,8BAA8B,CAAA;AAG5D,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,EAAE,UAAA,EAAY,OAAO,CAAA;AAC9C,IAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,MAAM,GAAA,EAAI;AACtC,IAAA,OAAO,SAAA,GAAY,MAAM,SAAA,CAAU,SAAS,CAAA,GAAI,IAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOA,eAAsB,iBAAA,CAAkB,YAAoB,yBAAA,EAAgD;AAC1G,EAAA,MAAM,OAAmB,EAAC;AAC1B,EAAA,IAAI,KAAA;AACJ,EAAA,MAAM,OAAA,GAAU,QAAQ,UAAA,CAAW;AAAA,IACjC,iBAAA,EAAkB,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AAChC,MAAA,IAAI,GAAA,OAAU,UAAA,GAAa,GAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,IACD,gBAAA,EAAiB,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AAC/B,MAAA,IAAI,GAAA,OAAU,SAAA,GAAY,GAAA;AAAA,IAC5B,CAAC;AAAA,GACF,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC9C,IAAA,KAAA,GAAQ,UAAA,CAAW,SAAS,SAAS,CAAA;AAAA,EACvC,CAAC,CAAA;AACD,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,OAAA,EAAS,QAAQ,CAAC,CAAA;AAAA,EACxC,CAAA,SAAE;AACA,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,EAAE,GAAG,IAAA,EAAK;AACnB","file":"signup-signals.cjs","sourcesContent":["/**\n * The two browser signals a Nodaro app reports when it claims the free\n * signup grant (`client.credits.claimSignupGrant`) — a browser-level key\n * and a device-level key. This is the ONE implementation every Nodaro\n * surface uses, so a browser seen on one of them is recognised on all: the\n * keys are compared server-side, and two surfaces computing them differently\n * would silently stop matching each other.\n *\n * Browser-only (`document`, `screen`, `crypto.subtle`), hence its own\n * subpath (`@nodaro/sdk/signup-signals`) beside `@nodaro/sdk/supabase` —\n * the package's main entry stays Node-safe.\n *\n * Everything here fails open, on purpose. A key is a SIGNAL the server\n * scores, never a precondition: a browser that refuses to be measured must\n * still reach the claim. So nothing throws, nothing blocks past its\n * deadline, nothing is stored locally, no cookie is read, and no raw\n * component ever leaves the browser — only the digests.\n *\n * The browser key needs `@fingerprintjs/fingerprintjs` (an optional peer\n * dependency, loaded on demand); without it only the device key is sent.\n */\n\n/** Bump when the canonical shape changes — old and new keys must not collide. */\nconst DEVICE_KEY_VERSION = \"v1\"\n\n/** FingerprintJS probes canvas/audio/WebGL; first paint must not wait on it. */\nexport const SIGNUP_SIGNALS_TIMEOUT_MS = 3000\n\n/** What a claim carries. Each key is a SHA-256 hex digest, absent when it could not be computed. */\nexport interface SignupKeys {\n  browserKey?: string\n  deviceKey?: string\n}\n\n/** SHA-256 as lowercase hex, or null where SubtleCrypto is unavailable. */\nexport async function sha256Hex(value: string): Promise<string | null> {\n  try {\n    const subtle = globalThis.crypto?.subtle\n    if (!subtle) return null\n    const digest = await subtle.digest(\"SHA-256\", new TextEncoder().encode(value))\n    return Array.from(new Uint8Array(digest))\n      .map((byte) => byte.toString(16).padStart(2, \"0\"))\n      .join(\"\")\n  } catch {\n    return null\n  }\n}\n\n/**\n * The GPU string, which is the highest-entropy hardware attribute available.\n * Guarded on its own rather than with the rest: a null context is the NORMAL\n * case on a hardened browser, and it must cost only this one field instead of\n * the whole key. `WEBGL_debug_renderer_info` is being retired, so the masked\n * RENDERER is the fallback.\n */\nfunction webglRenderer(): string {\n  try {\n    const canvas = document.createElement(\"canvas\")\n    const gl = (canvas.getContext(\"webgl\") ??\n      canvas.getContext(\"experimental-webgl\")) as WebGLRenderingContext | null\n    if (!gl) return \"\"\n    const debugInfo = gl.getExtension(\"WEBGL_debug_renderer_info\")\n    const renderer = debugInfo\n      ? gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL)\n      : gl.getParameter(gl.RENDERER)\n    return typeof renderer === \"string\" ? renderer : \"\"\n  } catch {\n    return \"\"\n  }\n}\n\n/**\n * Fixed order, one labelled field each, empty where an attribute is absent —\n * so a browser that hides two of them still produces a stable key, and adding\n * a field later cannot silently re-map an existing one.\n */\nfunction canonicalDeviceString(): string {\n  const nav = navigator as Navigator & { deviceMemory?: number }\n  return [\n    DEVICE_KEY_VERSION,\n    `gl=${webglRenderer()}`,\n    `hc=${nav.hardwareConcurrency ?? \"\"}`,\n    `dm=${nav.deviceMemory ?? \"\"}`,\n    `sw=${screen.width ?? \"\"}`,\n    `sh=${screen.height ?? \"\"}`,\n    `cd=${screen.colorDepth ?? \"\"}`,\n    `dpr=${window.devicePixelRatio ?? \"\"}`,\n    `pf=${nav.platform ?? \"\"}`,\n    `tz=${Intl.DateTimeFormat().resolvedOptions().timeZone ?? \"\"}`,\n  ].join(\"|\")\n}\n\n/**\n * The per-DEVICE key: a SHA-256 over hardware-shaped attributes that survive\n * a new browser profile, an incognito window, or a cleared origin. It is\n * deliberately coarse and deliberately NOT unique — a whole model line of\n * laptop shares one. Null when it cannot be computed for any reason.\n */\nexport async function computeDeviceKey(): Promise<string | null> {\n  try {\n    return await sha256Hex(canonicalDeviceString())\n  } catch {\n    return null\n  }\n}\n\n/**\n * The browser-level key. FingerprintJS contributes software entropy the\n * hardware-only device key cannot see (fonts, codecs, engine quirks), which\n * is what makes two keys worth having.\n *\n * Its `visitorId` is a 128-bit murmur hash — 32 hex characters — and the\n * server stores a key only when it is a SHA-256 hex, so it is re-hashed\n * here. Null when the agent is not installed, cannot load, or yields nothing.\n */\nexport async function computeBrowserKey(): Promise<string | null> {\n  try {\n    // Dynamic so the ~37 KB agent is a chunk nobody downloads on a boot that\n    // has nothing to claim — and so a consumer without it still builds.\n    const { load } = await import(\"@fingerprintjs/fingerprintjs\")\n    // `monitoring: false` is mandatory: it disables FingerprintJS's own\n    // install-stats beacon to m1.openfpcdn.io.\n    const agent = await load({ monitoring: false })\n    const { visitorId } = await agent.get()\n    return visitorId ? await sha256Hex(visitorId) : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Both keys, concurrently, under one deadline. Each writes itself on\n * success, so a deadline reached while one is still running still sends the\n * other — and a browser that yields neither sends `{}`.\n */\nexport async function collectSignupKeys(timeoutMs: number = SIGNUP_SIGNALS_TIMEOUT_MS): Promise<SignupKeys> {\n  const keys: SignupKeys = {}\n  let timer: ReturnType<typeof setTimeout> | undefined\n  const settled = Promise.allSettled([\n    computeBrowserKey().then((key) => {\n      if (key) keys.browserKey = key\n    }),\n    computeDeviceKey().then((key) => {\n      if (key) keys.deviceKey = key\n    }),\n  ])\n  const deadline = new Promise<void>((resolve) => {\n    timer = setTimeout(resolve, timeoutMs)\n  })\n  try {\n    await Promise.race([settled, deadline])\n  } finally {\n    if (timer !== undefined) clearTimeout(timer)\n  }\n  return { ...keys }\n}\n"]}

package/dist/signup-signals.d.cts

@@ -0,0 +1,55 @@
+/**
+ * The two browser signals a Nodaro app reports when it claims the free
+ * signup grant (`client.credits.claimSignupGrant`) — a browser-level key
+ * and a device-level key. This is the ONE implementation every Nodaro
+ * surface uses, so a browser seen on one of them is recognised on all: the
+ * keys are compared server-side, and two surfaces computing them differently
+ * would silently stop matching each other.
+ *
+ * Browser-only (`document`, `screen`, `crypto.subtle`), hence its own
+ * subpath (`@nodaro/sdk/signup-signals`) beside `@nodaro/sdk/supabase` —
+ * the package's main entry stays Node-safe.
+ *
+ * Everything here fails open, on purpose. A key is a SIGNAL the server
+ * scores, never a precondition: a browser that refuses to be measured must
+ * still reach the claim. So nothing throws, nothing blocks past its
+ * deadline, nothing is stored locally, no cookie is read, and no raw
+ * component ever leaves the browser — only the digests.
+ *
+ * The browser key needs `@fingerprintjs/fingerprintjs` (an optional peer
+ * dependency, loaded on demand); without it only the device key is sent.
+ */
+/** FingerprintJS probes canvas/audio/WebGL; first paint must not wait on it. */
+declare const SIGNUP_SIGNALS_TIMEOUT_MS = 3000;
+/** What a claim carries. Each key is a SHA-256 hex digest, absent when it could not be computed. */
+interface SignupKeys {
+    browserKey?: string;
+    deviceKey?: string;
+}
+/** SHA-256 as lowercase hex, or null where SubtleCrypto is unavailable. */
+declare function sha256Hex(value: string): Promise<string | null>;
+/**
+ * The per-DEVICE key: a SHA-256 over hardware-shaped attributes that survive
+ * a new browser profile, an incognito window, or a cleared origin. It is
+ * deliberately coarse and deliberately NOT unique — a whole model line of
+ * laptop shares one. Null when it cannot be computed for any reason.
+ */
+declare function computeDeviceKey(): Promise<string | null>;
+/**
+ * The browser-level key. FingerprintJS contributes software entropy the
+ * hardware-only device key cannot see (fonts, codecs, engine quirks), which
+ * is what makes two keys worth having.
+ *
+ * Its `visitorId` is a 128-bit murmur hash — 32 hex characters — and the
+ * server stores a key only when it is a SHA-256 hex, so it is re-hashed
+ * here. Null when the agent is not installed, cannot load, or yields nothing.
+ */
+declare function computeBrowserKey(): Promise<string | null>;
+/**
+ * Both keys, concurrently, under one deadline. Each writes itself on
+ * success, so a deadline reached while one is still running still sends the
+ * other — and a browser that yields neither sends `{}`.
+ */
+declare function collectSignupKeys(timeoutMs?: number): Promise<SignupKeys>;
+
+export { SIGNUP_SIGNALS_TIMEOUT_MS, type SignupKeys, collectSignupKeys, computeBrowserKey, computeDeviceKey, sha256Hex };

package/dist/signup-signals.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The two browser signals a Nodaro app reports when it claims the free
+ * signup grant (`client.credits.claimSignupGrant`) — a browser-level key
+ * and a device-level key. This is the ONE implementation every Nodaro
+ * surface uses, so a browser seen on one of them is recognised on all: the
+ * keys are compared server-side, and two surfaces computing them differently
+ * would silently stop matching each other.
+ *
+ * Browser-only (`document`, `screen`, `crypto.subtle`), hence its own
+ * subpath (`@nodaro/sdk/signup-signals`) beside `@nodaro/sdk/supabase` —
+ * the package's main entry stays Node-safe.
+ *
+ * Everything here fails open, on purpose. A key is a SIGNAL the server
+ * scores, never a precondition: a browser that refuses to be measured must
+ * still reach the claim. So nothing throws, nothing blocks past its
+ * deadline, nothing is stored locally, no cookie is read, and no raw
+ * component ever leaves the browser — only the digests.
+ *
+ * The browser key needs `@fingerprintjs/fingerprintjs` (an optional peer
+ * dependency, loaded on demand); without it only the device key is sent.
+ */
+/** FingerprintJS probes canvas/audio/WebGL; first paint must not wait on it. */
+declare const SIGNUP_SIGNALS_TIMEOUT_MS = 3000;
+/** What a claim carries. Each key is a SHA-256 hex digest, absent when it could not be computed. */
+interface SignupKeys {
+    browserKey?: string;
+    deviceKey?: string;
+}
+/** SHA-256 as lowercase hex, or null where SubtleCrypto is unavailable. */
+declare function sha256Hex(value: string): Promise<string | null>;
+/**
+ * The per-DEVICE key: a SHA-256 over hardware-shaped attributes that survive
+ * a new browser profile, an incognito window, or a cleared origin. It is
+ * deliberately coarse and deliberately NOT unique — a whole model line of
+ * laptop shares one. Null when it cannot be computed for any reason.
+ */
+declare function computeDeviceKey(): Promise<string | null>;
+/**
+ * The browser-level key. FingerprintJS contributes software entropy the
+ * hardware-only device key cannot see (fonts, codecs, engine quirks), which
+ * is what makes two keys worth having.
+ *
+ * Its `visitorId` is a 128-bit murmur hash — 32 hex characters — and the
+ * server stores a key only when it is a SHA-256 hex, so it is re-hashed
+ * here. Null when the agent is not installed, cannot load, or yields nothing.
+ */
+declare function computeBrowserKey(): Promise<string | null>;
+/**
+ * Both keys, concurrently, under one deadline. Each writes itself on
+ * success, so a deadline reached while one is still running still sends the
+ * other — and a browser that yields neither sends `{}`.
+ */
+declare function collectSignupKeys(timeoutMs?: number): Promise<SignupKeys>;
+
+export { SIGNUP_SIGNALS_TIMEOUT_MS, type SignupKeys, collectSignupKeys, computeBrowserKey, computeDeviceKey, sha256Hex };

package/dist/signup-signals.js

@@ -0,0 +1,82 @@
+// src/signup-signals.ts
+var DEVICE_KEY_VERSION = "v1";
+var SIGNUP_SIGNALS_TIMEOUT_MS = 3e3;
+async function sha256Hex(value) {
+  try {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) return null;
+    const digest = await subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  } catch {
+    return null;
+  }
+}
+function webglRenderer() {
+  try {
+    const canvas = document.createElement("canvas");
+    const gl = canvas.getContext("webgl") ?? canvas.getContext("experimental-webgl");
+    if (!gl) return "";
+    const debugInfo = gl.getExtension("WEBGL_debug_renderer_info");
+    const renderer = debugInfo ? gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) : gl.getParameter(gl.RENDERER);
+    return typeof renderer === "string" ? renderer : "";
+  } catch {
+    return "";
+  }
+}
+function canonicalDeviceString() {
+  const nav = navigator;
+  return [
+    DEVICE_KEY_VERSION,
+    `gl=${webglRenderer()}`,
+    `hc=${nav.hardwareConcurrency ?? ""}`,
+    `dm=${nav.deviceMemory ?? ""}`,
+    `sw=${screen.width ?? ""}`,
+    `sh=${screen.height ?? ""}`,
+    `cd=${screen.colorDepth ?? ""}`,
+    `dpr=${window.devicePixelRatio ?? ""}`,
+    `pf=${nav.platform ?? ""}`,
+    `tz=${Intl.DateTimeFormat().resolvedOptions().timeZone ?? ""}`
+  ].join("|");
+}
+async function computeDeviceKey() {
+  try {
+    return await sha256Hex(canonicalDeviceString());
+  } catch {
+    return null;
+  }
+}
+async function computeBrowserKey() {
+  try {
+    const { load } = await import('@fingerprintjs/fingerprintjs');
+    const agent = await load({ monitoring: false });
+    const { visitorId } = await agent.get();
+    return visitorId ? await sha256Hex(visitorId) : null;
+  } catch {
+    return null;
+  }
+}
+async function collectSignupKeys(timeoutMs = SIGNUP_SIGNALS_TIMEOUT_MS) {
+  const keys = {};
+  let timer;
+  const settled = Promise.allSettled([
+    computeBrowserKey().then((key) => {
+      if (key) keys.browserKey = key;
+    }),
+    computeDeviceKey().then((key) => {
+      if (key) keys.deviceKey = key;
+    })
+  ]);
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(resolve, timeoutMs);
+  });
+  try {
+    await Promise.race([settled, deadline]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+  return { ...keys };
+}
+
+export { SIGNUP_SIGNALS_TIMEOUT_MS, collectSignupKeys, computeBrowserKey, computeDeviceKey, sha256Hex };
+//# sourceMappingURL=signup-signals.js.map
+//# sourceMappingURL=signup-signals.js.map

package/dist/signup-signals.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/signup-signals.ts"],"names":[],"mappings":";AAuBA,IAAM,kBAAA,GAAqB,IAAA;AAGpB,IAAM,yBAAA,GAA4B;AASzC,eAAsB,UAAU,KAAA,EAAuC;AACrE,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,WAAW,MAAA,EAAQ,MAAA;AAClC,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AAC7E,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CACrC,IAAI,CAAC,IAAA,KAAS,KAAK,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAChD,KAAK,EAAE,CAAA;AAAA,EACZ,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASA,SAAS,aAAA,GAAwB;AAC/B,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,IAAA,MAAM,KAAM,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,IACnC,MAAA,CAAO,WAAW,oBAAoB,CAAA;AACxC,IAAA,IAAI,CAAC,IAAI,OAAO,EAAA;AAChB,IAAA,MAAM,SAAA,GAAY,EAAA,CAAG,YAAA,CAAa,2BAA2B,CAAA;AAC7D,IAAA,MAAM,QAAA,GAAW,SAAA,GACb,EAAA,CAAG,YAAA,CAAa,SAAA,CAAU,uBAAuB,CAAA,GACjD,EAAA,CAAG,YAAA,CAAa,EAAA,CAAG,QAAQ,CAAA;AAC/B,IAAA,OAAO,OAAO,QAAA,KAAa,QAAA,GAAW,QAAA,GAAW,EAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF;AAOA,SAAS,qBAAA,GAAgC;AACvC,EAAA,MAAM,GAAA,GAAM,SAAA;AACZ,EAAA,OAAO;AAAA,IACL,kBAAA;AAAA,IACA,CAAA,GAAA,EAAM,eAAe,CAAA,CAAA;AAAA,IACrB,CAAA,GAAA,EAAM,GAAA,CAAI,mBAAA,IAAuB,EAAE,CAAA,CAAA;AAAA,IACnC,CAAA,GAAA,EAAM,GAAA,CAAI,YAAA,IAAgB,EAAE,CAAA,CAAA;AAAA,IAC5B,CAAA,GAAA,EAAM,MAAA,CAAO,KAAA,IAAS,EAAE,CAAA,CAAA;AAAA,IACxB,CAAA,GAAA,EAAM,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA,CAAA;AAAA,IACzB,CAAA,GAAA,EAAM,MAAA,CAAO,UAAA,IAAc,EAAE,CAAA,CAAA;AAAA,IAC7B,CAAA,IAAA,EAAO,MAAA,CAAO,gBAAA,IAAoB,EAAE,CAAA,CAAA;AAAA,IACpC,CAAA,GAAA,EAAM,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA,CAAA;AAAA,IACxB,MAAM,IAAA,CAAK,cAAA,GAAiB,eAAA,EAAgB,CAAE,YAAY,EAAE,CAAA;AAAA,GAC9D,CAAE,KAAK,GAAG,CAAA;AACZ;AAQA,eAAsB,gBAAA,GAA2C;AAC/D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAA,CAAU,qBAAA,EAAuB,CAAA;AAAA,EAChD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAWA,eAAsB,iBAAA,GAA4C;AAChE,EAAA,IAAI;AAGF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,8BAA8B,CAAA;AAG5D,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,EAAE,UAAA,EAAY,OAAO,CAAA;AAC9C,IAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,MAAM,GAAA,EAAI;AACtC,IAAA,OAAO,SAAA,GAAY,MAAM,SAAA,CAAU,SAAS,CAAA,GAAI,IAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOA,eAAsB,iBAAA,CAAkB,YAAoB,yBAAA,EAAgD;AAC1G,EAAA,MAAM,OAAmB,EAAC;AAC1B,EAAA,IAAI,KAAA;AACJ,EAAA,MAAM,OAAA,GAAU,QAAQ,UAAA,CAAW;AAAA,IACjC,iBAAA,EAAkB,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AAChC,MAAA,IAAI,GAAA,OAAU,UAAA,GAAa,GAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,IACD,gBAAA,EAAiB,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AAC/B,MAAA,IAAI,GAAA,OAAU,SAAA,GAAY,GAAA;AAAA,IAC5B,CAAC;AAAA,GACF,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC9C,IAAA,KAAA,GAAQ,UAAA,CAAW,SAAS,SAAS,CAAA;AAAA,EACvC,CAAC,CAAA;AACD,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,OAAA,EAAS,QAAQ,CAAC,CAAA;AAAA,EACxC,CAAA,SAAE;AACA,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,EAAE,GAAG,IAAA,EAAK;AACnB","file":"signup-signals.js","sourcesContent":["/**\n * The two browser signals a Nodaro app reports when it claims the free\n * signup grant (`client.credits.claimSignupGrant`) — a browser-level key\n * and a device-level key. This is the ONE implementation every Nodaro\n * surface uses, so a browser seen on one of them is recognised on all: the\n * keys are compared server-side, and two surfaces computing them differently\n * would silently stop matching each other.\n *\n * Browser-only (`document`, `screen`, `crypto.subtle`), hence its own\n * subpath (`@nodaro/sdk/signup-signals`) beside `@nodaro/sdk/supabase` —\n * the package's main entry stays Node-safe.\n *\n * Everything here fails open, on purpose. A key is a SIGNAL the server\n * scores, never a precondition: a browser that refuses to be measured must\n * still reach the claim. So nothing throws, nothing blocks past its\n * deadline, nothing is stored locally, no cookie is read, and no raw\n * component ever leaves the browser — only the digests.\n *\n * The browser key needs `@fingerprintjs/fingerprintjs` (an optional peer\n * dependency, loaded on demand); without it only the device key is sent.\n */\n\n/** Bump when the canonical shape changes — old and new keys must not collide. */\nconst DEVICE_KEY_VERSION = \"v1\"\n\n/** FingerprintJS probes canvas/audio/WebGL; first paint must not wait on it. */\nexport const SIGNUP_SIGNALS_TIMEOUT_MS = 3000\n\n/** What a claim carries. Each key is a SHA-256 hex digest, absent when it could not be computed. */\nexport interface SignupKeys {\n  browserKey?: string\n  deviceKey?: string\n}\n\n/** SHA-256 as lowercase hex, or null where SubtleCrypto is unavailable. */\nexport async function sha256Hex(value: string): Promise<string | null> {\n  try {\n    const subtle = globalThis.crypto?.subtle\n    if (!subtle) return null\n    const digest = await subtle.digest(\"SHA-256\", new TextEncoder().encode(value))\n    return Array.from(new Uint8Array(digest))\n      .map((byte) => byte.toString(16).padStart(2, \"0\"))\n      .join(\"\")\n  } catch {\n    return null\n  }\n}\n\n/**\n * The GPU string, which is the highest-entropy hardware attribute available.\n * Guarded on its own rather than with the rest: a null context is the NORMAL\n * case on a hardened browser, and it must cost only this one field instead of\n * the whole key. `WEBGL_debug_renderer_info` is being retired, so the masked\n * RENDERER is the fallback.\n */\nfunction webglRenderer(): string {\n  try {\n    const canvas = document.createElement(\"canvas\")\n    const gl = (canvas.getContext(\"webgl\") ??\n      canvas.getContext(\"experimental-webgl\")) as WebGLRenderingContext | null\n    if (!gl) return \"\"\n    const debugInfo = gl.getExtension(\"WEBGL_debug_renderer_info\")\n    const renderer = debugInfo\n      ? gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL)\n      : gl.getParameter(gl.RENDERER)\n    return typeof renderer === \"string\" ? renderer : \"\"\n  } catch {\n    return \"\"\n  }\n}\n\n/**\n * Fixed order, one labelled field each, empty where an attribute is absent —\n * so a browser that hides two of them still produces a stable key, and adding\n * a field later cannot silently re-map an existing one.\n */\nfunction canonicalDeviceString(): string {\n  const nav = navigator as Navigator & { deviceMemory?: number }\n  return [\n    DEVICE_KEY_VERSION,\n    `gl=${webglRenderer()}`,\n    `hc=${nav.hardwareConcurrency ?? \"\"}`,\n    `dm=${nav.deviceMemory ?? \"\"}`,\n    `sw=${screen.width ?? \"\"}`,\n    `sh=${screen.height ?? \"\"}`,\n    `cd=${screen.colorDepth ?? \"\"}`,\n    `dpr=${window.devicePixelRatio ?? \"\"}`,\n    `pf=${nav.platform ?? \"\"}`,\n    `tz=${Intl.DateTimeFormat().resolvedOptions().timeZone ?? \"\"}`,\n  ].join(\"|\")\n}\n\n/**\n * The per-DEVICE key: a SHA-256 over hardware-shaped attributes that survive\n * a new browser profile, an incognito window, or a cleared origin. It is\n * deliberately coarse and deliberately NOT unique — a whole model line of\n * laptop shares one. Null when it cannot be computed for any reason.\n */\nexport async function computeDeviceKey(): Promise<string | null> {\n  try {\n    return await sha256Hex(canonicalDeviceString())\n  } catch {\n    return null\n  }\n}\n\n/**\n * The browser-level key. FingerprintJS contributes software entropy the\n * hardware-only device key cannot see (fonts, codecs, engine quirks), which\n * is what makes two keys worth having.\n *\n * Its `visitorId` is a 128-bit murmur hash — 32 hex characters — and the\n * server stores a key only when it is a SHA-256 hex, so it is re-hashed\n * here. Null when the agent is not installed, cannot load, or yields nothing.\n */\nexport async function computeBrowserKey(): Promise<string | null> {\n  try {\n    // Dynamic so the ~37 KB agent is a chunk nobody downloads on a boot that\n    // has nothing to claim — and so a consumer without it still builds.\n    const { load } = await import(\"@fingerprintjs/fingerprintjs\")\n    // `monitoring: false` is mandatory: it disables FingerprintJS's own\n    // install-stats beacon to m1.openfpcdn.io.\n    const agent = await load({ monitoring: false })\n    const { visitorId } = await agent.get()\n    return visitorId ? await sha256Hex(visitorId) : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Both keys, concurrently, under one deadline. Each writes itself on\n * success, so a deadline reached while one is still running still sends the\n * other — and a browser that yields neither sends `{}`.\n */\nexport async function collectSignupKeys(timeoutMs: number = SIGNUP_SIGNALS_TIMEOUT_MS): Promise<SignupKeys> {\n  const keys: SignupKeys = {}\n  let timer: ReturnType<typeof setTimeout> | undefined\n  const settled = Promise.allSettled([\n    computeBrowserKey().then((key) => {\n      if (key) keys.browserKey = key\n    }),\n    computeDeviceKey().then((key) => {\n      if (key) keys.deviceKey = key\n    }),\n  ])\n  const deadline = new Promise<void>((resolve) => {\n    timer = setTimeout(resolve, timeoutMs)\n  })\n  try {\n    await Promise.race([settled, deadline])\n  } finally {\n    if (timer !== undefined) clearTimeout(timer)\n  }\n  return { ...keys }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodaro/sdk",
-  "version": "2.25.0",
+  "version": "2.27.0",
   "description": "Typed REST client for the Nodaro API — workflows, jobs, executions, apps, characters, and more.",
   "type": "module",
   "license": "Apache-2.0",
@@ -24,10 +24,16 @@
       "types": "./dist/supabase-browser.d.ts",
       "import": "./dist/supabase-browser.js",
       "require": "./dist/supabase-browser.cjs"
+    },
+    "./signup-signals": {
+      "types": "./dist/signup-signals.d.ts",
+      "import": "./dist/signup-signals.js",
+      "require": "./dist/signup-signals.cjs"
     }
   },
   "files": [
     "dist",
+    "!dist/metafile-*.json",
     "README.md",
     "LICENSE"
   ],
@@ -41,14 +47,18 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@nodaro/shared": "^3.29.0",
-    "@nodaro/prompts": "^1.37.1"
+    "@nodaro/shared": "^3.32.0",
+    "@nodaro/prompts": "^1.38.0"
   },
   "peerDependencies": {
+    "@fingerprintjs/fingerprintjs": "^5.2.0",
     "@supabase/ssr": "^0.12.3",
     "@supabase/supabase-js": "^2.110.5"
   },
   "peerDependenciesMeta": {
+    "@fingerprintjs/fingerprintjs": {
+      "optional": true
+    },
     "@supabase/ssr": {
       "optional": true
     },
@@ -57,6 +67,7 @@
     }
   },
   "devDependencies": {
+    "@fingerprintjs/fingerprintjs": "5.2.0",
     "@vitest/coverage-v8": "^4.1.2",
     "tsup": "^8.5.0",
     "typescript": "^5.7.3",