@prosopo/fingerprint 2.7.18 → 2.7.19

package/dist/index.js

@@ -1,61 +1,40 @@
-import { buildFingerprintProofFromComponents } from "./proof.js";
-import { FINGERPRINT_DISCLOSURE_KEYS, FINGERPRINT_PROOF_VERSION, encodeFingerprintProof, leafHashForContent, verifyFingerprintProofStructure } from "./proof.js";
+import "./_virtual/_rolldown/runtime.js";
 import { buildMerkleLayers, hashMerklePair, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof } from "./merkle.js";
-const EXCLUDED_SOURCES = ["webGlExtensions"];
-const FingerprintJSImport = async () => import("@prosopo/fingerprintjs");
-let componentsCache = null;
-const loadComponents = () => {
-  if (!componentsCache) {
-    const pending = (async () => {
-      const { sources, loadSources, prepareForSources } = await FingerprintJSImport();
-      await prepareForSources();
-      const sourceOptions = {
-        cache: {}
-      };
-      const getComponents = loadSources(
-        sources,
-        sourceOptions,
-        EXCLUDED_SOURCES
-      );
-      return getComponents();
-    })();
-    componentsCache = pending;
-    pending.catch(() => {
-      if (componentsCache === pending) {
-        componentsCache = null;
-      }
-    });
-  }
-  return componentsCache;
+import { FINGERPRINT_DISCLOSURE_KEYS, FINGERPRINT_PROOF_VERSION, buildFingerprintProofFromComponents, encodeFingerprintProof, leafHashForContent, verifyFingerprintProofStructure } from "./proof.js";
+//#region src/index.ts
+var EXCLUDED_SOURCES = ["webGlExtensions"];
+var FingerprintJSImport = async () => import("@prosopo/fingerprintjs");
+var componentsCache = null;
+var loadComponents = () => {
+	if (!componentsCache) {
+		const pending = (async () => {
+			const { sources, loadSources, prepareForSources } = await FingerprintJSImport();
+			await prepareForSources();
+			return loadSources(sources, { cache: {} }, EXCLUDED_SOURCES)();
+		})();
+		componentsCache = pending;
+		pending.catch(() => {
+			if (componentsCache === pending) componentsCache = null;
+		});
+	}
+	return componentsCache;
 };
-const getFingerprint = async () => {
-  const [{ hashComponents }, components] = await Promise.all([
-    FingerprintJSImport(),
-    loadComponents()
-  ]);
-  return hashComponents(components);
+var getFingerprint = async () => {
+	const [{ hashComponents }, components] = await Promise.all([FingerprintJSImport(), loadComponents()]);
+	return hashComponents(components);
 };
-const getFingerprintProof = async (discloseKeys) => {
-  const components = await loadComponents();
-  return buildFingerprintProofFromComponents(components, discloseKeys);
+/**
+* Produce a proof of fingerprint: a Merkle commitment to the full component set
+* plus a selective disclosure of the requested components. Callers should pass
+* {@link FINGERPRINT_DISCLOSURE_KEYS} — omitting `discloseKeys` discloses every
+* component, which produces a very large payload. Derived from the same
+* component run as {@link getFingerprint}.
+*/
+var getFingerprintProof = async (discloseKeys) => {
+	return buildFingerprintProofFromComponents(await loadComponents(), discloseKeys);
 };
-const prefetchFingerprint = () => {
-  loadComponents().catch(() => {
-  });
-};
-export {
-  FINGERPRINT_DISCLOSURE_KEYS,
-  FINGERPRINT_PROOF_VERSION,
-  buildFingerprintProofFromComponents,
-  buildMerkleLayers,
-  encodeFingerprintProof,
-  getFingerprint,
-  getFingerprintProof,
-  hashMerklePair,
-  leafHashForContent,
-  merkleProofFromLayers,
-  merkleRootFromLayers,
-  prefetchFingerprint,
-  verifyFingerprintProofStructure,
-  verifyMerkleProof
+var prefetchFingerprint = () => {
+	loadComponents().catch(() => {});
 };
+//#endregion
+export { FINGERPRINT_DISCLOSURE_KEYS, FINGERPRINT_PROOF_VERSION, buildFingerprintProofFromComponents, buildMerkleLayers, encodeFingerprintProof, getFingerprint, getFingerprintProof, hashMerklePair, leafHashForContent, merkleProofFromLayers, merkleRootFromLayers, prefetchFingerprint, verifyFingerprintProofStructure, verifyMerkleProof };

package/dist/merkle.js

@@ -1,83 +1,69 @@
 import { hexHashArray } from "@prosopo/util-crypto";
-const at = (arr, index) => {
-  const value = arr[index];
-  if (value === void 0) {
-    throw new Error(
-      `merkle: index ${index} out of range (length ${arr.length})`
-    );
-  }
-  return value;
+//#region src/merkle.ts
+var at = (arr, index) => {
+	const value = arr[index];
+	if (value === void 0) throw new Error(`merkle: index ${index} out of range (length ${arr.length})`);
+	return value;
 };
-const hashMerklePair = (left, right) => hexHashArray([left, right]);
-const buildMerkleLayers = (leafHashes) => {
-  if (leafHashes.length === 0) {
-    throw new Error("merkle: cannot build a tree with no leaves");
-  }
-  const layers = [[...leafHashes]];
-  let current = leafHashes;
-  while (current.length > 1) {
-    const next = [];
-    for (let i = 0; i < current.length; i += 2) {
-      const left = at(current, i);
-      const right = i + 1 < current.length ? at(current, i + 1) : left;
-      next.push(hashMerklePair(left, right));
-    }
-    layers.push(next);
-    current = next;
-  }
-  return layers;
+/** Hash a pair of child hashes into their parent. */
+var hashMerklePair = (left, right) => hexHashArray([left, right]);
+/**
+* Build every layer of the Merkle tree, bottom-up. Layer 0 is the leaf hashes,
+* the final layer is `[root]`. An odd node at the end of a layer is paired with
+* itself.
+*/
+var buildMerkleLayers = (leafHashes) => {
+	if (leafHashes.length === 0) throw new Error("merkle: cannot build a tree with no leaves");
+	const layers = [[...leafHashes]];
+	let current = leafHashes;
+	while (current.length > 1) {
+		const next = [];
+		for (let i = 0; i < current.length; i += 2) {
+			const left = at(current, i);
+			const right = i + 1 < current.length ? at(current, i + 1) : left;
+			next.push(hashMerklePair(left, right));
+		}
+		layers.push(next);
+		current = next;
+	}
+	return layers;
 };
-const merkleRootFromLayers = (layers) => at(at(layers, layers.length - 1), 0);
-const merkleProofFromLayers = (layers, leafHash) => {
-  const proof = [];
-  let hash = leafHash;
-  for (let layerNum = 0; layerNum < layers.length - 1; layerNum++) {
-    const layer = at(layers, layerNum);
-    const index = layer.indexOf(hash);
-    if (index === -1) {
-      throw new Error("merkle: leaf hash not present in layer");
-    }
-    let partnerIndex = index % 2 === 1 ? index - 1 : index + 1;
-    if (partnerIndex > layer.length - 1) {
-      partnerIndex = index;
-    }
-    const partner = at(layer, partnerIndex);
-    const pair = partnerIndex > index ? [hash, partner] : [partner, hash];
-    proof.push(pair);
-    hash = hashMerklePair(pair[0], pair[1]);
-  }
-  return [...proof, [merkleRootFromLayers(layers)]];
+var merkleRootFromLayers = (layers) => at(at(layers, layers.length - 1), 0);
+/** Produce the sibling path proving `leafHash` belongs to the tree. */
+var merkleProofFromLayers = (layers, leafHash) => {
+	const proof = [];
+	let hash = leafHash;
+	for (let layerNum = 0; layerNum < layers.length - 1; layerNum++) {
+		const layer = at(layers, layerNum);
+		const index = layer.indexOf(hash);
+		if (index === -1) throw new Error("merkle: leaf hash not present in layer");
+		let partnerIndex = index % 2 === 1 ? index - 1 : index + 1;
+		if (partnerIndex > layer.length - 1) partnerIndex = index;
+		const partner = at(layer, partnerIndex);
+		const pair = partnerIndex > index ? [hash, partner] : [partner, hash];
+		proof.push(pair);
+		hash = hashMerklePair(pair[0], pair[1]);
+	}
+	return [...proof, [merkleRootFromLayers(layers)]];
 };
-const verifyMerkleProof = (leafHash, proof) => {
-  try {
-    const firstLayer = proof[0];
-    if (firstLayer === void 0 || firstLayer.indexOf(leafHash) === -1) {
-      return false;
-    }
-    if (proof.length === 1) {
-      return at(firstLayer, 0) === leafHash;
-    }
-    const root = at(at(proof, proof.length - 1), 0);
-    let hash = leafHash;
-    for (let i = 0; i < proof.length - 1; i++) {
-      const layer = at(proof, i);
-      if (layer.indexOf(hash) === -1) {
-        return false;
-      }
-      hash = hashMerklePair(at(layer, 0), at(layer, 1));
-      if (at(proof, i + 1).indexOf(hash) === -1) {
-        return false;
-      }
-    }
-    return hash === root;
-  } catch {
-    return false;
-  }
-};
-export {
-  buildMerkleLayers,
-  hashMerklePair,
-  merkleProofFromLayers,
-  merkleRootFromLayers,
-  verifyMerkleProof
+/** Verify a leaf + sibling path recomputes to the proof's embedded root. */
+var verifyMerkleProof = (leafHash, proof) => {
+	try {
+		const firstLayer = proof[0];
+		if (firstLayer === void 0 || firstLayer.indexOf(leafHash) === -1) return false;
+		if (proof.length === 1) return at(firstLayer, 0) === leafHash;
+		const root = at(at(proof, proof.length - 1), 0);
+		let hash = leafHash;
+		for (let i = 0; i < proof.length - 1; i++) {
+			const layer = at(proof, i);
+			if (layer.indexOf(hash) === -1) return false;
+			hash = hashMerklePair(at(layer, 0), at(layer, 1));
+			if (at(proof, i + 1).indexOf(hash) === -1) return false;
+		}
+		return hash === root;
+	} catch {
+		return false;
+	}
 };
+//#endregion
+export { buildMerkleLayers, hashMerklePair, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof };

package/dist/proof.js

@@ -1,84 +1,96 @@
+import { buildMerkleLayers, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof } from "./merkle.js";
 import { hexHash } from "@prosopo/util-crypto";
-import { buildMerkleLayers, merkleRootFromLayers, merkleProofFromLayers, verifyMerkleProof } from "./merkle.js";
-const FINGERPRINT_PROOF_VERSION = 1;
-const FINGERPRINT_DISCLOSURE_KEYS = [
-  "colorDepth",
-  "cookiesEnabled",
-  "sessionStorage",
-  "localStorage",
-  "timezone",
-  "hardwareConcurrency",
-  "languages",
-  "architecture"
+//#region src/proof.ts
+var FINGERPRINT_PROOF_VERSION = 1;
+/**
+* The fixed set of components the client discloses in a proof of fingerprint.
+* Disclosing every component (the previous default) made the proof enormous —
+* each disclosure carries a full Merkle path and its raw value, and components
+* like webgl/audio/fonts have very large values. Selective disclosure keeps the
+* commitment (`root`) over the whole component set while only these cheap,
+* stable scalar components carry a path + value, shrinking the payload ~10x.
+*
+* The provider-side validator's bounds MUST be a subset of these keys: a bounded
+* key that isn't disclosed would always fail validation as `missing:<key>`.
+*/
+var FINGERPRINT_DISCLOSURE_KEYS = [
+	"colorDepth",
+	"cookiesEnabled",
+	"sessionStorage",
+	"localStorage",
+	"timezone",
+	"hardwareConcurrency",
+	"languages",
+	"architecture"
 ];
-const escapeKey = (key) => key.replace(/([:|\\])/g, "\\$1");
-const componentLeafContent = (key, component) => {
-  const serialized = "error" in component ? "error" : JSON.stringify(component.value);
-  return `${escapeKey(key)}:${serialized}`;
+var escapeKey = (key) => key.replace(/([:|\\])/g, "\\$1");
+var componentLeafContent = (key, component) => {
+	const serialized = "error" in component ? "error" : JSON.stringify(component.value);
+	return `${escapeKey(key)}:${serialized}`;
 };
-const disclosureLeafContent = (disclosure) => {
-  const serialized = disclosure.error ? "error" : JSON.stringify(disclosure.value);
-  return `${escapeKey(disclosure.key)}:${serialized}`;
+var disclosureLeafContent = (disclosure) => {
+	const serialized = disclosure.error ? "error" : JSON.stringify(disclosure.value);
+	return `${escapeKey(disclosure.key)}:${serialized}`;
 };
-const leafHashForContent = (content) => hexHash(content);
-const buildFingerprintProofFromComponents = (components, discloseKeys) => {
-  const keys = Object.keys(components).sort();
-  if (keys.length === 0) {
-    throw new Error("fingerprint proof: no components to commit to");
-  }
-  const leafHashes = keys.map((key) => {
-    const component = components[key];
-    if (component === void 0) {
-      throw new Error(`fingerprint proof: missing component ${key}`);
-    }
-    return leafHashForContent(componentLeafContent(key, component));
-  });
-  const layers = buildMerkleLayers(leafHashes);
-  const root = merkleRootFromLayers(layers);
-  const disclose = discloseKeys ?? keys;
-  const disclosures = [];
-  for (const key of disclose) {
-    const index = keys.indexOf(key);
-    if (index === -1) {
-      continue;
-    }
-    const component = components[key];
-    const leafHash = leafHashes[index];
-    if (component === void 0 || leafHash === void 0) {
-      continue;
-    }
-    const proof = merkleProofFromLayers(layers, leafHash);
-    disclosures.push(
-      "error" in component ? { key, error: true, proof } : { key, value: component.value, proof }
-    );
-  }
-  return { v: FINGERPRINT_PROOF_VERSION, root, disclosures };
+var leafHashForContent = (content) => hexHash(content);
+/**
+* Build a {@link FingerprintProof} from an already-resolved FingerprintJS
+* components map. The commitment always covers every component (in sorted key
+* order); `discloseKeys` selects which components are revealed (defaulting to
+* all). Keys that are not present in the fingerprint are skipped — a validator
+* should treat an expected-but-absent disclosure as a failure.
+*/
+var buildFingerprintProofFromComponents = (components, discloseKeys) => {
+	const keys = Object.keys(components).sort();
+	if (keys.length === 0) throw new Error("fingerprint proof: no components to commit to");
+	const leafHashes = keys.map((key) => {
+		const component = components[key];
+		if (component === void 0) throw new Error(`fingerprint proof: missing component ${key}`);
+		return leafHashForContent(componentLeafContent(key, component));
+	});
+	const layers = buildMerkleLayers(leafHashes);
+	const root = merkleRootFromLayers(layers);
+	const disclose = discloseKeys ?? keys;
+	const disclosures = [];
+	for (const key of disclose) {
+		const index = keys.indexOf(key);
+		if (index === -1) continue;
+		const component = components[key];
+		const leafHash = leafHashes[index];
+		if (component === void 0 || leafHash === void 0) continue;
+		const proof = merkleProofFromLayers(layers, leafHash);
+		disclosures.push("error" in component ? {
+			key,
+			error: true,
+			proof
+		} : {
+			key,
+			value: component.value,
+			proof
+		});
+	}
+	return {
+		v: 1,
+		root,
+		disclosures
+	};
 };
-const verifyFingerprintProofStructure = (proof) => {
-  if (proof.v !== FINGERPRINT_PROOF_VERSION) {
-    return false;
-  }
-  if (typeof proof.root !== "string" || proof.disclosures.length === 0) {
-    return false;
-  }
-  for (const disclosure of proof.disclosures) {
-    const leafHash = leafHashForContent(disclosureLeafContent(disclosure));
-    if (!verifyMerkleProof(leafHash, disclosure.proof)) {
-      return false;
-    }
-    const rootLayer = disclosure.proof[disclosure.proof.length - 1];
-    if (rootLayer === void 0 || rootLayer[0] !== proof.root) {
-      return false;
-    }
-  }
-  return true;
-};
-const encodeFingerprintProof = (proof) => JSON.stringify(proof);
-export {
-  FINGERPRINT_DISCLOSURE_KEYS,
-  FINGERPRINT_PROOF_VERSION,
-  buildFingerprintProofFromComponents,
-  encodeFingerprintProof,
-  leafHashForContent,
-  verifyFingerprintProofStructure
+/**
+* Structural verification of a proof: every disclosed `(key, value)` re-hashes
+* to a leaf that is proven to belong to the single committed `root`. This is
+* the non-secret half of validation — the value-bounding rules live in the
+* provider-side (closed-source) validator and are layered on top of this.
+*/
+var verifyFingerprintProofStructure = (proof) => {
+	if (proof.v !== 1) return false;
+	if (typeof proof.root !== "string" || proof.disclosures.length === 0) return false;
+	for (const disclosure of proof.disclosures) {
+		if (!verifyMerkleProof(leafHashForContent(disclosureLeafContent(disclosure)), disclosure.proof)) return false;
+		const rootLayer = disclosure.proof[disclosure.proof.length - 1];
+		if (rootLayer === void 0 || rootLayer[0] !== proof.root) return false;
+	}
+	return true;
 };
+var encodeFingerprintProof = (proof) => JSON.stringify(proof);
+//#endregion
+export { FINGERPRINT_DISCLOSURE_KEYS, FINGERPRINT_PROOF_VERSION, buildFingerprintProofFromComponents, encodeFingerprintProof, leafHashForContent, verifyFingerprintProofStructure };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/fingerprint",
-	"version": "2.7.18",
+	"version": "2.7.19",
 	"description": "Provider fingerprint",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -38,13 +38,13 @@
 	"homepage": "https://github.com/prosopo/captcha#readme",
 	"dependencies": {
 		"@prosopo/fingerprintjs": "5.2.0",
-		"@prosopo/types": "4.9.12",
+		"@prosopo/types": "4.10.0",
 		"@prosopo/util-crypto": "13.5.30"
 	},
 	"devDependencies": {
-		"@prosopo/config": "3.3.4",
+		"@prosopo/config": "3.3.5",
 		"@types/node": "22.10.2",
-		"@vitest/coverage-v8": "3.2.4",
+		"@vitest/coverage-v8": "4.1.10",
 		"concurrently": "9.0.1",
 		"del-cli": "6.0.0",
 		"npm-run-all": "4.1.5",
@@ -52,8 +52,8 @@
 		"tslib": "2.7.0",
 		"tsx": "4.20.3",
 		"typescript": "5.6.2",
-		"vite": "6.4.1",
-		"vitest": "3.2.4"
+		"vite": "8.1.5",
+		"vitest": "4.1.10"
 	},
 	"sideEffects": false
 }