@stopnetic/js 0.1.4 → 0.1.5

package/README.md

@@ -1,5 +1,11 @@
 # @stopnetic/js - JavaScript and TypeScript website guard
 
+Repository increment after0.1.4: optional `diagnostics: true` and
+`connectionInsights: 'vercel'` add correlated references and daily scoped JA4
+observations. Server helpers read `STOPNETIC_DIAGNOSTICS` and
+`STOPNETIC_CONNECTION_INSIGHTS`. Defaults false/none; matching service/new SDK
+required. [Configuration and measurement guide](../../docs/request-monitoring.md).
+
 Experimental repository increment: `interactionTrap: 'monitor' | 'block'` adds a
 server-backed hidden-action observation. Default off; requires the matching new
 service and SDK release after 0.1.3. Server helpers also read

package/dist/guard.d.ts

@@ -30,6 +30,12 @@ export type StopneticOptions = {
    * off. Monitor records explicit activation; block withholds that bound session.
    * Requires matching service; ignoring the action never proves human identity. */
   interactionTrap?: 'off' | 'monitor' | 'block';
+  /** Opt-in short-lived trace/request references on guard responses and events.
+   * These are diagnostic labels, never access credentials. Default false. */
+  diagnostics?: boolean;
+  /** Observe a configured Vercel JA4 header as a daily, installation-scoped keyed
+   * group. No raw fingerprint/IP is sent. Missing data never selects a denial. */
+  connectionInsights?: 'none' | 'vercel';
   /** Optional coarse request analytics. No raw visitor IP or user-agent is sent. */
   trafficInsights?: boolean;
   /** Opt into country controls; requires trusted countrySource and no publicPaths. */
@@ -43,7 +49,10 @@ export type StopneticOptions = {
 export function parseAdditionalDecisionPublicKeys(value?: string): string[];
 export function createStopnetic(options: StopneticOptions): {
   /** Local configured capability declaration, not a deployment attestation. */
-  readonly capabilities: { readonly approvedAccountGate: boolean; readonly botProtocol: 2; readonly interactionTrapProtocol: 1 };
+  readonly capabilities: { readonly approvedAccountGate: boolean; readonly botProtocol: 2; readonly interactionTrapProtocol: 1; readonly monitoringProtocol: 1 };
   check(request: Request): Promise<Response | null>;
   verify(request: Request): Promise<Response>;
+  /** References for this exact Request after check/verify. Add to an allowed
+   * downstream response when using a custom Proxy; empty when diagnostics off. */
+  diagnosticHeaders(request: Request): Headers;
 };

package/dist/guard.js

@@ -5,6 +5,7 @@ import { verificationPage } from './verification-page.js';
 import { automationSignals, sameBotControl, botClientContext } from './bot-protection.js';
 import { validBotWork, verificationScript } from './browser-check.js';
 import { interactionMarkup, validateTrapDecision } from './interaction-trap.js';
+import { connectionObservation, sameMonitoring } from './request-monitoring.js';
 export { parseAdditionalDecisionPublicKeys } from './signing-keys.js';
 
 const unavailable = retryAfter => new Response(null, { status: 503, headers: {
@@ -66,7 +67,7 @@ function bootstrap(ticket, verifyPath, botProtection, challengeId, trap) {
 
 /** Pilot guard for server-side Next.js Proxy and Route Handlers. */
 export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, additionalDecisionPublicKeys = [], cookieSecret, verifyPath = '/__stopnetic/verify',
-  cookieName = 'stopnetic_pilot_session', secureCookie = true, fetchImpl = fetch, timeoutMs = 2000, publicPaths = [], reportEvents = true, guardMode = 'selected', trafficInsights = false, countrySource = 'none', countryBlocking = false, botProtection = 'off', botClientSource = 'none', interactionTrap = 'off', requireApprovedAccount = false, authorizeVisitor }) {
+  cookieName = 'stopnetic_pilot_session', secureCookie = true, fetchImpl = fetch, timeoutMs = 2000, publicPaths = [], reportEvents = true, guardMode = 'selected', trafficInsights = false, countrySource = 'none', countryBlocking = false, botProtection = 'off', botClientSource = 'none', interactionTrap = 'off', diagnostics = false, connectionInsights = 'none', requireApprovedAccount = false, authorizeVisitor }) {
   if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(siteId || '')) throw new Error('Invalid siteId');
   const credential = typeof apiToken === 'string' ? apiToken.match(/^[a-z]{1,32}_([a-f0-9]{32})\.[A-Za-z0-9_-]{43}$/) : null;
   if (!credential) throw new Error('apiToken must be an issued installation key');
@@ -84,6 +85,8 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
   if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 10000) throw new Error('Invalid timeoutMs');
   if (typeof reportEvents !== 'boolean') throw new Error('Invalid reportEvents');
   if (typeof trafficInsights !== 'boolean') throw new Error('Invalid trafficInsights');
+  if (typeof diagnostics !== 'boolean') throw new Error('Invalid diagnostics');
+  if (!['none', 'vercel'].includes(connectionInsights)) throw new Error('Invalid connectionInsights');
   if (!['none', 'vercel', 'cloudflare'].includes(countrySource)) throw new Error('Invalid countrySource');
   if (!Array.isArray(publicPaths) || publicPaths.some(path => typeof path !== 'string' || !/^\/[a-zA-Z0-9_\-/.]*(?:\*)?$/.test(path))) throw new Error('Invalid publicPaths');
   if (!['selected', 'site'].includes(guardMode)) throw new Error('Invalid guardMode');
@@ -104,6 +107,41 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
   const eventsEndpoint = new URL('./events', endpoint);
   const browserCookieName = `${cookieName}_browser`;
   const installation = hash(apiToken);
+  const requestMonitoring = new WeakMap();
+
+  function startMonitoring(request) {
+    if (!diagnostics && connectionInsights === 'none') return;
+    const session = validSession(request);
+    const previous = session?.diagnostic_trace;
+    const trace = /^[A-Za-z0-9_-]{22}$/.test(previous || '') ? previous
+      : session?.challenge_id ? createHmac('sha256', cookieSecret)
+        .update(`stopnetic-trace-v1:${siteId}:${installationId}:${session.challenge_id}`).digest('base64url').slice(0, 22)
+        : randomBytes(16).toString('base64url');
+    const connection = connectionObservation(request, connectionInsights, cookieSecret, `${siteId}:${installationId}`);
+    requestMonitoring.set(request, { request_id: randomBytes(16).toString('base64url'), validated: false,
+      monitoring_context: { version: 1, ...(diagnostics ? { trace_id: trace } : {}), ...(connection ? { connection } : {}) } });
+  }
+
+  function monitoringInput(request) {
+    const state = requestMonitoring.get(request);
+    return state ? { request_id: state.request_id, monitoring_context: state.monitoring_context } : {};
+  }
+
+  function diagnosticHeaders(request) {
+    const headers = new Headers();
+    const state = requestMonitoring.get(request);
+    if (diagnostics && state) {
+      headers.set('x-stopnetic-request-id', state.request_id);
+      headers.set('x-stopnetic-trace-id', state.monitoring_context.trace_id);
+      headers.set('x-stopnetic-diagnostic-status', state.validated ? 'decision-validated' : 'no-validated-decision');
+    }
+    return headers;
+  }
+
+  function diagnosticResponse(request, response) {
+    if (response) diagnosticHeaders(request).forEach((value, name) => response.headers.set(name, value));
+    return response;
+  }
 
   function browserBinding(request) {
     const payload = verified(cookieValue(request, browserCookieName), cookieSecret);
@@ -116,7 +154,7 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
   }
 
   async function remote(purpose, input) {
-    const context = { site_id: siteId, path: input.path, method: input.method, request_id: randomBytes(16).toString('base64url') };
+    const context = { site_id: siteId, path: input.path, method: input.method, request_id: input.request_id || randomBytes(16).toString('base64url') };
     const response = await fetchImpl(purpose === 'decision' ? endpoint : verifyEndpoint, {
       method: 'POST', signal: AbortSignal.timeout(timeoutMs), redirect: 'error',
       headers: { authorization: `Bearer ${apiToken}`, 'content-type': 'application/json' },
@@ -138,6 +176,7 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
       || !Number.isSafeInteger(payload.issued_at) || !Number.isSafeInteger(payload.expires_at)
       || payload.issued_at > now + 5000 || payload.expires_at <= now || payload.expires_at <= payload.issued_at
       || payload.expires_at - payload.issued_at > 30_000) throw new Error('Invalid decision context or expiry');
+    if (input.monitoring_context && !sameMonitoring(payload.monitoring_context, input.monitoring_context)) throw new Error('Invalid monitoring context');
     if (countryBlocking) {
       const control = payload.country_control;
       const country = payload.country_decision;
@@ -241,7 +280,7 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
     return { approved_access: { version: 1, required: true, status } };
   }
 
-  async function check(request) {
+  async function checkRequest(request) {
     const path = new URL(request.url).pathname;
     if (path === verifyPath) return null;
     if (publicPaths.some(rule => rule.endsWith('*') ? path.startsWith(rule.slice(0, -1)) : path === rule)) return null;
@@ -257,8 +296,9 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
     let policy;
     try {
       const context = trafficContext(request, trafficInsights, countrySource);
-      policy = await remote('decision', { path, method: request.method, ...countryControl(request), ...await approvedAccess(request), ...botControl(request, session?.webdriver, session?.webdriver_inconsistent, session?.webdriver_tampered), ...clientContext(request), ...trapControl(session), ...(context ? { traffic_context: context } : {}), ...(guardMode === 'site' ? { guard_mode: 'site' } : {}), ...(binding ? { browser_binding: binding } : {}),
+      policy = await remote('decision', { path, method: request.method, ...monitoringInput(request), ...countryControl(request), ...await approvedAccess(request), ...botControl(request, session?.webdriver, session?.webdriver_inconsistent, session?.webdriver_tampered), ...clientContext(request), ...trapControl(session), ...(context ? { traffic_context: context } : {}), ...(guardMode === 'site' ? { guard_mode: 'site' } : {}), ...(binding ? { browser_binding: binding } : {}),
         ...(challenge ? { session_challenge: challenge } : {}) });
+      const observed = requestMonitoring.get(request); if (observed) observed.validated = true;
     } catch (error) { return unavailable(error?.retryAfter); }
     if (!policy || !['public', 'block', 'human', 'verified', 'entitled', 'default'].includes(policy.action)) return unavailable();
     // An older service must not silently apply selected-path semantics here.
@@ -276,6 +316,7 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
       ...(botClientSource !== 'none' ? { bot_client_key: clientContext(request).bot_client.key } : {}),
       ...(botProtection !== 'off' ? { bot_mode: botProtection, bot_version: 2 } : {}),
       ...(trap ? { trap_mode: interactionTrap, trap_token: trap.token } : {}),
+      ...(diagnostics ? { diagnostic_trace: requestMonitoring.get(request).monitoring_context.trace_id } : {}),
       challenge_id: policy.challenge_id, browser_hash: hash(binding), installation }, cookieSecret);
     const response = bootstrap(ticket, verifyPath, botProtection, policy.challenge_id, trap);
     response.headers.set('set-cookie', cookie(browserCookieName, signed({ v: 1, kind: 'browser', site: siteId,
@@ -284,7 +325,7 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
     return response;
   }
 
-  async function verify(request) {
+  async function verifyRequest(request) {
     if (request.method !== 'POST') return new Response(null, { status: 405, headers: { 'cache-control': 'no-store' } });
     const origin = request.headers.get('origin');
     if (!origin) return concealed();
@@ -307,6 +348,11 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
     if (payload?.kind !== 'challenge' || payload.site !== siteId || payload.installation !== installation
       || typeof payload.path !== 'string' || !/^\/[^\s?#]*$/.test(payload.path) || !binding
       || payload.browser_hash !== hash(binding) || !/^[A-Za-z0-9_-]{43}$/.test(payload.challenge_id || '')) return concealed();
+    // Never take a flow reference from a visitor header/body field. Only this
+    // installation's authenticated ticket may link verification to a challenge.
+    if (diagnostics && /^[A-Za-z0-9_-]{22}$/.test(payload.diagnostic_trace || '')) {
+      requestMonitoring.get(request).monitoring_context.trace_id = payload.diagnostic_trace;
+    }
     if (requireApprovedAccount && payload.approval_required !== true) return concealed();
     if (interactionTrap !== 'off' && (payload.trap_mode !== interactionTrap || !/^[A-Za-z0-9_-]{43}$/.test(payload.trap_token || ''))) return concealed();
     if (interaction !== undefined && (interactionTrap === 'off' || !interaction || Object.keys(interaction).length !== 2
@@ -325,8 +371,9 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
     }
     let workVerified = false;
     try {
-      const result = await remote(interaction ? 'trap' : 'verify', { path: payload.path, method: 'POST', challenge_id: payload.challenge_id, browser_binding: binding, ...countryControl(request), ...await approvedAccess(request), ...botControl(request, browser?.webdriver, browser?.webdriverInconsistent, browser?.webdriverTampered), ...clientContext(request), ...trapControl(),
+      const result = await remote(interaction ? 'trap' : 'verify', { path: payload.path, method: 'POST', challenge_id: payload.challenge_id, browser_binding: binding, ...monitoringInput(request), ...countryControl(request), ...await approvedAccess(request), ...botControl(request, browser?.webdriver, browser?.webdriverInconsistent, browser?.webdriverTampered), ...clientContext(request), ...trapControl(),
         ...(interaction ? { trap_activation: true } : {}), ...(botProtection !== 'off' && proof ? { bot_proof: proof } : {}) });
+      const observed = requestMonitoring.get(request); if (observed) observed.validated = true;
       if (interaction || result.trap_decision?.result === 'block') {
         if (result.challenge_id !== payload.challenge_id || !['block', 'observed'].includes(result.action)) return unavailable();
         await report(result, result.action === 'block' ? 'BLOCK' : 'OBSERVED');
@@ -353,6 +400,7 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
         webdriver_inconsistent: browser.webdriverInconsistent, webdriver_tampered: browser.webdriverTampered, work_verified: workVerified } : {}),
       ...(botClientSource !== 'none' ? { bot_client_key: clientContext(request).bot_client.key } : {}),
       ...(interactionTrap !== 'off' ? { trap_mode: interactionTrap } : {}),
+      ...(diagnostics ? { diagnostic_trace: requestMonitoring.get(request).monitoring_context.trace_id } : {}),
       browser_hash: hash(binding), challenge_id: payload.challenge_id, challenge_path: payload.path,
       exp: Date.now() + 300_000 }, cookieSecret);
     return new Response(null, { status: 204, headers: {
@@ -361,5 +409,15 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
     } });
   }
 
-  return { check, verify, capabilities: Object.freeze({ approvedAccountGate: requireApprovedAccount, botProtocol: 2, interactionTrapProtocol: 1 }) };
+  async function check(request) {
+    startMonitoring(request);
+    return diagnosticResponse(request, await checkRequest(request));
+  }
+
+  async function verify(request) {
+    startMonitoring(request);
+    return diagnosticResponse(request, await verifyRequest(request));
+  }
+
+  return { check, verify, diagnosticHeaders, capabilities: Object.freeze({ approvedAccountGate: requireApprovedAccount, botProtocol: 2, interactionTrapProtocol: 1, monitoringProtocol: 1 }) };
 }

package/dist/index.js

@@ -84,6 +84,7 @@ export function createStopneticHandler(options) {
     // Copy headers, including individual cookies, without buffering the body.
     const headers = new Headers(result.headers);
     headers.set('cache-control', 'private, no-store');
+    guard.diagnosticHeaders(request).forEach((value, name) => headers.set(name, value));
     return new Response(result.body, { status: result.status, statusText: result.statusText, headers });
   };
 }
@@ -103,6 +104,8 @@ function requestHeaders(req, origin) {
       try { headers.set(name, value); } catch { /* Leave unsupported metadata unknown. */ }
     }
   }
+  const ja4 = req.headers['x-vercel-ja4-digest'];
+  if (ja4 !== undefined) headers.set('x-vercel-ja4-digest', typeof ja4 === 'string' && ja4.length <= 128 ? ja4 : 'invalid');
   return headers;
 }
 
@@ -145,6 +148,7 @@ export function createStopneticMiddleware(options) {
   const verifyPath = options.verifyPath || '/__stopnetic/verify';
   return async function stopnetic(req, res, next) {
     let response;
+    let checked;
     let close = false;
     try {
       const host = req.headers.host;
@@ -165,7 +169,8 @@ export function createStopneticMiddleware(options) {
           }
         } else {
           // Checking ordinary requests must leave their bodies for the application.
-          response = await guard.check(new Request(url, { method, headers }));
+          checked = new Request(url, { method, headers });
+          response = await guard.check(checked);
         }
       }
     } catch { response = unavailable(); close = true; }
@@ -174,6 +179,7 @@ export function createStopneticMiddleware(options) {
       return;
     }
     res.setHeader('cache-control', 'private, no-store');
+    if (checked) guard.diagnosticHeaders(checked).forEach((value, name) => res.setHeader(name, value));
     return next();
   };
 }

package/dist/interaction-trap.js

@@ -1,42 +1,42 @@
-// Optional positive interaction evidence. Nothing here classifies visitors who
-// ignore the decoy. No resource URL, form or focusable target is exposed.
-export function interactionMarkup(id) {
-  return `<section hidden inert aria-hidden="true"><button type="button" tabindex="-1" id="${id}">Automated client verification shortcut</button></section>`;
-}
-
-// Serialized into the same CSP-authorized script as the normal browser check.
-// Merely reading the DOM, focusing, hovering or inspecting it is not activation.
-export function installInteractionTrap(id, token, ticket, verifyPath, mode, evidence, blocked) {
-  let sent = false;
-  document.getElementById(id).addEventListener('click', () => {
-    if (sent) return;
-    sent = true;
-    if (mode === 'block') blocked();
-    const controller = new AbortController();
-    const deadline = setTimeout(() => controller.abort(), 8000);
-    fetch(verifyPath, { method: 'POST', credentials: 'same-origin', signal: controller.signal,
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ ticket, browser: evidence(), interaction: { version: 1, token } }),
-    }).catch(() => {}).finally(() => clearTimeout(deadline));
-  });
-}
-
-export function validateTrapDecision(payload, expected, purpose) {
-  const control = payload.interaction_trap;
-  const decision = payload.trap_decision;
-  if (!control || Object.keys(control).length !== Object.keys(expected).length
-    || Object.entries(expected).some(([key, value]) => control[key] !== value)
-    || decision?.version !== 1 || decision.mode !== expected.mode
-    || typeof decision.activated !== 'boolean' || Object.keys(decision).length !== 4) return false;
-  const result = decision.result;
-  const priorDenial = payload.action === 'block' && (payload.approval_decision?.result === 'required'
-    || payload.country_decision && !['disabled', 'pass'].includes(payload.country_decision.result));
-  if (!['clear', 'observed', 'block', 'public'].includes(result)
-    || (result === 'clear' && decision.activated)
-    || (result === 'observed' && (!decision.activated || expected.mode !== 'monitor'))
-    || (result === 'block' && (!decision.activated || expected.mode !== 'block' || payload.action !== 'block'))
-    || (result === 'public' && (purpose !== 'decision' || (payload.action !== 'public' && !priorDenial) || decision.activated))) return false;
-  // An activation receipt cannot silently lose the positive evidence. Country
-  // and approval denials can precede activation, and retain their own reason.
-  return purpose !== 'trap' || decision.activated || !!priorDenial;
-}
+// Optional positive interaction evidence. Nothing here classifies visitors who
+// ignore the decoy. No resource URL, form or focusable target is exposed.
+export function interactionMarkup(id) {
+  return `<section hidden inert aria-hidden="true"><button type="button" tabindex="-1" id="${id}">Automated client verification shortcut</button></section>`;
+}
+
+// Serialized into the same CSP-authorized script as the normal browser check.
+// Merely reading the DOM, focusing, hovering or inspecting it is not activation.
+export function installInteractionTrap(id, token, ticket, verifyPath, mode, evidence, blocked) {
+  let sent = false;
+  document.getElementById(id).addEventListener('click', () => {
+    if (sent) return;
+    sent = true;
+    if (mode === 'block') blocked();
+    const controller = new AbortController();
+    const deadline = setTimeout(() => controller.abort(), 8000);
+    fetch(verifyPath, { method: 'POST', credentials: 'same-origin', signal: controller.signal,
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ ticket, browser: evidence(), interaction: { version: 1, token } }),
+    }).catch(() => {}).finally(() => clearTimeout(deadline));
+  });
+}
+
+export function validateTrapDecision(payload, expected, purpose) {
+  const control = payload.interaction_trap;
+  const decision = payload.trap_decision;
+  if (!control || Object.keys(control).length !== Object.keys(expected).length
+    || Object.entries(expected).some(([key, value]) => control[key] !== value)
+    || decision?.version !== 1 || decision.mode !== expected.mode
+    || typeof decision.activated !== 'boolean' || Object.keys(decision).length !== 4) return false;
+  const result = decision.result;
+  const priorDenial = payload.action === 'block' && (payload.approval_decision?.result === 'required'
+    || payload.country_decision && !['disabled', 'pass'].includes(payload.country_decision.result));
+  if (!['clear', 'observed', 'block', 'public'].includes(result)
+    || (result === 'clear' && decision.activated)
+    || (result === 'observed' && (!decision.activated || expected.mode !== 'monitor'))
+    || (result === 'block' && (!decision.activated || expected.mode !== 'block' || payload.action !== 'block'))
+    || (result === 'public' && (purpose !== 'decision' || (payload.action !== 'public' && !priorDenial) || decision.activated))) return false;
+  // An activation receipt cannot silently lose the positive evidence. Country
+  // and approval denials can precede activation, and retain their own reason.
+  return purpose !== 'trap' || decision.activated || !!priorDenial;
+}

package/dist/request-monitoring.js

@@ -0,0 +1,28 @@
+import { createHmac } from 'node:crypto';
+
+// Observe the explicitly selected hosting header, not a browser identity.
+// Raw connection metadata never leaves the customer's server. Group comparisons
+// are meaningful only for one installation/site/UTC day, not across customers.
+export function connectionObservation(request, source, secret, scope, now = Date.now()) {
+  if (source === 'none') return undefined;
+  const epoch = Math.floor(now / 86400000);
+  const base = { source: 'vercel', epoch, status: 'unavailable', ja4_group: null };
+  if (process.env.VERCEL !== '1') return base;
+  const value = request.headers.get('x-vercel-ja4-digest');
+  if (!value) return { ...base, status: 'missing' };
+  // Support the compact JA4 representation only; unknown formats are telemetry
+  // gaps, never access denials. No arbitrary forwarding/country fallback.
+  if (!/^[tqd][a-z0-9]{2}[di][0-9]{4}[a-z0-9]{2}_[a-f0-9]{12}_[a-f0-9]{12}$/.test(value)) {
+    return { ...base, status: 'invalid' };
+  }
+  return { ...base, status: 'observed', ja4_group: createHmac('sha256', secret)
+    .update(`stopnetic-ja4-v1:${scope}:${epoch}:${value}`).digest('hex') };
+}
+
+export function sameMonitoring(actual, expected) {
+  if (!actual || actual.version !== 1 || Object.keys(actual).length !== Object.keys(expected).length
+    || actual.trace_id !== expected.trace_id || Boolean(actual.connection) !== Boolean(expected.connection)) return false;
+  if (expected.connection && (Object.keys(actual.connection).length !== 4
+    || Object.entries(expected.connection).some(([key, value]) => actual.connection[key] !== value))) return false;
+  return true;
+}

package/dist/server.js

@@ -4,6 +4,7 @@ export const accessBase = '/api/stopnetic';
 
 /** Server environment only. Never import this module into browser code. */
 export function optionsFromEnv(env = process.env) {
+  if (env.STOPNETIC_DIAGNOSTICS && !['true', 'false'].includes(env.STOPNETIC_DIAGNOSTICS)) throw new Error('Invalid STOPNETIC_DIAGNOSTICS');
   if (env.STOPNETIC_REQUIRE_APPROVED_ACCOUNT && !['true', 'false'].includes(env.STOPNETIC_REQUIRE_APPROVED_ACCOUNT)) throw new Error('Invalid STOPNETIC_REQUIRE_APPROVED_ACCOUNT');
   return {
     origin: env.STOPNETIC_WEBSITE_ORIGIN,
@@ -20,6 +21,8 @@ export function optionsFromEnv(env = process.env) {
     botProtection: env.STOPNETIC_BOT_PROTECTION || 'off',
     botClientSource: env.STOPNETIC_BOT_CLIENT_SOURCE || 'none',
     interactionTrap: env.STOPNETIC_INTERACTION_TRAP || 'off',
+    diagnostics: env.STOPNETIC_DIAGNOSTICS === 'true',
+    connectionInsights: env.STOPNETIC_CONNECTION_INSIGHTS || 'none',
     requireApprovedAccount: env.STOPNETIC_REQUIRE_APPROVED_ACCOUNT === 'true',
     countryBlocking: env.STOPNETIC_COUNTRY_BLOCKING === 'true',
     countrySource: env.STOPNETIC_COUNTRY_SOURCE || 'none',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stopnetic/js",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Server-side Stopnetic guard for JavaScript websites, Node.js and Express-compatible servers.",
   "type": "module",
   "license": "MIT",