unshared-clientjs-sdk 2.3.0 → 3.0.0-rc.14

package/dist/middleware/index.d.ts

@@ -38,6 +38,8 @@ export interface ProtectionConfig<TReq extends UnsharedRequest = UnsharedRequest
     includePathPrefix?: string[];
     /** Skip the bot/crawler UA filter. Set to true in test environments so automated browsers (Playwright, Puppeteer, etc.) can observe verdicts. @default false */
     disableBotFilter?: boolean;
+    /** @internal Serve only the bundled fingerprint library, without S3 fetches. @default false */
+    disableS3Fingerprint?: boolean;
     /** Hard timeout (ms) for checkUser on cache miss. Fails open on timeout. @default 1500 */
     checkUserTimeoutMs?: number;
     /**

package/dist/middleware/index.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.ACCOUNT_FLAGGED_ERROR=exports.flaggedResponse=exports.VerdictCache=void 0,exports.unsharedBoundToUser=unsharedBoundToUser;const fs_1=require("fs"),verdict_cache_1=require("./verdict-cache");Object.defineProperty(exports,"VerdictCache",{enumerable:!0,get:function(){return verdict_cache_1.VerdictCache}});const rate_limit_backoff_1=require("./rate-limit-backoff"),dispatch_dedupe_1=require("./dispatch-dedupe"),response_interceptor_1=require("./response-interceptor"),fingerprint_script_1=require("./injection/fingerprint-script"),fp_bundle_source_1=require("./injection/fp-bundle-source"),submit_fp_1=require("./routes/submit-fp"),verify_1=require("./routes/verify"),interstitial_1=require("./routes/interstitial"),gate_page_1=require("./injection/gate-page"),dispatch_processing_1=require("./dispatch-processing"),http_helpers_1=require("./utils/http-helpers"),content_type_1=require("./utils/content-type"),flagged_response_1=require("./utils/flagged-response"),mask_email_1=require("./utils/mask-email"),skip_paths_1=require("./utils/skip-paths"),include_path_1=require("./utils/include-path"),is_bot_1=require("./utils/is-bot"),client_ip_1=require("./utils/client-ip"),cookies_1=require("./utils/cookies"),device_id_1=require("./utils/device-id"),secure_1=require("./utils/secure"),sentinel_user_id_1=require("./utils/sentinel-user-id");var flagged_response_2=require("./utils/flagged-response");Object.defineProperty(exports,"flaggedResponse",{enumerable:!0,get:function(){return flagged_response_2.flaggedResponse}}),Object.defineProperty(exports,"ACCOUNT_FLAGGED_ERROR",{enumerable:!0,get:function(){return flagged_response_2.ACCOUNT_FLAGGED_ERROR}});const CHECK_USER_TIMEOUT_MS=1500,FAIL_OPEN_TTL_MS=5e3,_lastFailOpenWarn={};function warnFailOpenThrottled(e){const t=Date.now();t-(_lastFailOpenWarn[e.reason]??0)<6e4||(_lastFailOpenWarn[e.reason]=t,console.warn(`[Unshared] Failing open (reason=${e.reason}${null!=e.status?`, status=${e.status}`:""}). Detection is not enforced for this request. Configure onFailOpen to observe this directly.`))}function unsharedBoundToUser(e,t){if(!t.userId)throw new Error("[Unshared] userId resolver is required");if(!t.emailAddress){let e=!1;try{require.resolve("unshared-frontend-sdk"),e=!0}catch{}e||console.warn("[Unshared] Warning: emailAddress resolver is not configured and unshared-frontend-sdk is not installed.\nNo user events will be submitted. Either install unshared-frontend-sdk (Tier 1) or\nprovide emailAddress in your middleware config (Tier 2).")}const{userId:r,emailAddress:i,routePrefix:s="/__unshared",corsOrigins:n,cacheTTL:o=6e4,maxCacheSize:a,streamingIdleMs:d=50,skipPaths:c,includePathPrefix:l,disableBotFilter:u=!1,checkUserTimeoutMs:_=CHECK_USER_TIMEOUT_MS,cacheMissStrategy:p="block",sessionId:h,deviceId:f,onFlagged:g,onError:v,onFailOpen:m,blockFlagged:I=!1,flaggedMode:k,autoInterstitial:y=!1,interstitialFlowType:A="email_verification"}=t,C=k??(I?"gate":void 0),S=y||"overlay"===C,x=e=>{if(m)try{m(e)}catch{}else"async_miss"!==e.reason&&warnFailOpenThrottled(e)},T=new verdict_cache_1.VerdictCache(o,a),b=new rate_limit_backoff_1.RateLimitBackoff,E=new Map,w=new dispatch_dedupe_1.DispatchDedupe,O=Date.now().toString(36),U=(0,fingerprint_script_1.generateFingerprintScript)(s,O,{autoInterstitial:S,interstitialFlowType:A});let F="";try{const e=require.resolve("unshared-frontend-sdk/dist/index.umd.js");F=(0,fs_1.readFileSync)(e,"utf8")}catch{}const q=(0,fp_bundle_source_1.createFingerprintBundleSource)(),M=void 0!==C||S,P="gate"===C?"flaggedMode 'gate' (blockFlagged)":"overlay"===C?"flaggedMode 'overlay'":"autoInterstitial";if(M&&!F)throw new Error(`[Unshared] ${P} requires unshared-frontend-sdk to be installed (its UMD bundle renders the interstitial).`);if(M&&"/__unshared"!==s)throw new Error(`[Unshared] ${P} requires the default routePrefix ("/__unshared"); the browser SDK proxy routes are fixed to that prefix.`);const $="gate"===C?(0,gate_page_1.generateGatePage)(s,O):"",j=(0,submit_fp_1.handleSubmitFingerprint)({client:e,verdictCache:T,rateLimitBackoff:b,dispatchDedupe:w,resolveUserId:r,resolveEmailAddress:i,resolveSessionId:h,resolveDeviceId:f,disableBotFilter:u,onError:v}),D=(0,verify_1.handleVerifyTrigger)({client:e,verdictCache:T,resolveEmailAddress:i,resolveDeviceId:f,onError:v}),V=(0,verify_1.handleVerify)({client:e,verdictCache:T,resolveUserId:r,resolveEmailAddress:i,resolveDeviceId:f,onError:v}),N=(0,interstitial_1.handleGetInterstitialFlow)({client:e}),L=n?Array.isArray(n)?n:[n]:null,R=`${s}/fp.js`,G=`${s}/fingerprint.js`,H=`${s}/submit-fp`,B=`${s}/verify-trigger`,K=`${s}/verify`,X=`${s}/status`,W=`${s}/interstitial-flow`,z=function(t,n,o){const a=(0,http_helpers_1.getRequestPath)(t.url),m=t.url||a;if(a.startsWith(s+"/")){if(function(e,t){if(!L)return;const r=e.headers.origin??"";L.includes("*")?(t.setHeader("Access-Control-Allow-Origin","*"),t.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.setHeader("Access-Control-Allow-Headers","Content-Type, X-Idempotency-Key, X-Session-Id, X-Device-Id")):L.includes(r)&&(t.setHeader("Access-Control-Allow-Origin",r),t.setHeader("Vary","Origin"),t.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.setHeader("Access-Control-Allow-Headers","Content-Type, X-Idempotency-Key, X-Session-Id, X-Device-Id"),t.setHeader("Access-Control-Allow-Credentials","true"))}(t,n),"OPTIONS"===t.method)return void(0,http_helpers_1.sendEmpty)(n,204);if(("GET"===t.method||"HEAD"===t.method)&&a===R)return n.setHeader("Content-Type","application/javascript"),n.setHeader("Cache-Control","public, max-age=3600"),void(0,http_helpers_1.sendBodyForMethod)(n,t.method,200,F);if(("GET"===t.method||"HEAD"===t.method)&&a===G){const e=q.get();return e?(n.setHeader("Content-Type","application/javascript"),n.setHeader("Cache-Control","public, max-age=3600"),void(0,http_helpers_1.sendBodyForMethod)(n,t.method,200,e)):void(0,http_helpers_1.sendBodyForMethod)(n,t.method,503,"/* fingerprint agent unavailable */")}if("POST"===t.method&&(a===H||a===B||a===K))return void 0===t.body?void(0,http_helpers_1.sendJson)(n,400,{success:!1,error:{code:"BODY_PARSER_MISSING",message:"req.body is undefined. Mount a JSON body-parsing middleware (e.g., express.json()) before the Unshared middleware."}}):a===H?void j(t,n):a===B?void D(t,n):void V(t,n);if("GET"===t.method&&a===W)return void N(t,n);if("GET"===t.method&&a===X){let s;try{s=r(t)}catch{}if(!s)return void(0,http_helpers_1.sendJson)(n,200,{status:"anonymous"});const o=resolveEmail(t,i);return void(async()=>{let r=T.get(s);if((!r||T.isStale(s))&&o&&!b.isPaused()&&!T.isRefreshing(s)){T.markRefreshing(s);try{const i=(0,device_id_1.extractDeviceIdOrUndefined)(t,f),n=extractFingerprintId(t),a=extractSessionId(t,h),d=i??n??"unknown";await fetchAndCacheVerdict(e,T,s,o,d,n,a,_,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:s,emailAddress:o})),r=T.get(s)}catch(e){v&&v(e,{operation:"checkUser",userId:s,emailAddress:o}),x({operation:"checkUser",reason:"exception",userId:s,emailAddress:o})}finally{T.clearRefreshing(s)}}r&&r.isFlagged&&!r.isVerified&&(void 0!==C||g)&&o?(0,http_helpers_1.sendJson)(n,200,{status:"flagged",email:(0,mask_email_1.maskEmail)(o)}):(0,http_helpers_1.sendJson)(n,200,{status:"ok"})})()}return void(0,http_helpers_1.sendJson)(n,404,{success:!1,error:{code:"NOT_FOUND",message:"Unknown route"}})}const I=void 0!==C;if((0,skip_paths_1.shouldSkipPath)(a,c,I))return void o();if(!(0,include_path_1.shouldIncludePath)(a,l))return interceptForInjection(t,n,U,d),void o();let k;try{k=r(t)}catch{}if((0,sentinel_user_id_1.isSentinelUserId)(k)){const e=(0,cookies_1.parseCookie)(t,"__unshared_uid"),r=(0,cookies_1.parseCookie)(t,"__unshared_uid_at"),i=r?Number(r):NaN,s=Number.isFinite(i)&&Date.now()-i<=sentinel_user_id_1.SENTINEL_STICKINESS_TTL_MS;k=e&&s?e:void 0}if(!k){const e=(0,secure_1.isSecureRequest)(t)?"; Secure":"";return appendSetCookie(n,`__unshared_uid=; Path=/; SameSite=Lax; Max-Age=0${e}`),appendSetCookie(n,`__unshared_uid_at=; Path=/; SameSite=Lax; Max-Age=0${e}`),appendSetCookie(n,`__unshared_sid=; Path=/; SameSite=Lax; Max-Age=0${e}`),appendSetCookie(n,`__unshared_email=; Path=/; SameSite=Lax; Max-Age=0${e}`),interceptForInjection(t,n,U,d),void o()}const y=resolveEmail(t,i);if(setUserIdCookie(t,n,k),y&&setEmailCookie(t,n,y),!y)return interceptForInjection(t,n,U,d),void o();const A=extractSessionId(t,h),S=(0,device_id_1.extractDeviceIdOrUndefined)(t,f),O=extractFingerprintId(t),M=t.headers["user-agent"]??"",P=(0,client_ip_1.extractClientIp)(t),z=S??O;if(!u&&(0,is_bot_1.isBot)(M))return void o();const J=T.get(k);if(!J){if("async"===p)return T.isRefreshing(k)||(T.markRefreshing(k),fetchAndCacheVerdict(e,T,k,y,z??"unknown",O,A,_,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:k,emailAddress:y})).catch(()=>x({operation:"checkUser",reason:"exception",userId:k,emailAddress:y})).finally(()=>T.clearRefreshing(k))),x({operation:"checkUser",reason:"async_miss",userId:k,emailAddress:y}),Y(),interceptForInjection(t,n,U,d),void o();let r=E.get(k);return r||(r=fetchAndCacheVerdict(e,T,k,y,z??"unknown",O,A,_,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:k,emailAddress:y})).finally(()=>E.delete(k)),E.set(k,r)),void r.then(e=>{e.isFlagged||Y(),applyVerdict(e,k,y,t,n,o,U,g,C,$,d)}).catch(()=>{x({operation:"checkUser",reason:"exception",userId:k,emailAddress:y}),Y(),interceptForInjection(t,n,U,d),o()})}function Y(){"unknown"!==A&&z&&(b.isPaused()||dispatchUserEvent(e,T,b,w,{userId:k,emailAddress:y,sessionId:A,deviceId:z,fingerprintId:O,userAgent:M,ipAddress:P,eventType:m},v))}T.isStale(k)&&!T.isRefreshing(k)&&(T.markRefreshing(k),fetchAndCacheVerdict(e,T,k,y,z??"unknown",O,A,_,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:k,emailAddress:y})).catch(()=>x({operation:"checkUser",reason:"exception",userId:k,emailAddress:y})).finally(()=>T.clearRefreshing(k))),J.isFlagged||Y(),applyVerdict(J,k,y,t,n,o,U,g,C,$,d)};return z.destroy=()=>{T.destroy(),q.stop()},z}function resolveEmail(e,t){if(t)try{const r=t(e);if(r)return r}catch{}const r=(0,cookies_1.parseCookie)(e,"__unshared_email");if(r)return r;const i=e.body?.email;return"string"==typeof i&&i?i:void 0}function applyVerdict(e,t,r,i,s,n,o,a,d,c,l){const u=e.isFlagged&&!e.isVerified;if("gate"===d&&u)(0,content_type_1.isHtmlNavigation)(i.method,i.headers.accept)?(s.statusCode=200,s.setHeader("Content-Type","text/html; charset=utf-8"),s.setHeader("Cache-Control","no-store"),s.end(c)):(0,http_helpers_1.sendJson)(s,403,(0,flagged_response_1.flaggedResponse)(r));else if("overlay"===d&&u)(0,content_type_1.isHtmlNavigation)(i.method,i.headers.accept)?(interceptForInjection(i,s,o,l),n()):(0,http_helpers_1.sendJson)(s,403,(0,flagged_response_1.flaggedResponse)(r));else if(interceptForInjection(i,s,o,l),e.isFlagged&&!e.isVerified&&a)try{a({userId:t,emailAddress:r,verdict:e,req:i,res:s,next:n})}catch{n()}else n()}function interceptForInjection(e,t,r,i){delete e.headers["if-none-match"],delete e.headers["if-modified-since"],(0,response_interceptor_1.interceptResponse)(t,(e,t)=>{if(!(0,content_type_1.isHtmlContentType)(t))return null;const i=e.toString("utf8"),s=i.lastIndexOf("</body>");return-1===s?i+r:i.slice(0,s)+r+i.slice(s)},{preventCaching:!0,streamingIdleMs:i})}function dispatchUserEvent(e,t,r,i,s,n){i.mark(s.userId,s.eventType),(0,dispatch_processing_1.runProcessUserEvent)({client:e,cache:t,backoff:r,onError:n},{eventType:s.eventType,userId:s.userId,emailAddress:s.emailAddress,ipAddress:s.ipAddress,deviceId:s.deviceId,fingerprintId:s.fingerprintId,sessionHash:s.sessionId,userAgent:s.userAgent},dispatch_processing_1.DISPATCH_TIMEOUT_MS)}async function fetchAndCacheVerdict(e,t,r,i,s,n,o,a=CHECK_USER_TIMEOUT_MS,d){const c={timeoutMs:a,maxRetries:0},l=s&&"unknown"!==s?s:void 0,u=l??n,_=n??l;let p;u&&(c.deviceId=u),_&&(c.fingerprintId=_);const h=await Promise.race([e.checkUser(i,c),new Promise(e=>{p=setTimeout(()=>e(null),a)})]);return clearTimeout(p),h?h.failedOpen?(d?.(h.failedOpen.reason??"http_error",h.failedOpen.status),cacheFailOpenVerdict(t,r,i,o)):(t.set(r,{isFlagged:h.data?.is_user_flagged??!1,isVerified:!1,emailAddress:i,sessionId:o}),t.get(r)):(d?.("timeout"),cacheFailOpenVerdict(t,r,i,o))}function cacheFailOpenVerdict(e,t,r,i){const s=e.get(t);return e.set(t,{isFlagged:s?.isFlagged??!1,isVerified:s?.isVerified??!1,emailAddress:r,sessionId:i},5e3),e.get(t)}function extractSessionId(e,t){if(t)try{const r=t(e);if(r)return r}catch{}return(0,cookies_1.parseCookie)(e,"__unshared_sid")??"unknown"}function extractFingerprintId(e){return(0,cookies_1.parseCookie)(e,"__unshared_fingerprint_id")||void 0}function appendSetCookie(e,t){const r=e.getHeader("Set-Cookie");if(r){const i=Array.isArray(r)?[...r]:[String(r)];i.push(t),e.setHeader("Set-Cookie",i)}else e.setHeader("Set-Cookie",t)}function setUserIdCookie(e,t,r){const i=(0,secure_1.isSecureRequest)(e)?"; Secure":"";appendSetCookie(t,`__unshared_uid=${encodeURIComponent(r)}; Path=/; SameSite=Lax${i}`),appendSetCookie(t,`__unshared_uid_at=${Date.now()}; Path=/; SameSite=Lax${i}`)}function setEmailCookie(e,t,r){const i=(0,secure_1.isSecureRequest)(e)?"; Secure":"";appendSetCookie(t,`__unshared_email=${encodeURIComponent(r)}; HttpOnly; Path=/; SameSite=Lax${i}`)}
+"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.ACCOUNT_FLAGGED_ERROR=exports.flaggedResponse=exports.VerdictCache=void 0,exports.unsharedBoundToUser=unsharedBoundToUser;const fs_1=require("fs"),read_json_body_1=require("./utils/read-json-body"),verdict_cache_1=require("./verdict-cache");Object.defineProperty(exports,"VerdictCache",{enumerable:!0,get:function(){return verdict_cache_1.VerdictCache}});const rate_limit_backoff_1=require("./rate-limit-backoff"),dispatch_dedupe_1=require("./dispatch-dedupe"),response_interceptor_1=require("./response-interceptor"),fingerprint_script_1=require("./injection/fingerprint-script"),fp_bundle_source_1=require("./injection/fp-bundle-source"),submit_fp_1=require("./routes/submit-fp"),verify_1=require("./routes/verify"),interstitial_1=require("./routes/interstitial"),gate_page_1=require("./injection/gate-page"),dispatch_processing_1=require("./dispatch-processing"),http_helpers_1=require("./utils/http-helpers"),content_type_1=require("./utils/content-type"),flagged_response_1=require("./utils/flagged-response"),mask_email_1=require("./utils/mask-email"),skip_paths_1=require("./utils/skip-paths"),include_path_1=require("./utils/include-path"),is_bot_1=require("./utils/is-bot"),client_ip_1=require("./utils/client-ip"),cookies_1=require("./utils/cookies"),device_id_1=require("./utils/device-id"),permanent_device_id_1=require("./utils/permanent-device-id"),secure_1=require("./utils/secure"),sentinel_user_id_1=require("./utils/sentinel-user-id");var flagged_response_2=require("./utils/flagged-response");Object.defineProperty(exports,"flaggedResponse",{enumerable:!0,get:function(){return flagged_response_2.flaggedResponse}}),Object.defineProperty(exports,"ACCOUNT_FLAGGED_ERROR",{enumerable:!0,get:function(){return flagged_response_2.ACCOUNT_FLAGGED_ERROR}});const CHECK_USER_TIMEOUT_MS=1500,FAIL_OPEN_TTL_MS=5e3,_lastFailOpenWarn={};function warnFailOpenThrottled(e){const t=Date.now();t-(_lastFailOpenWarn[e.reason]??0)<6e4||(_lastFailOpenWarn[e.reason]=t,console.warn(`[Unshared] Failing open (reason=${e.reason}${null!=e.status?`, status=${e.status}`:""}). Detection is not enforced for this request. Configure onFailOpen to observe this directly.`))}function unsharedBoundToUser(e,t){if(!t.userId)throw new Error("[Unshared] userId resolver is required");if(!t.emailAddress){let e=!1;try{require.resolve("unshared-frontend-sdk"),e=!0}catch{}e||console.warn("[Unshared] Warning: emailAddress resolver is not configured and unshared-frontend-sdk is not installed.\nNo user events will be submitted. Either install unshared-frontend-sdk (Tier 1) or\nprovide emailAddress in your middleware config (Tier 2).")}const{userId:r,emailAddress:i,routePrefix:n="/__unshared",corsOrigins:s,cacheTTL:o=6e4,maxCacheSize:a,streamingIdleMs:d=50,skipPaths:c,includePathPrefix:l,disableBotFilter:u=!1,checkUserTimeoutMs:_=CHECK_USER_TIMEOUT_MS,cacheMissStrategy:p="block",sessionId:h,deviceId:f,onFlagged:g,onError:m,onFailOpen:v,blockFlagged:I=!1,flaggedMode:k,autoInterstitial:y=!1,interstitialFlowType:A="email_verification"}=t,C=k??(I?"gate":void 0),S=y||"overlay"===C,x=e=>{if(v)try{v(e)}catch{}else"async_miss"!==e.reason&&warnFailOpenThrottled(e)},E=new verdict_cache_1.VerdictCache(o,a),b=new rate_limit_backoff_1.RateLimitBackoff,T=new Map,U=new dispatch_dedupe_1.DispatchDedupe,O=Date.now().toString(36),w=(0,fingerprint_script_1.generateFingerprintScript)(n,O,{autoInterstitial:S,interstitialFlowType:A});let q="";try{const e=require.resolve("unshared-frontend-sdk/dist/index.umd.js");q=(0,fs_1.readFileSync)(e,"utf8")}catch{}const F=(0,fp_bundle_source_1.createFingerprintBundleSource)({disabled:t.disableS3Fingerprint}),M=void 0!==C||S,P="gate"===C?"flaggedMode 'gate' (blockFlagged)":"overlay"===C?"flaggedMode 'overlay'":"autoInterstitial";if(M&&!q)throw new Error(`[Unshared] ${P} requires unshared-frontend-sdk to be installed (its UMD bundle renders the interstitial).`);if(M&&"/__unshared"!==n)throw new Error(`[Unshared] ${P} requires the default routePrefix ("/__unshared"); the browser SDK proxy routes are fixed to that prefix.`);const j="gate"===C?(0,gate_page_1.generateGatePage)(n,O):"",$=(0,submit_fp_1.handleSubmitFingerprint)({client:e,verdictCache:E,rateLimitBackoff:b,dispatchDedupe:U,resolveUserId:r,resolveEmailAddress:i,resolveSessionId:h,resolveDeviceId:f,disableBotFilter:u,onError:m}),D=(0,verify_1.handleVerifyTrigger)({client:e,verdictCache:E,resolveEmailAddress:i,resolveDeviceId:f,onError:m}),V=(0,verify_1.handleVerify)({client:e,verdictCache:E,resolveUserId:r,resolveEmailAddress:i,resolveDeviceId:f,onError:m}),L=(0,interstitial_1.handleGetInterstitialFlow)({client:e}),H=s?Array.isArray(s)?s:[s]:null,N=`${n}/fp.js`,R=`${n}/fingerprint.js`,X=`${n}/submit-fp`,G=`${n}/verify-trigger`,K=`${n}/verify`,B=`${n}/status`,W=`${n}/interstitial-flow`,z=function(t,s,o){const a=(0,http_helpers_1.getRequestPath)(t.url),v=t.url||a;if(a.startsWith(n+"/")){if(function(e,t){if(!H)return;const r=e.headers.origin??"";H.includes("*")?(t.setHeader("Access-Control-Allow-Origin","*"),t.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.setHeader("Access-Control-Allow-Headers","Content-Type, X-Idempotency-Key, X-Session-Id, X-Device-Id, X-Permanent-Device-Id"),t.setHeader("Access-Control-Expose-Headers","X-Unshared-Enforcement-Reconciled")):H.includes(r)&&(t.setHeader("Access-Control-Allow-Origin",r),t.setHeader("Vary","Origin"),t.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.setHeader("Access-Control-Allow-Headers","Content-Type, X-Idempotency-Key, X-Session-Id, X-Device-Id, X-Permanent-Device-Id"),t.setHeader("Access-Control-Expose-Headers","X-Unshared-Enforcement-Reconciled"),t.setHeader("Access-Control-Allow-Credentials","true"))}(t,s),"OPTIONS"===t.method)return void(0,http_helpers_1.sendEmpty)(s,204);if(("GET"===t.method||"HEAD"===t.method)&&a===N)return s.setHeader("Content-Type","application/javascript"),s.setHeader("Cache-Control","public, max-age=3600"),void(0,http_helpers_1.sendBodyForMethod)(s,t.method,200,q);if(("GET"===t.method||"HEAD"===t.method)&&a===R)return void F.get().then(e=>{e?(s.setHeader("Content-Type","application/javascript"),s.setHeader("Cache-Control","public, max-age=3600"),(0,http_helpers_1.sendBodyForMethod)(s,t.method,200,e)):(0,http_helpers_1.sendBodyForMethod)(s,t.method,503,"/* fingerprint agent unavailable */")});if("POST"===t.method&&(a===X||a===G||a===K))return void(0,read_json_body_1.readJsonBody)(t,s).then(e=>{if(e)return a===X?$(t,s):a===G?D(t,s):V(t,s)}).catch(o);if("GET"===t.method&&a===W)return void L(t,s);if("GET"===t.method&&a===B){let n;try{n=r(t)}catch{}if(!n)return void(0,http_helpers_1.sendJson)(s,200,{status:"anonymous"});const o=resolveEmail(t,i);return void(async()=>{let r=E.get(n);if((!r||E.isStale(n))&&o&&!b.isPaused()&&!E.isRefreshing(n)){E.markRefreshing(n);try{const i=(0,device_id_1.extractDeviceIdOrUndefined)(t,f),s=extractFingerprintId(t),a=(0,permanent_device_id_1.extractPermanentDeviceId)(t),d=extractSessionId(t,h),c=i??s??"unknown";await fetchAndCacheVerdict(e,E,n,o,c,s,a,d,_,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:n,emailAddress:o})),r=E.get(n)}catch(e){m&&m(e,{operation:"checkUser",userId:n,emailAddress:o}),x({operation:"checkUser",reason:"exception",userId:n,emailAddress:o})}finally{E.clearRefreshing(n)}}r&&r.isFlagged&&!r.isVerified&&(void 0!==C||g)&&o?(0,http_helpers_1.sendJson)(s,200,{status:"flagged",email:(0,mask_email_1.maskEmail)(o)}):(0,http_helpers_1.sendJson)(s,200,{status:"ok"})})()}return void(0,http_helpers_1.sendJson)(s,404,{success:!1,error:{code:"NOT_FOUND",message:"Unknown route"}})}const I=void 0!==C;if((0,skip_paths_1.shouldSkipPath)(a,c,I))return void o();if(!(0,include_path_1.shouldIncludePath)(a,l))return interceptForInjection(t,s,w,d),void o();let k;try{k=r(t)}catch{}if((0,sentinel_user_id_1.isSentinelUserId)(k)){const e=(0,cookies_1.parseCookie)(t,"__unshared_uid"),r=(0,cookies_1.parseCookie)(t,"__unshared_uid_at"),i=r?Number(r):NaN,n=Number.isFinite(i)&&Date.now()-i<=sentinel_user_id_1.SENTINEL_STICKINESS_TTL_MS;k=e&&n?e:void 0}if(!k){const e=(0,secure_1.isSecureRequest)(t)?"; Secure":"";return appendSetCookie(s,`__unshared_uid=; Path=/; SameSite=Lax; Max-Age=0${e}`),appendSetCookie(s,`__unshared_uid_at=; Path=/; SameSite=Lax; Max-Age=0${e}`),appendSetCookie(s,`__unshared_sid=; Path=/; SameSite=Lax; Max-Age=0${e}`),appendSetCookie(s,`__unshared_email=; Path=/; SameSite=Lax; Max-Age=0${e}`),appendSetCookie(s,`__unshared_verification_id=; HttpOnly; Path=/; SameSite=Lax; Max-Age=0${e}`),interceptForInjection(t,s,w,d),void o()}const y=resolveEmail(t,i);if(setUserIdCookie(t,s,k),y&&setEmailCookie(t,s,y),!y)return interceptForInjection(t,s,w,d),void o();const A=extractSessionId(t,h),S=(0,device_id_1.extractDeviceIdOrUndefined)(t,f),O=extractFingerprintId(t),M=(0,permanent_device_id_1.extractPermanentDeviceId)(t),P=t.headers["user-agent"]??"",z=(0,client_ip_1.extractClientIp)(t),J=S??O;if(!u&&(0,is_bot_1.isBot)(P))return void o();const Q=E.get(k);if(!Q){if("async"===p)return E.isRefreshing(k)||(E.markRefreshing(k),fetchAndCacheVerdict(e,E,k,y,J??"unknown",O,M,A,_,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:k,emailAddress:y})).catch(()=>x({operation:"checkUser",reason:"exception",userId:k,emailAddress:y})).finally(()=>E.clearRefreshing(k))),x({operation:"checkUser",reason:"async_miss",userId:k,emailAddress:y}),Y(),interceptForInjection(t,s,w,d),void o();let r=T.get(k);return r||(r=fetchAndCacheVerdict(e,E,k,y,J??"unknown",O,M,A,_,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:k,emailAddress:y})).finally(()=>T.delete(k)),T.set(k,r)),void r.then(e=>{e.isFlagged||Y(),applyVerdict(e,k,y,t,s,o,w,g,C,j,d)}).catch(()=>{x({operation:"checkUser",reason:"exception",userId:k,emailAddress:y}),Y(),interceptForInjection(t,s,w,d),o()})}function Y(){"unknown"!==A&&J&&(b.isPaused()||dispatchUserEvent(e,E,b,U,{userId:k,emailAddress:y,sessionId:A,deviceId:J,fingerprintId:O,permanentDeviceId:M,userAgent:P,ipAddress:z,eventType:v},m))}E.isStale(k)&&!E.isRefreshing(k)&&(E.markRefreshing(k),fetchAndCacheVerdict(e,E,k,y,J??"unknown",O,M,A,_,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:k,emailAddress:y})).catch(()=>x({operation:"checkUser",reason:"exception",userId:k,emailAddress:y})).finally(()=>E.clearRefreshing(k))),Q.isFlagged||Y(),applyVerdict(Q,k,y,t,s,o,w,g,C,j,d)};return z.destroy=()=>{E.destroy(),F.stop()},z}function resolveEmail(e,t){if(t)try{const r=t(e);if(r)return r}catch{}const r=(0,cookies_1.parseCookie)(e,"__unshared_email");if(r)return r;const i=e.body?.email;return"string"==typeof i&&i?i:void 0}function applyVerdict(e,t,r,i,n,s,o,a,d,c,l){const u=e.isFlagged&&!e.isVerified;if("gate"===d&&u)(0,content_type_1.isHtmlNavigation)(i.method,i.headers.accept)?(n.statusCode=200,n.setHeader("Content-Type","text/html; charset=utf-8"),n.setHeader("Cache-Control","no-store"),n.end(c)):(0,http_helpers_1.sendJson)(n,403,(0,flagged_response_1.flaggedResponse)(r));else if("overlay"===d&&u)(0,content_type_1.isHtmlNavigation)(i.method,i.headers.accept)?(interceptForInjection(i,n,o,l),s()):(0,http_helpers_1.sendJson)(n,403,(0,flagged_response_1.flaggedResponse)(r));else if(interceptForInjection(i,n,o,l),e.isFlagged&&!e.isVerified&&a)try{a({userId:t,emailAddress:r,verdict:e,req:i,res:n,next:s})}catch{s()}else s()}function interceptForInjection(e,t,r,i){delete e.headers["if-none-match"],delete e.headers["if-modified-since"],(0,response_interceptor_1.interceptResponse)(t,(e,t)=>{if(!(0,content_type_1.isHtmlContentType)(t))return null;const i=e.toString("utf8"),n=i.lastIndexOf("</body>");return-1===n?i+r:i.slice(0,n)+r+i.slice(n)},{preventCaching:!0,streamingIdleMs:i})}function dispatchUserEvent(e,t,r,i,n,s){i.mark(n.userId,n.eventType),(0,dispatch_processing_1.runProcessUserEvent)({client:e,cache:t,backoff:r,onError:s},{eventType:n.eventType,userId:n.userId,emailAddress:n.emailAddress,ipAddress:n.ipAddress,deviceId:n.deviceId,fingerprintId:n.fingerprintId,permanentDeviceId:n.permanentDeviceId,sessionHash:n.sessionId,userAgent:n.userAgent},dispatch_processing_1.DISPATCH_TIMEOUT_MS)}async function fetchAndCacheVerdict(e,t,r,i,n,s,o,a,d=CHECK_USER_TIMEOUT_MS,c){const l={timeoutMs:d,maxRetries:0},u=n&&"unknown"!==n?n:void 0,_=u??s,p=s??u;let h;_&&(l.deviceId=_),p&&(l.fullHash=p),o&&(l.permanentDeviceId=o);const f=await Promise.race([e.checkUser(i,l),new Promise(e=>{h=setTimeout(()=>e(null),d)})]);return clearTimeout(h),f?f.failedOpen?(c?.(f.failedOpen.reason??"http_error",f.failedOpen.status),cacheFailOpenVerdict(t,r,i,a)):(t.set(r,{isFlagged:f.data?.is_user_flagged??!1,isVerified:!1,emailAddress:i,sessionId:a}),t.get(r)):(c?.("timeout"),cacheFailOpenVerdict(t,r,i,a))}function cacheFailOpenVerdict(e,t,r,i){const n=e.get(t);return e.set(t,{isFlagged:n?.isFlagged??!1,isVerified:n?.isVerified??!1,emailAddress:r,sessionId:i},5e3),e.get(t)}function extractSessionId(e,t){if(t)try{const r=t(e);if(r)return r}catch{}return(0,cookies_1.parseCookie)(e,"__unshared_sid")??"unknown"}function extractFingerprintId(e){return(0,cookies_1.parseCookie)(e,"__unshared_fingerprint_id")||void 0}function appendSetCookie(e,t){const r=e.getHeader("Set-Cookie");if(r){const i=Array.isArray(r)?[...r]:[String(r)];i.push(t),e.setHeader("Set-Cookie",i)}else e.setHeader("Set-Cookie",t)}function setUserIdCookie(e,t,r){const i=(0,secure_1.isSecureRequest)(e)?"; Secure":"";appendSetCookie(t,`__unshared_uid=${encodeURIComponent(r)}; Path=/; SameSite=Lax; Max-Age=31536000${i}`),appendSetCookie(t,`__unshared_uid_at=${Date.now()}; Path=/; SameSite=Lax; Max-Age=31536000${i}`)}function setEmailCookie(e,t,r){const i=(0,secure_1.isSecureRequest)(e)?"; Secure":"";appendSetCookie(t,`__unshared_email=${encodeURIComponent(r)}; HttpOnly; Path=/; SameSite=Lax; Max-Age=31536000${i}`)}

package/dist/middleware/injection/fingerprint-script.d.ts

@@ -12,6 +12,13 @@
  *   window.addEventListener("unshared:flagged", (e) => {
  *     e.detail.email — the flagged user's email (from 403 response body)
  *   });
+ *
+ * Sticky-signal contract (ordering-proof alternative to the event): the signal
+ * is also recorded on the shared namespace, so listeners that attach AFTER the
+ * CustomEvent fired (late hydration, app crash-and-remount) can recover it:
+ *   window.__unshared.flagged            — { email } once flagged, else undefined
+ *   window.__unshared.whenFlagged(cb)    — subscribes cb AND replays immediately
+ *                                          if the signal already fired
  */
 export declare function generateFingerprintScript(routePrefix: string, version?: string, opts?: {
     autoInterstitial?: boolean;

package/dist/middleware/injection/fingerprint-script.js

@@ -1 +1 @@
-"use strict";function generateFingerprintScript(e,t,n){const r=t?`?v=${escapeJavaScript(t)}`:"",s=n?.autoInterstitial?`\nvar _isdk=new UnsharedBrowser.UnsharedBrowser({baseUrl:""});\nwindow.addEventListener("unshared:flagged",function(){try{_isdk.showInterstitial({flowType:"${escapeJavaScript(n?.interstitialFlowType??"email_verification")}",onComplete:function(){try{location.reload()}catch(e){}}})}catch(e){}});`:"";return`<script>\n(function(){\ntry{\n// --- Bot drop (defense-in-depth) ---\n// Must be the first statement: we do not want to write cookies, localStorage,\n// session IDs, or any network requests for known-bot traffic. Mirrors the\n// regex in unshared-fingerprint-lib/src/detect/bot.ts and Node middleware\n// utils/is-bot.ts. Keep all three in sync.\nvar BOT_RE=/googlebot|bingbot|slurp|baiduspider|duckduckbot|yandex|sogou|exabot|ia_archiver|curl|wget|python-requests|python-urllib|axios|node-fetch|go-http-client|java\\/|libwww-perl|okhttp|apache-httpclient|http_request|httpie|headlesschrome|phantomjs|puppeteer|playwright|cypress|selenium|webdriver|electron|jsdom|vercel-screenshot|screenshot|prerender|lighthouse|chrome-lighthouse|pagespeed|gtmetrix|pingdom|nessus|nikto|sqlmap|burp|zap|qualys|openvas|nmap|masscan|facebookexternalhit|twitterbot|linkedinbot|whatsapp|telegrambot|slackbot|discordbot|bot|crawl|spider|scrape|fetch|scan/i;\nif(typeof navigator!=="undefined"&&navigator.userAgent&&BOT_RE.test(navigator.userAgent))return;\n\nvar pfx="${escapeJavaScript(e)}";\nvar SS_FP="__unshared_fp";\nvar SS_LAST_SUBMIT="__unshared_last_submit";\n\n// Dedup state: skip submit if (user_id + URL) matches last submission.\n// Modern SPAs (Next.js App Router, React Router, etc.) call replaceState\n// 3-5 times during hydration with the same URL — without this guard,\n// each call generates a redundant FP row with identical stable_hash.\n// Persisted to sessionStorage so hard reloads and framework double-boots\n// inside the same tab still dedupe (the in-memory value resets on reload).\nvar lastSubmitKey="";\ntry{lastSubmitKey=sessionStorage.getItem(SS_LAST_SUBMIT)||""}catch(e){}\n\n// Page-scoped dedup state SHARED with the frontend SDK (browser.ts getSharedDedup).\n// On a Tier 1 page both this inline script and the SDK submit; each holds its own\n// in-memory lastSubmitKey, so both could pass the check below and POST. window.__unshared\n// is read+written synchronously in submitFP (no await between), so whichever fires\n// first claims the uid|route key and the other no-ops — killing the read-before-write\n// race that doubled events. KEEP IN SYNC with browser.ts: namespace, lastKey, key formula.\nvar shared=(window.__unshared=window.__unshared||{});\n\n// --- Helpers ---\nfunction gC(n){var m=document.cookie.match(new RegExp("(?:^|; )"+n+"=([^;]*)"));return m?decodeURIComponent(m[1]):null}\nfunction sC(n,v,d){var e="";if(d){var dt=new Date();dt.setTime(dt.getTime()+d*864e5);e="; expires="+dt.toUTCString()}document.cookie=n+"="+encodeURIComponent(v)+e+"; path=/; SameSite=Lax"+(location.protocol==="https:"?"; Secure":"")}\nfunction uuid(){return(typeof crypto!=="undefined"&&crypto.randomUUID)?crypto.randomUUID():("xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,function(c){var r=Math.random()*16|0;return(c==="x"?r:r&0x3|0x8).toString(16)}))}\n// Sentinel user IDs that must never be treated as real users. Mirrors\n// the Set in sentinel-user-id.ts — keep in sync. Empty string is handled\n// by the separate !uid checks below.\nvar SENTINEL_UIDS={"__pre_auth__":1,"anonymous":1,"guest":1,"undefined":1,"null":1};\nfunction isSentinelUid(v){return typeof v==="string"&&SENTINEL_UIDS.hasOwnProperty(v)}\n\n// --- Session + device IDs ---\n// Session ID is a UUID because it's supposed to be tab-scoped and random.\n// Device ID is intentionally NOT a UUID — Issue 9: random UUIDs wrote\n// meaningless device_ids to every fingerprint row. Instead we read the\n// stable fingerprint hash from localStorage if a previous submission\n// already persisted it; otherwise we leave did empty and let submitFP()\n// reconcile on the first successful collection. The Node middleware's\n// Issue 8 bootstrap-skip branch handles the empty-device_id window so we\n// never dispatch with a random or "unknown" value.\nvar sid=gC("__unshared_sid");\nif(!sid){sid=uuid();sC("__unshared_sid",sid,365)}\nvar did="";\ntry{did=localStorage.getItem("__unshared_device_id")||""}catch(e){}\nif(did){sC("__unshared_fp_id",did,365)}\n\n// --- Fingerprint cache (sessionStorage) ---\nfunction getFP(){try{var r=sessionStorage.getItem(SS_FP);return r?JSON.parse(r):null}catch(e){return null}}\nfunction setFP(fp){try{sessionStorage.setItem(SS_FP,JSON.stringify(fp))}catch(e){}}\n\n// --- Submit fingerprint to backend ---\nfunction submitFP(fp){\n  var uid=gC("__unshared_uid");\n  if(!uid||isSentinelUid(uid))return;\n  // Issue 9: reconcile device_id to the stable fingerprint hash. This runs\n  // before we send the X-Device-Id header so the very first submission\n  // already carries the real value. Persist to localStorage so other tabs\n  // (and future reloads) pick up the same stable ID without needing to\n  // re-collect the fingerprint.\n  if(fp.fingerprint_id){\n    did=fp.fingerprint_id;\n    try{localStorage.setItem("__unshared_device_id",did)}catch(e){}\n    sC("__unshared_fp_id",did,365);\n  }\n  // event_type is the SPA route, not a fixed enum. Page-level event names\n  // (page_load/route_change) collapsed every row into one of two buckets;\n  // the URL is more useful for analytics and matches the frontend SDK.\n  var route=(location.pathname||"/")+(location.search||"");\n  var key=uid+"|"+route;\n  // Check the shared window guard AND the in-memory key (last-key semantics, so an\n  // SPA A->B->A revisit still submits the second A). The shared guard makes this\n  // submitter and the frontend SDK see each other within the page.\n  if(key===lastSubmitKey||shared.lastKey===key)return;\n  shared.lastKey=key;\n  lastSubmitKey=key;\n  try{sessionStorage.setItem(SS_LAST_SUBMIT,key)}catch(e){}\n  // collected_at is stamped fresh at submit time rather than carried from fp.timestamp,\n  // because fp is cached per-tab in sessionStorage — reusing its original timestamp would\n  // freeze collected_at at first load and drift against server created_at as the tab ages.\n  // The server authoritatively overwrites this value again on ingress.\n  var body={hash:fp.full_hash,stable_hash:fp.fingerprint_id,collected_at:(new Date()).toISOString(),is_incognito:fp.isIncognito,components:fp.components,version:fp.version,source:fp.source,session_id:sid,user_id:uid,event_type:route};\n  // Idempotency key derived from (stable_hash, user_id, route), SHA-256-hashed\n  // when WebCrypto is available so the user_id never appears in the platform's\n  // stored idempotency_key column (raw fallback on non-secure contexts — the\n  // middleware accepts both). NOTE: the middleware appends |Date.now() before\n  // forwarding (submit-fp.ts), so the backend sees a unique value per\n  // submission and dedups only PubSub redeliveries — NOT two distinct POSTs.\n  // Cross-submitter / cross-reload dedup is client-side (the shared window\n  // guard + sessionStorage above).\n  var idem=fp.fingerprint_id+"|"+uid+"|"+route;\n  function sendFP(idemKey){\n    var xhr=new XMLHttpRequest();\n    xhr.open("POST",pfx+"/submit-fp",true);\n    xhr.setRequestHeader("Content-Type","application/json");\n    xhr.setRequestHeader("X-Session-Id",sid);\n    if(did)xhr.setRequestHeader("X-Device-Id",did);\n    xhr.setRequestHeader("X-Idempotency-Key",idemKey);\n    xhr.send(JSON.stringify(body));\n  }\n  if(window.crypto&&crypto.subtle&&window.TextEncoder){\n    crypto.subtle.digest("SHA-256",new TextEncoder().encode(idem)).then(function(d){\n      var a=new Uint8Array(d),s="";\n      for(var i=0;i<a.length;i++){s+=("0"+a[i].toString(16)).slice(-2)}\n      sendFP(s);\n    }).catch(function(){sendFP(idem)});\n  }else{sendFP(idem)}\n}\n\n// --- Collect fingerprint (loads fp.js if needed) then submit ---\nvar fpReady=false;\nfunction collectAndSubmit(){\n  var uid=gC("__unshared_uid");\n  if(!uid||isSentinelUid(uid))return;\n  var cached=getFP();\n  if(cached){submitFP(cached);return}\n  if(!fpReady)return;\n  try{\n    var c=new UnsharedBrowser.UnsharedBrowser({baseUrl:""});\n    c.collect({exclude:["timing","speech"]}).then(function(fp){setFP(fp);submitFP(fp)});\n  }catch(e){}\n}\n\n// --- Load fp.js (always — browser caches it for 1h) ---\n// Submit cached FP immediately if available; load fp.js for fresh collection\nvar pageLoadSubmitted=false;\nvar _boot_uid=gC("__unshared_uid");\nif(getFP()&&_boot_uid&&!isSentinelUid(_boot_uid)){submitFP(getFP());pageLoadSubmitted=true;deferredCheck()}\nvar s=document.createElement("script");\ns.src=pfx+"/fp.js${r}";\ns.onload=function(){fpReady=true;${s}if(!pageLoadSubmitted){collectAndSubmit();deferredCheck()}};\ndocument.head.appendChild(s);\n\n// --- Deferred verdict check ---\n// After fingerprint submission, the backend processes the event async.\n// If the user was just flagged, the initial page load may have beaten\n// the verdict update. Re-check after a delay so newly flagged sessions\n// get caught without waiting for user interaction.\n// The endpoint always returns 200 so browsers don't log a scary red\n// network error — we inspect the body and dispatch the flagged event\n// ourselves when status==="flagged".\nfunction deferredCheck(){\n  var uid=gC("__unshared_uid");\n  if(!uid||isSentinelUid(uid))return;\n  setTimeout(function(){\n    try{fetch(pfx+"/status",{method:"GET",credentials:"same-origin"}).then(function(r){return r.json()}).then(function(b){if(b&&b.status==="flagged")emitFlagged(b)}).catch(function(){})}catch(e){}\n  },500);\n}\n\n// --- SPA route change tracking (History API + popstate) ---\nvar oPush=history.pushState,oReplace=history.replaceState;\nhistory.pushState=function(){oPush.apply(this,arguments);try{collectAndSubmit()}catch(e){}};\nhistory.replaceState=function(){oReplace.apply(this,arguments);try{collectAndSubmit()}catch(e){}};\nwindow.addEventListener("popstate",function(){try{collectAndSubmit()}catch(e){}});\n\n// --- 403 interception: dispatch "unshared:flagged" event ---\nfunction emitFlagged(body){\n  try{window.dispatchEvent(new CustomEvent("unshared:flagged",{detail:{email:body.email||""}}))}catch(e){}\n}\n\n// Patch fetch\nvar oFetch=window.fetch;\nif(oFetch){window.fetch=function(){return oFetch.apply(this,arguments).then(function(r){if(r.status===403){try{var cl=r.clone();cl.json().then(function(b){if(b&&b.error==="account_flagged")emitFlagged(b)}).catch(function(){})}catch(e){}}return r})}}\n\n// Patch XMLHttpRequest\nvar oXSend=XMLHttpRequest.prototype.send;\nXMLHttpRequest.prototype.send=function(){var x=this;x.addEventListener("load",function(){if(x.status===403){try{var b=JSON.parse(x.responseText);if(b&&b.error==="account_flagged")emitFlagged(b)}catch(e){}}});return oXSend.apply(this,arguments)};\n\n}catch(e){}\n})();\n<\/script>`}function escapeJavaScript(e){return JSON.stringify(e).slice(1,-1).replace(/<\/(script)/gi,"<\\/$1").replace(new RegExp("\u2028","g"),"\\u2028").replace(new RegExp("\u2029","g"),"\\u2029")}Object.defineProperty(exports,"t",{value:!0}),exports.generateFingerprintScript=generateFingerprintScript;
+"use strict";function generateFingerprintScript(e,t,n){const r=t?`?v=${escapeJavaScript(t)}`:"",a=n?.autoInterstitial?`\nvar _isdk=new UnsharedBrowser.UnsharedBrowser({baseUrl:""});\nvar _isdkShow=function(){try{_isdk.showInterstitial({flowType:"${escapeJavaScript(n?.interstitialFlowType??"email_verification")}",onComplete:function(){try{location.reload()}catch(e){}}})}catch(e){}};\nwindow.addEventListener("unshared:flagged",_isdkShow);\nif(shared.flagged){_isdkShow()}`:"";return`<script>\n(function(){\ntry{\n// --- Bot drop (defense-in-depth) ---\n// Must be the first statement: we do not want to write cookies, localStorage,\n// session IDs, or any network requests for known-bot traffic. Mirrors the\n// regex in unshared-fingerprint-lib/src/detect/bot.ts and Node middleware\n// utils/is-bot.ts. Keep all three in sync.\nvar BOT_RE=/googlebot|bingbot|slurp|baiduspider|duckduckbot|yandex|sogou|exabot|ia_archiver|curl|wget|python-requests|python-urllib|axios|node-fetch|go-http-client|java\\/|libwww-perl|okhttp|apache-httpclient|http_request|httpie|headlesschrome|phantomjs|puppeteer|playwright|cypress|selenium|webdriver|electron|jsdom|vercel-screenshot|screenshot|prerender|lighthouse|chrome-lighthouse|pagespeed|gtmetrix|pingdom|nessus|nikto|sqlmap|burp|zap|qualys|openvas|nmap|masscan|facebookexternalhit|twitterbot|linkedinbot|whatsapp|telegrambot|slackbot|discordbot|bot|crawl|spider|scrape|fetch|scan/i;\nif(typeof navigator!=="undefined"&&navigator.userAgent&&BOT_RE.test(navigator.userAgent))return;\n\nvar pfx="${escapeJavaScript(e)}";\nvar SS_FP="__unshared_fp";\nvar SS_FP_RAW="__unshared_fp_raw";\nvar SS_LAST_SUBMIT="__unshared_last_submit";\nvar CAPTURE_SESSION_KEYS=["__unshared_email","__unshared_last_submit","__unshared_verification_id"];\nvar MAX_REQUEST_BYTES=102400;\n\n// Dedup state: skip submit if (user_id + URL) matches last submission.\n// Modern SPAs (Next.js App Router, React Router, etc.) call replaceState\n// 3-5 times during hydration with the same URL — without this guard,\n// each call generates a redundant FP row with identical stable_hash.\n// Persisted to sessionStorage so hard reloads and framework double-boots\n// inside the same tab still dedupe (the in-memory value resets on reload).\nvar lastSubmitKey="";\ntry{lastSubmitKey=sessionStorage.getItem(SS_LAST_SUBMIT)||""}catch(e){}\n\n// Page-scoped dedup state SHARED with the frontend SDK (browser.ts getSharedDedup).\n// On a Tier 1 page both this inline script and the SDK submit; each holds its own\n// in-memory lastSubmitKey, so both could pass the check below and POST. window.__unshared\n// is read+written synchronously in submitFP (no await between), so whichever fires\n// first claims the uid|route key and the other no-ops — killing the read-before-write\n// race that doubled events. KEEP IN SYNC with browser.ts: namespace, lastKey, key formula.\nvar shared=(window.__unshared=window.__unshared||{});\n// Sticky flagged signal: emitFlagged() records shared.flagged and drains\n// shared.flaggedCbs, so listeners that attach AFTER the CustomEvent fired\n// (late hydration, fp.js still loading) can recover it via whenFlagged().\n// KEEP IN SYNC with browser.ts getSharedDedup: flagged, flaggedCbs, whenFlagged.\nshared.whenFlagged=shared.whenFlagged||function(cb){(shared.flaggedCbs=shared.flaggedCbs||[]).push(cb);if(shared.flagged){try{cb(shared.flagged)}catch(e){}}};\n\n// --- Helpers ---\nfunction gC(n){var m=document.cookie.match(new RegExp("(?:^|; )"+n+"=([^;]*)"));return m?decodeURIComponent(m[1]):null}\nfunction sC(n,v,d){var e="";if(d){var dt=new Date();dt.setTime(dt.getTime()+d*864e5);e="; expires="+dt.toUTCString()}document.cookie=n+"="+encodeURIComponent(v)+e+"; path=/; SameSite=Lax"+(location.protocol==="https:"?"; Secure":"")}\nfunction uuid(){return(typeof crypto!=="undefined"&&crypto.randomUUID)?crypto.randomUUID():("xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,function(c){var r=Math.random()*16|0;return(c==="x"?r:r&0x3|0x8).toString(16)}))}\nfunction validPid(v){return typeof v==="string"&&/^upid_[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(v)}\nfunction bLen(v){return typeof TextEncoder!=="undefined"?new TextEncoder().encode(v).length:encodeURIComponent(v).replace(/%[0-9A-F]{2}/g,"x").length}\nfunction cCookies(){try{return document.cookie.split(";").map(function(v){return v.trim()}).filter(Boolean).map(function(v){var i=v.indexOf("="),n=i<0?v:v.slice(0,i),r=i<0?"":v.slice(i+1),d=r;try{d=decodeURIComponent(r)}catch(e){}return{name:n,value:d}}).sort(function(a,b){return a.name<b.name?-1:a.name>b.name?1:0})}catch(e){return[]}}\nfunction cStorage(s,keys){try{var out=[];for(var i=0;i<keys.length;i++){var v=s.getItem(keys[i]);if(v!==null)out.push({name:keys[i],value:v})}return out.sort(function(a,b){return a.name<b.name?-1:a.name>b.name?1:0})}catch(e){return[]}}\nfunction browserStorage(){var l=[],s=[];try{l=cStorage(localStorage,["__unshared_device_id"])}catch(e){}try{s=cStorage(sessionStorage,CAPTURE_SESSION_KEYS)}catch(e){}return{cookies:cCookies(),local_storage:l,session_storage:s}}\n// Sentinel user IDs that must never be treated as real users. Mirrors\n// the Set in sentinel-user-id.ts — keep in sync. Empty string is handled\n// by the separate !uid checks below.\nvar SENTINEL_UIDS={"__pre_auth__":1,"anonymous":1,"guest":1,"undefined":1,"null":1};\nfunction isSentinelUid(v){return typeof v==="string"&&SENTINEL_UIDS.hasOwnProperty(v)}\n\n// --- Session + device IDs ---\n// Session ID is a UUID because it's supposed to be tab-scoped and random.\n// Device ID is intentionally NOT a UUID — Issue 9: random UUIDs wrote\n// meaningless device_ids to every fingerprint row. Instead we read the\n// stable fingerprint hash from localStorage if a previous submission\n// already persisted it; otherwise we leave did empty and let submitFP()\n// reconcile on the first successful collection. The Node middleware's\n// Issue 8 bootstrap-skip branch handles the empty-device_id window so we\n// never dispatch with a random or "unknown" value.\nvar sid=gC("__unshared_sid");\nif(!sid){sid=uuid()}sC("__unshared_sid",sid,365);\nvar did="",pid="";\n\n// --- Fingerprint cache (sessionStorage) ---\n// Old normalized-only caches cannot recover overwritten raw fields; recollect them.\nfunction getFP(){try{var w=sessionStorage.getItem(SS_FP),r=sessionStorage.getItem(SS_FP_RAW);return w&&r?{wire:JSON.parse(w),raw:JSON.parse(r)}:null}catch(e){return null}}\nfunction setFP(collected){try{sessionStorage.removeItem(SS_FP_RAW);sessionStorage.setItem(SS_FP,JSON.stringify(collected.wire));sessionStorage.setItem(SS_FP_RAW,JSON.stringify(collected.raw))}catch(e){}}\n\n// --- Submit fingerprint to backend ---\nfunction submitFP(collected){\n  var fp=collected.wire;\n  var uid=gC("__unshared_uid");\n  if(!uid||isSentinelUid(uid))return;\n  try{pid=localStorage.getItem("__unshared_device_id")||""}catch(e){}\n  if(!validPid(pid)){pid="upid_"+uuid();try{localStorage.setItem("__unshared_device_id",pid)}catch(e){}}\n  sC("__unshared_device_id",pid,400);\n  // Issue 9: reconcile device_id to the stable fingerprint hash. This runs\n  // before we send the X-Device-Id header so the very first submission\n  // already carries the real value. Persist to localStorage so other tabs\n  // (and future reloads) pick up the same stable ID without needing to\n  // re-collect the fingerprint.\n  if(fp.fingerprint_id){\n    did=fp.fingerprint_id;\n    sC("__unshared_fp_id",did,365);\n  }\n  // event_type is the SPA route, not a fixed enum. Page-level event names\n  // (page_load/route_change) collapsed every row into one of two buckets;\n  // the URL is more useful for analytics and matches the frontend SDK.\n  var route=(location.pathname||"/")+(location.search||"");\n  var key=uid+"|"+route;\n  // Check the shared window guard AND the in-memory key (last-key semantics, so an\n  // SPA A->B->A revisit still submits the second A). The shared guard makes this\n  // submitter and the frontend SDK see each other within the page.\n  if(key===lastSubmitKey||shared.lastKey===key)return;\n  // collected_at is stamped fresh at submit time rather than carried from fp.timestamp,\n  // because fp is cached per-tab in sessionStorage — reusing its original timestamp would\n  // freeze collected_at at first load and drift against server created_at as the tab ages.\n  // The server authoritatively overwrites this value again on ingress.\n  var body={fingerprint:collected.raw,context:{sdk:{name:"unshared-inline-sdk",version:"3.0.0",agent_source:fp.source||"unknown"},identity:{user_id:uid},identifiers:{unshared_device_id:pid,device_id:did,stable_hash:fp.fingerprint_id||"",full_hash:fp.full_hash||"",session_hash:sid},browser_storage:browserStorage(),event:{type:route,collected_at:(new Date()).toISOString()}}};\n  var payload=JSON.stringify(body);\n  // Keep in sync with the structured browser builder: full, cookies only, core only.\n  if(bLen(payload)>MAX_REQUEST_BYTES){body.context.browser_storage.local_storage=[];body.context.browser_storage.session_storage=[];payload=JSON.stringify(body);}\n  if(bLen(payload)>MAX_REQUEST_BYTES){delete body.context.browser_storage;payload=JSON.stringify(body);}\n  if(bLen(payload)>MAX_REQUEST_BYTES){if(window.console&&console.warn)console.warn("[Unshared] REQUEST_TOO_LARGE: Request body exceeds 100 KiB");return;}\n  shared.lastKey=key;\n  lastSubmitKey=key;\n  try{sessionStorage.setItem(SS_LAST_SUBMIT,key)}catch(e){}\n  // Idempotency key derived from (stable_hash, user_id, route), SHA-256-hashed\n  // when WebCrypto is available so the user_id never appears in the platform's\n  // stored idempotency_key column (raw fallback on non-secure contexts — the\n  // middleware accepts both). NOTE: the middleware appends |Date.now() before\n  // forwarding (submit-fp.ts), so the backend sees a unique value per\n  // submission and dedups only PubSub redeliveries — NOT two distinct POSTs.\n  // Cross-submitter / cross-reload dedup is client-side (the shared window\n  // guard + sessionStorage above).\n  var idem=fp.fingerprint_id+"|"+uid+"|"+route;\n  function sendFP(idemKey){\n    var xhr=new XMLHttpRequest();\n    xhr.open("POST",pfx+"/submit-fp",true);\n    xhr.setRequestHeader("Content-Type","application/json");\n    xhr.setRequestHeader("X-Session-Id",sid);\n    if(did)xhr.setRequestHeader("X-Device-Id",did);\n    if(pid)xhr.setRequestHeader("X-Permanent-Device-Id",pid);\n    xhr.setRequestHeader("X-Idempotency-Key",idemKey);\n    xhr.send(payload);\n  }\n  if(window.crypto&&crypto.subtle&&window.TextEncoder){\n    crypto.subtle.digest("SHA-256",new TextEncoder().encode(idem)).then(function(d){\n      var a=new Uint8Array(d),s="";\n      for(var i=0;i<a.length;i++){s+=("0"+a[i].toString(16)).slice(-2)}\n      sendFP(s);\n    }).catch(function(){sendFP(idem)});\n  }else{sendFP(idem)}\n}\n\n// --- Collect fingerprint (loads fp.js if needed) then submit ---\nvar fpReady=false;\nfunction collectAndSubmit(){\n  var uid=gC("__unshared_uid");\n  if(!uid||isSentinelUid(uid))return;\n  var cached=getFP();\n  if(cached){submitFP(cached);return}\n  if(!fpReady)return;\n  try{\n    var c=new UnsharedBrowser.UnsharedBrowser({baseUrl:""});\n    c.collectWithMetadata({exclude:["timing","speech"]}).then(function(fp){setFP(fp);submitFP(fp)}).catch(function(){});\n  }catch(e){}\n}\n\n// --- Load fp.js (always — browser caches it for 1h) ---\n// Submit cached FP immediately if available; load fp.js for fresh collection\nvar pageLoadSubmitted=false;\nvar _boot_uid=gC("__unshared_uid");\nif(getFP()&&_boot_uid&&!isSentinelUid(_boot_uid)){submitFP(getFP());pageLoadSubmitted=true;deferredCheck()}\nvar s=document.createElement("script");\ns.src=pfx+"/fp.js${r}";\ns.onload=function(){fpReady=true;${a}if(!pageLoadSubmitted){collectAndSubmit();deferredCheck()}};\ndocument.head.appendChild(s);\n\n// --- Deferred verdict check ---\n// After fingerprint submission, the backend processes the event async.\n// If the user was just flagged, the initial page load may have beaten\n// the verdict update. Re-check after a delay so newly flagged sessions\n// get caught without waiting for user interaction.\n// The endpoint always returns 200 so browsers don't log a scary red\n// network error — we inspect the body and dispatch the flagged event\n// ourselves when status==="flagged".\nfunction deferredCheck(){\n  var uid=gC("__unshared_uid");\n  if(!uid||isSentinelUid(uid))return;\n  setTimeout(function(){\n    try{fetch(pfx+"/status",{method:"GET",credentials:"same-origin"}).then(function(r){return r.json()}).then(function(b){if(b&&b.status==="flagged")emitFlagged(b)}).catch(function(){})}catch(e){}\n  },500);\n}\n\n// --- SPA route change tracking (History API + popstate) ---\nvar oPush=history.pushState,oReplace=history.replaceState;\nhistory.pushState=function(){oPush.apply(this,arguments);try{collectAndSubmit()}catch(e){}};\nhistory.replaceState=function(){oReplace.apply(this,arguments);try{collectAndSubmit()}catch(e){}};\nwindow.addEventListener("popstate",function(){try{collectAndSubmit()}catch(e){}});\n\n// --- 403 interception: record sticky state + dispatch "unshared:flagged" ---\nfunction emitFlagged(body){\n  var d={email:body.email||""};\n  shared.flagged=d;\n  var cbs=shared.flaggedCbs||[];\n  for(var i=0;i<cbs.length;i++){try{cbs[i](d)}catch(e){}}\n  try{window.dispatchEvent(new CustomEvent("unshared:flagged",{detail:d}))}catch(e){}\n}\n\n// Patch fetch\nvar oFetch=window.fetch;\nif(oFetch){window.fetch=function(){return oFetch.apply(this,arguments).then(function(r){if(r.status===403){try{var cl=r.clone();cl.json().then(function(b){if(b&&b.error==="account_flagged")emitFlagged(b)}).catch(function(){})}catch(e){}}return r})}}\n\n// Patch XMLHttpRequest\nvar oXSend=XMLHttpRequest.prototype.send;\nXMLHttpRequest.prototype.send=function(){var x=this;x.addEventListener("load",function(){if(x.status===403){try{var b=JSON.parse(x.responseText);if(b&&b.error==="account_flagged")emitFlagged(b)}catch(e){}}});return oXSend.apply(this,arguments)};\n\n}catch(e){}\n})();\n<\/script>`}function escapeJavaScript(e){return JSON.stringify(e).slice(1,-1).replace(/<\/(script)/gi,"<\\/$1").replace(new RegExp("\u2028","g"),"\\u2028").replace(new RegExp("\u2029","g"),"\\u2029")}Object.defineProperty(exports,"t",{value:!0}),exports.generateFingerprintScript=generateFingerprintScript;

package/dist/middleware/injection/fp-bundle-source.d.ts

@@ -1,13 +1,15 @@
 export declare const S3_FINGERPRINT_URL = "https://unshared-public.s3.us-east-2.amazonaws.com/fingerprint@1/fingerprint.umd.js";
 export interface FingerprintBundleSource {
-    /** Current UMD string: freshest S3 copy, else bundled fallback, else ''. */
-    get(): string;
+    /** Wait for the initial bounded S3 attempt, then return the cached UMD or fallback. */
+    get(): Promise<string>;
     /** Run one refresh cycle now (also called by the background timer). */
     refresh(): Promise<void>;
     /** Stop the background timer. */
     stop(): void;
 }
 export interface FingerprintBundleSourceOptions {
+    /** @internal Disable all remote fetches and serve only the bundled fallback. */
+    disabled?: boolean;
     url?: string;
     intervalMs?: number;
     fetchTimeoutMs?: number;
@@ -18,8 +20,7 @@ export interface FingerprintBundleSourceOptions {
     /**
      * Start the background refresh timer + immediate boot fetch.
      * @default true in production, false under NODE_ENV==='test' (so unit tests
-     *          never make a real network call to S3 — they seed with the bundled
-     *          fallback and drive `refresh()` with an injected fetch).
+     *          drive `get()` / `refresh()` with an injected fetch).
      */
     autoStart?: boolean;
 }

package/dist/middleware/injection/fp-bundle-source.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.S3_FINGERPRINT_URL=void 0,exports.createFingerprintBundleSource=createFingerprintBundleSource;const fs_1=require("fs"),module_1=require("module"),path_1=require("path");exports.S3_FINGERPRINT_URL="https://unshared-public.s3.us-east-2.amazonaws.com/fingerprint@1/fingerprint.umd.js";const DEFAULT_REFRESH_INTERVAL_MS=9e5,DEFAULT_FETCH_TIMEOUT_MS=5e3;function defaultLoadFallback(){try{const e=(0,module_1.createRequire)(__filename).resolve("unshared-frontend-sdk/package.json"),t=(0,module_1.createRequire)(e).resolve("unshared-fingerprint-lib"),r=(0,path_1.join)((0,path_1.dirname)(t),"fingerprint.umd.js");return(0,fs_1.readFileSync)(r,"utf8")}catch{return""}}function createFingerprintBundleSource(e={}){const t=e.url??exports.S3_FINGERPRINT_URL,r=e.intervalMs??DEFAULT_REFRESH_INTERVAL_MS,n=e.fetchTimeoutMs??DEFAULT_FETCH_TIMEOUT_MS,o=e.fetchImpl??globalThis.fetch;let s,a,i=(e.loadFallback??defaultLoadFallback)();async function u(){if(!o)return;const e=new AbortController,r=setTimeout(()=>e.abort(),n);try{const r={};s&&(r["If-None-Match"]=s);const n=await o(t,{headers:r,signal:e.signal});if(304===n.status)return;if(!n.ok)return;const a=await n.text();a&&(i=a,s=n.headers.get("etag")??void 0)}catch{}finally{clearTimeout(r)}}return(e.autoStart??"test"!==process.env.NODE_ENV)&&(u(),a=setInterval(()=>{u()},r),"function"==typeof a.unref&&a.unref()),{get:()=>i,refresh:u,stop:()=>{a&&clearInterval(a),a=void 0}}}
+"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.S3_FINGERPRINT_URL=void 0,exports.createFingerprintBundleSource=createFingerprintBundleSource;const fs_1=require("fs"),module_1=require("module"),path_1=require("path");exports.S3_FINGERPRINT_URL="https://unshared-public.s3.us-east-2.amazonaws.com/fingerprint@1/fingerprint.umd.js";const DEFAULT_REFRESH_INTERVAL_MS=9e5,DEFAULT_FETCH_TIMEOUT_MS=1e3;function defaultLoadFallback(){try{const e=(0,module_1.createRequire)(__filename).resolve("unshared-frontend-sdk/package.json"),t=(0,module_1.createRequire)(e).resolve("unshared-fingerprint-lib"),r=(0,path_1.join)((0,path_1.dirname)(t),"fingerprint.umd.js");return(0,fs_1.readFileSync)(r,"utf8")}catch{return""}}function createFingerprintBundleSource(e={}){const t=e.disabled??!1,r=e.url??exports.S3_FINGERPRINT_URL,n=e.intervalMs??DEFAULT_REFRESH_INTERVAL_MS,o=e.fetchTimeoutMs??DEFAULT_FETCH_TIMEOUT_MS,s=e.fetchImpl??globalThis.fetch;let a,i,u,c,l=(e.loadFallback??defaultLoadFallback)();function _(){if(t)return Promise.resolve();if(c)return c;const e=new AbortController;let n;const i=new Promise(t=>{n=setTimeout(()=>{e.abort(),t()},o)});return c=Promise.race([(async()=>{try{if(!s)return;const t={};a&&(t["If-None-Match"]=a);const n=await s(r,{headers:t,signal:e.signal});if(304===n.status||!n.ok)return;const o=await n.text();o&&!e.signal.aborted&&(l=o,a=n.headers.get("etag")??void 0)}catch{}})(),i]).finally(()=>{clearTimeout(n),c=void 0}),u??(u=c),c}return(e.autoStart??"test"!==process.env.NODE_ENV)&&!t&&(_(),i=setInterval(()=>{_()},n),"function"==typeof i.unref&&i.unref()),{get:async()=>(await(u??_()),l),refresh:_,stop:()=>{i&&clearInterval(i),i=void 0}}}

package/dist/middleware/routes/submit-fp.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"i",{value:!0}),exports.handleSubmitFingerprint=handleSubmitFingerprint;const util_1=require("../../util"),is_bot_1=require("../utils/is-bot"),client_ip_1=require("../utils/client-ip"),cookies_1=require("../utils/cookies"),device_id_1=require("../utils/device-id"),secure_1=require("../utils/secure"),sentinel_user_id_1=require("../utils/sentinel-user-id"),http_helpers_1=require("../utils/http-helpers"),dispatch_processing_1=require("../dispatch-processing");function handleSubmitFingerprint(e){return async(i,t)=>{try{const s=i.body??{},n={full_hash:s.hash??"",fingerprint_id:s.stable_hash??"",timestamp:s.collected_at??(new Date).toISOString(),isIncognito:s.is_incognito??!1,components:s.components??{},version:s.version??"inline-1.0.0",..."remote"===s.source||"bundled"===s.source?{source:s.source}:{}};let r,o,_;try{const t=e.resolveUserId?e.resolveUserId(i):void 0;t&&!(0,sentinel_user_id_1.isSentinelUserId)(t)&&(r=t)}catch{}if(!r){const e="string"==typeof s.user_id?s.user_id:void 0;e&&!(0,sentinel_user_id_1.isSentinelUserId)(e)&&(r=e)}if(!r){const e=(0,cookies_1.parseCookie)(i,"__unshared_uid");e&&!(0,sentinel_user_id_1.isSentinelUserId)(e)&&(r=e)}try{o=e.resolveEmailAddress?e.resolveEmailAddress(i):void 0}catch{}o=o??(0,cookies_1.parseCookie)(i,"__unshared_email")??s.email??void 0;try{_=e.resolveSessionId?e.resolveSessionId(i):void 0}catch{}_=_??s.session_id??(0,cookies_1.parseCookie)(i,"__unshared_sid");const c=(0,client_ip_1.extractClientIp)(i),d=i.headers["user-agent"]??"";if(!e.disableBotFilter&&(0,is_bot_1.isBot)(d))return void(0,http_helpers_1.sendJson)(t,200,{success:!0});const u=(n.fingerprint_id&&n.fingerprint_id.length>0?n.fingerprint_id:void 0)??(0,device_id_1.extractDeviceId)(i,e.resolveDeviceId),a=n.fingerprint_id||void 0,p=n.full_hash||void 0,l=(0,secure_1.isSecureRequest)(i)?"; Secure":"",h=[];if(p&&!(0,cookies_1.parseCookie)(i,"__unshared_fingerprint_id")&&h.push(`__unshared_fingerprint_id=${encodeURIComponent(p)}; HttpOnly; Path=/; SameSite=Lax${l}`),a){const e=(0,cookies_1.parseCookie)(i,"__unshared_fp_id");e&&e===a||h.push(`__unshared_fp_id=${encodeURIComponent(a)}; Path=/; SameSite=Lax; Max-Age=31536000${l}`)}if(o&&!(0,cookies_1.parseCookie)(i,"__unshared_email")&&h.push(`__unshared_email=${encodeURIComponent(o)}; HttpOnly; Path=/; SameSite=Lax${l}`),h.length>0){const e=t.getHeader("Set-Cookie");if(e){const i=Array.isArray(e)?[...e]:[String(e)];i.push(...h),t.setHeader("Set-Cookie",i)}else t.setHeader("Set-Cookie",h)}let f;if("string"==typeof s.event_type&&s.event_type)f=s.event_type;else{const e=i.headers.referer??i.headers.referrer;let t="unknown";if("string"==typeof e&&e.length>0)try{const i=new URL(e);t=(i.pathname||"/")+(i.search||"")}catch{}f=t}const g=i.headers["x-idempotency-key"],m="string"==typeof g&&g.length>0?g:void 0,v=Date.now(),y=m?`${m}|${v}`:a&&r?`${(0,util_1.sha256Hex)(`${a}|${r}|${f}`)}|${v}`:void 0;r&&e.client.submitFingerprintEvent(n,{userId:r,emailAddress:o,sessionHash:_,eventType:f,ipAddress:c,userAgent:d,idempotencyKey:y}).catch(i=>{e.onError&&e.onError(i,{operation:"submitFingerprintEvent",userId:r,emailAddress:o})}),r&&o&&!e.rateLimitBackoff.isPaused()&&!e.dispatchDedupe.wasRecentlyDispatched(r,f)&&await(0,dispatch_processing_1.runProcessUserEvent)({client:e.client,cache:e.verdictCache,backoff:e.rateLimitBackoff,onError:e.onError},{eventType:f,userId:r,emailAddress:o,ipAddress:c,deviceId:u,fingerprintId:a,sessionHash:_??"unknown",userAgent:d},dispatch_processing_1.SUBMIT_FP_TIMEOUT_MS),(0,http_helpers_1.sendJson)(t,200,{success:!0})}catch(i){e.onError&&e.onError(i,{operation:"submitFingerprintEvent"}),(0,http_helpers_1.sendJson)(t,200,{success:!0})}}}
+"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.handleSubmitFingerprint=handleSubmitFingerprint;const util_1=require("../../util"),is_bot_1=require("../utils/is-bot"),client_ip_1=require("../utils/client-ip"),cookies_1=require("../utils/cookies"),device_id_1=require("../utils/device-id"),secure_1=require("../utils/secure"),sentinel_user_id_1=require("../utils/sentinel-user-id"),http_helpers_1=require("../utils/http-helpers"),permanent_device_id_1=require("../utils/permanent-device-id"),dispatch_processing_1=require("../dispatch-processing");function asRecord(e){return null===e||"object"!=typeof e||Array.isArray(e)?{}:e}function handleSubmitFingerprint(e){return async(t,i)=>{try{const s=asRecord(t.body),r=asRecord(s.fingerprint??s),n=asRecord(s.context),o=asRecord(n.identity),c=asRecord(n.identifiers),_=asRecord(n.event),d={...r,full_hash:r.hash??r.full_hash??"",fingerprint_id:r.stableHash??r.stable_hash??r.fingerprint_id??"",timestamp:r.timestamp??r.collected_at??(new Date).toISOString(),isIncognito:r.isIncognito??r.is_incognito??!1,components:r.components??{},version:r.version??"unknown",..."remote"===r.source||"bundled"===r.source?{source:r.source}:{}};let a,p,u;try{const i=e.resolveUserId?e.resolveUserId(t):void 0;i&&!(0,sentinel_user_id_1.isSentinelUserId)(i)&&(a=i)}catch{}if(!a){const e="string"==typeof o.user_id?o.user_id:"string"==typeof s.user_id?s.user_id:void 0;e&&!(0,sentinel_user_id_1.isSentinelUserId)(e)&&(a=e)}if(!a){const e=(0,cookies_1.parseCookie)(t,"__unshared_uid");e&&!(0,sentinel_user_id_1.isSentinelUserId)(e)&&(a=e)}try{p=e.resolveEmailAddress?e.resolveEmailAddress(t):void 0}catch{}p=p??(0,cookies_1.parseCookie)(t,"__unshared_email")??o.email_address??s.email??void 0;try{u=e.resolveSessionId?e.resolveSessionId(t):void 0}catch{}u=u??c.session_hash??s.session_id??(0,cookies_1.parseCookie)(t,"__unshared_sid");const l=(0,client_ip_1.extractClientIp)(t),h=t.headers["user-agent"]??"";if(!e.disableBotFilter&&(0,is_bot_1.isBot)(h))return void(0,http_helpers_1.sendJson)(i,200,{success:!0,data:{skipped:!0}});const f=(d.fingerprint_id&&d.fingerprint_id.length>0?d.fingerprint_id:void 0)??(0,device_id_1.extractDeviceId)(t,e.resolveDeviceId),y=d.fingerprint_id||void 0,g=d.full_hash||void 0,v=(0,permanent_device_id_1.resolveOrCreatePermanentDeviceId)(t,c.unshared_device_id??s.permanent_device_id),m=(0,secure_1.isSecureRequest)(t)?"; Secure":"",b=[];b.push(`__unshared_device_id=${encodeURIComponent(v.id)}; Path=/; SameSite=Lax; Max-Age=34560000${m}`);const R=(0,cookies_1.parseCookie)(t,"__unshared_fingerprint_id")||g;if(R&&b.push(`__unshared_fingerprint_id=${encodeURIComponent(R)}; HttpOnly; Path=/; SameSite=Lax; Max-Age=31536000${m}`),y&&b.push(`__unshared_fp_id=${encodeURIComponent(y)}; Path=/; SameSite=Lax; Max-Age=31536000${m}`),p&&b.push(`__unshared_email=${encodeURIComponent(p)}; HttpOnly; Path=/; SameSite=Lax; Max-Age=31536000${m}`),b.length>0){const e=i.getHeader("Set-Cookie");if(e){const t=Array.isArray(e)?[...e]:[String(e)];t.push(...b),i.setHeader("Set-Cookie",t)}else i.setHeader("Set-Cookie",b)}let S;if("string"==typeof _.type&&_.type)S=_.type;else if("string"==typeof s.event_type&&s.event_type)S=s.event_type;else{const e=t.headers.referer??t.headers.referrer;let i="unknown";if("string"==typeof e&&e.length>0)try{const t=new URL(e);i=(t.pathname||"/")+(t.search||"")}catch{}S=i}const $=t.headers["x-idempotency-key"],k="string"==typeof $&&$.length>0?$:void 0,x=Date.now(),A=k?`${k}|${x}`:y&&a?`${(0,util_1.sha256Hex)(`${y}|${a}|${S}`)}|${x}`:void 0,q={...c,unshared_device_id:v.id,...f?{device_id:f}:{},...y?{stable_hash:y}:{},...g?{full_hash:g}:{},...u?{session_hash:u}:{}},j="string"==typeof asRecord(n.sdk).name?asRecord(n.sdk).name:void 0,C="string"==typeof j&&j.startsWith("unshared-")&&Object.prototype.hasOwnProperty.call(s,"fingerprint")&&s.context&&"object"==typeof s.context&&!Array.isArray(s.context)&&n.identity&&"object"==typeof n.identity&&!Array.isArray(n.identity)&&n.identifiers&&"object"==typeof n.identifiers&&!Array.isArray(n.identifiers)&&n.event&&"object"==typeof n.event&&!Array.isArray(n.event),w=!Object.prototype.hasOwnProperty.call(s,"context")&&"string"==typeof s.hash&&"string"==typeof s.stable_hash&&"string"==typeof s.collected_at&&s.components&&"object"==typeof s.components&&!Array.isArray(s.components),I=C||w?{...s,fingerprint:r,context:{...n,sdk:asRecord(n.sdk),identity:{...o,...a?{user_id:a}:{},...p?{email_address:p}:{}},identifiers:q,event:{..._,type:S,ip_address:l,user_agent:h}}}:s,L=await e.client.submitFingerprint(I,{idempotencyKey:A});L.success||e.onError?.(L.error,{operation:"submitFingerprintEvent",userId:a,emailAddress:p}),a&&p&&!e.rateLimitBackoff.isPaused()&&!e.dispatchDedupe.wasRecentlyDispatched(a,S)&&await(0,dispatch_processing_1.runCheckUser)({client:e.client,cache:e.verdictCache,backoff:e.rateLimitBackoff,onError:e.onError},{user_id:a,email_address:p,identifiers:q},a,p,dispatch_processing_1.SUBMIT_FP_TIMEOUT_MS),L.success?(0,http_helpers_1.sendJson)(i,200,{success:!0,data:L.data}):(0,http_helpers_1.sendJson)(i,200,{success:!1,error:L.error})}catch(t){e.onError&&e.onError(t,{operation:"submitFingerprintEvent"}),(0,http_helpers_1.sendJson)(i,200,{success:!0,data:{accepted:!1}})}}}

package/dist/middleware/routes/verify.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"i",{value:!0}),exports.handleVerifyTrigger=handleVerifyTrigger,exports.handleVerify=handleVerify;const cookies_1=require("../utils/cookies"),device_id_1=require("../utils/device-id"),http_helpers_1=require("../utils/http-helpers");function handleVerifyTrigger(e){return async(r,i)=>{try{const s=resolveEmail(r,r.body??{},e.resolveEmailAddress);if(!s)return void(0,http_helpers_1.sendJson)(i,400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Email is required"}});const t=(0,device_id_1.extractDeviceId)(r,e.resolveDeviceId),c=(0,cookies_1.parseCookie)(r,"__unshared_fingerprint_id")||void 0,o=await e.client.triggerEmailVerification(s,t,{fingerprintId:c});o.success?(0,http_helpers_1.sendJson)(i,200,{success:!0,data:o.data}):(0,http_helpers_1.sendJson)(i,200,{success:!1,error:o.error??{code:"TRIGGER_FAILED",message:"Failed to send verification email"}})}catch(r){e.onError&&e.onError(r,{operation:"verifyTrigger"}),(0,http_helpers_1.sendJson)(i,200,{success:!1,error:{code:"INTERNAL_ERROR",message:"Failed to trigger verification"}})}}}function handleVerify(e){return async(r,i)=>{try{const s=r.body??{},t=resolveEmail(r,s,e.resolveEmailAddress),c=s.code;if(!t||!c)return void(0,http_helpers_1.sendJson)(i,400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Email and code are required"}});const o=(0,device_id_1.extractDeviceId)(r,e.resolveDeviceId),a=(0,cookies_1.parseCookie)(r,"__unshared_fingerprint_id")||void 0,n=await e.client.verify(t,o,c,{fingerprintId:a});if(n.success){let s;try{s=e.resolveUserId?.(r)}catch{}s&&e.verdictCache.update(s,{isVerified:!0}),(0,http_helpers_1.sendJson)(i,200,{success:!0,data:{verified:!0}})}else(0,http_helpers_1.sendJson)(i,200,{success:!1,error:n.error??{code:"VERIFICATION_FAILED",message:"Verification failed"}})}catch(r){e.onError&&e.onError(r,{operation:"verify"}),(0,http_helpers_1.sendJson)(i,200,{success:!1,error:{code:"INTERNAL_ERROR",message:"Verification failed"}})}}}function resolveEmail(e,r,i){if(i)try{const r=i(e);if(r)return r}catch{}const s=(0,cookies_1.parseCookie)(e,"__unshared_email");if(s)return s;const t=r.email;return"string"==typeof t&&t?t:void 0}
+"use strict";Object.defineProperty(exports,"i",{value:!0}),exports.handleVerifyTrigger=handleVerifyTrigger,exports.handleVerify=handleVerify;const cookies_1=require("../utils/cookies"),device_id_1=require("../utils/device-id"),http_helpers_1=require("../utils/http-helpers"),permanent_device_id_1=require("../utils/permanent-device-id"),secure_1=require("../utils/secure"),VERIFICATION_COOKIE="__unshared_verification_id";function appendCookie(e,i){const r=e.getHeader("Set-Cookie"),s=r?Array.isArray(r)?[...r]:[String(r)]:[];s.push(i),e.setHeader("Set-Cookie",s)}function handleVerifyTrigger(e){return async(i,r)=>{try{const s=resolveEmail(i,i.body??{},e.resolveEmailAddress);if(!s)return void(0,http_helpers_1.sendJson)(r,400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Email is required"}});const t=(0,device_id_1.extractDeviceId)(i,e.resolveDeviceId),c=(0,cookies_1.parseCookie)(i,"__unshared_fp_id")||void 0,o=(0,cookies_1.parseCookie)(i,"__unshared_fingerprint_id")||void 0,_=(0,permanent_device_id_1.extractPermanentDeviceId)(i),n=await e.client.triggerEmailVerification(s,t,{fingerprintId:c,fullHash:o,permanentDeviceId:_});if(n.success){if(n.data?.verification_id){const e=(0,secure_1.isSecureRequest)(i)?"; Secure":"";appendCookie(r,`${VERIFICATION_COOKIE}=${encodeURIComponent(n.data.verification_id)}; HttpOnly; Path=/; SameSite=Lax; Max-Age=600${e}`)}(0,http_helpers_1.sendJson)(r,200,{success:!0,data:n.data})}else(0,http_helpers_1.sendJson)(r,200,{success:!1,error:n.error??{code:"TRIGGER_FAILED",message:"Failed to send verification email"}})}catch(i){e.onError&&e.onError(i,{operation:"verifyTrigger"}),(0,http_helpers_1.sendJson)(r,200,{success:!1,error:{code:"INTERNAL_ERROR",message:"Failed to trigger verification"}})}}}function handleVerify(e){return async(i,r)=>{try{const s=(i.body??{}).code,t=(0,cookies_1.parseCookie)(i,VERIFICATION_COOKIE);if(!t||!s)return void(0,http_helpers_1.sendJson)(r,400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Verification ID and code are required"}});const c=await e.client.verifyEmail({verification_id:t,code:s});if(c.success&&c.data?.verified){let s,t=!1;try{s=e.resolveUserId?.(i)}catch{}const o=resolveEmail(i,{},e.resolveEmailAddress),_=(0,device_id_1.extractDeviceId)(i,e.resolveDeviceId),n=(0,cookies_1.parseCookie)(i,"__unshared_fp_id")||void 0,a=(0,cookies_1.parseCookie)(i,"__unshared_fingerprint_id")||void 0,d=(0,permanent_device_id_1.extractPermanentDeviceId)(i);if(s&&o){const i={..._?{device_id:_}:{},...n?{stable_hash:n}:{},...a?{full_hash:a}:{},...d?{unshared_device_id:d}:{}},r=await e.client.checkUser({user_id:s,email_address:o,identifiers:i},{maxRetries:0});r.success&&r.data&&!r.failedOpen&&!r.data.is_user_flagged&&(e.verdictCache.update(s,{isVerified:!0}),t=!0)}const u=(0,secure_1.isSecureRequest)(i)?"; Secure":"";appendCookie(r,`${VERIFICATION_COOKIE}=; HttpOnly; Path=/; SameSite=Lax; Max-Age=0${u}`),t&&r.setHeader("X-Unshared-Enforcement-Reconciled","clean"),(0,http_helpers_1.sendJson)(r,200,{success:!0,data:c.data})}else c.success?(0,http_helpers_1.sendJson)(r,200,{success:!0,data:c.data}):(0,http_helpers_1.sendJson)(r,200,{success:!1,error:c.error??{code:"VERIFICATION_FAILED",message:"Verification failed"}})}catch(i){e.onError&&e.onError(i,{operation:"verify"}),(0,http_helpers_1.sendJson)(r,200,{success:!1,error:{code:"INTERNAL_ERROR",message:"Verification failed"}})}}}function resolveEmail(e,i,r){if(r)try{const i=r(e);if(i)return i}catch{}const s=(0,cookies_1.parseCookie)(e,"__unshared_email");if(s)return s;const t=i.email;return"string"==typeof t&&t?t:void 0}

package/dist/middleware/utils/permanent-device-id.d.ts

@@ -0,0 +1,7 @@
+import type { UnsharedRequest } from '../../types';
+export declare function isPermanentDeviceId(value: unknown): value is string;
+export declare function extractPermanentDeviceId(req: UnsharedRequest): string | undefined;
+export declare function resolveOrCreatePermanentDeviceId(req: UnsharedRequest, candidate?: unknown): {
+    id: string;
+    shouldSetCookie: boolean;
+};

package/dist/middleware/utils/permanent-device-id.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.isPermanentDeviceId=isPermanentDeviceId,exports.extractPermanentDeviceId=extractPermanentDeviceId,exports.resolveOrCreatePermanentDeviceId=resolveOrCreatePermanentDeviceId;const crypto_1=require("crypto"),cookies_1=require("./cookies"),PERMANENT_DEVICE_ID_PATTERN=/^upid_[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;function isPermanentDeviceId(e){return"string"==typeof e&&PERMANENT_DEVICE_ID_PATTERN.test(e)}function extractPermanentDeviceId(e){const r=(0,cookies_1.parseCookie)(e,"__unshared_device_id");if(isPermanentDeviceId(r))return r;const t=e.headers["x-permanent-device-id"];return isPermanentDeviceId(t)?t:void 0}function resolveOrCreatePermanentDeviceId(e,r){const t=(0,cookies_1.parseCookie)(e,"__unshared_device_id");if(isPermanentDeviceId(t))return{id:t,shouldSetCookie:!1};const i=e.headers["x-permanent-device-id"];return{id:isPermanentDeviceId(i)?i:isPermanentDeviceId(r)?r:`upid_${(0,crypto_1.randomUUID)()}`,shouldSetCookie:!0}}

package/dist/middleware/utils/read-json-body.d.ts

@@ -0,0 +1,3 @@
+import type { UnsharedRequest, UnsharedResponse } from '../../types';
+/** Only call for SDK-owned routes, never for application requests. */
+export declare function readJsonBody(req: UnsharedRequest, res: UnsharedResponse): Promise<boolean>;

package/dist/middleware/utils/read-json-body.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.readJsonBody=readJsonBody;const http_helpers_1=require("./http-helpers"),MAX_REQUEST_BYTES=1<<20;async function readJsonBody(e,t){const r=e,o=(e,o,s)=>{if(!r.destroyed&&!r.readableEnded&&r.resume&&r.once&&r.removeListener&&r.destroy){const e=setTimeout(()=>r.destroy(),3e4);e.unref();const t=()=>{clearTimeout(e),r.removeListener("end",t),r.removeListener("close",t),r.removeListener("error",t)};r.once("end",t),r.once("close",t),r.once("error",t),r.resume()}return(0,http_helpers_1.sendJson)(t,e,{success:!1,error:{code:o,message:s}}),!1},s=()=>o(413,"REQUEST_TOO_LARGE","Request body exceeds 1 MiB");if(void 0!==e.body)try{return!(Buffer.byteLength(JSON.stringify(e.body),"utf8")>MAX_REQUEST_BYTES)||s()}catch{return o(400,"INVALID_JSON","Request body is not valid JSON.")}return r.on&&r.removeListener&&r.pause?r.destroyed||r.readableEnded?o(400,"INVALID_JSON","Request body is unavailable or incomplete."):Number(e.headers["content-length"])>MAX_REQUEST_BYTES?s():e.headers["content-encoding"]&&"identity"!==e.headers["content-encoding"]?o(415,"UNSUPPORTED_ENCODING","Request body must use identity encoding."):new Promise(t=>{const s=[];let d=0,u=!1;const n=(e,d,n)=>{u||(u=!0,clearTimeout(_),r.removeListener("data",a),r.removeListener("end",c),r.removeListener("aborted",i),r.removeListener("error",i),r.removeListener("close",i),s.length=0,t(!e||o(e,d,n)))},i=()=>n(400,"INVALID_JSON","Request body is unavailable or incomplete."),a=e=>{const t=Buffer.isBuffer(e)?e:Buffer.from(e,"utf8");d+=t.length,d>MAX_REQUEST_BYTES?n(413,"REQUEST_TOO_LARGE","Request body exceeds 1 MiB"):s.push(t)},c=()=>{try{e.body=JSON.parse(Buffer.concat(s,d).toString("utf8"))}catch{return void n(400,"INVALID_JSON","Request body is not valid JSON.")}n()},_=setTimeout(()=>n(408,"REQUEST_TIMEOUT","Timed out reading request body."),3e4);_.unref(),r.on("data",a),r.on("end",c),r.on("aborted",i),r.on("error",i),r.on("close",i)}):o(400,"BODY_PARSER_MISSING","Provide a readable Node request stream or a parsed JSON body.")}

package/dist/middleware.d.ts

@@ -38,7 +38,6 @@ export interface MiddlewareOptions<TReq extends UnsharedRequest = UnsharedReques
  * @example
  * ```typescript
  * assertTrustProxy(app);  // throws at startup if not set
- * app.use(express.json());
  * app.use(createUnsharedMiddleware(client, options));
  * ```
  */
@@ -51,8 +50,8 @@ export declare function assertTrustProxy(app: any): void;
  * Passes all other requests to next().
  *
  * **Prerequisites:**
- * - Mount `express.json()` (or equivalent body-parser) **before** this middleware,
- *   otherwise `req.body` will be undefined and every request will return 400.
+ * - Existing default JSON parser order is supported by the browser's 100 KiB
+ *   proxy limit. Unparsed SDK routes are also read automatically up to 1 MiB.
  * - For cross-origin frontends, pass `corsOrigins` instead of configuring CORS
  *   separately — the middleware handles OPTIONS preflight automatically.
  * - `user_id` is automatically scrubbed from `req.body` after it is read, so
@@ -67,10 +66,10 @@ export declare function assertTrustProxy(app: any): void;
  * ```typescript
  * import { createUnsharedMiddleware } from "unshared-clientjs-sdk";
  *
- * app.use(express.json());  // must come first
  * app.use(createUnsharedMiddleware(client, {
  *   userIdExtractor: (req) => req.user?.id,
  * }));
+ * app.use(express.json()); // application routes keep their own default limit
  * ```
  */
 export declare function createUnsharedMiddleware<TReq extends UnsharedRequest = UnsharedRequest>(client: UnsharedClient, options?: MiddlewareOptions<TReq>): (req: TReq, res: UnsharedResponse, next: UnsharedNextFunction) => Promise<void>;

package/dist/middleware.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.assertTrustProxy=assertTrustProxy,exports.createUnsharedMiddleware=createUnsharedMiddleware;const http_helpers_1=require("./middleware/utils/http-helpers");function assertTrustProxy(e){if(!e?.get?.("trust proxy"))throw new Error('[unshared-labs] Express "trust proxy" is not set.\n\n  Fix: add this line before mounting any middleware:\n    app.set("trust proxy", 1);\n\n  Why: without it, req.ip returns the proxy/load-balancer IP instead of\n  the real client IP, which degrades account-sharing detection accuracy.\n  Set to 1 if behind a single reverse proxy (Nginx, ALB, CloudFront),\n  or the number of trusted proxies in your chain.')}function createUnsharedMiddleware(e,r){const{userIdExtractor:s,eventTypeExtractor:t,sessionIdExtractor:o,ipAddressExtractor:n,defaultEventType:i="browser_event",routePrefix:d="/unshared",corsOrigins:c}=r??{},a=`${d}/submit-fingerprint-event`,h=c?Array.isArray(c)?c:[c]:null;return async(r,d,c)=>{const u=(0,http_helpers_1.getRequestPath)(r.url);if(h&&u===a){const e=r.headers.origin??"",s=h.includes("*");if((s||h.includes(e))&&(d.setHeader("Access-Control-Allow-Origin",s?"*":e),d.setHeader("Access-Control-Allow-Methods","POST, OPTIONS"),d.setHeader("Access-Control-Allow-Headers","Content-Type, X-Idempotency-Key, X-Session-Id")),"OPTIONS"===r.method)return void(0,http_helpers_1.sendEmpty)(d,204)}if("POST"===r.method&&u===a)try{if(void 0===r.body)return void(0,http_helpers_1.sendJson)(d,400,{success:!1,error:{code:"BODY_PARSER_MISSING",message:"req.body is undefined. Mount a JSON body-parsing middleware (e.g., express.json()) before the Unshared middleware."}});const c=r.body??{};if(!c.hash||!c.stable_hash||!c.collected_at)return void(0,http_helpers_1.sendJson)(d,400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Missing required fingerprint fields: hash, stable_hash, collected_at"}});if(!r.headers["x-session-id"])return void(0,http_helpers_1.sendJson)(d,400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Missing required header: X-Session-Id"}});const a={full_hash:c.hash,fingerprint_id:c.stable_hash,timestamp:c.collected_at,isIncognito:c.is_incognito??!1,components:c.components??{},version:c.version??"unknown"};let h,u,l,p;try{h=(s?s(r):void 0)??c.user_id}catch{h=c.user_id}if(r.body&&"object"==typeof r.body&&"user_id"in r.body&&delete r.body.user_id,!h)return void(0,http_helpers_1.sendJson)(d,400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Missing required field: user_id"}});try{u=(t?t(r):void 0)??c.event_type??i}catch{u=c.event_type??i}try{l=(o?o(r):void 0)??r.headers["x-session-id"]?.toString()??c.session_id}catch{l=r.headers["x-session-id"]?.toString()??c.session_id}const _=r.ip??r.socket?.remoteAddress??"";try{p=(n?n(r):void 0)??_}catch{p=_}const f=await e.submitFingerprintEvent(a,{userId:h,sessionHash:l,eventType:u,ipAddress:p});if(!f.success)return void(0,http_helpers_1.sendJson)(d,200,{success:!1,error:{code:"UPSTREAM_ERROR",message:f.error?.message??"Upstream request failed"}});(0,http_helpers_1.sendJson)(d,202,{success:!0,data:f.data})}catch(e){(0,http_helpers_1.sendJson)(d,200,{success:!1,error:{code:"MIDDLEWARE_ERROR",message:e instanceof Error?e.message:"Middleware error"}})}else c()}}
+"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.assertTrustProxy=assertTrustProxy,exports.createUnsharedMiddleware=createUnsharedMiddleware;const http_helpers_1=require("./middleware/utils/http-helpers"),read_json_body_1=require("./middleware/utils/read-json-body");function assertTrustProxy(e){if(!e?.get?.("trust proxy"))throw new Error('[unshared-labs] Express "trust proxy" is not set.\n\n  Fix: add this line before mounting any middleware:\n    app.set("trust proxy", 1);\n\n  Why: without it, req.ip returns the proxy/load-balancer IP instead of\n  the real client IP, which degrades account-sharing detection accuracy.\n  Set to 1 if behind a single reverse proxy (Nginx, ALB, CloudFront),\n  or the number of trusted proxies in your chain.')}function createUnsharedMiddleware(e,t){const{userIdExtractor:r,eventTypeExtractor:o,sessionIdExtractor:s,ipAddressExtractor:n,defaultEventType:i="browser_event",routePrefix:c="/unshared",corsOrigins:a}=t??{},d=`${c}/submit-fingerprint-event`,p=a?Array.isArray(a)?a:[a]:null;return async(t,c,a)=>{const y=(0,http_helpers_1.getRequestPath)(t.url);if(p&&y===d){const e=t.headers.origin??"",r=p.includes("*");if((r||p.includes(e))&&(c.setHeader("Access-Control-Allow-Origin",r?"*":e),c.setHeader("Access-Control-Allow-Methods","POST, OPTIONS"),c.setHeader("Access-Control-Allow-Headers","Content-Type, X-Idempotency-Key, X-Session-Id, X-Permanent-Device-Id")),"OPTIONS"===t.method)return void(0,http_helpers_1.sendEmpty)(c,204)}if("POST"===t.method&&y===d)try{if(!await(0,read_json_body_1.readJsonBody)(t,c))return;const a=t.body??{};if(!a||"object"!=typeof a||Array.isArray(a))return void(0,http_helpers_1.sendJson)(c,400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Request body must be a JSON object"}});const d=a.context&&"object"==typeof a.context?a.context:{},p=d.identity&&"object"==typeof d.identity?d.identity:{},y=d.identifiers&&"object"==typeof d.identifiers?d.identifiers:{},u=d.event&&"object"==typeof d.event?d.event:{};let h,l,f,_;try{h=(r?r(t):void 0)??p.user_id}catch{h=p.user_id}try{l=(o?o(t):void 0)??u.type??i}catch{l=u.type??i}try{f=(s?s(t):void 0)??t.headers["x-session-id"]?.toString()??y.session_hash}catch{f=t.headers["x-session-id"]?.toString()??y.session_hash}const b=t.ip??t.socket?.remoteAddress??"";try{_=(n?n(t):void 0)??b}catch{_=b}const x=t.headers["x-permanent-device-id"]?.toString()??y.unshared_device_id,A=d.sdk&&"object"==typeof d.sdk?d.sdk.name:void 0,j="string"==typeof A&&A.startsWith("unshared-")&&a.fingerprint&&"object"==typeof a.fingerprint&&a.context&&"object"==typeof a.context&&!Array.isArray(a.context)&&a.context.identity&&"object"==typeof a.context.identity&&!Array.isArray(a.context.identity)&&a.context.identifiers&&"object"==typeof a.context.identifiers&&!Array.isArray(a.context.identifiers)&&a.context.event&&"object"==typeof a.context.event&&!Array.isArray(a.context.event),v=!Object.prototype.hasOwnProperty.call(a,"context")&&"string"==typeof a.hash&&"string"==typeof a.stable_hash&&"string"==typeof a.collected_at&&a.components&&"object"==typeof a.components&&!Array.isArray(a.components),g=j||v?{...a,context:{...d,identity:{...p,...h?{user_id:h}:{}},identifiers:{...y,...f?{session_hash:f}:{},...x?{unshared_device_id:x}:{}},event:{...u,type:l,..._?{ip_address:_}:{},user_agent:t.headers["user-agent"]?.toString()??""}}}:a,w=await e.submitFingerprint(g,{idempotencyKey:t.headers["x-idempotency-key"]?.toString()});if(!w.success)return void(0,http_helpers_1.sendJson)(c,200,{success:!1,error:w.error??{code:"UPSTREAM_ERROR",message:"Upstream request failed"}});(0,http_helpers_1.sendJson)(c,202,{success:!0,data:w.data})}catch(e){(0,http_helpers_1.sendJson)(c,200,{success:!1,error:{code:"MIDDLEWARE_ERROR",message:e instanceof Error?e.message:"Middleware error"}})}else a()}}

package/dist/shared-types.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Canonical wire-format for fingerprint data transmitted from the browser SDK to the backend.
+ *
+ * Single source of truth shared by:
+ *   - @unshared-labs/frontend-fingerprint  (serializer: _buildBody in browser.ts)
+ *   - @unshared-labs/sdk                   (submitFingerprintEvent in client.ts)
+ *
+ * SCHEMA AUTHORITY: The browser SDK serializer is the writer. The Node.js SDK is the
+ * reader. Any field added here must be produced by the browser SDK and consumed by the
+ * server SDK. Do not add fields that only one side uses.
+ */
+export type JSONPrimitive = string | number | boolean | null;
+export type JSONValue = JSONPrimitive | JSONObject | JSONValue[];
+export interface JSONObject {
+  [key: string]: JSONValue;
+}
+
+export interface BrowserStorageEntry extends JSONObject {
+  name: string;
+  value: string;
+}
+
+export interface BrowserStorageSnapshot extends JSONObject {
+  cookies: BrowserStorageEntry[];
+  local_storage: BrowserStorageEntry[];
+  session_storage: BrowserStorageEntry[];
+}
+
+export interface EncryptedEventEnvelope {
+  encrypted_data: string;
+}
+
+export interface FingerprintEventContext extends JSONObject {
+  sdk: JSONObject;
+  identity: JSONObject;
+  identifiers: JSONObject;
+  event: JSONObject;
+  browser_storage?: BrowserStorageSnapshot;
+}
+
+export type V3Identifiers = Record<string, string>;
+
+export interface V3Success<T> {
+  success: true;
+  data: T;
+}
+
+export interface V3Error {
+  success: false;
+  error: {
+    code: string;
+    message: string;
+    retryAfter?: number;
+    nextAllowedAt?: string;
+  };
+}
+
+export type V3Result<T> = V3Success<T> | V3Error;
+
+export interface IngestResult {
+  event_id: string;
+  collected_at: string;
+  endpoint_version: 'v3';
+}
+
+export interface TriggerEmailRequest {
+  email_address: string;
+  identifiers: V3Identifiers;
+}
+
+export interface TriggerEmailResult {
+  verification_id: string;
+  next_allowed_at: string;
+  retry_after_seconds: number;
+}
+
+export interface VerifyEmailRequest {
+  verification_id: string;
+  code: string;
+}
+
+export type VerifyEmailResult =
+  | { verified: true; verification_scope: 'email' }
+  | { verified: false; verification_scope: 'email'; reason: 'invalid_code' };
+
+export interface CheckUserRequest {
+  user_id?: string;
+  email_address: string;
+  identifiers: V3Identifiers;
+}
+
+export type CheckDecisionCode =
+  | 'FLAGGED_RISK_MATCH'
+  | 'NO_ENFORCING_RISK'
+  | 'NO_IDENTITY_MATCH'
+  | 'IDENTITY_UNCERTAIN'
+  | 'CHECK_UNAVAILABLE';
+
+export interface CheckUserResult {
+  is_user_flagged: boolean;
+  decision_id: string;
+  decision_code: CheckDecisionCode;
+}
+
+export interface FingerprintEventPayload extends JSONObject {
+  fingerprint: JSONObject;
+  context: FingerprintEventContext;
+}
+
+export interface FingerprintWireFormat {
+  [key: string]: unknown;
+  /**
+   * Primary device identifier — stable hash excluding volatile signals (audio, timing).
+   * Consistent across normal and incognito sessions on the same device.
+   * 32-character hex string.
+   */
+  fingerprint_id: string;
+  /**
+   * Full hash including all active signals (volatile signals included).
+   * Maximum entropy; may vary slightly between sessions on the same device.
+   * 32-character hex string.
+   */
+  full_hash: string;
+  /**
+   * Raw browser signal data keyed by signal name (e.g. `webgl`, `hardware`, `audio`).
+   *
+   * This blob is forwarded as-is in the `components` JSON field and stored verbatim
+   * in a `components JSONB` column on `fingerprint_events`. No server-side decomposition
+   * is performed; the full component tree is preserved for querying.
+   */
+  components: Record<string, unknown>;
+  /** ISO timestamp when the fingerprint was collected. */
+  timestamp: string;
+  /** Whether private/incognito browsing was detected at collection time. */
+  isIncognito: boolean;
+  /** Fingerprint library semver, e.g. "1.0.0". */
+  version: string;
+  /**
+   * Where the fingerprint agent that produced this result was loaded from:
+   *   - `'remote'`  — the runtime-loaded UMD (S3 directly in browser direct mode,
+   *                   or the Node SDK's same-origin proxy of S3).
+   *   - `'bundled'` — the copy compiled into the SDK, used as the fallback when
+   *                   the remote load failed/timed out.
+   * Optional: older SDK artifacts and the mobile SDKs omit it, so the reader
+   * must tolerate its absence. Observability for S3 fast-path vs fallback rates.
+   */
+  source?: 'remote' | 'bundled';
+}

package/dist/web/protection-handler.d.ts

@@ -49,7 +49,7 @@ interface InjectWarnState {
  * single middleware instance; when omitted, the module-level default is used.
  */
 declare function injectIntoHtmlResponse(response: Response, fingerprintScript: string, extraCookies?: string[], warnState?: InjectWarnState): Promise<Response>;
-declare function fetchAndCacheVerdict(client: UnsharedClient, cache: VerdictCache, userId: string, emailAddress: string, deviceId: string, fingerprintId: string | undefined, sessionId: string, timeoutMs?: number, reportFailOpen?: (reason: 'timeout' | 'http_error' | 'no_device_id', status?: number) => void): Promise<Verdict>;
+declare function fetchAndCacheVerdict(client: UnsharedClient, cache: VerdictCache, userId: string, emailAddress: string, deviceId: string, fingerprintId: string | undefined, permanentDeviceId: string | undefined, sessionId: string, timeoutMs?: number, reportFailOpen?: (reason: 'timeout' | 'http_error' | 'no_device_id', status?: number) => void): Promise<Verdict>;
 export declare const __test_fetchAndCacheVerdict: typeof fetchAndCacheVerdict;
 export declare const __test_injectIntoHtmlResponse: typeof injectIntoHtmlResponse;
 export declare function __test_resetInjectWarning(): void;

package/dist/web/protection-handler.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.__test_injectIntoHtmlResponse=exports.__test_fetchAndCacheVerdict=void 0,exports.createWebProtectionMiddleware=createWebProtectionMiddleware,exports.__test_resetInjectWarning=__test_resetInjectWarning;const webcrypto_1=require("../webcrypto"),verdict_cache_1=require("../middleware/verdict-cache"),rate_limit_backoff_1=require("../middleware/rate-limit-backoff"),dispatch_dedupe_1=require("../middleware/dispatch-dedupe"),fingerprint_script_1=require("../middleware/injection/fingerprint-script"),gate_page_1=require("../middleware/injection/gate-page"),flagged_response_1=require("../middleware/utils/flagged-response"),mask_email_1=require("../middleware/utils/mask-email"),content_type_1=require("../middleware/utils/content-type"),skip_paths_1=require("../middleware/utils/skip-paths"),include_path_1=require("../middleware/utils/include-path"),is_bot_1=require("../middleware/utils/is-bot"),sentinel_user_id_1=require("../middleware/utils/sentinel-user-id"),dispatch_processing_1=require("../middleware/dispatch-processing"),web_helpers_1=require("./web-helpers"),CHECK_USER_TIMEOUT_MS=1500,FAIL_OPEN_TTL_MS=5e3;function createWebProtectionMiddleware(e,r){if(!r.userId)throw new Error("[Unshared] userId resolver is required");const{userId:t,emailAddress:s,routePrefix:n="/__unshared",corsOrigins:i,cacheTTL:o=6e4,skipPaths:a,includePathPrefix:d,sessionId:c,deviceId:_,fingerprintSdkBundle:l="",onFlagged:u,onError:p,onFailOpen:h,disableBotFilter:f=!1,checkUserTimeoutMs:m=CHECK_USER_TIMEOUT_MS,blockFlagged:w=!1,flaggedMode:g,autoInterstitial:b=!1,interstitialFlowType:I="email_verification"}=r,v=g??(w?"gate":void 0),y=b||"overlay"===v,S=e=>{if(h)try{h(e)}catch{}},A=Date.now().toString(36),E=void 0!==v||y,R="gate"===v?"flaggedMode 'gate' (blockFlagged)":"overlay"===v?"flaggedMode 'overlay'":"autoInterstitial";if(E&&!l)throw new Error(`[Unshared] ${R} requires fingerprintSdkBundle (the browser SDK UMD served at {routePrefix}/fp.js renders the interstitial).`);if(E&&"/__unshared"!==n)throw new Error(`[Unshared] ${R} requires the default routePrefix ("/__unshared"); the browser SDK proxy routes are fixed to that prefix.`);const x="gate"===v?(0,gate_page_1.generateGatePage)(n,A):"",T=new verdict_cache_1.VerdictCache(o),k=new Map,C=new rate_limit_backoff_1.RateLimitBackoff,U=new dispatch_dedupe_1.DispatchDedupe,O=(0,fingerprint_script_1.generateFingerprintScript)(n,A,{autoInterstitial:y,interstitialFlowType:I}),$={emitted:!1},P=`${n}/fp.js`,q=`${n}/submit-fp`,F=`${n}/verify-trigger`,L=`${n}/verify`,M=`${n}/status`,j=i?Array.isArray(i)?i:[i]:null;return async function(r,i,o){const h=e=>{o?.waitUntil&&o.waitUntil(e)};let w,g;try{const e=new URL(r.url);w=e.pathname,g=e.search}catch{return i(r)}if(w.startsWith(n+"/")){const n=function(e){if(!j)return{};const r=e.headers.get("origin")??"",t=j.includes("*");if(!t&&!j.includes(r))return{};const s={"Access-Control-Allow-Origin":t?"*":r,"Access-Control-Allow-Methods":"POST, OPTIONS","Access-Control-Allow-Headers":"Content-Type, X-Idempotency-Key, X-Session-Id, X-Device-Id"};return t||(s["Access-Control-Allow-Credentials"]="true"),s}(r);if("OPTIONS"===r.method)return(0,web_helpers_1.emptyResponse)(204,n);if(("GET"===r.method||"HEAD"===r.method)&&w===P){if(!l)return(0,web_helpers_1.jsonResponse)(404,{success:!1,error:{code:"NOT_FOUND",message:"Fingerprint SDK bundle not configured. Pass fingerprintSdkBundle in config."}},n);const e={...n,"Content-Type":"application/javascript","Cache-Control":"public, max-age=3600","Content-Length":String((new TextEncoder).encode(l).byteLength)};return"HEAD"===r.method?new Response(null,{status:200,headers:new Headers(e)}):(0,web_helpers_1.bodyResponse)(200,l,e)}if("POST"===r.method&&(w===q||w===F||w===L)){let i;try{i=await r.json()}catch{return(0,web_helpers_1.jsonResponse)(400,{success:!1,error:{code:"BODY_PARSER_MISSING",message:"Request body is not valid JSON."}},n)}return w===q?handleSubmitFp(r,i,{client:e,verdictCache:T,rateLimitBackoff:C,dispatchDedupe:U,resolveUserId:t,resolveEmailAddress:s,resolveSessionId:c,resolveDeviceId:_,disableBotFilter:f,onError:p,registerBackground:h},n):w===F?handleVerifyTriggerWeb(r,i,{client:e,verdictCache:T,resolveUserId:t,resolveEmailAddress:s,resolveDeviceId:_,onError:p},n):handleVerifyWeb(r,i,{client:e,verdictCache:T,resolveUserId:t,resolveEmailAddress:s,resolveDeviceId:_,onError:p},n)}if("GET"===r.method&&w===M){let i;try{i=t(r)}catch{}if(!i)return(0,web_helpers_1.jsonResponse)(200,{status:"anonymous"},n);const o=resolveEmail(r,s);let a=T.get(i);if((!a||T.isStale(i))&&o&&!C.isPaused()&&!T.isRefreshing(i)){T.markRefreshing(i);try{const t=(0,web_helpers_1.extractDeviceIdFromRequest)(r,_),s=(0,web_helpers_1.parseCookieFromRequest)(r,"__unshared_fingerprint_id")||void 0,n=extractSessionIdFromRequest(r,c),d=t??s??"unknown";await fetchAndCacheVerdict(e,T,i,o,d,s,n,m,(e,r)=>S({operation:"checkUser",reason:e,status:r,userId:i,emailAddress:o})),a=T.get(i)}catch(e){p&&p(e,{operation:"checkUser",userId:i,emailAddress:o}),S({operation:"checkUser",reason:"exception",userId:i,emailAddress:o})}finally{T.clearRefreshing(i)}}return a&&a.isFlagged&&!a.isVerified&&(void 0!==v||u)&&o?(0,web_helpers_1.jsonResponse)(200,{status:"flagged",email:(0,mask_email_1.maskEmail)(o)},n):(0,web_helpers_1.jsonResponse)(200,{status:"ok"},n)}return(0,web_helpers_1.jsonResponse)(404,{success:!1,error:{code:"NOT_FOUND",message:"Unknown route"}},n)}const b=void 0!==v;if((0,skip_paths_1.shouldSkipPath)(w,a,b))return i(r);if(!(0,include_path_1.shouldIncludePath)(w,d))return injectIntoHtmlResponse(await i(r),O,void 0,$);let I;try{I=t(r)}catch{}if((0,sentinel_user_id_1.isSentinelUserId)(I)){const e=(0,web_helpers_1.parseCookieFromRequest)(r,"__unshared_uid"),t=(0,web_helpers_1.parseCookieFromRequest)(r,"__unshared_uid_at"),s=t?Number(t):NaN,n=Number.isFinite(s)&&Date.now()-s<=sentinel_user_id_1.SENTINEL_STICKINESS_TTL_MS;I=e&&n?e:void 0}if(!I){const e=(0,web_helpers_1.isSecureWebRequest)(r)?"; Secure":"",t=[`__unshared_uid=; Path=/; SameSite=Lax; Max-Age=0${e}`,`__unshared_uid_at=; Path=/; SameSite=Lax; Max-Age=0${e}`,`__unshared_sid=; Path=/; SameSite=Lax; Max-Age=0${e}`,`__unshared_email=; Path=/; SameSite=Lax; Max-Age=0${e}`];return injectIntoHtmlResponse(await i(r),O,t,$)}const y=resolveEmail(r,s),A=[],E=(0,web_helpers_1.isSecureWebRequest)(r)?"; Secure":"";if(A.push(`__unshared_uid=${encodeURIComponent(I)}; Path=/; SameSite=Lax${E}`),A.push(`__unshared_uid_at=${Date.now()}; Path=/; SameSite=Lax${E}`),y&&A.push(`__unshared_email=${encodeURIComponent(y)}; HttpOnly; Path=/; SameSite=Lax${E}`),!y)return injectIntoHtmlResponse(await i(r),O,A,$);const R=extractSessionIdFromRequest(r,c),D=(0,web_helpers_1.extractDeviceIdFromRequest)(r,_),N=(0,web_helpers_1.parseCookieFromRequest)(r,"__unshared_fingerprint_id")||void 0,H=r.headers.get("user-agent")??"",V=(0,web_helpers_1.extractClientIpFromRequest)(r),W=D??N;if(!f&&(0,is_bot_1.isBot)(H))return i(r);let B=T.get(I);if(B)T.isStale(I)&&!T.isRefreshing(I)&&(T.markRefreshing(I),h(fetchAndCacheVerdict(e,T,I,y,W??"unknown",N,R,m,(e,r)=>S({operation:"checkUser",reason:e,status:r,userId:I,emailAddress:y})).catch(()=>S({operation:"checkUser",reason:"exception",userId:I,emailAddress:y})).finally(()=>T.clearRefreshing(I))));else try{let r=k.get(I);r||(r=fetchAndCacheVerdict(e,T,I,y,W??"unknown",N,R,m,(e,r)=>S({operation:"checkUser",reason:e,status:r,userId:I,emailAddress:y})).finally(()=>k.delete(I)),k.set(I,r)),B=await r}catch{return S({operation:"checkUser",reason:"exception",userId:I,emailAddress:y}),injectIntoHtmlResponse(await i(r),O,A,$)}const K=B.isFlagged&&!B.isVerified;if("gate"===v&&K)return(0,content_type_1.isHtmlNavigation)(r.method,r.headers.get("accept")??void 0)?(0,web_helpers_1.bodyResponse)(200,x,{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"}):(0,web_helpers_1.jsonResponse)(403,(0,flagged_response_1.flaggedResponse)(y));if("overlay"===v&&K)return(0,content_type_1.isHtmlNavigation)(r.method,r.headers.get("accept")??void 0)?injectIntoHtmlResponse(await i(r),O,A,$):(0,web_helpers_1.jsonResponse)(403,(0,flagged_response_1.flaggedResponse)(y));if(B.isFlagged&&!B.isVerified&&u)try{const e=await u({userId:I,emailAddress:y,verdict:B,request:r});if(e)return injectIntoHtmlResponse(e,O,A,$)}catch(e){p&&p(e,{operation:"checkUser",userId:I,emailAddress:y})}return B.isFlagged||"unknown"===R||!W||C.isPaused()||h(dispatchUserEvent(e,T,C,U,{userId:I,emailAddress:y,sessionId:R,deviceId:W,fingerprintId:N,userAgent:H,ipAddress:V,eventType:w+g},p)),injectIntoHtmlResponse(await i(r),O,A,$)}}const defaultInjectWarnState={emitted:!1};function passthroughResponse(e,r,t){if(!r||0===r.length)return e;const s=(0,web_helpers_1.mergeResponseHeaders)(e.headers,void 0,r);return new Response(t,{status:e.status,statusText:e.statusText,headers:s})}async function injectIntoHtmlResponse(e,r,t,s=defaultInjectWarnState){const n=e.headers.get("content-type");if(204===e.status||304===e.status)return passthroughResponse(e,t,null);if(null===e.body)return n||s.emitted||(s.emitted=!0,console.warn("[Unshared] The response returned by your handler has no body (e.g. NextResponse.next()), so fingerprint injection did not run. In Next.js middleware, fingerprints must be collected by the browser/React SDK, while this middleware handles verdict + enforcement. See the Next.js section of the integration guide.")),passthroughResponse(e,t,null);if(!(0,content_type_1.isHtmlContentType)(n??void 0))return passthroughResponse(e,t,e.body);const i=await e.text(),o=i.lastIndexOf("</body>"),a=-1===o?i+r:i.slice(0,o)+r+i.slice(o),d=(0,web_helpers_1.mergeResponseHeaders)(e.headers,{"Cache-Control":"no-store","Content-Length":String((new TextEncoder).encode(a).length)},t);return d.delete("ETag"),d.delete("Last-Modified"),d.delete("Content-Encoding"),new Response(a,{status:e.status,statusText:e.statusText,headers:d})}function resolveEmail(e,r){if(r)try{const t=r(e);if(t)return t}catch{}const t=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_email");if(t)return t}function resolveEmailWithBody(e,r,t){const s=resolveEmail(e,t);if(s)return s;const n=r.email;return"string"==typeof n&&n?n:void 0}function extractSessionIdFromRequest(e,r){if(r)try{const t=r(e);if(t)return t}catch{}return(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_sid")??"unknown"}function dispatchUserEvent(e,r,t,s,n,i){return s.mark(n.userId,n.eventType),(0,dispatch_processing_1.runProcessUserEvent)({client:e,cache:r,backoff:t,onError:i},{eventType:n.eventType,userId:n.userId,emailAddress:n.emailAddress,ipAddress:n.ipAddress,deviceId:n.deviceId,fingerprintId:n.fingerprintId,sessionHash:n.sessionId,userAgent:n.userAgent},dispatch_processing_1.DISPATCH_TIMEOUT_MS)}async function fetchAndCacheVerdict(e,r,t,s,n,i,o,a=CHECK_USER_TIMEOUT_MS,d){const c=()=>{const e=r.get(t);return r.set(t,{isFlagged:e?.isFlagged??!1,isVerified:e?.isVerified??!1,emailAddress:s,sessionId:o},5e3),r.get(t)},_={timeoutMs:a,maxRetries:0};let l;n&&"unknown"!==n&&(_.deviceId=n),i&&(_.fingerprintId=i);const u=await Promise.race([e.checkUser(s,_),new Promise(e=>{l=setTimeout(()=>e(null),a)})]);return clearTimeout(l),u?u.failedOpen?(d?.(u.failedOpen.reason??"http_error",u.failedOpen.status),c()):(r.set(t,{isFlagged:u.data?.is_user_flagged??!1,isVerified:!1,emailAddress:s,sessionId:o}),r.get(t)):(d?.("timeout"),c())}async function handleSubmitFp(e,r,t,s){try{const n={full_hash:r.hash??"",fingerprint_id:r.stable_hash??"",timestamp:r.collected_at??(new Date).toISOString(),isIncognito:r.is_incognito??!1,components:r.components??{},version:r.version??"inline-1.0.0"};let i,o,a;try{const r=t.resolveUserId(e);r&&!(0,sentinel_user_id_1.isSentinelUserId)(r)&&(i=r)}catch{}if(!i){const e="string"==typeof r.user_id?r.user_id:void 0;e&&!(0,sentinel_user_id_1.isSentinelUserId)(e)&&(i=e)}if(!i){const r=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_uid");r&&!(0,sentinel_user_id_1.isSentinelUserId)(r)&&(i=r)}try{o=t.resolveEmailAddress?t.resolveEmailAddress(e):void 0}catch{}o=o??(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_email")??r.email??void 0;try{a=t.resolveSessionId?t.resolveSessionId(e):void 0}catch{}a=a??r.session_id??(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_sid");const d=(0,web_helpers_1.extractClientIpFromRequest)(e),c=e.headers.get("user-agent")??"";if(!t.disableBotFilter&&(0,is_bot_1.isBot)(c))return(0,web_helpers_1.jsonResponse)(200,{success:!0},s);const _=(n.fingerprint_id&&n.fingerprint_id.length>0?n.fingerprint_id:void 0)??(0,web_helpers_1.extractDeviceIdFromRequestOrUnknown)(e,t.resolveDeviceId),l=n.fingerprint_id||void 0,u=n.full_hash||void 0,p=(0,web_helpers_1.isSecureWebRequest)(e)?"; Secure":"",h=[];if(u&&!(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fingerprint_id")&&h.push(`__unshared_fingerprint_id=${encodeURIComponent(u)}; HttpOnly; Path=/; SameSite=Lax${p}`),l){const r=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fp_id");r&&r===l||h.push(`__unshared_fp_id=${encodeURIComponent(l)}; Path=/; SameSite=Lax; Max-Age=31536000${p}`)}let f;if(o&&!(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_email")&&h.push(`__unshared_email=${encodeURIComponent(o)}; HttpOnly; Path=/; SameSite=Lax${p}`),"string"==typeof r.event_type&&r.event_type)f=r.event_type;else{const r=e.headers.get("referer")??e.headers.get("referrer");let t="unknown";if(r)try{const e=new URL(r);t=(e.pathname||"/")+(e.search||"")}catch{}f=t}const m=e.headers.get("x-idempotency-key")||void 0,w=Date.now();let g;if(m?g=`${m}|${w}`:l&&i&&(g=`${await(0,webcrypto_1.sha256HexWeb)(`${l}|${i}|${f}`)}|${w}`),i){const e=t.client.submitFingerprintEvent(n,{userId:i,emailAddress:o,sessionHash:a,eventType:f,ipAddress:d,userAgent:c,idempotencyKey:g}).catch(e=>{t.onError&&t.onError(e,{operation:"submitFingerprintEvent",userId:i,emailAddress:o})});t.registerBackground?.(e)}if(i&&o&&!t.rateLimitBackoff.isPaused()&&!t.dispatchDedupe.wasRecentlyDispatched(i,f)){const e=(0,dispatch_processing_1.runProcessUserEvent)({client:t.client,cache:t.verdictCache,backoff:t.rateLimitBackoff,onError:t.onError},{eventType:f,userId:i,emailAddress:o,ipAddress:d,deviceId:_,fingerprintId:l,sessionHash:a??"unknown",userAgent:c},dispatch_processing_1.SUBMIT_FP_TIMEOUT_MS);t.registerBackground?.(e)}const b={...s,"Content-Type":"application/json"},I=new Response(JSON.stringify({success:!0}),{status:200,headers:b});for(const e of h)I.headers.append("Set-Cookie",e);return I}catch{return(0,web_helpers_1.jsonResponse)(200,{success:!0},s)}}async function handleVerifyTriggerWeb(e,r,t,s){try{const n=resolveEmailWithBody(e,r??{},t.resolveEmailAddress);if(!n)return(0,web_helpers_1.jsonResponse)(400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Email is required"}},s);const i=(0,web_helpers_1.extractDeviceIdFromRequestOrUnknown)(e,t.resolveDeviceId),o=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fingerprint_id")||void 0,a=await t.client.triggerEmailVerification(n,i,{fingerprintId:o});return a.success?(0,web_helpers_1.jsonResponse)(200,{success:!0,data:a.data},s):(0,web_helpers_1.jsonResponse)(200,{success:!1,error:a.error??{code:"TRIGGER_FAILED",message:"Failed to send verification email"}},s)}catch(e){return t.onError&&t.onError(e,{operation:"verifyTrigger"}),(0,web_helpers_1.jsonResponse)(200,{success:!1,error:{code:"INTERNAL_ERROR",message:"Failed to trigger verification"}},s)}}async function handleVerifyWeb(e,r,t,s){try{const n=resolveEmailWithBody(e,r??{},t.resolveEmailAddress),i=r?.code;if(!n||!i)return(0,web_helpers_1.jsonResponse)(400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Email and code are required"}},s);const o=(0,web_helpers_1.extractDeviceIdFromRequestOrUnknown)(e,t.resolveDeviceId),a=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fingerprint_id")||void 0,d=await t.client.verify(n,o,i,{fingerprintId:a});if(d.success){let r;try{r=t.resolveUserId(e)}catch{}return r&&t.verdictCache.update(r,{isVerified:!0}),(0,web_helpers_1.jsonResponse)(200,{success:!0,data:{verified:!0}},s)}return(0,web_helpers_1.jsonResponse)(200,{success:!1,error:d.error??{code:"VERIFICATION_FAILED",message:"Verification failed"}},s)}catch(e){return t.onError&&t.onError(e,{operation:"verify"}),(0,web_helpers_1.jsonResponse)(200,{success:!1,error:{code:"INTERNAL_ERROR",message:"Verification failed"}},s)}}function __test_resetInjectWarning(){defaultInjectWarnState.emitted=!1}exports.__test_fetchAndCacheVerdict=fetchAndCacheVerdict,exports.__test_injectIntoHtmlResponse=injectIntoHtmlResponse;
+"use strict";Object.defineProperty(exports,"t",{value:!0}),exports.__test_injectIntoHtmlResponse=exports.__test_fetchAndCacheVerdict=void 0,exports.createWebProtectionMiddleware=createWebProtectionMiddleware,exports.__test_resetInjectWarning=__test_resetInjectWarning;const webcrypto_1=require("../webcrypto"),verdict_cache_1=require("../middleware/verdict-cache"),rate_limit_backoff_1=require("../middleware/rate-limit-backoff"),dispatch_dedupe_1=require("../middleware/dispatch-dedupe"),fingerprint_script_1=require("../middleware/injection/fingerprint-script"),gate_page_1=require("../middleware/injection/gate-page"),flagged_response_1=require("../middleware/utils/flagged-response"),mask_email_1=require("../middleware/utils/mask-email"),content_type_1=require("../middleware/utils/content-type"),skip_paths_1=require("../middleware/utils/skip-paths"),include_path_1=require("../middleware/utils/include-path"),is_bot_1=require("../middleware/utils/is-bot"),sentinel_user_id_1=require("../middleware/utils/sentinel-user-id"),dispatch_processing_1=require("../middleware/dispatch-processing"),web_helpers_1=require("./web-helpers"),CHECK_USER_TIMEOUT_MS=1500,FAIL_OPEN_TTL_MS=5e3;function createWebProtectionMiddleware(e,t){if(!t.userId)throw new Error("[Unshared] userId resolver is required");const{userId:r,emailAddress:s,routePrefix:n="/__unshared",corsOrigins:i,cacheTTL:a=6e4,skipPaths:o,includePathPrefix:d,sessionId:c,deviceId:_,fingerprintSdkBundle:l="",onFlagged:u,onError:p,onFailOpen:h,disableBotFilter:f=!1,checkUserTimeoutMs:m=CHECK_USER_TIMEOUT_MS,blockFlagged:g=!1,flaggedMode:w,autoInterstitial:b=!1,interstitialFlowType:v="email_verification"}=t,y=w??(g?"gate":void 0),I=b||"overlay"===y,x=e=>{if(h)try{h(e)}catch{}},S=Date.now().toString(36),A=void 0!==y||I,R="gate"===y?"flaggedMode 'gate' (blockFlagged)":"overlay"===y?"flaggedMode 'overlay'":"autoInterstitial";if(A&&!l)throw new Error(`[Unshared] ${R} requires fingerprintSdkBundle (the browser SDK UMD served at {routePrefix}/fp.js renders the interstitial).`);if(A&&"/__unshared"!==n)throw new Error(`[Unshared] ${R} requires the default routePrefix ("/__unshared"); the browser SDK proxy routes are fixed to that prefix.`);const E="gate"===y?(0,gate_page_1.generateGatePage)(n,S):"",T=new verdict_cache_1.VerdictCache(a),k=new Map,C=new rate_limit_backoff_1.RateLimitBackoff,P=new dispatch_dedupe_1.DispatchDedupe,U=(0,fingerprint_script_1.generateFingerprintScript)(n,S,{autoInterstitial:I,interstitialFlowType:v}),$={emitted:!1},j=`${n}/fp.js`,D=`${n}/submit-fp`,O=`${n}/verify-trigger`,M=`${n}/verify`,F=`${n}/status`,q=i?Array.isArray(i)?i:[i]:null;return async function(t,i,a){const h=e=>{a?.waitUntil&&a.waitUntil(e)};let g,w;try{const e=new URL(t.url);g=e.pathname,w=e.search}catch{return i(t)}if(g.startsWith(n+"/")){const n=function(e){if(!q)return{};const t=e.headers.get("origin")??"",r=q.includes("*");if(!r&&!q.includes(t))return{};const s={"Access-Control-Allow-Origin":r?"*":t,"Access-Control-Allow-Methods":"POST, OPTIONS","Access-Control-Allow-Headers":"Content-Type, X-Idempotency-Key, X-Session-Id, X-Device-Id, X-Permanent-Device-Id","Access-Control-Expose-Headers":"X-Unshared-Enforcement-Reconciled"};return r||(s["Access-Control-Allow-Credentials"]="true"),s}(t);if("OPTIONS"===t.method)return(0,web_helpers_1.emptyResponse)(204,n);if(("GET"===t.method||"HEAD"===t.method)&&g===j){if(!l)return(0,web_helpers_1.jsonResponse)(404,{success:!1,error:{code:"NOT_FOUND",message:"Fingerprint SDK bundle not configured. Pass fingerprintSdkBundle in config."}},n);const e={...n,"Content-Type":"application/javascript","Cache-Control":"public, max-age=3600","Content-Length":String((new TextEncoder).encode(l).byteLength)};return"HEAD"===t.method?new Response(null,{status:200,headers:new Headers(e)}):(0,web_helpers_1.bodyResponse)(200,l,e)}if("POST"===t.method&&(g===D||g===O||g===M)){const i=await(0,web_helpers_1.readJsonRequest)(t);if(!i.success)return(0,web_helpers_1.jsonResponse)(i.status,{success:!1,error:i.error},n);const a=i.data;return g===D?handleSubmitFp(t,a,{client:e,verdictCache:T,rateLimitBackoff:C,dispatchDedupe:P,resolveUserId:r,resolveEmailAddress:s,resolveSessionId:c,resolveDeviceId:_,disableBotFilter:f,onError:p,registerBackground:h},n):g===O?handleVerifyTriggerWeb(t,a,{client:e,verdictCache:T,resolveUserId:r,resolveEmailAddress:s,resolveDeviceId:_,onError:p},n):handleVerifyWeb(t,a,{client:e,verdictCache:T,resolveUserId:r,resolveEmailAddress:s,resolveDeviceId:_,onError:p},n)}if("GET"===t.method&&g===F){let i;try{i=r(t)}catch{}if(!i)return(0,web_helpers_1.jsonResponse)(200,{status:"anonymous"},n);const a=resolveEmail(t,s);let o=T.get(i);if((!o||T.isStale(i))&&a&&!C.isPaused()&&!T.isRefreshing(i)){T.markRefreshing(i);try{const r=(0,web_helpers_1.extractDeviceIdFromRequest)(t,_),s=(0,web_helpers_1.parseCookieFromRequest)(t,"__unshared_fingerprint_id")||void 0,n=extractPermanentDeviceIdFromRequest(t),d=extractSessionIdFromRequest(t,c),l=r??s??"unknown";await fetchAndCacheVerdict(e,T,i,a,l,s,n,d,m,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:i,emailAddress:a})),o=T.get(i)}catch(e){p&&p(e,{operation:"checkUser",userId:i,emailAddress:a}),x({operation:"checkUser",reason:"exception",userId:i,emailAddress:a})}finally{T.clearRefreshing(i)}}return o&&o.isFlagged&&!o.isVerified&&(void 0!==y||u)&&a?(0,web_helpers_1.jsonResponse)(200,{status:"flagged",email:(0,mask_email_1.maskEmail)(a)},n):(0,web_helpers_1.jsonResponse)(200,{status:"ok"},n)}return(0,web_helpers_1.jsonResponse)(404,{success:!1,error:{code:"NOT_FOUND",message:"Unknown route"}},n)}const b=void 0!==y;if((0,skip_paths_1.shouldSkipPath)(g,o,b))return i(t);if(!(0,include_path_1.shouldIncludePath)(g,d))return injectIntoHtmlResponse(await i(t),U,void 0,$);let v;try{v=r(t)}catch{}if((0,sentinel_user_id_1.isSentinelUserId)(v)){const e=(0,web_helpers_1.parseCookieFromRequest)(t,"__unshared_uid"),r=(0,web_helpers_1.parseCookieFromRequest)(t,"__unshared_uid_at"),s=r?Number(r):NaN,n=Number.isFinite(s)&&Date.now()-s<=sentinel_user_id_1.SENTINEL_STICKINESS_TTL_MS;v=e&&n?e:void 0}if(!v){const e=(0,web_helpers_1.isSecureWebRequest)(t)?"; Secure":"",r=[`__unshared_uid=; Path=/; SameSite=Lax; Max-Age=0${e}`,`__unshared_uid_at=; Path=/; SameSite=Lax; Max-Age=0${e}`,`__unshared_sid=; Path=/; SameSite=Lax; Max-Age=0${e}`,`__unshared_email=; Path=/; SameSite=Lax; Max-Age=0${e}`,`__unshared_verification_id=; HttpOnly; Path=/; SameSite=Lax; Max-Age=0${e}`];return injectIntoHtmlResponse(await i(t),U,r,$)}const I=resolveEmail(t,s),S=[],A=(0,web_helpers_1.isSecureWebRequest)(t)?"; Secure":"";if(S.push(`__unshared_uid=${encodeURIComponent(v)}; Path=/; SameSite=Lax; Max-Age=31536000${A}`),S.push(`__unshared_uid_at=${Date.now()}; Path=/; SameSite=Lax; Max-Age=31536000${A}`),I&&S.push(`__unshared_email=${encodeURIComponent(I)}; HttpOnly; Path=/; SameSite=Lax; Max-Age=31536000${A}`),!I)return injectIntoHtmlResponse(await i(t),U,S,$);const R=extractSessionIdFromRequest(t,c),L=(0,web_helpers_1.extractDeviceIdFromRequest)(t,_),H=(0,web_helpers_1.parseCookieFromRequest)(t,"__unshared_fingerprint_id")||void 0,N=extractPermanentDeviceIdFromRequest(t),V=t.headers.get("user-agent")??"",W=(0,web_helpers_1.extractClientIpFromRequest)(t),B=L??H;if(!f&&(0,is_bot_1.isBot)(V))return i(t);let K=T.get(v);if(K)T.isStale(v)&&!T.isRefreshing(v)&&(T.markRefreshing(v),h(fetchAndCacheVerdict(e,T,v,I,B??"unknown",H,N,R,m,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:v,emailAddress:I})).catch(()=>x({operation:"checkUser",reason:"exception",userId:v,emailAddress:I})).finally(()=>T.clearRefreshing(v))));else try{let t=k.get(v);t||(t=fetchAndCacheVerdict(e,T,v,I,B??"unknown",H,N,R,m,(e,t)=>x({operation:"checkUser",reason:e,status:t,userId:v,emailAddress:I})).finally(()=>k.delete(v)),k.set(v,t)),K=await t}catch{return x({operation:"checkUser",reason:"exception",userId:v,emailAddress:I}),injectIntoHtmlResponse(await i(t),U,S,$)}const X=K.isFlagged&&!K.isVerified;if("gate"===y&&X)return(0,content_type_1.isHtmlNavigation)(t.method,t.headers.get("accept")??void 0)?(0,web_helpers_1.bodyResponse)(200,E,{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"}):(0,web_helpers_1.jsonResponse)(403,(0,flagged_response_1.flaggedResponse)(I));if("overlay"===y&&X)return(0,content_type_1.isHtmlNavigation)(t.method,t.headers.get("accept")??void 0)?injectIntoHtmlResponse(await i(t),U,S,$):(0,web_helpers_1.jsonResponse)(403,(0,flagged_response_1.flaggedResponse)(I));if(K.isFlagged&&!K.isVerified&&u)try{const e=await u({userId:v,emailAddress:I,verdict:K,request:t});if(e)return injectIntoHtmlResponse(e,U,S,$)}catch(e){p&&p(e,{operation:"checkUser",userId:v,emailAddress:I})}return K.isFlagged||"unknown"===R||!B||C.isPaused()||h(dispatchUserEvent(e,T,C,P,{userId:v,emailAddress:I,sessionId:R,deviceId:B,fingerprintId:H,permanentDeviceId:N,userAgent:V,ipAddress:W,eventType:g+w},p)),injectIntoHtmlResponse(await i(t),U,S,$)}}const defaultInjectWarnState={emitted:!1};function passthroughResponse(e,t,r){if(!t||0===t.length)return e;const s=(0,web_helpers_1.mergeResponseHeaders)(e.headers,void 0,t);return new Response(r,{status:e.status,statusText:e.statusText,headers:s})}async function injectIntoHtmlResponse(e,t,r,s=defaultInjectWarnState){const n=e.headers.get("content-type");if(204===e.status||304===e.status)return passthroughResponse(e,r,null);if(null===e.body)return n||s.emitted||(s.emitted=!0,console.warn("[Unshared] The response returned by your handler has no body (e.g. NextResponse.next()), so fingerprint injection did not run. In Next.js middleware, fingerprints must be collected by the browser/React SDK, while this middleware handles verdict + enforcement. See the Next.js section of the integration guide.")),passthroughResponse(e,r,null);if(!(0,content_type_1.isHtmlContentType)(n??void 0))return passthroughResponse(e,r,e.body);const i=await e.text(),a=i.lastIndexOf("</body>"),o=-1===a?i+t:i.slice(0,a)+t+i.slice(a),d=(0,web_helpers_1.mergeResponseHeaders)(e.headers,{"Cache-Control":"no-store","Content-Length":String((new TextEncoder).encode(o).length)},r);return d.delete("ETag"),d.delete("Last-Modified"),d.delete("Content-Encoding"),new Response(o,{status:e.status,statusText:e.statusText,headers:d})}function resolveEmail(e,t){if(t)try{const r=t(e);if(r)return r}catch{}const r=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_email");if(r)return r}function resolveEmailWithBody(e,t,r){const s=resolveEmail(e,r);if(s)return s;const n=t.email;return"string"==typeof n&&n?n:void 0}function extractSessionIdFromRequest(e,t){if(t)try{const r=t(e);if(r)return r}catch{}return(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_sid")??"unknown"}function isPermanentDeviceId(e){return"string"==typeof e&&/^upid_[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}function extractPermanentDeviceIdFromRequest(e){const t=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_device_id");if(isPermanentDeviceId(t))return t;const r=e.headers.get("x-permanent-device-id");return isPermanentDeviceId(r)?r:void 0}function dispatchUserEvent(e,t,r,s,n,i){return s.mark(n.userId,n.eventType),(0,dispatch_processing_1.runProcessUserEvent)({client:e,cache:t,backoff:r,onError:i},{eventType:n.eventType,userId:n.userId,emailAddress:n.emailAddress,ipAddress:n.ipAddress,deviceId:n.deviceId,fingerprintId:n.fingerprintId,permanentDeviceId:n.permanentDeviceId,sessionHash:n.sessionId,userAgent:n.userAgent},dispatch_processing_1.DISPATCH_TIMEOUT_MS)}async function fetchAndCacheVerdict(e,t,r,s,n,i,a,o,d=CHECK_USER_TIMEOUT_MS,c){const _=()=>{const e=t.get(r);return t.set(r,{isFlagged:e?.isFlagged??!1,isVerified:e?.isVerified??!1,emailAddress:s,sessionId:o},5e3),t.get(r)},l={timeoutMs:d,maxRetries:0};let u;n&&"unknown"!==n&&(l.deviceId=n),i&&(l.fullHash=i),a&&(l.permanentDeviceId=a);const p=await Promise.race([e.checkUser(s,l),new Promise(e=>{u=setTimeout(()=>e(null),d)})]);return clearTimeout(u),p?p.failedOpen?(c?.(p.failedOpen.reason??"http_error",p.failedOpen.status),_()):(t.set(r,{isFlagged:p.data?.is_user_flagged??!1,isVerified:!1,emailAddress:s,sessionId:o}),t.get(r)):(c?.("timeout"),_())}async function handleSubmitFp(e,t,r,s){try{const n=t?.fingerprint&&"object"==typeof t.fingerprint?t.fingerprint:t??{},i=t?.context&&"object"==typeof t.context?t.context:{},a=i.identity&&"object"==typeof i.identity?i.identity:{},o=i.identifiers&&"object"==typeof i.identifiers?i.identifiers:{},d=i.event&&"object"==typeof i.event?i.event:{},c={full_hash:n.hash??n.full_hash??"",fingerprint_id:n.stableHash??n.stable_hash??n.fingerprint_id??""};let _,l,u;try{const t=r.resolveUserId(e);t&&!(0,sentinel_user_id_1.isSentinelUserId)(t)&&(_=t)}catch{}if(!_){const e="string"==typeof a.user_id?a.user_id:"string"==typeof t.user_id?t.user_id:void 0;e&&!(0,sentinel_user_id_1.isSentinelUserId)(e)&&(_=e)}if(!_){const t=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_uid");t&&!(0,sentinel_user_id_1.isSentinelUserId)(t)&&(_=t)}try{l=r.resolveEmailAddress?r.resolveEmailAddress(e):void 0}catch{}l=l??(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_email")??a.email_address??t.email??void 0;try{u=r.resolveSessionId?r.resolveSessionId(e):void 0}catch{}u=u??o.session_hash??t.session_id??(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_sid");const p=(0,web_helpers_1.extractClientIpFromRequest)(e),h=e.headers.get("user-agent")??"";if(!r.disableBotFilter&&(0,is_bot_1.isBot)(h))return(0,web_helpers_1.jsonResponse)(200,{success:!0,data:{skipped:!0}},s);const f=(c.fingerprint_id&&c.fingerprint_id.length>0?c.fingerprint_id:void 0)??(0,web_helpers_1.extractDeviceIdFromRequestOrUnknown)(e,r.resolveDeviceId),m=c.fingerprint_id||void 0,g=c.full_hash||void 0,w=extractPermanentDeviceIdFromRequest(e),b=e.headers.get("x-permanent-device-id")??o.unshared_device_id??t.permanent_device_id,v=w??(isPermanentDeviceId(b)?b:`upid_${crypto.randomUUID()}`),y=(0,web_helpers_1.isSecureWebRequest)(e)?"; Secure":"",I=[];I.push(`__unshared_device_id=${encodeURIComponent(v)}; Path=/; SameSite=Lax; Max-Age=34560000${y}`);const x=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fingerprint_id")||g;let S;if(x&&I.push(`__unshared_fingerprint_id=${encodeURIComponent(x)}; HttpOnly; Path=/; SameSite=Lax; Max-Age=31536000${y}`),m&&I.push(`__unshared_fp_id=${encodeURIComponent(m)}; Path=/; SameSite=Lax; Max-Age=31536000${y}`),l&&I.push(`__unshared_email=${encodeURIComponent(l)}; HttpOnly; Path=/; SameSite=Lax; Max-Age=31536000${y}`),"string"==typeof d.type&&d.type)S=d.type;else if("string"==typeof t.event_type&&t.event_type)S=t.event_type;else{const t=e.headers.get("referer")??e.headers.get("referrer");let r="unknown";if(t)try{const e=new URL(t);r=(e.pathname||"/")+(e.search||"")}catch{}S=r}const A=e.headers.get("x-idempotency-key")||void 0,R=Date.now();let E;A?E=`${A}|${R}`:m&&_&&(E=`${await(0,webcrypto_1.sha256HexWeb)(`${m}|${_}|${S}`)}|${R}`);const T={...o,unshared_device_id:v,...f&&"unknown"!==f?{device_id:f}:{},...m?{stable_hash:m}:{},...g?{full_hash:g}:{},...u?{session_hash:u}:{}},k=i.sdk&&"object"==typeof i.sdk?i.sdk.name:void 0,C="string"==typeof k&&k.startsWith("unshared-")&&Object.prototype.hasOwnProperty.call(t,"fingerprint")&&t.context&&"object"==typeof t.context&&!Array.isArray(t.context)&&i.identity&&"object"==typeof i.identity&&!Array.isArray(i.identity)&&i.identifiers&&"object"==typeof i.identifiers&&!Array.isArray(i.identifiers)&&i.event&&"object"==typeof i.event&&!Array.isArray(i.event),P=!Object.prototype.hasOwnProperty.call(t,"context")&&"string"==typeof t.hash&&"string"==typeof t.stable_hash&&"string"==typeof t.collected_at&&t.components&&"object"==typeof t.components&&!Array.isArray(t.components),U=C||P?{...t,fingerprint:n,context:{...i,identity:{...a,..._?{user_id:_}:{},...l?{email_address:l}:{}},identifiers:T,event:{...d,type:S,ip_address:p,user_agent:h}}}:t,$=await r.client.submitFingerprint(U,{idempotencyKey:E});if($.success||r.onError?.($.error,{operation:"submitFingerprintEvent",userId:_,emailAddress:l}),_&&l&&!r.rateLimitBackoff.isPaused()&&!r.dispatchDedupe.wasRecentlyDispatched(_,S)){const e=(0,dispatch_processing_1.runCheckUser)({client:r.client,cache:r.verdictCache,backoff:r.rateLimitBackoff,onError:r.onError},{user_id:_,email_address:l,identifiers:T},_,l,dispatch_processing_1.SUBMIT_FP_TIMEOUT_MS);r.registerBackground?.(e)}const j={...s,"Content-Type":"application/json"},D=new Response(JSON.stringify($.success?{success:!0,data:$.data}:{success:!1,error:$.error}),{status:200,headers:j});for(const e of I)D.headers.append("Set-Cookie",e);return D}catch{return(0,web_helpers_1.jsonResponse)(200,{success:!0,data:{accepted:!1}},s)}}async function handleVerifyTriggerWeb(e,t,r,s){try{const n=resolveEmailWithBody(e,t??{},r.resolveEmailAddress);if(!n)return(0,web_helpers_1.jsonResponse)(400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Email is required"}},s);const i=(0,web_helpers_1.extractDeviceIdFromRequestOrUnknown)(e,r.resolveDeviceId),a=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fp_id")||void 0,o=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fingerprint_id")||void 0,d=extractPermanentDeviceIdFromRequest(e),c=await r.client.triggerEmailVerification(n,i,{fingerprintId:a,fullHash:o,permanentDeviceId:d});if(c.success){const t=(0,web_helpers_1.jsonResponse)(200,{success:!0,data:c.data},s);if(c.data?.verification_id){const r=(0,web_helpers_1.isSecureWebRequest)(e)?"; Secure":"";t.headers.append("Set-Cookie",`__unshared_verification_id=${encodeURIComponent(c.data.verification_id)}; HttpOnly; Path=/; SameSite=Lax; Max-Age=600${r}`)}return t}return(0,web_helpers_1.jsonResponse)(200,{success:!1,error:c.error??{code:"TRIGGER_FAILED",message:"Failed to send verification email"}},s)}catch(e){return r.onError&&r.onError(e,{operation:"verifyTrigger"}),(0,web_helpers_1.jsonResponse)(200,{success:!1,error:{code:"INTERNAL_ERROR",message:"Failed to trigger verification"}},s)}}async function handleVerifyWeb(e,t,r,s){try{const n=t?.code,i=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_verification_id");if(!i||!n)return(0,web_helpers_1.jsonResponse)(400,{success:!1,error:{code:"VALIDATION_ERROR",message:"Verification ID and code are required"}},s);const a=await r.client.verifyEmail({verification_id:i,code:n});if(a.success&&a.data?.verified){let t,n=!1;try{t=r.resolveUserId(e)}catch{}const i=resolveEmail(e,r.resolveEmailAddress),o=(0,web_helpers_1.extractDeviceIdFromRequest)(e,r.resolveDeviceId),d=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fp_id")||void 0,c=(0,web_helpers_1.parseCookieFromRequest)(e,"__unshared_fingerprint_id")||void 0,_=extractPermanentDeviceIdFromRequest(e);if(t&&i){const e={...o?{device_id:o}:{},...d?{stable_hash:d}:{},...c?{full_hash:c}:{},..._?{unshared_device_id:_}:{}},s=await r.client.checkUser({user_id:t,email_address:i,identifiers:e},{maxRetries:0});s.success&&s.data&&!s.failedOpen&&!s.data.is_user_flagged&&(r.verdictCache.update(t,{isVerified:!0}),n=!0)}const l=(0,web_helpers_1.jsonResponse)(200,{success:!0,data:a.data},s);n&&l.headers.set("X-Unshared-Enforcement-Reconciled","clean");const u=(0,web_helpers_1.isSecureWebRequest)(e)?"; Secure":"";return l.headers.append("Set-Cookie",`__unshared_verification_id=; HttpOnly; Path=/; SameSite=Lax; Max-Age=0${u}`),l}return a.success?(0,web_helpers_1.jsonResponse)(200,{success:!0,data:a.data},s):(0,web_helpers_1.jsonResponse)(200,{success:!1,error:a.error??{code:"VERIFICATION_FAILED",message:"Verification failed"}},s)}catch(e){return r.onError&&r.onError(e,{operation:"verify"}),(0,web_helpers_1.jsonResponse)(200,{success:!1,error:{code:"INTERNAL_ERROR",message:"Verification failed"}},s)}}function __test_resetInjectWarning(){defaultInjectWarnState.emitted=!1}exports.__test_fetchAndCacheVerdict=fetchAndCacheVerdict,exports.__test_injectIntoHtmlResponse=injectIntoHtmlResponse;