fix(webhooks): parse simplified payload and preserve bot owners (node)

src/constants.ts

@@ -76,7 +76,7 @@ export const FLAG_KEYS: readonly FlagKey[] = [
 ];
 
 /** Webhook schema version this SDK was built for. */
-export const KNOWN_SCHEMA_VERSION = '2026-10-06';
+export const KNOWN_SCHEMA_VERSION = '2026-10-07';
 
 export const DEFAULT_HISTORY_BASE_URL = 'https://account.shieldlabs.ai';
 export const DEFAULT_MANAGEMENT_BASE_URL = 'https://api.shieldlabs.ai';

src/normalize.ts

@@ -401,7 +401,14 @@ export function fromWebhookData(data: JsonObject): Identification {
   const flagSource = isPlainObject(rawFlags) ? rawFlags : {};
   const flags = {} as DetectionFlags;
   for (const key of FLAG_KEYS) flags[key] = isTruthy(own(flagSource, key));
-  for (const key of ['os_mismatch2', 'device_spoofing', 'latency_test', 'banned_ip'] as const)
+  for (const key of [
+    'os_mismatch2',
+    'device_spoofing',
+    'latency_test',
+    'banned_ip',
+    'ai_bot',
+    'ai_browser',
+  ] as const)
     if (typeof flagSource[key] === 'boolean') flags[key] = flagSource[key];
 
   const rawTraffic = own(data, 'traffic_source');
@@ -463,12 +470,28 @@ function webhookExtensions(
   data: JsonObject,
 ): Pick<
   Identification,
-  'risk_events' | 'hre' | 'fingerprint' | 'result_version' | 'scoring_version'
+  | 'risk_events'
+  | 'hre'
+  | 'fingerprint'
+  | 'result_version'
+  | 'scoring_version'
+  | 'search_bot_owner'
+  | 'ai_bot_owner'
+  | 'ai_browser_owner'
 > {
   const out: Pick<
     Identification,
-    'risk_events' | 'hre' | 'fingerprint' | 'result_version' | 'scoring_version'
+    | 'risk_events'
+    | 'hre'
+    | 'fingerprint'
+    | 'result_version'
+    | 'scoring_version'
+    | 'search_bot_owner'
+    | 'ai_bot_owner'
+    | 'ai_browser_owner'
   > = {};
+  for (const key of ['search_bot_owner', 'ai_bot_owner', 'ai_browser_owner'] as const)
+    if (typeof data[key] === 'string') out[key] = data[key];
   if (typeof data.result_version === 'string') out.result_version = data.result_version;
   if (typeof data.scoring_version === 'string') out.scoring_version = data.scoring_version;
   if (Array.isArray(data.risk_events))
@@ -498,6 +521,9 @@ function webhookExtensions(
         status: stringField(r, 'status') || 'unavailable',
         reason: stringField(r, 'reason'),
         level: typeof r.level === 'string' ? r.level : null,
+        ...('cluster_id' in r
+          ? { cluster_id: typeof r.cluster_id === 'string' ? r.cluster_id : null }
+          : {}),
         ...(typeof r.devices === 'number' ? { devices: r.devices } : {}),
         ...(typeof r.min_devices === 'number' ? { min_devices: r.min_devices } : {}),
       };

src/types.ts

@@ -52,7 +52,10 @@ export interface IdentificationSignal {
 
 /** The 19 stable detection flags. A flag the server did not send is false. */
 export interface DetectionFlags {
+  /** Legacy only; current webhooks expose the combined os_mismatch. */
   os_mismatch2?: boolean;
+  ai_bot?: boolean;
+  ai_browser?: boolean;
   device_spoofing?: boolean;
   latency_test?: boolean;
   banned_ip?: boolean;
@@ -84,7 +87,11 @@ export interface DetectionFlags {
 export interface Identification {
   result_version?: string;
   scoring_version?: string;
+  /** Legacy 2026-10-06 only. */
   risk_events?: RiskEvent[];
+  search_bot_owner?: string;
+  ai_bot_owner?: string;
+  ai_browser_owner?: string;
   hre?: HRE;
   fingerprint?: Fingerprint;
   /** UUID of the identification, created in the browser. */
@@ -237,6 +244,7 @@ export interface RiskEvent {
   status: string;
 }
 export interface HREResult {
+  cluster_id?: string | null;
   status: string;
   level: string | null;
   reason: string;

test/contract-current.test.ts

@@ -9,13 +9,10 @@ it('preserves current signed Core identity, fp21, HRE and zero-weight events', (
   expect(event.event_id).toBeTruthy();
   expect(event.site_id).toBe(7);
   if (event.event_type !== 'identification.scored') throw new Error('unexpected type');
-  expect(event.data.risk_events).toHaveLength(19);
-  expect(event.data.risk_events?.find((r) => r.code === 'incognito')).toMatchObject({
-    weight: 0,
-    detected: true,
-  });
-  expect(event.data.fingerprint?.hardware_id).toBe('sample-hardware');
-  expect(event.data.device_id).not.toBe(event.data.fingerprint?.hardware_id);
+  expect(event.data.risk_events).toBeUndefined();
+  expect(event.data.fingerprint).toBeUndefined();
+  expect(event.data.detection_flags.os_mismatch2).toBeUndefined();
+  expect(event.data.hre?.account_sharing.cluster_id).toBeNull();
   expect(event.data.hre?.account_takeover).toMatchObject({
     status: 'not_evaluated',
     reason: 'no_history',
@@ -26,3 +23,13 @@ it('preserves current signed Core identity, fp21, HRE and zero-weight events', (
     false,
   );
 });
+
+it('preserves accepted bot ownership and nullable HRE cluster IDs', () => {
+  const raw = readFileSync(new URL('./contracts/ai-bot.json', import.meta.url));
+  const header = 'sha256=' + createHmac('sha256', 'secret').update(raw).digest('hex');
+  const event = webhooks.constructEvent(raw, header, 'secret');
+  if (event.event_type !== 'identification.scored') throw new Error('wrong type');
+  expect(event.data.ai_bot_owner).toBe('OpenAI');
+  expect(event.data.detection_flags.ai_bot).toBe(true);
+  expect(event.data.hre?.account_takeover.cluster_id).toBeNull();
+});

test/contracts/ai-bot.json

@@ -0,0 +1,91 @@
+{
+  "event_id": "ce256c0f66536957adc5f719250f5b10ce331bd1",
+  "site_id": 7,
+  "event_type": "identification.scored",
+  "schema_version": "2026-10-07",
+  "created_at": "2026-10-06T00:00:02Z",
+  "data": {
+    "result_version": "2026-10-06T00:00:01Z",
+    "scoring_version": "core:fixture",
+    "ai_bot_owner": "OpenAI",
+    "hre": {
+      "account_sharing": {
+        "cluster_id": null,
+        "status": "not_applicable",
+        "level": null,
+        "reason": "anonymous_user"
+      },
+      "account_takeover": {
+        "cluster_id": null,
+        "status": "not_applicable",
+        "level": null,
+        "reason": "anonymous_user"
+      },
+      "impossible_travel": {
+        "cluster_id": null,
+        "status": "not_applicable",
+        "level": null,
+        "reason": "anonymous_user"
+      }
+    },
+    "request_id": "13f84f05-7c2a-4e9b-9f1d-2a6b8c0e4d11",
+    "visitor_id": "161dfbad-8e7f-4a6b-9c5d-0e1f2a3b4c5d",
+    "device_id": "5eb7fd5c-2a1b-4c3d-9e8f-7a6b5c4d3e2f",
+    "session_id": "7a1b2c3d-4e5f-4789-abcd-ef0123456789",
+    "cookie_id": "3f2e1d0c-9b8a-4654-b210-fedcba987654",
+    "user_hid": "anonymous",
+    "domain": "example.com",
+    "public_ip": {
+      "ip": "203.0.113.1",
+      "country": ""
+    },
+    "local_ip": {
+      "ip": "",
+      "country": ""
+    },
+    "connection_type": "direct",
+    "os": "Windows",
+    "browser": "Chrome",
+    "device_type": "desktop",
+    "traffic_source": {
+      "channel": "",
+      "referrer_domain": "",
+      "landing_url": "",
+      "click_id_type": "",
+      "utm_source": "",
+      "utm_medium": "",
+      "utm_campaign": "",
+      "utm_content": "",
+      "utm_term": ""
+    },
+    "risk_score": 0,
+    "signals": [],
+    "detection_flags": {
+      "device_spoofing": false,
+      "latency_test": false,
+      "banned_ip": false,
+      "vpn": false,
+      "privacy_relay": false,
+      "browser_vpn_proxy": false,
+      "tor": false,
+      "proxy": false,
+      "datacenter_ip": false,
+      "abuser": false,
+      "os_mismatch": false,
+      "os_not_detected": false,
+      "timezone_mismatch": false,
+      "anti_detect_browser": false,
+      "browser_automation": false,
+      "ip_mismatch": false,
+      "incognito": false,
+      "search_bot": false,
+      "ai_bot": true,
+      "ai_browser": false,
+      "suspicious_paid_click": false,
+      "javascript_disabled": false,
+      "stun_not_checked": false,
+      "check_incomplete": false
+    },
+    "observed_at": "2026-10-06T00:00:00Z"
+  }
+}