Drop-in Hardware Attestation.
Zero CAPTCHAs. 100% Zero-Trust.

import { SiliconSieve } from '@gamperlab/silicon-sieve'; // oder window.SiliconSieve

export async function submitCheckout(orderData: CheckoutPayload) {
    // 1. Führe Hardware-Attestierung aus (<15ms Ausführungszeit)
    const attestation = await SiliconSieve.verify();

    if (!attestation.passed) {
        throw new Error("Automatisierte Umgebung erkannt. Hardware-Attestierung fehlgeschlagen.");
    }

    // 2. Sende Request mit Hardware-Proof an deine Payment- oder Order-API
    const response = await fetch('/api/v1/checkout', {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
            'X-Silicon-Proof': attestation.hardware_hash,
            'X-Silicon-Nonce': attestation.nonce
        },
        body: JSON.stringify({
            ...orderData,
            siliconAttestation: attestation
        })
    });

    return await response.json();
}

curl -X POST https://api.gamperlab.com/v1/verify \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sieve_live_YOUR_KEY" \
  -d '{
    "proof": "7f8b9a1c...e3d2f10a",
    "nonce": "ch_98a7bc6d4e2f1098"
  }'

export default async function handler(req, res) {
    if (req.method !== 'POST') return res.status(405).end();

    const siliconProof = req.headers['x-silicon-proof'];
    const clientIp = req.headers['x-forwarded-for'] || req.socket.remoteAddress;

    // DUAL VELOCITY THROTTLING:
    // Prüfe sowohl IP-Rate-Limit als auch physische Hardware-Signatur
    const isHardwareThrottled = checkRateLimit(`hw:${siliconProof}`, 10, 60); // max 10 req/min
    const isIpThrottled = checkRateLimit(`ip:${clientIp}`, 30, 60);

    if (isHardwareThrottled || isIpThrottled) {
        console.warn(`[BLOCKED] Rate limit exceeded for Hardware: ${siliconProof}`);
        return res.status(429).json({ error: 'Rate limit exceeded. Too many requests.' });
    }

    // Führe Geschäftstransaktion aus
    const result = await executeTransaction(req.body);
    res.status(200).json({ success: true, result });
}