Read the machineunder the rewrite.

import { useTrustSig } from "@trustsig/react";

const { getResponse } = useTrustSig();
const { token } = await getResponse();

import { TrustSig } from '@trustsig/server';

const ts = new TrustSig({ secretKey: process.env.TRUSTSIG_SECRET_KEY });

app.post('/signup', async (req, res) => {
  const token = req.headers['x-trustsig-response'];
  const result = await ts.verifyRemote(token);

  // is_bot is true once the session crossed the block threshold.
  if (result.is_bot) {
    return res.status(403).json({ error: 'Access denied.' });
  }

  const { anti_detect_browser, tampered, privacy_tooling, virtual_machine } =
    result.integrity;

  // A named engine, or the interception pattern one leaves behind.
  if (anti_detect_browser || tampered) {
    return requireSecondFactor(result.identity.device_id);
  }

  // Randomised readback on its own is a privacy browser as often as an
  // attacker. Bind the account to the device instead of turning them away.
  if (privacy_tooling) {
    return completeSignup(req, res, { pin: result.identity.device_id });
  }

  // A software renderer is ordinary on a corporate desktop and is not on a
  // hosting network. The pair is the finding, neither half alone.
  if (virtual_machine && result.network.datacenter) {
    return res.status(403).json({ error: 'Access denied.' });
  }

  return completeSignup(req, res);
});