Add tracking_token to Device request object

This adds the optional tracking_token field to the Device request
object for explicit device linking via the Device Tracking Add-on.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: oschwald

HISTORY.rst

@@ -6,6 +6,10 @@ History
 3.3.0
 ++++++++++++++++++
 
+* Added ``tracking_token`` to the ``/device`` request object. This is the
+  token generated by the `Device Tracking Add-on
+  <https://dev.maxmind.com/minfraud/track-devices>`_ for explicit device
+  linking.
 * Added ``banquest``, ``summit_payments``, and ``yaadpay`` to the
   ``/payment/processor`` validation.
 * The version is now retrieved from package metadata at runtime using

README.rst

@@ -153,6 +153,7 @@ Score, Insights and Factors Example
     >>>         'accept_language': 'en-US,en;q=0.8',
     >>>         'session_age': 3600,
     >>>         'session_id': 'a333a4e127f880d8820e56a66f40717c',
+    >>>         'tracking_token': '...',
     >>>         'user_agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36'
     >>>     },
     >>>     'event': {

src/minfraud/validation.py

@@ -364,6 +364,7 @@ def _uri(s: str) -> str:
             "ip_address": _ip_address,
             "session_age": All(_any_number, Range(min=0)),
             "session_id": str,
+            "tracking_token": str,
             "user_agent": str,
         },
         "email": {

tests/test_validation.py

@@ -291,6 +291,9 @@ def test_session_age(self) -> None:
                 {"device": {"ip_address": "4.4.4.4", "session_age": invalid}},
             )
 
+    def test_tracking_token(self) -> None:
+        self.check_transaction_str_type("device", "tracking_token")
+
 
 class TestEmail(ValidationBase, unittest.TestCase):
     def test_address(self) -> None: