@nawa-captcha/server 0.0.0-stage → 0.1.1

package/dist/rng.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Source of randomness for puzzle generation. Production always uses {@link cryptoRng} (CSPRNG).
+ * {@link seededRng} exists so tests can assert that generation is deterministic for a seed; it is
+ * never used by the engine.
+ */
+export interface Rng {
+    /** Uniform float in [0, 1). */
+    next(): number;
+    /** Uniform integer in [min, maxExclusive); fractional bounds are rounded inward. */
+    int(min: number, maxExclusive: number): number;
+    /** Uniform float in [min, max). */
+    float(min?: number, max?: number): number;
+    pick<T>(items: readonly T[]): T;
+    shuffle<T>(items: T[]): T[];
+    sample<T>(items: readonly T[], count: number): T[];
+    bytes(n: number): Uint8Array;
+    /** base64url id with `bytes` bytes of entropy. */
+    id(bytes?: number): string;
+}
+export declare function bytesToB64url(bytes: Uint8Array): string;
+/** CSPRNG-backed randomness (node:crypto or crypto.getRandomValues). */
+export declare const cryptoRng: Rng;
+/** Deterministic sfc32 generator seeded from SHA-256(seed). For tests and tooling only. */
+export declare function seededRng(seed: string | number): Rng;
+//# sourceMappingURL=rng.d.ts.map

package/dist/rng.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rng.d.ts","sourceRoot":"","sources":["../src/rng.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,+BAA+B;IAC/B,IAAI,IAAI,MAAM,CAAC;IACf,oFAAoF;IACpF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/C,mCAAmC;IACnC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;IACnD,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,kDAAkD;IAClD,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B;AAID,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAavD;AAuCD,wEAAwE;AACxE,eAAO,MAAM,SAAS,EAAE,GAQvB,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CA2BpD"}

package/dist/rng.js

@@ -0,0 +1,93 @@
+import { randomBytes, randomInt, sha256 } from './primitives.js';
+const B64URL = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+export function bytesToB64url(bytes) {
+    let out = '';
+    let i = 0;
+    for (; i + 2 < bytes.length; i += 3) {
+        const n = (bytes[i] << 16) | (bytes[i + 1] << 8) | bytes[i + 2];
+        out += B64URL[n >> 18] + B64URL[(n >> 12) & 63] + B64URL[(n >> 6) & 63] + B64URL[n & 63];
+    }
+    if (i < bytes.length) {
+        const n = (bytes[i] << 16) | ((bytes[i + 1] ?? 0) << 8);
+        out += B64URL[n >> 18] + B64URL[(n >> 12) & 63];
+        if (i + 1 < bytes.length)
+            out += B64URL[(n >> 6) & 63];
+    }
+    return out;
+}
+function build(next, bytes, intImpl) {
+    const rng = {
+        next,
+        int(min, maxExclusive) {
+            const lo = Math.ceil(min);
+            const hi = Math.floor(maxExclusive);
+            if (hi <= lo)
+                return lo;
+            return intImpl ? intImpl(lo, hi) : lo + Math.floor(next() * (hi - lo));
+        },
+        float(min = 0, max = 1) {
+            return min + next() * (max - min);
+        },
+        pick(items) {
+            const item = items[rng.int(0, items.length)];
+            if (item === undefined)
+                throw new Error('nawa-captcha: pick from empty list');
+            return item;
+        },
+        shuffle(items) {
+            for (let i = items.length - 1; i > 0; i -= 1) {
+                const j = rng.int(0, i + 1);
+                const a = items[i];
+                items[i] = items[j];
+                items[j] = a;
+            }
+            return items;
+        },
+        sample(items, count) {
+            return rng.shuffle([...items]).slice(0, count);
+        },
+        bytes,
+        id(n = 16) {
+            return bytesToB64url(bytes(n));
+        },
+    };
+    return rng;
+}
+/** CSPRNG-backed randomness (node:crypto or crypto.getRandomValues). */
+export const cryptoRng = build(() => {
+    const b = randomBytes(6);
+    // 48 bits of entropy is plenty for geometry jitter.
+    return ((b[0] * 2 ** 40) + (b[1] * 2 ** 32) + (((b[2] << 24) | (b[3] << 16) | (b[4] << 8) | b[5]) >>> 0)) / 2 ** 48;
+}, randomBytes, (lo, hi) => randomInt(lo, hi));
+/** Deterministic sfc32 generator seeded from SHA-256(seed). For tests and tooling only. */
+export function seededRng(seed) {
+    const h = sha256(new TextEncoder().encode(`nawa-guard-seed:${seed}`));
+    const dv = new DataView(h.buffer, h.byteOffset, h.byteLength);
+    let a = dv.getUint32(0);
+    let b = dv.getUint32(4);
+    let c = dv.getUint32(8);
+    let d = dv.getUint32(12);
+    const next = () => {
+        a >>>= 0;
+        b >>>= 0;
+        c >>>= 0;
+        d >>>= 0;
+        let t = (a + b) | 0;
+        a = b ^ (b >>> 9);
+        b = (c + (c << 3)) | 0;
+        c = (c << 21) | (c >>> 11);
+        d = (d + 1) | 0;
+        t = (t + d) | 0;
+        c = (c + t) | 0;
+        return (t >>> 0) / 4294967296;
+    };
+    for (let i = 0; i < 12; i += 1)
+        next();
+    return build(next, (n) => {
+        const out = new Uint8Array(n);
+        for (let i = 0; i < n; i += 1)
+            out[i] = Math.floor(next() * 256);
+        return out;
+    });
+}
+//# sourceMappingURL=rng.js.map

package/dist/rng.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rng.js","sourceRoot":"","sources":["../src/rng.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAsBjE,MAAM,MAAM,GAAG,kEAAkE,CAAC;AAElF,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QACnE,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAE,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,CAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAE,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;YAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAE,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,IAAkB,EAAE,KAAgC,EAAE,OAA4C;IAC/G,MAAM,GAAG,GAAQ;QACf,IAAI;QACJ,GAAG,CAAC,GAAG,EAAE,YAAY;YACnB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,EAAE,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC;YACpB,OAAO,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK;YACX,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBACrB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,KAAK;YACjB,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,KAAK;QACL,EAAE,CAAC,CAAC,GAAG,EAAE;YACP,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAQ,KAAK,CACjC,GAAG,EAAE;IACH,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzB,oDAAoD;IACpD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAC5H,CAAC,EACD,WAAW,EACX,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAC9B,CAAC;AAEF,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,GAAW,EAAE;QACxB,CAAC,MAAM,CAAC,CAAC;QACT,CAAC,MAAM,CAAC,CAAC;QACT,CAAC,MAAM,CAAC,CAAC;QACT,CAAC,MAAM,CAAC,CAAC;QACT,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3B,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC;IAChC,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/selection.d.ts

@@ -0,0 +1,54 @@
+import type { Rng } from './rng.js';
+import { type ChallengeType } from './types.js';
+/**
+ * How the server picks a challenge type for a request:
+ * - `adaptive` (default): the difficulty ladder (`ladder[level]`), limited to the allowed types;
+ *   failures from the same client move it up the ladder.
+ * - `random`: a weighted random pick from the allowed types.
+ * - `sequence`: the allowed types in turn, per client and action (a rotation).
+ */
+export type SelectionMode = 'random' | 'sequence' | 'adaptive';
+/** Per-action override. Any field left out falls back to the global option. */
+export interface ActionPolicy {
+    /** Allow-list for this action (replaces the global `types`). */
+    readonly types?: readonly ChallengeType[];
+    readonly weights?: Partial<Record<ChallengeType, number>>;
+    readonly mode?: SelectionMode;
+    /** Number of different puzzles to solve in a row before a pass token is issued (1-3). */
+    readonly steps?: number;
+    readonly ladder?: readonly (readonly ChallengeType[])[];
+    /** Base proof-of-work difficulty (bits) for `pow` and the accessible PoW tax on this action. */
+    readonly powBits?: number;
+}
+export interface ResolvedPolicy {
+    readonly types: readonly ChallengeType[];
+    readonly weights: Partial<Record<ChallengeType, number>>;
+    readonly mode: SelectionMode;
+    readonly steps: number;
+    readonly ladder: readonly (readonly ChallengeType[])[];
+    readonly powBits: number;
+}
+export declare const DEFAULT_LADDER: readonly (readonly ChallengeType[])[];
+/** Types used by `random`/`sequence` when no allow-list is configured (everything visual). */
+export declare const DEFAULT_POOL: readonly ChallengeType[];
+export declare const MAX_STEPS = 3;
+export declare function isChallengeType(v: unknown): v is ChallengeType;
+/** Validates a configured type list; unknown names are a configuration error, not silently dropped. */
+export declare function checkTypes(list: readonly unknown[] | undefined, where: string): ChallengeType[] | undefined;
+export declare function checkSteps(steps: number | undefined, where: string): number | undefined;
+/**
+ * Parses the browser's optional narrowing hint (`types: ['slider', 'rotate']` or "slider,rotate").
+ * Unknown names are ignored; the result is only ever used to NARROW the server's allow-list.
+ */
+export declare function parseClientTypes(value: unknown): ChallengeType[] | undefined;
+/** The pool a challenge is drawn from: allow-list ∩ client narrowing (ignored if it leaves nothing). */
+export declare function effectivePool(policy: ResolvedPolicy, clientTypes: readonly ChallengeType[] | undefined): ChallengeType[];
+export declare function weightedPick(rng: Rng, pool: readonly ChallengeType[], weights: Partial<Record<ChallengeType, number>>): ChallengeType;
+/** Random pool without the text/audio alternatives (chosen by the person, never drawn at random). */
+export declare function drawable(pool: readonly ChallengeType[]): ChallengeType[];
+/**
+ * Adaptive pick: the ladder rung for `level` limited to the pool. If that rung has nothing allowed,
+ * the nearest lower rung is used, then higher ones, then the whole pool.
+ */
+export declare function ladderPool(ladder: readonly (readonly ChallengeType[])[], level: number, pool: readonly ChallengeType[]): ChallengeType[];
+//# sourceMappingURL=selection.d.ts.map

package/dist/selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection.d.ts","sourceRoot":"","sources":["../src/selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,aAAa,EAAE,CAAC,EAAE,CAAC;IACxD,gGAAgG;IAChG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,aAAa,EAAE,CAAC,EAAE,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,cAAc,EAAE,SAAS,CAAC,SAAS,aAAa,EAAE,CAAC,EAI/D,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,YAAY,EAAE,SAAS,aAAa,EAAsF,CAAC;AAExI,eAAO,MAAM,SAAS,IAAI,CAAC;AAE3B,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,aAAa,CAE9D;AAED,uGAAuG;AACvG,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,EAAE,GAAG,SAAS,CAM3G;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,GAAG,SAAS,CAM5E;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,GAAG,aAAa,EAAE,CAMxH;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,aAAa,CAUrI;AAED,qGAAqG;AACrG,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAGxE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,aAAa,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAQxI"}

package/dist/selection.js

@@ -0,0 +1,85 @@
+import { CHALLENGE_TYPES } from './types.js';
+export const DEFAULT_LADDER = [
+    ['slider', 'rotate'],
+    ['icons', 'order', 'trace', 'slider', 'rotate-object', 'shadow-drag', 'jigsaw', 'pairs', 'find-shape', 'tap-order', 'icons-objects'],
+    ['icons', 'trace', 'math', 'order', 'maze', 'spell', 'symmetry', 'rotate-match', 'story', 'order-time', 'color-name', 'trace-letters'],
+];
+/** Types used by `random`/`sequence` when no allow-list is configured (everything visual). */
+export const DEFAULT_POOL = CHALLENGE_TYPES.filter((t) => t !== 'pow' && t !== 'accessible' && t !== 'audio');
+export const MAX_STEPS = 3;
+export function isChallengeType(v) {
+    return typeof v === 'string' && CHALLENGE_TYPES.includes(v);
+}
+/** Validates a configured type list; unknown names are a configuration error, not silently dropped. */
+export function checkTypes(list, where) {
+    if (list === undefined)
+        return undefined;
+    if (!Array.isArray(list))
+        throw new Error(`nawa-captcha: ${where} must be an array of challenge types`);
+    const bad = list.filter((t) => !isChallengeType(t));
+    if (bad.length)
+        throw new Error(`nawa-captcha: unknown challenge type(s) in ${where}: ${bad.join(', ')}. Known: ${CHALLENGE_TYPES.join(', ')}`);
+    return [...new Set(list)];
+}
+export function checkSteps(steps, where) {
+    if (steps === undefined)
+        return undefined;
+    if (!Number.isInteger(steps) || steps < 1 || steps > MAX_STEPS)
+        throw new Error(`nawa-captcha: ${where} must be an integer from 1 to ${MAX_STEPS}`);
+    return steps;
+}
+/**
+ * Parses the browser's optional narrowing hint (`types: ['slider', 'rotate']` or "slider,rotate").
+ * Unknown names are ignored; the result is only ever used to NARROW the server's allow-list.
+ */
+export function parseClientTypes(value) {
+    if (value === undefined || value === null || value === '')
+        return undefined;
+    const raw = typeof value === 'string' ? value.split(',') : Array.isArray(value) ? value : undefined;
+    if (!raw || raw.length > CHALLENGE_TYPES.length)
+        return undefined;
+    const out = raw.map((t) => (typeof t === 'string' ? t.trim() : t)).filter(isChallengeType);
+    return out.length ? [...new Set(out)] : undefined;
+}
+/** The pool a challenge is drawn from: allow-list ∩ client narrowing (ignored if it leaves nothing). */
+export function effectivePool(policy, clientTypes) {
+    const usable = policy.types.filter((t) => (policy.weights[t] ?? 1) > 0);
+    const base = usable.length ? usable : [...policy.types];
+    if (!clientTypes?.length)
+        return base;
+    const narrowed = base.filter((t) => clientTypes.includes(t));
+    return narrowed.length ? narrowed : base;
+}
+export function weightedPick(rng, pool, weights) {
+    const ws = pool.map((t) => Math.max(0, weights[t] ?? 1));
+    const total = ws.reduce((a, b) => a + b, 0);
+    if (!(total > 0))
+        return rng.pick(pool);
+    let x = rng.next() * total;
+    for (let i = 0; i < pool.length; i += 1) {
+        x -= ws[i];
+        if (x < 0)
+            return pool[i];
+    }
+    return pool[pool.length - 1];
+}
+/** Random pool without the text/audio alternatives (chosen by the person, never drawn at random). */
+export function drawable(pool) {
+    const visual = pool.filter((t) => t !== 'accessible' && t !== 'audio');
+    return visual.length ? visual : [...pool];
+}
+/**
+ * Adaptive pick: the ladder rung for `level` limited to the pool. If that rung has nothing allowed,
+ * the nearest lower rung is used, then higher ones, then the whole pool.
+ */
+export function ladderPool(ladder, level, pool) {
+    const top = Math.min(level, ladder.length - 1);
+    const order = [...Array.from({ length: top + 1 }, (_, i) => top - i), ...Array.from({ length: ladder.length - top - 1 }, (_, i) => top + 1 + i)];
+    for (const rung of order) {
+        const hit = (ladder[rung] ?? []).filter((t) => pool.includes(t));
+        if (hit.length)
+            return hit;
+    }
+    return [...pool];
+}
+//# sourceMappingURL=selection.js.map

package/dist/selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection.js","sourceRoot":"","sources":["../src/selection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAsB,MAAM,YAAY,CAAC;AAiCjE,MAAM,CAAC,MAAM,cAAc,GAA0C;IACnE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,CAAC;IACpI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC;CACvI,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,YAAY,GAA6B,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;AAExI,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC;AAE3B,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,UAAU,CAAC,IAAoC,EAAE,KAAa;IAC5E,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,sCAAsC,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChJ,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAuB,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAyB,EAAE,KAAa;IACjE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,iCAAiC,SAAS,EAAE,CAAC,CAAC;IACpJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,MAAsB,EAAE,WAAiD;IACrG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,IAA8B,EAAE,OAA+C;IACpH,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAE,CAAC;QACZ,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;AAChC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,QAAQ,CAAC,IAA8B;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAA6C,EAAE,KAAa,EAAE,IAA8B;IACrH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Storage used for one-time redemption (challenge ids, pass-token ids), attempt counters, rate
+ * limits and adaptive difficulty. Every operation must be atomic in a multi-instance deployment,
+ * which is why the interface is two primitives rather than get/set.
+ */
+export interface NawaCaptchaStore {
+    /** Sets `key` only if absent. Resolves true when this call created it (i.e. first redemption). */
+    setIfAbsent(key: string, ttlMs: number): Promise<boolean>;
+    /** Increments a counter (creating it with `ttlMs` if absent) and resolves the new value. */
+    increment(key: string, ttlMs: number): Promise<number>;
+    /** Current counter value, or 0. */
+    count(key: string): Promise<number>;
+    delete(key: string): Promise<void>;
+}
+export interface MemoryStoreOptions {
+    /** Upper bound on live entries; least-recently-used entries are evicted beyond it. */
+    readonly maxEntries?: number;
+    readonly now?: () => number;
+}
+/**
+ * Single-process LRU store with TTLs. Fine for one Node instance and for tests. Behind a load
+ * balancer use Redis (or any shared atomic store), otherwise a token redeemed on instance A
+ * could be replayed on instance B.
+ */
+export declare class MemoryStore implements NawaCaptchaStore {
+    private readonly map;
+    private readonly max;
+    private readonly now;
+    constructor(options?: MemoryStoreOptions);
+    get size(): number;
+    private live;
+    private put;
+    private evict;
+    setIfAbsent(key: string, ttlMs: number): Promise<boolean>;
+    increment(key: string, ttlMs: number): Promise<number>;
+    count(key: string): Promise<number>;
+    delete(key: string): Promise<void>;
+}
+/** The subset of the ioredis client used by {@link ioredisStore}. */
+export interface IoRedisLike {
+    set(key: string, value: string, px: 'PX', ttl: number, nx: 'NX'): Promise<'OK' | null>;
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+    get(key: string): Promise<string | null>;
+    del(key: string): Promise<number>;
+}
+/** The subset of the node-redis v4+ client used by {@link nodeRedisStore}. */
+export interface NodeRedisLike {
+    set(key: string, value: string, options: {
+        PX: number;
+        NX: true;
+    }): Promise<string | null>;
+    eval(script: string, options: {
+        keys: string[];
+        arguments: string[];
+    }): Promise<unknown>;
+    get(key: string): Promise<string | null>;
+    del(key: string): Promise<number>;
+}
+/**
+ * Redis adapter for ioredis: `ioredisStore(new Redis(url))`. SET NX PX gives atomic one-time
+ * redemption; INCR+PEXPIRE runs as a Lua script so a counter can never be left without a TTL.
+ */
+export declare function ioredisStore(client: IoRedisLike, prefix?: string): NawaCaptchaStore;
+/** Redis adapter for node-redis v4+: `nodeRedisStore(createClient({ url }))` (after `connect()`). */
+export declare function nodeRedisStore(client: NodeRedisLike, prefix?: string): NawaCaptchaStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,4FAA4F;IAC5F,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,mCAAmC;IACnC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAOD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,qBAAa,WAAY,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,GAAE,kBAAuB;IAK5C,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,IAAI;IAaZ,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,KAAK;IAaP,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMzD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUtD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzC;AAMD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;GAGG;AAEH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,SAAgB,GAAG,gBAAgB,CAS1F;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,SAAgB,GAAG,gBAAgB,CAS9F"}

package/dist/store.js

@@ -0,0 +1,100 @@
+/**
+ * Single-process LRU store with TTLs. Fine for one Node instance and for tests. Behind a load
+ * balancer use Redis (or any shared atomic store), otherwise a token redeemed on instance A
+ * could be replayed on instance B.
+ */
+export class MemoryStore {
+    map = new Map();
+    max;
+    now;
+    constructor(options = {}) {
+        this.max = options.maxEntries ?? 100_000;
+        this.now = options.now ?? Date.now;
+    }
+    get size() {
+        return this.map.size;
+    }
+    live(key) {
+        const e = this.map.get(key);
+        if (!e)
+            return undefined;
+        if (e.expiresAt <= this.now()) {
+            this.map.delete(key);
+            return undefined;
+        }
+        // Re-insert to mark as most recently used.
+        this.map.delete(key);
+        this.map.set(key, e);
+        return e;
+    }
+    put(key, entry) {
+        this.map.set(key, entry);
+        if (this.map.size > this.max)
+            this.evict();
+    }
+    evict() {
+        const now = this.now();
+        for (const [k, e] of this.map) {
+            if (this.map.size <= this.max)
+                return;
+            if (e.expiresAt <= now)
+                this.map.delete(k);
+        }
+        while (this.map.size > this.max) {
+            const oldest = this.map.keys().next();
+            if (oldest.done)
+                return;
+            this.map.delete(oldest.value);
+        }
+    }
+    async setIfAbsent(key, ttlMs) {
+        if (this.live(key))
+            return false;
+        this.put(key, { value: 1, expiresAt: this.now() + ttlMs });
+        return true;
+    }
+    async increment(key, ttlMs) {
+        const e = this.live(key);
+        if (e) {
+            e.value += 1;
+            return e.value;
+        }
+        this.put(key, { value: 1, expiresAt: this.now() + ttlMs });
+        return 1;
+    }
+    async count(key) {
+        return this.live(key)?.value ?? 0;
+    }
+    async delete(key) {
+        this.map.delete(key);
+    }
+}
+// ------------------------------------------------------------------------------------ Redis
+const INCR_SCRIPT = "local v = redis.call('INCR', KEYS[1]) if v == 1 then redis.call('PEXPIRE', KEYS[1], ARGV[1]) end return v";
+/**
+ * Redis adapter for ioredis: `ioredisStore(new Redis(url))`. SET NX PX gives atomic one-time
+ * redemption; INCR+PEXPIRE runs as a Lua script so a counter can never be left without a TTL.
+ */
+// The default key prefix keeps its pre-rename value so stores stay compatible across the upgrade.
+export function ioredisStore(client, prefix = 'nawa-guard:') {
+    return {
+        setIfAbsent: async (key, ttlMs) => (await client.set(prefix + key, '1', 'PX', Math.max(1, Math.ceil(ttlMs)), 'NX')) === 'OK',
+        increment: async (key, ttlMs) => Number(await client.eval(INCR_SCRIPT, 1, prefix + key, Math.max(1, Math.ceil(ttlMs)))),
+        count: async (key) => Number((await client.get(prefix + key)) ?? 0),
+        delete: async (key) => {
+            await client.del(prefix + key);
+        },
+    };
+}
+/** Redis adapter for node-redis v4+: `nodeRedisStore(createClient({ url }))` (after `connect()`). */
+export function nodeRedisStore(client, prefix = 'nawa-guard:') {
+    return {
+        setIfAbsent: async (key, ttlMs) => (await client.set(prefix + key, '1', { PX: Math.max(1, Math.ceil(ttlMs)), NX: true })) === 'OK',
+        increment: async (key, ttlMs) => Number(await client.eval(INCR_SCRIPT, { keys: [prefix + key], arguments: [String(Math.max(1, Math.ceil(ttlMs)))] })),
+        count: async (key) => Number((await client.get(prefix + key)) ?? 0),
+        delete: async (key) => {
+            await client.del(prefix + key);
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AA0BA;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACL,GAAG,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC/B,GAAG,CAAS;IACZ,GAAG,CAAe;IAEnC,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAEO,IAAI,CAAC,GAAW;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,GAAG,CAAC,GAAW,EAAE,KAAY;QACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG;gBAAE,OAAO;YACtC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI;gBAAE,OAAO;YACxB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa;QAC1C,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACb,OAAO,CAAC,CAAC,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;CACF;AAED,6FAA6F;AAE7F,MAAM,WAAW,GAAG,2GAA2G,CAAC;AAkBhI;;;GAGG;AACH,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,MAAM,GAAG,aAAa;IACtE,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;QAC5H,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvH,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAM,GAAG,aAAa;IAC1E,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI;QAClI,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrJ,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tokens.d.ts

@@ -0,0 +1,70 @@
+import { type BindMode } from './binding.js';
+import { type Keyring } from './crypto.js';
+import type { ChallengeType } from './types.js';
+export declare const CHALLENGE_PREFIX = "ngc1";
+export declare const PASS_PREFIX = "ngp1";
+/** Upper bound for anything that claims to be a token; checked before any parsing. */
+export declare const MAX_TOKEN_LENGTH = 8192;
+/** Contents of a challenge token. Sealed with AES-256-GCM: the client can neither read nor alter it. */
+export interface ChallengeClaims {
+    readonly v: 1;
+    /** Random challenge id; the one-time-redemption and attempt-counter key. */
+    readonly id: string;
+    readonly typ: ChallengeType;
+    readonly sk: string;
+    readonly act: string;
+    readonly lang: string;
+    /** Issued-at / expiry in unix milliseconds (ms precision is needed for minimum solve time). */
+    readonly iat: number;
+    readonly exp: number;
+    /** Difficulty level that produced this challenge. */
+    readonly lvl: number;
+    readonly cbm: BindMode;
+    readonly cb?: string;
+    /** Type-specific solution. Never leaves the server in readable form. */
+    readonly sol: unknown;
+    /** Multi-step chains only: this step (1-based), total steps, types already solved, and the pool to pick from. */
+    readonly stp?: number;
+    readonly of?: number;
+    readonly done?: readonly ChallengeType[];
+    readonly pool?: readonly ChallengeType[];
+}
+/** Contents of a pass token. Signed (HMAC-SHA256), readable by design; holds no secret. */
+export interface PassTokenClaims {
+    readonly v: 1;
+    readonly jti: string;
+    readonly sk: string;
+    readonly act: string;
+    readonly typ: ChallengeType;
+    readonly lvl: number;
+    /** Unix seconds. */
+    readonly iat: number;
+    readonly exp: number;
+    readonly cbm: BindMode;
+    readonly cb?: string;
+    /**
+     * Multi-step only (`steps` > 1): every solved type in order; `typ` is the last one. Optional and
+     * additive, so single-step tokens are byte-for-byte the v1 format.
+     */
+    readonly stp?: readonly ChallengeType[];
+}
+export declare function sealChallenge(keys: Keyring, claims: ChallengeClaims): string;
+export declare function openChallenge(keys: Keyring, token: string): {
+    claims: ChallengeClaims;
+    kid: string;
+} | undefined;
+/**
+ * Format (documented in README and mirrored by the .NET verifier):
+ *   ngp1.<kid>.<base64url(JSON claims)>.<base64url(HMAC-SHA256(K_pass, "ngp1.<kid>.<payload>"))>
+ */
+export declare function signPassToken(keys: Keyring, claims: PassTokenClaims): string;
+export type PassTokenParse = {
+    ok: true;
+    claims: PassTokenClaims;
+    kid: string;
+} | {
+    ok: false;
+    error: 'malformed' | 'unknown-key' | 'bad-signature';
+};
+export declare function parsePassToken(keys: Keyring, token: string): PassTokenParse;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAA+E,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,gBAAgB,SAAS,CAAC;AACvC,eAAO,MAAM,WAAW,SAAS,CAAC;AAClC,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,wGAAwG;AACxG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,iHAAiH;IACjH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACzC;AAID,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAO5E;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAkBhH;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAM5E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,GAAG,aAAa,GAAG,eAAe,CAAA;CAAE,CAAC;AAExE,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAqB3E"}