@nawa-captcha/server 0.0.0-stage → 0.1.1

package/dist/tokens.js

@@ -0,0 +1,103 @@
+import { BIND_MODES } from './binding.js';
+import { b64url, fromB64url, fromUtf8, hmac, isValidKid, open, safeEqual, seal, utf8 } from './crypto.js';
+export const CHALLENGE_PREFIX = 'ngc1';
+export const PASS_PREFIX = 'ngp1';
+/** Upper bound for anything that claims to be a token; checked before any parsing. */
+export const MAX_TOKEN_LENGTH = 8192;
+// ------------------------------------------------------------------ challenge tokens
+export function sealChallenge(keys, claims) {
+    const kid = keys.activeKid;
+    const key = keys.key(kid, 'challenge-token');
+    if (!key)
+        throw new Error('nawa-captcha: active key missing');
+    const aad = `${CHALLENGE_PREFIX}.${kid}`;
+    const { iv, data } = seal(key, JSON.stringify(claims), aad);
+    return `${aad}.${b64url(iv)}.${b64url(data)}`;
+}
+export function openChallenge(keys, token) {
+    if (typeof token !== 'string' || token.length > MAX_TOKEN_LENGTH)
+        return undefined;
+    const parts = token.split('.');
+    if (parts.length !== 4)
+        return undefined;
+    const [prefix, kid, ivText, dataText] = parts;
+    if (prefix !== CHALLENGE_PREFIX || !isValidKid(kid))
+        return undefined;
+    const key = keys.key(kid, 'challenge-token');
+    const iv = fromB64url(ivText);
+    const data = fromB64url(dataText);
+    if (!key || !iv || !data)
+        return undefined;
+    const json = open(key, iv, data, `${prefix}.${kid}`);
+    if (json === undefined)
+        return undefined;
+    try {
+        const claims = JSON.parse(json);
+        return claims && claims.v === 1 && typeof claims.id === 'string' ? { claims, kid } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// ------------------------------------------------------------------ pass tokens
+/**
+ * Format (documented in README and mirrored by the .NET verifier):
+ *   ngp1.<kid>.<base64url(JSON claims)>.<base64url(HMAC-SHA256(K_pass, "ngp1.<kid>.<payload>"))>
+ */
+export function signPassToken(keys, claims) {
+    const kid = keys.activeKid;
+    const key = keys.key(kid, 'pass-token');
+    if (!key)
+        throw new Error('nawa-captcha: active key missing');
+    const head = `${PASS_PREFIX}.${kid}.${b64url(utf8(JSON.stringify(claims)))}`;
+    return `${head}.${b64url(hmac(key, head))}`;
+}
+export function parsePassToken(keys, token) {
+    if (typeof token !== 'string' || token.length === 0 || token.length > MAX_TOKEN_LENGTH)
+        return { ok: false, error: 'malformed' };
+    const parts = token.split('.');
+    if (parts.length !== 4)
+        return { ok: false, error: 'malformed' };
+    const [prefix, kid, payload, sig] = parts;
+    if (prefix !== PASS_PREFIX || !isValidKid(kid))
+        return { ok: false, error: 'malformed' };
+    const key = keys.key(kid, 'pass-token');
+    if (!key)
+        return { ok: false, error: 'unknown-key' };
+    const sigBytes = fromB64url(sig);
+    if (!sigBytes || !fromB64url(payload))
+        return { ok: false, error: 'malformed' };
+    // Signature first: nothing inside the payload is trusted (or even parsed) before it verifies.
+    if (!safeEqual(sigBytes, hmac(key, `${prefix}.${kid}.${payload}`)))
+        return { ok: false, error: 'bad-signature' };
+    try {
+        const text = fromUtf8(fromB64url(payload));
+        if (text === undefined)
+            return { ok: false, error: 'malformed' };
+        const claims = JSON.parse(text);
+        if (!isPassClaims(claims))
+            return { ok: false, error: 'malformed' };
+        return { ok: true, claims, kid };
+    }
+    catch {
+        return { ok: false, error: 'malformed' };
+    }
+}
+function isPassClaims(c) {
+    if (!c || typeof c !== 'object')
+        return false;
+    const o = c;
+    return (o['v'] === 1 &&
+        typeof o['jti'] === 'string' &&
+        typeof o['sk'] === 'string' &&
+        typeof o['act'] === 'string' &&
+        typeof o['typ'] === 'string' &&
+        Number.isInteger(o['iat']) &&
+        Number.isInteger(o['exp']) &&
+        Number.isInteger(o['lvl']) &&
+        typeof o['cbm'] === 'string' &&
+        BIND_MODES.includes(o['cbm']) &&
+        (o['cb'] === undefined || typeof o['cb'] === 'string') &&
+        (o['stp'] === undefined || (Array.isArray(o['stp']) && o['stp'].length >= 1 && o['stp'].length <= 5 && o['stp'].every((t) => typeof t === 'string'))));
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAiB,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAgB,MAAM,aAAa,CAAC;AAGxH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AA+CrC,sFAAsF;AAEtF,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,MAAuB;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,GAAG,gBAAgB,IAAI,GAAG,EAAE,CAAC;IACzC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,KAAa;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,SAAS,CAAC;IACnF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,KAAyC,CAAC;IAClF,IAAI,MAAM,KAAK,gBAAgB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QACnD,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,MAAuB;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAMD,MAAM,UAAU,cAAc,CAAC,IAAa,EAAE,KAAa;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACjI,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,KAAyC,CAAC;IAC9E,IAAI,MAAM,KAAK,WAAW,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACzF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChF,8FAA8F;IAC9F,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACjH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QACnD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QACZ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC5B,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAa,CAAC;QACzC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC;QACtD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CACtJ,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,62 @@
+import type { Rng } from './rng.js';
+/**
+ * Every challenge type, grouped by what the person does. Each type lives in its own module under
+ * `src/puzzles/` and is rendered by one of the widget's generic views (see {@link ViewKind}).
+ */
+export declare const CHALLENGE_TYPES: readonly ["slider", "slide-unlock", "shadow-drag", "jigsaw", "rotate", "rotate-object", "rotate-match", "hold", "icons", "icons-weather", "icons-objects", "odd-one-out", "odd-rotation", "color-name", "biggest", "find-shape", "shadow-pick", "pattern", "clock", "math-compare", "symmetry", "pairs", "tap-order", "spell", "order", "order-size", "order-numbers", "order-time", "story", "trace", "trace-letters", "maze", "math", "count", "dice", "pow", "accessible", "audio"];
+export type ChallengeType = (typeof CHALLENGE_TYPES)[number];
+/**
+ * The widget view that renders a type. Views are generic interaction patterns; the public data
+ * of each view is documented next to the puzzles that use it.
+ */
+export declare const VIEW_KINDS: readonly ["slide", "drag", "rotate", "swap", "hold", "grid", "pairs", "taps", "order", "path", "text", "pow", "accessible", "audio"];
+export type ViewKind = (typeof VIEW_KINDS)[number];
+export declare const LANGS: readonly ["ar", "en"];
+export type Lang = (typeof LANGS)[number];
+/** A pointer/keyboard sample in image coordinates: [x, y, msSinceStart]. */
+export type TracePoint = readonly [x: number, y: number, t: number];
+export type InputMode = 'mouse' | 'touch' | 'pen' | 'keyboard';
+export interface Interaction {
+    readonly mode: InputMode;
+    readonly trail: readonly TracePoint[];
+}
+export interface GenerateContext {
+    readonly level: number;
+    readonly lang: Lang;
+    /** Randomness source. The engine always passes a CSPRNG; tests may pass a seeded one. */
+    readonly rng: Rng;
+}
+export interface Generated<Sol, Pub> {
+    readonly solution: Sol;
+    readonly publicData: Pub;
+    readonly prompt: string;
+}
+export interface CheckContext {
+    readonly level: number;
+    /** Server-measured ms between issue and verification (from the sealed `iat`). */
+    readonly elapsedMs: number;
+}
+export type CheckFailure = 'invalid-answer' | 'wrong-answer' | 'bot-suspected';
+export type CheckResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly reason: CheckFailure;
+    readonly detail?: string;
+};
+export interface PuzzleDefinition<Sol = unknown, Pub = unknown> {
+    readonly type: ChallengeType;
+    /** Which widget view renders it. */
+    readonly view: ViewKind;
+    /** Verification is refused if answered sooner than this after issue. */
+    readonly minSolveMs: number;
+    /** Wrong answers allowed on one challenge before it is burned. */
+    readonly maxAttempts: number;
+    generate(ctx: GenerateContext): Generated<Sol, Pub>;
+    /** Validates the untrusted answer shape AND checks it against the sealed solution. */
+    check(solution: Sol, answer: unknown, ctx: CheckContext): CheckResult;
+}
+export declare const ok: CheckResult;
+export declare const invalid: (detail?: string) => CheckResult;
+export declare const wrong: (detail?: string) => CheckResult;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,eAAe,wdA8ClB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,UAAU,sIAAuI,CAAC;AAC/J,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,eAAO,MAAM,KAAK,uBAAwB,CAAC;AAC3C,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAEpE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,yFAAyF;IACzF,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,SAAS,CAAC,GAAG,EAAE,GAAG;IACjC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElI,MAAM,WAAW,gBAAgB,CAAC,GAAG,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO;IAC5D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,sFAAsF;IACtF,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,WAAW,CAAC;CACvE;AAED,eAAO,MAAM,EAAE,EAAE,WAA0B,CAAC;AAC5C,eAAO,MAAM,OAAO,GAAI,SAAS,MAAM,KAAG,WAAuF,CAAC;AAClI,eAAO,MAAM,KAAK,GAAI,SAAS,MAAM,KAAG,WAAqF,CAAC"}

package/dist/types.js

@@ -0,0 +1,61 @@
+/**
+ * Every challenge type, grouped by what the person does. Each type lives in its own module under
+ * `src/puzzles/` and is rendered by one of the widget's generic views (see {@link ViewKind}).
+ */
+export const CHALLENGE_TYPES = [
+    // drag, slide, rotate, hold
+    'slider',
+    'slide-unlock',
+    'shadow-drag',
+    'jigsaw',
+    'rotate',
+    'rotate-object',
+    'rotate-match',
+    'hold',
+    // select in a picture grid
+    'icons',
+    'icons-weather',
+    'icons-objects',
+    'odd-one-out',
+    'odd-rotation',
+    'color-name',
+    'biggest',
+    'find-shape',
+    'shadow-pick',
+    'pattern',
+    'clock',
+    'math-compare',
+    'symmetry',
+    'pairs',
+    // tap in order
+    'tap-order',
+    'spell',
+    // put in order
+    'order',
+    'order-size',
+    'order-numbers',
+    'order-time',
+    'story',
+    // draw a path
+    'trace',
+    'trace-letters',
+    'maze',
+    // type the answer
+    'math',
+    'count',
+    'dice',
+    // invisible / text alternative
+    'pow',
+    'accessible',
+    'audio',
+];
+/**
+ * The widget view that renders a type. Views are generic interaction patterns; the public data
+ * of each view is documented next to the puzzles that use it.
+ */
+export const VIEW_KINDS = ['slide', 'drag', 'rotate', 'swap', 'hold', 'grid', 'pairs', 'taps', 'order', 'path', 'text', 'pow', 'accessible', 'audio'];
+export const LANGS = ['ar', 'en'];
+export const ok = { ok: true };
+export const invalid = (detail) => ({ ok: false, reason: 'invalid-answer', ...(detail ? { detail } : {}) });
+export const wrong = (detail) => ({ ok: false, reason: 'wrong-answer', ...(detail ? { detail } : {}) });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,4BAA4B;IAC5B,QAAQ;IACR,cAAc;IACd,aAAa;IACb,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,cAAc;IACd,MAAM;IACN,2BAA2B;IAC3B,OAAO;IACP,eAAe;IACf,eAAe;IACf,aAAa;IACb,cAAc;IACd,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,OAAO;IACP,cAAc;IACd,UAAU;IACV,OAAO;IACP,eAAe;IACf,WAAW;IACX,OAAO;IACP,eAAe;IACf,OAAO;IACP,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,OAAO;IACP,cAAc;IACd,OAAO;IACP,eAAe;IACf,MAAM;IACN,kBAAkB;IAClB,MAAM;IACN,OAAO;IACP,MAAM;IACN,+BAA+B;IAC/B,KAAK;IACL,YAAY;IACZ,OAAO;CACC,CAAC;AAGX;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAU,CAAC;AAG/J,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC;AAiD3C,MAAM,CAAC,MAAM,EAAE,GAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAe,EAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAClI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAe,EAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,70 @@
 {
   "name": "@nawa-captcha/server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Nawa Captcha server: self-hosted, privacy-friendly puzzle CAPTCHA for Node.js. 37 challenge types you choose from, sealed answers, single-use pass tokens, multi-step chains, Express middleware. A reCAPTCHA / hCaptcha alternative with no third-party tracking.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./express": {
+      "types": "./dist/express.d.ts",
+      "import": "./dist/express.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "keywords": [
+    "nodejs",
+    "express",
+    "middleware",
+    "server",
+    "verification",
+    "captcha",
+    "recaptcha-alternative",
+    "hcaptcha-alternative",
+    "turnstile-alternative",
+    "self-hosted-captcha",
+    "accessible-captcha",
+    "puzzle-captcha",
+    "slider-captcha",
+    "privacy",
+    "gdpr",
+    "bot-protection",
+    "anti-spam",
+    "proof-of-work",
+    "nawa-captcha",
+    "pelagic-ui",
+    "arabic",
+    "rtl",
+    "accessibility"
+  ],
+  "homepage": "https://oriebalzyuot96.github.io/nawa-captcha/",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oriebalzyuot96/nawa-captcha.git",
+    "directory": "packages/server"
+  },
+  "bugs": "https://github.com/oriebalzyuot96/nawa-captcha/issues",
+  "author": "oriebalzyuot96",
+  "publishConfig": {
+    "access": "public"
+  },
+  "browser": {
+    "./dist/primitives.js": "./dist/primitives.browser.js"
+  }
+}