@prosopo/provider 4.15.13 → 4.15.15

package/dist/tasks/frictionless/frictionlessTasks.js

@@ -1,486 +1,349 @@
-import { SimdReadingsStage, CaptchaType, ApiParams } from "@prosopo/types";
-import { FrictionlessReason } from "@prosopo/types";
-import { v4 } from "uuid";
+import { buildAllWindowIncrements } from "../../util/usageCounters.js";
+import { DecisionMachineRunner } from "../decisionMachine/decisionMachineRunner.js";
 import { buildDnsEventUrl } from "../../api/dnsEventUrl.js";
 import { checkLangRules } from "../../rules/lang.js";
-import { buildAllWindowIncrements } from "../../util/usageCounters.js";
 import { CaptchaManager } from "../captchaManager.js";
-import { DecisionMachineRunner } from "../decisionMachine/decisionMachineRunner.js";
 import { getBotScore } from "../detection/getBotScore.js";
 import { applyRouter } from "./routingMachine.js";
-const DEFAULT_MAX_TIMESTAMP_AGE = 60 * 10 * 1e3;
-const getSessionIDPrefix = (host) => {
-  return host ? host.replace(".prosopo.io", "") : "local";
+import { ApiParams, CaptchaType, FrictionlessReason as FrictionlessReason$1, SimdReadingsStage } from "@prosopo/types";
+import { v4 } from "uuid";
+//#region src/tasks/frictionless/frictionlessTasks.ts
+var DEFAULT_MAX_TIMESTAMP_AGE = 600 * 1e3;
+var getSessionIDPrefix = (host) => {
+	return host ? host.replace(".prosopo.io", "") : "local";
 };
-class FrictionlessManager extends CaptchaManager {
-  constructor(db, pair, config, logger, writeQueue, decisionMachineRunner, usageCounters) {
-    super(db, pair, config, logger, writeQueue);
-    this.config = config;
-    this.decisionMachineRunner = decisionMachineRunner ?? new DecisionMachineRunner(db);
-    this.usageCounters = usageCounters ?? null;
-  }
-  /**
-   * Provide the routing-machine context for this request. When set, the
-   * frictionless flow's send*Captcha calls will (a) invoke the routing
-   * machine to potentially override the baseline captcha type, and (b) emit
-   * fire-and-forget served-counter writes after the session is created.
-   *
-   * Not called on maintenance-mode or configured-captchaType short-circuit
-   * paths — those skip routing entirely.
-   */
-  setRoutingContext(ctx) {
-    this.routingContext = ctx;
-  }
-  /**
-   * Evaluate the configured routing machine against an arbitrary baseline +
-   * context, without going through `sendCaptcha`. Used by the dedup
-   * short-circuit to ask "if we reused this cached session, would the
-   * current routing machine still pick the same captchaType?" — if not,
-   * the cached session is evicted and the request falls through into the
-   * normal decision-machine flow (which will run the router again with
-   * fully-derived inputs).
-   *
-   * Returns the supplied baseline on any failure (no machine, machine
-   * throws, counter fetch failure, etc.), matching applyRouter's contract.
-   */
-  async applyRoutingMachine(baseline, ctx) {
-    return applyRouter(
-      this.decisionMachineRunner,
-      this.usageCounters,
-      baseline,
-      ctx,
-      this.logger
-    );
-  }
-  setSessionParams(params) {
-    this.sessionParams = {
-      token: params.token,
-      score: params.score,
-      threshold: params.threshold,
-      scoreComponents: params.scoreComponents,
-      ipAddress: params.ipAddress,
-      webView: params.webView ?? false,
-      iFrame: params.iFrame ?? false,
-      decryptedHeadHash: params.decryptedHeadHash,
-      siteKey: params.siteKey,
-      currentUrl: params.currentUrl,
-      iframeUrl: params.iframeUrl,
-      isProtect: params.isProtect,
-      ipInfo: params.ipInfo,
-      headers: params.headers,
-      mode: params.mode,
-      simdReadings: params.simdReadings,
-      entropyMathRandomFingerprint: params.entropyMathRandomFingerprint,
-      entropyCryptoFingerprint: params.entropyCryptoFingerprint,
-      entropyWallClockOffsetMs: params.entropyWallClockOffsetMs,
-      entropyMathRandomFirst: params.entropyMathRandomFirst,
-      tcpToChelloUs: params.tcpToChelloUs,
-      chelloToHandshakeUs: params.chelloToHandshakeUs
-    };
-  }
-  updateScore(score, scoreComponents) {
-    if (this.sessionParams) {
-      this.sessionParams.score = score;
-      this.sessionParams.scoreComponents = scoreComponents;
-    }
-  }
-  checkLangRules(acceptLanguage) {
-    return checkLangRules(this.config, acceptLanguage);
-  }
-  async createSession(token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, currentUrl, tcpToChelloUs, chelloToHandshakeUs, isEscalation, iframeUrl, isProtect) {
-    const sessionRecord = {
-      sessionId: `${getSessionIDPrefix(this.config.host)}-${v4()}`,
-      createdAt: /* @__PURE__ */ new Date(),
-      token,
-      score,
-      threshold,
-      scoreComponents,
-      ipAddress,
-      captchaType,
-      mode,
-      solvedImagesCount,
-      powDifficulty,
-      userSitekeyIpHash,
-      webView,
-      iFrame,
-      // Only persist the escalation flag when it's actually true —
-      // avoids polluting analytics with `false` on every plain
-      // frictionless session.
-      ...isEscalation && { isEscalation: true },
-      decryptedHeadHash,
-      reason,
-      siteKey,
-      currentUrl,
-      iframeUrl,
-      // Same rationale as isEscalation above: only persist the flag
-      // when it's actually true so non-Protect sessions stay slim and
-      // the sparse index on {isProtect, createdAt} carries only the
-      // Protect subset.
-      ...isProtect && { isProtect: true },
-      blocked,
-      deleted,
-      ipInfo,
-      headers,
-      simdReadings,
-      // Tag the arrival stage when the readings actually came in on
-      // this hop. Absence of readings → absence of stage.
-      ...simdReadings && {
-        simdReadingsStage: SimdReadingsStage.frictionless
-      },
-      entropyMathRandomFingerprint,
-      entropyCryptoFingerprint,
-      entropyWallClockOffsetMs,
-      entropyMathRandomFirst,
-      tcpToChelloUs,
-      chelloToHandshakeUs
-    };
-    await this.db.storeSessionRecord(sessionRecord);
-    if (this.writeQueue) {
-      const cacheData = sessionRecord;
-      const cachePromises = [
-        this.writeQueue.cacheSession(sessionRecord.sessionId, cacheData)
-      ];
-      if (userSitekeyIpHash) {
-        cachePromises.push(
-          this.writeQueue.cacheSessionByHash(
-            userSitekeyIpHash,
-            sessionRecord.sessionId
-          )
-        );
-      }
-      await Promise.all(cachePromises).catch(() => {
-      });
-    }
-    return sessionRecord;
-  }
-  async sendImageCaptcha(params) {
-    return this.sendCaptcha(CaptchaType.image, params);
-  }
-  async sendPowCaptcha(params) {
-    return this.sendCaptcha(CaptchaType.pow, params);
-  }
-  async sendPuzzleCaptcha(params) {
-    return this.sendCaptcha(CaptchaType.puzzle, params);
-  }
-  // Shared body for the three concrete `send*Captcha` helpers. Each helper is
-  // kept as its own thin wrapper so call-sites read clearly, but session
-  // validation and the createSession invocation only live in one place.
-  async sendCaptcha(captchaType, params) {
-    const effectiveParams = { ...this.sessionParams, ...params };
-    if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || !effectiveParams.ipAddress || effectiveParams.siteKey === void 0) {
-      throw new Error(
-        `Session parameters must be set before sending a ${captchaType} captcha`
-      );
-    }
-    const baseline = {
-      captchaType,
-      solvedImagesCount: captchaType === CaptchaType.image ? effectiveParams.solvedImagesCount : void 0,
-      powDifficulty: captchaType === CaptchaType.pow ? effectiveParams.powDifficulty : void 0
-    };
-    const routed = this.routingContext ? await applyRouter(
-      this.decisionMachineRunner,
-      this.usageCounters,
-      baseline,
-      this.routingContext,
-      this.logger
-    ) : baseline;
-    const finalCaptchaType = routed.captchaType;
-    const finalSolvedImagesCount = finalCaptchaType === CaptchaType.image ? routed.solvedImagesCount ?? effectiveParams.solvedImagesCount : void 0;
-    const finalPowDifficulty = finalCaptchaType === CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
-    const blocked = finalCaptchaType === CaptchaType.image ? effectiveParams.blocked : void 0;
-    const sessionRecord = await this.createSession(
-      effectiveParams.token,
-      effectiveParams.score,
-      effectiveParams.threshold,
-      effectiveParams.scoreComponents,
-      effectiveParams.ipAddress,
-      finalCaptchaType,
-      effectiveParams.siteKey,
-      finalSolvedImagesCount,
-      finalPowDifficulty,
-      effectiveParams.userSitekeyIpHash,
-      effectiveParams.webView ?? false,
-      effectiveParams.iFrame ?? false,
-      effectiveParams.decryptedHeadHash,
-      effectiveParams.reason,
-      blocked,
-      void 0,
-      effectiveParams.ipInfo,
-      effectiveParams.headers,
-      effectiveParams.mode,
-      effectiveParams.simdReadings,
-      effectiveParams.entropyMathRandomFingerprint,
-      effectiveParams.entropyCryptoFingerprint,
-      effectiveParams.entropyWallClockOffsetMs,
-      effectiveParams.entropyMathRandomFirst,
-      effectiveParams.currentUrl,
-      effectiveParams.tcpToChelloUs,
-      effectiveParams.chelloToHandshakeUs,
-      void 0,
-      effectiveParams.iframeUrl,
-      effectiveParams.isProtect
-    );
-    if (this.routingContext && this.usageCounters) {
-      this.usageCounters.incrManyAsync(
-        this.routingContext.dappAccount,
-        buildAllWindowIncrements(
-          "served",
-          finalCaptchaType,
-          this.routingContext.ip,
-          this.routingContext.userAccount
-        )
-      );
-    }
-    return {
-      [ApiParams.captchaType]: finalCaptchaType,
-      [ApiParams.sessionId]: sessionRecord.sessionId,
-      [ApiParams.status]: "ok",
-      dns_url: buildDnsEventUrl(sessionRecord.sessionId)
-    };
-  }
-  async registerBlockedSession(params) {
-    const effectiveParams = { ...this.sessionParams, ...params };
-    if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || !effectiveParams.ipAddress || effectiveParams.siteKey === void 0) {
-      throw new Error(
-        "Session parameters must be set before calling registerBlockedSession"
-      );
-    }
-    await this.createSession(
-      effectiveParams.token,
-      effectiveParams.score,
-      effectiveParams.threshold,
-      effectiveParams.scoreComponents,
-      effectiveParams.ipAddress,
-      CaptchaType.image,
-      effectiveParams.siteKey,
-      effectiveParams.solvedImagesCount,
-      void 0,
-      effectiveParams.userSitekeyIpHash,
-      effectiveParams.webView ?? false,
-      effectiveParams.iFrame ?? false,
-      effectiveParams.decryptedHeadHash,
-      effectiveParams.reason,
-      true,
-      true,
-      effectiveParams.ipInfo,
-      effectiveParams.headers,
-      effectiveParams.mode,
-      effectiveParams.simdReadings,
-      effectiveParams.entropyMathRandomFingerprint,
-      effectiveParams.entropyCryptoFingerprint,
-      effectiveParams.entropyWallClockOffsetMs,
-      effectiveParams.entropyMathRandomFirst,
-      effectiveParams.currentUrl,
-      effectiveParams.tcpToChelloUs,
-      effectiveParams.chelloToHandshakeUs,
-      void 0,
-      effectiveParams.iframeUrl,
-      effectiveParams.isProtect
-    );
-  }
-  scoreIncreaseAccessPolicy(accessPolicy, baseBotScore, botScore, scoreComponents) {
-    const accessPolicyPenalty = accessPolicy?.frictionlessScore || this.config.penalties.PENALTY_ACCESS_RULE;
-    botScore += accessPolicyPenalty;
-    return {
-      score: botScore,
-      scoreComponents: {
-        ...scoreComponents,
-        accessPolicy: accessPolicyPenalty
-      }
-    };
-  }
-  scoreIncreaseWebView(baseBotScore, botScore, scoreComponents) {
-    this.logger.debug(() => ({
-      msg: "WebView detected"
-    }));
-    botScore += this.config.penalties.PENALTY_WEBVIEW;
-    return {
-      score: botScore,
-      scoreComponents: {
-        ...scoreComponents,
-        webView: this.config.penalties.PENALTY_WEBVIEW
-      }
-    };
-  }
-  scoreIncreaseTimestamp(timestamp, baseBotScore, botScore, scoreComponents) {
-    this.logger.info(() => ({
-      msg: "Timestamp is older than 10 minutes",
-      data: { timestamp: new Date(timestamp) }
-    }));
-    botScore += this.config.penalties.PENALTY_OLD_TIMESTAMP;
-    return {
-      score: botScore,
-      scoreComponents: {
-        ...scoreComponents,
-        timeout: this.config.penalties.PENALTY_OLD_TIMESTAMP
-      }
-    };
-  }
-  static timestampTooOld(timestamp) {
-    const now = Date.now();
-    const diff = now - timestamp;
-    return diff > DEFAULT_MAX_TIMESTAMP_AGE;
-  }
-  /**
-   * Redacts a key for logging purposes by showing only the first 5, middle 10, and last 5 characters
-   * @param key - The key to redact
-   * @returns Redacted key string or empty string if key is falsy
-   */
-  redactKeyForLogging(key) {
-    if (!key) return "";
-    const start = key.slice(0, 5);
-    const middle = key.slice(
-      Math.floor(key.length / 2) - 5,
-      Math.floor(key.length / 2) + 5
-    );
-    const end = key.slice(-5);
-    return `${start}...${middle}...${end}`;
-  }
-  async decryptPayload(token, headHash) {
-    const decryptKeys = [
-      // Process DB keys first, then env var key last as env key will likely be invalid
-      ...await this.getDetectorKeys(),
-      process.env.BOT_DECRYPTION_KEY
-    ].filter((k) => k);
-    this.logger.debug(() => {
-      const loggedKeys = decryptKeys.map(
-        (key) => this.redactKeyForLogging(key)
-      );
-      return {
-        msg: "Decrypting score",
-        data: {
-          keysLength: decryptKeys.length,
-          keys: loggedKeys
-        }
-      };
-    });
-    let baseBotScore;
-    let timestamp;
-    let userId;
-    let userAgent;
-    let webView;
-    let iFrame;
-    let decryptedHeadHash = "";
-    let decryptionFailed = false;
-    let triggeredDetectors;
-    let shadowDomPenalty;
-    let entropyMathRandomFingerprint;
-    let entropyCryptoFingerprint;
-    let entropyWallClockOffsetMs;
-    let entropyMathRandomFirst;
-    for (const [keyIndex, key] of decryptKeys.entries()) {
-      try {
-        this.logger.info(() => ({
-          msg: "Attempting to decrypt score",
-          data: {
-            key: this.redactKeyForLogging(key)
-          }
-        }));
-        const decrypted = await getBotScore(token, headHash, key);
-        decryptedHeadHash = decrypted.decryptedHeadHash || "";
-        const s = decrypted.baseBotScore;
-        const t = decrypted.timestamp;
-        const a = decrypted.userId;
-        const u = decrypted.userAgent;
-        const w = decrypted.isWebView;
-        const i = decrypted.isIframe;
-        const td = decrypted.triggeredDetectors;
-        const sd = decrypted.shadowDomPenalty;
-        const ef = decrypted.entropyMathRandomFingerprint;
-        const ec = decrypted.entropyCryptoFingerprint;
-        const eo = decrypted.entropyWallClockOffsetMs;
-        const em = decrypted.entropyMathRandomFirst;
-        this.logger.debug(() => ({
-          msg: "Successfully decrypted score",
-          data: {
-            key: this.redactKeyForLogging(key),
-            baseBotScore: s,
-            timestamp: t,
-            userId: a,
-            userAgent: u,
-            webView: w,
-            iFrame: i,
-            triggeredDetectors: td,
-            shadowDomPenalty: sd,
-            entropyMathRandomFingerprint: ef,
-            entropyCryptoFingerprint: ec,
-            entropyWallClockOffsetMs: eo,
-            entropyMathRandomFirst: em
-          }
-        }));
-        baseBotScore = s;
-        timestamp = t;
-        userId = a;
-        userAgent = u;
-        webView = w;
-        iFrame = i;
-        triggeredDetectors = td;
-        shadowDomPenalty = sd;
-        entropyMathRandomFingerprint = ef;
-        entropyCryptoFingerprint = ec;
-        entropyWallClockOffsetMs = eo;
-        entropyMathRandomFirst = em;
-        break;
-      } catch (err) {
-        if (keyIndex === decryptKeys.length - 1) {
-          this.logger.warn(() => ({
-            msg: "Error decrypting score: no more keys to try"
-          }));
-          baseBotScore = 1;
-          timestamp = 0;
-          decryptedHeadHash = "";
-          decryptionFailed = true;
-        }
-      }
-    }
-    const baseBotScoreUndefined = baseBotScore === void 0 || Number.isNaN(baseBotScore);
-    const timestampUndefined = timestamp === void 0 || Number.isNaN(timestamp);
-    const undefinedCount = Number(baseBotScoreUndefined) + Number(timestampUndefined);
-    if (undefinedCount > 0) {
-      this.logger.error(() => ({
-        msg: "Error decrypting score: baseBotScore or timestamp is undefined"
-      }));
-      baseBotScore = 1;
-      timestamp = 0;
-      decryptedHeadHash = "";
-      decryptionFailed = true;
-    }
-    this.logger.info(() => ({
-      msg: "decryptPayload result",
-      data: {
-        baseBotScore,
-        timestamp,
-        userId,
-        userAgent,
-        webView,
-        iFrame,
-        decryptedHeadHash,
-        decryptionFailed,
-        shadowDomPenalty
-      }
-    }));
-    return {
-      baseBotScore: Number(baseBotScore),
-      timestamp: Number(timestamp),
-      userId,
-      userAgent,
-      webView: webView || false,
-      iFrame: iFrame || false,
-      decryptedHeadHash,
-      decryptionFailed,
-      triggeredDetectors,
-      shadowDomPenalty,
-      entropyMathRandomFingerprint,
-      entropyCryptoFingerprint,
-      entropyWallClockOffsetMs,
-      entropyMathRandomFirst
-    };
-  }
-  async getClientContextEntropy(siteKey, contextType) {
-    return this.db.getClientContextEntropy(siteKey, contextType);
-  }
-}
-export {
-  FrictionlessManager,
-  FrictionlessReason
+var FrictionlessManager = class extends CaptchaManager {
+	constructor(db, pair, config, logger, writeQueue, decisionMachineRunner, usageCounters) {
+		super(db, pair, config, logger, writeQueue);
+		this.config = config;
+		this.decisionMachineRunner = decisionMachineRunner ?? new DecisionMachineRunner(db);
+		this.usageCounters = usageCounters ?? null;
+	}
+	/**
+	* Provide the routing-machine context for this request. When set, the
+	* frictionless flow's send*Captcha calls will (a) invoke the routing
+	* machine to potentially override the baseline captcha type, and (b) emit
+	* fire-and-forget served-counter writes after the session is created.
+	*
+	* Not called on maintenance-mode or configured-captchaType short-circuit
+	* paths — those skip routing entirely.
+	*/
+	setRoutingContext(ctx) {
+		this.routingContext = ctx;
+	}
+	/**
+	* Evaluate the configured routing machine against an arbitrary baseline +
+	* context, without going through `sendCaptcha`. Used by the dedup
+	* short-circuit to ask "if we reused this cached session, would the
+	* current routing machine still pick the same captchaType?" — if not,
+	* the cached session is evicted and the request falls through into the
+	* normal decision-machine flow (which will run the router again with
+	* fully-derived inputs).
+	*
+	* Returns the supplied baseline on any failure (no machine, machine
+	* throws, counter fetch failure, etc.), matching applyRouter's contract.
+	*/
+	async applyRoutingMachine(baseline, ctx) {
+		return applyRouter(this.decisionMachineRunner, this.usageCounters, baseline, ctx, this.logger);
+	}
+	setSessionParams(params) {
+		this.sessionParams = {
+			token: params.token,
+			score: params.score,
+			threshold: params.threshold,
+			scoreComponents: params.scoreComponents,
+			ipAddress: params.ipAddress,
+			webView: params.webView ?? false,
+			iFrame: params.iFrame ?? false,
+			decryptedHeadHash: params.decryptedHeadHash,
+			siteKey: params.siteKey,
+			currentUrl: params.currentUrl,
+			iframeUrl: params.iframeUrl,
+			isProtect: params.isProtect,
+			ipInfo: params.ipInfo,
+			headers: params.headers,
+			mode: params.mode,
+			simdReadings: params.simdReadings,
+			entropyMathRandomFingerprint: params.entropyMathRandomFingerprint,
+			entropyCryptoFingerprint: params.entropyCryptoFingerprint,
+			entropyWallClockOffsetMs: params.entropyWallClockOffsetMs,
+			entropyMathRandomFirst: params.entropyMathRandomFirst,
+			tcpToChelloUs: params.tcpToChelloUs,
+			chelloToHandshakeUs: params.chelloToHandshakeUs
+		};
+	}
+	updateScore(score, scoreComponents) {
+		if (this.sessionParams) {
+			this.sessionParams.score = score;
+			this.sessionParams.scoreComponents = scoreComponents;
+		}
+	}
+	checkLangRules(acceptLanguage) {
+		return checkLangRules(this.config, acceptLanguage);
+	}
+	async createSession(token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, currentUrl, tcpToChelloUs, chelloToHandshakeUs, isEscalation, iframeUrl, isProtect) {
+		const sessionRecord = {
+			sessionId: `${getSessionIDPrefix(this.config.host)}-${v4()}`,
+			createdAt: /* @__PURE__ */ new Date(),
+			token,
+			score,
+			threshold,
+			scoreComponents,
+			ipAddress,
+			captchaType,
+			mode,
+			solvedImagesCount,
+			powDifficulty,
+			userSitekeyIpHash,
+			webView,
+			iFrame,
+			...isEscalation && { isEscalation: true },
+			decryptedHeadHash,
+			reason,
+			siteKey,
+			currentUrl,
+			iframeUrl,
+			...isProtect && { isProtect: true },
+			blocked,
+			deleted,
+			ipInfo,
+			headers,
+			simdReadings,
+			...simdReadings && { simdReadingsStage: SimdReadingsStage.frictionless },
+			entropyMathRandomFingerprint,
+			entropyCryptoFingerprint,
+			entropyWallClockOffsetMs,
+			entropyMathRandomFirst,
+			tcpToChelloUs,
+			chelloToHandshakeUs
+		};
+		await this.db.storeSessionRecord(sessionRecord);
+		if (this.writeQueue) {
+			const cacheData = sessionRecord;
+			const cachePromises = [this.writeQueue.cacheSession(sessionRecord.sessionId, cacheData)];
+			if (userSitekeyIpHash) cachePromises.push(this.writeQueue.cacheSessionByHash(userSitekeyIpHash, sessionRecord.sessionId));
+			await Promise.all(cachePromises).catch(() => {});
+		}
+		return sessionRecord;
+	}
+	async sendImageCaptcha(params) {
+		return this.sendCaptcha(CaptchaType.image, params);
+	}
+	async sendPowCaptcha(params) {
+		return this.sendCaptcha(CaptchaType.pow, params);
+	}
+	async sendPuzzleCaptcha(params) {
+		return this.sendCaptcha(CaptchaType.puzzle, params);
+	}
+	async sendCaptcha(captchaType, params) {
+		const effectiveParams = {
+			...this.sessionParams,
+			...params
+		};
+		if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || !effectiveParams.ipAddress || effectiveParams.siteKey === void 0) throw new Error(`Session parameters must be set before sending a ${captchaType} captcha`);
+		const baseline = {
+			captchaType,
+			solvedImagesCount: captchaType === CaptchaType.image ? effectiveParams.solvedImagesCount : void 0,
+			powDifficulty: captchaType === CaptchaType.pow ? effectiveParams.powDifficulty : void 0
+		};
+		const routed = this.routingContext ? await applyRouter(this.decisionMachineRunner, this.usageCounters, baseline, this.routingContext, this.logger) : baseline;
+		const finalCaptchaType = routed.captchaType;
+		const finalSolvedImagesCount = finalCaptchaType === CaptchaType.image ? routed.solvedImagesCount ?? effectiveParams.solvedImagesCount : void 0;
+		const finalPowDifficulty = finalCaptchaType === CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
+		const blocked = finalCaptchaType === CaptchaType.image ? effectiveParams.blocked : void 0;
+		const sessionRecord = await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, finalCaptchaType, effectiveParams.siteKey, finalSolvedImagesCount, finalPowDifficulty, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, effectiveParams.reason, blocked, void 0, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect);
+		if (this.routingContext && this.usageCounters) this.usageCounters.incrManyAsync(this.routingContext.dappAccount, buildAllWindowIncrements("served", finalCaptchaType, this.routingContext.ip, this.routingContext.userAccount));
+		return {
+			[ApiParams.captchaType]: finalCaptchaType,
+			[ApiParams.sessionId]: sessionRecord.sessionId,
+			[ApiParams.status]: "ok",
+			dns_url: buildDnsEventUrl(sessionRecord.sessionId)
+		};
+	}
+	async registerBlockedSession(params) {
+		const effectiveParams = {
+			...this.sessionParams,
+			...params
+		};
+		if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || !effectiveParams.ipAddress || effectiveParams.siteKey === void 0) throw new Error("Session parameters must be set before calling registerBlockedSession");
+		await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, CaptchaType.image, effectiveParams.siteKey, effectiveParams.solvedImagesCount, void 0, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, effectiveParams.reason, true, true, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect);
+	}
+	scoreIncreaseAccessPolicy(accessPolicy, baseBotScore, botScore, scoreComponents) {
+		const accessPolicyPenalty = accessPolicy?.frictionlessScore || this.config.penalties.PENALTY_ACCESS_RULE;
+		botScore += accessPolicyPenalty;
+		return {
+			score: botScore,
+			scoreComponents: {
+				...scoreComponents,
+				accessPolicy: accessPolicyPenalty
+			}
+		};
+	}
+	scoreIncreaseWebView(baseBotScore, botScore, scoreComponents) {
+		this.logger.debug(() => ({ msg: "WebView detected" }));
+		botScore += this.config.penalties.PENALTY_WEBVIEW;
+		return {
+			score: botScore,
+			scoreComponents: {
+				...scoreComponents,
+				webView: this.config.penalties.PENALTY_WEBVIEW
+			}
+		};
+	}
+	scoreIncreaseTimestamp(timestamp, baseBotScore, botScore, scoreComponents) {
+		this.logger.info(() => ({
+			msg: "Timestamp is older than 10 minutes",
+			data: { timestamp: new Date(timestamp) }
+		}));
+		botScore += this.config.penalties.PENALTY_OLD_TIMESTAMP;
+		return {
+			score: botScore,
+			scoreComponents: {
+				...scoreComponents,
+				timeout: this.config.penalties.PENALTY_OLD_TIMESTAMP
+			}
+		};
+	}
+	static timestampTooOld(timestamp) {
+		return Date.now() - timestamp > DEFAULT_MAX_TIMESTAMP_AGE;
+	}
+	/**
+	* Redacts a key for logging purposes by showing only the first 5, middle 10, and last 5 characters
+	* @param key - The key to redact
+	* @returns Redacted key string or empty string if key is falsy
+	*/
+	redactKeyForLogging(key) {
+		if (!key) return "";
+		return `${key.slice(0, 5)}...${key.slice(Math.floor(key.length / 2) - 5, Math.floor(key.length / 2) + 5)}...${key.slice(-5)}`;
+	}
+	async decryptPayload(token, headHash) {
+		const decryptKeys = [...await this.getDetectorKeys(), process.env.BOT_DECRYPTION_KEY].filter((k) => k);
+		this.logger.debug(() => {
+			const loggedKeys = decryptKeys.map((key) => this.redactKeyForLogging(key));
+			return {
+				msg: "Decrypting score",
+				data: {
+					keysLength: decryptKeys.length,
+					keys: loggedKeys
+				}
+			};
+		});
+		let baseBotScore;
+		let timestamp;
+		let userId;
+		let userAgent;
+		let webView;
+		let iFrame;
+		let decryptedHeadHash = "";
+		let decryptionFailed = false;
+		let triggeredDetectors;
+		let shadowDomPenalty;
+		let entropyMathRandomFingerprint;
+		let entropyCryptoFingerprint;
+		let entropyWallClockOffsetMs;
+		let entropyMathRandomFirst;
+		for (const [keyIndex, key] of decryptKeys.entries()) try {
+			this.logger.info(() => ({
+				msg: "Attempting to decrypt score",
+				data: { key: this.redactKeyForLogging(key) }
+			}));
+			const decrypted = await getBotScore(token, headHash, key);
+			decryptedHeadHash = decrypted.decryptedHeadHash || "";
+			const s = decrypted.baseBotScore;
+			const t = decrypted.timestamp;
+			const a = decrypted.userId;
+			const u = decrypted.userAgent;
+			const w = decrypted.isWebView;
+			const i = decrypted.isIframe;
+			const td = decrypted.triggeredDetectors;
+			const sd = decrypted.shadowDomPenalty;
+			const ef = decrypted.entropyMathRandomFingerprint;
+			const ec = decrypted.entropyCryptoFingerprint;
+			const eo = decrypted.entropyWallClockOffsetMs;
+			const em = decrypted.entropyMathRandomFirst;
+			this.logger.debug(() => ({
+				msg: "Successfully decrypted score",
+				data: {
+					key: this.redactKeyForLogging(key),
+					baseBotScore: s,
+					timestamp: t,
+					userId: a,
+					userAgent: u,
+					webView: w,
+					iFrame: i,
+					triggeredDetectors: td,
+					shadowDomPenalty: sd,
+					entropyMathRandomFingerprint: ef,
+					entropyCryptoFingerprint: ec,
+					entropyWallClockOffsetMs: eo,
+					entropyMathRandomFirst: em
+				}
+			}));
+			baseBotScore = s;
+			timestamp = t;
+			userId = a;
+			userAgent = u;
+			webView = w;
+			iFrame = i;
+			triggeredDetectors = td;
+			shadowDomPenalty = sd;
+			entropyMathRandomFingerprint = ef;
+			entropyCryptoFingerprint = ec;
+			entropyWallClockOffsetMs = eo;
+			entropyMathRandomFirst = em;
+			break;
+		} catch (err) {
+			if (keyIndex === decryptKeys.length - 1) {
+				this.logger.warn(() => ({ msg: "Error decrypting score: no more keys to try" }));
+				baseBotScore = 1;
+				timestamp = 0;
+				decryptedHeadHash = "";
+				decryptionFailed = true;
+			}
+		}
+		const baseBotScoreUndefined = baseBotScore === void 0 || Number.isNaN(baseBotScore);
+		const timestampUndefined = timestamp === void 0 || Number.isNaN(timestamp);
+		if (Number(baseBotScoreUndefined) + Number(timestampUndefined) > 0) {
+			this.logger.error(() => ({ msg: "Error decrypting score: baseBotScore or timestamp is undefined" }));
+			baseBotScore = 1;
+			timestamp = 0;
+			decryptedHeadHash = "";
+			decryptionFailed = true;
+		}
+		this.logger.info(() => ({
+			msg: "decryptPayload result",
+			data: {
+				baseBotScore,
+				timestamp,
+				userId,
+				userAgent,
+				webView,
+				iFrame,
+				decryptedHeadHash,
+				decryptionFailed,
+				shadowDomPenalty
+			}
+		}));
+		return {
+			baseBotScore: Number(baseBotScore),
+			timestamp: Number(timestamp),
+			userId,
+			userAgent,
+			webView: webView || false,
+			iFrame: iFrame || false,
+			decryptedHeadHash,
+			decryptionFailed,
+			triggeredDetectors,
+			shadowDomPenalty,
+			entropyMathRandomFingerprint,
+			entropyCryptoFingerprint,
+			entropyWallClockOffsetMs,
+			entropyMathRandomFirst
+		};
+	}
+	async getClientContextEntropy(siteKey, contextType) {
+		return this.db.getClientContextEntropy(siteKey, contextType);
+	}
 };
+//#endregion
+export { FrictionlessManager, FrictionlessReason$1 as FrictionlessReason };