@prosopo/provider 4.15.14 → 4.15.16

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -1,807 +1,556 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const util$1 = require("@polkadot/util");
-const common = require("@prosopo/common");
-const datasets = require("@prosopo/datasets");
-const types = require("@prosopo/types");
-const util$2 = require("@prosopo/util");
-const utilCrypto = require("@prosopo/util-crypto");
-const compositeIpAddress = require("../../compositeIpAddress.cjs");
-const pairs = require("../../pairs.cjs");
-const lang = require("../../rules/lang.cjs");
-const util = require("../../util.cjs");
-const usageCounters = require("../../util/usageCounters.cjs");
-const captchaManager = require("../captchaManager.cjs");
-const decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
-const enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
-require("../frictionless/frictionlessTasks.cjs");
-const frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
-const evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
-const imgCaptchaTasksUtils = require("./imgCaptchaTasksUtils.cjs");
-class ImgCaptchaManager extends captchaManager.CaptchaManager {
-  constructor(db, pair, config, logger, writeQueue, usageCounters2) {
-    super(db, pair, config, logger, writeQueue);
-    this.config = config;
-    this.decisionMachineRunner = new decisionMachineRunner.DecisionMachineRunner(db);
-    this.usageCounters = usageCounters2 ?? null;
-  }
-  async getCaptchaWithProof(datasetId, solved, size) {
-    const captchaDocs = await this.db.getRandomCaptcha(solved, datasetId, size);
-    if (!captchaDocs) {
-      throw new common.ProsopoEnvError("DATABASE.CAPTCHA_GET_FAILED", {
-        context: {
-          failedFuncName: this.getCaptchaWithProof.name,
-          datasetId,
-          solved,
-          size
-        }
-      });
-    }
-    return captchaDocs;
-  }
-  async getRandomCaptchasAndRequestHash(datasetId, userAccount, ipAddress, captchaConfig, threshold, sessionId, ipInfo) {
-    const dataset = await this.db.getDatasetDetails(datasetId);
-    if (!dataset) {
-      throw new common.ProsopoEnvError("DATABASE.DATASET_GET_FAILED", {
-        context: {
-          failedFuncName: this.getRandomCaptchasAndRequestHash.name,
-          dataset,
-          datasetId
-        }
-      });
-    }
-    const unsolvedCount = Math.abs(
-      Math.trunc(captchaConfig.unsolved.count)
-    );
-    const solvedCount = Math.abs(
-      Math.trunc(captchaConfig.solved.count)
-    );
-    if (!solvedCount) {
-      throw new common.ProsopoEnvError("CONFIG.INVALID_CAPTCHA_NUMBER");
-    }
-    const solved = await this.getCaptchaWithProof(datasetId, true, solvedCount);
-    let unsolved = [];
-    if (unsolvedCount) {
-      unsolved = await this.getCaptchaWithProof(
-        datasetId,
-        false,
-        unsolvedCount
-      );
-    }
-    const captchas = util.shuffleArray([...solved, ...unsolved]);
-    const salt = utilCrypto.randomAsHex();
-    const requestHash = datasets.computePendingRequestHash(
-      captchas.map((c) => c.captchaId),
-      userAccount,
-      salt
-    );
-    const currentTime = Date.now();
-    const signedRequestHash = util$1.u8aToHex(
-      this.pair.sign(util$1.stringToHex(requestHash))
-    );
-    const timeLimit = captchas.map((captcha) => captcha.timeLimitMs || types.DEFAULT_IMAGE_CAPTCHA_TIMEOUT).reduce((a, b) => a + b, 0);
-    const deadlineDate = new Date(timeLimit + currentTime);
-    await this.db.storePendingImageCommitment(
-      userAccount,
-      requestHash,
-      salt,
-      deadlineDate,
-      new Date(currentTime),
-      compositeIpAddress.getCompositeIpAddress(ipAddress),
-      threshold,
-      sessionId,
-      ipInfo
-    );
-    return {
-      captchas,
-      requestHash,
-      timestamp: currentTime,
-      signedRequestHash
-    };
-  }
-  /**
-   * Validate and store the text captcha solution(s) from the Dapp User in a web2 environment
-   * @param {string} userAccount
-   * @param {string} dappAccount
-   * @param {string} requestHash
-   * @param {JSON} captchas
-   * @param userTimestampSignature
-   * @param timestamp
-   * @param providerRequestHashSignature
-   * @param ipAddress
-   * @param headers
-   * @param ja4
-   * @param behavioralData
-   * @return {Promise<DappUserSolutionResult>} result containing the contract event
-   */
-  async dappUserSolution(userAccount, dappAccount, requestHash, captchas, userTimestampSignature, timestamp, providerRequestHashSignature, ipAddress, headers, ja4, behavioralData, ipInfo, simdReadings, clientMetaData) {
-    const decodedSimdReadings = simdReadings ? await this.decryptSimdReadingsForAttach(simdReadings) : void 0;
-    const pushSimdAttachIfAny = (sessionId, writes) => {
-      if (decodedSimdReadings) {
-        writes.push(
-          this.recordSessionSimdReadingsIfAbsentWithCache(
-            sessionId,
-            decodedSimdReadings,
-            types.SimdReadingsStage.submit
-          )
-        );
-      }
-    };
-    const verification = utilCrypto.signatureVerify(
-      util$1.stringToHex(timestamp.toString()),
-      userTimestampSignature,
-      userAccount
-    );
-    if (!verification.isValid) {
-      const err = new common.ProsopoEnvError("GENERAL.INVALID_SIGNATURE", {
-        context: { failedFuncName: this.dappUserSolution.name, userAccount }
-      });
-      this.logger.info(() => ({
-        err,
-        msg: "Invalid user timestamp signature"
-      }));
-      throw err;
-    }
-    const providerRequestHashSignatureVerify = utilCrypto.signatureVerify(
-      util$1.stringToHex(requestHash.toString()),
-      providerRequestHashSignature,
-      this.pair.address
-    );
-    if (!providerRequestHashSignatureVerify.isValid) {
-      const err = new common.ProsopoEnvError("GENERAL.INVALID_SIGNATURE", {
-        context: {
-          failedFuncName: this.dappUserSolution.name,
-          userAccount,
-          error: "requestHash signature is invalid"
-        }
-      });
-      this.logger.info(() => ({
-        err,
-        msg: "Invalid provider requestHash signature"
-      }));
-      throw err;
-    }
-    let response = {
-      captchas: [],
-      verified: false
-    };
-    const pendingRecord = await this.db.getPendingImageCommitment(requestHash);
-    const unverifiedCaptchaIds = captchas.map((captcha) => captcha.captchaId);
-    const pendingRequest = await this.validateDappUserSolutionRequestIsPending(
-      requestHash,
-      pendingRecord,
-      userAccount,
-      unverifiedCaptchaIds
-    );
-    if (pendingRequest) {
-      const { storedCaptchas, receivedCaptchas, captchaIds } = await this.validateReceivedCaptchasAgainstStoredCaptchas(captchas);
-      const rawFlat = receivedCaptchas.map((c) => util$2.extractData(c.salt));
-      const { checkbox: checkboxCoordPair, flat } = pairs.peelCheckboxPrefix(
-        rawFlat,
-        receivedCaptchas.map((c) => c.solution.length)
-      );
-      const shapePairs = flat.map((list) => pairs.constructPairList(list));
-      const pairs$1 = checkboxCoordPair ? [[checkboxCoordPair], ...shapePairs] : shapePairs;
-      const { tree, commitmentId } = imgCaptchaTasksUtils.buildTreeAndGetCommitmentId(receivedCaptchas);
-      const datasetId = util$2.at(storedCaptchas, 0).datasetId;
-      if (!datasetId) {
-        throw new common.ProsopoEnvError("CAPTCHA.ID_MISMATCH", {
-          context: { failedFuncName: this.dappUserSolution.name }
-        });
-      }
-      await this.db.updatePendingImageCommitmentStatus(requestHash);
-      let behavioralDataPacked;
-      let deviceCapability;
-      if (behavioralData) {
-        try {
-          const decryptKeys = [
-            // Process DB keys first, then env var key last as env key will likely be invalid
-            ...await this.getDetectorKeys(),
-            process.env.BOT_DECRYPTION_KEY
-          ];
-          const decryptedData = await this.decryptBehavioralData(
-            behavioralData,
-            decryptKeys
-          );
-          if (decryptedData) {
-            this.logger?.info(() => ({
-              msg: "Behavioral analysis completed",
-              data: {
-                userAccount,
-                dappAccount,
-                requestHash,
-                mouseEventsCount: decryptedData.collector1?.length || 0,
-                touchEventsCount: decryptedData.collector2?.length || 0,
-                clickEventsCount: decryptedData.collector3?.length || 0,
-                deviceCapability: decryptedData.deviceCapability
-              }
-            }));
-            behavioralDataPacked = {
-              c1: decryptedData.collector1 || [],
-              c2: decryptedData.collector2 || [],
-              c3: decryptedData.collector3 || [],
-              d: decryptedData.deviceCapability
-            };
-            deviceCapability = decryptedData.deviceCapability;
-          }
-        } catch (error) {
-          this.logger?.error(() => ({
-            msg: "Failed to process behavioral data",
-            err: error
-          }));
-        }
-      }
-      const commit = {
-        id: commitmentId,
-        userAccount,
-        dappAccount,
-        providerAccount: this.pair.address,
-        datasetId,
-        result: { status: types.CaptchaStatus.pending },
-        userSignature: userTimestampSignature,
-        userSubmitted: true,
-        serverChecked: false,
-        requestedAtTimestamp: new Date(timestamp),
-        submittedAtTimestamp: /* @__PURE__ */ new Date(),
-        ipAddress: compositeIpAddress.getCompositeIpAddress(ipAddress),
-        headers,
-        sessionId: pendingRecord.sessionId,
-        ja4,
-        ipInfo,
-        pending: false,
-        salt: pendingRecord.salt,
-        requestHash: pendingRecord[types.ApiParams.requestHash],
-        threshold: pendingRecord.threshold,
-        deadlineTimestamp: pendingRecord.deadlineTimestamp,
-        ...behavioralDataPacked && { behavioralDataPacked },
-        ...deviceCapability && { deviceCapability },
-        ...clientMetaData?.hp && {
-          clientMetaData: { hp: clientMetaData.hp }
-        }
-      };
-      await this.db.storeUserImageCaptchaSolution(receivedCaptchas, commit);
-      const solutionRecords = await Promise.all(
-        storedCaptchas.map(async (captcha) => {
-          const solutionRecord = await this.db.getSolutionByCaptchaId(
-            captcha.captchaId
-          );
-          if (!solutionRecord) {
-            throw new common.ProsopoEnvError("CAPTCHA.SOLUTION_NOT_FOUND", {
-              context: { failedFuncName: this.dappUserSolution.name }
-            });
-          }
-          return solutionRecord;
-        })
-      );
-      const totalImages = storedCaptchas[0]?.items.length || 0;
-      if (pairs.containsIdenticalPairs(pairs$1) && process.env.NODE_ENV !== "test") {
-        const writePromises = [
-          this.db.disapproveDappUserCommitment(
-            commitmentId,
-            "CAPTCHA.INVALID_SOLUTION",
-            pairs$1
-          )
-        ];
-        if (pendingRecord.sessionId) {
-          writePromises.push(
-            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
-              userSubmitted: true,
-              result: {
-                status: types.CaptchaStatus.disapproved,
-                reason: types.ResultReason.CAPTCHA_INVALID_SOLUTION
-              }
-            })
-          );
-          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
-        }
-        await Promise.all(writePromises);
-        response = {
-          captchas: captchaIds.map((id) => ({
-            captchaId: id,
-            proof: [[]]
-          })),
-          verified: false
-        };
-        return response;
-      }
-      if (datasets.compareCaptchaSolutions(
-        receivedCaptchas,
-        solutionRecords,
-        totalImages,
-        pendingRecord.threshold
-      )) {
-        response = {
-          captchas: captchaIds.map((id) => ({
-            captchaId: id,
-            proof: tree.proof(id)
-          })),
-          verified: true
-        };
-        const writePromises = [
-          this.db.approveDappUserCommitment(commitmentId, pairs$1)
-        ];
-        if (pendingRecord.sessionId) {
-          writePromises.push(
-            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
-              userSubmitted: true,
-              result: { status: types.CaptchaStatus.approved }
-            })
-          );
-          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
-        }
-        await Promise.all(writePromises);
-      } else {
-        const writePromises = [
-          this.db.disapproveDappUserCommitment(
-            commitmentId,
-            "CAPTCHA.INVALID_SOLUTION",
-            pairs$1
-          )
-        ];
-        if (pendingRecord.sessionId) {
-          writePromises.push(
-            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
-              userSubmitted: true,
-              result: {
-                status: types.CaptchaStatus.disapproved,
-                reason: types.ResultReason.CAPTCHA_INVALID_SOLUTION
-              }
-            })
-          );
-          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
-        }
-        await Promise.all(writePromises);
-        response = {
-          captchas: captchaIds.map((id) => ({
-            captchaId: id,
-            proof: [[]]
-          })),
-          verified: false
-        };
-      }
-    } else {
-      this.logger.info(() => ({
-        msg: "Request hash not found"
-      }));
-    }
-    return response;
-  }
-  /**
-   * Validate length of received captchas array matches length of captchas found in database
-   * Validate that the datasetId is the same for all captchas and is equal to the datasetId on the stored captchas
-   */
-  async validateReceivedCaptchasAgainstStoredCaptchas(captchas) {
-    const receivedCaptchas = datasets.parseAndSortCaptchaSolutions(captchas);
-    const captchaIds = receivedCaptchas.map((captcha) => captcha.captchaId);
-    const storedCaptchas = await this.db.getCaptchaById(captchaIds);
-    if (!storedCaptchas || receivedCaptchas.length !== storedCaptchas.length) {
-      throw new common.ProsopoEnvError("CAPTCHA.INVALID_CAPTCHA_ID", {
-        context: {
-          failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
-          captchas
-        }
-      });
-    }
-    if (!storedCaptchas.every(
-      (captcha) => captcha.datasetId === util$2.at(storedCaptchas, 0).datasetId
-    )) {
-      throw new common.ProsopoEnvError("CAPTCHA.DIFFERENT_DATASET_IDS", {
-        context: {
-          failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
-          captchas
-        }
-      });
-    }
-    return { storedCaptchas, receivedCaptchas, captchaIds };
-  }
-  /**
-   * Validate that a Dapp User is responding to their own pending captcha request
-   * @param {string} requestHash
-   * @param {PendingImageCaptchaRequest} pendingRecord
-   * @param {string} userAccount
-   * @param {string[]} captchaIds
-   */
-  async validateDappUserSolutionRequestIsPending(requestHash, pendingRecord, userAccount, captchaIds) {
-    const currentTime = /* @__PURE__ */ new Date();
-    if (!pendingRecord) {
-      this.logger.info(() => ({
-        msg: "No pending record found"
-      }));
-      return false;
-    }
-    if (pendingRecord.deadlineTimestamp < currentTime) {
-      this.logger.info(() => ({
-        msg: "Deadline for responding to captcha has expired"
-      }));
-      return false;
-    }
-    if (pendingRecord) {
-      const pendingHashComputed = datasets.computePendingRequestHash(
-        captchaIds,
-        userAccount,
-        pendingRecord.salt
-      );
-      return requestHash === pendingHashComputed;
-    }
-    return false;
-  }
-  /*
-   * Get dapp user solution from database
-   */
-  async getDappUserCommitmentById(commitmentId) {
-    const dappUserSolution = await this.db.getDappUserCommitmentById(commitmentId);
-    if (!dappUserSolution) {
-      throw new common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", {
-        context: {
-          failedFuncName: this.getDappUserCommitmentById.name,
-          commitmentId
-        }
-      });
-    }
-    return dappUserSolution;
-  }
-  /* Check if dapp user has verified solution in cache */
-  async getDappUserCommitmentByAccount(userAccount, dappAccount) {
-    const dappUserSolutions = await this.db.getDappUserCommitmentByAccount(
-      userAccount,
-      dappAccount
-    );
-    if (dappUserSolutions.length > 0) {
-      for (const dappUserSolution of dappUserSolutions) {
-        if (dappUserSolution.result.status === types.CaptchaStatus.approved) {
-          return dappUserSolution;
-        }
-      }
-    }
-    return void 0;
-  }
-  async verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, disallowWebView, contextAwareEnabled = false, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false) {
-    const logger = this.logger.with({ commitmentId, dapp });
-    const solution = await (commitmentId ? this.getDappUserCommitmentById(commitmentId) : this.getDappUserCommitmentByAccount(user, dapp));
-    if (!solution) {
-      logger.debug(() => ({
-        msg: "Not verified - no solution found"
-      }));
-      return {
-        status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
-        verified: false
-      };
-    }
-    if (solution.serverChecked) {
-      return {
-        status: "API.USER_ALREADY_VERIFIED",
-        verified: false
-      };
-    }
-    await this.db.markDappUserCommitmentsChecked([solution.id]);
-    if (solution.result.status === types.CaptchaStatus.disapproved) {
-      return {
-        status: solution.result.reason || "API.USER_NOT_VERIFIED",
-        verified: false
-      };
-    }
-    maxVerifiedTime = maxVerifiedTime || 60 * 1e3;
-    const currentTime = Date.now();
-    const submittedAt = solution.submittedAtTimestamp;
-    const timeSinceCompletion = submittedAt instanceof Date ? currentTime - submittedAt.getTime() : Number.POSITIVE_INFINITY;
-    if (timeSinceCompletion > maxVerifiedTime) {
-      logger.debug(() => ({
-        msg: "Not verified - timed out"
-      }));
-      return {
-        status: "API.USER_NOT_VERIFIED_TIME_EXPIRED",
-        verified: false
-      };
-    }
-    const commitmentUpdates = {};
-    let failStatus;
-    if (userAccessRulesStorage) {
-      try {
-        const blockPolicy = await this.checkForHardBlock(
-          userAccessRulesStorage,
-          solution,
-          solution.userAccount,
-          solution.headers,
-          solution.coords,
-          solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0,
-          solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0
-        );
-        if (blockPolicy) {
-          logger.info(() => ({
-            msg: "User blocked by access policy in server image verification",
-            data: {
-              userAccount: solution.userAccount,
-              dappAccount: solution.dappAccount,
-              policy: blockPolicy
-            }
-          }));
-          commitmentUpdates.result = {
-            status: types.CaptchaStatus.disapproved,
-            reason: types.ResultReason.ACCESS_POLICY_BLOCK
-          };
-          failStatus = types.ResultReason.ACCESS_POLICY_BLOCK;
-        }
-      } catch (error) {
-        logger.warn(() => ({
-          msg: "Failed to check user access policies in server image verification",
-          error
-        }));
-      }
-    }
-    if (!failStatus && email && spamEmailDomainCheckingEnabled) {
-      try {
-        const isSpam = await this.checkSpamEmail(email);
-        if (isSpam) {
-          const emailDomain = email.split("@")[1] || "unknown";
-          logger.info(() => ({
-            msg: "Spam email domain detected in server image verification",
-            data: { emailDomain }
-          }));
-          commitmentUpdates.result = {
-            status: types.CaptchaStatus.disapproved,
-            reason: types.ResultReason.SPAM_EMAIL_DOMAIN
-          };
-          failStatus = types.ResultReason.SPAM_EMAIL_DOMAIN;
-        }
-      } catch (error) {
-        logger.warn(() => ({
-          msg: "Failed to check spam email domain in server image verification",
-          error
-        }));
-      }
-    }
-    if (!failStatus && spamFilter?.enabled && spamFilter.emailRules?.enabled && email) {
-      const result = evaluateEmailSpamRules.evaluateEmailSpamRules(email, spamFilter.emailRules);
-      if (result.isSpam) {
-        logger.info(() => ({
-          msg: "Spam filter rejected email in image verification",
-          data: { reason: result.reason }
-        }));
-        commitmentUpdates.result = {
-          status: types.CaptchaStatus.disapproved,
-          reason: types.ResultReason.SPAM_EMAIL_RULE
-        };
-        failStatus = types.ResultReason.SPAM_EMAIL_RULE;
-      }
-    }
-    const sessionRecord = solution.sessionId ? await this.db.getSessionRecordBySessionId(solution.sessionId) : void 0;
-    const enrichedDnsEvent = await enrichDnsEvent.enrichDnsEvent(
-      sessionRecord?.dnsEvent,
-      env.ipInfoService,
-      ip ?? solution.ipInfo?.ip
-    );
-    if (!failStatus) {
-      const check = await this.resolveTrafficFilterCheck(
-        env,
-        solution.ipInfo,
-        trafficFilter,
-        ip,
-        enrichedDnsEvent
-      );
-      if (check.isBlocked) {
-        logger.info(() => ({
-          msg: "Traffic filter rejected request",
-          data: {
-            ip,
-            reason: check.reason,
-            dnsPeerIp: enrichedDnsEvent?.peerIp,
-            dnsResolverIp: enrichedDnsEvent?.resolverIp,
-            dnsPeerAsn: enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
-            dnsResolverAsn: enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo),
-            dnsPathValid: enrichedDnsEvent?.pathValid
-          }
-        }));
-        commitmentUpdates.result = {
-          status: types.CaptchaStatus.disapproved,
-          reason: check.reason
-        };
-        failStatus = check.reason;
-      }
-    }
-    if (storeMetadata && email) {
-      commitmentUpdates.metadata = { email };
-    }
-    if (ip) {
-      const solutionIpAddress = compositeIpAddress.getIpAddressFromComposite(solution.ipAddress);
-      const clientRecord = await this.db.getClientRecord(dapp);
-      const ipValidationRules = clientRecord?.settings?.ipValidationRules;
-      commitmentUpdates.providedIp = compositeIpAddress.getCompositeIpAddress(ip);
-      if (!failStatus && ipValidationRules?.enabled === true) {
-        const ipValidation = await util.deepValidateIpAddress(
-          ip,
-          solutionIpAddress,
-          logger,
-          env.ipInfoService,
-          ipValidationRules,
-          enrichedDnsEvent?.peerIp
-        );
-        if (!ipValidation.isValid) {
-          logger.error(() => ({
-            msg: "IP validation failed for image captcha",
-            data: {
-              ip,
-              solutionIp: solutionIpAddress.address,
-              error: ipValidation.errorMessage,
-              distanceKm: ipValidation.distanceKm
-            }
-          }));
-          failStatus = types.ResultReason.FAILED_IP_VALIDATION;
-        }
-      }
-    }
-    let isApproved = !failStatus && solution.result.status === types.CaptchaStatus.approved;
-    let failureStatus = failStatus || types.ResultReason.USER_NOT_VERIFIED;
-    if (!failStatus && solution.result.status === types.CaptchaStatus.approved && this.usageCounters) {
-      const ipValue = ip ?? "";
-      this.usageCounters.incrManyAsync(
-        solution.dappAccount,
-        usageCounters.buildAllWindowIncrements(
-          "solved",
-          types.CaptchaType.image,
-          ipValue,
-          solution.userAccount,
-          enrichedDnsEvent?.peerIp
-        )
-      );
-    }
-    let score;
-    if (sessionRecord) {
-      const dnsAsymmetry = enrichDnsEvent.computeDnsAsymmetry(
-        enrichedDnsEvent,
-        solution.ipInfo,
-        trafficFilter
-      );
-      if (dnsAsymmetry > 0) {
-        sessionRecord.scoreComponents = {
-          ...sessionRecord.scoreComponents,
-          dnsAsymmetry
-        };
-      }
-      score = frictionlessTasksUtils.computeFrictionlessScore(sessionRecord?.scoreComponents);
-      logger.info(() => ({
-        data: {
-          scoreComponents: sessionRecord?.scoreComponents,
-          score,
-          dnsPeerAsn: enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
-          dnsResolverAsn: enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo)
-        }
-      }));
-      if (!failStatus && disallowWebView === true && (sessionRecord.webView === true || (sessionRecord.scoreComponents.webView || 0) > 0)) {
-        logger.info(() => ({
-          msg: "Disallowing webview access - user not verified"
-        }));
-        commitmentUpdates.result = {
-          status: types.CaptchaStatus.disapproved,
-          reason: types.ResultReason.DISALLOWED_WEBVIEW
-        };
-        failStatus = types.ResultReason.DISALLOWED_WEBVIEW;
-        isApproved = false;
-        failureStatus = types.ResultReason.DISALLOWED_WEBVIEW;
-      }
-      if (contextAwareEnabled && sessionRecord.reason === types.FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED) {
-        logger.info(() => ({
-          msg: "Context aware validation failed"
-        }));
-      }
-    }
-    if (isApproved) {
-      const decisionInput = {
-        userAccount: solution.userAccount,
-        dappAccount: solution.dappAccount,
-        captchaResult: "passed",
-        headers: solution.headers,
-        captchaType: types.CaptchaType.image,
-        behavioralDataPacked: solution.behavioralDataPacked,
-        deviceCapability: solution.deviceCapability,
-        countryCode: solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0,
-        ipInfo: solution.ipInfo,
-        dnsEvent: enrichedDnsEvent,
-        score,
-        threshold: sessionRecord?.threshold,
-        scoreComponents: sessionRecord?.scoreComponents,
-        decryptedHeadHash: sessionRecord?.decryptedHeadHash,
-        userSitekeyIpHash: sessionRecord?.userSitekeyIpHash,
-        simdReadings: sessionRecord?.simdReadings,
-        frictionlessReason: sessionRecord?.reason,
-        ruleType: sessionRecord?.ruleType,
-        webView: sessionRecord?.webView,
-        iFrame: sessionRecord?.iFrame,
-        coords: solution.coords
-      };
-      try {
-        const decision = await this.decisionMachineRunner.decide(
-          decisionInput,
-          logger
-        );
-        if (decision.decision === types.DecisionMachineDecision.Deny) {
-          const dmReason = decision.reason || types.ResultReason.CAPTCHA_DECISION_MACHINE_DENIED;
-          logger.info(() => ({
-            msg: "Decision machine denied user verification",
-            data: {
-              reason: decision.reason
-            }
-          }));
-          commitmentUpdates.result = {
-            status: types.CaptchaStatus.disapproved,
-            reason: dmReason
-          };
-          isApproved = false;
-          failureStatus = dmReason;
-        }
-      } catch (error) {
-        logger.error(() => ({
-          msg: "Failed to process decision machine",
-          err: error
-        }));
-      }
-    }
-    const writePromises = [];
-    const sideUpdates = {};
-    if (commitmentUpdates.providedIp) {
-      sideUpdates.providedIp = commitmentUpdates.providedIp;
-    }
-    if (commitmentUpdates.metadata) {
-      sideUpdates.metadata = commitmentUpdates.metadata;
-    }
-    if (Object.keys(sideUpdates).length > 0) {
-      writePromises.push(
-        this.db.updateDappUserCommitment(solution.id, sideUpdates)
-      );
-    }
-    if (commitmentId) {
-      if (isApproved) {
-        writePromises.push(this.db.approveDappUserCommitment(commitmentId));
-      } else if (commitmentUpdates.result) {
-        writePromises.push(
-          this.db.disapproveDappUserCommitment(
-            commitmentId,
-            commitmentUpdates.result.reason
-          )
-        );
-      }
-    }
-    const finalResult = isApproved ? { status: types.CaptchaStatus.approved } : commitmentUpdates.result || {
-      status: types.CaptchaStatus.disapproved,
-      reason: failureStatus
-    };
-    if (solution.sessionId) {
-      writePromises.push(
-        this.updateSessionRecordWithCache(
-          solution.sessionId,
-          {
-            serverChecked: true,
-            result: finalResult
-          },
-          true
-        )
-      );
-    }
-    if (writePromises.length > 0) {
-      await Promise.all(writePromises);
-    }
-    return {
-      status: isApproved ? types.ResultReason.USER_VERIFIED : failureStatus,
-      verified: isApproved,
-      commitmentId: solution.id.toString(),
-      ...score && { score }
-    };
-  }
-  checkLangRules(acceptLanguage) {
-    return lang.checkLangRules(this.config, acceptLanguage);
-  }
-  getVerificationResponse(verified, clientRecord, translateFn, score, commitmentId, reason) {
-    return {
-      ...super.getVerificationResponse(
-        verified,
-        clientRecord,
-        translateFn,
-        score,
-        reason
-      ),
-      ...commitmentId && {
-        [types.ApiParams.commitmentId]: commitmentId
-      }
-    };
-  }
-}
+const require_usageCounters = require("../../util/usageCounters.cjs");
+const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_lang = require("../../rules/lang.cjs");
+const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
+const require_captchaManager = require("../captchaManager.cjs");
+const require_pairs = require("../../pairs.cjs");
+const require_util = require("../../util.cjs");
+const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
+const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
+const require_imgCaptchaTasksUtils = require("./imgCaptchaTasksUtils.cjs");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+let _prosopo_util_crypto = require("@prosopo/util-crypto");
+let _prosopo_datasets = require("@prosopo/datasets");
+let _polkadot_util = require("@polkadot/util");
+//#region src/tasks/imgCaptcha/imgCaptchaTasks.ts
+var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
+	constructor(db, pair, config, logger, writeQueue, usageCounters) {
+		super(db, pair, config, logger, writeQueue);
+		this.config = config;
+		this.decisionMachineRunner = new require_decisionMachineRunner.DecisionMachineRunner(db);
+		this.usageCounters = usageCounters ?? null;
+	}
+	async getCaptchaWithProof(datasetId, solved, size) {
+		const captchaDocs = await this.db.getRandomCaptcha(solved, datasetId, size);
+		if (!captchaDocs) throw new _prosopo_common.ProsopoEnvError("DATABASE.CAPTCHA_GET_FAILED", { context: {
+			failedFuncName: this.getCaptchaWithProof.name,
+			datasetId,
+			solved,
+			size
+		} });
+		return captchaDocs;
+	}
+	async getRandomCaptchasAndRequestHash(datasetId, userAccount, ipAddress, captchaConfig, threshold, sessionId, ipInfo) {
+		const dataset = await this.db.getDatasetDetails(datasetId);
+		if (!dataset) throw new _prosopo_common.ProsopoEnvError("DATABASE.DATASET_GET_FAILED", { context: {
+			failedFuncName: this.getRandomCaptchasAndRequestHash.name,
+			dataset,
+			datasetId
+		} });
+		const unsolvedCount = Math.abs(Math.trunc(captchaConfig.unsolved.count));
+		const solvedCount = Math.abs(Math.trunc(captchaConfig.solved.count));
+		if (!solvedCount) throw new _prosopo_common.ProsopoEnvError("CONFIG.INVALID_CAPTCHA_NUMBER");
+		const solved = await this.getCaptchaWithProof(datasetId, true, solvedCount);
+		let unsolved = [];
+		if (unsolvedCount) unsolved = await this.getCaptchaWithProof(datasetId, false, unsolvedCount);
+		const captchas = require_util.shuffleArray([...solved, ...unsolved]);
+		const salt = (0, _prosopo_util_crypto.randomAsHex)();
+		const requestHash = (0, _prosopo_datasets.computePendingRequestHash)(captchas.map((c) => c.captchaId), userAccount, salt);
+		const currentTime = Date.now();
+		const signedRequestHash = (0, _polkadot_util.u8aToHex)(this.pair.sign((0, _polkadot_util.stringToHex)(requestHash)));
+		const timeLimit = captchas.map((captcha) => captcha.timeLimitMs || _prosopo_types.DEFAULT_IMAGE_CAPTCHA_TIMEOUT).reduce((a, b) => a + b, 0);
+		const deadlineDate = new Date(timeLimit + currentTime);
+		await this.db.storePendingImageCommitment(userAccount, requestHash, salt, deadlineDate, new Date(currentTime), require_compositeIpAddress.getCompositeIpAddress(ipAddress), threshold, sessionId, ipInfo);
+		return {
+			captchas,
+			requestHash,
+			timestamp: currentTime,
+			signedRequestHash
+		};
+	}
+	/**
+	* Validate and store the text captcha solution(s) from the Dapp User in a web2 environment
+	* @param {string} userAccount
+	* @param {string} dappAccount
+	* @param {string} requestHash
+	* @param {JSON} captchas
+	* @param userTimestampSignature
+	* @param timestamp
+	* @param providerRequestHashSignature
+	* @param ipAddress
+	* @param headers
+	* @param ja4
+	* @param behavioralData
+	* @return {Promise<DappUserSolutionResult>} result containing the contract event
+	*/
+	async dappUserSolution(userAccount, dappAccount, requestHash, captchas, userTimestampSignature, timestamp, providerRequestHashSignature, ipAddress, headers, ja4, behavioralData, ipInfo, simdReadings, clientMetaData) {
+		const decodedSimdReadings = simdReadings ? await this.decryptSimdReadingsForAttach(simdReadings) : void 0;
+		const pushSimdAttachIfAny = (sessionId, writes) => {
+			if (decodedSimdReadings) writes.push(this.recordSessionSimdReadingsIfAbsentWithCache(sessionId, decodedSimdReadings, _prosopo_types.SimdReadingsStage.submit));
+		};
+		if (!(0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(timestamp.toString()), userTimestampSignature, userAccount).isValid) {
+			const err = new _prosopo_common.ProsopoEnvError("GENERAL.INVALID_SIGNATURE", { context: {
+				failedFuncName: this.dappUserSolution.name,
+				userAccount
+			} });
+			this.logger.info(() => ({
+				err,
+				msg: "Invalid user timestamp signature"
+			}));
+			throw err;
+		}
+		if (!(0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(requestHash.toString()), providerRequestHashSignature, this.pair.address).isValid) {
+			const err = new _prosopo_common.ProsopoEnvError("GENERAL.INVALID_SIGNATURE", { context: {
+				failedFuncName: this.dappUserSolution.name,
+				userAccount,
+				error: "requestHash signature is invalid"
+			} });
+			this.logger.info(() => ({
+				err,
+				msg: "Invalid provider requestHash signature"
+			}));
+			throw err;
+		}
+		let response = {
+			captchas: [],
+			verified: false
+		};
+		const pendingRecord = await this.db.getPendingImageCommitment(requestHash);
+		const unverifiedCaptchaIds = captchas.map((captcha) => captcha.captchaId);
+		if (await this.validateDappUserSolutionRequestIsPending(requestHash, pendingRecord, userAccount, unverifiedCaptchaIds)) {
+			const { storedCaptchas, receivedCaptchas, captchaIds } = await this.validateReceivedCaptchasAgainstStoredCaptchas(captchas);
+			const rawFlat = receivedCaptchas.map((c) => (0, _prosopo_util.extractData)(c.salt));
+			const { checkbox: checkboxCoordPair, flat } = require_pairs.peelCheckboxPrefix(rawFlat, receivedCaptchas.map((c) => c.solution.length));
+			const shapePairs = flat.map((list) => require_pairs.constructPairList(list));
+			const pairs = checkboxCoordPair ? [[checkboxCoordPair], ...shapePairs] : shapePairs;
+			const { tree, commitmentId } = require_imgCaptchaTasksUtils.buildTreeAndGetCommitmentId(receivedCaptchas);
+			const datasetId = (0, _prosopo_util.at)(storedCaptchas, 0).datasetId;
+			if (!datasetId) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.ID_MISMATCH", { context: { failedFuncName: this.dappUserSolution.name } });
+			await this.db.updatePendingImageCommitmentStatus(requestHash);
+			let behavioralDataPacked;
+			let deviceCapability;
+			if (behavioralData) try {
+				const decryptKeys = [...await this.getDetectorKeys(), process.env.BOT_DECRYPTION_KEY];
+				const decryptedData = await this.decryptBehavioralData(behavioralData, decryptKeys);
+				if (decryptedData) {
+					this.logger?.info(() => ({
+						msg: "Behavioral analysis completed",
+						data: {
+							userAccount,
+							dappAccount,
+							requestHash,
+							mouseEventsCount: decryptedData.collector1?.length || 0,
+							touchEventsCount: decryptedData.collector2?.length || 0,
+							clickEventsCount: decryptedData.collector3?.length || 0,
+							deviceCapability: decryptedData.deviceCapability
+						}
+					}));
+					behavioralDataPacked = {
+						c1: decryptedData.collector1 || [],
+						c2: decryptedData.collector2 || [],
+						c3: decryptedData.collector3 || [],
+						d: decryptedData.deviceCapability
+					};
+					deviceCapability = decryptedData.deviceCapability;
+				}
+			} catch (error) {
+				this.logger?.error(() => ({
+					msg: "Failed to process behavioral data",
+					err: error
+				}));
+			}
+			const commit = {
+				id: commitmentId,
+				userAccount,
+				dappAccount,
+				providerAccount: this.pair.address,
+				datasetId,
+				result: { status: _prosopo_types.CaptchaStatus.pending },
+				userSignature: userTimestampSignature,
+				userSubmitted: true,
+				serverChecked: false,
+				requestedAtTimestamp: new Date(timestamp),
+				submittedAtTimestamp: /* @__PURE__ */ new Date(),
+				ipAddress: require_compositeIpAddress.getCompositeIpAddress(ipAddress),
+				headers,
+				sessionId: pendingRecord.sessionId,
+				ja4,
+				ipInfo,
+				pending: false,
+				salt: pendingRecord.salt,
+				requestHash: pendingRecord[_prosopo_types.ApiParams.requestHash],
+				threshold: pendingRecord.threshold,
+				deadlineTimestamp: pendingRecord.deadlineTimestamp,
+				...behavioralDataPacked && { behavioralDataPacked },
+				...deviceCapability && { deviceCapability },
+				...clientMetaData?.hp && { clientMetaData: { hp: clientMetaData.hp } }
+			};
+			await this.db.storeUserImageCaptchaSolution(receivedCaptchas, commit);
+			const solutionRecords = await Promise.all(storedCaptchas.map(async (captcha) => {
+				const solutionRecord = await this.db.getSolutionByCaptchaId(captcha.captchaId);
+				if (!solutionRecord) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.SOLUTION_NOT_FOUND", { context: { failedFuncName: this.dappUserSolution.name } });
+				return solutionRecord;
+			}));
+			const totalImages = storedCaptchas[0]?.items.length || 0;
+			if (require_pairs.containsIdenticalPairs(pairs) && process.env.NODE_ENV !== "test") {
+				const writePromises = [this.db.disapproveDappUserCommitment(commitmentId, "CAPTCHA.INVALID_SOLUTION", pairs)];
+				if (pendingRecord.sessionId) {
+					writePromises.push(this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+						userSubmitted: true,
+						result: {
+							status: _prosopo_types.CaptchaStatus.disapproved,
+							reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_SOLUTION
+						}
+					}));
+					pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+				}
+				await Promise.all(writePromises);
+				response = {
+					captchas: captchaIds.map((id) => ({
+						captchaId: id,
+						proof: [[]]
+					})),
+					verified: false
+				};
+				return response;
+			}
+			if ((0, _prosopo_datasets.compareCaptchaSolutions)(receivedCaptchas, solutionRecords, totalImages, pendingRecord.threshold)) {
+				response = {
+					captchas: captchaIds.map((id) => ({
+						captchaId: id,
+						proof: tree.proof(id)
+					})),
+					verified: true
+				};
+				const writePromises = [this.db.approveDappUserCommitment(commitmentId, pairs)];
+				if (pendingRecord.sessionId) {
+					writePromises.push(this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+						userSubmitted: true,
+						result: { status: _prosopo_types.CaptchaStatus.approved }
+					}));
+					pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+				}
+				await Promise.all(writePromises);
+			} else {
+				const writePromises = [this.db.disapproveDappUserCommitment(commitmentId, "CAPTCHA.INVALID_SOLUTION", pairs)];
+				if (pendingRecord.sessionId) {
+					writePromises.push(this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+						userSubmitted: true,
+						result: {
+							status: _prosopo_types.CaptchaStatus.disapproved,
+							reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_SOLUTION
+						}
+					}));
+					pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+				}
+				await Promise.all(writePromises);
+				response = {
+					captchas: captchaIds.map((id) => ({
+						captchaId: id,
+						proof: [[]]
+					})),
+					verified: false
+				};
+			}
+		} else this.logger.info(() => ({ msg: "Request hash not found" }));
+		return response;
+	}
+	/**
+	* Validate length of received captchas array matches length of captchas found in database
+	* Validate that the datasetId is the same for all captchas and is equal to the datasetId on the stored captchas
+	*/
+	async validateReceivedCaptchasAgainstStoredCaptchas(captchas) {
+		const receivedCaptchas = (0, _prosopo_datasets.parseAndSortCaptchaSolutions)(captchas);
+		const captchaIds = receivedCaptchas.map((captcha) => captcha.captchaId);
+		const storedCaptchas = await this.db.getCaptchaById(captchaIds);
+		if (!storedCaptchas || receivedCaptchas.length !== storedCaptchas.length) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.INVALID_CAPTCHA_ID", { context: {
+			failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
+			captchas
+		} });
+		if (!storedCaptchas.every((captcha) => captcha.datasetId === (0, _prosopo_util.at)(storedCaptchas, 0).datasetId)) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DIFFERENT_DATASET_IDS", { context: {
+			failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
+			captchas
+		} });
+		return {
+			storedCaptchas,
+			receivedCaptchas,
+			captchaIds
+		};
+	}
+	/**
+	* Validate that a Dapp User is responding to their own pending captcha request
+	* @param {string} requestHash
+	* @param {PendingImageCaptchaRequest} pendingRecord
+	* @param {string} userAccount
+	* @param {string[]} captchaIds
+	*/
+	async validateDappUserSolutionRequestIsPending(requestHash, pendingRecord, userAccount, captchaIds) {
+		const currentTime = /* @__PURE__ */ new Date();
+		if (!pendingRecord) {
+			this.logger.info(() => ({ msg: "No pending record found" }));
+			return false;
+		}
+		if (pendingRecord.deadlineTimestamp < currentTime) {
+			this.logger.info(() => ({ msg: "Deadline for responding to captcha has expired" }));
+			return false;
+		}
+		if (pendingRecord) return requestHash === (0, _prosopo_datasets.computePendingRequestHash)(captchaIds, userAccount, pendingRecord.salt);
+		return false;
+	}
+	async getDappUserCommitmentById(commitmentId) {
+		const dappUserSolution = await this.db.getDappUserCommitmentById(commitmentId);
+		if (!dappUserSolution) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
+			failedFuncName: this.getDappUserCommitmentById.name,
+			commitmentId
+		} });
+		return dappUserSolution;
+	}
+	async getDappUserCommitmentByAccount(userAccount, dappAccount) {
+		const dappUserSolutions = await this.db.getDappUserCommitmentByAccount(userAccount, dappAccount);
+		if (dappUserSolutions.length > 0) {
+			for (const dappUserSolution of dappUserSolutions) if (dappUserSolution.result.status === _prosopo_types.CaptchaStatus.approved) return dappUserSolution;
+		}
+	}
+	async verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, disallowWebView, contextAwareEnabled = false, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false) {
+		const logger = this.logger.with({
+			commitmentId,
+			dapp
+		});
+		const solution = await (commitmentId ? this.getDappUserCommitmentById(commitmentId) : this.getDappUserCommitmentByAccount(user, dapp));
+		if (!solution) {
+			logger.debug(() => ({ msg: "Not verified - no solution found" }));
+			return {
+				status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
+				verified: false
+			};
+		}
+		if (solution.serverChecked) return {
+			status: "API.USER_ALREADY_VERIFIED",
+			verified: false
+		};
+		await this.db.markDappUserCommitmentsChecked([solution.id]);
+		if (solution.result.status === _prosopo_types.CaptchaStatus.disapproved) return {
+			status: solution.result.reason || "API.USER_NOT_VERIFIED",
+			verified: false
+		};
+		maxVerifiedTime = maxVerifiedTime || 60 * 1e3;
+		const currentTime = Date.now();
+		const submittedAt = solution.submittedAtTimestamp;
+		if ((submittedAt instanceof Date ? currentTime - submittedAt.getTime() : Number.POSITIVE_INFINITY) > maxVerifiedTime) {
+			logger.debug(() => ({ msg: "Not verified - timed out" }));
+			return {
+				status: "API.USER_NOT_VERIFIED_TIME_EXPIRED",
+				verified: false
+			};
+		}
+		const commitmentUpdates = {};
+		let failStatus;
+		if (userAccessRulesStorage) try {
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, solution, solution.userAccount, solution.headers, solution.coords, solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0, solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0);
+			if (blockPolicy) {
+				logger.info(() => ({
+					msg: "User blocked by access policy in server image verification",
+					data: {
+						userAccount: solution.userAccount,
+						dappAccount: solution.dappAccount,
+						policy: blockPolicy
+					}
+				}));
+				commitmentUpdates.result = {
+					status: _prosopo_types.CaptchaStatus.disapproved,
+					reason: _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK
+				};
+				failStatus = _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: "Failed to check user access policies in server image verification",
+				error
+			}));
+		}
+		if (!failStatus && email && spamEmailDomainCheckingEnabled) try {
+			if (await this.checkSpamEmail(email)) {
+				const emailDomain = email.split("@")[1] || "unknown";
+				logger.info(() => ({
+					msg: "Spam email domain detected in server image verification",
+					data: { emailDomain }
+				}));
+				commitmentUpdates.result = {
+					status: _prosopo_types.CaptchaStatus.disapproved,
+					reason: _prosopo_types.ResultReason.SPAM_EMAIL_DOMAIN
+				};
+				failStatus = _prosopo_types.ResultReason.SPAM_EMAIL_DOMAIN;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: "Failed to check spam email domain in server image verification",
+				error
+			}));
+		}
+		if (!failStatus && spamFilter?.enabled && spamFilter.emailRules?.enabled && email) {
+			const result = require_evaluateEmailSpamRules.evaluateEmailSpamRules(email, spamFilter.emailRules);
+			if (result.isSpam) {
+				logger.info(() => ({
+					msg: "Spam filter rejected email in image verification",
+					data: { reason: result.reason }
+				}));
+				commitmentUpdates.result = {
+					status: _prosopo_types.CaptchaStatus.disapproved,
+					reason: _prosopo_types.ResultReason.SPAM_EMAIL_RULE
+				};
+				failStatus = _prosopo_types.ResultReason.SPAM_EMAIL_RULE;
+			}
+		}
+		const sessionRecord = solution.sessionId ? await this.db.getSessionRecordBySessionId(solution.sessionId) : void 0;
+		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? solution.ipInfo?.ip);
+		if (!failStatus) {
+			const check = await this.resolveTrafficFilterCheck(env, solution.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			if (check.isBlocked) {
+				logger.info(() => ({
+					msg: "Traffic filter rejected request",
+					data: {
+						ip,
+						reason: check.reason,
+						dnsPeerIp: enrichedDnsEvent?.peerIp,
+						dnsResolverIp: enrichedDnsEvent?.resolverIp,
+						dnsPeerAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
+						dnsResolverAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo),
+						dnsPathValid: enrichedDnsEvent?.pathValid
+					}
+				}));
+				commitmentUpdates.result = {
+					status: _prosopo_types.CaptchaStatus.disapproved,
+					reason: check.reason
+				};
+				failStatus = check.reason;
+			}
+		}
+		if (storeMetadata && email) commitmentUpdates.metadata = { email };
+		if (ip) {
+			const solutionIpAddress = require_compositeIpAddress.getIpAddressFromComposite(solution.ipAddress);
+			const ipValidationRules = (await this.db.getClientRecord(dapp))?.settings?.ipValidationRules;
+			commitmentUpdates.providedIp = require_compositeIpAddress.getCompositeIpAddress(ip);
+			if (!failStatus && ipValidationRules?.enabled === true) {
+				const ipValidation = await require_util.deepValidateIpAddress(ip, solutionIpAddress, logger, env.ipInfoService, ipValidationRules, enrichedDnsEvent?.peerIp);
+				if (!ipValidation.isValid) {
+					logger.error(() => ({
+						msg: "IP validation failed for image captcha",
+						data: {
+							ip,
+							solutionIp: solutionIpAddress.address,
+							error: ipValidation.errorMessage,
+							distanceKm: ipValidation.distanceKm
+						}
+					}));
+					failStatus = _prosopo_types.ResultReason.FAILED_IP_VALIDATION;
+				}
+			}
+		}
+		let isApproved = !failStatus && solution.result.status === _prosopo_types.CaptchaStatus.approved;
+		let failureStatus = failStatus || _prosopo_types.ResultReason.USER_NOT_VERIFIED;
+		if (!failStatus && solution.result.status === _prosopo_types.CaptchaStatus.approved && this.usageCounters) {
+			const ipValue = ip ?? "";
+			this.usageCounters.incrManyAsync(solution.dappAccount, require_usageCounters.buildAllWindowIncrements("solved", _prosopo_types.CaptchaType.image, ipValue, solution.userAccount, enrichedDnsEvent?.peerIp));
+		}
+		let score;
+		if (sessionRecord) {
+			const dnsAsymmetry = require_enrichDnsEvent.computeDnsAsymmetry(enrichedDnsEvent, solution.ipInfo, trafficFilter);
+			if (dnsAsymmetry > 0) sessionRecord.scoreComponents = {
+				...sessionRecord.scoreComponents,
+				dnsAsymmetry
+			};
+			score = require_frictionlessTasksUtils.computeFrictionlessScore(sessionRecord?.scoreComponents);
+			logger.info(() => ({ data: {
+				scoreComponents: sessionRecord?.scoreComponents,
+				score,
+				dnsPeerAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
+				dnsResolverAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo)
+			} }));
+			if (!failStatus && disallowWebView === true && (sessionRecord.webView === true || (sessionRecord.scoreComponents.webView || 0) > 0)) {
+				logger.info(() => ({ msg: "Disallowing webview access - user not verified" }));
+				commitmentUpdates.result = {
+					status: _prosopo_types.CaptchaStatus.disapproved,
+					reason: _prosopo_types.ResultReason.DISALLOWED_WEBVIEW
+				};
+				failStatus = _prosopo_types.ResultReason.DISALLOWED_WEBVIEW;
+				isApproved = false;
+				failureStatus = _prosopo_types.ResultReason.DISALLOWED_WEBVIEW;
+			}
+			if (contextAwareEnabled && sessionRecord.reason === _prosopo_types.FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED) logger.info(() => ({ msg: "Context aware validation failed" }));
+		}
+		if (isApproved) {
+			const decisionInput = {
+				userAccount: solution.userAccount,
+				dappAccount: solution.dappAccount,
+				captchaResult: "passed",
+				headers: solution.headers,
+				captchaType: _prosopo_types.CaptchaType.image,
+				behavioralDataPacked: solution.behavioralDataPacked,
+				deviceCapability: solution.deviceCapability,
+				countryCode: solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0,
+				ipInfo: solution.ipInfo,
+				dnsEvent: enrichedDnsEvent,
+				score,
+				threshold: sessionRecord?.threshold,
+				scoreComponents: sessionRecord?.scoreComponents,
+				decryptedHeadHash: sessionRecord?.decryptedHeadHash,
+				userSitekeyIpHash: sessionRecord?.userSitekeyIpHash,
+				simdReadings: sessionRecord?.simdReadings,
+				frictionlessReason: sessionRecord?.reason,
+				ruleType: sessionRecord?.ruleType,
+				webView: sessionRecord?.webView,
+				iFrame: sessionRecord?.iFrame,
+				coords: solution.coords
+			};
+			try {
+				const decision = await this.decisionMachineRunner.decide(decisionInput, logger);
+				if (decision.decision === _prosopo_types.DecisionMachineDecision.Deny) {
+					const dmReason = decision.reason || _prosopo_types.ResultReason.CAPTCHA_DECISION_MACHINE_DENIED;
+					logger.info(() => ({
+						msg: "Decision machine denied user verification",
+						data: { reason: decision.reason }
+					}));
+					commitmentUpdates.result = {
+						status: _prosopo_types.CaptchaStatus.disapproved,
+						reason: dmReason
+					};
+					isApproved = false;
+					failureStatus = dmReason;
+				}
+			} catch (error) {
+				logger.error(() => ({
+					msg: "Failed to process decision machine",
+					err: error
+				}));
+			}
+		}
+		const writePromises = [];
+		const sideUpdates = {};
+		if (commitmentUpdates.providedIp) sideUpdates.providedIp = commitmentUpdates.providedIp;
+		if (commitmentUpdates.metadata) sideUpdates.metadata = commitmentUpdates.metadata;
+		if (Object.keys(sideUpdates).length > 0) writePromises.push(this.db.updateDappUserCommitment(solution.id, sideUpdates));
+		if (commitmentId) {
+			if (isApproved) writePromises.push(this.db.approveDappUserCommitment(commitmentId));
+			else if (commitmentUpdates.result) writePromises.push(this.db.disapproveDappUserCommitment(commitmentId, commitmentUpdates.result.reason));
+		}
+		const finalResult = isApproved ? { status: _prosopo_types.CaptchaStatus.approved } : commitmentUpdates.result || {
+			status: _prosopo_types.CaptchaStatus.disapproved,
+			reason: failureStatus
+		};
+		if (solution.sessionId) writePromises.push(this.updateSessionRecordWithCache(solution.sessionId, {
+			serverChecked: true,
+			result: finalResult
+		}, true));
+		if (writePromises.length > 0) await Promise.all(writePromises);
+		return {
+			status: isApproved ? _prosopo_types.ResultReason.USER_VERIFIED : failureStatus,
+			verified: isApproved,
+			commitmentId: solution.id.toString(),
+			...score && { score }
+		};
+	}
+	checkLangRules(acceptLanguage) {
+		return require_lang.checkLangRules(this.config, acceptLanguage);
+	}
+	getVerificationResponse(verified, clientRecord, translateFn, score, commitmentId, reason) {
+		return {
+			...super.getVerificationResponse(verified, clientRecord, translateFn, score, reason),
+			...commitmentId && { [_prosopo_types.ApiParams.commitmentId]: commitmentId }
+		};
+	}
+};
+//#endregion
 exports.ImgCaptchaManager = ImgCaptchaManager;