@prosopo/provider 4.15.14 → 4.15.16

package/dist/tasks/imgCaptcha/imgCaptchaTasks.js

@@ -1,807 +1,556 @@
-import { u8aToHex, stringToHex } from "@polkadot/util";
-import { ProsopoEnvError } from "@prosopo/common";
-import { computePendingRequestHash, compareCaptchaSolutions, parseAndSortCaptchaSolutions } from "@prosopo/datasets";
-import { DEFAULT_IMAGE_CAPTCHA_TIMEOUT, SimdReadingsStage, ApiParams, CaptchaStatus, ResultReason, CaptchaType, FrictionlessReason, DecisionMachineDecision } from "@prosopo/types";
-import { extractData, at } from "@prosopo/util";
-import { randomAsHex, signatureVerify } from "@prosopo/util-crypto";
-import { getCompositeIpAddress, getIpAddressFromComposite } from "../../compositeIpAddress.js";
-import { peelCheckboxPrefix, constructPairList, containsIdenticalPairs } from "../../pairs.js";
-import { checkLangRules } from "../../rules/lang.js";
-import { shuffleArray, deepValidateIpAddress } from "../../util.js";
 import { buildAllWindowIncrements } from "../../util/usageCounters.js";
-import { CaptchaManager } from "../captchaManager.js";
 import { DecisionMachineRunner } from "../decisionMachine/decisionMachineRunner.js";
-import { enrichDnsEvent, getIpInfoAsn, computeDnsAsymmetry } from "../dnsEvent/enrichDnsEvent.js";
-import "../frictionless/frictionlessTasks.js";
+import { checkLangRules } from "../../rules/lang.js";
+import { getCompositeIpAddress, getIpAddressFromComposite } from "../../compositeIpAddress.js";
+import { computeDnsAsymmetry, enrichDnsEvent, getIpInfoAsn } from "../dnsEvent/enrichDnsEvent.js";
+import { CaptchaManager } from "../captchaManager.js";
+import { FrictionlessReason as FrictionlessReason$1 } from "../frictionless/frictionlessTasks.js";
+import { constructPairList, containsIdenticalPairs, peelCheckboxPrefix } from "../../pairs.js";
+import { deepValidateIpAddress, shuffleArray } from "../../util.js";
 import { computeFrictionlessScore } from "../frictionless/frictionlessTasksUtils.js";
 import { evaluateEmailSpamRules } from "../spam/evaluateEmailSpamRules.js";
 import { buildTreeAndGetCommitmentId } from "./imgCaptchaTasksUtils.js";
-class ImgCaptchaManager extends CaptchaManager {
-  constructor(db, pair, config, logger, writeQueue, usageCounters) {
-    super(db, pair, config, logger, writeQueue);
-    this.config = config;
-    this.decisionMachineRunner = new DecisionMachineRunner(db);
-    this.usageCounters = usageCounters ?? null;
-  }
-  async getCaptchaWithProof(datasetId, solved, size) {
-    const captchaDocs = await this.db.getRandomCaptcha(solved, datasetId, size);
-    if (!captchaDocs) {
-      throw new ProsopoEnvError("DATABASE.CAPTCHA_GET_FAILED", {
-        context: {
-          failedFuncName: this.getCaptchaWithProof.name,
-          datasetId,
-          solved,
-          size
-        }
-      });
-    }
-    return captchaDocs;
-  }
-  async getRandomCaptchasAndRequestHash(datasetId, userAccount, ipAddress, captchaConfig, threshold, sessionId, ipInfo) {
-    const dataset = await this.db.getDatasetDetails(datasetId);
-    if (!dataset) {
-      throw new ProsopoEnvError("DATABASE.DATASET_GET_FAILED", {
-        context: {
-          failedFuncName: this.getRandomCaptchasAndRequestHash.name,
-          dataset,
-          datasetId
-        }
-      });
-    }
-    const unsolvedCount = Math.abs(
-      Math.trunc(captchaConfig.unsolved.count)
-    );
-    const solvedCount = Math.abs(
-      Math.trunc(captchaConfig.solved.count)
-    );
-    if (!solvedCount) {
-      throw new ProsopoEnvError("CONFIG.INVALID_CAPTCHA_NUMBER");
-    }
-    const solved = await this.getCaptchaWithProof(datasetId, true, solvedCount);
-    let unsolved = [];
-    if (unsolvedCount) {
-      unsolved = await this.getCaptchaWithProof(
-        datasetId,
-        false,
-        unsolvedCount
-      );
-    }
-    const captchas = shuffleArray([...solved, ...unsolved]);
-    const salt = randomAsHex();
-    const requestHash = computePendingRequestHash(
-      captchas.map((c) => c.captchaId),
-      userAccount,
-      salt
-    );
-    const currentTime = Date.now();
-    const signedRequestHash = u8aToHex(
-      this.pair.sign(stringToHex(requestHash))
-    );
-    const timeLimit = captchas.map((captcha) => captcha.timeLimitMs || DEFAULT_IMAGE_CAPTCHA_TIMEOUT).reduce((a, b) => a + b, 0);
-    const deadlineDate = new Date(timeLimit + currentTime);
-    await this.db.storePendingImageCommitment(
-      userAccount,
-      requestHash,
-      salt,
-      deadlineDate,
-      new Date(currentTime),
-      getCompositeIpAddress(ipAddress),
-      threshold,
-      sessionId,
-      ipInfo
-    );
-    return {
-      captchas,
-      requestHash,
-      timestamp: currentTime,
-      signedRequestHash
-    };
-  }
-  /**
-   * Validate and store the text captcha solution(s) from the Dapp User in a web2 environment
-   * @param {string} userAccount
-   * @param {string} dappAccount
-   * @param {string} requestHash
-   * @param {JSON} captchas
-   * @param userTimestampSignature
-   * @param timestamp
-   * @param providerRequestHashSignature
-   * @param ipAddress
-   * @param headers
-   * @param ja4
-   * @param behavioralData
-   * @return {Promise<DappUserSolutionResult>} result containing the contract event
-   */
-  async dappUserSolution(userAccount, dappAccount, requestHash, captchas, userTimestampSignature, timestamp, providerRequestHashSignature, ipAddress, headers, ja4, behavioralData, ipInfo, simdReadings, clientMetaData) {
-    const decodedSimdReadings = simdReadings ? await this.decryptSimdReadingsForAttach(simdReadings) : void 0;
-    const pushSimdAttachIfAny = (sessionId, writes) => {
-      if (decodedSimdReadings) {
-        writes.push(
-          this.recordSessionSimdReadingsIfAbsentWithCache(
-            sessionId,
-            decodedSimdReadings,
-            SimdReadingsStage.submit
-          )
-        );
-      }
-    };
-    const verification = signatureVerify(
-      stringToHex(timestamp.toString()),
-      userTimestampSignature,
-      userAccount
-    );
-    if (!verification.isValid) {
-      const err = new ProsopoEnvError("GENERAL.INVALID_SIGNATURE", {
-        context: { failedFuncName: this.dappUserSolution.name, userAccount }
-      });
-      this.logger.info(() => ({
-        err,
-        msg: "Invalid user timestamp signature"
-      }));
-      throw err;
-    }
-    const providerRequestHashSignatureVerify = signatureVerify(
-      stringToHex(requestHash.toString()),
-      providerRequestHashSignature,
-      this.pair.address
-    );
-    if (!providerRequestHashSignatureVerify.isValid) {
-      const err = new ProsopoEnvError("GENERAL.INVALID_SIGNATURE", {
-        context: {
-          failedFuncName: this.dappUserSolution.name,
-          userAccount,
-          error: "requestHash signature is invalid"
-        }
-      });
-      this.logger.info(() => ({
-        err,
-        msg: "Invalid provider requestHash signature"
-      }));
-      throw err;
-    }
-    let response = {
-      captchas: [],
-      verified: false
-    };
-    const pendingRecord = await this.db.getPendingImageCommitment(requestHash);
-    const unverifiedCaptchaIds = captchas.map((captcha) => captcha.captchaId);
-    const pendingRequest = await this.validateDappUserSolutionRequestIsPending(
-      requestHash,
-      pendingRecord,
-      userAccount,
-      unverifiedCaptchaIds
-    );
-    if (pendingRequest) {
-      const { storedCaptchas, receivedCaptchas, captchaIds } = await this.validateReceivedCaptchasAgainstStoredCaptchas(captchas);
-      const rawFlat = receivedCaptchas.map((c) => extractData(c.salt));
-      const { checkbox: checkboxCoordPair, flat } = peelCheckboxPrefix(
-        rawFlat,
-        receivedCaptchas.map((c) => c.solution.length)
-      );
-      const shapePairs = flat.map((list) => constructPairList(list));
-      const pairs = checkboxCoordPair ? [[checkboxCoordPair], ...shapePairs] : shapePairs;
-      const { tree, commitmentId } = buildTreeAndGetCommitmentId(receivedCaptchas);
-      const datasetId = at(storedCaptchas, 0).datasetId;
-      if (!datasetId) {
-        throw new ProsopoEnvError("CAPTCHA.ID_MISMATCH", {
-          context: { failedFuncName: this.dappUserSolution.name }
-        });
-      }
-      await this.db.updatePendingImageCommitmentStatus(requestHash);
-      let behavioralDataPacked;
-      let deviceCapability;
-      if (behavioralData) {
-        try {
-          const decryptKeys = [
-            // Process DB keys first, then env var key last as env key will likely be invalid
-            ...await this.getDetectorKeys(),
-            process.env.BOT_DECRYPTION_KEY
-          ];
-          const decryptedData = await this.decryptBehavioralData(
-            behavioralData,
-            decryptKeys
-          );
-          if (decryptedData) {
-            this.logger?.info(() => ({
-              msg: "Behavioral analysis completed",
-              data: {
-                userAccount,
-                dappAccount,
-                requestHash,
-                mouseEventsCount: decryptedData.collector1?.length || 0,
-                touchEventsCount: decryptedData.collector2?.length || 0,
-                clickEventsCount: decryptedData.collector3?.length || 0,
-                deviceCapability: decryptedData.deviceCapability
-              }
-            }));
-            behavioralDataPacked = {
-              c1: decryptedData.collector1 || [],
-              c2: decryptedData.collector2 || [],
-              c3: decryptedData.collector3 || [],
-              d: decryptedData.deviceCapability
-            };
-            deviceCapability = decryptedData.deviceCapability;
-          }
-        } catch (error) {
-          this.logger?.error(() => ({
-            msg: "Failed to process behavioral data",
-            err: error
-          }));
-        }
-      }
-      const commit = {
-        id: commitmentId,
-        userAccount,
-        dappAccount,
-        providerAccount: this.pair.address,
-        datasetId,
-        result: { status: CaptchaStatus.pending },
-        userSignature: userTimestampSignature,
-        userSubmitted: true,
-        serverChecked: false,
-        requestedAtTimestamp: new Date(timestamp),
-        submittedAtTimestamp: /* @__PURE__ */ new Date(),
-        ipAddress: getCompositeIpAddress(ipAddress),
-        headers,
-        sessionId: pendingRecord.sessionId,
-        ja4,
-        ipInfo,
-        pending: false,
-        salt: pendingRecord.salt,
-        requestHash: pendingRecord[ApiParams.requestHash],
-        threshold: pendingRecord.threshold,
-        deadlineTimestamp: pendingRecord.deadlineTimestamp,
-        ...behavioralDataPacked && { behavioralDataPacked },
-        ...deviceCapability && { deviceCapability },
-        ...clientMetaData?.hp && {
-          clientMetaData: { hp: clientMetaData.hp }
-        }
-      };
-      await this.db.storeUserImageCaptchaSolution(receivedCaptchas, commit);
-      const solutionRecords = await Promise.all(
-        storedCaptchas.map(async (captcha) => {
-          const solutionRecord = await this.db.getSolutionByCaptchaId(
-            captcha.captchaId
-          );
-          if (!solutionRecord) {
-            throw new ProsopoEnvError("CAPTCHA.SOLUTION_NOT_FOUND", {
-              context: { failedFuncName: this.dappUserSolution.name }
-            });
-          }
-          return solutionRecord;
-        })
-      );
-      const totalImages = storedCaptchas[0]?.items.length || 0;
-      if (containsIdenticalPairs(pairs) && process.env.NODE_ENV !== "test") {
-        const writePromises = [
-          this.db.disapproveDappUserCommitment(
-            commitmentId,
-            "CAPTCHA.INVALID_SOLUTION",
-            pairs
-          )
-        ];
-        if (pendingRecord.sessionId) {
-          writePromises.push(
-            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
-              userSubmitted: true,
-              result: {
-                status: CaptchaStatus.disapproved,
-                reason: ResultReason.CAPTCHA_INVALID_SOLUTION
-              }
-            })
-          );
-          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
-        }
-        await Promise.all(writePromises);
-        response = {
-          captchas: captchaIds.map((id) => ({
-            captchaId: id,
-            proof: [[]]
-          })),
-          verified: false
-        };
-        return response;
-      }
-      if (compareCaptchaSolutions(
-        receivedCaptchas,
-        solutionRecords,
-        totalImages,
-        pendingRecord.threshold
-      )) {
-        response = {
-          captchas: captchaIds.map((id) => ({
-            captchaId: id,
-            proof: tree.proof(id)
-          })),
-          verified: true
-        };
-        const writePromises = [
-          this.db.approveDappUserCommitment(commitmentId, pairs)
-        ];
-        if (pendingRecord.sessionId) {
-          writePromises.push(
-            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
-              userSubmitted: true,
-              result: { status: CaptchaStatus.approved }
-            })
-          );
-          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
-        }
-        await Promise.all(writePromises);
-      } else {
-        const writePromises = [
-          this.db.disapproveDappUserCommitment(
-            commitmentId,
-            "CAPTCHA.INVALID_SOLUTION",
-            pairs
-          )
-        ];
-        if (pendingRecord.sessionId) {
-          writePromises.push(
-            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
-              userSubmitted: true,
-              result: {
-                status: CaptchaStatus.disapproved,
-                reason: ResultReason.CAPTCHA_INVALID_SOLUTION
-              }
-            })
-          );
-          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
-        }
-        await Promise.all(writePromises);
-        response = {
-          captchas: captchaIds.map((id) => ({
-            captchaId: id,
-            proof: [[]]
-          })),
-          verified: false
-        };
-      }
-    } else {
-      this.logger.info(() => ({
-        msg: "Request hash not found"
-      }));
-    }
-    return response;
-  }
-  /**
-   * Validate length of received captchas array matches length of captchas found in database
-   * Validate that the datasetId is the same for all captchas and is equal to the datasetId on the stored captchas
-   */
-  async validateReceivedCaptchasAgainstStoredCaptchas(captchas) {
-    const receivedCaptchas = parseAndSortCaptchaSolutions(captchas);
-    const captchaIds = receivedCaptchas.map((captcha) => captcha.captchaId);
-    const storedCaptchas = await this.db.getCaptchaById(captchaIds);
-    if (!storedCaptchas || receivedCaptchas.length !== storedCaptchas.length) {
-      throw new ProsopoEnvError("CAPTCHA.INVALID_CAPTCHA_ID", {
-        context: {
-          failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
-          captchas
-        }
-      });
-    }
-    if (!storedCaptchas.every(
-      (captcha) => captcha.datasetId === at(storedCaptchas, 0).datasetId
-    )) {
-      throw new ProsopoEnvError("CAPTCHA.DIFFERENT_DATASET_IDS", {
-        context: {
-          failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
-          captchas
-        }
-      });
-    }
-    return { storedCaptchas, receivedCaptchas, captchaIds };
-  }
-  /**
-   * Validate that a Dapp User is responding to their own pending captcha request
-   * @param {string} requestHash
-   * @param {PendingImageCaptchaRequest} pendingRecord
-   * @param {string} userAccount
-   * @param {string[]} captchaIds
-   */
-  async validateDappUserSolutionRequestIsPending(requestHash, pendingRecord, userAccount, captchaIds) {
-    const currentTime = /* @__PURE__ */ new Date();
-    if (!pendingRecord) {
-      this.logger.info(() => ({
-        msg: "No pending record found"
-      }));
-      return false;
-    }
-    if (pendingRecord.deadlineTimestamp < currentTime) {
-      this.logger.info(() => ({
-        msg: "Deadline for responding to captcha has expired"
-      }));
-      return false;
-    }
-    if (pendingRecord) {
-      const pendingHashComputed = computePendingRequestHash(
-        captchaIds,
-        userAccount,
-        pendingRecord.salt
-      );
-      return requestHash === pendingHashComputed;
-    }
-    return false;
-  }
-  /*
-   * Get dapp user solution from database
-   */
-  async getDappUserCommitmentById(commitmentId) {
-    const dappUserSolution = await this.db.getDappUserCommitmentById(commitmentId);
-    if (!dappUserSolution) {
-      throw new ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", {
-        context: {
-          failedFuncName: this.getDappUserCommitmentById.name,
-          commitmentId
-        }
-      });
-    }
-    return dappUserSolution;
-  }
-  /* Check if dapp user has verified solution in cache */
-  async getDappUserCommitmentByAccount(userAccount, dappAccount) {
-    const dappUserSolutions = await this.db.getDappUserCommitmentByAccount(
-      userAccount,
-      dappAccount
-    );
-    if (dappUserSolutions.length > 0) {
-      for (const dappUserSolution of dappUserSolutions) {
-        if (dappUserSolution.result.status === CaptchaStatus.approved) {
-          return dappUserSolution;
-        }
-      }
-    }
-    return void 0;
-  }
-  async verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, disallowWebView, contextAwareEnabled = false, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false) {
-    const logger = this.logger.with({ commitmentId, dapp });
-    const solution = await (commitmentId ? this.getDappUserCommitmentById(commitmentId) : this.getDappUserCommitmentByAccount(user, dapp));
-    if (!solution) {
-      logger.debug(() => ({
-        msg: "Not verified - no solution found"
-      }));
-      return {
-        status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
-        verified: false
-      };
-    }
-    if (solution.serverChecked) {
-      return {
-        status: "API.USER_ALREADY_VERIFIED",
-        verified: false
-      };
-    }
-    await this.db.markDappUserCommitmentsChecked([solution.id]);
-    if (solution.result.status === CaptchaStatus.disapproved) {
-      return {
-        status: solution.result.reason || "API.USER_NOT_VERIFIED",
-        verified: false
-      };
-    }
-    maxVerifiedTime = maxVerifiedTime || 60 * 1e3;
-    const currentTime = Date.now();
-    const submittedAt = solution.submittedAtTimestamp;
-    const timeSinceCompletion = submittedAt instanceof Date ? currentTime - submittedAt.getTime() : Number.POSITIVE_INFINITY;
-    if (timeSinceCompletion > maxVerifiedTime) {
-      logger.debug(() => ({
-        msg: "Not verified - timed out"
-      }));
-      return {
-        status: "API.USER_NOT_VERIFIED_TIME_EXPIRED",
-        verified: false
-      };
-    }
-    const commitmentUpdates = {};
-    let failStatus;
-    if (userAccessRulesStorage) {
-      try {
-        const blockPolicy = await this.checkForHardBlock(
-          userAccessRulesStorage,
-          solution,
-          solution.userAccount,
-          solution.headers,
-          solution.coords,
-          solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0,
-          solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0
-        );
-        if (blockPolicy) {
-          logger.info(() => ({
-            msg: "User blocked by access policy in server image verification",
-            data: {
-              userAccount: solution.userAccount,
-              dappAccount: solution.dappAccount,
-              policy: blockPolicy
-            }
-          }));
-          commitmentUpdates.result = {
-            status: CaptchaStatus.disapproved,
-            reason: ResultReason.ACCESS_POLICY_BLOCK
-          };
-          failStatus = ResultReason.ACCESS_POLICY_BLOCK;
-        }
-      } catch (error) {
-        logger.warn(() => ({
-          msg: "Failed to check user access policies in server image verification",
-          error
-        }));
-      }
-    }
-    if (!failStatus && email && spamEmailDomainCheckingEnabled) {
-      try {
-        const isSpam = await this.checkSpamEmail(email);
-        if (isSpam) {
-          const emailDomain = email.split("@")[1] || "unknown";
-          logger.info(() => ({
-            msg: "Spam email domain detected in server image verification",
-            data: { emailDomain }
-          }));
-          commitmentUpdates.result = {
-            status: CaptchaStatus.disapproved,
-            reason: ResultReason.SPAM_EMAIL_DOMAIN
-          };
-          failStatus = ResultReason.SPAM_EMAIL_DOMAIN;
-        }
-      } catch (error) {
-        logger.warn(() => ({
-          msg: "Failed to check spam email domain in server image verification",
-          error
-        }));
-      }
-    }
-    if (!failStatus && spamFilter?.enabled && spamFilter.emailRules?.enabled && email) {
-      const result = evaluateEmailSpamRules(email, spamFilter.emailRules);
-      if (result.isSpam) {
-        logger.info(() => ({
-          msg: "Spam filter rejected email in image verification",
-          data: { reason: result.reason }
-        }));
-        commitmentUpdates.result = {
-          status: CaptchaStatus.disapproved,
-          reason: ResultReason.SPAM_EMAIL_RULE
-        };
-        failStatus = ResultReason.SPAM_EMAIL_RULE;
-      }
-    }
-    const sessionRecord = solution.sessionId ? await this.db.getSessionRecordBySessionId(solution.sessionId) : void 0;
-    const enrichedDnsEvent = await enrichDnsEvent(
-      sessionRecord?.dnsEvent,
-      env.ipInfoService,
-      ip ?? solution.ipInfo?.ip
-    );
-    if (!failStatus) {
-      const check = await this.resolveTrafficFilterCheck(
-        env,
-        solution.ipInfo,
-        trafficFilter,
-        ip,
-        enrichedDnsEvent
-      );
-      if (check.isBlocked) {
-        logger.info(() => ({
-          msg: "Traffic filter rejected request",
-          data: {
-            ip,
-            reason: check.reason,
-            dnsPeerIp: enrichedDnsEvent?.peerIp,
-            dnsResolverIp: enrichedDnsEvent?.resolverIp,
-            dnsPeerAsn: getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
-            dnsResolverAsn: getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo),
-            dnsPathValid: enrichedDnsEvent?.pathValid
-          }
-        }));
-        commitmentUpdates.result = {
-          status: CaptchaStatus.disapproved,
-          reason: check.reason
-        };
-        failStatus = check.reason;
-      }
-    }
-    if (storeMetadata && email) {
-      commitmentUpdates.metadata = { email };
-    }
-    if (ip) {
-      const solutionIpAddress = getIpAddressFromComposite(solution.ipAddress);
-      const clientRecord = await this.db.getClientRecord(dapp);
-      const ipValidationRules = clientRecord?.settings?.ipValidationRules;
-      commitmentUpdates.providedIp = getCompositeIpAddress(ip);
-      if (!failStatus && ipValidationRules?.enabled === true) {
-        const ipValidation = await deepValidateIpAddress(
-          ip,
-          solutionIpAddress,
-          logger,
-          env.ipInfoService,
-          ipValidationRules,
-          enrichedDnsEvent?.peerIp
-        );
-        if (!ipValidation.isValid) {
-          logger.error(() => ({
-            msg: "IP validation failed for image captcha",
-            data: {
-              ip,
-              solutionIp: solutionIpAddress.address,
-              error: ipValidation.errorMessage,
-              distanceKm: ipValidation.distanceKm
-            }
-          }));
-          failStatus = ResultReason.FAILED_IP_VALIDATION;
-        }
-      }
-    }
-    let isApproved = !failStatus && solution.result.status === CaptchaStatus.approved;
-    let failureStatus = failStatus || ResultReason.USER_NOT_VERIFIED;
-    if (!failStatus && solution.result.status === CaptchaStatus.approved && this.usageCounters) {
-      const ipValue = ip ?? "";
-      this.usageCounters.incrManyAsync(
-        solution.dappAccount,
-        buildAllWindowIncrements(
-          "solved",
-          CaptchaType.image,
-          ipValue,
-          solution.userAccount,
-          enrichedDnsEvent?.peerIp
-        )
-      );
-    }
-    let score;
-    if (sessionRecord) {
-      const dnsAsymmetry = computeDnsAsymmetry(
-        enrichedDnsEvent,
-        solution.ipInfo,
-        trafficFilter
-      );
-      if (dnsAsymmetry > 0) {
-        sessionRecord.scoreComponents = {
-          ...sessionRecord.scoreComponents,
-          dnsAsymmetry
-        };
-      }
-      score = computeFrictionlessScore(sessionRecord?.scoreComponents);
-      logger.info(() => ({
-        data: {
-          scoreComponents: sessionRecord?.scoreComponents,
-          score,
-          dnsPeerAsn: getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
-          dnsResolverAsn: getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo)
-        }
-      }));
-      if (!failStatus && disallowWebView === true && (sessionRecord.webView === true || (sessionRecord.scoreComponents.webView || 0) > 0)) {
-        logger.info(() => ({
-          msg: "Disallowing webview access - user not verified"
-        }));
-        commitmentUpdates.result = {
-          status: CaptchaStatus.disapproved,
-          reason: ResultReason.DISALLOWED_WEBVIEW
-        };
-        failStatus = ResultReason.DISALLOWED_WEBVIEW;
-        isApproved = false;
-        failureStatus = ResultReason.DISALLOWED_WEBVIEW;
-      }
-      if (contextAwareEnabled && sessionRecord.reason === FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED) {
-        logger.info(() => ({
-          msg: "Context aware validation failed"
-        }));
-      }
-    }
-    if (isApproved) {
-      const decisionInput = {
-        userAccount: solution.userAccount,
-        dappAccount: solution.dappAccount,
-        captchaResult: "passed",
-        headers: solution.headers,
-        captchaType: CaptchaType.image,
-        behavioralDataPacked: solution.behavioralDataPacked,
-        deviceCapability: solution.deviceCapability,
-        countryCode: solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0,
-        ipInfo: solution.ipInfo,
-        dnsEvent: enrichedDnsEvent,
-        score,
-        threshold: sessionRecord?.threshold,
-        scoreComponents: sessionRecord?.scoreComponents,
-        decryptedHeadHash: sessionRecord?.decryptedHeadHash,
-        userSitekeyIpHash: sessionRecord?.userSitekeyIpHash,
-        simdReadings: sessionRecord?.simdReadings,
-        frictionlessReason: sessionRecord?.reason,
-        ruleType: sessionRecord?.ruleType,
-        webView: sessionRecord?.webView,
-        iFrame: sessionRecord?.iFrame,
-        coords: solution.coords
-      };
-      try {
-        const decision = await this.decisionMachineRunner.decide(
-          decisionInput,
-          logger
-        );
-        if (decision.decision === DecisionMachineDecision.Deny) {
-          const dmReason = decision.reason || ResultReason.CAPTCHA_DECISION_MACHINE_DENIED;
-          logger.info(() => ({
-            msg: "Decision machine denied user verification",
-            data: {
-              reason: decision.reason
-            }
-          }));
-          commitmentUpdates.result = {
-            status: CaptchaStatus.disapproved,
-            reason: dmReason
-          };
-          isApproved = false;
-          failureStatus = dmReason;
-        }
-      } catch (error) {
-        logger.error(() => ({
-          msg: "Failed to process decision machine",
-          err: error
-        }));
-      }
-    }
-    const writePromises = [];
-    const sideUpdates = {};
-    if (commitmentUpdates.providedIp) {
-      sideUpdates.providedIp = commitmentUpdates.providedIp;
-    }
-    if (commitmentUpdates.metadata) {
-      sideUpdates.metadata = commitmentUpdates.metadata;
-    }
-    if (Object.keys(sideUpdates).length > 0) {
-      writePromises.push(
-        this.db.updateDappUserCommitment(solution.id, sideUpdates)
-      );
-    }
-    if (commitmentId) {
-      if (isApproved) {
-        writePromises.push(this.db.approveDappUserCommitment(commitmentId));
-      } else if (commitmentUpdates.result) {
-        writePromises.push(
-          this.db.disapproveDappUserCommitment(
-            commitmentId,
-            commitmentUpdates.result.reason
-          )
-        );
-      }
-    }
-    const finalResult = isApproved ? { status: CaptchaStatus.approved } : commitmentUpdates.result || {
-      status: CaptchaStatus.disapproved,
-      reason: failureStatus
-    };
-    if (solution.sessionId) {
-      writePromises.push(
-        this.updateSessionRecordWithCache(
-          solution.sessionId,
-          {
-            serverChecked: true,
-            result: finalResult
-          },
-          true
-        )
-      );
-    }
-    if (writePromises.length > 0) {
-      await Promise.all(writePromises);
-    }
-    return {
-      status: isApproved ? ResultReason.USER_VERIFIED : failureStatus,
-      verified: isApproved,
-      commitmentId: solution.id.toString(),
-      ...score && { score }
-    };
-  }
-  checkLangRules(acceptLanguage) {
-    return checkLangRules(this.config, acceptLanguage);
-  }
-  getVerificationResponse(verified, clientRecord, translateFn, score, commitmentId, reason) {
-    return {
-      ...super.getVerificationResponse(
-        verified,
-        clientRecord,
-        translateFn,
-        score,
-        reason
-      ),
-      ...commitmentId && {
-        [ApiParams.commitmentId]: commitmentId
-      }
-    };
-  }
-}
-export {
-  ImgCaptchaManager
+import { ProsopoEnvError } from "@prosopo/common";
+import { ApiParams, CaptchaStatus, CaptchaType, DEFAULT_IMAGE_CAPTCHA_TIMEOUT, DecisionMachineDecision, ResultReason, SimdReadingsStage } from "@prosopo/types";
+import { at, extractData } from "@prosopo/util";
+import { randomAsHex, signatureVerify } from "@prosopo/util-crypto";
+import { compareCaptchaSolutions, computePendingRequestHash, parseAndSortCaptchaSolutions } from "@prosopo/datasets";
+import { stringToHex, u8aToHex } from "@polkadot/util";
+//#region src/tasks/imgCaptcha/imgCaptchaTasks.ts
+var ImgCaptchaManager = class extends CaptchaManager {
+	constructor(db, pair, config, logger, writeQueue, usageCounters) {
+		super(db, pair, config, logger, writeQueue);
+		this.config = config;
+		this.decisionMachineRunner = new DecisionMachineRunner(db);
+		this.usageCounters = usageCounters ?? null;
+	}
+	async getCaptchaWithProof(datasetId, solved, size) {
+		const captchaDocs = await this.db.getRandomCaptcha(solved, datasetId, size);
+		if (!captchaDocs) throw new ProsopoEnvError("DATABASE.CAPTCHA_GET_FAILED", { context: {
+			failedFuncName: this.getCaptchaWithProof.name,
+			datasetId,
+			solved,
+			size
+		} });
+		return captchaDocs;
+	}
+	async getRandomCaptchasAndRequestHash(datasetId, userAccount, ipAddress, captchaConfig, threshold, sessionId, ipInfo) {
+		const dataset = await this.db.getDatasetDetails(datasetId);
+		if (!dataset) throw new ProsopoEnvError("DATABASE.DATASET_GET_FAILED", { context: {
+			failedFuncName: this.getRandomCaptchasAndRequestHash.name,
+			dataset,
+			datasetId
+		} });
+		const unsolvedCount = Math.abs(Math.trunc(captchaConfig.unsolved.count));
+		const solvedCount = Math.abs(Math.trunc(captchaConfig.solved.count));
+		if (!solvedCount) throw new ProsopoEnvError("CONFIG.INVALID_CAPTCHA_NUMBER");
+		const solved = await this.getCaptchaWithProof(datasetId, true, solvedCount);
+		let unsolved = [];
+		if (unsolvedCount) unsolved = await this.getCaptchaWithProof(datasetId, false, unsolvedCount);
+		const captchas = shuffleArray([...solved, ...unsolved]);
+		const salt = randomAsHex();
+		const requestHash = computePendingRequestHash(captchas.map((c) => c.captchaId), userAccount, salt);
+		const currentTime = Date.now();
+		const signedRequestHash = u8aToHex(this.pair.sign(stringToHex(requestHash)));
+		const timeLimit = captchas.map((captcha) => captcha.timeLimitMs || DEFAULT_IMAGE_CAPTCHA_TIMEOUT).reduce((a, b) => a + b, 0);
+		const deadlineDate = new Date(timeLimit + currentTime);
+		await this.db.storePendingImageCommitment(userAccount, requestHash, salt, deadlineDate, new Date(currentTime), getCompositeIpAddress(ipAddress), threshold, sessionId, ipInfo);
+		return {
+			captchas,
+			requestHash,
+			timestamp: currentTime,
+			signedRequestHash
+		};
+	}
+	/**
+	* Validate and store the text captcha solution(s) from the Dapp User in a web2 environment
+	* @param {string} userAccount
+	* @param {string} dappAccount
+	* @param {string} requestHash
+	* @param {JSON} captchas
+	* @param userTimestampSignature
+	* @param timestamp
+	* @param providerRequestHashSignature
+	* @param ipAddress
+	* @param headers
+	* @param ja4
+	* @param behavioralData
+	* @return {Promise<DappUserSolutionResult>} result containing the contract event
+	*/
+	async dappUserSolution(userAccount, dappAccount, requestHash, captchas, userTimestampSignature, timestamp, providerRequestHashSignature, ipAddress, headers, ja4, behavioralData, ipInfo, simdReadings, clientMetaData) {
+		const decodedSimdReadings = simdReadings ? await this.decryptSimdReadingsForAttach(simdReadings) : void 0;
+		const pushSimdAttachIfAny = (sessionId, writes) => {
+			if (decodedSimdReadings) writes.push(this.recordSessionSimdReadingsIfAbsentWithCache(sessionId, decodedSimdReadings, SimdReadingsStage.submit));
+		};
+		if (!signatureVerify(stringToHex(timestamp.toString()), userTimestampSignature, userAccount).isValid) {
+			const err = new ProsopoEnvError("GENERAL.INVALID_SIGNATURE", { context: {
+				failedFuncName: this.dappUserSolution.name,
+				userAccount
+			} });
+			this.logger.info(() => ({
+				err,
+				msg: "Invalid user timestamp signature"
+			}));
+			throw err;
+		}
+		if (!signatureVerify(stringToHex(requestHash.toString()), providerRequestHashSignature, this.pair.address).isValid) {
+			const err = new ProsopoEnvError("GENERAL.INVALID_SIGNATURE", { context: {
+				failedFuncName: this.dappUserSolution.name,
+				userAccount,
+				error: "requestHash signature is invalid"
+			} });
+			this.logger.info(() => ({
+				err,
+				msg: "Invalid provider requestHash signature"
+			}));
+			throw err;
+		}
+		let response = {
+			captchas: [],
+			verified: false
+		};
+		const pendingRecord = await this.db.getPendingImageCommitment(requestHash);
+		const unverifiedCaptchaIds = captchas.map((captcha) => captcha.captchaId);
+		if (await this.validateDappUserSolutionRequestIsPending(requestHash, pendingRecord, userAccount, unverifiedCaptchaIds)) {
+			const { storedCaptchas, receivedCaptchas, captchaIds } = await this.validateReceivedCaptchasAgainstStoredCaptchas(captchas);
+			const { checkbox: checkboxCoordPair, flat } = peelCheckboxPrefix(receivedCaptchas.map((c) => extractData(c.salt)), receivedCaptchas.map((c) => c.solution.length));
+			const shapePairs = flat.map((list) => constructPairList(list));
+			const pairs = checkboxCoordPair ? [[checkboxCoordPair], ...shapePairs] : shapePairs;
+			const { tree, commitmentId } = buildTreeAndGetCommitmentId(receivedCaptchas);
+			const datasetId = at(storedCaptchas, 0).datasetId;
+			if (!datasetId) throw new ProsopoEnvError("CAPTCHA.ID_MISMATCH", { context: { failedFuncName: this.dappUserSolution.name } });
+			await this.db.updatePendingImageCommitmentStatus(requestHash);
+			let behavioralDataPacked;
+			let deviceCapability;
+			if (behavioralData) try {
+				const decryptKeys = [...await this.getDetectorKeys(), process.env.BOT_DECRYPTION_KEY];
+				const decryptedData = await this.decryptBehavioralData(behavioralData, decryptKeys);
+				if (decryptedData) {
+					this.logger?.info(() => ({
+						msg: "Behavioral analysis completed",
+						data: {
+							userAccount,
+							dappAccount,
+							requestHash,
+							mouseEventsCount: decryptedData.collector1?.length || 0,
+							touchEventsCount: decryptedData.collector2?.length || 0,
+							clickEventsCount: decryptedData.collector3?.length || 0,
+							deviceCapability: decryptedData.deviceCapability
+						}
+					}));
+					behavioralDataPacked = {
+						c1: decryptedData.collector1 || [],
+						c2: decryptedData.collector2 || [],
+						c3: decryptedData.collector3 || [],
+						d: decryptedData.deviceCapability
+					};
+					deviceCapability = decryptedData.deviceCapability;
+				}
+			} catch (error) {
+				this.logger?.error(() => ({
+					msg: "Failed to process behavioral data",
+					err: error
+				}));
+			}
+			const commit = {
+				id: commitmentId,
+				userAccount,
+				dappAccount,
+				providerAccount: this.pair.address,
+				datasetId,
+				result: { status: CaptchaStatus.pending },
+				userSignature: userTimestampSignature,
+				userSubmitted: true,
+				serverChecked: false,
+				requestedAtTimestamp: new Date(timestamp),
+				submittedAtTimestamp: /* @__PURE__ */ new Date(),
+				ipAddress: getCompositeIpAddress(ipAddress),
+				headers,
+				sessionId: pendingRecord.sessionId,
+				ja4,
+				ipInfo,
+				pending: false,
+				salt: pendingRecord.salt,
+				requestHash: pendingRecord[ApiParams.requestHash],
+				threshold: pendingRecord.threshold,
+				deadlineTimestamp: pendingRecord.deadlineTimestamp,
+				...behavioralDataPacked && { behavioralDataPacked },
+				...deviceCapability && { deviceCapability },
+				...clientMetaData?.hp && { clientMetaData: { hp: clientMetaData.hp } }
+			};
+			await this.db.storeUserImageCaptchaSolution(receivedCaptchas, commit);
+			const solutionRecords = await Promise.all(storedCaptchas.map(async (captcha) => {
+				const solutionRecord = await this.db.getSolutionByCaptchaId(captcha.captchaId);
+				if (!solutionRecord) throw new ProsopoEnvError("CAPTCHA.SOLUTION_NOT_FOUND", { context: { failedFuncName: this.dappUserSolution.name } });
+				return solutionRecord;
+			}));
+			const totalImages = storedCaptchas[0]?.items.length || 0;
+			if (containsIdenticalPairs(pairs) && process.env.NODE_ENV !== "test") {
+				const writePromises = [this.db.disapproveDappUserCommitment(commitmentId, "CAPTCHA.INVALID_SOLUTION", pairs)];
+				if (pendingRecord.sessionId) {
+					writePromises.push(this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+						userSubmitted: true,
+						result: {
+							status: CaptchaStatus.disapproved,
+							reason: ResultReason.CAPTCHA_INVALID_SOLUTION
+						}
+					}));
+					pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+				}
+				await Promise.all(writePromises);
+				response = {
+					captchas: captchaIds.map((id) => ({
+						captchaId: id,
+						proof: [[]]
+					})),
+					verified: false
+				};
+				return response;
+			}
+			if (compareCaptchaSolutions(receivedCaptchas, solutionRecords, totalImages, pendingRecord.threshold)) {
+				response = {
+					captchas: captchaIds.map((id) => ({
+						captchaId: id,
+						proof: tree.proof(id)
+					})),
+					verified: true
+				};
+				const writePromises = [this.db.approveDappUserCommitment(commitmentId, pairs)];
+				if (pendingRecord.sessionId) {
+					writePromises.push(this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+						userSubmitted: true,
+						result: { status: CaptchaStatus.approved }
+					}));
+					pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+				}
+				await Promise.all(writePromises);
+			} else {
+				const writePromises = [this.db.disapproveDappUserCommitment(commitmentId, "CAPTCHA.INVALID_SOLUTION", pairs)];
+				if (pendingRecord.sessionId) {
+					writePromises.push(this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+						userSubmitted: true,
+						result: {
+							status: CaptchaStatus.disapproved,
+							reason: ResultReason.CAPTCHA_INVALID_SOLUTION
+						}
+					}));
+					pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+				}
+				await Promise.all(writePromises);
+				response = {
+					captchas: captchaIds.map((id) => ({
+						captchaId: id,
+						proof: [[]]
+					})),
+					verified: false
+				};
+			}
+		} else this.logger.info(() => ({ msg: "Request hash not found" }));
+		return response;
+	}
+	/**
+	* Validate length of received captchas array matches length of captchas found in database
+	* Validate that the datasetId is the same for all captchas and is equal to the datasetId on the stored captchas
+	*/
+	async validateReceivedCaptchasAgainstStoredCaptchas(captchas) {
+		const receivedCaptchas = parseAndSortCaptchaSolutions(captchas);
+		const captchaIds = receivedCaptchas.map((captcha) => captcha.captchaId);
+		const storedCaptchas = await this.db.getCaptchaById(captchaIds);
+		if (!storedCaptchas || receivedCaptchas.length !== storedCaptchas.length) throw new ProsopoEnvError("CAPTCHA.INVALID_CAPTCHA_ID", { context: {
+			failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
+			captchas
+		} });
+		if (!storedCaptchas.every((captcha) => captcha.datasetId === at(storedCaptchas, 0).datasetId)) throw new ProsopoEnvError("CAPTCHA.DIFFERENT_DATASET_IDS", { context: {
+			failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
+			captchas
+		} });
+		return {
+			storedCaptchas,
+			receivedCaptchas,
+			captchaIds
+		};
+	}
+	/**
+	* Validate that a Dapp User is responding to their own pending captcha request
+	* @param {string} requestHash
+	* @param {PendingImageCaptchaRequest} pendingRecord
+	* @param {string} userAccount
+	* @param {string[]} captchaIds
+	*/
+	async validateDappUserSolutionRequestIsPending(requestHash, pendingRecord, userAccount, captchaIds) {
+		const currentTime = /* @__PURE__ */ new Date();
+		if (!pendingRecord) {
+			this.logger.info(() => ({ msg: "No pending record found" }));
+			return false;
+		}
+		if (pendingRecord.deadlineTimestamp < currentTime) {
+			this.logger.info(() => ({ msg: "Deadline for responding to captcha has expired" }));
+			return false;
+		}
+		if (pendingRecord) return requestHash === computePendingRequestHash(captchaIds, userAccount, pendingRecord.salt);
+		return false;
+	}
+	async getDappUserCommitmentById(commitmentId) {
+		const dappUserSolution = await this.db.getDappUserCommitmentById(commitmentId);
+		if (!dappUserSolution) throw new ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
+			failedFuncName: this.getDappUserCommitmentById.name,
+			commitmentId
+		} });
+		return dappUserSolution;
+	}
+	async getDappUserCommitmentByAccount(userAccount, dappAccount) {
+		const dappUserSolutions = await this.db.getDappUserCommitmentByAccount(userAccount, dappAccount);
+		if (dappUserSolutions.length > 0) {
+			for (const dappUserSolution of dappUserSolutions) if (dappUserSolution.result.status === CaptchaStatus.approved) return dappUserSolution;
+		}
+	}
+	async verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, disallowWebView, contextAwareEnabled = false, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false) {
+		const logger = this.logger.with({
+			commitmentId,
+			dapp
+		});
+		const solution = await (commitmentId ? this.getDappUserCommitmentById(commitmentId) : this.getDappUserCommitmentByAccount(user, dapp));
+		if (!solution) {
+			logger.debug(() => ({ msg: "Not verified - no solution found" }));
+			return {
+				status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
+				verified: false
+			};
+		}
+		if (solution.serverChecked) return {
+			status: "API.USER_ALREADY_VERIFIED",
+			verified: false
+		};
+		await this.db.markDappUserCommitmentsChecked([solution.id]);
+		if (solution.result.status === CaptchaStatus.disapproved) return {
+			status: solution.result.reason || "API.USER_NOT_VERIFIED",
+			verified: false
+		};
+		maxVerifiedTime = maxVerifiedTime || 60 * 1e3;
+		const currentTime = Date.now();
+		const submittedAt = solution.submittedAtTimestamp;
+		if ((submittedAt instanceof Date ? currentTime - submittedAt.getTime() : Number.POSITIVE_INFINITY) > maxVerifiedTime) {
+			logger.debug(() => ({ msg: "Not verified - timed out" }));
+			return {
+				status: "API.USER_NOT_VERIFIED_TIME_EXPIRED",
+				verified: false
+			};
+		}
+		const commitmentUpdates = {};
+		let failStatus;
+		if (userAccessRulesStorage) try {
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, solution, solution.userAccount, solution.headers, solution.coords, solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0, solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0);
+			if (blockPolicy) {
+				logger.info(() => ({
+					msg: "User blocked by access policy in server image verification",
+					data: {
+						userAccount: solution.userAccount,
+						dappAccount: solution.dappAccount,
+						policy: blockPolicy
+					}
+				}));
+				commitmentUpdates.result = {
+					status: CaptchaStatus.disapproved,
+					reason: ResultReason.ACCESS_POLICY_BLOCK
+				};
+				failStatus = ResultReason.ACCESS_POLICY_BLOCK;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: "Failed to check user access policies in server image verification",
+				error
+			}));
+		}
+		if (!failStatus && email && spamEmailDomainCheckingEnabled) try {
+			if (await this.checkSpamEmail(email)) {
+				const emailDomain = email.split("@")[1] || "unknown";
+				logger.info(() => ({
+					msg: "Spam email domain detected in server image verification",
+					data: { emailDomain }
+				}));
+				commitmentUpdates.result = {
+					status: CaptchaStatus.disapproved,
+					reason: ResultReason.SPAM_EMAIL_DOMAIN
+				};
+				failStatus = ResultReason.SPAM_EMAIL_DOMAIN;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: "Failed to check spam email domain in server image verification",
+				error
+			}));
+		}
+		if (!failStatus && spamFilter?.enabled && spamFilter.emailRules?.enabled && email) {
+			const result = evaluateEmailSpamRules(email, spamFilter.emailRules);
+			if (result.isSpam) {
+				logger.info(() => ({
+					msg: "Spam filter rejected email in image verification",
+					data: { reason: result.reason }
+				}));
+				commitmentUpdates.result = {
+					status: CaptchaStatus.disapproved,
+					reason: ResultReason.SPAM_EMAIL_RULE
+				};
+				failStatus = ResultReason.SPAM_EMAIL_RULE;
+			}
+		}
+		const sessionRecord = solution.sessionId ? await this.db.getSessionRecordBySessionId(solution.sessionId) : void 0;
+		const enrichedDnsEvent = await enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? solution.ipInfo?.ip);
+		if (!failStatus) {
+			const check = await this.resolveTrafficFilterCheck(env, solution.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			if (check.isBlocked) {
+				logger.info(() => ({
+					msg: "Traffic filter rejected request",
+					data: {
+						ip,
+						reason: check.reason,
+						dnsPeerIp: enrichedDnsEvent?.peerIp,
+						dnsResolverIp: enrichedDnsEvent?.resolverIp,
+						dnsPeerAsn: getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
+						dnsResolverAsn: getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo),
+						dnsPathValid: enrichedDnsEvent?.pathValid
+					}
+				}));
+				commitmentUpdates.result = {
+					status: CaptchaStatus.disapproved,
+					reason: check.reason
+				};
+				failStatus = check.reason;
+			}
+		}
+		if (storeMetadata && email) commitmentUpdates.metadata = { email };
+		if (ip) {
+			const solutionIpAddress = getIpAddressFromComposite(solution.ipAddress);
+			const ipValidationRules = (await this.db.getClientRecord(dapp))?.settings?.ipValidationRules;
+			commitmentUpdates.providedIp = getCompositeIpAddress(ip);
+			if (!failStatus && ipValidationRules?.enabled === true) {
+				const ipValidation = await deepValidateIpAddress(ip, solutionIpAddress, logger, env.ipInfoService, ipValidationRules, enrichedDnsEvent?.peerIp);
+				if (!ipValidation.isValid) {
+					logger.error(() => ({
+						msg: "IP validation failed for image captcha",
+						data: {
+							ip,
+							solutionIp: solutionIpAddress.address,
+							error: ipValidation.errorMessage,
+							distanceKm: ipValidation.distanceKm
+						}
+					}));
+					failStatus = ResultReason.FAILED_IP_VALIDATION;
+				}
+			}
+		}
+		let isApproved = !failStatus && solution.result.status === CaptchaStatus.approved;
+		let failureStatus = failStatus || ResultReason.USER_NOT_VERIFIED;
+		if (!failStatus && solution.result.status === CaptchaStatus.approved && this.usageCounters) {
+			const ipValue = ip ?? "";
+			this.usageCounters.incrManyAsync(solution.dappAccount, buildAllWindowIncrements("solved", CaptchaType.image, ipValue, solution.userAccount, enrichedDnsEvent?.peerIp));
+		}
+		let score;
+		if (sessionRecord) {
+			const dnsAsymmetry = computeDnsAsymmetry(enrichedDnsEvent, solution.ipInfo, trafficFilter);
+			if (dnsAsymmetry > 0) sessionRecord.scoreComponents = {
+				...sessionRecord.scoreComponents,
+				dnsAsymmetry
+			};
+			score = computeFrictionlessScore(sessionRecord?.scoreComponents);
+			logger.info(() => ({ data: {
+				scoreComponents: sessionRecord?.scoreComponents,
+				score,
+				dnsPeerAsn: getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
+				dnsResolverAsn: getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo)
+			} }));
+			if (!failStatus && disallowWebView === true && (sessionRecord.webView === true || (sessionRecord.scoreComponents.webView || 0) > 0)) {
+				logger.info(() => ({ msg: "Disallowing webview access - user not verified" }));
+				commitmentUpdates.result = {
+					status: CaptchaStatus.disapproved,
+					reason: ResultReason.DISALLOWED_WEBVIEW
+				};
+				failStatus = ResultReason.DISALLOWED_WEBVIEW;
+				isApproved = false;
+				failureStatus = ResultReason.DISALLOWED_WEBVIEW;
+			}
+			if (contextAwareEnabled && sessionRecord.reason === FrictionlessReason$1.CONTEXT_AWARE_VALIDATION_FAILED) logger.info(() => ({ msg: "Context aware validation failed" }));
+		}
+		if (isApproved) {
+			const decisionInput = {
+				userAccount: solution.userAccount,
+				dappAccount: solution.dappAccount,
+				captchaResult: "passed",
+				headers: solution.headers,
+				captchaType: CaptchaType.image,
+				behavioralDataPacked: solution.behavioralDataPacked,
+				deviceCapability: solution.deviceCapability,
+				countryCode: solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0,
+				ipInfo: solution.ipInfo,
+				dnsEvent: enrichedDnsEvent,
+				score,
+				threshold: sessionRecord?.threshold,
+				scoreComponents: sessionRecord?.scoreComponents,
+				decryptedHeadHash: sessionRecord?.decryptedHeadHash,
+				userSitekeyIpHash: sessionRecord?.userSitekeyIpHash,
+				simdReadings: sessionRecord?.simdReadings,
+				frictionlessReason: sessionRecord?.reason,
+				ruleType: sessionRecord?.ruleType,
+				webView: sessionRecord?.webView,
+				iFrame: sessionRecord?.iFrame,
+				coords: solution.coords
+			};
+			try {
+				const decision = await this.decisionMachineRunner.decide(decisionInput, logger);
+				if (decision.decision === DecisionMachineDecision.Deny) {
+					const dmReason = decision.reason || ResultReason.CAPTCHA_DECISION_MACHINE_DENIED;
+					logger.info(() => ({
+						msg: "Decision machine denied user verification",
+						data: { reason: decision.reason }
+					}));
+					commitmentUpdates.result = {
+						status: CaptchaStatus.disapproved,
+						reason: dmReason
+					};
+					isApproved = false;
+					failureStatus = dmReason;
+				}
+			} catch (error) {
+				logger.error(() => ({
+					msg: "Failed to process decision machine",
+					err: error
+				}));
+			}
+		}
+		const writePromises = [];
+		const sideUpdates = {};
+		if (commitmentUpdates.providedIp) sideUpdates.providedIp = commitmentUpdates.providedIp;
+		if (commitmentUpdates.metadata) sideUpdates.metadata = commitmentUpdates.metadata;
+		if (Object.keys(sideUpdates).length > 0) writePromises.push(this.db.updateDappUserCommitment(solution.id, sideUpdates));
+		if (commitmentId) {
+			if (isApproved) writePromises.push(this.db.approveDappUserCommitment(commitmentId));
+			else if (commitmentUpdates.result) writePromises.push(this.db.disapproveDappUserCommitment(commitmentId, commitmentUpdates.result.reason));
+		}
+		const finalResult = isApproved ? { status: CaptchaStatus.approved } : commitmentUpdates.result || {
+			status: CaptchaStatus.disapproved,
+			reason: failureStatus
+		};
+		if (solution.sessionId) writePromises.push(this.updateSessionRecordWithCache(solution.sessionId, {
+			serverChecked: true,
+			result: finalResult
+		}, true));
+		if (writePromises.length > 0) await Promise.all(writePromises);
+		return {
+			status: isApproved ? ResultReason.USER_VERIFIED : failureStatus,
+			verified: isApproved,
+			commitmentId: solution.id.toString(),
+			...score && { score }
+		};
+	}
+	checkLangRules(acceptLanguage) {
+		return checkLangRules(this.config, acceptLanguage);
+	}
+	getVerificationResponse(verified, clientRecord, translateFn, score, commitmentId, reason) {
+		return {
+			...super.getVerificationResponse(verified, clientRecord, translateFn, score, reason),
+			...commitmentId && { [ApiParams.commitmentId]: commitmentId }
+		};
+	}
 };
+//#endregion
+export { ImgCaptchaManager };