@prosopo/provider 4.15.16 → 5.0.0

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -34,7 +34,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 				}
 			}));
 		});
-		const { token, headHash, dapp, user, mode, simdReadings, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl } = _prosopo_types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
+		const { token, headHash, dapp, user, mode, simdReadings, detectorSessionId, detectorUnavailable, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl } = _prosopo_types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
 		const currentUrl = (0, _prosopo_util.sanitisePageUrl)(reportedCurrentUrl);
 		const iframeUrl = (0, _prosopo_util.sanitisePageUrl)(reportedIframeUrl);
 		const isProtect = (0, _prosopo_util.isProtectDeployment)(currentUrl, iframeUrl);
@@ -76,7 +76,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 		const tasks = new require_tasks.Tasks(env, req.logger);
 		const userSitekeyIpHash = require_hashUserIp.hashUserIp(user, normalizedIp, dapp);
 		const [decodedSimdReadings, { existingToken, dedup }, clientRecord] = await Promise.all([
-			require_decryptSimdReadings.decryptIncomingSimdReadings(tasks.frictionlessManager, simdReadings),
+			require_decryptSimdReadings.decryptIncomingSimdReadings(tasks.frictionlessManager, simdReadings, detectorSessionId),
 			require_sessionDedup.resolveSessionDedup(tasks, token, userSitekeyIpHash, req.logger),
 			tasks.db.getClientRecord(dapp)
 		]);
@@ -182,7 +182,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 		const flatHeaders = (0, _prosopo_util.flatten)(req.headers);
 		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
 		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-		const shortCircuitResponse = await require_shortCircuit.runConfiguredCaptchaTypeShortCircuit({
+		const shortCircuitInput = {
 			tasks,
 			env,
 			clientRecord,
@@ -193,19 +193,24 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			flatHeaders,
 			sessionMode,
 			userSitekeyIpHash,
+			requestId: req.requestId,
 			logger: req.logger,
+			detectorUnavailable: detectorUnavailable ?? false,
 			...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
 			...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs }
-		}, res);
+		};
+		const shortCircuitResponse = await require_shortCircuit.runConfiguredCaptchaTypeShortCircuit(shortCircuitInput, res);
 		if (shortCircuitResponse) return shortCircuitResponse;
+		const noDetectorResponse = await require_shortCircuit.runNoDetectorPowFallback(shortCircuitInput, res);
+		if (noDetectorResponse) return noDetectorResponse;
 		const lScore = tasks.frictionlessManager.checkLangRules(req.headers["accept-language"] || "");
 		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
 		const [decryptedPayload, validation, accessPolicies] = await Promise.all([
-			tasks.frictionlessManager.decryptPayload(token, headHash),
+			tasks.frictionlessManager.decryptPayload(token, headHash, detectorSessionId),
 			tasks.frictionlessManager.isValidRequest(clientRecord, _prosopo_types.CaptchaType.frictionless, env),
 			tasks.frictionlessManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)
 		]);
-		const { baseBotScore: rawBaseBotScore, timestamp: rawTimestamp, userId: rawUserId, userAgent: rawUserAgent, webView, iFrame, decryptedHeadHash, decryptionFailed: rawDecryptionFailed, triggeredDetectors, shadowDomPenalty, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst } = decryptedPayload;
+		const { baseBotScore: rawBaseBotScore, timestamp: rawTimestamp, userId: rawUserId, userAgent: rawUserAgent, webView, iFrame, decryptedHeadHash, decryptionFailed: rawDecryptionFailed, triggeredDetectors, shadowDomPenalty, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, bundleId } = decryptedPayload;
 		const detectorOverride = process.env.PROSOPO_TEST_FRICTIONLESS_DETECTOR_OVERRIDE === "1";
 		const baseBotScore = detectorOverride ? 0 : rawBaseBotScore;
 		const timestamp = detectorOverride ? Date.now() : rawTimestamp;
@@ -259,6 +264,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			ipInfo: req.ipInfo,
 			headers: flatHeaders,
 			mode: sessionMode,
+			...bundleId && { bundleId },
 			...decodedSimdReadings && { simdReadings: decodedSimdReadings },
 			...entropyMathRandomFingerprint !== void 0 && { entropyMathRandomFingerprint },
 			...entropyCryptoFingerprint !== void 0 && { entropyCryptoFingerprint },

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -1,27 +1,61 @@
+const require_bundlePool = require("../../../tasks/detection/bundlePool.cjs");
 const require_honeypotResponse = require("./honeypotResponse.cjs");
 require("./constants.cjs");
 let _prosopo_types = require("@prosopo/types");
+let uuid = require("uuid");
 //#region src/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.ts
+var buildBypassSessionParams = (input) => ({
+	token: input.token || `nodetector-${(0, uuid.v4)()}`,
+	score: 0,
+	threshold: input.clientRecord.settings?.frictionlessThreshold ?? .5,
+	scoreComponents: { baseScore: 0 },
+	ipAddress: input.ipAddress,
+	webView: false,
+	iFrame: false,
+	decryptedHeadHash: "",
+	siteKey: input.dapp,
+	ipInfo: input.ipInfo,
+	headers: input.flatHeaders,
+	mode: input.sessionMode,
+	userSitekeyIpHash: input.userSitekeyIpHash,
+	...input.tcpToChelloUs !== void 0 && { tcpToChelloUs: input.tcpToChelloUs },
+	...input.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: input.chelloToHandshakeUs }
+});
+/**
+* Universal "no detector ⇒ PoW" fallback. The detector lives only in the
+* provider-served pool bundles; when none is available for this request there
+* is no way to run (or decrypt) frictionless detection, so the provider serves
+* a real PoW challenge rather than the request failing or silently passing.
+*
+* Fires when EITHER:
+*   - the pool is empty (missing dir, empty dir, or all bundles failed to
+*     load) — no provider has a bundle to assign; or
+*   - the client reported `detectorUnavailable` (it couldn't fetch/run a
+*     bundle this session) — even if the pool itself is populated.
+*
+* Returns null (proceed with normal scored detection) only when the pool has at
+* least one bundle AND the client ran one.
+*/
+var runNoDetectorPowFallback = async (input, res) => {
+	const pool = require_bundlePool.getDetectorBundlePool();
+	const poolEmpty = !pool || pool.size() === 0;
+	if (!poolEmpty && !input.detectorUnavailable) return null;
+	const reason = poolEmpty ? "empty_detector_pool_pow_fallback" : "client_detector_unavailable_pow_fallback";
+	input.logger.warn(() => ({
+		msg: "Frictionless decision",
+		data: {
+			requestId: input.requestId,
+			decision: reason,
+			captchaType: _prosopo_types.CaptchaType.pow
+		}
+	}));
+	require_honeypotResponse.attachHoneypot(res, input.clientRecord);
+	return res.json(await input.tasks.frictionlessManager.sendPowCaptcha(buildBypassSessionParams(input)));
+};
 var runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
 	const configuredType = input.clientRecord.settings?.captchaType;
 	if (!configuredType || configuredType === _prosopo_types.CaptchaType.frictionless) return null;
-	const sessionParams = {
-		token: input.token,
-		score: 0,
-		threshold: input.clientRecord.settings?.frictionlessThreshold ?? .5,
-		scoreComponents: { baseScore: 0 },
-		ipAddress: input.ipAddress,
-		webView: false,
-		iFrame: false,
-		decryptedHeadHash: "",
-		siteKey: input.dapp,
-		ipInfo: input.ipInfo,
-		headers: input.flatHeaders,
-		mode: input.sessionMode,
-		userSitekeyIpHash: input.userSitekeyIpHash,
-		...input.tcpToChelloUs !== void 0 && { tcpToChelloUs: input.tcpToChelloUs },
-		...input.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: input.chelloToHandshakeUs }
-	};
+	const sessionParams = buildBypassSessionParams(input);
 	input.logger.info(() => ({
 		msg: "Frictionless decision",
 		data: {
@@ -42,3 +76,4 @@ var runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
 };
 //#endregion
 exports.runConfiguredCaptchaTypeShortCircuit = runConfiguredCaptchaTypeShortCircuit;
+exports.runNoDetectorPowFallback = runNoDetectorPowFallback;

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -70,7 +70,8 @@ var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (r
 		}));
 		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
 		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
+		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
+		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
 		const userAccessPolicy = (await tasks.imgCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)).find((p) => !p.deferToVerify);
 		const { valid, reason, sessionId: validSessionId, solvedImagesCount } = await tasks.imgCaptchaManager.isValidRequest(clientRecord, _prosopo_types.CaptchaType.image, env, sessionId, userAccessPolicy, normalizedIp);
 		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {

package/dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs

@@ -53,7 +53,8 @@ var getPoWCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req
 		if (!normalizedIp) req.logger.warn(() => ({ msg: "Request missing IP; geoblocking will be skipped" }));
 		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
 		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
+		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
+		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
 		const userAccessPolicy = (await tasks.powCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)).find((p) => !p.deferToVerify);
 		const { valid, reason, sessionId: validSessionId, powDifficulty } = await tasks.powCaptchaManager.isValidRequest(clientSettings, _prosopo_types.CaptchaType.pow, env, sessionId, userAccessPolicy, normalizedIp);
 		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {

package/dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs

@@ -53,7 +53,8 @@ var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => async (
 		if (!normalizedIp) req.logger.warn(() => ({ msg: "Request missing IP; geoblocking will be skipped" }));
 		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
 		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
+		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
+		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
 		const userAccessPolicy = (await tasks.puzzleCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)).find((p) => !p.deferToVerify);
 		const { valid, reason, sessionId: validSessionId } = await tasks.puzzleCaptchaManager.isValidRequest(clientSettings, _prosopo_types.CaptchaType.puzzle, env, sessionId, userAccessPolicy, normalizedIp);
 		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {

package/dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs

@@ -131,7 +131,7 @@ var buildEscalation = async (tasks, result, challenge, handshakeTiming) => {
 	if (!originSession) return void 0;
 	const routed = result.routingOutput;
 	const selectionReason = routed.reason ?? originSession.reason;
-	const newSession = await tasks.frictionlessManager.createSession(originSession.token, originSession.score, originSession.threshold, originSession.scoreComponents, originSession.ipAddress, routed.captchaType, originSession.siteKey ?? powRecord.dappAccount, routed.captchaType === _prosopo_types.CaptchaType.image ? routed.solvedImagesCount ?? originSession.solvedImagesCount : void 0, void 0, originSession.userSitekeyIpHash, originSession.webView, originSession.iFrame, originSession.decryptedHeadHash, selectionReason, void 0, void 0, originSession.ipInfo, originSession.headers, originSession.mode, originSession.simdReadings, originSession.entropyMathRandomFingerprint, originSession.entropyCryptoFingerprint, originSession.entropyWallClockOffsetMs, originSession.entropyMathRandomFirst, originSession.currentUrl, handshakeTiming?.tcpToChelloUs, handshakeTiming?.chelloToHandshakeUs, true, originSession.iframeUrl, originSession.isProtect);
+	const newSession = await tasks.frictionlessManager.createSession(originSession.token, originSession.score, originSession.threshold, originSession.scoreComponents, originSession.ipAddress, routed.captchaType, originSession.siteKey ?? powRecord.dappAccount, routed.captchaType === _prosopo_types.CaptchaType.image ? routed.solvedImagesCount ?? originSession.solvedImagesCount : void 0, void 0, originSession.userSitekeyIpHash, originSession.webView, originSession.iFrame, originSession.decryptedHeadHash, selectionReason, void 0, void 0, originSession.ipInfo, originSession.headers, originSession.mode, originSession.simdReadings, originSession.entropyMathRandomFingerprint, originSession.entropyCryptoFingerprint, originSession.entropyWallClockOffsetMs, originSession.entropyMathRandomFirst, originSession.bundleId, originSession.currentUrl, handshakeTiming?.tcpToChelloUs, handshakeTiming?.chelloToHandshakeUs, true, originSession.iframeUrl, originSession.isProtect);
 	if (tasks.writeQueue) await tasks.writeQueue.cacheSessionEscalation(powRecord.sessionId, newSession.sessionId);
 	return {
 		captchaType: routed.captchaType,

package/dist/cjs/api/captcha.cjs

@@ -1,4 +1,5 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_assignDetectorBundle = require("./captcha/assignDetectorBundle.cjs");
 const require_checkSpamEmail = require("./captcha/checkSpamEmail.cjs");
 const require_handler = require("./captcha/getFrictionlessCaptchaChallenge/handler.cjs");
 const require_getImageCaptchaChallenge = require("./captcha/getImageCaptchaChallenge.cjs");
@@ -65,6 +66,11 @@ function prosopoRouter(env) {
 	*/
 	router.post(_prosopo_types.ClientApiPaths.GetFrictionlessCaptchaChallenge, asyncHandler(require_handler.default(env, userAccessRulesStorage)));
 	/**
+	* Assigns a precomputed detector bundle for this session (or signals the
+	* bundled fallback when no pool is loaded).
+	*/
+	router.post(_prosopo_types.ClientApiPaths.AssignDetectorBundle, (req, res, next) => require_assignDetectorBundle.default(env)(req, res, next));
+	/**
 	* Supplies a Puzzle challenge to a Dapp User
 	*/
 	router.post(_prosopo_types.ClientApiPaths.GetPuzzleCaptchaChallenge, asyncHandler(require_getPuzzleCaptchaChallenge.default(env, userAccessRulesStorage)));

package/dist/cjs/api/startProviderApi.cjs

@@ -1,6 +1,7 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_metrics = require("./metrics.cjs");
 const require_blacklistRequestInspector = require("./blacklistRequestInspector.cjs");
+const require_bundlePool = require("../tasks/detection/bundlePool.cjs");
 const require_block = require("./block.cjs");
 const require_captcha = require("./captcha.cjs");
 const require_verify = require("./verify.cjs");
@@ -15,15 +16,15 @@ const require_ipInfoMiddleware = require("./ipInfoMiddleware.cjs");
 const require_robotsMiddleware = require("./robotsMiddleware.cjs");
 let _prosopo_logger = require("@prosopo/logger");
 let _prosopo_types = require("@prosopo/types");
-let node_https = require("node:https");
-node_https = require_runtime.__toESM(node_https, 1);
 let node_fs = require("node:fs");
 node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+let node_https = require("node:https");
+node_https = require_runtime.__toESM(node_https, 1);
 let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let express = require("express");
 express = require_runtime.__toESM(express, 1);
-let node_path = require("node:path");
-node_path = require_runtime.__toESM(node_path, 1);
 let node_url = require("node:url");
 let _prosopo_locale = require("@prosopo/locale");
 let _prosopo_user_access_policy_api = require("@prosopo/user-access-policy/api");
@@ -32,6 +33,12 @@ cors = require_runtime.__toESM(cors, 1);
 let express_rate_limit = require("express-rate-limit");
 express_rate_limit = require_runtime.__toESM(express_rate_limit, 1);
 //#region src/api/startProviderApi.ts
+/**
+* Body-size ceiling for the detector-pool push. ~830 KB/bundle × 100 bundles
+* ≈ 86 MB encoded; 128 MB leaves headroom without approaching the 512 MiB V8
+* string limit that ultimately bounds a single-body push at ~620 bundles.
+*/
+var DETECTOR_POOL_BODY_LIMIT = "128mb";
 var __dirname$1 = node_path.default.dirname((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
 var certPath = node_path.default.resolve(__dirname$1, "../../../../certs");
 var keyPath = node_path.default.join(certPath, "server.key");
@@ -48,7 +55,7 @@ var isTlsAvailable = () => {
 * @returns Array of ClientApiPaths excluding verify and spam routes
 */
 var getClientApiPathsExpectingProsopoHeaders = () => {
-	return Object.values(_prosopo_types.ClientApiPaths).filter((path) => path.indexOf("verify") === -1 && path.indexOf("spam") === -1);
+	return Object.values(_prosopo_types.ClientApiPaths).filter((path) => path.indexOf("verify") === -1 && path.indexOf("spam") === -1 && path.indexOf("detector/assign") === -1);
 };
 /**
 * Extract authenticated user address from JWT for rate limiting
@@ -95,6 +102,17 @@ var getUserFromJWT = (req) => {
 */
 async function startProviderApi(env, admin = false, port) {
 	env.logger.info(() => ({ msg: "Starting Prosopo API" }));
+	const detectorPoolDir = process.env.PROSOPO_DETECTOR_POOL_DIR ?? "/app/data/detector-pool";
+	require_bundlePool.initDetectorBundlePool(detectorPoolDir, {
+		info: (msg, data) => env.logger.info(() => ({
+			msg,
+			data
+		})),
+		warn: (msg, data) => env.logger.warn(() => ({
+			msg,
+			data
+		}))
+	}, process.env.PROSOPO_DETECTOR_POOL_RELEASE);
 	const apiApp = (0, express.default)();
 	const apiPort = port || env.config.server?.port;
 	const apiEndpointAdapter = (0, _prosopo_api_express_router.createApiExpressDefaultEndpointAdapter)((0, _prosopo_logger.parseLogLevel)(env.config.logLevel));
@@ -129,6 +147,7 @@ async function startProviderApi(env, admin = false, port) {
 		],
 		maxAge: 86400
 	}));
+	apiApp.use(_prosopo_types.AdminApiPaths.ReplaceDetectorPool, express.default.json({ limit: DETECTOR_POOL_BODY_LIMIT }));
 	apiApp.use(express.default.json({ limit: "1mb" }));
 	apiApp.use(require_public.publicRouter(env));
 	apiApp.use(require_metrics.metricsMiddleware());

package/dist/cjs/tasks/captchaManager.cjs

@@ -1,5 +1,6 @@
 const require_compositeIpAddress = require("../compositeIpAddress.cjs");
 const require_blacklistRequestInspector = require("../api/blacklistRequestInspector.cjs");
+const require_bundlePool = require("./detection/bundlePool.cjs");
 const require_checkTrafficFilter = require("./spam/checkTrafficFilter.cjs");
 const require_enrichDnsEvent = require("./dnsEvent/enrichDnsEvent.cjs");
 const require_checkSpamEmail = require("./spam/checkSpamEmail.cjs");
@@ -59,19 +60,24 @@ var CaptchaManager = class CaptchaManager {
 		this.scheduleMongoSessionUpdate(sessionId, updates, streamToCentral);
 	}
 	/**
-	* Decrypt with the active detector keys and strip the throwaway
-	* `timestamp` field. Returns `undefined` when no key decrypts.
+	* Decrypt with the session's detector pool bundle and strip the throwaway
+	* `timestamp` field. Returns `undefined` when no bundle is resolved or
+	* decryption fails.
 	*/
-	async decryptSimdReadingsForAttach(simdReadingsCiphertext) {
-		const decryptKeys = [...await this.getDetectorKeys(), process.env.BOT_DECRYPTION_KEY];
-		const decrypted = await this.decryptSimdReadings(simdReadingsCiphertext, decryptKeys);
+	async decryptSimdReadingsForAttach(simdReadingsCiphertext, bundle) {
+		const decrypted = await this.decryptSimdReadings(simdReadingsCiphertext, bundle);
 		if (!decrypted) return void 0;
 		const { timestamp: _ignored, ...readings } = decrypted;
 		return readings;
 	}
-	/** Decrypt + first-hop-wins attach. No-op on decrypt failure. */
+	/**
+	* Decrypt + first-hop-wins attach. Resolves the session's detector pool
+	* bundle (promoted onto the session record at frictionless time) to decrypt.
+	* No-op on decrypt failure / no bundle.
+	*/
 	async decryptAndAttachSimdReadingsIfAbsent(sessionId, simdReadingsCiphertext, stage) {
-		const readings = await this.decryptSimdReadingsForAttach(simdReadingsCiphertext);
+		const bundle = await this.resolveBundleBySessionId(sessionId);
+		const readings = await this.decryptSimdReadingsForAttach(simdReadingsCiphertext, bundle);
 		if (!readings) return;
 		await this.recordSessionSimdReadingsIfAbsentWithCache(sessionId, readings, stage);
 	}
@@ -271,62 +277,81 @@ var CaptchaManager = class CaptchaManager {
 	async getPrioritisedAccessPolicies(userAccessRulesStorage, clientId, userScope, options) {
 		return require_blacklistRequestInspector.getPrioritisedAccessRule(userAccessRulesStorage, userScope, clientId, options);
 	}
-	async getDetectorKeys() {
-		return await this.db.getDetectorKeys();
+	/**
+	* Resolve a detector pool bundle's decryption material from a `bundleId`
+	* (in-memory pool lookup). Returns undefined when the id is absent or the
+	* bundle is no longer in the pool.
+	*/
+	resolveBundleById(bundleId) {
+		const bundle = bundleId ? require_bundlePool.getDetectorBundlePool()?.get(bundleId) : void 0;
+		return bundle ? {
+			key: bundle.privateKey,
+			innerConfig: bundle.innerConfig
+		} : void 0;
+	}
+	/**
+	* Resolve the detector pool bundle for a session via its short-lived
+	* `detectorSessionId → bundleId` Redis binding (used at the frictionless hop,
+	* before the binding is promoted onto the durable session record). Returns
+	* the bundleId too so the caller can promote it onto the session.
+	*/
+	async resolveBundleByDetectorSession(detectorSessionId) {
+		if (!detectorSessionId || !this.writeQueue) return void 0;
+		const bundleId = await this.writeQueue.getDetectorBundle(detectorSessionId);
+		const decrypt = this.resolveBundleById(bundleId);
+		return bundleId && decrypt ? {
+			...decrypt,
+			bundleId
+		} : void 0;
+	}
+	/**
+	* Resolve the detector pool bundle for a session via the `bundleId` promoted
+	* onto its durable session record (used at later hops — SIMD attach,
+	* PoW/puzzle/image solution submit — after the Redis binding has expired).
+	* Cache-first (Redis), Mongo fallback.
+	*/
+	async resolveBundleBySessionId(sessionId) {
+		if (!sessionId) return void 0;
+		const cached = this.writeQueue ? await this.writeQueue.getCachedSession(sessionId) : void 0;
+		const bundleId = (typeof cached?.bundleId === "string" ? cached.bundleId : void 0) ?? (await this.db.getSessionRecordBySessionId(sessionId))?.bundleId;
+		return this.resolveBundleById(bundleId);
 	}
 	/**
 	* Decrypt the catcher's WASM SIMD CPU fingerprint readings via the
 	* obfuscated `decodeSimd.js` bundle (source lives in the private
-	* @prosopo/catcher repo). Mirrors `decryptBehavioralData`: tries each
-	* detector key in turn (loaded by the caller, with the env-var key as
-	* fallback). Returns null when no key works so the caller can drop
-	* the field rather than fail the whole request.
+	* @prosopo/catcher repo). The detector lives only in provider-served pool
+	* bundles, so decryption uses that session's single bundle (RSA key + inner
+	* cipher) — there is no key pool. Returns null when no bundle is resolved or
+	* decryption fails, so the caller can drop the field rather than fail the
+	* whole request.
 	*/
-	async decryptSimdReadings(encryptedData, decryptKeys) {
-		const decryptSimdReadings = (await Promise.resolve().then(() => require("./detection/decodeSimd.cjs"))).default;
-		const validKeys = decryptKeys.filter((k) => k);
-		if (validKeys.length === 0) {
-			this.logger?.error(() => ({ msg: "No decryption keys provided for SIMD readings" }));
+	async decryptSimdReadings(encryptedData, bundle) {
+		if (!bundle) {
+			this.logger?.warn(() => ({ msg: "No detector bundle resolved for SIMD readings — dropping field" }));
 			return null;
 		}
-		for (const [keyIndex, key] of validKeys.entries()) try {
-			return await decryptSimdReadings(encryptedData, key);
+		const decryptSimdReadings = (await Promise.resolve().then(() => require("./detection/decodeSimd.cjs"))).default;
+		try {
+			return await decryptSimdReadings(encryptedData, bundle.key, bundle.innerConfig);
 		} catch (err) {
-			this.logger?.debug(() => ({
-				msg: "Failed to decrypt SIMD readings with key, trying next",
-				data: {
-					keyIndex: keyIndex + 1,
-					totalKeys: validKeys.length,
-					err
-				}
+			this.logger?.warn(() => ({
+				msg: "Failed to decrypt SIMD readings with the session's bundle",
+				data: { err }
 			}));
+			return null;
 		}
-		this.logger?.warn(() => ({
-			msg: "Failed to decrypt SIMD readings with all available keys",
-			data: { totalKeysAttempted: validKeys.length }
-		}));
-		return null;
 	}
-	async decryptBehavioralData(encryptedData, decryptKeys) {
-		const decryptBehavioralData = (await Promise.resolve().then(() => require("./detection/decodeBehavior.cjs"))).default;
-		const validKeys = decryptKeys.filter((k) => k);
-		if (validKeys.length === 0) {
-			this.logger?.error(() => ({ msg: "No decryption keys provided for behavioral data" }));
+	async decryptBehavioralData(encryptedData, bundle) {
+		if (!bundle) {
+			this.logger?.warn(() => ({ msg: "No detector bundle resolved for behavioral data — dropping field" }));
 			return null;
 		}
-		for (const [keyIndex, key] of validKeys.entries()) try {
-			this.logger?.debug(() => ({
-				msg: "Attempting to decrypt behavioral data",
-				data: {
-					keyIndex: keyIndex + 1,
-					totalKeys: validKeys.length
-				}
-			}));
-			const result = await decryptBehavioralData(encryptedData, key);
+		const decryptBehavioralData = (await Promise.resolve().then(() => require("./detection/decodeBehavior.cjs"))).default;
+		try {
+			const result = await decryptBehavioralData(encryptedData, bundle.key, bundle.innerConfig);
 			this.logger?.info(() => ({
 				msg: "Behavioral data decrypted successfully",
 				data: {
-					keyIndex: keyIndex + 1,
 					c1Length: result.collector1?.length || 0,
 					c2Length: result.collector2?.length || 0,
 					c3Length: result.collector3?.length || 0,
@@ -335,20 +360,12 @@ var CaptchaManager = class CaptchaManager {
 			}));
 			return result;
 		} catch (error) {
-			this.logger?.debug(() => ({
-				msg: "Failed to decrypt with key, trying next",
-				data: {
-					keyIndex: keyIndex + 1,
-					totalKeys: validKeys.length,
-					err: error
-				}
+			this.logger?.warn(() => ({
+				msg: "Failed to decrypt behavioral data with the session's bundle",
+				data: { err: error }
 			}));
+			return null;
 		}
-		this.logger?.error(() => ({
-			msg: "Failed to decrypt behavioral data with all available keys",
-			data: { totalKeysAttempted: validKeys.length }
-		}));
-		return null;
 	}
 	/**
 	* Checks if a user should be hard blocked based on access policies

package/dist/cjs/tasks/client/clientTasks.cjs

@@ -2,23 +2,10 @@ const require_validateAddress = require("../../api/validateAddress.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_database = require("@prosopo/database");
 let _prosopo_types = require("@prosopo/types");
-let node_crypto = require("node:crypto");
+require("node:crypto");
 let _prosopo_util = require("@prosopo/util");
 //#region src/tasks/client/clientTasks.ts
 var SAMPLE_SIZE = 75;
-var isValidPrivateKey = (privateKeyString) => {
-	const privateKey = Buffer.from(privateKeyString, "base64").toString("ascii");
-	try {
-		(0, node_crypto.createPrivateKey)({
-			key: privateKey,
-			format: "pem",
-			type: "pkcs8"
-		});
-		return true;
-	} catch (error) {
-		return false;
-	}
-};
 var ClientTaskManager = class {
 	constructor(config, logger, db) {
 		this.config = config;
@@ -196,21 +183,6 @@ var ClientTaskManager = class {
 		}
 		await this.providerDB.removeClientRecords(accounts);
 	}
-	async updateDetectorKey(detectorKey) {
-		if (!isValidPrivateKey(detectorKey)) throw new _prosopo_common.ProsopoApiError("INVALID_DETECTOR_KEY", {
-			context: { detectorKey },
-			logger: this.logger
-		});
-		await this.providerDB.storeDetectorKey(detectorKey);
-		return await this.providerDB.getDetectorKeys();
-	}
-	async removeDetectorKey(detectorKey, expirationInSeconds) {
-		if (!isValidPrivateKey(detectorKey)) throw new _prosopo_common.ProsopoApiError("INVALID_DETECTOR_KEY", {
-			context: { detectorKey },
-			logger: this.logger
-		});
-		await this.providerDB.removeDetectorKey(detectorKey, expirationInSeconds);
-	}
 	async updateDecisionMachine(scope, runtime, source, dappAccount, language, name, version, captchaType, kind) {
 		if (scope === _prosopo_types.DecisionMachineScope.Dapp && !dappAccount) throw new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
 			context: {