@prosopo/provider 5.0.0 → 5.0.3

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs

@@ -13,6 +13,44 @@ var runDecisionMachine = async (input, handle) => {
 	const { tasks, env, clientRecord, dapp, userSitekeyIpHash, flatHeaders, ipInfo } = input;
 	const { req, res } = handle;
 	let { botScore, scoreComponents } = input;
+	if (!input.token) {
+		req.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "missing_token",
+				captchaType: _prosopo_types.CaptchaType.image
+			}
+		}));
+		require_metrics.recordFrictionlessDecision("missing_token");
+		require_honeypotResponse.attachHoneypot(res, clientRecord);
+		return res.json(await tasks.frictionlessManager.sendImageCaptcha({
+			solvedImagesCount: Math.min(3, clientRecord.settings.imageMaxRounds),
+			userSitekeyIpHash,
+			reason: _prosopo_types.FrictionlessReason.MISSING_TOKEN,
+			siteKey: dapp,
+			ipInfo,
+			headers: flatHeaders
+		}));
+	}
+	if (!input.headHash) {
+		req.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "missing_head_hash",
+				captchaType: _prosopo_types.CaptchaType.image
+			}
+		}));
+		require_metrics.recordFrictionlessDecision("missing_head_hash");
+		require_honeypotResponse.attachHoneypot(res, clientRecord);
+		return res.json(await tasks.frictionlessManager.sendImageCaptcha({
+			solvedImagesCount: Math.min(2, clientRecord.settings.imageMaxRounds),
+			userSitekeyIpHash,
+			reason: _prosopo_types.FrictionlessReason.MISSING_HEAD_HASH,
+			siteKey: dapp,
+			ipInfo,
+			headers: flatHeaders
+		}));
+	}
 	if (input.decryptionFailed) {
 		req.logger.info(() => ({
 			msg: "Frictionless decision",

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -20,6 +20,7 @@ const require_shortCircuit = require("./shortCircuit.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
+let uuid = require("uuid");
 let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 //#region src/api/captcha/getFrictionlessCaptchaChallenge/handler.ts
 var handler_default = (env, userAccessRulesStorage) => async (req, res, next) => {
@@ -34,10 +35,11 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 				}
 			}));
 		});
-		const { token, headHash, dapp, user, mode, simdReadings, detectorSessionId, detectorUnavailable, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl } = _prosopo_types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
+		const { token, headHash, dapp, user, mode, simdReadings, detectorSessionId, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl } = _prosopo_types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
 		const currentUrl = (0, _prosopo_util.sanitisePageUrl)(reportedCurrentUrl);
 		const iframeUrl = (0, _prosopo_util.sanitisePageUrl)(reportedIframeUrl);
 		const isProtect = (0, _prosopo_util.isProtectDeployment)(currentUrl, iframeUrl);
+		const sessionToken = token || `notoken-${(0, uuid.v4)()}`;
 		const normalizedIp = require_normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
 		const sessionMode = mode === _prosopo_types.ModeEnum.invisible ? _prosopo_types.ModeEnum.invisible : void 0;
 		req.logger.info(() => ({
@@ -195,14 +197,14 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			userSitekeyIpHash,
 			requestId: req.requestId,
 			logger: req.logger,
-			detectorUnavailable: detectorUnavailable ?? false,
+			...detectorSessionId && { detectorSessionId },
 			...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
 			...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs }
 		};
 		const shortCircuitResponse = await require_shortCircuit.runConfiguredCaptchaTypeShortCircuit(shortCircuitInput, res);
 		if (shortCircuitResponse) return shortCircuitResponse;
-		const noDetectorResponse = await require_shortCircuit.runNoDetectorPowFallback(shortCircuitInput, res);
-		if (noDetectorResponse) return noDetectorResponse;
+		const emptyPoolResponse = await require_shortCircuit.runEmptyDetectorPoolPowFallback(shortCircuitInput, res);
+		if (emptyPoolResponse) return emptyPoolResponse;
 		const lScore = tasks.frictionlessManager.checkLangRules(req.headers["accept-language"] || "");
 		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
 		const [decryptedPayload, validation, accessPolicies] = await Promise.all([
@@ -249,7 +251,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			...shadowDomPenalty !== void 0 && { shadowDomPenalty }
 		};
 		tasks.frictionlessManager.setSessionParams({
-			token,
+			token: sessionToken,
 			score: botScore,
 			threshold: botThreshold,
 			scoreComponents,
@@ -329,6 +331,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			botScore,
 			scoreComponents,
 			token,
+			headHash,
 			botThreshold,
 			currentUrl,
 			iframeUrl

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -4,58 +4,55 @@ require("./constants.cjs");
 let _prosopo_types = require("@prosopo/types");
 let uuid = require("uuid");
 //#region src/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.ts
-var buildBypassSessionParams = (input) => ({
-	token: input.token || `nodetector-${(0, uuid.v4)()}`,
-	score: 0,
-	threshold: input.clientRecord.settings?.frictionlessThreshold ?? .5,
-	scoreComponents: { baseScore: 0 },
-	ipAddress: input.ipAddress,
-	webView: false,
-	iFrame: false,
-	decryptedHeadHash: "",
-	siteKey: input.dapp,
-	ipInfo: input.ipInfo,
-	headers: input.flatHeaders,
-	mode: input.sessionMode,
-	userSitekeyIpHash: input.userSitekeyIpHash,
-	...input.tcpToChelloUs !== void 0 && { tcpToChelloUs: input.tcpToChelloUs },
-	...input.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: input.chelloToHandshakeUs }
-});
+var buildBypassSessionParams = async (input) => {
+	const bundleId = input.detectorSessionId ? (await input.tasks.frictionlessManager.resolveBundleByDetectorSession(input.detectorSessionId))?.bundleId : void 0;
+	return {
+		token: input.token || `nodetector-${(0, uuid.v4)()}`,
+		score: 0,
+		threshold: input.clientRecord.settings?.frictionlessThreshold ?? .5,
+		scoreComponents: { baseScore: 0 },
+		ipAddress: input.ipAddress,
+		webView: false,
+		iFrame: false,
+		decryptedHeadHash: "",
+		siteKey: input.dapp,
+		ipInfo: input.ipInfo,
+		headers: input.flatHeaders,
+		mode: input.sessionMode,
+		userSitekeyIpHash: input.userSitekeyIpHash,
+		...bundleId && { bundleId },
+		...input.tcpToChelloUs !== void 0 && { tcpToChelloUs: input.tcpToChelloUs },
+		...input.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: input.chelloToHandshakeUs }
+	};
+};
 /**
-* Universal "no detector ⇒ PoW" fallback. The detector lives only in the
-* provider-served pool bundles; when none is available for this request there
-* is no way to run (or decrypt) frictionless detection, so the provider serves
-* a real PoW challenge rather than the request failing or silently passing.
-*
-* Fires when EITHER:
-*   - the pool is empty (missing dir, empty dir, or all bundles failed to
-*     load) — no provider has a bundle to assign; or
-*   - the client reported `detectorUnavailable` (it couldn't fetch/run a
-*     bundle this session) — even if the pool itself is populated.
+* Empty-pool PoW fallback. The detector lives only in the provider-served pool
+* bundles; when this provider has none to assign (missing dir, empty dir, or
+* all bundles failed to load) no client could have run detection, so it serves
+* a real PoW challenge rather than failing the request.
 *
-* Returns null (proceed with normal scored detection) only when the pool has at
-* least one bundle AND the client ran one.
+* This is a provider-side condition only. Nothing a client sends — an empty
+* token included — can reach this path; a client that ran no detector is
+* handled by the decision machine's missing-token gate.
 */
-var runNoDetectorPowFallback = async (input, res) => {
+var runEmptyDetectorPoolPowFallback = async (input, res) => {
 	const pool = require_bundlePool.getDetectorBundlePool();
-	const poolEmpty = !pool || pool.size() === 0;
-	if (!poolEmpty && !input.detectorUnavailable) return null;
-	const reason = poolEmpty ? "empty_detector_pool_pow_fallback" : "client_detector_unavailable_pow_fallback";
+	if (pool && pool.size() > 0) return null;
 	input.logger.warn(() => ({
 		msg: "Frictionless decision",
 		data: {
 			requestId: input.requestId,
-			decision: reason,
+			decision: "empty_detector_pool_pow_fallback",
 			captchaType: _prosopo_types.CaptchaType.pow
 		}
 	}));
 	require_honeypotResponse.attachHoneypot(res, input.clientRecord);
-	return res.json(await input.tasks.frictionlessManager.sendPowCaptcha(buildBypassSessionParams(input)));
+	return res.json(await input.tasks.frictionlessManager.sendPowCaptcha(await buildBypassSessionParams(input)));
 };
 var runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
 	const configuredType = input.clientRecord.settings?.captchaType;
 	if (!configuredType || configuredType === _prosopo_types.CaptchaType.frictionless) return null;
-	const sessionParams = buildBypassSessionParams(input);
+	const sessionParams = await buildBypassSessionParams(input);
 	input.logger.info(() => ({
 		msg: "Frictionless decision",
 		data: {
@@ -76,4 +73,4 @@ var runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
 };
 //#endregion
 exports.runConfiguredCaptchaTypeShortCircuit = runConfiguredCaptchaTypeShortCircuit;
-exports.runNoDetectorPowFallback = runNoDetectorPowFallback;
+exports.runEmptyDetectorPoolPowFallback = runEmptyDetectorPoolPowFallback;

package/dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs

@@ -131,7 +131,7 @@ var buildEscalation = async (tasks, result, challenge, handshakeTiming) => {
 	if (!originSession) return void 0;
 	const routed = result.routingOutput;
 	const selectionReason = routed.reason ?? originSession.reason;
-	const newSession = await tasks.frictionlessManager.createSession(originSession.token, originSession.score, originSession.threshold, originSession.scoreComponents, originSession.ipAddress, routed.captchaType, originSession.siteKey ?? powRecord.dappAccount, routed.captchaType === _prosopo_types.CaptchaType.image ? routed.solvedImagesCount ?? originSession.solvedImagesCount : void 0, void 0, originSession.userSitekeyIpHash, originSession.webView, originSession.iFrame, originSession.decryptedHeadHash, selectionReason, void 0, void 0, originSession.ipInfo, originSession.headers, originSession.mode, originSession.simdReadings, originSession.entropyMathRandomFingerprint, originSession.entropyCryptoFingerprint, originSession.entropyWallClockOffsetMs, originSession.entropyMathRandomFirst, originSession.bundleId, originSession.currentUrl, handshakeTiming?.tcpToChelloUs, handshakeTiming?.chelloToHandshakeUs, true, originSession.iframeUrl, originSession.isProtect);
+	const newSession = await tasks.frictionlessManager.createSession(originSession.token, originSession.score, originSession.threshold, originSession.scoreComponents, originSession.ipAddress, routed.captchaType, originSession.siteKey ?? powRecord.dappAccount, routed.captchaType === _prosopo_types.CaptchaType.image ? routed.solvedImagesCount ?? originSession.solvedImagesCount : void 0, void 0, originSession.userSitekeyIpHash, originSession.webView, originSession.iFrame, originSession.decryptedHeadHash, selectionReason, void 0, void 0, originSession.ipInfo, originSession.headers, originSession.mode, originSession.simdReadings, originSession.entropyMathRandomFingerprint, originSession.entropyCryptoFingerprint, originSession.entropyWallClockOffsetMs, originSession.entropyMathRandomFirst, originSession.bundleId, originSession.currentUrl, handshakeTiming?.tcpToChelloUs, handshakeTiming?.chelloToHandshakeUs, true, originSession.iframeUrl, originSession.isProtect, originSession.sessionId);
 	if (tasks.writeQueue) await tasks.writeQueue.cacheSessionEscalation(powRecord.sessionId, newSession.sessionId);
 	return {
 		captchaType: routed.captchaType,

package/dist/cjs/api/startProviderApi.cjs

@@ -76,6 +76,19 @@ var getUserFromJWT = (req) => {
 	}
 };
 /**
+* `.listen()` returns before the socket is bound, so a bind failure such as
+* EADDRINUSE arrives later as an 'error' event — an uncaught exception unless
+* something is waiting on it. Settle on whichever event comes first so the
+* caller gets a rejection it can handle.
+*/
+var awaitListening = (server) => new Promise((resolve, reject) => {
+	server.once("error", reject);
+	server.once("listening", () => {
+		server.removeListener("error", reject);
+		resolve();
+	});
+});
+/**
 * Start the Prosopo Provider API server
 *
 * This function creates and configures an Express server with all necessary middleware
@@ -223,22 +236,24 @@ async function startProviderApi(env, admin = false, port) {
 			key: node_fs.default.readFileSync(keyPath),
 			cert: node_fs.default.readFileSync(crtPath)
 		};
-		return node_https.default.createServer(httpsOptions, apiApp).listen(apiPort, () => {
-			env.logger.info(() => ({
-				data: {
-					apiPort,
-					protocol: "https"
-				},
-				msg: "Prosopo app listening with HTTPS"
-			}));
-		});
-	}
-	return apiApp.listen(apiPort, () => {
+		const httpsServer = node_https.default.createServer(httpsOptions, apiApp).listen(apiPort);
+		await awaitListening(httpsServer);
 		env.logger.info(() => ({
-			data: { apiPort },
-			msg: "Prosopo app listening"
+			data: {
+				apiPort,
+				protocol: "https"
+			},
+			msg: "Prosopo app listening with HTTPS"
 		}));
-	});
+		return httpsServer;
+	}
+	const server = apiApp.listen(apiPort);
+	await awaitListening(server);
+	env.logger.info(() => ({
+		data: { apiPort },
+		msg: "Prosopo app listening"
+	}));
+	return server;
 }
 //#endregion
 exports.getClientApiPathsExpectingProsopoHeaders = getClientApiPathsExpectingProsopoHeaders;

package/dist/cjs/api/verify.cjs

@@ -317,7 +317,7 @@ function prosopoVerifyRouter(env) {
 			}
 			const dappPair = env.keyring.addFromAddress(dapp);
 			(0, _prosopo_api_express_router.verifySignature)(dappSignature, timestamp.toString(), dappPair);
-			const { verified, score } = await tasks.puzzleCaptchaManager.serverVerifyPuzzleCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata);
+			const { verified, score } = await tasks.puzzleCaptchaManager.serverVerifyPuzzleCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata);
 			const verificationResponse = tasks.puzzleCaptchaManager.getVerificationResponse(verified, clientRecord, req.i18n.t, score);
 			return res.json(verificationResponse);
 		} catch (err) {

package/dist/cjs/tasks/captchaManager.cjs

@@ -71,6 +71,51 @@ var CaptchaManager = class CaptchaManager {
 		return readings;
 	}
 	/**
+	* Read a session and, if it's an escalation missing one of the
+	* inherently-origin-populated fields, walk to `originSessionId` and fill
+	* the gap. Intended for the decision-machine input read path only —
+	* `simdReadings`, `dnsEvent`, `entropyMathRandomFingerprint` etc. are
+	* populated on the origin session (SIMD via pow-submit's fire-and-forget
+	* attach; DNS via the sidecar's origin-TLS-scoped patch) and don't
+	* automatically end up on the escalation record because
+	* `buildEscalation` reads the origin from Mongo before the async writes
+	* settle. Rather than duplicating the origin's state onto every
+	* escalation at write time, keep the origin as the source of truth and
+	* fall back to it at read time.
+	*
+	* Fields intentionally NOT walked:
+	*   - captchaType / sessionId / score / threshold / scoreComponents /
+	*     ipAddress / ipInfo / headers — these describe the escalation
+	*     itself and must never be overridden by the origin.
+	*   - Anything already present on the escalation — first-write wins.
+	*
+	* Non-escalation sessions and escalations without `originSessionId`
+	* (older records) fall through as no-op.
+	*/
+	async getSessionRecordWithOriginFallback(sessionId) {
+		const session = await this.db.getSessionRecordBySessionId(sessionId);
+		if (!session) return void 0;
+		if (!session.originSessionId) return session;
+		const needsSimd = session.simdReadings === void 0 || session.simdReadings === null;
+		const needsDns = session.dnsEvent === void 0 || session.dnsEvent === null;
+		const needsEntropyMath = session.entropyMathRandomFingerprint === void 0;
+		const needsEntropyCrypto = session.entropyCryptoFingerprint === void 0;
+		const needsEntropyWall = session.entropyWallClockOffsetMs === void 0;
+		const needsEntropyFirst = session.entropyMathRandomFirst === void 0;
+		if (!needsSimd && !needsDns && !needsEntropyMath && !needsEntropyCrypto && !needsEntropyWall && !needsEntropyFirst) return session;
+		const origin = await this.db.getSessionRecordBySessionId(session.originSessionId);
+		if (!origin) return session;
+		return {
+			...session,
+			...needsSimd && origin.simdReadings && { simdReadings: origin.simdReadings },
+			...needsDns && origin.dnsEvent && { dnsEvent: origin.dnsEvent },
+			...needsEntropyMath && origin.entropyMathRandomFingerprint !== void 0 && { entropyMathRandomFingerprint: origin.entropyMathRandomFingerprint },
+			...needsEntropyCrypto && origin.entropyCryptoFingerprint !== void 0 && { entropyCryptoFingerprint: origin.entropyCryptoFingerprint },
+			...needsEntropyWall && origin.entropyWallClockOffsetMs !== void 0 && { entropyWallClockOffsetMs: origin.entropyWallClockOffsetMs },
+			...needsEntropyFirst && origin.entropyMathRandomFirst !== void 0 && { entropyMathRandomFirst: origin.entropyMathRandomFirst }
+		};
+	}
+	/**
 	* Decrypt + first-hop-wins attach. Resolves the session's detector pool
 	* bundle (promoted onto the session record at frictionless time) to decrypt.
 	* No-op on decrypt failure / no bundle.
@@ -130,20 +175,6 @@ var CaptchaManager = class CaptchaManager {
 				sessionId
 			}
 		}));
-		if (userAccessPolicy?.captchaType !== void 0 && userAccessPolicy.captchaType !== requestedCaptchaType) {
-			this.logger.warn(() => ({
-				msg: "Invalid captcha type for user access policy",
-				data: {
-					account: clientSettings.account,
-					captchaType: userAccessPolicy.captchaType
-				}
-			}));
-			return {
-				valid: false,
-				reason: _prosopo_types.ResultReason.INCORRECT_CAPTCHA_TYPE,
-				type: requestedCaptchaType
-			};
-		}
 		if (sessionId) {
 			const cachedBeforeRemove = this.writeQueue ? await this.writeQueue.getCachedSession(sessionId) : null;
 			const cachedHash = typeof cachedBeforeRemove?.userSitekeyIpHash === "string" ? cachedBeforeRemove.userSitekeyIpHash : void 0;
@@ -246,6 +277,21 @@ var CaptchaManager = class CaptchaManager {
 				ipInfo: sessionRecord.ipInfo
 			};
 		}
+		if (userAccessPolicy?.captchaType !== void 0 && userAccessPolicy.captchaType !== requestedCaptchaType) {
+			this.logger.warn(() => ({
+				msg: "Invalid captcha type for user access policy (sessionless)",
+				data: {
+					account: clientSettings.account,
+					captchaType: userAccessPolicy.captchaType,
+					requestedCaptchaType
+				}
+			}));
+			return {
+				valid: false,
+				reason: _prosopo_types.ResultReason.INCORRECT_CAPTCHA_TYPE,
+				type: requestedCaptchaType
+			};
+		}
 		if (clientSettings?.settings?.captchaType !== requestedCaptchaType) {
 			this.logger.warn(() => ({
 				msg: `Invalid ${requestedCaptchaType} request`,

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -82,7 +82,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 	checkLangRules(acceptLanguage) {
 		return require_lang.checkLangRules(this.config, acceptLanguage);
 	}
-	async createSession(token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, bundleId, currentUrl, tcpToChelloUs, chelloToHandshakeUs, isEscalation, iframeUrl, isProtect) {
+	async createSession(token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, bundleId, currentUrl, tcpToChelloUs, chelloToHandshakeUs, isEscalation, iframeUrl, isProtect, originSessionId) {
 		const sessionRecord = {
 			sessionId: `${getSessionIDPrefix(this.config.host)}-${(0, uuid.v4)()}`,
 			createdAt: /* @__PURE__ */ new Date(),
@@ -99,6 +99,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			webView,
 			iFrame,
 			...isEscalation && { isEscalation: true },
+			...originSessionId && { originSessionId },
 			decryptedHeadHash,
 			bundleId,
 			reason,

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -394,7 +394,34 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				failStatus = _prosopo_types.ResultReason.SPAM_EMAIL_RULE;
 			}
 		}
-		const sessionRecord = solution.sessionId ? await this.db.getSessionRecordBySessionId(solution.sessionId) : void 0;
+		const maxEmailSubmissionCount = spamFilter?.enabled && spamFilter.emailRules?.enabled ? spamFilter.emailRules.maxEmailSubmissionCount : void 0;
+		let emailNormalised;
+		if (!failStatus && maxEmailSubmissionCount !== void 0 && email && storeMetadata) {
+			emailNormalised = require_evaluateEmailSpamRules.normaliseEmailForMatching(email);
+			if (emailNormalised) try {
+				const priorCount = await this.db.countCommitmentsByNormalisedEmail(dapp, emailNormalised);
+				if (priorCount >= maxEmailSubmissionCount) {
+					logger.info(() => ({
+						msg: "Email submission count exceeded in image verification",
+						data: {
+							priorCount,
+							maxEmailSubmissionCount
+						}
+					}));
+					commitmentUpdates.result = {
+						status: _prosopo_types.CaptchaStatus.disapproved,
+						reason: _prosopo_types.ResultReason.SPAM_EMAIL_COUNT_EXCEEDED
+					};
+					failStatus = _prosopo_types.ResultReason.SPAM_EMAIL_COUNT_EXCEEDED;
+				}
+			} catch (error) {
+				logger.warn(() => ({
+					msg: "Failed to check email submission count in image verification",
+					error
+				}));
+			}
+		}
+		const sessionRecord = solution.sessionId ? await this.getSessionRecordWithOriginFallback(solution.sessionId) : void 0;
 		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? solution.ipInfo?.ip);
 		if (!failStatus) {
 			const check = await this.resolveTrafficFilterCheck(env, solution.ipInfo, trafficFilter, ip, enrichedDnsEvent);
@@ -418,7 +445,10 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				failStatus = check.reason;
 			}
 		}
-		if (storeMetadata && email) commitmentUpdates.metadata = { email };
+		if (storeMetadata && email) commitmentUpdates.metadata = {
+			email,
+			emailNormalised: emailNormalised ?? require_evaluateEmailSpamRules.normaliseEmailForMatching(email)
+		};
 		if (ip) {
 			const solutionIpAddress = require_compositeIpAddress.getIpAddressFromComposite(solution.ipAddress);
 			const ipValidationRules = (await this.db.getClientRecord(dapp))?.settings?.ipValidationRules;

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -353,7 +353,34 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				failReason = "API.SPAM_EMAIL_RULE";
 			}
 		}
-		const sessionRecord = challengeRecord.sessionId ? await this.db.getSessionRecordBySessionId(challengeRecord.sessionId) : void 0;
+		const maxEmailSubmissionCount = spamFilter?.enabled && spamFilter.emailRules?.enabled ? spamFilter.emailRules.maxEmailSubmissionCount : void 0;
+		let emailNormalised;
+		if (!failResult && maxEmailSubmissionCount !== void 0 && email && storeMetadata) {
+			emailNormalised = require_evaluateEmailSpamRules.normaliseEmailForMatching(email);
+			if (emailNormalised) try {
+				const priorCount = await this.db.countCommitmentsByNormalisedEmail(dappAccount, emailNormalised);
+				if (priorCount >= maxEmailSubmissionCount) {
+					logger.info(() => ({
+						msg: "Email submission count exceeded in PoW verification",
+						data: {
+							priorCount,
+							maxEmailSubmissionCount
+						}
+					}));
+					failResult = {
+						status: _prosopo_types.CaptchaStatus.disapproved,
+						reason: _prosopo_types.ResultReason.SPAM_EMAIL_COUNT_EXCEEDED
+					};
+					failReason = "API.SPAM_EMAIL_COUNT_EXCEEDED";
+				}
+			} catch (error) {
+				logger.warn(() => ({
+					msg: "Failed to check email submission count in PoW verification",
+					error
+				}));
+			}
+		}
+		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
 		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
 		if (!failResult) {
 			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
@@ -377,7 +404,10 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				failReason = check.reason;
 			}
 		}
-		if (storeMetadata && email) powRecordUpdates.metadata = { email };
+		if (storeMetadata && email) powRecordUpdates.metadata = {
+			email,
+			emailNormalised: emailNormalised ?? require_evaluateEmailSpamRules.normaliseEmailForMatching(email)
+		};
 		if (!failResult && ip) {
 			const challengeIpAddress = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
 			const ipValidationRules = (await this.db.getClientRecord(dappAccount))?.settings?.ipValidationRules;

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -5,6 +5,7 @@ const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_util = require("../../util.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
+const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
 const require_powTasksUtils = require("../powCaptcha/powTasksUtils.cjs");
 const require_puzzleTasksUtils = require("./puzzleTasksUtils.cjs");
 let _prosopo_common = require("@prosopo/common");
@@ -184,11 +185,12 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @param userAccessRulesStorage - storage for querying user access policies
 	* @param email
 	* @param spamEmailDomainCheckingEnabled
+	* @param spamFilter
 	* @param trafficFilter
 	* @param storeMetadata - when true, persists the dapp-server-provided
 	*   `email` on the captcha record for spam-rate analysis.
 	*/
-	async serverVerifyPuzzleCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, trafficFilter, storeMetadata = false) {
+	async serverVerifyPuzzleCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false) {
 		const notVerifiedResponse = { verified: false };
 		const logger = this.logger.with({
 			challenge,
@@ -274,7 +276,34 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				error
 			}));
 		}
-		const sessionRecord = challengeRecord.sessionId ? await this.db.getSessionRecordBySessionId(challengeRecord.sessionId) : void 0;
+		const maxEmailSubmissionCount = spamFilter?.enabled && spamFilter.emailRules?.enabled ? spamFilter.emailRules.maxEmailSubmissionCount : void 0;
+		let emailNormalised;
+		if (maxEmailSubmissionCount !== void 0 && email && storeMetadata) {
+			emailNormalised = require_evaluateEmailSpamRules.normaliseEmailForMatching(email);
+			if (emailNormalised) try {
+				const priorCount = await this.db.countCommitmentsByNormalisedEmail(dappAccount, emailNormalised);
+				if (priorCount >= maxEmailSubmissionCount) {
+					logger.info(() => ({
+						msg: "Email submission count exceeded in server puzzle verification",
+						data: {
+							priorCount,
+							maxEmailSubmissionCount
+						}
+					}));
+					await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, { result: {
+						status: _prosopo_types.CaptchaStatus.disapproved,
+						reason: _prosopo_types.ResultReason.SPAM_EMAIL_COUNT_EXCEEDED
+					} });
+					return notVerifiedResponse;
+				}
+			} catch (error) {
+				logger.warn(() => ({
+					msg: "Failed to check email submission count in server puzzle verification",
+					error
+				}));
+			}
+		}
+		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
 		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
 		{
 			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
@@ -303,7 +332,10 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				return notVerifiedResponse;
 			}
 		}
-		if (storeMetadata && email) await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, { metadata: { email } });
+		if (storeMetadata && email) await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, { metadata: {
+			email,
+			emailNormalised: emailNormalised ?? require_evaluateEmailSpamRules.normaliseEmailForMatching(email)
+		} });
 		if (ip) {
 			const challengeIpAddress = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
 			const ipValidationRules = (await this.db.getClientRecord(dappAccount))?.settings?.ipValidationRules;

package/dist/cjs/tasks/spam/evaluateEmailSpamRules.cjs

@@ -28,6 +28,28 @@ var normaliseGmailAddress = (email) => {
 	if (!GMAIL_DOMAINS.has(parts.domain)) return `${parts.local}@${parts.domain}`;
 	return `${parts.local.replace(/\./g, "").split("+")[0] ?? ""}@gmail.com`;
 };
+/**
+* Normalises an email for equality-based rate-limit matching:
+*   - lowercases and trims
+*   - strips `+tag` from the local part for every domain (RFC 5233
+*     subaddressing is widely honoured — Gmail, Fastmail, iCloud, Outlook,
+*     ProtonMail — and rotating `+tag` suffixes is the cheapest evasion
+*     against per-address rate limits)
+*   - additionally removes dots from the local part for gmail /
+*     googlemail (Gmail is the only major provider that treats dots as
+*     insignificant)
+*
+* Returns the input trimmed/lowercased if it cannot be split into
+* local@domain. Never returns an empty string for a non-empty input.
+*/
+var normaliseEmailForMatching = (email) => {
+	const parts = splitEmail(email);
+	if (!parts) return email.trim().toLowerCase();
+	const beforePlus = parts.local.split("+")[0];
+	const withoutPlusTag = beforePlus ? beforePlus : parts.local;
+	if (GMAIL_DOMAINS.has(parts.domain)) return `${withoutPlusTag.replace(/\./g, "") || withoutPlusTag}@gmail.com`;
+	return `${withoutPlusTag}@${parts.domain}`;
+};
 var countDots = (s) => {
 	let n = 0;
 	for (const c of s) if (c === ".") n += 1;
@@ -80,4 +102,5 @@ var evaluateEmailSpamRules = (email, rules) => {
 //#endregion
 exports.DEFAULT_EMAIL_SPAM_PATTERNS = DEFAULT_EMAIL_SPAM_PATTERNS;
 exports.evaluateEmailSpamRules = evaluateEmailSpamRules;
+exports.normaliseEmailForMatching = normaliseEmailForMatching;
 exports.normaliseGmailAddress = normaliseGmailAddress;

package/dist/tasks/captchaManager.d.ts

@@ -21,6 +21,7 @@ export declare class CaptchaManager {
     constructor(db: IProviderDatabase, pair: KeyringPair, config: ProsopoConfigOutput, logger?: Logger, writeQueue?: RedisWriteQueue | null);
     updateSessionRecordWithCache(sessionId: string, updates: Partial<Session>, streamToCentral?: boolean): Promise<void>;
     decryptSimdReadingsForAttach(simdReadingsCiphertext: string, bundle: PoolBundleDecrypt | undefined): Promise<NonNullable<Session["simdReadings"]> | undefined>;
+    getSessionRecordWithOriginFallback(sessionId: string): Promise<Session | undefined>;
     decryptAndAttachSimdReadingsIfAbsent(sessionId: string, simdReadingsCiphertext: string, stage: SimdReadingsStage): Promise<void>;
     recordSessionSimdReadingsIfAbsentWithCache(sessionId: string, readings: NonNullable<Session["simdReadings"]>, stage: SimdReadingsStage): Promise<void>;
     scheduleMongoSessionUpdate(sessionId: string, updates: Partial<Session>, streamToCentral?: boolean): void;

package/dist/tasks/captchaManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EACJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAOrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACpB;AAkCD,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAe/C,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IA8QF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;;;;;;IAkBV,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAKpB,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAeF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAepE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAa5D,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAyCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA+C9B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAmB9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM;CAGnD"}
+{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EACJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAOrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACpB;AAkCD,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IA2DlB,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAmSF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;;;;;;IAkBV,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAKpB,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAeF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAepE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAa5D,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAyCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA+C9B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAmB9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM;CAGnD"}