@prosopo/provider 5.10.0 → 5.10.2

package/dist/cjs/tasks/captchaManager.cjs

@@ -355,13 +355,44 @@ var CaptchaManager = class CaptchaManager {
 	* the bundleId too so the caller can promote it onto the session.
 	*/
 	async resolveBundleByDetectorSession(detectorSessionId) {
-		if (!detectorSessionId || !this.writeQueue) return void 0;
+		if (!detectorSessionId || !this.writeQueue) {
+			this.logUnresolvedDetectorBundle("noDetectorSession");
+			return;
+		}
 		const bundleId = await this.writeQueue.getDetectorBundle(detectorSessionId);
+		if (!bundleId) {
+			this.logUnresolvedDetectorBundle("noBinding");
+			return;
+		}
 		const decrypt = this.resolveBundleById(bundleId);
-		return bundleId && decrypt ? {
+		if (!decrypt) {
+			this.logUnresolvedDetectorBundle("bundleNotInPool", bundleId);
+			return;
+		}
+		return {
 			...decrypt,
 			bundleId
-		} : void 0;
+		};
+	}
+	/**
+	* Returning undefined here leaves the frictionless decrypt with no keys to
+	* try, which fails closed: the score is forced to 1 and the caller is
+	* challenged despite nothing having been measured about it. The three causes
+	* need different fixes — a caller that sent no detector session, a binding
+	* that was absent or had expired (see `DETECTOR_BUNDLE_TTL_SECONDS`), and a
+	* bundle this provider no longer holds — but they are indistinguishable
+	* downstream, where all three surface as the same decrypt failure. Logged at
+	* info because that is the level aggregated log search runs at, and only on
+	* the failure path, so this costs nothing on the hot path.
+	*/
+	logUnresolvedDetectorBundle(cause, bundleId) {
+		this.logger?.info(() => ({
+			msg: "Detector bundle not resolved",
+			data: {
+				cause,
+				...bundleId !== void 0 && { bundleId }
+			}
+		}));
 	}
 	/**
 	* Resolve the detector pool bundle for a session via the `bundleId` promoted

package/dist/cjs/tasks/detection/assignSecret.cjs

@@ -0,0 +1,45 @@
+let node_crypto = require("node:crypto");
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+//#region src/tasks/detection/assignSecret.ts
+/**
+* Per-provider key for the client → bundle mapping in `assignDetectorBundle`.
+* Generated once and kept on the pool volume so a restart does not change the
+* mapping. Treat it as a credential.
+*/
+var SECRET_BYTES = 32;
+/**
+* Dot-prefixed so a pool replace leaves it alone: `loadFromDir` and
+* `persistDetectorBundlePool` only touch `.js`/`.json`.
+*/
+var SECRET_FILENAME = ".assign-secret";
+var cached = null;
+function getAssignSecret(poolDir, logger = {}) {
+	const path = (0, node_path.join)(poolDir, SECRET_FILENAME);
+	if (cached && cached.path === path) return cached.secret;
+	try {
+		const existing = (0, node_fs.readFileSync)(path);
+		if (existing.length === SECRET_BYTES) {
+			cached = {
+				path,
+				secret: existing
+			};
+			return existing;
+		}
+		logger.warn?.("assign secret has unexpected length, regenerating", { bytes: existing.length });
+	} catch {}
+	const secret = (0, node_crypto.randomBytes)(SECRET_BYTES);
+	(0, node_fs.mkdirSync)((0, node_path.dirname)(path), { recursive: true });
+	const tmp = `${path}.tmp`;
+	(0, node_fs.writeFileSync)(tmp, secret, { mode: 384 });
+	(0, node_fs.chmodSync)(tmp, 384);
+	(0, node_fs.renameSync)(tmp, path);
+	logger.info?.("generated a new assign secret", { path });
+	cached = {
+		path,
+		secret
+	};
+	return secret;
+}
+//#endregion
+exports.getAssignSecret = getAssignSecret;

package/dist/cjs/tasks/detection/bundlePool.cjs

@@ -1,4 +1,3 @@
-let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 //#region src/tasks/detection/bundlePool.ts
@@ -11,7 +10,7 @@ let node_path = require("node:path");
 * (`{ privateKey, innerConfig }`, kept server-side) produced by the catcher
 * `bundle:pool` build script.
 *
-* A bundle is assigned per detector session by {@link DetectorBundlePool.pickRandom},
+* A bundle is assigned per detector session by {@link DetectorBundlePool.at},
 * served by id, and resolved again at decryption time so the provider uses the
 * single correct keypair + inner config rather than brute-forcing a key pool.
 * The session→bundle binding lives in Redis (short TTL); this module only holds
@@ -105,13 +104,13 @@ var DetectorBundlePool = class {
 		return this.ids.length;
 	}
 	/**
-	* Pick a uniformly-random bundle. Throws if the pool is empty — the caller
-	* must surface this as a hard failure (no bundle ⇒ no valid payload can be
-	* produced).
+	* Select by position. `ids` is sorted by {@link replace}, so an index means
+	* the same bundle until the pool contents change. Reduced modulo the size, so
+	* callers need not know how many bundles are loaded.
 	*/
-	pickRandom() {
+	at(index) {
 		if (this.ids.length === 0) throw new Error("detector bundle pool is empty");
-		const bundleId = this.ids[(0, node_crypto.randomInt)(this.ids.length)];
+		const bundleId = this.ids[index % this.ids.length];
 		const bundle = bundleId !== void 0 ? this.bundles.get(bundleId) : void 0;
 		if (bundleId === void 0 || !bundle) throw new Error("detector bundle pool selection failed");
 		return {
@@ -183,6 +182,10 @@ function persistDetectorBundlePool(bundles, dir = globalPoolDir) {
 function getDetectorBundlePool() {
 	return globalPool;
 }
+/** Where the global pool was last loaded from — the host-mounted volume. */
+function getDetectorBundlePoolDir() {
+	return globalPoolDir;
+}
 /**
 * Hot-swap the global pool's contents (admin "emergency push" channel) and
 * write it to the pool directory so it survives a restart. Creates the global
@@ -215,6 +218,7 @@ function replaceDetectorBundlePool(bundles, logger = {}) {
 exports.DEFAULT_DETECTOR_POOL_DIR = DEFAULT_DETECTOR_POOL_DIR;
 exports.DetectorBundlePool = DetectorBundlePool;
 exports.getDetectorBundlePool = getDetectorBundlePool;
+exports.getDetectorBundlePoolDir = getDetectorBundlePoolDir;
 exports.initDetectorBundlePool = initDetectorBundlePool;
 exports.persistDetectorBundlePool = persistDetectorBundlePool;
 exports.replaceDetectorBundlePool = replaceDetectorBundlePool;