@prosopo/provider 5.10.2 → 5.10.4

package/dist/api/public.js

@@ -1,4 +1,5 @@
 import { metricsEnabled, metricsHandler, recordHealthzGeoOutcome } from "./metrics.js";
+import { assetDocumentRouter } from "./assetDocument.js";
 import { getHealthzGeoRouter } from "./healthzGeo.js";
 import { ProsopoApiError } from "@prosopo/common";
 import { PublicApiPaths } from "@prosopo/types";
@@ -61,6 +62,7 @@ function publicRouter(env) {
 			return next(new ProsopoApiError("API.BAD_REQUEST", { context: { code: 500 } }));
 		}
 	});
+	router.use(assetDocumentRouter());
 	router.use(handleErrors);
 	return router;
 }

package/dist/api/public.js.map

@@ -1 +1 @@
-{"version":3,"file":"public.js","sourceRoot":"","sources":["../../src/api/public.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAwB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,OAAwB,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EACN,cAAc,EACd,cAAc,EACd,uBAAuB,GACvB,MAAM,cAAc,CAAC;AAOtB,MAAM,UAAU,YAAY,CAAC,GAAwB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKhC,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAYrC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,OAAO,GACZ,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;YACjB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAEjB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QAOD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAKH,IAAI,cAAc,EAAE,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IAKD,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACtE,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;YAEvB,MAAM,eAAe,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;YAChD,MAAM,0BAA0B,GAAG,EAAE,CAAC,6BAA6B,EAAE,CAAC;YAItE,MAAM,IAAI,GACT,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAC5C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;gBACjB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAEjB,MAAM,QAAQ,GAAoB;gBACjC,OAAO;gBACP,OAAO,EAAE,iBAAiB;gBAC1B,IAAI;gBACJ,KAAK,EAAE;oBACN;wBACC,KAAK,EAAE,SAAS;wBAChB,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE;wBAClC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAC7B,eAAe,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAC1C;qBACD;oBACD;wBACC,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE;wBAC7C,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAC7B,0BAA0B,CAAC,iBAAiB,EAAE,GAAG,IAAI,CACrD;qBACD;iBACD;aACD,CAAC;YAEF,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACvB,GAAG;gBACH,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE;gBAC/B,GAAG,EAAE,gCAAgC;aACrC,CAAC,CAAC,CAAC;YACJ,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,iBAAiB,EAAE;gBACtC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;aACtB,CAAC,CACF,CAAC;QACH,CAAC;IACF,CAAC,CAAC,CAAC;IAKH,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAEzB,OAAO,MAAM,CAAC;AACf,CAAC"}
+{"version":3,"file":"public.js","sourceRoot":"","sources":["../../src/api/public.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAwB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,OAAwB,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EACN,cAAc,EACd,cAAc,EACd,uBAAuB,GACvB,MAAM,cAAc,CAAC;AAOtB,MAAM,UAAU,YAAY,CAAC,GAAwB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKhC,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAYrC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,OAAO,GACZ,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;YACjB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAEjB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QAOD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAKH,IAAI,cAAc,EAAE,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IAKD,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACtE,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;YAEvB,MAAM,eAAe,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;YAChD,MAAM,0BAA0B,GAAG,EAAE,CAAC,6BAA6B,EAAE,CAAC;YAItE,MAAM,IAAI,GACT,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAC5C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;gBACjB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAEjB,MAAM,QAAQ,GAAoB;gBACjC,OAAO;gBACP,OAAO,EAAE,iBAAiB;gBAC1B,IAAI;gBACJ,KAAK,EAAE;oBACN;wBACC,KAAK,EAAE,SAAS;wBAChB,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE;wBAClC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAC7B,eAAe,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAC1C;qBACD;oBACD;wBACC,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE;wBAC7C,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAC7B,0BAA0B,CAAC,iBAAiB,EAAE,GAAG,IAAI,CACrD;qBACD;iBACD;aACD,CAAC;YAEF,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACvB,GAAG;gBACH,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE;gBAC/B,GAAG,EAAE,gCAAgC;aACrC,CAAC,CAAC,CAAC;YACJ,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,iBAAiB,EAAE;gBACtC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;aACtB,CAAC,CACF,CAAC;QACH,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAKlC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAEzB,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/cjs/api/assetDocument.cjs

@@ -0,0 +1,43 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+let express = require("express");
+express = require_runtime.__toESM(express, 1);
+//#region src/api/assetDocument.ts
+var scriptLiteral = (value) => JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
+var page = (inner, id) => `<!doctype html>
+<meta charset="utf-8">
+<body><script>
+var f=document.createElement('iframe');
+f.src=${scriptLiteral(inner)};
+f.onload=function(){window.top.postMessage({p:'n',i:${scriptLiteral(id)}},'*')};
+document.body.appendChild(f);
+<\/script></body>`;
+var ID_PATTERN = /^[A-Za-z0-9]{1,64}$/;
+var probeId = (raw) => "string" === typeof raw && ID_PATTERN.test(raw) ? raw : "";
+var innerUrl = (raw) => {
+	if ("string" !== typeof raw || 0 === raw.length) return;
+	try {
+		const url = new URL(raw);
+		return "http:" === url.protocol || "https:" === url.protocol ? url.href : void 0;
+	} catch {
+		return;
+	}
+};
+function assetDocumentRouter() {
+	const router = express.default.Router();
+	router.get(/.*/, (req, res, next) => {
+		if ("n" !== req.query.m) return next();
+		const inner = innerUrl(req.query.u);
+		if (!inner) return next();
+		const id = probeId(req.query.i);
+		res.removeHeader("X-Frame-Options");
+		res.set({
+			"Content-Type": "text/html; charset=utf-8",
+			"Cache-Control": "no-store",
+			"Content-Security-Policy": "frame-ancestors *"
+		});
+		return res.status(200).send(page(inner, id));
+	});
+	return router;
+}
+//#endregion
+exports.assetDocumentRouter = assetDocumentRouter;

package/dist/cjs/api/captcha/assignDetectorBundle.cjs

@@ -8,6 +8,26 @@ let uuid = require("uuid");
 //#region src/api/captcha/assignDetectorBundle.ts
 /** Pool position for this caller: a keyed hash of their address. */
 var clientIndex = (ip, secret) => (0, node_crypto.createHmac)("sha256", secret).update(ip).digest().readUIntBE(0, 6);
+var siteConfig = async (tasks, body, logger) => {
+	const parsed = _prosopo_types.AssignDetectorBundleRequestBody.safeParse(body);
+	if (!parsed.success) return {};
+	try {
+		const client = await tasks.db.getClientRecord(parsed.data[_prosopo_types.ApiParams.dapp]);
+		const clientUrl = client?.settings?.clientUrl;
+		const assetOrigin = client?.settings?.assetOrigin;
+		if (!clientUrl || !assetOrigin) return {};
+		return {
+			[_prosopo_types.ApiParams.clientUrl]: clientUrl,
+			[_prosopo_types.ApiParams.assetOrigin]: assetOrigin
+		};
+	} catch (err) {
+		logger.warn(() => ({
+			msg: "assignDetectorBundle site config failed",
+			err
+		}));
+		return {};
+	}
+};
 /**
 * Assigns a precomputed detector bundle for this detection session.
 *
@@ -43,13 +63,15 @@ var assignDetectorBundle_default = (env) => async (req, res, _next) => {
 		});
 		const { bundleId, bundle } = pool.at(clientIndex(require_normalizeRequestIp.normalizeRequestIp(req.ip, req.logger), secret));
 		const detectorSessionId = `det-${(0, uuid.v4)()}`;
-		const writeQueue = new require_tasks.Tasks(env, req.logger).frictionlessManager.writeQueue;
+		const tasks = new require_tasks.Tasks(env, req.logger);
+		const writeQueue = tasks.frictionlessManager.writeQueue;
 		if (!writeQueue) return res.json(noBundle);
 		if (!await writeQueue.cacheDetectorBundle(detectorSessionId, bundleId)) return res.json(noBundle);
 		const response = {
 			[_prosopo_types.ApiParams.useProviderBundle]: true,
 			[_prosopo_types.ApiParams.detectorSessionId]: detectorSessionId,
 			[_prosopo_types.ApiParams.detectorScript]: bundle.js,
+			...await siteConfig(tasks, req.body, req.logger),
 			status: "ok"
 		};
 		return res.json(response);

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -267,7 +267,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 				...verifiedSignerUrl && { agent: verifiedSignerUrl }
 			});
 		}
-		const { baseBotScore: rawBaseBotScore, timestamp: rawTimestamp, userId: rawUserId, userAgent: rawUserAgent, webView, iFrame, decryptedHeadHash, decryptionFailed: rawDecryptionFailed, triggeredDetectors, shadowDomPenalty, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, g, i, cv, sq, cg, sm, b, sw, md, bn, fs, bundleId } = decryptedPayload;
+		const { baseBotScore: rawBaseBotScore, timestamp: rawTimestamp, userId: rawUserId, userAgent: rawUserAgent, webView, iFrame, decryptedHeadHash, decryptionFailed: rawDecryptionFailed, triggeredDetectors, shadowDomPenalty, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, g, i, cv, sq, cg, sm, dz, b, sw, md, bn, fs, bundleId } = decryptedPayload;
 		const detectorOverride = process.env.PROSOPO_TEST_FRICTIONLESS_DETECTOR_OVERRIDE === "1";
 		const baseBotScore = detectorOverride ? 0 : rawBaseBotScore;
 		const timestamp = detectorOverride ? Date.now() : rawTimestamp;
@@ -333,6 +333,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			...sq !== void 0 && { sq },
 			...cg !== void 0 && { cg },
 			...sm !== void 0 && { sm },
+			...dz !== void 0 && { dz },
 			...b !== void 0 && { b },
 			...sw !== void 0 && { sw },
 			...md !== void 0 && { md },

package/dist/cjs/api/public.cjs

@@ -1,5 +1,6 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_metrics = require("./metrics.cjs");
+const require_assetDocument = require("./assetDocument.cjs");
 const require_healthzGeo = require("./healthzGeo.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
@@ -64,6 +65,7 @@ function publicRouter(env) {
 			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", { context: { code: 500 } }));
 		}
 	});
+	router.use(require_assetDocument.assetDocumentRouter());
 	router.use(_prosopo_api_express_router.handleErrors);
 	return router;
 }

package/dist/cjs/tasks/captchaManager.cjs

@@ -345,7 +345,8 @@ var CaptchaManager = class CaptchaManager {
 		const bundle = bundleId ? require_bundlePool.getDetectorBundlePool()?.get(bundleId) : void 0;
 		return bundle ? {
 			key: bundle.privateKey,
-			innerConfig: bundle.innerConfig
+			innerConfig: bundle.innerConfig,
+			...bundle.payloadLayout && { payloadLayout: bundle.payloadLayout }
 		} : void 0;
 	}
 	/**

package/dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs

@@ -43,46 +43,49 @@ var ARTIFACT_CACHE_TTL_MS = Number.parseInt(process.env.DECISION_MACHINE_ARTIFAC
 var DEFAULT_DECISION = { decision: _prosopo_types.DecisionMachineDecision.Allow };
 var RequiredCountersSchema = zod.z.array(_prosopo_types.CounterSpecSchema);
 /**
-* WeakSet-style registry of every live runner. Populated in the constructor
-* and consulted by {@link invalidateAllDecisionMachineArtifactCaches} so an
-* artifact upload can flush every runner's in-memory artifact cache in one
-* call. Held as `WeakRef` so a runner that goes out of scope is garbage
-* collected — this map only ever grows in prod (runners are constructed
-* per task class at process start and live for the process's lifetime) so
-* a plain array would also work, but `WeakRef` is defensive.
+* Bumped by {@link invalidateAllDecisionMachineArtifactCaches}. A runner
+* caches the value it last saw and drops its artifact cache whenever the two
+* diverge, which flushes every runner — including ones built after the
+* invalidation — without holding a reference to any of them.
+*
+* This replaces a registry of live runners, which assumed runners were built
+* once per process. They are built per request, so the registry grew without
+* bound and construction eventually began to fail. `WeakRef` did not bound
+* it: the set held the wrapper, which outlives its referent.
 */
-var liveRunners = /* @__PURE__ */ new Set();
+var artifactCacheGeneration = 0;
 /**
 * Flush every runner's in-memory artifact cache. Companion to
 * {@link invalidateDecisionMachineScriptCache}. Call both after any
 * `upsertDecisionMachineArtifact` upload.
 */
 var invalidateAllDecisionMachineArtifactCaches = () => {
-	for (const ref of liveRunners) {
-		const runner = ref.deref();
-		if (runner === void 0) {
-			liveRunners.delete(ref);
-			continue;
-		}
-		runner.invalidateArtifactCache();
-	}
+	artifactCacheGeneration++;
 };
 var DecisionMachineRunner = class DecisionMachineRunner {
 	constructor(db) {
 		this.db = db;
 		this.artifactCache = /* @__PURE__ */ new Map();
-		liveRunners.add(new WeakRef(this));
+		this.seenArtifactCacheGeneration = artifactCacheGeneration;
 	}
 	/** Drop every entry in this runner's artifact cache. */
 	invalidateArtifactCache() {
 		this.artifactCache.clear();
 	}
+	/** Drop the cache if an invalidation happened since it was last consulted. */
+	dropArtifactCacheIfStale() {
+		if (this.seenArtifactCacheGeneration !== artifactCacheGeneration) {
+			this.seenArtifactCacheGeneration = artifactCacheGeneration;
+			this.artifactCache.clear();
+		}
+	}
 	/** Build a cache key for a given scope + kind + dappAccount tuple. */
 	static cacheKey(scope, kind, dappAccount) {
 		return `${scope}:${kind}:${dappAccount ?? ""}`;
 	}
 	/** Return a cached artifact if still fresh, or undefined. */
 	getCachedArtifact(scope, kind, dappAccount) {
+		this.dropArtifactCacheIfStale();
 		const entry = this.artifactCache.get(DecisionMachineRunner.cacheKey(scope, kind, dappAccount));
 		if (!entry) return null;
 		if (Date.now() - entry.cachedAt > ARTIFACT_CACHE_TTL_MS) {

package/dist/cjs/tasks/detection/bundlePool.cjs

@@ -7,8 +7,8 @@ let node_path = require("node:path");
 * Loads a pool of precomputed, obfuscated detector bundles from disk and caches
 * them in memory — the Node analogue of the Rust "bumblebee" `bundle_manager`.
 * Each bundle is a `{id}.js` (served to the browser) paired with a `{id}.json`
-* (`{ privateKey, innerConfig }`, kept server-side) produced by the catcher
-* `bundle:pool` build script.
+* (`{ privateKey, innerConfig, payloadLayout }`, kept server-side) produced by
+* the catcher `bundle:pool` build script.
 *
 * A bundle is assigned per detector session by {@link DetectorBundlePool.at},
 * served by id, and resolved again at decryption time so the provider uses the
@@ -67,11 +67,13 @@ var DetectorBundlePool = class {
 					continue;
 				}
 				if (expectedRelease && !release) unstamped++;
+				const payloadLayout = typeof secrets.payloadLayout === "string" ? secrets.payloadLayout : void 0;
 				next.set(bundleId, {
 					js,
 					privateKey: secrets.privateKey,
 					innerConfig: secrets.innerConfig,
-					...release && { release }
+					...release && { release },
+					...payloadLayout && { payloadLayout }
 				});
 			} catch (error) {
 				logger.warn?.("failed to load bundle pool entry", {
@@ -167,7 +169,8 @@ function persistDetectorBundlePool(bundles, dir = globalPoolDir) {
 		(0, node_fs.writeFileSync)(jsonTmp, JSON.stringify({
 			privateKey: bundle.privateKey,
 			innerConfig: bundle.innerConfig,
-			...bundle.release && { release: bundle.release }
+			...bundle.release && { release: bundle.release },
+			...bundle.payloadLayout && { payloadLayout: bundle.payloadLayout }
 		}), {
 			encoding: "utf8",
 			mode: 384