@prosopo/provider 5.11.1 → 5.12.2

package/dist/cjs/api/cpuProfiler.cjs

@@ -0,0 +1,129 @@
+let node_inspector_promises = require("node:inspector/promises");
+//#region src/api/cpuProfiler.ts
+var enabled = () => process.env.PROSOPO_CPU_PROFILE_ENABLED === "true";
+var numberFromEnv = (name, fallback) => {
+	const parsed = Number.parseInt(process.env[name] ?? "", 10);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+};
+var SYNTHETIC_FRAMES = /* @__PURE__ */ new Set([
+	"(idle)",
+	"(program)",
+	"(root)"
+]);
+/**
+* Collapse a CDP profile into self time per call frame.
+*
+* `timeDeltas[i]` is the gap between sample `i-1` and sample `i`, so charging
+* each delta to the node named by `samples[i]` gives self time — the time that
+* frame was on top of the stack, not the time spent beneath it.
+*/
+var summariseProfile = (profile, topN) => {
+	const framesById = new Map(profile.nodes.map((node) => [node.id, node]));
+	const samples = profile.samples ?? [];
+	const timeDeltas = profile.timeDeltas ?? [];
+	const selfMicros = /* @__PURE__ */ new Map();
+	let accountedMicros = 0;
+	for (let i = 0; i < samples.length; i++) {
+		const id = samples[i];
+		const delta = timeDeltas[i];
+		if (id === void 0 || delta === void 0 || delta < 0) continue;
+		selfMicros.set(id, (selfMicros.get(id) ?? 0) + delta);
+		accountedMicros += delta;
+	}
+	let idleMicros = 0;
+	const ranked = [];
+	for (const [id, micros] of selfMicros) {
+		const node = framesById.get(id);
+		if (!node) continue;
+		const { functionName, url, lineNumber } = node.callFrame;
+		if (SYNTHETIC_FRAMES.has(functionName)) {
+			idleMicros += micros;
+			continue;
+		}
+		ranked.push({
+			fn: functionName || "(anonymous)",
+			url,
+			line: lineNumber,
+			selfMs: micros / 1e3,
+			pct: 0
+		});
+	}
+	ranked.sort((a, b) => b.selfMs - a.selfMs);
+	const busyMs = Math.max(accountedMicros - idleMicros, 0) / 1e3;
+	for (const frame of ranked) frame.pct = busyMs > 0 ? frame.selfMs / busyMs * 100 : 0;
+	return {
+		durationMs: (profile.endTime - profile.startTime) / 1e3,
+		samples: samples.length,
+		accountedMs: accountedMicros / 1e3,
+		idlePct: accountedMicros > 0 ? idleMicros / accountedMicros * 100 : 0,
+		top: ranked.slice(0, topN)
+	};
+};
+var runOnce = async (logger) => {
+	const durationMs = numberFromEnv("PROSOPO_CPU_PROFILE_DURATION_MS", 5e3);
+	const samplingUs = numberFromEnv("PROSOPO_CPU_PROFILE_SAMPLING_US", 1e3);
+	const topN = numberFromEnv("PROSOPO_CPU_PROFILE_TOP_N", 25);
+	const session = new node_inspector_promises.Session();
+	try {
+		session.connect();
+		await session.post("Profiler.enable");
+		await session.post("Profiler.setSamplingInterval", { interval: samplingUs });
+		await session.post("Profiler.start");
+		await new Promise((resolve) => setTimeout(resolve, durationMs));
+		const { profile } = await session.post("Profiler.stop");
+		const summary = summariseProfile(profile, topN);
+		logger.info(() => ({
+			msg: "CPU profile",
+			data: {
+				windowMs: summary.durationMs,
+				samples: summary.samples,
+				idlePct: Number(summary.idlePct.toFixed(1)),
+				samplingUs,
+				top: summary.top.map((frame) => ({
+					fn: frame.fn,
+					at: `${frame.url}:${frame.line}`,
+					selfMs: Number(frame.selfMs.toFixed(2)),
+					pct: Number(frame.pct.toFixed(2))
+				}))
+			}
+		}));
+	} finally {
+		try {
+			session.disconnect();
+		} catch {}
+	}
+};
+/**
+* Sample the isolate for a window, log the ranked self time, repeat.
+*
+* Returns a stop function. Never throws into the caller and never keeps the
+* process alive: a broken profiler must not be able to take the provider with
+* it, and a provider that is otherwise idle must still be able to exit.
+*/
+var startCpuProfiler = (logger) => {
+	if (!enabled()) return () => void 0;
+	const intervalMs = numberFromEnv("PROSOPO_CPU_PROFILE_INTERVAL_MS", 9e5);
+	let running = false;
+	const tick = () => {
+		if (running) return;
+		running = true;
+		runOnce(logger).catch((err) => {
+			logger.warn(() => ({
+				msg: "CPU profile failed",
+				err
+			}));
+		}).finally(() => {
+			running = false;
+		});
+	};
+	logger.info(() => ({
+		msg: "CPU profiler enabled",
+		data: { intervalMs }
+	}));
+	const timer = setInterval(tick, intervalMs);
+	timer.unref?.();
+	return () => clearInterval(timer);
+};
+//#endregion
+exports.startCpuProfiler = startCpuProfiler;
+exports.summariseProfile = summariseProfile;

package/dist/cjs/api/metrics.cjs

@@ -34,6 +34,21 @@ var SCORE_BUCKETS = [
 	5,
 	10
 ];
+var SPAN_BUCKETS = [
+	1e-4,
+	25e-5,
+	5e-4,
+	.001,
+	.0025,
+	.005,
+	.01,
+	.025,
+	.05,
+	.1,
+	.25,
+	.5,
+	1
+];
 var KNOWN_ROUTES = /* @__PURE__ */ new Set([
 	...Object.values(_prosopo_types.ClientApiPaths),
 	...Object.values(_prosopo_types.PublicApiPaths),
@@ -160,6 +175,38 @@ var buildMetrics = () => {
 			help: "Healthz geo steering outcomes (steered/not_steered/target_down/geo_unavailable)",
 			labelNames: ["outcome"],
 			registers: [registry]
+		}),
+		decoderDuration: new prom_client.Histogram({
+			name: `${PREFIX}decoder_duration_seconds`,
+			help: "End-to-end duration of a detector payload decode, worker round trip included",
+			labelNames: ["decoder"],
+			buckets: SPAN_BUCKETS,
+			registers: [registry]
+		}),
+		decoderCallsTotal: new prom_client.Counter({
+			name: `${PREFIX}decoder_calls_total`,
+			help: "Detector payload decodes by decoder and outcome",
+			labelNames: ["decoder", "outcome"],
+			registers: [registry]
+		}),
+		syncSpanWallSecondsTotal: new prom_client.Counter({
+			name: `${PREFIX}sync_span_wall_seconds_total`,
+			help: "Seconds the event loop was held by named blocks of synchronous work",
+			labelNames: ["span"],
+			registers: [registry]
+		}),
+		syncSpanCallsTotal: new prom_client.Counter({
+			name: `${PREFIX}sync_span_calls_total`,
+			help: "Calls into each named block of synchronous work, successful or not",
+			labelNames: ["span"],
+			registers: [registry]
+		}),
+		syncSpanDuration: new prom_client.Histogram({
+			name: `${PREFIX}sync_span_duration_seconds`,
+			help: "Duration of each named block of synchronous work",
+			labelNames: ["span"],
+			buckets: SPAN_BUCKETS,
+			registers: [registry]
 		})
 	};
 };
@@ -216,6 +263,65 @@ var setMaintenanceModeGauge = (on) => {
 	if (!metricsEnabled()) return;
 	getMetrics().maintenanceMode.set(on ? 1 : 0);
 };
+/**
+* Time one detector decode end to end, worker round trip included.
+*
+* Wall time here is not event-loop time — the decode runs on a worker, so
+* this is latency the request sees rather than delay it imposes on its
+* neighbours. That is the point: watching it alongside
+* `prosopo_nodejs_eventloop_lag_p99_seconds` is how you tell that the work
+* moved rather than vanished.
+*/
+var recordDecoderOutcome = (decoder, outcome, durationSeconds) => {
+	if (!metricsEnabled()) return;
+	const m = getMetrics();
+	m.decoderCallsTotal.inc({
+		decoder,
+		outcome
+	});
+	m.decoderDuration.observe({ decoder }, durationSeconds);
+};
+/**
+* Measure how long a named block of synchronous work holds the event loop.
+*
+* `increase(prosopo_sync_span_wall_seconds_total[1d])` by span is the ranking
+* this exists to produce: which blocks are worth moving off the loop, ordered
+* by how much of it they actually consume rather than by how expensive they
+* look.
+*
+* Wall time, not CPU time, and that is not a compromise. Nothing else on this
+* thread can run while `fn` does, so its wall time *is* the delay it imposes
+* on every other request in flight — which is the quantity we care about.
+*
+* An earlier version also recorded a `process.cpuUsage()` delta and claimed it
+* was exact for the same reason. It was not: cpuUsage covers the whole
+* process, so V8's background GC and compiler threads and libuv's threadpool
+* all landed on whichever span happened to be open. In production it read
+* consistently *higher* than wall time, which is impossible for single-thread
+* work and is what gave it away. Node exposes no per-thread CPU clock, so
+* there is no fixed version of that metric to keep — process-wide CPU is
+* already available as `prosopo_process_cpu_seconds_total`.
+*
+* This takes `() => T` and not an async callback for the same reason: wrapping
+* an awaiting function would time every other request served during its awaits.
+* Passing a function that *returns* a promise is fine and intended — several of
+* our decoders are async in signature but do their work synchronously before
+* resolving. Only the synchronous part is timed, so if one of them later grows
+* a real await the span under-reports rather than over-reports.
+*/
+var measureSync = (span, fn) => {
+	if (!metricsEnabled()) return fn();
+	const wallBefore = process.hrtime.bigint();
+	try {
+		return fn();
+	} finally {
+		const wallSeconds = Number(process.hrtime.bigint() - wallBefore) / 1e9;
+		const m = getMetrics();
+		m.syncSpanCallsTotal.inc({ span });
+		m.syncSpanWallSecondsTotal.inc({ span }, wallSeconds);
+		m.syncSpanDuration.observe({ span }, wallSeconds);
+	}
+};
 var metricsMiddleware = () => {
 	return (req, res, next) => {
 		if (!metricsEnabled()) return next();
@@ -256,6 +362,7 @@ var metricsHandler = (env) => {
 };
 //#endregion
 exports.getMetrics = getMetrics;
+exports.measureSync = measureSync;
 exports.metricsEnabled = metricsEnabled;
 exports.metricsHandler = metricsHandler;
 exports.metricsMiddleware = metricsMiddleware;
@@ -264,6 +371,7 @@ exports.recordBotScore = recordBotScore;
 exports.recordCaptchaIssueError = recordCaptchaIssueError;
 exports.recordCaptchaIssued = recordCaptchaIssued;
 exports.recordCaptchaVerify = recordCaptchaVerify;
+exports.recordDecoderOutcome = recordDecoderOutcome;
 exports.recordDetectorTriggered = recordDetectorTriggered;
 exports.recordDomainValidation = recordDomainValidation;
 exports.recordFrictionlessDecision = recordFrictionlessDecision;

package/dist/cjs/api/startProviderApi.cjs

@@ -11,6 +11,7 @@ const require_handshakeTimingMiddleware = require("./handshakeTimingMiddleware.c
 const require_public = require("./public.cjs");
 const require_domainMiddleware = require("./domainMiddleware.cjs");
 const require_createApiAdminRoutesProvider = require("./admin/createApiAdminRoutesProvider.cjs");
+const require_cpuProfiler = require("./cpuProfiler.cjs");
 const require_headerCheckMiddleware = require("./headerCheckMiddleware.cjs");
 const require_ignoreMiddleware = require("./ignoreMiddleware.cjs");
 const require_ipInfoMiddleware = require("./ipInfoMiddleware.cjs");
@@ -165,6 +166,7 @@ async function startProviderApi(env, admin = false, port) {
 	apiApp.use(express.default.json({ limit: "1mb" }));
 	apiApp.use(require_public.publicRouter(env));
 	apiApp.use(require_metrics.metricsMiddleware());
+	require_cpuProfiler.startCpuProfiler(env.logger);
 	if (!(process.env.NODE_ENV === "test" || env.config.defaultEnvironment === "development")) {
 		const rateLimits = {
 			...env.config.rateLimits,

package/dist/cjs/tasks/captchaManager.cjs

@@ -1,6 +1,7 @@
 const require_compositeIpAddress = require("../compositeIpAddress.cjs");
 const require_blacklistRequestInspector = require("../api/blacklistRequestInspector.cjs");
 const require_bundlePool = require("./detection/bundlePool.cjs");
+const require_decoderPool = require("./detection/decoderPool.cjs");
 const require_checkTrafficFilter = require("./spam/checkTrafficFilter.cjs");
 const require_enrichDnsEvent = require("./dnsEvent/enrichDnsEvent.cjs");
 const require_checkSpamEmail = require("./spam/checkSpamEmail.cjs");
@@ -115,6 +116,56 @@ var CaptchaManager = class CaptchaManager {
 		};
 	}
 	/**
+	* Decode the payloads a solution submission can carry, in one pass.
+	*
+	* Both decodes want the same session bundle and neither depends on the
+	* other, so the bundle is resolved once and the two decodes run together.
+	* Done separately they cost two bundle lookups and two serialised decoder
+	* round trips on the submit path, which measured as a ~22-25% latency
+	* regression on `pow/solution` and `puzzle/solution` once decoding moved
+	* to worker threads.
+	*
+	* Absent or undecodable payloads come back undefined rather than throwing,
+	* matching what the individual decoders already do: a submission is not
+	* worth failing over a signal we could not read.
+	*/
+	async decodeSubmissionPayloads(sessionId, payloads) {
+		const { behavioural, simd } = payloads;
+		if (!behavioural && !simd) return {};
+		let bundle;
+		try {
+			bundle = await this.resolveBundleBySessionId(sessionId);
+		} catch (err) {
+			this.logger?.warn(() => ({
+				msg: "Could not resolve the detector bundle for a submission",
+				data: { sessionId },
+				err
+			}));
+			return {};
+		}
+		const tolerate = async (decoding, which) => {
+			if (!decoding) return void 0;
+			try {
+				return await decoding ?? void 0;
+			} catch (err) {
+				this.logger?.warn(() => ({
+					msg: "Failed to decode a submission payload",
+					data: {
+						decoder: which,
+						sessionId
+					},
+					err
+				}));
+				return;
+			}
+		};
+		const [decodedBehavioural, decodedSimd] = await Promise.all([tolerate(behavioural ? this.decryptBehavioralData(behavioural, bundle) : void 0, "behaviour"), tolerate(simd ? this.decryptSimdReadingsForAttach(simd, bundle) : void 0, "simd")]);
+		return {
+			...decodedBehavioural && { behavioural: decodedBehavioural },
+			...decodedSimd && { simd: decodedSimd }
+		};
+	}
+	/**
 	* Decrypt + first-hop-wins attach. Resolves the session's detector pool
 	* bundle (promoted onto the session record at frictionless time) to decrypt.
 	* No-op on decrypt failure / no bundle.
@@ -409,9 +460,12 @@ var CaptchaManager = class CaptchaManager {
 			this.logger?.warn(() => ({ msg: "No detector bundle resolved for SIMD readings — dropping field" }));
 			return null;
 		}
-		const decryptSimdReadings = (await Promise.resolve().then(() => require("./detection/decodeSimd.cjs"))).default;
 		try {
-			return await decryptSimdReadings(encryptedData, bundle.key, bundle.innerConfig);
+			return await require_decoderPool.decode("simd", [
+				encryptedData,
+				bundle.key,
+				bundle.innerConfig
+			]);
 		} catch (err) {
 			this.logger?.warn(() => ({
 				msg: "Failed to decrypt SIMD readings with the session's bundle",
@@ -425,9 +479,12 @@ var CaptchaManager = class CaptchaManager {
 			this.logger?.warn(() => ({ msg: "No detector bundle resolved for behavioral data — dropping field" }));
 			return null;
 		}
-		const decryptBehavioralData = (await Promise.resolve().then(() => require("./detection/decodeBehavior.cjs"))).default;
 		try {
-			const result = await decryptBehavioralData(encryptedData, bundle.key, bundle.innerConfig);
+			const result = await require_decoderPool.decode("behaviour", [
+				encryptedData,
+				bundle.key,
+				bundle.innerConfig
+			]);
 			this.logger?.info(() => ({
 				msg: "Behavioral data decrypted successfully",
 				data: {

package/dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs

@@ -1,4 +1,5 @@
 const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_metrics = require("../../api/metrics.cjs");
 let _prosopo_types = require("@prosopo/types");
 let node_crypto = require("node:crypto");
 let node_vm = require("node:vm");
@@ -250,7 +251,7 @@ var DecisionMachineRunner = class DecisionMachineRunner {
 			if (options.optional) return void 0;
 			throw new Error(`Decision machine must export one of: ${exportNames.join(", ")}`);
 		}
-		const result = await this.withTimeout(Promise.resolve(named.fn(options.input)), EXEC_TIMEOUT_MS);
+		const result = await this.withTimeout(Promise.resolve(require_metrics.measureSync("decision_machine_decide", () => named.fn(options.input))), EXEC_TIMEOUT_MS);
 		const parsed = schema.safeParse(result);
 		if (!parsed.success) throw new Error(`Decision machine '${named.name}' output failed validation`);
 		return parsed.data;

package/dist/cjs/tasks/detection/decoderModules.cjs

@@ -0,0 +1,14 @@
+var FILENAMES = {
+	payload: "decodePayload.js",
+	simd: "decodeSimd.js",
+	behaviour: "decodeBehavior.js"
+};
+var decoderModuleUrl = (decoder) => new URL(`./${FILENAMES[decoder]}`, require("url").pathToFileURL(__filename).href).href;
+var decoderModuleUrls = () => ({
+	payload: decoderModuleUrl("payload"),
+	simd: decoderModuleUrl("simd"),
+	behaviour: decoderModuleUrl("behaviour")
+});
+//#endregion
+exports.decoderModuleUrl = decoderModuleUrl;
+exports.decoderModuleUrls = decoderModuleUrls;

package/dist/cjs/tasks/detection/decoderPool.cjs

@@ -0,0 +1,183 @@
+const require_metrics = require("../../api/metrics.cjs");
+const require_decoderModules = require("./decoderModules.cjs");
+let _prosopo_logger = require("@prosopo/logger");
+let node_os = require("node:os");
+let node_worker_threads = require("node:worker_threads");
+//#region src/tasks/detection/decoderPool.ts
+var logger = (0, _prosopo_logger.getLogger)("info", "provider:decoder-pool");
+var DEFAULT_TIMEOUT_MS = 5e3;
+var numberFromEnv = (name, fallback) => {
+	const raw = process.env[name];
+	if (raw === void 0 || raw === "") return fallback;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallback;
+};
+/**
+* Workers to run. Defaults to a small share of the box, since decoding is one
+* of several things the node does and the rest of it still needs cores.
+*
+* `PROSOPO_DECODER_WORKERS=0` runs every decode inline on the main thread —
+* the behaviour before this existed. That is the kill switch: it needs a
+* restart but not a rollback.
+*/
+var poolSize = () => numberFromEnv("PROSOPO_DECODER_WORKERS", Math.max(1, Math.min(4, (0, node_os.availableParallelism)() - 1)));
+var timeoutMs = () => numberFromEnv("PROSOPO_DECODER_TIMEOUT_MS", DEFAULT_TIMEOUT_MS);
+var WORKER_SOURCE = `
+import { parentPort, workerData } from "node:worker_threads";
+
+const decoders = {};
+for (const [name, url] of Object.entries(workerData.urls)) {
+	decoders[name] = (await import(url)).default;
+}
+parentPort.postMessage({ ready: true });
+
+parentPort.on("message", async ({ id, decoder, args }) => {
+	try {
+		const result = await decoders[decoder](...args);
+		parentPort.postMessage({ id, ok: true, result });
+	} catch (err) {
+		parentPort.postMessage({
+			id,
+			ok: false,
+			message: err instanceof Error ? err.message : String(err),
+		});
+	}
+});
+`;
+var pool;
+var nextCallId = 0;
+var nextWorker = 0;
+var inlineFallback = false;
+var spawn = () => {
+	const worker = new node_worker_threads.Worker(WORKER_SOURCE, {
+		eval: true,
+		workerData: { urls: require_decoderModules.decoderModuleUrls() }
+	});
+	const pooled = {
+		worker,
+		inFlight: /* @__PURE__ */ new Map(),
+		ready: new Promise((resolve, reject) => {
+			worker.once("message", () => resolve());
+			worker.once("error", reject);
+		})
+	};
+	worker.on("message", (msg) => {
+		if (msg.id === void 0) return;
+		const pending = pooled.inFlight.get(msg.id);
+		if (!pending) return;
+		pooled.inFlight.delete(msg.id);
+		clearTimeout(pending.timer);
+		if (msg.ok) pending.resolve(msg.result);
+		else pending.reject(new Error(msg.message ?? "decoder failed"));
+	});
+	const abandon = (reason) => {
+		for (const [id, pending] of pooled.inFlight) {
+			clearTimeout(pending.timer);
+			pending.reject(new Error(reason));
+			pooled.inFlight.delete(id);
+		}
+		replace(pooled);
+	};
+	worker.on("error", (err) => {
+		logger.error(() => ({
+			msg: "Decoder worker errored",
+			err
+		}));
+		abandon(`decoder worker errored: ${err.message}`);
+	});
+	worker.on("exit", (code) => {
+		if (code === 0) return;
+		logger.error(() => ({
+			msg: "Decoder worker exited",
+			data: { code }
+		}));
+		abandon(`decoder worker exited with code ${code}`);
+	});
+	worker.unref();
+	return pooled;
+};
+var replace = (dead) => {
+	if (!pool) return;
+	const index = pool.indexOf(dead);
+	if (index === -1) return;
+	try {
+		pool[index] = spawn();
+	} catch (err) {
+		logger.error(() => ({
+			msg: "Could not replace decoder worker",
+			err
+		}));
+		pool.splice(index, 1);
+	}
+};
+var getPool = () => {
+	if (inlineFallback) return void 0;
+	if (pool) return pool.length > 0 ? pool : void 0;
+	const size = poolSize();
+	if (size === 0) {
+		inlineFallback = true;
+		logger.info(() => ({ msg: "Decoder workers disabled, decoding inline" }));
+		return;
+	}
+	try {
+		pool = Array.from({ length: size }, () => spawn());
+		logger.info(() => ({
+			msg: "Decoder pool started",
+			data: { size }
+		}));
+		return pool;
+	} catch (err) {
+		inlineFallback = true;
+		logger.error(() => ({
+			msg: "Could not start decoder pool, falling back to inline decoding",
+			err
+		}));
+		return;
+	}
+};
+var runInline = async (decoder, args) => {
+	return (await import(require_decoderModules.decoderModuleUrl(decoder))).default(...args);
+};
+var runOnWorker = async (pooled, decoder, args) => {
+	await pooled.ready;
+	const id = nextCallId++;
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			pooled.inFlight.delete(id);
+			pooled.worker.terminate();
+			reject(/* @__PURE__ */ new Error(`decoder '${decoder}' timed out`));
+		}, timeoutMs());
+		timer.unref?.();
+		pooled.inFlight.set(id, {
+			resolve,
+			reject,
+			timer
+		});
+		pooled.worker.postMessage({
+			id,
+			decoder,
+			args
+		});
+	});
+};
+/**
+* Decode off the event loop, falling back to inline decoding if the pool is
+* unavailable. Either way the contract is the one the callers already handle:
+* resolves with the decoder's result, rejects with its error.
+*/
+var decode = async (decoder, args) => {
+	const started = process.hrtime.bigint();
+	const workers = getPool();
+	const pooled = workers?.[nextWorker++ % workers.length];
+	try {
+		const result = pooled ? await runOnWorker(pooled, decoder, args) : await runInline(decoder, args);
+		require_metrics.recordDecoderOutcome(decoder, "ok", elapsedSeconds(started));
+		return result;
+	} catch (err) {
+		require_metrics.recordDecoderOutcome(decoder, "error", elapsedSeconds(started));
+		throw err;
+	}
+};
+var elapsedSeconds = (started) => Number(process.hrtime.bigint() - started) / 1e9;
+//#endregion
+exports.decode = decode;

package/dist/cjs/tasks/detection/getBotScore.cjs

@@ -1,4 +1,4 @@
-const require_decodePayload = require("./decodePayload.cjs");
+const require_decoderPool = require("./decoderPool.cjs");
 //#region src/tasks/detection/getBotScore.ts
 var MAX_KEYS = 64;
 var MAX_KEY_LENGTH = 64;
@@ -60,7 +60,14 @@ var sanitiseDetectorData = (value) => {
 	return sanitised;
 };
 var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded, payloadLayoutEncoded, keyMapEncoded) => {
-	const result = await require_decodePayload.default(payload, headHash, privateKeyString, innerConfigEncoded, payloadLayoutEncoded, keyMapEncoded);
+	const result = await require_decoderPool.decode("payload", [
+		payload,
+		headHash,
+		privateKeyString,
+		innerConfigEncoded,
+		payloadLayoutEncoded,
+		keyMapEncoded
+	]);
 	const baseBotScore = result.score;
 	if (baseBotScore === void 0 || Number.isNaN(baseBotScore)) return {
 		baseBotScore: 1,

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -109,8 +109,11 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		};
 		const storedClientMetaData = require_clientMetaData.toStoredClientMetaData(clientMetaData);
 		const pendingRecord = await this.db.getPendingImageCommitment(requestHash);
-		const sessionBundle = await this.resolveBundleBySessionId(pendingRecord?.sessionId);
-		const decodedSimdReadings = simdReadings ? await this.decryptSimdReadingsForAttach(simdReadings, sessionBundle) : void 0;
+		const decodedPayloads = await this.decodeSubmissionPayloads(pendingRecord?.sessionId, {
+			behavioural: behavioralData,
+			simd: simdReadings
+		});
+		const decodedSimdReadings = decodedPayloads.simd;
 		const pushSimdAttachIfAny = (sessionId, writes) => {
 			if (decodedSimdReadings) writes.push(this.recordSessionSimdReadingsIfAbsentWithCache(sessionId, decodedSimdReadings, _prosopo_types.SimdReadingsStage.submit));
 		};
@@ -128,7 +131,7 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			let behavioralDataPacked;
 			let deviceCapability;
 			if (behavioralData) try {
-				const decryptedData = await this.decryptBehavioralData(behavioralData, sessionBundle);
+				const decryptedData = decodedPayloads.behavioural;
 				if (decryptedData) {
 					this.logger?.info(() => ({
 						msg: "Behavioral analysis completed",

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasksUtils.cjs

@@ -1,3 +1,4 @@
+const require_metrics = require("../../api/metrics.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_datasets = require("@prosopo/datasets");
 //#region src/tasks/imgCaptcha/imgCaptchaTasksUtils.ts
@@ -20,8 +21,10 @@ var buildTreeAndGetCommitmentId = (captchaSolutions) => {
 		failedFuncName: buildTreeAndGetCommitmentId.name,
 		commitmentId: null
 	} });
-	const solutionsHashed = captchaSolutions.map((captcha) => nativeMerkle.computeCaptchaSolutionHash(captcha.captchaId, captcha.captchaContentId, captcha.solution, captcha.salt));
-	const layers = nativeMerkle.buildMerkleLayers(solutionsHashed);
+	const layers = require_metrics.measureSync("merkle_build", () => {
+		const solutionsHashed = captchaSolutions.map((captcha) => nativeMerkle.computeCaptchaSolutionHash(captcha.captchaId, captcha.captchaContentId, captcha.solution, captcha.salt));
+		return nativeMerkle.buildMerkleLayers(solutionsHashed);
+	});
 	const tree = new _prosopo_datasets.CaptchaMerkleTree();
 	tree.hydrateFromLayers(layers);
 	const commitmentId = tree.root?.hash;

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -133,9 +133,12 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		}
 		let behavioralUpdates = {};
 		let decryptedBehavioralDataPacked;
+		const decodedPayloads = await this.decodeSubmissionPayloads(challengeRecord.sessionId, {
+			behavioural: behavioralData,
+			simd: simdReadings
+		});
 		if (behavioralData) try {
-			const bundle = await this.resolveBundleBySessionId(challengeRecord.sessionId);
-			const decryptedData = await this.decryptBehavioralData(behavioralData, bundle);
+			const decryptedData = decodedPayloads.behavioural;
 			if (decryptedData) {
 				const dappAccount = (0, _prosopo_util.at)(challengeSplit, 2);
 				this.logger?.info(() => ({
@@ -182,7 +185,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.pow, result) && { blocked: true },
 				...storedClientMetaData && { clientMetaData: storedClientMetaData }
 			}));
-			if (simdReadings) writePromises.push(this.decryptAndAttachSimdReadingsIfAbsent(linkedSessionId, simdReadings, _prosopo_types.SimdReadingsStage.submit));
+			if (decodedPayloads.simd) writePromises.push(this.recordSessionSimdReadingsIfAbsentWithCache(linkedSessionId, decodedPayloads.simd, _prosopo_types.SimdReadingsStage.submit));
 		}
 		await Promise.all(writePromises);
 		if (!correct) return { verified: correct };