@prosopo/provider 5.12.2 → 5.12.3

package/dist/api/captcha/signedAssetsResolver.d.ts

@@ -1,5 +1,6 @@
+import { DEFAULT_ASSET_TOKEN_TTL_SECONDS } from "@prosopo/datasets";
 import type { Asset, AssetsResolver } from "@prosopo/types";
-export declare const DEFAULT_ASSET_TOKEN_TTL_SECONDS = 300;
+export { DEFAULT_ASSET_TOKEN_TTL_SECONDS };
 export interface SignedAssetsResolverOptions {
     securityKey: string;
     ttlSeconds?: number;

package/dist/api/captcha/signedAssetsResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signedAssetsResolver.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/signedAssetsResolver.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE5D,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,MAAM,WAAW,2BAA2B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,qBAAa,oBAAqB,YAAW,cAAc;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,EAAE,2BAA2B;IAOhD,OAAO,CAAC,IAAI;IAUZ,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK;IA0BrC,OAAO,CAAC,KAAK;CAUb;AAQD,wBAAgB,uBAAuB,CACtC,QAAQ,CAAC,EAAE,MAAM,GACf,cAAc,GAAG,SAAS,CAqB5B"}
+{"version":3,"file":"signedAssetsResolver.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/signedAssetsResolver.ts"],"names":[],"mappings":"AAmCA,OAAO,EACN,+BAA+B,EAG/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAE3C,MAAM,WAAW,2BAA2B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,qBAAa,oBAAqB,YAAW,cAAc;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,EAAE,2BAA2B;IAOhD,OAAO,CAAC,IAAI;IAYZ,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK;IA0BrC,OAAO,CAAC,KAAK;CAUb;AAQD,wBAAgB,uBAAuB,CACtC,QAAQ,CAAC,EAAE,MAAM,GACf,cAAc,GAAG,SAAS,CAqB5B"}

package/dist/api/captcha/signedAssetsResolver.js

@@ -1,14 +1,15 @@
 import { createHash } from "node:crypto";
+import { DEFAULT_ASSET_TOKEN_TTL_SECONDS, assetTokenBase, encodeAssetToken } from "@prosopo/datasets";
+//#region src/api/captcha/signedAssetsResolver.ts
 var SignedAssetsResolver = class {
 	constructor(options) {
 		this.securityKey = options.securityKey;
-		this.ttlSeconds = options.ttlSeconds ?? 300;
+		this.ttlSeconds = options.ttlSeconds ?? DEFAULT_ASSET_TOKEN_TTL_SECONDS;
 		this.clientIp = options.clientIp;
 		this.now = options.now ?? (() => Date.now());
 	}
 	sign(path, expires) {
-		const base = `${this.securityKey}${path}${expires}${this.clientIp ?? ""}`;
-		return createHash("sha256").update(base).digest("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+		return encodeAssetToken(new Uint8Array(createHash("sha256").update(assetTokenBase(this.securityKey, path, expires, this.clientIp)).digest()));
 	}
 	resolveAsset(assetURI) {
 		const url = this.toUrl(assetURI);
@@ -45,9 +46,9 @@ function getSignedAssetsResolver(clientIp) {
 	if (!securityKey) return;
 	return new SignedAssetsResolver({
 		securityKey,
-		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || 300,
+		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || DEFAULT_ASSET_TOKEN_TTL_SECONDS,
 		...process.env.PROSOPO_ASSET_TOKEN_BIND_IP === "true" && clientIp ? { clientIp } : {}
 	});
 }
 //#endregion
-export { SignedAssetsResolver, getSignedAssetsResolver };
+export { DEFAULT_ASSET_TOKEN_TTL_SECONDS, SignedAssetsResolver, getSignedAssetsResolver };

package/dist/api/captcha/signedAssetsResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"signedAssetsResolver.js","sourceRoot":"","sources":["../../../src/api/captcha/signedAssetsResolver.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAYnD,MAAM,OAAO,oBAAoB;IAMhC,YAAY,OAAoC;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,+BAA+B,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,IAAI,CAAC,IAAY,EAAE,OAAe;QACzC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1E,OAAO,UAAU,CAAC,QAAQ,CAAC;aACzB,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,QAAQ,CAAC;aAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAIjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QAMD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,6DAA6D,QAAQ,EAAE,CACvE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,UAAU,KAAK,YAAY,OAAO,EAAE,CAAC;QAEhF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAC3D,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD;AAQD,MAAM,UAAU,uBAAuB,CACtC,QAAiB;IAEjB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GACf,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,EAAE,EAAE,CAAC;QACtE,+BAA+B,CAAC;IAMjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAC;IAElE,OAAO,IAAI,oBAAoB,CAAC;QAC/B,WAAW;QACX,UAAU;QACV,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"signedAssetsResolver.js","sourceRoot":"","sources":["../../../src/api/captcha/signedAssetsResolver.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,+BAA+B,EAC/B,cAAc,EACd,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAY3C,MAAM,OAAO,oBAAoB;IAMhC,YAAY,OAAoC;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,+BAA+B,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,IAAI,CAAC,IAAY,EAAE,OAAe;QACzC,OAAO,gBAAgB,CACtB,IAAI,UAAU,CACb,UAAU,CAAC,QAAQ,CAAC;aAClB,MAAM,CACN,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAC9D;aACA,MAAM,EAAE,CACV,CACD,CAAC;IACH,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAIjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QAMD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,6DAA6D,QAAQ,EAAE,CACvE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,UAAU,KAAK,YAAY,OAAO,EAAE,CAAC;QAEhF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAC3D,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD;AAQD,MAAM,UAAU,uBAAuB,CACtC,QAAiB;IAEjB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GACf,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,EAAE,EAAE,CAAC;QACtE,+BAA+B,CAAC;IAMjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAC;IAElE,OAAO,IAAI,oBAAoB,CAAC;QAC/B,WAAW;QACX,UAAU;QACV,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/api/captcha/assetSeal.cjs

@@ -0,0 +1,22 @@
+const require_assetSealFormat = require("./assetSealFormat.cjs");
+let node_crypto = require("node:crypto");
+//#region src/api/captcha/assetSeal.ts
+var CIPHER = "aes-256-gcm";
+var GCM_OPTIONS = { authTagLength: 16 };
+var sealAssetPath = (params) => {
+	if (!require_assetSealFormat.isSafeAssetPath(params.path)) throw new Error(`Refusing to seal an unusable asset path: ${params.path}`);
+	const iv = (0, node_crypto.randomBytes)(12);
+	const cipher = (0, node_crypto.createCipheriv)(CIPHER, params.key, iv, GCM_OPTIONS);
+	cipher.setAAD(require_assetSealFormat.additionalData(params.keyId));
+	const ciphertext = Buffer.concat([cipher.update(require_assetSealFormat.encodePayload({
+		expiresAtSeconds: params.expiresAtSeconds,
+		path: params.path
+	})), cipher.final()]);
+	return require_assetSealFormat.encodeEnvelope({
+		keyId: params.keyId,
+		iv: new Uint8Array(iv),
+		sealed: new Uint8Array(Buffer.concat([ciphertext, cipher.getAuthTag()]))
+	});
+};
+//#endregion
+exports.sealAssetPath = sealAssetPath;

package/dist/cjs/api/captcha/assetSealFormat.cjs

@@ -0,0 +1,95 @@
+var AAD_BYTES = 2;
+var EXPIRY_BYTES = 4;
+var MAX_KEY_ID = 255;
+var BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder("utf-8", { fatal: true });
+var toBase64Url = (bytes) => {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var fromBase64Url = (value) => {
+	if (!BASE64URL_PATTERN.test(value)) return;
+	const normalised = value.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = normalised.padEnd(normalised.length + (4 - normalised.length % 4) % 4, "=");
+	try {
+		const binary = atob(padded);
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+		return bytes;
+	} catch {
+		return;
+	}
+};
+var additionalData = (keyId) => new Uint8Array([1, keyId]);
+var encodeEnvelope = (envelope) => {
+	const bytes = new Uint8Array(AAD_BYTES + envelope.iv.length + envelope.sealed.length);
+	bytes.set(additionalData(envelope.keyId), 0);
+	bytes.set(envelope.iv, AAD_BYTES);
+	bytes.set(envelope.sealed, AAD_BYTES + envelope.iv.length);
+	return toBase64Url(bytes);
+};
+var decodeEnvelope = (blob) => {
+	const bytes = fromBase64Url(blob);
+	if (!bytes || bytes.length <= 14) return;
+	if (bytes[0] !== 1) return;
+	const keyId = bytes[1];
+	if (void 0 === keyId) return;
+	return {
+		keyId,
+		iv: bytes.slice(AAD_BYTES, 14),
+		sealed: bytes.slice(14)
+	};
+};
+var encodePayload = (payload) => {
+	const path = textEncoder.encode(payload.path);
+	const bytes = new Uint8Array(EXPIRY_BYTES + path.length);
+	new DataView(bytes.buffer).setUint32(0, payload.expiresAtSeconds, false);
+	bytes.set(path, EXPIRY_BYTES);
+	return bytes;
+};
+var decodePayload = (bytes) => {
+	if (bytes.length <= EXPIRY_BYTES) return;
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	try {
+		return {
+			expiresAtSeconds: view.getUint32(0, false),
+			path: textDecoder.decode(bytes.subarray(EXPIRY_BYTES))
+		};
+	} catch {
+		return;
+	}
+};
+var isSafeAssetPath = (path, requiredPrefix) => {
+	if (!path.startsWith("/") || path.length > 512) return false;
+	if (path.includes("..") || path.includes("//")) return false;
+	if (/[\u0000-\u001f\u007f]/.test(path)) return false;
+	return void 0 === requiredPrefix || path.startsWith(requiredPrefix);
+};
+var parseSealKeys = (spec) => {
+	const keys = /* @__PURE__ */ new Map();
+	for (const entry of spec.split(",")) {
+		const trimmed = entry.trim();
+		if ("" === trimmed) continue;
+		const separator = trimmed.indexOf(":");
+		if (separator <= 0) throw new Error("Malformed seal key entry: expected \"keyId:base64key\"");
+		const keyId = Number(trimmed.slice(0, separator));
+		if (!Number.isInteger(keyId) || keyId < 0 || keyId > MAX_KEY_ID) throw new Error(`Seal key id must be an integer in [0, ${MAX_KEY_ID}]`);
+		const key = fromBase64Url(trimmed.slice(separator + 1).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""));
+		if (!key || key.length !== 32) throw new Error(`Seal key ${keyId} must be 32 base64-encoded bytes`);
+		keys.set(keyId, key);
+	}
+	if (0 === keys.size) throw new Error("No seal keys configured");
+	return keys;
+};
+//#endregion
+exports.additionalData = additionalData;
+exports.decodeEnvelope = decodeEnvelope;
+exports.decodePayload = decodePayload;
+exports.encodeEnvelope = encodeEnvelope;
+exports.encodePayload = encodePayload;
+exports.fromBase64Url = fromBase64Url;
+exports.isSafeAssetPath = isSafeAssetPath;
+exports.parseSealKeys = parseSealKeys;
+exports.toBase64Url = toBase64Url;

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -7,6 +7,7 @@ const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
+const require_sealedAssetsResolver = require("./sealedAssetsResolver.cjs");
 const require_signedAssetsResolver = require("./signedAssetsResolver.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
@@ -112,7 +113,7 @@ var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (r
 			}));
 		});
 		const taskData = await tasks.imgCaptchaManager.getRandomCaptchasAndRequestHash(datasetId, user, ipAddress, captchaConfig, clientRecord.settings.imageThreshold ?? .8, validSessionId, req.ipInfo);
-		const assetsResolver = require_signedAssetsResolver.getSignedAssetsResolver(ipAddress.toString()) ?? env.assetsResolver;
+		const assetsResolver = require_sealedAssetsResolver.getSealedAssetsResolver() ?? require_signedAssetsResolver.getSignedAssetsResolver(ipAddress.toString()) ?? env.assetsResolver;
 		const captchaResponse = {
 			[_prosopo_types.ApiParams.status]: "ok",
 			[_prosopo_types.ApiParams.captchas]: taskData.captchas.map((captcha) => ({

package/dist/cjs/api/captcha/sealedAssetsResolver.cjs

@@ -0,0 +1,70 @@
+const require_assetSealFormat = require("./assetSealFormat.cjs");
+const require_assetSeal = require("./assetSeal.cjs");
+var SealedAssetsResolver = class {
+	constructor(options) {
+		this.key = options.key;
+		this.keyId = options.keyId;
+		this.ttlSeconds = options.ttlSeconds ?? 300;
+		this.urlPrefix = options.urlPrefix ?? "s";
+		this.now = options.now ?? (() => Date.now());
+	}
+	resolveAsset(assetURI) {
+		const url = this.toUrl(assetURI);
+		if (!url) return {
+			URI: assetURI,
+			getURL: () => assetURI
+		};
+		if (url.search !== "") throw new Error(`Cannot seal an asset URL that has a query string: ${assetURI}`);
+		const blob = require_assetSeal.sealAssetPath({
+			path: url.pathname,
+			key: this.key,
+			keyId: this.keyId,
+			expiresAtSeconds: Math.floor(this.now() / 1e3) + this.ttlSeconds
+		});
+		const sealed = `${url.origin}/${this.urlPrefix}/${blob}${extensionOf(url.pathname)}`;
+		return {
+			URI: assetURI,
+			getURL: () => sealed
+		};
+	}
+	toUrl(assetURI) {
+		try {
+			const url = new URL(assetURI);
+			return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+		} catch {
+			return;
+		}
+	}
+};
+var extensionOf = (pathname) => {
+	const lastDot = pathname.lastIndexOf(".");
+	if (lastDot <= pathname.lastIndexOf("/") + 1) return "";
+	const extension = pathname.slice(lastDot);
+	return /^\.[a-zA-Z0-9]{1,8}$/.test(extension) ? extension : "";
+};
+function getSealedAssetsResolver() {
+	const spec = process.env.PROSOPO_ASSET_SEAL_KEYS;
+	if (!spec) return;
+	const keys = require_assetSealFormat.parseSealKeys(spec);
+	const keyId = activeKeyId(keys);
+	const key = keys.get(keyId);
+	if (!key) throw new Error(`PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID ${keyId} is not in PROSOPO_ASSET_SEAL_KEYS`);
+	return new SealedAssetsResolver({
+		key,
+		keyId,
+		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_SEAL_TTL_SECONDS ?? "", 10) || 300,
+		urlPrefix: process.env.PROSOPO_ASSET_SEAL_URL_PREFIX || "s"
+	});
+}
+var activeKeyId = (keys) => {
+	const configured = process.env.PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID;
+	if (configured) {
+		const parsed = Number.parseInt(configured, 10);
+		if (!Number.isInteger(parsed)) throw new Error("PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID must be an integer");
+		return parsed;
+	}
+	return Math.max(...keys.keys());
+};
+//#endregion
+exports.SealedAssetsResolver = SealedAssetsResolver;
+exports.getSealedAssetsResolver = getSealedAssetsResolver;

package/dist/cjs/api/captcha/signedAssetsResolver.cjs

@@ -1,14 +1,15 @@
 let node_crypto = require("node:crypto");
+let _prosopo_datasets = require("@prosopo/datasets");
+//#region src/api/captcha/signedAssetsResolver.ts
 var SignedAssetsResolver = class {
 	constructor(options) {
 		this.securityKey = options.securityKey;
-		this.ttlSeconds = options.ttlSeconds ?? 300;
+		this.ttlSeconds = options.ttlSeconds ?? _prosopo_datasets.DEFAULT_ASSET_TOKEN_TTL_SECONDS;
 		this.clientIp = options.clientIp;
 		this.now = options.now ?? (() => Date.now());
 	}
 	sign(path, expires) {
-		const base = `${this.securityKey}${path}${expires}${this.clientIp ?? ""}`;
-		return (0, node_crypto.createHash)("sha256").update(base).digest("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+		return (0, _prosopo_datasets.encodeAssetToken)(new Uint8Array((0, node_crypto.createHash)("sha256").update((0, _prosopo_datasets.assetTokenBase)(this.securityKey, path, expires, this.clientIp)).digest()));
 	}
 	resolveAsset(assetURI) {
 		const url = this.toUrl(assetURI);
@@ -45,10 +46,11 @@ function getSignedAssetsResolver(clientIp) {
 	if (!securityKey) return;
 	return new SignedAssetsResolver({
 		securityKey,
-		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || 300,
+		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || _prosopo_datasets.DEFAULT_ASSET_TOKEN_TTL_SECONDS,
 		...process.env.PROSOPO_ASSET_TOKEN_BIND_IP === "true" && clientIp ? { clientIp } : {}
 	});
 }
 //#endregion
+exports.DEFAULT_ASSET_TOKEN_TTL_SECONDS = _prosopo_datasets.DEFAULT_ASSET_TOKEN_TTL_SECONDS;
 exports.SignedAssetsResolver = SignedAssetsResolver;
 exports.getSignedAssetsResolver = getSignedAssetsResolver;

package/dist/edge/assetSealHandler.d.ts

@@ -0,0 +1,9 @@
+export interface AssetSealHandlerOptions {
+    readonly keys: ReadonlyMap<number, Uint8Array>;
+    readonly urlPrefix: string;
+    readonly requiredPathPrefix?: string;
+    readonly now?: () => number;
+}
+export type AssetSealHandler = (request: Request) => Promise<Request | Response>;
+export declare const createAssetSealHandler: (options: AssetSealHandlerOptions) => AssetSealHandler;
+//# sourceMappingURL=assetSealHandler.d.ts.map

package/dist/edge/assetSealHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSealHandler.d.ts","sourceRoot":"","sources":["../../src/edge/assetSealHandler.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC9B,OAAO,EAAE,OAAO,KACZ,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;AAWjC,eAAO,MAAM,sBAAsB,YACzB,uBAAuB,KAC9B,gBA4EF,CAAC"}

package/dist/edge/assetSealHandler.js

@@ -0,0 +1,74 @@
+import { additionalData, decodeEnvelope, decodePayload, isSafeAssetPath, } from "../api/captcha/assetSealFormat.js";
+const TAG_BYTES = 16;
+const notFound = () => new Response("Not found", {
+    status: 404,
+    headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store",
+    },
+});
+export const createAssetSealHandler = (options) => {
+    const imported = new Map();
+    const now = options.now ?? (() => Date.now());
+    const marker = `/${options.urlPrefix}/`;
+    const keyFor = (keyId) => {
+        const raw = options.keys.get(keyId);
+        if (!raw) {
+            return undefined;
+        }
+        const existing = imported.get(keyId);
+        if (existing) {
+            return existing;
+        }
+        const promise = crypto.subtle.importKey("raw", raw.slice(), { name: "AES-GCM" }, false, ["decrypt"]);
+        imported.set(keyId, promise);
+        return promise;
+    };
+    const open = async (blob) => {
+        const envelope = decodeEnvelope(blob);
+        if (!envelope || envelope.sealed.length <= TAG_BYTES) {
+            return undefined;
+        }
+        const key = keyFor(envelope.keyId);
+        if (!key) {
+            return undefined;
+        }
+        let payload;
+        try {
+            const plaintext = await crypto.subtle.decrypt({
+                name: "AES-GCM",
+                iv: envelope.iv,
+                additionalData: additionalData(envelope.keyId),
+                tagLength: TAG_BYTES * 8,
+            }, await key, envelope.sealed);
+            payload = decodePayload(new Uint8Array(plaintext));
+        }
+        catch {
+            return undefined;
+        }
+        if (!payload || payload.expiresAtSeconds <= Math.floor(now() / 1000)) {
+            return undefined;
+        }
+        return isSafeAssetPath(payload.path, options.requiredPathPrefix)
+            ? payload.path
+            : undefined;
+    };
+    return async (request) => {
+        const url = new URL(request.url);
+        if (!url.pathname.startsWith(marker)) {
+            return request;
+        }
+        const path = await open(stripExtension(url.pathname.slice(marker.length)));
+        if (!path) {
+            return notFound();
+        }
+        url.pathname = path;
+        url.search = "";
+        return new Request(url, request);
+    };
+};
+const stripExtension = (segment) => {
+    const dot = segment.indexOf(".");
+    return dot === -1 ? segment : segment.slice(0, dot);
+};
+//# sourceMappingURL=assetSealHandler.js.map

package/dist/edge/assetSealHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSealHandler.js","sourceRoot":"","sources":["../../src/edge/assetSealHandler.ts"],"names":[],"mappings":"AAcA,OAAO,EAEN,cAAc,EACd,cAAc,EACd,aAAa,EACb,eAAe,GACf,MAAM,mCAAmC,CAAC;AAE3C,MAAM,SAAS,GAAG,EAAE,CAAC;AAarB,MAAM,QAAQ,GAAG,GAAa,EAAE,CAC/B,IAAI,QAAQ,CAAC,WAAW,EAAE;IACzB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE;QACR,cAAc,EAAE,2BAA2B;QAC3C,eAAe,EAAE,UAAU;KAC3B;CACD,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACrC,OAAgC,EACb,EAAE;IACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC;IAExC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAkC,EAAE;QAChE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,GAAG,CAAC,KAAK,EAAE,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACX,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAA+B,EAAE;QAChE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,OAAkC,CAAC;QACvC,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C;gBACC,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC9C,SAAS,EAAE,SAAS,GAAG,CAAC;aACxB,EACD,MAAM,GAAG,EACT,QAAQ,CAAC,MAAM,CACf,CAAC;YACF,OAAO,GAAG,aAAa,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAC/D,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,SAAS,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAgB,EAA+B,EAAE;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,QAAQ,EAAE,CAAC;QACnB,CAAC;QAED,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAU,EAAE;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC,CAAC"}

package/dist/tests/unit/api/captcha/assetSeal.unit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=assetSeal.unit.test.d.ts.map

package/dist/tests/unit/api/captcha/assetSeal.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSeal.unit.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/unit/api/captcha/assetSeal.unit.test.ts"],"names":[],"mappings":""}

package/dist/tests/unit/api/captcha/assetSeal.unit.test.js

@@ -0,0 +1,132 @@
+import { describe, expect, test } from "vitest";
+import { sealAssetPath, unsealAssetPath, } from "../../../../api/captcha/assetSeal.js";
+import { SEAL_KEY_BYTES, decodeEnvelope, encodeEnvelope, isSafeAssetPath, parseSealKeys, toBase64Url, } from "../../../../api/captcha/assetSealFormat.js";
+const KEY = new Uint8Array(SEAL_KEY_BYTES).fill(7);
+const OTHER_KEY = new Uint8Array(SEAL_KEY_BYTES).fill(9);
+const KEY_ID = 1;
+const NOW_SECONDS = 1_700_000_000;
+const PATH = "/v5_dataset_flat/images/abc.webp";
+const keys = (entries = [[KEY_ID, KEY]]) => new Map(entries);
+const seal = (overrides = {}) => sealAssetPath({
+    path: overrides.path ?? PATH,
+    key: overrides.key ?? KEY,
+    keyId: overrides.keyId ?? KEY_ID,
+    expiresAtSeconds: NOW_SECONDS + (overrides.ttl ?? 300),
+});
+const unseal = (blob, overrides = {}) => unsealAssetPath({
+    blob,
+    keys: overrides.keys ?? keys(),
+    nowSeconds: overrides.nowSeconds ?? NOW_SECONDS,
+    ...(overrides.requiredPathPrefix !== undefined
+        ? { requiredPathPrefix: overrides.requiredPathPrefix }
+        : {}),
+});
+describe("sealing a path", () => {
+    test("opens again to the path it was given", () => {
+        expect(unseal(seal())).toBe(PATH);
+    });
+    test("says nothing about the path it carries", () => {
+        const blob = seal();
+        expect(blob).not.toContain("abc");
+        expect(blob).not.toContain("images");
+        expect(blob).not.toContain("v5_dataset_flat");
+    });
+    test("is different every time, for the same path", () => {
+        const blobs = new Set(Array.from({ length: 50 }, () => seal()));
+        expect(blobs.size).toBe(50);
+    });
+    test("is usable in a URL path segment", () => {
+        expect(seal()).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+    test("refuses to seal a path that could not be served", () => {
+        expect(() => seal({ path: "../../etc/passwd" })).toThrow();
+        expect(() => seal({ path: "no-leading-slash" })).toThrow();
+    });
+});
+describe("opening a seal", () => {
+    test("rejects one whose expiry has passed", () => {
+        const blob = seal({ ttl: 60 });
+        expect(unseal(blob, { nowSeconds: NOW_SECONDS + 59 })).toBe(PATH);
+        expect(unseal(blob, { nowSeconds: NOW_SECONDS + 60 })).toBeUndefined();
+        expect(unseal(blob, { nowSeconds: NOW_SECONDS + 61 })).toBeUndefined();
+    });
+    test("rejects one sealed under a key we do not hold", () => {
+        const blob = seal({ key: OTHER_KEY, keyId: 2 });
+        expect(unseal(blob)).toBeUndefined();
+    });
+    test("rejects one whose key id has been swapped", () => {
+        const envelope = decodeEnvelope(seal());
+        if (!envelope)
+            throw new Error("expected an envelope");
+        const swapped = encodeEnvelope({ ...envelope, keyId: 2 });
+        expect(unseal(swapped, {
+            keys: keys([
+                [KEY_ID, KEY],
+                [2, KEY],
+            ]),
+        })).toBeUndefined();
+    });
+    test("rejects a tampered blob", () => {
+        const blob = seal();
+        const flipped = `${blob.slice(0, -2)}${"A" === blob.slice(-2, -1) ? "B" : "A"}${blob.slice(-1)}`;
+        expect(unseal(flipped)).toBeUndefined();
+    });
+    test("rejects truncation", () => {
+        expect(unseal(seal().slice(0, 20))).toBeUndefined();
+    });
+    test("rejects noise", () => {
+        for (const blob of ["", "!!!!", "a", toBase64Url(new Uint8Array(8))]) {
+            expect(unseal(blob)).toBeUndefined();
+        }
+    });
+    test("enforces the path prefix when one is required", () => {
+        expect(unseal(seal(), { requiredPathPrefix: "/v5_dataset_flat/" })).toBe(PATH);
+        expect(unseal(seal({ path: "/elsewhere/a.webp" }), {
+            requiredPathPrefix: "/v5_dataset_flat/",
+        })).toBeUndefined();
+    });
+    test("opens a blob sealed under any key still configured", () => {
+        const old = seal({ key: KEY, keyId: 1 });
+        const fresh = seal({ key: OTHER_KEY, keyId: 2 });
+        const both = keys([
+            [1, KEY],
+            [2, OTHER_KEY],
+        ]);
+        expect(unseal(old, { keys: both })).toBe(PATH);
+        expect(unseal(fresh, { keys: both })).toBe(PATH);
+    });
+});
+describe("isSafeAssetPath", () => {
+    test("accepts an ordinary dataset path", () => {
+        expect(isSafeAssetPath(PATH)).toBe(true);
+    });
+    test("rejects traversal, protocol-relative paths and control characters", () => {
+        expect(isSafeAssetPath("/a/../b.webp")).toBe(false);
+        expect(isSafeAssetPath("//evil.example/a.webp")).toBe(false);
+        expect(isSafeAssetPath("/a\nHost: evil.example")).toBe(false);
+        expect(isSafeAssetPath("relative.webp")).toBe(false);
+    });
+    test("rejects a path longer than any real item", () => {
+        expect(isSafeAssetPath(`/${"a".repeat(512)}`)).toBe(false);
+    });
+});
+describe("parseSealKeys", () => {
+    const encoded = toBase64Url(KEY);
+    test("reads id and key pairs", () => {
+        const parsed = parseSealKeys(`1:${encoded},2:${toBase64Url(OTHER_KEY)}`);
+        expect(Array.from(parsed.keys()).sort()).toEqual([1, 2]);
+        expect(parsed.get(1)).toEqual(KEY);
+    });
+    test("tolerates whitespace and trailing separators", () => {
+        expect(parseSealKeys(` 1:${encoded} , `).size).toBe(1);
+    });
+    test("refuses a key that is not 32 bytes", () => {
+        expect(() => parseSealKeys(`1:${toBase64Url(new Uint8Array(16))}`)).toThrow(/32/);
+    });
+    test("refuses malformed entries", () => {
+        expect(() => parseSealKeys(encoded)).toThrow(/keyId:base64key/);
+        expect(() => parseSealKeys(`x:${encoded}`)).toThrow(/integer/);
+        expect(() => parseSealKeys("")).toThrow(/No seal keys/);
+    });
+});
+//# sourceMappingURL=assetSeal.unit.test.js.map

package/dist/tests/unit/api/captcha/assetSeal.unit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSeal.unit.test.js","sourceRoot":"","sources":["../../../../../src/tests/unit/api/captcha/assetSeal.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EACN,aAAa,EACb,eAAe,GACf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,WAAW,GACX,MAAM,4CAA4C,CAAC;AAEpD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzD,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,IAAI,GAAG,kCAAkC,CAAC;AAEhD,MAAM,IAAI,GAAG,CACZ,UAAkC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EACvB,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;AAE/C,MAAM,IAAI,GAAG,CACZ,YAKI,EAAE,EACG,EAAE,CACX,aAAa,CAAC;IACb,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;IAC5B,GAAG,EAAE,SAAS,CAAC,GAAG,IAAI,GAAG;IACzB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,MAAM;IAChC,gBAAgB,EAAE,WAAW,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;CACtD,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,CACd,IAAY,EACZ,YAII,EAAE,EACe,EAAE,CACvB,eAAe,CAAC;IACf,IAAI;IACJ,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE;IAC9B,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,WAAW;IAC/C,GAAG,CAAC,SAAS,CAAC,kBAAkB,KAAK,SAAS;QAC7C,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;QACtD,CAAC,CAAC,EAAE,CAAC;CACN,CAAC,CAAC;AAEJ,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC/B,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACnD,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACvD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC/B,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAE1D,MAAM,CACL,MAAM,CAAC,OAAO,EAAE;YACf,IAAI,EAAE,IAAI,CAAC;gBACV,CAAC,MAAM,EAAE,GAAG,CAAC;gBACb,CAAC,CAAC,EAAE,GAAG,CAAC;aACR,CAAC;SACF,CAAC,CACF,CAAC,aAAa,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;QAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CACvE,IAAI,CACJ,CAAC;QACF,MAAM,CACL,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE;YAC3C,kBAAkB,EAAE,mBAAmB;SACvC,CAAC,CACF,CAAC,aAAa,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC;YACjB,CAAC,CAAC,EAAE,GAAG,CAAC;YACR,CAAC,CAAC,EAAE,SAAS,CAAC;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAChC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC9B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,OAAO,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,aAAa,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,WAAW,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAC1E,IAAI,CACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/unit/api/captcha/sealedAssetsResolver.unit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sealedAssetsResolver.unit.test.d.ts.map

package/dist/tests/unit/api/captcha/sealedAssetsResolver.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedAssetsResolver.unit.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/unit/api/captcha/sealedAssetsResolver.unit.test.ts"],"names":[],"mappings":""}