@prosopo/provider 5.12.2 → 5.13.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/provider@5.12.2 build:cjs
+> @prosopo/provider@5.13.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -32,6 +32,7 @@ ViteCommonJSConfig: .
 {
   externals: [
     '@prosopo/api-route',
+The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
     '@prosopo/logger',
     '@prosopo/util',
     '@prosopo/api-express-router',
@@ -55,11 +56,10 @@ ViteCommonJSConfig: .
     '@prosopo/web-bot-auth'
   ]
 }
-The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 113 modules transformed.
+✓ 116 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/tasks/index.cjs                                                       0.08 kB │ gzip: 0.07 kB
@@ -79,6 +79,7 @@ dist/cjs/api/validateAddress.cjs                                               0
 dist/cjs/api/ja4.cjs                                                           0.85 kB │ gzip: 0.47 kB
 dist/cjs/api/dnsEventUrl.cjs                                                   0.85 kB │ gzip: 0.46 kB
 dist/cjs/tasks/dataset/datasetTasks.cjs                                        0.92 kB │ gzip: 0.41 kB
+dist/cjs/api/captcha/assetSeal.cjs                                             0.99 kB │ gzip: 0.51 kB
 dist/cjs/_virtual/_rolldown/runtime.cjs                                        1.00 kB │ gzip: 0.50 kB
 dist/cjs/api/headerCheckMiddleware.cjs                                         1.02 kB │ gzip: 0.45 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.cjs      1.03 kB │ gzip: 0.53 kB
@@ -103,7 +104,6 @@ dist/cjs/tasks/puzzle/backgroundBuffer.cjs                                     1
 dist/cjs/utils/clientMetaData.cjs                                              1.48 kB │ gzip: 0.72 kB
 dist/cjs/tasks/detection/assignSecret.cjs                                      1.48 kB │ gzip: 0.75 kB
 dist/cjs/api/assetDocument.cjs                                                 1.50 kB │ gzip: 0.81 kB
-dist/cjs/compositeIpAddress.cjs                                                1.55 kB │ gzip: 0.57 kB
 dist/cjs/api/admin/apiGetAllDecisionMachinesEndpoint.cjs                       1.59 kB │ gzip: 0.60 kB
 dist/cjs/schedulers/updateSpamEmailDomains.cjs                                 1.64 kB │ gzip: 0.62 kB
 dist/cjs/utils/honeypot/encoders.cjs                                           1.66 kB │ gzip: 0.67 kB
@@ -116,7 +116,6 @@ dist/cjs/tasks/imgCaptcha/imgCaptchaTasksUtils.cjs                             1
 dist/cjs/api/admin/apiToggleMaintenanceModeEndpoint.cjs                        1.80 kB │ gzip: 0.72 kB
 dist/cjs/utils/honeypot/phraseBank.cjs                                         1.87 kB │ gzip: 0.91 kB
 dist/cjs/api/handshakeTimingMiddleware.cjs                                     1.88 kB │ gzip: 0.71 kB
-dist/cjs/api/captcha/signedAssetsResolver.cjs                                  1.96 kB │ gzip: 0.96 kB
 dist/cjs/api/admin/apiClearAllCountersEndpoint.cjs                             2.01 kB │ gzip: 0.78 kB
 dist/cjs/tasks/frictionless/ipMatch.cjs                                        2.03 kB │ gzip: 1.03 kB
 dist/cjs/tasks/spam/updateSpamEmailDomains.cjs                                 2.12 kB │ gzip: 0.85 kB
@@ -124,6 +123,8 @@ dist/cjs/migrations/frictionlessLadder.cjs                                     2
 dist/cjs/tasks/puzzle/stratifiedSampler.cjs                                    2.20 kB │ gzip: 1.08 kB
 dist/cjs/tasks/frictionless/routingMachine.cjs                                 2.21 kB │ gzip: 0.93 kB
 dist/cjs/tasks/frictionless/frictionlessTasksUtils.cjs                         2.21 kB │ gzip: 1.10 kB
+dist/cjs/api/captcha/signedAssetsResolver.cjs                                  2.24 kB │ gzip: 1.00 kB
+dist/cjs/api/captcha/sealedAssetsResolver.cjs                                  2.37 kB │ gzip: 0.98 kB
 dist/cjs/tasks/captchaTypeSelection.cjs                                        2.44 kB │ gzip: 1.04 kB
 dist/cjs/api/admin/apiDnsEventEndpoint.cjs                                     2.59 kB │ gzip: 1.00 kB
 dist/cjs/utils/dns.cjs                                                         2.66 kB │ gzip: 1.02 kB
@@ -135,6 +136,8 @@ dist/cjs/api/public.cjs                                                        2
 dist/cjs/api/captcha/maintenanceModeResponses.cjs                              2.91 kB │ gzip: 0.77 kB
 dist/cjs/api/captcha/submitImageCaptchaSolution.cjs                            2.93 kB │ gzip: 1.03 kB
 dist/cjs/tasks/detection/getBotScore.cjs                                       3.37 kB │ gzip: 1.33 kB
+dist/cjs/compositeIpAddress.cjs                                                3.39 kB │ gzip: 1.36 kB
+dist/cjs/api/captcha/assetSealFormat.cjs                                       3.59 kB │ gzip: 1.37 kB
 dist/cjs/api/captcha/assignDetectorBundle.cjs                                  3.63 kB │ gzip: 1.37 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs          3.66 kB │ gzip: 1.35 kB
 dist/cjs/api/admin/apiAdminRoutesProvider.cjs                                  3.67 kB │ gzip: 0.62 kB
@@ -150,13 +153,13 @@ dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4
 dist/cjs/api/captcha.cjs                                                       4.51 kB │ gzip: 1.40 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs          4.56 kB │ gzip: 1.07 kB
 dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs                                     4.84 kB │ gzip: 1.74 kB
-dist/cjs/index.cjs                                                             4.95 kB │ gzip: 1.03 kB
+dist/cjs/index.cjs                                                             5.02 kB │ gzip: 1.05 kB
 dist/cjs/tasks/tasks.cjs                                                       5.07 kB │ gzip: 1.57 kB
 dist/cjs/tasks/detection/decoderPool.cjs                                       5.47 kB │ gzip: 2.06 kB
 dist/cjs/util/usageCounters.cjs                                                5.72 kB │ gzip: 2.03 kB
 dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs                                6.73 kB │ gzip: 1.89 kB
 dist/cjs/api/healthzGeo.cjs                                                    7.03 kB │ gzip: 2.70 kB
-dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              7.25 kB │ gzip: 2.05 kB
+dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              7.39 kB │ gzip: 2.06 kB
 dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     7.47 kB │ gzip: 2.48 kB
 dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             7.56 kB │ gzip: 2.03 kB
 dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              9.12 kB │ gzip: 2.71 kB
@@ -171,12 +174,12 @@ dist/cjs/api/blacklistRequestInspector.cjs                                    13
 dist/cjs/api/verify.cjs                                                       16.79 kB │ gzip: 2.93 kB
 dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             18.37 kB │ gzip: 4.89 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              20.05 kB │ gzip: 4.59 kB
-dist/cjs/tasks/captchaManager.cjs                                             23.94 kB │ gzip: 7.10 kB
 dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.12 kB │ gzip: 5.17 kB
-dist/cjs/tasks/powCaptcha/powTasks.cjs                                        24.99 kB │ gzip: 6.02 kB
+dist/cjs/tasks/captchaManager.cjs                                             24.62 kB │ gzip: 7.42 kB
+dist/cjs/tasks/powCaptcha/powTasks.cjs                                        25.55 kB │ gzip: 6.16 kB
 dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 27.94 kB │ gzip: 6.36 kB
 
-✓ built in 126ms
+✓ built in 191ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/provider@5.12.2 build:tsc
+> @prosopo/provider@5.13.0 build:tsc
 > tsc --build --verbose
 
-3:29:13 PM - Projects in this build: 
+9:06:33 AM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -28,53 +28,53 @@
     * ../web-bot-auth/tsconfig.json
     * tsconfig.json
 
-3:29:14 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/error.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/index.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/types.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/redisClient.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/tests/typesEnv.test-d.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/index.ts' is older than output '../env/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/tests/unit/testDoubles.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/productionProviderList.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
 
-3:29:14 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+9:06:33 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-3:29:14 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+9:06:33 AM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/provider@5.12.2 build
+> @prosopo/provider@5.13.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/provider@5.12.2 build:cross-env
+> @prosopo/provider@5.13.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -63,7 +63,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 113 modules transformed.
+✓ 116 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js                                        0.04 kB │ gzip: 0.06 kB
@@ -85,6 +85,7 @@ dist/api/dnsEventUrl.js                                                   0.80 k
 dist/api/ja4.js                                                           0.80 kB │ gzip: 0.44 kB
 dist/tasks/dataset/datasetTasks.js                                        0.85 kB │ gzip: 0.39 kB
 dist/tasks/powCaptcha/powTasksUtils.js                                    0.89 kB │ gzip: 0.46 kB
+dist/api/captcha/assetSeal.js                                             0.91 kB │ gzip: 0.50 kB
 dist/api/headerCheckMiddleware.js                                         0.91 kB │ gzip: 0.43 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js      0.95 kB │ gzip: 0.51 kB
 dist/api/admin/apiRegisterSiteKeyEndpoint.js                              1.00 kB │ gzip: 0.46 kB
@@ -105,7 +106,6 @@ dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 k
 dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip: 0.51 kB
 dist/tasks/dataset/datasetTasksUtils.js                                   1.30 kB │ gzip: 0.48 kB
 dist/api/assetDocument.js                                                 1.36 kB │ gzip: 0.75 kB
-dist/compositeIpAddress.js                                                1.36 kB │ gzip: 0.55 kB
 dist/tasks/detection/assignSecret.js                                      1.42 kB │ gzip: 0.74 kB
 dist/utils/clientMetaData.js                                              1.42 kB │ gzip: 0.72 kB
 dist/api/admin/apiGetAllDecisionMachinesEndpoint.js                       1.48 kB │ gzip: 0.57 kB
@@ -121,15 +121,16 @@ dist/api/admin/apiUpdateDecisionMachineEndpoint.js                        1.68 k
 dist/utils/honeypot/phraseBank.js                                         1.69 kB │ gzip: 0.84 kB
 dist/api/handshakeTimingMiddleware.js                                     1.75 kB │ gzip: 0.69 kB
 dist/tasks/spam/updateSpamEmailDomains.js                                 1.87 kB │ gzip: 0.77 kB
-dist/api/captcha/signedAssetsResolver.js                                  1.89 kB │ gzip: 0.94 kB
 dist/api/admin/apiClearAllCountersEndpoint.js                             1.89 kB │ gzip: 0.76 kB
 dist/tasks/frictionless/ipMatch.js                                        1.98 kB │ gzip: 1.02 kB
+dist/api/captcha/signedAssetsResolver.js                                  2.08 kB │ gzip: 0.98 kB
 dist/migrations/frictionlessLadder.js                                     2.12 kB │ gzip: 0.93 kB
 dist/tasks/puzzle/stratifiedSampler.js                                    2.14 kB │ gzip: 1.07 kB
 dist/tasks/frictionless/frictionlessTasksUtils.js                         2.16 kB │ gzip: 1.09 kB
 dist/api/captcha/maintenanceModeResponses.js                              2.16 kB │ gzip: 0.73 kB
 dist/tasks/frictionless/routingMachine.js                                 2.20 kB │ gzip: 0.93 kB
 dist/tasks/captchaTypeSelection.js                                        2.22 kB │ gzip: 1.03 kB
+dist/api/captcha/sealedAssetsResolver.js                                  2.26 kB │ gzip: 0.97 kB
 dist/utils/dns.js                                                         2.36 kB │ gzip: 0.95 kB
 dist/api/admin/apiDnsEventEndpoint.js                                     2.43 kB │ gzip: 0.96 kB
 dist/api/public.js                                                        2.45 kB │ gzip: 0.98 kB
@@ -139,8 +140,10 @@ dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.55 k
 dist/api/forwardVerify.js                                                 2.59 kB │ gzip: 1.10 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            2.59 kB │ gzip: 1.00 kB
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip: 0.55 kB
-dist/index.js                                                             2.92 kB │ gzip: 0.80 kB
+dist/index.js                                                             2.95 kB │ gzip: 0.81 kB
+dist/compositeIpAddress.js                                                3.15 kB │ gzip: 1.34 kB
 dist/tasks/detection/getBotScore.js                                       3.29 kB │ gzip: 1.32 kB
+dist/api/captcha/assetSealFormat.js                                       3.38 kB │ gzip: 1.34 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.39 kB │ gzip: 1.32 kB
 dist/api/captcha/assignDetectorBundle.js                                  3.40 kB │ gzip: 1.34 kB
 dist/api/domainMiddleware.js                                              3.52 kB │ gzip: 1.22 kB
@@ -159,7 +162,7 @@ dist/tasks/dnsEvent/enrichDnsEvent.js                                     4.71 k
 dist/tasks/detection/decoderPool.js                                       5.34 kB │ gzip: 2.02 kB
 dist/util/usageCounters.js                                                5.65 kB │ gzip: 2.01 kB
 dist/api/captcha/getPoWCaptchaChallenge.js                                6.09 kB │ gzip: 1.83 kB
-dist/api/captcha/getImageCaptchaChallenge.js                              6.51 kB │ gzip: 1.99 kB
+dist/api/captcha/getImageCaptchaChallenge.js                              6.61 kB │ gzip: 2.00 kB
 dist/api/captcha/getPuzzleCaptchaChallenge.js                             6.84 kB │ gzip: 1.97 kB
 dist/api/healthzGeo.js                                                    6.86 kB │ gzip: 2.68 kB
 dist/tasks/spam/checkTrafficFilter.js                                     7.16 kB │ gzip: 2.45 kB
@@ -176,11 +179,11 @@ dist/api/verify.js                                                       15.12 k
 dist/tasks/frictionless/frictionlessTasks.js                             17.80 kB │ gzip: 4.86 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              18.54 kB │ gzip: 4.48 kB
 dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.71 kB │ gzip: 5.12 kB
-dist/tasks/captchaManager.js                                             23.44 kB │ gzip: 7.03 kB
-dist/tasks/powCaptcha/powTasks.js                                        23.61 kB │ gzip: 5.97 kB
+dist/tasks/captchaManager.js                                             24.12 kB │ gzip: 7.34 kB
+dist/tasks/powCaptcha/powTasks.js                                        24.13 kB │ gzip: 6.12 kB
 dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.42 kB │ gzip: 6.30 kB
 
-✓ built in 127ms
+✓ built in 484ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # @prosopo/provider
 
+## 5.13.0
+### Minor Changes
+
+- 85a1bb9: Seal captcha image paths into opaque URLs, opened by a CDN edge script.
+  
+  An image URL used to say which image it was: `https://cdn.example.net/dataset/images/abc.webp`. Signed URLs already stop a harvested URL being refetched forever, but the path stays in plain sight, and the path is a stable identifier for the image behind it — which makes it a usable key for caching answers between sessions.
+  
+  The path is now AES-256-GCM sealed, with an expiry, into an opaque blob drawn fresh every time:
+  
+  ```
+  https://cdn.example.net/s/AgHk1n...Qx9.webp
+  ```
+  
+  The edge script opens it, puts the canonical path back on the request, and the CDN serves the one object that path names. The same image therefore has a different URL in every session, with nothing in the URL to group those together, and there is still only one cached copy and one stored object.
+  
+  Sealing happens strictly below `item.data`. The item hash, the captchaId and the datasetId are untouched, so nothing about the dataset or how a solution is verified changes.
+  
+  The provider seals with `node:crypto`, because `AssetsResolver.resolveAsset` is synchronous and every WebCrypto call returns a promise; the edge opens with WebCrypto, because that is what its runtime has. The wire format, the validation and the base64url alphabet live in one module both ends import, and a test seals with one end and opens with the other so the two cannot drift.
+  
+  Inert unless its key is configured, since a sealed URL is unservable until the matching edge script is live. Configured, it takes precedence over the signed resolver; leaving the signing key in place keeps that as the fallback for any zone not yet moved over. More than one key opens at a time, so keys can be rotated without a flag day. `npm run -w @prosopo/provider build:edge` emits the edge script as a single file. Rollout order, environment variables and rotation are documented for operators outside this repository.
+  
+  Test coverage: 51 unit tests over the wire format, the sealer, the resolver and the edge handler — round trip, tamper, truncation, expiry at the boundary, swapped key id, rotation across two live keys, path traversal and prefix confinement, URL shape and per-call uniqueness, passthrough of requests that are not sealed, idempotency when the handler runs at both hooks, and the provider-seals/edge-opens interop.
+
+### Patch Changes
+
+- 4c9b84b: Escalate a PoW solve to an image captcha when it arrives from a different address than the challenge.
+  
+  A PoW challenge is bound to the user account and the site key and to nothing about where the request came from, so a solved challenge can be carried to any host that wants a free pass. The issuing address is already on the record, so binding to it costs nothing: `verifyPowCaptchaSolution` now compares it against the address submitting the solve and escalates when they differ, under a new `IP_CHANGED` reason.
+  
+  Escalation, not denial. A phone handing off between towers mid-solve is a real user and should pay a picture rather than be turned away. For the same reason IPv6 is judged on the /64 alone — the interface identifier in the low 64 bits rotates by design under RFC 8981, several times a day on one unchanged connection — and an address we could not read counts as unchanged.
+  
+  Only applies where a session is linked, since escalation carries the originating session's risk profile forward. Missing coordinates still takes precedence as the reported reason when both fire.
+- 2cca36e: Report a bot score of zero to Pro and Enterprise instead of dropping the field.
+  
+  `canClientSeeScore` tested `score && tier && tier !== Tier.Free`. A session with nothing wrong with it scores 0, which is falsy, so `score` was omitted from the siteverify response for exactly those users: a paying customer got a score for every suspicious visitor and no score at all for their cleanest ones, which reads as "no score available" rather than "no risk".
+  
+  Invisible in production today because `Math.random() * 0.3` is added to every score, making an exact 0 all but impossible. Removing that noise — captcha-private#4433, where this was found — is what would have exposed it.
+  
+  The function also returned `number | boolean | undefined` from its `&&` chain; it now returns `boolean`.
+- Updated dependencies [4c9b84b]
+- Updated dependencies [f13bea8]
+  - @prosopo/types@5.10.1
+  - @prosopo/load-balancer@2.11.0
+  - @prosopo/api@4.3.4
+  - @prosopo/api-express-router@3.1.94
+  - @prosopo/database@4.0.40
+  - @prosopo/datasets@3.1.90
+  - @prosopo/env@3.6.63
+  - @prosopo/ipinfo@0.4.9
+  - @prosopo/keyring@2.9.96
+  - @prosopo/types-database@5.6.4
+  - @prosopo/types-env@2.11.9
+  - @prosopo/user-access-policy@3.14.10
+
+## 5.12.3
+### Patch Changes
+
+- aed164d: Make asset signing survive contact with a CDN that actually enforces it.
+  
+  Signing image URLs is optional and has been off in practice, so two paths that only break when a zone starts checking tokens have never been exercised. Both are fixed here, so enabling enforcement is a config change rather than a config change plus an incident.
+  
+  **A dataset could not be imported.** Hashing an item downloads the image from the URL stored in the dataset, and that URL is the canonical, unsigned one. Against an enforcing zone every one of those downloads is rejected, so a dataset becomes impossible to import on exactly the configuration it is meant to be served from. `downloadImage` now signs the URL when a signing key is configured, and leaves it alone when one is not.
+  
+  **A failed image never recovered.** The widget retried a broken image by appending a cache-busting query parameter. A token is a signature over the query string, so on a signed URL that parameter invalidates it and every retry is rejected — a transient failure turned permanent. The retry now re-requests the signed URL unchanged, and keeps the cache-buster for unsigned URLs, where it is still worth having and costs nothing.
+  
+  The token scheme itself now lives in one place, `@prosopo/datasets`, rather than being written out twice. The provider keeps its synchronous implementation, because `resolveAsset` cannot await, but both ends build the string to hash and encode the result through the same helpers.
+- Updated dependencies [aed164d]
+  - @prosopo/datasets@3.1.89
+
 ## 5.12.2
 ### Patch Changes
 

package/dist/api/captcha/assetSeal.d.ts

@@ -0,0 +1,15 @@
+export interface SealAssetPathParams {
+    readonly path: string;
+    readonly key: Uint8Array;
+    readonly keyId: number;
+    readonly expiresAtSeconds: number;
+}
+export declare const sealAssetPath: (params: SealAssetPathParams) => string;
+export interface UnsealAssetPathParams {
+    readonly blob: string;
+    readonly keys: ReadonlyMap<number, Uint8Array>;
+    readonly nowSeconds: number;
+    readonly requiredPathPrefix?: string;
+}
+export declare const unsealAssetPath: (params: UnsealAssetPathParams) => string | undefined;
+//# sourceMappingURL=assetSeal.d.ts.map

package/dist/api/captcha/assetSeal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSeal.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/assetSeal.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CAClC;AAED,eAAO,MAAM,aAAa,WAAY,mBAAmB,KAAG,MAqB3D,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,eAAO,MAAM,eAAe,WACnB,qBAAqB,KAC3B,MAAM,GAAG,SAiBX,CAAC"}

package/dist/api/captcha/assetSeal.js

@@ -0,0 +1,22 @@
+import { additionalData, encodeEnvelope, encodePayload, isSafeAssetPath } from "./assetSealFormat.js";
+import { createCipheriv, randomBytes } from "node:crypto";
+//#region src/api/captcha/assetSeal.ts
+var CIPHER = "aes-256-gcm";
+var GCM_OPTIONS = { authTagLength: 16 };
+var sealAssetPath = (params) => {
+	if (!isSafeAssetPath(params.path)) throw new Error(`Refusing to seal an unusable asset path: ${params.path}`);
+	const iv = randomBytes(12);
+	const cipher = createCipheriv(CIPHER, params.key, iv, GCM_OPTIONS);
+	cipher.setAAD(additionalData(params.keyId));
+	const ciphertext = Buffer.concat([cipher.update(encodePayload({
+		expiresAtSeconds: params.expiresAtSeconds,
+		path: params.path
+	})), cipher.final()]);
+	return encodeEnvelope({
+		keyId: params.keyId,
+		iv: new Uint8Array(iv),
+		sealed: new Uint8Array(Buffer.concat([ciphertext, cipher.getAuthTag()]))
+	});
+};
+//#endregion
+export { sealAssetPath };

package/dist/api/captcha/assetSeal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSeal.js","sourceRoot":"","sources":["../../../src/api/captcha/assetSeal.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACN,QAAQ,EAER,cAAc,EACd,cAAc,EACd,aAAa,EACb,cAAc,EACd,aAAa,EACb,eAAe,GACf,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,SAAS,GAAG,EAAE,CAAC;AASrB,MAAM,WAAW,GAAG,EAAE,aAAa,EAAE,SAAS,EAAW,CAAC;AAS1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAA2B,EAAU,EAAE;IACpE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAChC,MAAM,CAAC,MAAM,CACZ,aAAa,CAAC;YACb,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,IAAI,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC,CACF;QACD,MAAM,CAAC,KAAK,EAAE;KACd,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;KACxE,CAAC,CAAC;AACJ,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,MAA6B,EACR,EAAE;IACvB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC;QAC9D,CAAC,CAAC,OAAO,CAAC,IAAI;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,CACZ,MAAkB,EAClB,EAAc,EACd,GAAe,EACf,KAAa,EACe,EAAE;IAC9B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAChE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;YAC9D,QAAQ,CAAC,KAAK,EAAE;SAChB,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC"}

package/dist/api/captcha/assetSealFormat.d.ts

@@ -0,0 +1,23 @@
+export declare const SEAL_VERSION = 1;
+export declare const IV_BYTES = 12;
+export declare const MAX_ASSET_PATH_LENGTH = 512;
+export declare const SEAL_KEY_BYTES = 32;
+export interface SealEnvelope {
+    readonly keyId: number;
+    readonly iv: Uint8Array;
+    readonly sealed: Uint8Array;
+}
+export interface SealedPayload {
+    readonly expiresAtSeconds: number;
+    readonly path: string;
+}
+export declare const toBase64Url: (bytes: Uint8Array) => string;
+export declare const fromBase64Url: (value: string) => Uint8Array | undefined;
+export declare const additionalData: (keyId: number) => Uint8Array;
+export declare const encodeEnvelope: (envelope: SealEnvelope) => string;
+export declare const decodeEnvelope: (blob: string) => SealEnvelope | undefined;
+export declare const encodePayload: (payload: SealedPayload) => Uint8Array;
+export declare const decodePayload: (bytes: Uint8Array) => SealedPayload | undefined;
+export declare const isSafeAssetPath: (path: string, requiredPrefix?: string) => boolean;
+export declare const parseSealKeys: (spec: string) => Map<number, Uint8Array>;
+//# sourceMappingURL=assetSealFormat.d.ts.map

package/dist/api/captcha/assetSealFormat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSealFormat.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/assetSealFormat.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B,eAAO,MAAM,QAAQ,KAAK,CAAC;AAM3B,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAIzC,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAKD,eAAO,MAAM,WAAW,UAAW,UAAU,KAAG,MAS/C,CAAC;AAEF,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,UAAU,GAAG,SAmB1D,CAAC;AAEF,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,UACT,CAAC;AAEvC,eAAO,MAAM,cAAc,aAAc,YAAY,KAAG,MAQvD,CAAC;AAEF,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,YAAY,GAAG,SAiB5D,CAAC;AAEF,eAAO,MAAM,aAAa,YAAa,aAAa,KAAG,UAMtD,CAAC;AAEF,eAAO,MAAM,aAAa,UAAW,UAAU,KAAG,aAAa,GAAG,SAajE,CAAC;AAEF,eAAO,MAAM,eAAe,SACrB,MAAM,mBACK,MAAM,KACrB,OAYF,CAAC;AAEF,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAiClE,CAAC"}

package/dist/api/captcha/assetSealFormat.js

@@ -0,0 +1,87 @@
+var AAD_BYTES = 2;
+var EXPIRY_BYTES = 4;
+var MAX_KEY_ID = 255;
+var BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder("utf-8", { fatal: true });
+var toBase64Url = (bytes) => {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var fromBase64Url = (value) => {
+	if (!BASE64URL_PATTERN.test(value)) return;
+	const normalised = value.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = normalised.padEnd(normalised.length + (4 - normalised.length % 4) % 4, "=");
+	try {
+		const binary = atob(padded);
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+		return bytes;
+	} catch {
+		return;
+	}
+};
+var additionalData = (keyId) => new Uint8Array([1, keyId]);
+var encodeEnvelope = (envelope) => {
+	const bytes = new Uint8Array(AAD_BYTES + envelope.iv.length + envelope.sealed.length);
+	bytes.set(additionalData(envelope.keyId), 0);
+	bytes.set(envelope.iv, AAD_BYTES);
+	bytes.set(envelope.sealed, AAD_BYTES + envelope.iv.length);
+	return toBase64Url(bytes);
+};
+var decodeEnvelope = (blob) => {
+	const bytes = fromBase64Url(blob);
+	if (!bytes || bytes.length <= 14) return;
+	if (bytes[0] !== 1) return;
+	const keyId = bytes[1];
+	if (void 0 === keyId) return;
+	return {
+		keyId,
+		iv: bytes.slice(AAD_BYTES, 14),
+		sealed: bytes.slice(14)
+	};
+};
+var encodePayload = (payload) => {
+	const path = textEncoder.encode(payload.path);
+	const bytes = new Uint8Array(EXPIRY_BYTES + path.length);
+	new DataView(bytes.buffer).setUint32(0, payload.expiresAtSeconds, false);
+	bytes.set(path, EXPIRY_BYTES);
+	return bytes;
+};
+var decodePayload = (bytes) => {
+	if (bytes.length <= EXPIRY_BYTES) return;
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	try {
+		return {
+			expiresAtSeconds: view.getUint32(0, false),
+			path: textDecoder.decode(bytes.subarray(EXPIRY_BYTES))
+		};
+	} catch {
+		return;
+	}
+};
+var isSafeAssetPath = (path, requiredPrefix) => {
+	if (!path.startsWith("/") || path.length > 512) return false;
+	if (path.includes("..") || path.includes("//")) return false;
+	if (/[\u0000-\u001f\u007f]/.test(path)) return false;
+	return void 0 === requiredPrefix || path.startsWith(requiredPrefix);
+};
+var parseSealKeys = (spec) => {
+	const keys = /* @__PURE__ */ new Map();
+	for (const entry of spec.split(",")) {
+		const trimmed = entry.trim();
+		if ("" === trimmed) continue;
+		const separator = trimmed.indexOf(":");
+		if (separator <= 0) throw new Error("Malformed seal key entry: expected \"keyId:base64key\"");
+		const keyId = Number(trimmed.slice(0, separator));
+		if (!Number.isInteger(keyId) || keyId < 0 || keyId > MAX_KEY_ID) throw new Error(`Seal key id must be an integer in [0, ${MAX_KEY_ID}]`);
+		const key = fromBase64Url(trimmed.slice(separator + 1).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""));
+		if (!key || key.length !== 32) throw new Error(`Seal key ${keyId} must be 32 base64-encoded bytes`);
+		keys.set(keyId, key);
+	}
+	if (0 === keys.size) throw new Error("No seal keys configured");
+	return keys;
+};
+//#endregion
+export { additionalData, decodeEnvelope, decodePayload, encodeEnvelope, encodePayload, fromBase64Url, isSafeAssetPath, parseSealKeys, toBase64Url };

package/dist/api/captcha/assetSealFormat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSealFormat.js","sourceRoot":"","sources":["../../../src/api/captcha/assetSealFormat.ts"],"names":[],"mappings":"AAkBA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAE9B,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAE3B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAE7C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAajC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAU,EAAE;IACxD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAA0B,EAAE;IACtE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAC/B,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACvD,GAAG,CACH,CAAC;IACF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAc,EAAE,CAC3D,IAAI,UAAU,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAsB,EAAU,EAAE;IAChE,MAAM,KAAK,GAAG,IAAI,UAAU,CAC3B,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACvD,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAClC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAA4B,EAAE;IACxE,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,KAAK;QACL,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAC;QAChD,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC;KACzC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAsB,EAAc,EAAE;IACnE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAiB,EAA6B,EAAE;IAC7E,IAAI,KAAK,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,IAAI,CAAC;QACJ,OAAO;YACN,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC;YAC1C,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,IAAY,EACZ,cAAuB,EACb,EAAE;IACZ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAA2B,EAAE;IACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YACpB,SAAS;QACV,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,GAAG,GAAG,aAAa,CACxB,OAAO;aACL,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;aACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACpB,CAAC;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACd,YAAY,KAAK,YAAY,cAAc,uBAAuB,CAClE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC,CAAC"}

package/dist/api/captcha/getImageCaptchaChallenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getImageCaptchaChallenge.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/getImageCaptchaChallenge.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;8BAgBnD,mBAAmB,0BACA,kBAAkB,WAGpC,OAAO,GAAG,gBAAgB,OAC1B,QAAQ,QACP,YAAY;AAPpB,wBAqTG"}
+{"version":3,"file":"getImageCaptchaChallenge.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/getImageCaptchaChallenge.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;8BAiBnD,mBAAmB,0BACA,kBAAkB,WAGpC,OAAO,GAAG,gBAAgB,OAC1B,QAAQ,QACP,YAAY;AAPpB,wBAmTG"}

package/dist/api/captcha/getImageCaptchaChallenge.js

@@ -7,6 +7,7 @@ import { isReservedTestSiteKey } from "../testSiteKey.js";
 import { normalizeRequestIp } from "../../utils/normalizeRequestIp.js";
 import { buildImageMaintenanceResponse } from "./maintenanceModeResponses.js";
 import { applyTrafficFilterAtRequestTime } from "./trafficFilterRequestTime.js";
+import { getSealedAssetsResolver } from "./sealedAssetsResolver.js";
 import { getSignedAssetsResolver } from "./signedAssetsResolver.js";
 import { ProsopoApiError } from "@prosopo/common";
 import { ApiParams, CaptchaRequestBody, CaptchaType, SimdReadingsStage, clampImageRounds } from "@prosopo/types";
@@ -111,7 +112,7 @@ var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (r
 			}));
 		});
 		const taskData = await tasks.imgCaptchaManager.getRandomCaptchasAndRequestHash(datasetId, user, ipAddress, captchaConfig, clientRecord.settings.imageThreshold ?? .8, validSessionId, req.ipInfo);
-		const assetsResolver = getSignedAssetsResolver(ipAddress.toString()) ?? env.assetsResolver;
+		const assetsResolver = getSealedAssetsResolver() ?? getSignedAssetsResolver(ipAddress.toString()) ?? env.assetsResolver;
 		const captchaResponse = {
 			[ApiParams.status]: "ok",
 			[ApiParams.captchas]: taskData.captchas.map((captcha) => ({