@prosopo/provider 5.12.2 → 5.13.0

package/dist/api/captcha/getImageCaptchaChallenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"getImageCaptchaChallenge.js","sourceRoot":"","sources":["../../../src/api/captcha/getImageCaptchaChallenge.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACN,SAAS,EAET,kBAAkB,EAGlB,WAAW,EAEX,iBAAiB,EACjB,gBAAgB,GAChB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAClF,OAAO,EACN,mBAAmB,EACnB,2BAA2B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,eAAe,CACd,GAAwB,EACxB,sBAA0C,EACzC,EAAE,CACH,KAAK,EACJ,GAA+B,EAC/B,GAAa,EACb,IAAkB,EACjB,EAAE;IACH,IAAI,MAAoC,CAAC;IAEzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,iBAAiB,EAAE;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE;YACrD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,CAAC;QACJ,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,qBAAqB,EAAE;YAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YAClC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,EACL,SAAS,EAAE,eAAe,EAC1B,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,YAAY,GACZ,GAAG,MAAM,CAAC;IAMX,MAAM,SAAS,GAAG,eAAe,IAAI,GAAG,CAAC,SAAS,CAAC;IAEnD,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,iBAAiB,EAAE;YACtC,OAAO,EAAE;gBACR,IAAI,EAAE,GAAG;gBACT,KAAK,EAAE,sDAAsD;aAC7D;YACD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CACF,CAAC;IACH,CAAC;IAED,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,YAAY,CAAC,IAAI,CAAC,CAAC;IAKnB,IAAI,kBAAkB,EAAE,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CAAC,CAAC;QACJ,OAAO,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAClD,CAAC;IAMD,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,0DAA0D;YAC/D,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CAAC,CAAC;QACJ,OAAO,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzC,IAAI,CAAC;QACJ,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,6BAA6B,EAAE;gBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;gBACrC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB,CAAC,CACF,CAAC;QACH,CAAC;QAGD,MAAM,WAAW,GAChB,GAAG,CAAC,MAAM,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;YAC1D,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW;YACxB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GACR,GAAG,CAAC,MAAM,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;YAC1D,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS;YACtB,CAAC,CAAC,SAAS,CAAC;QAOd,MAAM,aAAa,GAAG,SAAS;YAC9B,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,SAAS,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QAEb,MAAM,SAAS,GAAG,mBAAmB,CACpC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EACpB,GAAG,CAAC,GAAG,EACP,YAAY,EACZ,IAAI,EACJ,aAAa,EAAE,iBAAiB,EAChC,SAAS,EACT,WAAW,EACX,GAAG,CACH,CAAC;QAUF,MAAM,cAAc,GACnB,MAAM,KAAK,CAAC,iBAAiB,CAAC,4BAA4B,CACzD,sBAAsB,EACtB,IAAI,EACJ,SAAS,EACT,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,CACxC,CAAC;QACH,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAMtE,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAC/B,CAAC;QAEF,MAAM,EACL,KAAK,EACL,MAAM,EACN,SAAS,EAAE,cAAc,EACzB,iBAAiB,GACjB,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAC/C,YAAY,EACZ,WAAW,CAAC,KAAK,EACjB,GAAG,EACH,SAAS,EACT,gBAAgB,EAChB,YAAY,CACZ,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAChD,OAAO,EAAE;oBACR,IAAI,EAAE,GAAG;oBACT,OAAO,EAAE,IAAI;oBACb,IAAI;iBACJ;gBACD,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB,CAAC,CACF,CAAC;QACH,CAAC;QAOD,MAAM,cAAc,GAAG,+BAA+B,CACrD,GAAG,CAAC,MAAM,EACV,YAAY,CAAC,QAAQ,EAAE,aAAa,EACpC,GAAG,CAAC,MAAM,CACV,CAAC;QACF,MAAM,wBAAwB,GAC7B,cAAc,CAAC,IAAI,KAAK,WAAW;YAClC,CAAC,CAAC,cAAc,CAAC,iBAAiB;YAClC,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,aAAa,GAA0C;YAC5D,MAAM,EAAE;gBAIP,KAAK,EAAE,gBAAgB,CACtB,wBAAwB;oBACvB,iBAAiB;oBACjB,gBAAgB,EAAE,iBAAiB;oBACnC,oBAAoB,EAAE,iBAAiB;oBACvC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EACjC,YAAY,CAAC,QAAQ,CACrB;aACD;YACD,QAAQ,EAAE;gBACT,KAAK,EACJ,gBAAgB,EAAE,mBAAmB;oBACrC,oBAAoB,EAAE,mBAAmB;oBACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK;aACnC;SACD,CAAC;QAEF,IAAI,cAAc,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,KAAK,CAAC,mBAAmB;iBAC7B,oCAAoC,CACpC,cAAc,EACd,YAAY,EACZ,iBAAiB,CAAC,SAAS,CAC3B;iBACA,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;gBACpB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACtB,GAAG,EAAE,SAAS;oBACd,GAAG,EAAE,+DAA+D;iBACpE,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GACb,MAAM,KAAK,CAAC,iBAAiB,CAAC,+BAA+B,CAC5D,SAAS,EACT,IAAI,EACJ,SAAS,EACT,aAAa,EACb,YAAY,CAAC,QAAQ,CAAC,cAAc,IAAI,GAAG,EAC3C,cAAc,EAId,GAAG,CAAC,MAAM,CACV,CAAC;QAKH,MAAM,cAAc,GACnB,uBAAuB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC;QAErE,MAAM,eAAe,GAAwB;YAC5C,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI;YACxB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC;gBAClE,GAAG,OAAO;gBACV,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CACxC;aACD,CAAC,CAAC;YACH,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,WAAW;YAC7C,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;YACpD,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;gBACtB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;oBACrB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,iBAAiB;iBACnD;aACD;SACD,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE;gBACL,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK;gBAC7C,IAAI;gBACJ,IAAI;gBACJ,SAAS;aACT;SACD,CAAC,CAAC,CAAC;QACJ,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,uBAAuB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG;YACH,IAAI,EAAE,GAAG,CAAC,MAAM;YAChB,GAAG,EAAE,0CAA0C;SAC/C,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,iBAAiB,EAAE;YACtC,OAAO,EAAE;gBACR,KAAK,EAAE,GAAG;gBAEV,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB;YACD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CACF,CAAC;IACH,CAAC;AACF,CAAC,CAAC"}
+{"version":3,"file":"getImageCaptchaChallenge.js","sourceRoot":"","sources":["../../../src/api/captcha/getImageCaptchaChallenge.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACN,SAAS,EAET,kBAAkB,EAGlB,WAAW,EAEX,iBAAiB,EACjB,gBAAgB,GAChB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAClF,OAAO,EACN,mBAAmB,EACnB,2BAA2B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,eAAe,CACd,GAAwB,EACxB,sBAA0C,EACzC,EAAE,CACH,KAAK,EACJ,GAA+B,EAC/B,GAAa,EACb,IAAkB,EACjB,EAAE;IACH,IAAI,MAAoC,CAAC;IAEzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,iBAAiB,EAAE;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE;YACrD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,CAAC;QACJ,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,qBAAqB,EAAE;YAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YAClC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,EACL,SAAS,EAAE,eAAe,EAC1B,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,YAAY,GACZ,GAAG,MAAM,CAAC;IAMX,MAAM,SAAS,GAAG,eAAe,IAAI,GAAG,CAAC,SAAS,CAAC;IAEnD,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,iBAAiB,EAAE;YACtC,OAAO,EAAE;gBACR,IAAI,EAAE,GAAG;gBACT,KAAK,EAAE,sDAAsD;aAC7D;YACD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CACF,CAAC;IACH,CAAC;IAED,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,YAAY,CAAC,IAAI,CAAC,CAAC;IAKnB,IAAI,kBAAkB,EAAE,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CAAC,CAAC;QACJ,OAAO,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAClD,CAAC;IAMD,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,0DAA0D;YAC/D,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CAAC,CAAC;QACJ,OAAO,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzC,IAAI,CAAC;QACJ,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,6BAA6B,EAAE;gBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;gBACrC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB,CAAC,CACF,CAAC;QACH,CAAC;QAGD,MAAM,WAAW,GAChB,GAAG,CAAC,MAAM,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;YAC1D,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW;YACxB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GACR,GAAG,CAAC,MAAM,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;YAC1D,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS;YACtB,CAAC,CAAC,SAAS,CAAC;QAOd,MAAM,aAAa,GAAG,SAAS;YAC9B,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,SAAS,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QAEb,MAAM,SAAS,GAAG,mBAAmB,CACpC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EACpB,GAAG,CAAC,GAAG,EACP,YAAY,EACZ,IAAI,EACJ,aAAa,EAAE,iBAAiB,EAChC,SAAS,EACT,WAAW,EACX,GAAG,CACH,CAAC;QAUF,MAAM,cAAc,GACnB,MAAM,KAAK,CAAC,iBAAiB,CAAC,4BAA4B,CACzD,sBAAsB,EACtB,IAAI,EACJ,SAAS,EACT,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,CACxC,CAAC;QACH,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAMtE,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAC/B,CAAC;QAEF,MAAM,EACL,KAAK,EACL,MAAM,EACN,SAAS,EAAE,cAAc,EACzB,iBAAiB,GACjB,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAC/C,YAAY,EACZ,WAAW,CAAC,KAAK,EACjB,GAAG,EACH,SAAS,EACT,gBAAgB,EAChB,YAAY,CACZ,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAChD,OAAO,EAAE;oBACR,IAAI,EAAE,GAAG;oBACT,OAAO,EAAE,IAAI;oBACb,IAAI;iBACJ;gBACD,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB,CAAC,CACF,CAAC;QACH,CAAC;QAOD,MAAM,cAAc,GAAG,+BAA+B,CACrD,GAAG,CAAC,MAAM,EACV,YAAY,CAAC,QAAQ,EAAE,aAAa,EACpC,GAAG,CAAC,MAAM,CACV,CAAC;QACF,MAAM,wBAAwB,GAC7B,cAAc,CAAC,IAAI,KAAK,WAAW;YAClC,CAAC,CAAC,cAAc,CAAC,iBAAiB;YAClC,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,aAAa,GAA0C;YAC5D,MAAM,EAAE;gBAIP,KAAK,EAAE,gBAAgB,CACtB,wBAAwB;oBACvB,iBAAiB;oBACjB,gBAAgB,EAAE,iBAAiB;oBACnC,oBAAoB,EAAE,iBAAiB;oBACvC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EACjC,YAAY,CAAC,QAAQ,CACrB;aACD;YACD,QAAQ,EAAE;gBACT,KAAK,EACJ,gBAAgB,EAAE,mBAAmB;oBACrC,oBAAoB,EAAE,mBAAmB;oBACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK;aACnC;SACD,CAAC;QAEF,IAAI,cAAc,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,KAAK,CAAC,mBAAmB;iBAC7B,oCAAoC,CACpC,cAAc,EACd,YAAY,EACZ,iBAAiB,CAAC,SAAS,CAC3B;iBACA,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;gBACpB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACtB,GAAG,EAAE,SAAS;oBACd,GAAG,EAAE,+DAA+D;iBACpE,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GACb,MAAM,KAAK,CAAC,iBAAiB,CAAC,+BAA+B,CAC5D,SAAS,EACT,IAAI,EACJ,SAAS,EACT,aAAa,EACb,YAAY,CAAC,QAAQ,CAAC,cAAc,IAAI,GAAG,EAC3C,cAAc,EAId,GAAG,CAAC,MAAM,CACV,CAAC;QACH,MAAM,cAAc,GACnB,uBAAuB,EAAE;YACzB,uBAAuB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC7C,GAAG,CAAC,cAAc,CAAC;QAEpB,MAAM,eAAe,GAAwB;YAC5C,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI;YACxB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC;gBAClE,GAAG,OAAO;gBACV,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CACxC;aACD,CAAC,CAAC;YACH,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,WAAW;YAC7C,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;YACpD,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;gBACtB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;oBACrB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,iBAAiB;iBACnD;aACD;SACD,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE;gBACL,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK;gBAC7C,IAAI;gBACJ,IAAI;gBACJ,SAAS;aACT;SACD,CAAC,CAAC,CAAC;QACJ,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,uBAAuB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG;YACH,IAAI,EAAE,GAAG,CAAC,MAAM;YAChB,GAAG,EAAE,0CAA0C;SAC/C,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CACV,IAAI,eAAe,CAAC,iBAAiB,EAAE;YACtC,OAAO,EAAE;gBACR,KAAK,EAAE,GAAG;gBAEV,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB;YACD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CACF,CAAC;IACH,CAAC;AACF,CAAC,CAAC"}

package/dist/api/captcha/sealedAssetsResolver.d.ts

@@ -0,0 +1,22 @@
+import type { Asset, AssetsResolver } from "@prosopo/types";
+export declare const DEFAULT_ASSET_SEAL_TTL_SECONDS = 300;
+export declare const DEFAULT_ASSET_SEAL_URL_PREFIX = "s";
+export interface SealedAssetsResolverOptions {
+    readonly key: Uint8Array;
+    readonly keyId: number;
+    readonly ttlSeconds?: number;
+    readonly urlPrefix?: string;
+    readonly now?: () => number;
+}
+export declare class SealedAssetsResolver implements AssetsResolver {
+    private readonly key;
+    private readonly keyId;
+    private readonly ttlSeconds;
+    private readonly urlPrefix;
+    private readonly now;
+    constructor(options: SealedAssetsResolverOptions);
+    resolveAsset(assetURI: string): Asset;
+    private toUrl;
+}
+export declare function getSealedAssetsResolver(): AssetsResolver | undefined;
+//# sourceMappingURL=sealedAssetsResolver.d.ts.map

package/dist/api/captcha/sealedAssetsResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedAssetsResolver.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/sealedAssetsResolver.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI5D,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,qBAAa,oBAAqB,YAAW,cAAc;IAC1D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,EAAE,2BAA2B;IAQhD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK;IAyBrC,OAAO,CAAC,KAAK;CAUb;AAYD,wBAAgB,uBAAuB,IAAI,cAAc,GAAG,SAAS,CA2BpE"}

package/dist/api/captcha/sealedAssetsResolver.js

@@ -0,0 +1,69 @@
+import { parseSealKeys } from "./assetSealFormat.js";
+import { sealAssetPath } from "./assetSeal.js";
+var SealedAssetsResolver = class {
+	constructor(options) {
+		this.key = options.key;
+		this.keyId = options.keyId;
+		this.ttlSeconds = options.ttlSeconds ?? 300;
+		this.urlPrefix = options.urlPrefix ?? "s";
+		this.now = options.now ?? (() => Date.now());
+	}
+	resolveAsset(assetURI) {
+		const url = this.toUrl(assetURI);
+		if (!url) return {
+			URI: assetURI,
+			getURL: () => assetURI
+		};
+		if (url.search !== "") throw new Error(`Cannot seal an asset URL that has a query string: ${assetURI}`);
+		const blob = sealAssetPath({
+			path: url.pathname,
+			key: this.key,
+			keyId: this.keyId,
+			expiresAtSeconds: Math.floor(this.now() / 1e3) + this.ttlSeconds
+		});
+		const sealed = `${url.origin}/${this.urlPrefix}/${blob}${extensionOf(url.pathname)}`;
+		return {
+			URI: assetURI,
+			getURL: () => sealed
+		};
+	}
+	toUrl(assetURI) {
+		try {
+			const url = new URL(assetURI);
+			return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+		} catch {
+			return;
+		}
+	}
+};
+var extensionOf = (pathname) => {
+	const lastDot = pathname.lastIndexOf(".");
+	if (lastDot <= pathname.lastIndexOf("/") + 1) return "";
+	const extension = pathname.slice(lastDot);
+	return /^\.[a-zA-Z0-9]{1,8}$/.test(extension) ? extension : "";
+};
+function getSealedAssetsResolver() {
+	const spec = process.env.PROSOPO_ASSET_SEAL_KEYS;
+	if (!spec) return;
+	const keys = parseSealKeys(spec);
+	const keyId = activeKeyId(keys);
+	const key = keys.get(keyId);
+	if (!key) throw new Error(`PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID ${keyId} is not in PROSOPO_ASSET_SEAL_KEYS`);
+	return new SealedAssetsResolver({
+		key,
+		keyId,
+		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_SEAL_TTL_SECONDS ?? "", 10) || 300,
+		urlPrefix: process.env.PROSOPO_ASSET_SEAL_URL_PREFIX || "s"
+	});
+}
+var activeKeyId = (keys) => {
+	const configured = process.env.PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID;
+	if (configured) {
+		const parsed = Number.parseInt(configured, 10);
+		if (!Number.isInteger(parsed)) throw new Error("PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID must be an integer");
+		return parsed;
+	}
+	return Math.max(...keys.keys());
+};
+//#endregion
+export { SealedAssetsResolver, getSealedAssetsResolver };

package/dist/api/captcha/sealedAssetsResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedAssetsResolver.js","sourceRoot":"","sources":["../../../src/api/captcha/sealedAssetsResolver.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAUjD,MAAM,OAAO,oBAAoB;IAOhC,YAAY,OAAoC;QAC/C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,8BAA8B,CAAC;QACvE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,6BAA6B,CAAC;QACpE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,qDAAqD,QAAQ,EAAE,CAC/D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC;YAC1B,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;SACjE,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAErF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAC3D,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD;AAED,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;IAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACd,oCAAoC,KAAK,oCAAoC,CAC7E,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GACf,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,EAAE,EAAE,CAAC;QACrE,8BAA8B,CAAC;IAEhC,OAAO,IAAI,oBAAoB,CAAC;QAC/B,GAAG;QACH,KAAK;QACL,UAAU;QACV,SAAS,EACR,OAAO,CAAC,GAAG,CAAC,6BAA6B;YACzC,6BAA6B;KAC9B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAqC,EAAU,EAAE;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IAChE,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC"}

package/dist/api/captcha/signedAssetsResolver.d.ts

@@ -1,5 +1,6 @@
+import { DEFAULT_ASSET_TOKEN_TTL_SECONDS } from "@prosopo/datasets";
 import type { Asset, AssetsResolver } from "@prosopo/types";
-export declare const DEFAULT_ASSET_TOKEN_TTL_SECONDS = 300;
+export { DEFAULT_ASSET_TOKEN_TTL_SECONDS };
 export interface SignedAssetsResolverOptions {
     securityKey: string;
     ttlSeconds?: number;

package/dist/api/captcha/signedAssetsResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signedAssetsResolver.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/signedAssetsResolver.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE5D,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,MAAM,WAAW,2BAA2B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,qBAAa,oBAAqB,YAAW,cAAc;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,EAAE,2BAA2B;IAOhD,OAAO,CAAC,IAAI;IAUZ,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK;IA0BrC,OAAO,CAAC,KAAK;CAUb;AAQD,wBAAgB,uBAAuB,CACtC,QAAQ,CAAC,EAAE,MAAM,GACf,cAAc,GAAG,SAAS,CAqB5B"}
+{"version":3,"file":"signedAssetsResolver.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/signedAssetsResolver.ts"],"names":[],"mappings":"AAmCA,OAAO,EACN,+BAA+B,EAG/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAE3C,MAAM,WAAW,2BAA2B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,qBAAa,oBAAqB,YAAW,cAAc;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,EAAE,2BAA2B;IAOhD,OAAO,CAAC,IAAI;IAYZ,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK;IA0BrC,OAAO,CAAC,KAAK;CAUb;AAQD,wBAAgB,uBAAuB,CACtC,QAAQ,CAAC,EAAE,MAAM,GACf,cAAc,GAAG,SAAS,CAqB5B"}

package/dist/api/captcha/signedAssetsResolver.js

@@ -1,14 +1,15 @@
 import { createHash } from "node:crypto";
+import { DEFAULT_ASSET_TOKEN_TTL_SECONDS, assetTokenBase, encodeAssetToken } from "@prosopo/datasets";
+//#region src/api/captcha/signedAssetsResolver.ts
 var SignedAssetsResolver = class {
 	constructor(options) {
 		this.securityKey = options.securityKey;
-		this.ttlSeconds = options.ttlSeconds ?? 300;
+		this.ttlSeconds = options.ttlSeconds ?? DEFAULT_ASSET_TOKEN_TTL_SECONDS;
 		this.clientIp = options.clientIp;
 		this.now = options.now ?? (() => Date.now());
 	}
 	sign(path, expires) {
-		const base = `${this.securityKey}${path}${expires}${this.clientIp ?? ""}`;
-		return createHash("sha256").update(base).digest("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+		return encodeAssetToken(new Uint8Array(createHash("sha256").update(assetTokenBase(this.securityKey, path, expires, this.clientIp)).digest()));
 	}
 	resolveAsset(assetURI) {
 		const url = this.toUrl(assetURI);
@@ -45,9 +46,9 @@ function getSignedAssetsResolver(clientIp) {
 	if (!securityKey) return;
 	return new SignedAssetsResolver({
 		securityKey,
-		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || 300,
+		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || DEFAULT_ASSET_TOKEN_TTL_SECONDS,
 		...process.env.PROSOPO_ASSET_TOKEN_BIND_IP === "true" && clientIp ? { clientIp } : {}
 	});
 }
 //#endregion
-export { SignedAssetsResolver, getSignedAssetsResolver };
+export { DEFAULT_ASSET_TOKEN_TTL_SECONDS, SignedAssetsResolver, getSignedAssetsResolver };

package/dist/api/captcha/signedAssetsResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"signedAssetsResolver.js","sourceRoot":"","sources":["../../../src/api/captcha/signedAssetsResolver.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAYnD,MAAM,OAAO,oBAAoB;IAMhC,YAAY,OAAoC;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,+BAA+B,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,IAAI,CAAC,IAAY,EAAE,OAAe;QACzC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1E,OAAO,UAAU,CAAC,QAAQ,CAAC;aACzB,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,QAAQ,CAAC;aAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAIjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QAMD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,6DAA6D,QAAQ,EAAE,CACvE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,UAAU,KAAK,YAAY,OAAO,EAAE,CAAC;QAEhF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAC3D,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD;AAQD,MAAM,UAAU,uBAAuB,CACtC,QAAiB;IAEjB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GACf,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,EAAE,EAAE,CAAC;QACtE,+BAA+B,CAAC;IAMjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAC;IAElE,OAAO,IAAI,oBAAoB,CAAC;QAC/B,WAAW;QACX,UAAU;QACV,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"signedAssetsResolver.js","sourceRoot":"","sources":["../../../src/api/captcha/signedAssetsResolver.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,+BAA+B,EAC/B,cAAc,EACd,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAY3C,MAAM,OAAO,oBAAoB;IAMhC,YAAY,OAAoC;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,+BAA+B,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,IAAI,CAAC,IAAY,EAAE,OAAe;QACzC,OAAO,gBAAgB,CACtB,IAAI,UAAU,CACb,UAAU,CAAC,QAAQ,CAAC;aAClB,MAAM,CACN,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAC9D;aACA,MAAM,EAAE,CACV,CACD,CAAC;IACH,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAIjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QAMD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,6DAA6D,QAAQ,EAAE,CACvE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,UAAU,KAAK,YAAY,OAAO,EAAE,CAAC;QAEhF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAW,EAAE,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAC3D,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD;AAQD,MAAM,UAAU,uBAAuB,CACtC,QAAiB;IAEjB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GACf,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,EAAE,EAAE,CAAC;QACtE,+BAA+B,CAAC;IAMjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAC;IAElE,OAAO,IAAI,oBAAoB,CAAC;QAC/B,WAAW;QACX,UAAU;QACV,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/api/captcha/assetSeal.cjs

@@ -0,0 +1,22 @@
+const require_assetSealFormat = require("./assetSealFormat.cjs");
+let node_crypto = require("node:crypto");
+//#region src/api/captcha/assetSeal.ts
+var CIPHER = "aes-256-gcm";
+var GCM_OPTIONS = { authTagLength: 16 };
+var sealAssetPath = (params) => {
+	if (!require_assetSealFormat.isSafeAssetPath(params.path)) throw new Error(`Refusing to seal an unusable asset path: ${params.path}`);
+	const iv = (0, node_crypto.randomBytes)(12);
+	const cipher = (0, node_crypto.createCipheriv)(CIPHER, params.key, iv, GCM_OPTIONS);
+	cipher.setAAD(require_assetSealFormat.additionalData(params.keyId));
+	const ciphertext = Buffer.concat([cipher.update(require_assetSealFormat.encodePayload({
+		expiresAtSeconds: params.expiresAtSeconds,
+		path: params.path
+	})), cipher.final()]);
+	return require_assetSealFormat.encodeEnvelope({
+		keyId: params.keyId,
+		iv: new Uint8Array(iv),
+		sealed: new Uint8Array(Buffer.concat([ciphertext, cipher.getAuthTag()]))
+	});
+};
+//#endregion
+exports.sealAssetPath = sealAssetPath;

package/dist/cjs/api/captcha/assetSealFormat.cjs

@@ -0,0 +1,95 @@
+var AAD_BYTES = 2;
+var EXPIRY_BYTES = 4;
+var MAX_KEY_ID = 255;
+var BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder("utf-8", { fatal: true });
+var toBase64Url = (bytes) => {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var fromBase64Url = (value) => {
+	if (!BASE64URL_PATTERN.test(value)) return;
+	const normalised = value.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = normalised.padEnd(normalised.length + (4 - normalised.length % 4) % 4, "=");
+	try {
+		const binary = atob(padded);
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+		return bytes;
+	} catch {
+		return;
+	}
+};
+var additionalData = (keyId) => new Uint8Array([1, keyId]);
+var encodeEnvelope = (envelope) => {
+	const bytes = new Uint8Array(AAD_BYTES + envelope.iv.length + envelope.sealed.length);
+	bytes.set(additionalData(envelope.keyId), 0);
+	bytes.set(envelope.iv, AAD_BYTES);
+	bytes.set(envelope.sealed, AAD_BYTES + envelope.iv.length);
+	return toBase64Url(bytes);
+};
+var decodeEnvelope = (blob) => {
+	const bytes = fromBase64Url(blob);
+	if (!bytes || bytes.length <= 14) return;
+	if (bytes[0] !== 1) return;
+	const keyId = bytes[1];
+	if (void 0 === keyId) return;
+	return {
+		keyId,
+		iv: bytes.slice(AAD_BYTES, 14),
+		sealed: bytes.slice(14)
+	};
+};
+var encodePayload = (payload) => {
+	const path = textEncoder.encode(payload.path);
+	const bytes = new Uint8Array(EXPIRY_BYTES + path.length);
+	new DataView(bytes.buffer).setUint32(0, payload.expiresAtSeconds, false);
+	bytes.set(path, EXPIRY_BYTES);
+	return bytes;
+};
+var decodePayload = (bytes) => {
+	if (bytes.length <= EXPIRY_BYTES) return;
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	try {
+		return {
+			expiresAtSeconds: view.getUint32(0, false),
+			path: textDecoder.decode(bytes.subarray(EXPIRY_BYTES))
+		};
+	} catch {
+		return;
+	}
+};
+var isSafeAssetPath = (path, requiredPrefix) => {
+	if (!path.startsWith("/") || path.length > 512) return false;
+	if (path.includes("..") || path.includes("//")) return false;
+	if (/[\u0000-\u001f\u007f]/.test(path)) return false;
+	return void 0 === requiredPrefix || path.startsWith(requiredPrefix);
+};
+var parseSealKeys = (spec) => {
+	const keys = /* @__PURE__ */ new Map();
+	for (const entry of spec.split(",")) {
+		const trimmed = entry.trim();
+		if ("" === trimmed) continue;
+		const separator = trimmed.indexOf(":");
+		if (separator <= 0) throw new Error("Malformed seal key entry: expected \"keyId:base64key\"");
+		const keyId = Number(trimmed.slice(0, separator));
+		if (!Number.isInteger(keyId) || keyId < 0 || keyId > MAX_KEY_ID) throw new Error(`Seal key id must be an integer in [0, ${MAX_KEY_ID}]`);
+		const key = fromBase64Url(trimmed.slice(separator + 1).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""));
+		if (!key || key.length !== 32) throw new Error(`Seal key ${keyId} must be 32 base64-encoded bytes`);
+		keys.set(keyId, key);
+	}
+	if (0 === keys.size) throw new Error("No seal keys configured");
+	return keys;
+};
+//#endregion
+exports.additionalData = additionalData;
+exports.decodeEnvelope = decodeEnvelope;
+exports.decodePayload = decodePayload;
+exports.encodeEnvelope = encodeEnvelope;
+exports.encodePayload = encodePayload;
+exports.fromBase64Url = fromBase64Url;
+exports.isSafeAssetPath = isSafeAssetPath;
+exports.parseSealKeys = parseSealKeys;
+exports.toBase64Url = toBase64Url;

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -7,6 +7,7 @@ const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
+const require_sealedAssetsResolver = require("./sealedAssetsResolver.cjs");
 const require_signedAssetsResolver = require("./signedAssetsResolver.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
@@ -112,7 +113,7 @@ var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (r
 			}));
 		});
 		const taskData = await tasks.imgCaptchaManager.getRandomCaptchasAndRequestHash(datasetId, user, ipAddress, captchaConfig, clientRecord.settings.imageThreshold ?? .8, validSessionId, req.ipInfo);
-		const assetsResolver = require_signedAssetsResolver.getSignedAssetsResolver(ipAddress.toString()) ?? env.assetsResolver;
+		const assetsResolver = require_sealedAssetsResolver.getSealedAssetsResolver() ?? require_signedAssetsResolver.getSignedAssetsResolver(ipAddress.toString()) ?? env.assetsResolver;
 		const captchaResponse = {
 			[_prosopo_types.ApiParams.status]: "ok",
 			[_prosopo_types.ApiParams.captchas]: taskData.captchas.map((captcha) => ({

package/dist/cjs/api/captcha/sealedAssetsResolver.cjs

@@ -0,0 +1,70 @@
+const require_assetSealFormat = require("./assetSealFormat.cjs");
+const require_assetSeal = require("./assetSeal.cjs");
+var SealedAssetsResolver = class {
+	constructor(options) {
+		this.key = options.key;
+		this.keyId = options.keyId;
+		this.ttlSeconds = options.ttlSeconds ?? 300;
+		this.urlPrefix = options.urlPrefix ?? "s";
+		this.now = options.now ?? (() => Date.now());
+	}
+	resolveAsset(assetURI) {
+		const url = this.toUrl(assetURI);
+		if (!url) return {
+			URI: assetURI,
+			getURL: () => assetURI
+		};
+		if (url.search !== "") throw new Error(`Cannot seal an asset URL that has a query string: ${assetURI}`);
+		const blob = require_assetSeal.sealAssetPath({
+			path: url.pathname,
+			key: this.key,
+			keyId: this.keyId,
+			expiresAtSeconds: Math.floor(this.now() / 1e3) + this.ttlSeconds
+		});
+		const sealed = `${url.origin}/${this.urlPrefix}/${blob}${extensionOf(url.pathname)}`;
+		return {
+			URI: assetURI,
+			getURL: () => sealed
+		};
+	}
+	toUrl(assetURI) {
+		try {
+			const url = new URL(assetURI);
+			return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+		} catch {
+			return;
+		}
+	}
+};
+var extensionOf = (pathname) => {
+	const lastDot = pathname.lastIndexOf(".");
+	if (lastDot <= pathname.lastIndexOf("/") + 1) return "";
+	const extension = pathname.slice(lastDot);
+	return /^\.[a-zA-Z0-9]{1,8}$/.test(extension) ? extension : "";
+};
+function getSealedAssetsResolver() {
+	const spec = process.env.PROSOPO_ASSET_SEAL_KEYS;
+	if (!spec) return;
+	const keys = require_assetSealFormat.parseSealKeys(spec);
+	const keyId = activeKeyId(keys);
+	const key = keys.get(keyId);
+	if (!key) throw new Error(`PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID ${keyId} is not in PROSOPO_ASSET_SEAL_KEYS`);
+	return new SealedAssetsResolver({
+		key,
+		keyId,
+		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_SEAL_TTL_SECONDS ?? "", 10) || 300,
+		urlPrefix: process.env.PROSOPO_ASSET_SEAL_URL_PREFIX || "s"
+	});
+}
+var activeKeyId = (keys) => {
+	const configured = process.env.PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID;
+	if (configured) {
+		const parsed = Number.parseInt(configured, 10);
+		if (!Number.isInteger(parsed)) throw new Error("PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID must be an integer");
+		return parsed;
+	}
+	return Math.max(...keys.keys());
+};
+//#endregion
+exports.SealedAssetsResolver = SealedAssetsResolver;
+exports.getSealedAssetsResolver = getSealedAssetsResolver;

package/dist/cjs/api/captcha/signedAssetsResolver.cjs

@@ -1,14 +1,15 @@
 let node_crypto = require("node:crypto");
+let _prosopo_datasets = require("@prosopo/datasets");
+//#region src/api/captcha/signedAssetsResolver.ts
 var SignedAssetsResolver = class {
 	constructor(options) {
 		this.securityKey = options.securityKey;
-		this.ttlSeconds = options.ttlSeconds ?? 300;
+		this.ttlSeconds = options.ttlSeconds ?? _prosopo_datasets.DEFAULT_ASSET_TOKEN_TTL_SECONDS;
 		this.clientIp = options.clientIp;
 		this.now = options.now ?? (() => Date.now());
 	}
 	sign(path, expires) {
-		const base = `${this.securityKey}${path}${expires}${this.clientIp ?? ""}`;
-		return (0, node_crypto.createHash)("sha256").update(base).digest("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+		return (0, _prosopo_datasets.encodeAssetToken)(new Uint8Array((0, node_crypto.createHash)("sha256").update((0, _prosopo_datasets.assetTokenBase)(this.securityKey, path, expires, this.clientIp)).digest()));
 	}
 	resolveAsset(assetURI) {
 		const url = this.toUrl(assetURI);
@@ -45,10 +46,11 @@ function getSignedAssetsResolver(clientIp) {
 	if (!securityKey) return;
 	return new SignedAssetsResolver({
 		securityKey,
-		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || 300,
+		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || _prosopo_datasets.DEFAULT_ASSET_TOKEN_TTL_SECONDS,
 		...process.env.PROSOPO_ASSET_TOKEN_BIND_IP === "true" && clientIp ? { clientIp } : {}
 	});
 }
 //#endregion
+exports.DEFAULT_ASSET_TOKEN_TTL_SECONDS = _prosopo_datasets.DEFAULT_ASSET_TOKEN_TTL_SECONDS;
 exports.SignedAssetsResolver = SignedAssetsResolver;
 exports.getSignedAssetsResolver = getSignedAssetsResolver;

package/dist/cjs/compositeIpAddress.cjs

@@ -38,9 +38,53 @@ var getIpAddressFromComposite = (compositeIpAddress) => {
 	}
 };
 var getBigInt = (number) => BigInt(number || 0n);
+/**
+* Mongo hands these back as Decimal128 rather than the `number | bigint` the
+* type promises, and `BigInt(Decimal128)` throws. Route through the string
+* form, and report a value we cannot read as absent rather than throwing.
+*/
+var readPart = (value) => {
+	if (value === void 0 || value === null) return void 0;
+	try {
+		return BigInt(value.toString());
+	} catch {
+		return;
+	}
+};
+/**
+* The value `getCompositeIpAddress` returns when it could not read an
+* address at all. 0.0.0.0 is not a client address, so nothing legitimate is
+* being swallowed by treating it as "we don't know".
+*/
+var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPart(ip.lower) === 0n;
+/**
+* Do two observations of a client come from the same place on the network?
+*
+* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
+* interface identifier in the low 64 bits is designed to rotate (RFC 8981
+* privacy extensions), often several times a day on one unchanged connection,
+* so comparing it would call an ordinary phone a different host.
+*
+* A value we do not actually have counts as the same — one that will not
+* parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
+* address it could not read. This answer gates extra friction for a real
+* user, and a gap in what we recorded is not evidence against them.
+*/
+var isSameIpOrigin = (a, b) => {
+	if (isUnknownIp(a) || isUnknownIp(b)) return true;
+	if (a.type !== b.type) return false;
+	const compare = (left, right) => {
+		const leftPart = readPart(left);
+		const rightPart = readPart(right);
+		if (leftPart === void 0 || rightPart === void 0) return true;
+		return leftPart === rightPart;
+	};
+	return a.type === _prosopo_types.IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+};
 var never = () => {
 	throw new Error("Unhandled type");
 };
 //#endregion
 exports.getCompositeIpAddress = getCompositeIpAddress;
 exports.getIpAddressFromComposite = getIpAddressFromComposite;
+exports.isSameIpOrigin = isSameIpOrigin;

package/dist/cjs/index.cjs

@@ -50,6 +50,7 @@ exports.getVerdictCache = require_blacklistRequestInspector.getVerdictCache;
 exports.handshakeTimingMiddleware = require_handshakeTimingMiddleware.handshakeTimingMiddleware;
 exports.headerCheckMiddleware = require_headerCheckMiddleware.headerCheckMiddleware;
 exports.ignoreMiddleware = require_ignoreMiddleware.ignoreMiddleware;
+exports.isSameIpOrigin = require_compositeIpAddress.isSameIpOrigin;
 exports.isTlsAvailable = require_startProviderApi.isTlsAvailable;
 exports.ja4Middleware = require_ja4Middleware.ja4Middleware;
 exports.migrateFrictionlessLadder = require_frictionlessLadder.migrateFrictionlessLadder;

package/dist/cjs/tasks/captchaManager.cjs

@@ -564,8 +564,22 @@ var CaptchaManager = class CaptchaManager {
 		const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
 		return require_checkTrafficFilter.checkTrafficFilter(ipInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}
+	/**
+	* Does this client's tier entitle it to the bot score, and is there one?
+	*
+	* `score !== undefined`, not `score`: a session with nothing wrong with it
+	* scores 0, and a truthiness test dropped the field for exactly those
+	* users — a paying customer reading `score` got a present field for
+	* every suspicious visitor and a missing one for their cleanest. It has
+	* been invisible because `Math.random() * 0.3` makes an exact 0 all but
+	* impossible; taking that noise out (see captcha-private#4433) is what
+	* would expose it.
+	*
+	* Returning `boolean` rather than the old `number | boolean | undefined`,
+	* which came from `&&`-chaining the score and the tier.
+	*/
 	static canClientSeeScore(tier, score) {
-		return score && tier && tier !== _prosopo_types.Tier.Free;
+		return score !== void 0 && tier !== _prosopo_types.Tier.Free;
 	}
 };
 //#endregion

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -190,14 +190,24 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		await Promise.all(writePromises);
 		if (!correct) return { verified: correct };
 		const escalateForMissingCoords = !coords && Boolean(challengeRecord.sessionId);
+		const solveIp = require_compositeIpAddress.getCompositeIpAddress(ipAddress);
+		const escalateForIpChange = Boolean(challengeRecord.sessionId) && !require_compositeIpAddress.isSameIpOrigin(challengeRecord.ipAddress, solveIp);
+		if (escalateForIpChange) this.logger.info(() => ({
+			msg: "PoW solve arrived from a different address than the challenge",
+			data: {
+				challenge,
+				issuedType: challengeRecord.ipAddress.type,
+				solvedType: solveIp.type
+			}
+		}));
 		let routingOutput = this.postPowContext ? await this.runPostPowRouting({
 			challengeRecord,
 			challengeSplit,
 			behavioralDataPacked: decryptedBehavioralDataPacked
 		}) : void 0;
-		if (escalateForMissingCoords && routingOutput?.captchaType !== _prosopo_types.CaptchaType.image && routingOutput?.captchaType !== _prosopo_types.CaptchaType.puzzle) routingOutput = {
+		if ((escalateForMissingCoords || escalateForIpChange) && routingOutput?.captchaType !== _prosopo_types.CaptchaType.image && routingOutput?.captchaType !== _prosopo_types.CaptchaType.puzzle) routingOutput = {
 			captchaType: _prosopo_types.CaptchaType.image,
-			reason: _prosopo_types.FrictionlessReason.MISSING_COORDINATES
+			reason: escalateForMissingCoords ? _prosopo_types.FrictionlessReason.MISSING_COORDINATES : _prosopo_types.FrictionlessReason.IP_CHANGED
 		};
 		return {
 			verified: correct,

package/dist/compositeIpAddress.d.ts

@@ -2,4 +2,5 @@ import type { IPAddress } from "@prosopo/types";
 import { type CompositeIpAddress } from "@prosopo/types";
 export declare const getCompositeIpAddress: (ip: string | IPAddress) => CompositeIpAddress;
 export declare const getIpAddressFromComposite: (compositeIpAddress: CompositeIpAddress) => IPAddress;
+export declare const isSameIpOrigin: (a: CompositeIpAddress, b: CompositeIpAddress) => boolean;
 //# sourceMappingURL=compositeIpAddress.d.ts.map

package/dist/compositeIpAddress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compositeIpAddress.d.ts","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAiB,MAAM,gBAAgB,CAAC;AAOxE,eAAO,MAAM,qBAAqB,OAC7B,MAAM,GAAG,SAAS,KACpB,kBAaF,CAAC;AAuBF,eAAO,MAAM,yBAAyB,uBACjB,kBAAkB,KACpC,SAaF,CAAC"}
+{"version":3,"file":"compositeIpAddress.d.ts","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAiB,MAAM,gBAAgB,CAAC;AAOxE,eAAO,MAAM,qBAAqB,OAC7B,MAAM,GAAG,SAAS,KACpB,kBAaF,CAAC;AAuBF,eAAO,MAAM,yBAAyB,uBACjB,kBAAkB,KACpC,SAaF,CAAC;AAuCF,eAAO,MAAM,cAAc,MACvB,kBAAkB,KAClB,kBAAkB,KACnB,OAiBF,CAAC"}

package/dist/compositeIpAddress.js

@@ -38,8 +38,51 @@ var getIpAddressFromComposite = (compositeIpAddress) => {
 	}
 };
 var getBigInt = (number) => BigInt(number || 0n);
+/**
+* Mongo hands these back as Decimal128 rather than the `number | bigint` the
+* type promises, and `BigInt(Decimal128)` throws. Route through the string
+* form, and report a value we cannot read as absent rather than throwing.
+*/
+var readPart = (value) => {
+	if (value === void 0 || value === null) return void 0;
+	try {
+		return BigInt(value.toString());
+	} catch {
+		return;
+	}
+};
+/**
+* The value `getCompositeIpAddress` returns when it could not read an
+* address at all. 0.0.0.0 is not a client address, so nothing legitimate is
+* being swallowed by treating it as "we don't know".
+*/
+var isUnknownIp = (ip) => ip.type === IpAddressType.v4 && readPart(ip.lower) === 0n;
+/**
+* Do two observations of a client come from the same place on the network?
+*
+* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
+* interface identifier in the low 64 bits is designed to rotate (RFC 8981
+* privacy extensions), often several times a day on one unchanged connection,
+* so comparing it would call an ordinary phone a different host.
+*
+* A value we do not actually have counts as the same — one that will not
+* parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
+* address it could not read. This answer gates extra friction for a real
+* user, and a gap in what we recorded is not evidence against them.
+*/
+var isSameIpOrigin = (a, b) => {
+	if (isUnknownIp(a) || isUnknownIp(b)) return true;
+	if (a.type !== b.type) return false;
+	const compare = (left, right) => {
+		const leftPart = readPart(left);
+		const rightPart = readPart(right);
+		if (leftPart === void 0 || rightPart === void 0) return true;
+		return leftPart === rightPart;
+	};
+	return a.type === IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+};
 var never = () => {
 	throw new Error("Unhandled type");
 };
 //#endregion
-export { getCompositeIpAddress, getIpAddressFromComposite };
+export { getCompositeIpAddress, getIpAddressFromComposite, isSameIpOrigin };

package/dist/compositeIpAddress.js.map

@@ -1 +1 @@
-{"version":3,"file":"compositeIpAddress.js","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAeA,OAAO,EAA2B,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACpC,EAAsB,EACD,EAAE;IACvB,IAAI,SAAoB,CAAC;IAEzB,IAAI,CAAC;QACJ,SAAS,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO;YACN,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,aAAa,CAAC,EAAE;SACtB,CAAC;IACH,CAAC;IAED,OAAO,yBAAyB,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CACjC,SAAoB,EACC,EAAE;IACvB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;IAErC,IAAI,SAAS,YAAY,QAAQ,EAAE,CAAC;QACnC,OAAO;YACN,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,aAAa,CAAC,EAAE;SACtB,CAAC;IACH,CAAC;IAED,SAA4B,CAAC;IAE7B,OAAO;QACN,KAAK,EAAE,SAAS,GAAG,aAAa;QAChC,KAAK,EAAE,SAAS,IAAI,QAAQ;QAC5B,IAAI,EAAE,aAAa,CAAC,EAAE;KACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACxC,kBAAsC,EAC1B,EAAE;IACd,QAAQ,kBAAkB,CAAC,IAAI,EAAE,CAAC;QACjC,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,QAAQ,CAAC,UAAU,CACzB,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;gBAChD,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CACtD,CAAC;QACH;YACC,KAAK,EAAE,CAAC;YACR,OAAO,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,MAAmC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAEhF,MAAM,KAAK,GAAG,GAAU,EAAE;IACzB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC,CAAC"}
+{"version":3,"file":"compositeIpAddress.js","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAeA,OAAO,EAA2B,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACpC,EAAsB,EACD,EAAE;IACvB,IAAI,SAAoB,CAAC;IAEzB,IAAI,CAAC;QACJ,SAAS,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO;YACN,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,aAAa,CAAC,EAAE;SACtB,CAAC;IACH,CAAC;IAED,OAAO,yBAAyB,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CACjC,SAAoB,EACC,EAAE;IACvB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;IAErC,IAAI,SAAS,YAAY,QAAQ,EAAE,CAAC;QACnC,OAAO;YACN,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,aAAa,CAAC,EAAE;SACtB,CAAC;IACH,CAAC;IAED,SAA4B,CAAC;IAE7B,OAAO;QACN,KAAK,EAAE,SAAS,GAAG,aAAa;QAChC,KAAK,EAAE,SAAS,IAAI,QAAQ;QAC5B,IAAI,EAAE,aAAa,CAAC,EAAE;KACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACxC,kBAAsC,EAC1B,EAAE;IACd,QAAQ,kBAAkB,CAAC,IAAI,EAAE,CAAC;QACjC,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,QAAQ,CAAC,UAAU,CACzB,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;gBAChD,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CACtD,CAAC;QACH;YACC,KAAK,EAAE,CAAC;YACR,OAAO,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,MAAmC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAOhF,MAAM,QAAQ,GAAG,CAAC,KAAkC,EAAsB,EAAE;IAC3E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,CAAC;QACJ,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAOF,MAAM,WAAW,GAAG,CAAC,EAAsB,EAAW,EAAE,CACvD,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;AAe3D,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,CAAqB,EACrB,CAAqB,EACX,EAAE;IACZ,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,OAAO,GAAG,CACf,IAAiC,EACjC,KAAkC,EACxB,EAAE;QACZ,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,QAAQ,KAAK,SAAS,CAAC;IAC/B,CAAC,CAAC;IAEF,OAAO,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE;QACjC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,GAAU,EAAE;IACzB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC,CAAC"}