@prosopo/provider 5.13.4 → 5.15.0

package/dist/cjs/api/rawTlsSignalsMiddleware.cjs

@@ -7,9 +7,44 @@ var HEADER_ACK_NS = "x-tls-ack-ns";
 var HEADER_OBSERVED_TTL = "x-tls-observed-ttl";
 var HEADER_TCP_MSS = "x-tls-tcp-mss";
 var HEADER_TCP_WSCALE = "x-tls-tcp-wscale";
+var HEADER_TCP_WINDOW = "x-tls-tcp-window";
+var HEADER_TCP_OPTS_KINDS = "x-tls-tcp-opts-kinds";
+var HEADER_TCP_OPTS_PRESENT = "x-tls-tcp-opts-present";
+var HEADER_TCP_OPTS_COUNT = "x-tls-tcp-opts-count";
+var HEADER_TCP_TSVAL = "x-tls-tcp-tsval";
+var HEADER_TCP_TSECR = "x-tls-tcp-tsecr";
+var HEADER_TCP_FLAGS = "x-tls-tcp-flags";
+var HEADER_TCP_DATA_OFFSET_RESV = "x-tls-tcp-data-offset-resv";
+var HEADER_TCP_URG_PTR = "x-tls-tcp-urg-ptr";
+var HEADER_IP_IDENT = "x-tls-ip-ident";
+var HEADER_IP_TOTAL_LEN = "x-tls-ip-total-len";
+var HEADER_IP_FRAG_FLAGS = "x-tls-ip-frag-flags";
+var HEADER_IP_TOS = "x-tls-ip-tos";
 var HEADER_TCP_OPTS_FLAGS = "x-tls-tcp-opts-flags";
 var HEADER_TCP_OPTS_ORDER = "x-tls-tcp-opts-order";
-var HEADER_TCP_WINDOW = "x-tls-tcp-window";
+var RAW_TLS_SIGNAL_KEYS = [
+	"synNs",
+	"synackNs",
+	"ackNs",
+	"observedTtl",
+	"tcpMss",
+	"tcpWscale",
+	"tcpWindow",
+	"tcpOptsKinds",
+	"tcpOptsPresent",
+	"tcpOptsCount",
+	"tcpTsval",
+	"tcpTsecr",
+	"tcpFlags",
+	"tcpDataOffsetResv",
+	"tcpUrgPtr",
+	"ipIdent",
+	"ipTotalLen",
+	"ipFragFlags",
+	"ipTos",
+	"tcpOptsFlags",
+	"tcpOptsOrder"
+];
 var parseIntHeader = (raw, logger, headerName, max) => {
 	if (raw === void 0) return;
 	const value = Array.isArray(raw) ? raw[0] : raw;
@@ -31,6 +66,46 @@ var MAX_NS = 2 ** 63;
 var MAX_U8 = 255;
 var MAX_U16 = 65535;
 var MAX_U32 = 4294967295;
+var OPTS_KINDS_SLOTS = 8;
+var MAX_U64 = (1n << 64n) - 1n;
+var parseOptsKindsHeader = (raw, logger) => {
+	if (raw === void 0) return;
+	const value = Array.isArray(raw) ? raw[0] : raw;
+	if (value === void 0 || !/^\d+$/.test(value)) {
+		if (value !== void 0) logger.debug(() => ({
+			msg: "Ignoring malformed raw TLS signal header",
+			data: {
+				header: HEADER_TCP_OPTS_KINDS,
+				raw: value
+			}
+		}));
+		return;
+	}
+	let packed;
+	try {
+		packed = BigInt(value);
+	} catch {
+		return;
+	}
+	if (packed > MAX_U64) {
+		logger.debug(() => ({
+			msg: "Ignoring out-of-range raw TLS signal header",
+			data: {
+				header: HEADER_TCP_OPTS_KINDS,
+				raw: value
+			}
+		}));
+		return;
+	}
+	if (packed === 0n) return;
+	const kinds = [];
+	for (let slot = 0; slot < OPTS_KINDS_SLOTS; slot++) {
+		const kind = Number(packed >> BigInt(slot * 8) & 255n);
+		if (kind === 0) break;
+		kinds.push(kind);
+	}
+	return kinds.length > 0 ? kinds : void 0;
+};
 var getRawTlsSignals = (headers, logger) => {
 	const log = logger ?? (0, _prosopo_logger.getLogger)("info", "provider:raw-tls-signals");
 	return {
@@ -40,37 +115,50 @@ var getRawTlsSignals = (headers, logger) => {
 		observedTtl: parseIntHeader(headers[HEADER_OBSERVED_TTL], log, HEADER_OBSERVED_TTL, MAX_U8),
 		tcpMss: parseIntHeader(headers[HEADER_TCP_MSS], log, HEADER_TCP_MSS, MAX_U16),
 		tcpWscale: parseIntHeader(headers[HEADER_TCP_WSCALE], log, HEADER_TCP_WSCALE, MAX_U8),
+		tcpWindow: parseIntHeader(headers[HEADER_TCP_WINDOW], log, HEADER_TCP_WINDOW, MAX_U16),
+		tcpOptsKinds: parseOptsKindsHeader(headers[HEADER_TCP_OPTS_KINDS], log),
+		tcpOptsPresent: parseIntHeader(headers[HEADER_TCP_OPTS_PRESENT], log, HEADER_TCP_OPTS_PRESENT, MAX_U16),
+		tcpOptsCount: parseIntHeader(headers[HEADER_TCP_OPTS_COUNT], log, HEADER_TCP_OPTS_COUNT, MAX_U8),
+		tcpTsval: parseIntHeader(headers[HEADER_TCP_TSVAL], log, HEADER_TCP_TSVAL, MAX_U32),
+		tcpTsecr: parseIntHeader(headers[HEADER_TCP_TSECR], log, HEADER_TCP_TSECR, MAX_U32),
+		tcpFlags: parseIntHeader(headers[HEADER_TCP_FLAGS], log, HEADER_TCP_FLAGS, MAX_U8),
+		tcpDataOffsetResv: parseIntHeader(headers[HEADER_TCP_DATA_OFFSET_RESV], log, HEADER_TCP_DATA_OFFSET_RESV, MAX_U8),
+		tcpUrgPtr: parseIntHeader(headers[HEADER_TCP_URG_PTR], log, HEADER_TCP_URG_PTR, MAX_U16),
+		ipIdent: parseIntHeader(headers[HEADER_IP_IDENT], log, HEADER_IP_IDENT, MAX_U16),
+		ipTotalLen: parseIntHeader(headers[HEADER_IP_TOTAL_LEN], log, HEADER_IP_TOTAL_LEN, MAX_U16),
+		ipFragFlags: parseIntHeader(headers[HEADER_IP_FRAG_FLAGS], log, HEADER_IP_FRAG_FLAGS, MAX_U16),
+		ipTos: parseIntHeader(headers[HEADER_IP_TOS], log, HEADER_IP_TOS, MAX_U8),
 		tcpOptsFlags: parseIntHeader(headers[HEADER_TCP_OPTS_FLAGS], log, HEADER_TCP_OPTS_FLAGS, MAX_U8),
-		tcpOptsOrder: parseIntHeader(headers[HEADER_TCP_OPTS_ORDER], log, HEADER_TCP_OPTS_ORDER, MAX_U32),
-		tcpWindow: parseIntHeader(headers[HEADER_TCP_WINDOW], log, HEADER_TCP_WINDOW, MAX_U16)
+		tcpOptsOrder: parseIntHeader(headers[HEADER_TCP_OPTS_ORDER], log, HEADER_TCP_OPTS_ORDER, MAX_U32)
 	};
 };
-var rawTlsSignalsForSession = (req) => {
+var rawTlsSignalsForSession = (req) => rawTlsSignalsFromRecord(req);
+/**
+* Pull the raw TLS signals out of a persisted Session — or anything shaped
+* like one — for a decision machine's `raw` bag, or to carry forward onto a
+* new Session record.
+*
+* Six call sites used to name every field by hand, so adding one to the
+* probe meant remembering six places; the fields that were forgotten read as
+* `undefined` and the rules gating on them silently never fired.
+*/
+var rawTlsSignalsFromRecord = (record) => {
 	const out = {};
-	if (req.synNs !== void 0) out.synNs = req.synNs;
-	if (req.synackNs !== void 0) out.synackNs = req.synackNs;
-	if (req.ackNs !== void 0) out.ackNs = req.ackNs;
-	if (req.observedTtl !== void 0) out.observedTtl = req.observedTtl;
-	if (req.tcpMss !== void 0) out.tcpMss = req.tcpMss;
-	if (req.tcpWscale !== void 0) out.tcpWscale = req.tcpWscale;
-	if (req.tcpOptsFlags !== void 0) out.tcpOptsFlags = req.tcpOptsFlags;
-	if (req.tcpOptsOrder !== void 0) out.tcpOptsOrder = req.tcpOptsOrder;
-	if (req.tcpWindow !== void 0) out.tcpWindow = req.tcpWindow;
+	if (!record) return out;
+	for (const key of RAW_TLS_SIGNAL_KEYS) {
+		const value = record[key];
+		if (value !== void 0) Object.assign(out, { [key]: value });
+	}
 	return out;
 };
 var rawTlsSignalsMiddleware = (env) => {
 	return async (req, res, next) => {
 		try {
 			const signals = getRawTlsSignals(req.headers, req.logger);
-			if (signals.synNs !== void 0) req.synNs = signals.synNs;
-			if (signals.synackNs !== void 0) req.synackNs = signals.synackNs;
-			if (signals.ackNs !== void 0) req.ackNs = signals.ackNs;
-			if (signals.observedTtl !== void 0) req.observedTtl = signals.observedTtl;
-			if (signals.tcpMss !== void 0) req.tcpMss = signals.tcpMss;
-			if (signals.tcpWscale !== void 0) req.tcpWscale = signals.tcpWscale;
-			if (signals.tcpOptsFlags !== void 0) req.tcpOptsFlags = signals.tcpOptsFlags;
-			if (signals.tcpOptsOrder !== void 0) req.tcpOptsOrder = signals.tcpOptsOrder;
-			if (signals.tcpWindow !== void 0) req.tcpWindow = signals.tcpWindow;
+			for (const key of RAW_TLS_SIGNAL_KEYS) {
+				const value = signals[key];
+				if (value !== void 0) Object.assign(req, { [key]: value });
+			}
 			if (Object.values(signals).some((v) => v !== void 0)) req.logger = req.logger.with(signals, "rawTlsSignals");
 			next();
 		} catch (err) {
@@ -81,4 +169,5 @@ var rawTlsSignalsMiddleware = (env) => {
 //#endregion
 exports.getRawTlsSignals = getRawTlsSignals;
 exports.rawTlsSignalsForSession = rawTlsSignalsForSession;
+exports.rawTlsSignalsFromRecord = rawTlsSignalsFromRecord;
 exports.rawTlsSignalsMiddleware = rawTlsSignalsMiddleware;

package/dist/cjs/api/startProviderApi.cjs

@@ -1,9 +1,9 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_metrics = require("./metrics.cjs");
+const require_rawTlsSignalsMiddleware = require("./rawTlsSignalsMiddleware.cjs");
 const require_blacklistRequestInspector = require("./blacklistRequestInspector.cjs");
 const require_bundlePool = require("../tasks/detection/bundlePool.cjs");
 const require_block = require("./block.cjs");
-const require_rawTlsSignalsMiddleware = require("./rawTlsSignalsMiddleware.cjs");
 const require_captcha = require("./captcha.cjs");
 const require_verify = require("./verify.cjs");
 const require_ja4Middleware = require("./ja4Middleware.cjs");
@@ -11,20 +11,22 @@ const require_handshakeTimingMiddleware = require("./handshakeTimingMiddleware.c
 const require_public = require("./public.cjs");
 const require_domainMiddleware = require("./domainMiddleware.cjs");
 const require_createApiAdminRoutesProvider = require("./admin/createApiAdminRoutesProvider.cjs");
+const require_adminAuthOptions = require("./adminAuthOptions.cjs");
 const require_cpuProfiler = require("./cpuProfiler.cjs");
+const require_detectorPoolBodyParser = require("./detectorPoolBodyParser.cjs");
 const require_headerCheckMiddleware = require("./headerCheckMiddleware.cjs");
 const require_ignoreMiddleware = require("./ignoreMiddleware.cjs");
 const require_ipInfoMiddleware = require("./ipInfoMiddleware.cjs");
 const require_robotsMiddleware = require("./robotsMiddleware.cjs");
 let _prosopo_logger = require("@prosopo/logger");
 let _prosopo_types = require("@prosopo/types");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let node_fs = require("node:fs");
 node_fs = require_runtime.__toESM(node_fs, 1);
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path, 1);
 let node_https = require("node:https");
 node_https = require_runtime.__toESM(node_https, 1);
-let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let express = require("express");
 express = require_runtime.__toESM(express, 1);
 let node_url = require("node:url");
@@ -162,7 +164,7 @@ async function startProviderApi(env, admin = false, port) {
 		],
 		maxAge: 86400
 	}));
-	apiApp.use(_prosopo_types.AdminApiPaths.ReplaceDetectorPool, express.default.json({ limit: DETECTOR_POOL_BODY_LIMIT }));
+	apiApp.use(_prosopo_types.AdminApiPaths.ReplaceDetectorPool, require_detectorPoolBodyParser.detectorPoolBodyParser(DETECTOR_POOL_BODY_LIMIT, env.pair, env.authAccount));
 	apiApp.use(express.default.json({ limit: "1mb" }));
 	apiApp.use(require_public.publicRouter(env));
 	apiApp.use(require_metrics.metricsMiddleware());
@@ -218,10 +220,11 @@ async function startProviderApi(env, admin = false, port) {
 	apiApp.use(clientPathsExcludingVerify, require_headerCheckMiddleware.headerCheckMiddleware(env));
 	apiApp.use(require_verify.prosopoVerifyRouter(env));
 	env.logger.info(() => ({ msg: "Enabling admin auth middleware" }));
-	apiApp.use("/v1/prosopo/provider/admin", (0, _prosopo_api_express_router.authMiddleware)(env.pair, env.authAccount));
+	const adminAuth = (0, _prosopo_api_express_router.authMiddleware)(env.pair, env.authAccount, require_adminAuthOptions.adminAuthOptions(process.env, env.config.host));
+	apiApp.use("/v1/prosopo/provider/admin", adminAuth);
 	if (apiRuleRoutesProvider) {
 		const userAccessRuleRoutes = apiRuleRoutesProvider.getRoutes();
-		for (const userAccessRuleRoute in userAccessRuleRoutes) apiApp.use(userAccessRuleRoute, (0, _prosopo_api_express_router.authMiddleware)(env.pair, env.authAccount));
+		for (const userAccessRuleRoute in userAccessRuleRoutes) apiApp.use(userAccessRuleRoute, adminAuth);
 		for (const userAccessRuleRoute in userAccessRuleRoutes) apiApp.use(userAccessRuleRoute, (req, res, next) => {
 			if (req.method === "POST") res.on("finish", () => {
 				if (res.statusCode >= 200 && res.statusCode < 300) require_blacklistRequestInspector.getVerdictCache().clear();

package/dist/cjs/api/verify.cjs

@@ -30,6 +30,36 @@ var VERIFY_PATH_TYPE = {
 	[_prosopo_types.ClientApiPaths.VerifyPowCaptchaSolution]: _prosopo_types.CaptchaType.pow,
 	[_prosopo_types.ClientApiPaths.VerifyPuzzleCaptchaSolution]: _prosopo_types.CaptchaType.puzzle
 };
+var decodeTokenOr400 = (token, i18n, logger, next) => {
+	try {
+		return (0, _prosopo_types.decodeProcaptchaOutput)(token);
+	} catch (error) {
+		next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error
+			},
+			i18n,
+			logger
+		}));
+		return null;
+	}
+};
+var dappSignatureError = (signature, message, pair, req) => {
+	try {
+		(0, _prosopo_api_express_router.verifySignature)(signature, message, pair);
+		return;
+	} catch {
+		return new _prosopo_common.ProsopoApiError("GENERAL.INVALID_SIGNATURE", {
+			context: {
+				code: 400,
+				siteKey: pair.address
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		});
+	}
+};
 /**
 * Returns a router connected to the database which can interact with the Proposo protocol
 *
@@ -98,7 +128,9 @@ function prosopoVerifyRouter(env) {
 		}
 		const { dappSignature, token, ip, maxVerifiedTime, email, clientSessionId } = parsed;
 		try {
-			const { user, dapp, timestamp, commitmentId, providerUrl } = (0, _prosopo_types.decodeProcaptchaOutput)(token);
+			const decoded = decodeTokenOr400(token, req.i18n, req.logger, next);
+			if (decoded === null) return;
+			const { user, dapp, timestamp, commitmentId, providerUrl } = decoded;
 			const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
 			if (testVerdict !== null) {
 				const verificationResponse = {
@@ -132,7 +164,8 @@ function prosopoVerifyRouter(env) {
 				logger: req.logger
 			}));
 			const keyPair = env.keyring.addFromAddress(dapp);
-			(0, _prosopo_api_express_router.verifySignature)(dappSignature, timestamp.toString(), keyPair);
+			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), keyPair, req);
+			if (signatureError) return next(signatureError);
 			const response = await tasks.imgCaptchaManager.verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, clientRecord.settings.disallowWebView, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
 			req.logger.debug(() => ({ data: { response } }));
 			const verificationResponse = tasks.imgCaptchaManager.getVerificationResponse(response[_prosopo_types.ApiParams.verified], clientRecord, req.i18n.t, response[_prosopo_types.ApiParams.score], response[_prosopo_types.ApiParams.commitmentId], response[_prosopo_types.ApiParams.status], response[_prosopo_types.ApiParams.sessionId]);
@@ -183,7 +216,9 @@ function prosopoVerifyRouter(env) {
 		}
 		try {
 			const { token, dappSignature, ip, email, clientSessionId } = parsed;
-			const { dapp, user, timestamp, challenge, providerUrl } = (0, _prosopo_types.decodeProcaptchaOutput)(token);
+			const decoded = decodeTokenOr400(token, req.i18n, req.logger, next);
+			if (decoded === null) return;
+			const { dapp, user, timestamp, challenge, providerUrl } = decoded;
 			const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
 			if (testVerdict !== null) {
 				const verificationResponse = {
@@ -223,7 +258,8 @@ function prosopoVerifyRouter(env) {
 				return res.json(unverifiedResponse);
 			}
 			const dappPair = env.keyring.addFromAddress(dapp);
-			(0, _prosopo_api_express_router.verifySignature)(dappSignature, timestamp.toString(), dappPair);
+			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), dappPair, req);
+			if (signatureError) return next(signatureError);
 			const { verified, score, reason, sessionId } = await tasks.powCaptchaManager.serverVerifyPowCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
 			const verificationResponse = tasks.powCaptchaManager.getVerificationResponse(verified, clientRecord, req.i18n.t, score, reason, sessionId);
 			return res.json(verificationResponse);
@@ -272,7 +308,9 @@ function prosopoVerifyRouter(env) {
 		}
 		try {
 			const { token, dappSignature, ip, email, clientSessionId } = parsed;
-			const { dapp, user, timestamp, challenge, providerUrl } = (0, _prosopo_types.decodeProcaptchaOutput)(token);
+			const decoded = decodeTokenOr400(token, req.i18n, req.logger, next);
+			if (decoded === null) return;
+			const { dapp, user, timestamp, challenge, providerUrl } = decoded;
 			const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
 			if (testVerdict !== null) {
 				const verificationResponse = {
@@ -312,7 +350,8 @@ function prosopoVerifyRouter(env) {
 				return res.json(unverifiedResponse);
 			}
 			const dappPair = env.keyring.addFromAddress(dapp);
-			(0, _prosopo_api_express_router.verifySignature)(dappSignature, timestamp.toString(), dappPair);
+			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), dappPair, req);
+			if (signatureError) return next(signatureError);
 			const { verified, score, sessionId } = await tasks.puzzleCaptchaManager.serverVerifyPuzzleCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
 			const verificationResponse = tasks.puzzleCaptchaManager.getVerificationResponse(verified, clientRecord, req.i18n.t, score, void 0, sessionId);
 			return res.json(verificationResponse);
@@ -361,7 +400,9 @@ function prosopoVerifyRouter(env) {
 		}
 		const { dappSignature, token, ip, clientSessionId } = parsed;
 		try {
-			const { user, dapp, timestamp, commitmentId: sessionId, providerUrl } = (0, _prosopo_types.decodeProcaptchaOutput)(token);
+			const decoded = decodeTokenOr400(token, req.i18n, req.logger, next);
+			if (decoded === null) return;
+			const { user, dapp, timestamp, commitmentId: sessionId, providerUrl } = decoded;
 			const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
 			if (testVerdict !== null) return res.json({
 				status: "ok",
@@ -391,7 +432,8 @@ function prosopoVerifyRouter(env) {
 				logger: req.logger
 			}));
 			const keyPair = env.keyring.addFromAddress(dapp);
-			(0, _prosopo_api_express_router.verifySignature)(dappSignature, timestamp.toString(), keyPair);
+			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), keyPair, req);
+			if (signatureError) return next(signatureError);
 			if (!sessionId) return res.json({
 				status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
 				verified: false

package/dist/cjs/compositeIpAddress.cjs

@@ -4,6 +4,11 @@ let ip_address = require("ip-address");
 //#region src/compositeIpAddress.ts
 var V6_SHIFT = 64n;
 var v6_LOWER_MASK = (1n << V6_SHIFT) - 1n;
+/**
+* The part of a v4 address treated as the host rather than the network, for
+* the purposes of `isSameIpOrigin`. 8 bits — a /24.
+*/
+var V4_HOST_BITS = 8n;
 var getCompositeIpAddress = (ip) => {
 	let ipAddress;
 	try {
@@ -60,10 +65,19 @@ var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPar
 /**
 * Do two observations of a client come from the same place on the network?
 *
-* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
-* interface identifier in the low 64 bits is designed to rotate (RFC 8981
-* privacy extensions), often several times a day on one unchanged connection,
-* so comparing it would call an ordinary phone a different host.
+* Both families are compared on the network part and neither on the host part.
+*
+* v6 is the /64 prefix: the interface identifier in the low 64 bits is designed
+* to rotate (RFC 8981 privacy extensions), often several times a day on one
+* unchanged connection, so comparing it would call an ordinary phone a
+* different host.
+*
+* v4 is the /24. A carrier NAT or mobile pool reassigns the low octet mid
+* session — an EE subscriber was observed moving one address in four seconds —
+* so comparing the whole address called every rotating mobile and CGNAT client
+* a different host, which is the opposite of the leniency this check is for.
+* The /24 still separates an unrelated network, which is the case worth
+* catching: a challenge handed to a second host to farm the work out.
 *
 * A value we do not actually have counts as the same — one that will not
 * parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
@@ -73,13 +87,13 @@ var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPar
 var isSameIpOrigin = (a, b) => {
 	if (isUnknownIp(a) || isUnknownIp(b)) return true;
 	if (a.type !== b.type) return false;
-	const compare = (left, right) => {
+	const sameNetwork = (left, right, hostBits) => {
 		const leftPart = readPart(left);
 		const rightPart = readPart(right);
 		if (leftPart === void 0 || rightPart === void 0) return true;
-		return leftPart === rightPart;
+		return leftPart >> hostBits === rightPart >> hostBits;
 	};
-	return a.type === _prosopo_types.IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+	return a.type === _prosopo_types.IpAddressType.v6 ? sameNetwork(a.upper, b.upper, 0n) : sameNetwork(a.lower, b.lower, V4_HOST_BITS);
 };
 var never = () => {
 	throw new Error("Unhandled type");

package/dist/cjs/tasks/captchaManager.cjs

@@ -225,6 +225,21 @@ var CaptchaManager = class CaptchaManager {
 				sessionId
 			}
 		}));
+		if (!(0, _prosopo_types.isCaptchaTypeFeatureEnabled)(requestedCaptchaType, clientSettings.settings?.captchaTypeFeatureFlags)) {
+			this.logger.warn(() => ({
+				msg: "Captcha type is switched off for this site",
+				data: {
+					account: clientSettings.account,
+					requestedCaptchaType,
+					sessionId
+				}
+			}));
+			return {
+				valid: false,
+				reason: _prosopo_types.ResultReason.INCORRECT_CAPTCHA_TYPE,
+				type: requestedCaptchaType
+			};
+		}
 		if (sessionId) {
 			const cachedBeforeRemove = this.writeQueue ? await this.writeQueue.getCachedSession(sessionId) : null;
 			const cachedHash = typeof cachedBeforeRemove?.userSitekeyIpHash === "string" ? cachedBeforeRemove.userSitekeyIpHash : void 0;

package/dist/cjs/tasks/captchaTypeSelection.cjs

@@ -18,12 +18,16 @@ let _prosopo_types = require("@prosopo/types");
 * Restrict rules, traffic-filter category policies, routing-machine actions
 * and detector-generated rules.
 *
+* Pass `allowedTypes` from `resolveAllowedCaptchaTypes`, so Prosopo's
+* per-site captcha type feature flags are applied alongside the site owner's
+* own `frictionlessTypes`. Absent means every type is allowed.
+*
 * Coercion only ever narrows. A disabled type falls back to the other
 * interactive type if that is permitted, and to PoW otherwise — never the
 * reverse, so this can't hand a user a harder challenge than was asked for.
 */
-var coerceToEnabledCaptchaType = (requested, frictionlessTypes, logger) => {
-	const types = (0, _prosopo_types.resolveFrictionlessTypes)(frictionlessTypes);
+var coerceToEnabledCaptchaType = (requested, allowedTypes, logger) => {
+	const types = (0, _prosopo_types.resolveFrictionlessTypes)(allowedTypes);
 	const puzzleAllowed = types.puzzle && require_puzzleRenderer.isPuzzleRenderAvailable();
 	const imageAllowed = types.image;
 	const resolved = (() => {
@@ -49,5 +53,22 @@ var coerceToEnabledCaptchaType = (requested, frictionlessTypes, logger) => {
 	}));
 	return resolved;
 };
+/**
+* Swap a puzzle for an image challenge once the user has refreshed it
+* `PUZZLE_REFRESHES_BEFORE_IMAGE` times in a row.
+*
+* A user who keeps refreshing either cannot solve this kind of puzzle or is a
+* solver shopping for an easy instance. The image challenge answers both.
+*
+* The refresh count is client-reported, so this only moves one way: from
+* puzzle to image, never back. Lying about it can only earn a harder
+* challenge. Leaving it out looks like a fresh visit, which is what a page
+* reload already gets.
+*
+* A site that has not enabled image keeps its puzzle. Serving a type the site
+* turned off is exactly what `coerceToEnabledCaptchaType` exists to stop.
+*/
+var switchTypeAfterRefreshes = (resolved, refreshCount, allowedTypes) => _prosopo_types.CaptchaType.puzzle === resolved && (refreshCount ?? 0) >= 3 && (0, _prosopo_types.resolveFrictionlessTypes)(allowedTypes).image ? _prosopo_types.CaptchaType.image : resolved;
 //#endregion
 exports.coerceToEnabledCaptchaType = coerceToEnabledCaptchaType;
+exports.switchTypeAfterRefreshes = switchTypeAfterRefreshes;

package/dist/cjs/tasks/client/clientTasks.cjs

@@ -5,6 +5,29 @@ let _prosopo_database = require("@prosopo/database");
 let _prosopo_types = require("@prosopo/types");
 require("node:crypto");
 let _prosopo_util = require("@prosopo/util");
+/**
+* Matches `text` against a pattern where `*` matches any run of characters.
+* Greedy two-pointer match, retrying from the last `*` on mismatch, so time
+* is bounded by pattern length times text length.
+*/
+var matchesGlob = (pattern, text) => {
+	let p = 0;
+	let t = 0;
+	let starP = -1;
+	let starT = 0;
+	while (t < text.length) if (p < pattern.length && pattern[p] === "*") {
+		starP = p++;
+		starT = t;
+	} else if (p < pattern.length && pattern[p] === text[t]) {
+		p++;
+		t++;
+	} else if (starP !== -1) {
+		p = starP + 1;
+		t = ++starT;
+	} else return false;
+	while (p < pattern.length && pattern[p] === "*") p++;
+	return p === pattern.length;
+};
 var ClientTaskManager = class {
 	constructor(config, logger, db) {
 		this.config = config;
@@ -251,10 +274,7 @@ var ClientTaskManager = class {
 				const allowed = (0, _prosopo_util.parseUrl)(suffix).hostname.replace(/\.$/, "");
 				return referrerHost.endsWith(`.${allowed}`) || referrerHost === allowed;
 			}
-			if (pattern.includes("*")) {
-				const escaped = pattern.replace(/[.+?^${}()|\[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-				return new RegExp(`^${escaped}$`, "i").test(referrerHost);
-			}
+			if (pattern.includes("*")) return matchesGlob(pattern, referrerHost.toLowerCase());
 			const allowedHost = (0, _prosopo_util.parseUrl)(pattern).hostname.replace(/\.$/, "");
 			return referrerHost === allowedHost || referrerHost.endsWith(`.${allowedHost}`);
 		} catch (e) {
@@ -297,3 +317,4 @@ var ClientTaskManager = class {
 };
 //#endregion
 exports.ClientTaskManager = ClientTaskManager;
+exports.matchesGlob = matchesGlob;

package/dist/cjs/tasks/dataset/datasetTasksUtils.cjs

@@ -5,7 +5,7 @@ var providerValidateDataset = async (datasetRaw, minSolvedCaptchas, minUnsolvedC
 	if (datasetRaw.captchas.length < minSolvedCaptchas + minUnsolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.CAPTCHAS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
 	const solutions = datasetRaw.captchas.map((captcha) => captcha.solution ? 1 : 0).reduce((partialSum, b) => partialSum + b, 0);
 	if (solutions < minSolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.SOLUTIONS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
-	if (solutions < minUnsolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.SOLUTIONS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
+	if (datasetRaw.captchas.length - solutions < minUnsolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.CAPTCHAS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
 	const dataset = await (0, _prosopo_datasets.buildDataset)(datasetRaw);
 	if (!dataset.datasetId || !dataset.datasetContentId) throw new _prosopo_common.ProsopoEnvError("DATASET.DATASET_ID_UNDEFINED", { context: {
 		failedFuncName: providerValidateDataset.name,

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -1,6 +1,7 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_dnsEventUrl = require("../../api/dnsEventUrl.cjs");
+const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
 const require_lang = require("../../rules/lang.cjs");
 const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
@@ -33,6 +34,15 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		this.routingContext = ctx;
 	}
 	/**
+	* The types this site may be served, from `resolveAllowedCaptchaTypes`.
+	* Set before any path can mint a session, including the short-circuits
+	* that skip routing, so the site's feature flags hold on every path.
+	* Unset means every type is allowed.
+	*/
+	setAllowedCaptchaTypes(allowed) {
+		this.allowedCaptchaTypes = allowed;
+	}
+	/**
 	* Evaluate the configured routing machine without going through
 	* `sendCaptcha`. Returns the supplied baseline on any failure (no machine,
 	* machine throws, counter fetch failure), matching applyRouter's contract.
@@ -63,15 +73,10 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			d: params.d,
 			tcpToChelloUs: params.tcpToChelloUs,
 			chelloToHandshakeUs: params.chelloToHandshakeUs,
-			synNs: params.synNs,
-			synackNs: params.synackNs,
-			ackNs: params.ackNs,
-			observedTtl: params.observedTtl,
-			tcpMss: params.tcpMss,
-			tcpWscale: params.tcpWscale,
-			tcpOptsFlags: params.tcpOptsFlags,
-			tcpOptsOrder: params.tcpOptsOrder,
-			tcpWindow: params.tcpWindow
+			...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(params),
+			refreshOf: params.refreshOf,
+			refreshCount: params.refreshCount,
+			refreshedAfterMs: params.refreshedAfterMs
 		};
 	}
 	/**
@@ -91,7 +96,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		return require_lang.checkLangRules(this.config, acceptLanguage);
 	}
 	async createSession(input) {
-		const { token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, mode, solvedImagesCount, powDifficulty, userSitekeyIpHash, reason, blocked, deleted, ipInfo, headers, bundleId, currentUrl, iframeUrl, d, tcpToChelloUs, chelloToHandshakeUs, synNs, synackNs, ackNs, observedTtl, tcpMss, tcpWscale, tcpOptsFlags, tcpOptsOrder, tcpWindow, simdReadings, puzzleTolerance, puzzle, isEscalation, originSessionId, isProtect, matchedRule, clientMetaData, webView = false, iFrame = false, decryptedHeadHash = "" } = input;
+		const { token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, mode, solvedImagesCount, powDifficulty, userSitekeyIpHash, reason, blocked, deleted, ipInfo, headers, bundleId, currentUrl, iframeUrl, d, tcpToChelloUs, chelloToHandshakeUs, simdReadings, puzzleTolerance, puzzle, isEscalation, originSessionId, refreshOf, refreshCount, refreshedAfterMs, isProtect, matchedRule, clientMetaData, webView = false, iFrame = false, decryptedHeadHash = "" } = input;
 		const sessionRecord = {
 			sessionId: `${getSessionIDPrefix(this.config.host)}-${(0, uuid.v4)()}`,
 			createdAt: /* @__PURE__ */ new Date(),
@@ -111,6 +116,9 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			iFrame,
 			...isEscalation && { isEscalation: true },
 			...originSessionId && { originSessionId },
+			...refreshOf && { refreshOf },
+			...refreshCount !== void 0 && { refreshCount },
+			...refreshedAfterMs !== void 0 && { refreshedAfterMs },
 			decryptedHeadHash,
 			bundleId,
 			reason,
@@ -127,15 +135,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			d,
 			tcpToChelloUs,
 			chelloToHandshakeUs,
-			synNs,
-			synackNs,
-			ackNs,
-			observedTtl,
-			tcpMss,
-			tcpWscale,
-			tcpOptsFlags,
-			tcpOptsOrder,
-			tcpWindow,
+			...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(input),
 			...matchedRule && { matchedRule },
 			...clientMetaData && { clientMetaData }
 		};
@@ -247,14 +247,16 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			powDifficulty: captchaType === _prosopo_types.CaptchaType.pow ? effectiveParams.powDifficulty : void 0
 		};
 		const routed = this.routingContext ? await require_routingMachine.applyRouter(this.decisionMachineRunner, this.usageCounters, baseline, this.routingContext, this.logger) : baseline;
-		const finalCaptchaType = require_captchaTypeSelection.coerceToEnabledCaptchaType(routed.captchaType, this.routingContext?.frictionlessTypes, this.logger);
+		const enabledCaptchaType = require_captchaTypeSelection.coerceToEnabledCaptchaType(routed.captchaType, this.allowedCaptchaTypes, this.logger);
+		const finalCaptchaType = require_captchaTypeSelection.switchTypeAfterRefreshes(enabledCaptchaType, effectiveParams.refreshCount, this.allowedCaptchaTypes);
+		const switchedByRefreshes = finalCaptchaType !== enabledCaptchaType;
 		const requestedSolvedImagesCount = routed.solvedImagesCount ?? effectiveParams.solvedImagesCount;
 		const imageRoundsBounds = this.routingContext ?? {};
 		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? requestedSolvedImagesCount !== void 0 ? (0, _prosopo_types.clampImageRounds)(requestedSolvedImagesCount, imageRoundsBounds) : requestedSolvedImagesCount : void 0;
 		const finalPowDifficulty = finalCaptchaType === _prosopo_types.CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
-		const finalReason = routed.reason ?? effectiveParams.reason;
+		const finalReason = switchedByRefreshes ? _prosopo_types.FrictionlessReason.PUZZLE_REFRESH_LIMIT : routed.reason ?? effectiveParams.reason;
 		const finalPuzzleOverrides = finalCaptchaType === _prosopo_types.CaptchaType.puzzle ? (() => {
-			const maxLevel = this.routingContext?.puzzleMaxDifficulty ?? _prosopo_types.puzzleMaxDifficultyDefault;
+			const maxLevel = (0, _prosopo_captcha_severity.resolveMaxEscalationLevel)(this.routingContext?.puzzleMaxDifficulty ?? _prosopo_types.puzzleMaxDifficultyDefault, this.routingContext?.platform.isMobile ?? false);
 			const level = finalReason !== void 0 && _prosopo_types.NO_MEASUREMENT_REASONS.has(finalReason) ? 0 : (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count, maxLevel);
 			const difficulty = level > 0 ? require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken) : void 0;
 			const tolerance = routed.puzzleTolerance ?? difficulty?.tolerance;
@@ -264,7 +266,8 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			} : void 0;
 			return {
 				...tolerance !== void 0 && { puzzleTolerance: tolerance },
-				...puzzle !== void 0 && { puzzle }
+				...puzzle !== void 0 && { puzzle },
+				...difficulty !== void 0 && { puzzleLevel: difficulty.level }
 			};
 		})() : {};
 		const blocked = finalCaptchaType === _prosopo_types.CaptchaType.image ? effectiveParams.blocked : void 0;