@prosopo/provider 5.14.0 → 5.15.0

package/dist/cjs/api/rawTlsSignalsMiddleware.cjs

@@ -7,9 +7,44 @@ var HEADER_ACK_NS = "x-tls-ack-ns";
 var HEADER_OBSERVED_TTL = "x-tls-observed-ttl";
 var HEADER_TCP_MSS = "x-tls-tcp-mss";
 var HEADER_TCP_WSCALE = "x-tls-tcp-wscale";
+var HEADER_TCP_WINDOW = "x-tls-tcp-window";
+var HEADER_TCP_OPTS_KINDS = "x-tls-tcp-opts-kinds";
+var HEADER_TCP_OPTS_PRESENT = "x-tls-tcp-opts-present";
+var HEADER_TCP_OPTS_COUNT = "x-tls-tcp-opts-count";
+var HEADER_TCP_TSVAL = "x-tls-tcp-tsval";
+var HEADER_TCP_TSECR = "x-tls-tcp-tsecr";
+var HEADER_TCP_FLAGS = "x-tls-tcp-flags";
+var HEADER_TCP_DATA_OFFSET_RESV = "x-tls-tcp-data-offset-resv";
+var HEADER_TCP_URG_PTR = "x-tls-tcp-urg-ptr";
+var HEADER_IP_IDENT = "x-tls-ip-ident";
+var HEADER_IP_TOTAL_LEN = "x-tls-ip-total-len";
+var HEADER_IP_FRAG_FLAGS = "x-tls-ip-frag-flags";
+var HEADER_IP_TOS = "x-tls-ip-tos";
 var HEADER_TCP_OPTS_FLAGS = "x-tls-tcp-opts-flags";
 var HEADER_TCP_OPTS_ORDER = "x-tls-tcp-opts-order";
-var HEADER_TCP_WINDOW = "x-tls-tcp-window";
+var RAW_TLS_SIGNAL_KEYS = [
+	"synNs",
+	"synackNs",
+	"ackNs",
+	"observedTtl",
+	"tcpMss",
+	"tcpWscale",
+	"tcpWindow",
+	"tcpOptsKinds",
+	"tcpOptsPresent",
+	"tcpOptsCount",
+	"tcpTsval",
+	"tcpTsecr",
+	"tcpFlags",
+	"tcpDataOffsetResv",
+	"tcpUrgPtr",
+	"ipIdent",
+	"ipTotalLen",
+	"ipFragFlags",
+	"ipTos",
+	"tcpOptsFlags",
+	"tcpOptsOrder"
+];
 var parseIntHeader = (raw, logger, headerName, max) => {
 	if (raw === void 0) return;
 	const value = Array.isArray(raw) ? raw[0] : raw;
@@ -31,6 +66,46 @@ var MAX_NS = 2 ** 63;
 var MAX_U8 = 255;
 var MAX_U16 = 65535;
 var MAX_U32 = 4294967295;
+var OPTS_KINDS_SLOTS = 8;
+var MAX_U64 = (1n << 64n) - 1n;
+var parseOptsKindsHeader = (raw, logger) => {
+	if (raw === void 0) return;
+	const value = Array.isArray(raw) ? raw[0] : raw;
+	if (value === void 0 || !/^\d+$/.test(value)) {
+		if (value !== void 0) logger.debug(() => ({
+			msg: "Ignoring malformed raw TLS signal header",
+			data: {
+				header: HEADER_TCP_OPTS_KINDS,
+				raw: value
+			}
+		}));
+		return;
+	}
+	let packed;
+	try {
+		packed = BigInt(value);
+	} catch {
+		return;
+	}
+	if (packed > MAX_U64) {
+		logger.debug(() => ({
+			msg: "Ignoring out-of-range raw TLS signal header",
+			data: {
+				header: HEADER_TCP_OPTS_KINDS,
+				raw: value
+			}
+		}));
+		return;
+	}
+	if (packed === 0n) return;
+	const kinds = [];
+	for (let slot = 0; slot < OPTS_KINDS_SLOTS; slot++) {
+		const kind = Number(packed >> BigInt(slot * 8) & 255n);
+		if (kind === 0) break;
+		kinds.push(kind);
+	}
+	return kinds.length > 0 ? kinds : void 0;
+};
 var getRawTlsSignals = (headers, logger) => {
 	const log = logger ?? (0, _prosopo_logger.getLogger)("info", "provider:raw-tls-signals");
 	return {
@@ -40,37 +115,50 @@ var getRawTlsSignals = (headers, logger) => {
 		observedTtl: parseIntHeader(headers[HEADER_OBSERVED_TTL], log, HEADER_OBSERVED_TTL, MAX_U8),
 		tcpMss: parseIntHeader(headers[HEADER_TCP_MSS], log, HEADER_TCP_MSS, MAX_U16),
 		tcpWscale: parseIntHeader(headers[HEADER_TCP_WSCALE], log, HEADER_TCP_WSCALE, MAX_U8),
+		tcpWindow: parseIntHeader(headers[HEADER_TCP_WINDOW], log, HEADER_TCP_WINDOW, MAX_U16),
+		tcpOptsKinds: parseOptsKindsHeader(headers[HEADER_TCP_OPTS_KINDS], log),
+		tcpOptsPresent: parseIntHeader(headers[HEADER_TCP_OPTS_PRESENT], log, HEADER_TCP_OPTS_PRESENT, MAX_U16),
+		tcpOptsCount: parseIntHeader(headers[HEADER_TCP_OPTS_COUNT], log, HEADER_TCP_OPTS_COUNT, MAX_U8),
+		tcpTsval: parseIntHeader(headers[HEADER_TCP_TSVAL], log, HEADER_TCP_TSVAL, MAX_U32),
+		tcpTsecr: parseIntHeader(headers[HEADER_TCP_TSECR], log, HEADER_TCP_TSECR, MAX_U32),
+		tcpFlags: parseIntHeader(headers[HEADER_TCP_FLAGS], log, HEADER_TCP_FLAGS, MAX_U8),
+		tcpDataOffsetResv: parseIntHeader(headers[HEADER_TCP_DATA_OFFSET_RESV], log, HEADER_TCP_DATA_OFFSET_RESV, MAX_U8),
+		tcpUrgPtr: parseIntHeader(headers[HEADER_TCP_URG_PTR], log, HEADER_TCP_URG_PTR, MAX_U16),
+		ipIdent: parseIntHeader(headers[HEADER_IP_IDENT], log, HEADER_IP_IDENT, MAX_U16),
+		ipTotalLen: parseIntHeader(headers[HEADER_IP_TOTAL_LEN], log, HEADER_IP_TOTAL_LEN, MAX_U16),
+		ipFragFlags: parseIntHeader(headers[HEADER_IP_FRAG_FLAGS], log, HEADER_IP_FRAG_FLAGS, MAX_U16),
+		ipTos: parseIntHeader(headers[HEADER_IP_TOS], log, HEADER_IP_TOS, MAX_U8),
 		tcpOptsFlags: parseIntHeader(headers[HEADER_TCP_OPTS_FLAGS], log, HEADER_TCP_OPTS_FLAGS, MAX_U8),
-		tcpOptsOrder: parseIntHeader(headers[HEADER_TCP_OPTS_ORDER], log, HEADER_TCP_OPTS_ORDER, MAX_U32),
-		tcpWindow: parseIntHeader(headers[HEADER_TCP_WINDOW], log, HEADER_TCP_WINDOW, MAX_U16)
+		tcpOptsOrder: parseIntHeader(headers[HEADER_TCP_OPTS_ORDER], log, HEADER_TCP_OPTS_ORDER, MAX_U32)
 	};
 };
-var rawTlsSignalsForSession = (req) => {
+var rawTlsSignalsForSession = (req) => rawTlsSignalsFromRecord(req);
+/**
+* Pull the raw TLS signals out of a persisted Session — or anything shaped
+* like one — for a decision machine's `raw` bag, or to carry forward onto a
+* new Session record.
+*
+* Six call sites used to name every field by hand, so adding one to the
+* probe meant remembering six places; the fields that were forgotten read as
+* `undefined` and the rules gating on them silently never fired.
+*/
+var rawTlsSignalsFromRecord = (record) => {
 	const out = {};
-	if (req.synNs !== void 0) out.synNs = req.synNs;
-	if (req.synackNs !== void 0) out.synackNs = req.synackNs;
-	if (req.ackNs !== void 0) out.ackNs = req.ackNs;
-	if (req.observedTtl !== void 0) out.observedTtl = req.observedTtl;
-	if (req.tcpMss !== void 0) out.tcpMss = req.tcpMss;
-	if (req.tcpWscale !== void 0) out.tcpWscale = req.tcpWscale;
-	if (req.tcpOptsFlags !== void 0) out.tcpOptsFlags = req.tcpOptsFlags;
-	if (req.tcpOptsOrder !== void 0) out.tcpOptsOrder = req.tcpOptsOrder;
-	if (req.tcpWindow !== void 0) out.tcpWindow = req.tcpWindow;
+	if (!record) return out;
+	for (const key of RAW_TLS_SIGNAL_KEYS) {
+		const value = record[key];
+		if (value !== void 0) Object.assign(out, { [key]: value });
+	}
 	return out;
 };
 var rawTlsSignalsMiddleware = (env) => {
 	return async (req, res, next) => {
 		try {
 			const signals = getRawTlsSignals(req.headers, req.logger);
-			if (signals.synNs !== void 0) req.synNs = signals.synNs;
-			if (signals.synackNs !== void 0) req.synackNs = signals.synackNs;
-			if (signals.ackNs !== void 0) req.ackNs = signals.ackNs;
-			if (signals.observedTtl !== void 0) req.observedTtl = signals.observedTtl;
-			if (signals.tcpMss !== void 0) req.tcpMss = signals.tcpMss;
-			if (signals.tcpWscale !== void 0) req.tcpWscale = signals.tcpWscale;
-			if (signals.tcpOptsFlags !== void 0) req.tcpOptsFlags = signals.tcpOptsFlags;
-			if (signals.tcpOptsOrder !== void 0) req.tcpOptsOrder = signals.tcpOptsOrder;
-			if (signals.tcpWindow !== void 0) req.tcpWindow = signals.tcpWindow;
+			for (const key of RAW_TLS_SIGNAL_KEYS) {
+				const value = signals[key];
+				if (value !== void 0) Object.assign(req, { [key]: value });
+			}
 			if (Object.values(signals).some((v) => v !== void 0)) req.logger = req.logger.with(signals, "rawTlsSignals");
 			next();
 		} catch (err) {
@@ -81,4 +169,5 @@ var rawTlsSignalsMiddleware = (env) => {
 //#endregion
 exports.getRawTlsSignals = getRawTlsSignals;
 exports.rawTlsSignalsForSession = rawTlsSignalsForSession;
+exports.rawTlsSignalsFromRecord = rawTlsSignalsFromRecord;
 exports.rawTlsSignalsMiddleware = rawTlsSignalsMiddleware;

package/dist/cjs/api/startProviderApi.cjs

@@ -1,9 +1,9 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_metrics = require("./metrics.cjs");
+const require_rawTlsSignalsMiddleware = require("./rawTlsSignalsMiddleware.cjs");
 const require_blacklistRequestInspector = require("./blacklistRequestInspector.cjs");
 const require_bundlePool = require("../tasks/detection/bundlePool.cjs");
 const require_block = require("./block.cjs");
-const require_rawTlsSignalsMiddleware = require("./rawTlsSignalsMiddleware.cjs");
 const require_captcha = require("./captcha.cjs");
 const require_verify = require("./verify.cjs");
 const require_ja4Middleware = require("./ja4Middleware.cjs");
@@ -20,13 +20,13 @@ const require_ipInfoMiddleware = require("./ipInfoMiddleware.cjs");
 const require_robotsMiddleware = require("./robotsMiddleware.cjs");
 let _prosopo_logger = require("@prosopo/logger");
 let _prosopo_types = require("@prosopo/types");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let node_fs = require("node:fs");
 node_fs = require_runtime.__toESM(node_fs, 1);
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path, 1);
 let node_https = require("node:https");
 node_https = require_runtime.__toESM(node_https, 1);
-let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let express = require("express");
 express = require_runtime.__toESM(express, 1);
 let node_url = require("node:url");

package/dist/cjs/compositeIpAddress.cjs

@@ -4,6 +4,11 @@ let ip_address = require("ip-address");
 //#region src/compositeIpAddress.ts
 var V6_SHIFT = 64n;
 var v6_LOWER_MASK = (1n << V6_SHIFT) - 1n;
+/**
+* The part of a v4 address treated as the host rather than the network, for
+* the purposes of `isSameIpOrigin`. 8 bits — a /24.
+*/
+var V4_HOST_BITS = 8n;
 var getCompositeIpAddress = (ip) => {
 	let ipAddress;
 	try {
@@ -60,10 +65,19 @@ var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPar
 /**
 * Do two observations of a client come from the same place on the network?
 *
-* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
-* interface identifier in the low 64 bits is designed to rotate (RFC 8981
-* privacy extensions), often several times a day on one unchanged connection,
-* so comparing it would call an ordinary phone a different host.
+* Both families are compared on the network part and neither on the host part.
+*
+* v6 is the /64 prefix: the interface identifier in the low 64 bits is designed
+* to rotate (RFC 8981 privacy extensions), often several times a day on one
+* unchanged connection, so comparing it would call an ordinary phone a
+* different host.
+*
+* v4 is the /24. A carrier NAT or mobile pool reassigns the low octet mid
+* session — an EE subscriber was observed moving one address in four seconds —
+* so comparing the whole address called every rotating mobile and CGNAT client
+* a different host, which is the opposite of the leniency this check is for.
+* The /24 still separates an unrelated network, which is the case worth
+* catching: a challenge handed to a second host to farm the work out.
 *
 * A value we do not actually have counts as the same — one that will not
 * parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
@@ -73,13 +87,13 @@ var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPar
 var isSameIpOrigin = (a, b) => {
 	if (isUnknownIp(a) || isUnknownIp(b)) return true;
 	if (a.type !== b.type) return false;
-	const compare = (left, right) => {
+	const sameNetwork = (left, right, hostBits) => {
 		const leftPart = readPart(left);
 		const rightPart = readPart(right);
 		if (leftPart === void 0 || rightPart === void 0) return true;
-		return leftPart === rightPart;
+		return leftPart >> hostBits === rightPart >> hostBits;
 	};
-	return a.type === _prosopo_types.IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+	return a.type === _prosopo_types.IpAddressType.v6 ? sameNetwork(a.upper, b.upper, 0n) : sameNetwork(a.lower, b.lower, V4_HOST_BITS);
 };
 var never = () => {
 	throw new Error("Unhandled type");

package/dist/cjs/tasks/captchaManager.cjs

@@ -225,6 +225,21 @@ var CaptchaManager = class CaptchaManager {
 				sessionId
 			}
 		}));
+		if (!(0, _prosopo_types.isCaptchaTypeFeatureEnabled)(requestedCaptchaType, clientSettings.settings?.captchaTypeFeatureFlags)) {
+			this.logger.warn(() => ({
+				msg: "Captcha type is switched off for this site",
+				data: {
+					account: clientSettings.account,
+					requestedCaptchaType,
+					sessionId
+				}
+			}));
+			return {
+				valid: false,
+				reason: _prosopo_types.ResultReason.INCORRECT_CAPTCHA_TYPE,
+				type: requestedCaptchaType
+			};
+		}
 		if (sessionId) {
 			const cachedBeforeRemove = this.writeQueue ? await this.writeQueue.getCachedSession(sessionId) : null;
 			const cachedHash = typeof cachedBeforeRemove?.userSitekeyIpHash === "string" ? cachedBeforeRemove.userSitekeyIpHash : void 0;

package/dist/cjs/tasks/captchaTypeSelection.cjs

@@ -18,12 +18,16 @@ let _prosopo_types = require("@prosopo/types");
 * Restrict rules, traffic-filter category policies, routing-machine actions
 * and detector-generated rules.
 *
+* Pass `allowedTypes` from `resolveAllowedCaptchaTypes`, so Prosopo's
+* per-site captcha type feature flags are applied alongside the site owner's
+* own `frictionlessTypes`. Absent means every type is allowed.
+*
 * Coercion only ever narrows. A disabled type falls back to the other
 * interactive type if that is permitted, and to PoW otherwise — never the
 * reverse, so this can't hand a user a harder challenge than was asked for.
 */
-var coerceToEnabledCaptchaType = (requested, frictionlessTypes, logger) => {
-	const types = (0, _prosopo_types.resolveFrictionlessTypes)(frictionlessTypes);
+var coerceToEnabledCaptchaType = (requested, allowedTypes, logger) => {
+	const types = (0, _prosopo_types.resolveFrictionlessTypes)(allowedTypes);
 	const puzzleAllowed = types.puzzle && require_puzzleRenderer.isPuzzleRenderAvailable();
 	const imageAllowed = types.image;
 	const resolved = (() => {
@@ -49,5 +53,22 @@ var coerceToEnabledCaptchaType = (requested, frictionlessTypes, logger) => {
 	}));
 	return resolved;
 };
+/**
+* Swap a puzzle for an image challenge once the user has refreshed it
+* `PUZZLE_REFRESHES_BEFORE_IMAGE` times in a row.
+*
+* A user who keeps refreshing either cannot solve this kind of puzzle or is a
+* solver shopping for an easy instance. The image challenge answers both.
+*
+* The refresh count is client-reported, so this only moves one way: from
+* puzzle to image, never back. Lying about it can only earn a harder
+* challenge. Leaving it out looks like a fresh visit, which is what a page
+* reload already gets.
+*
+* A site that has not enabled image keeps its puzzle. Serving a type the site
+* turned off is exactly what `coerceToEnabledCaptchaType` exists to stop.
+*/
+var switchTypeAfterRefreshes = (resolved, refreshCount, allowedTypes) => _prosopo_types.CaptchaType.puzzle === resolved && (refreshCount ?? 0) >= 3 && (0, _prosopo_types.resolveFrictionlessTypes)(allowedTypes).image ? _prosopo_types.CaptchaType.image : resolved;
 //#endregion
 exports.coerceToEnabledCaptchaType = coerceToEnabledCaptchaType;
+exports.switchTypeAfterRefreshes = switchTypeAfterRefreshes;

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -1,6 +1,7 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_dnsEventUrl = require("../../api/dnsEventUrl.cjs");
+const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
 const require_lang = require("../../rules/lang.cjs");
 const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
@@ -33,6 +34,15 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		this.routingContext = ctx;
 	}
 	/**
+	* The types this site may be served, from `resolveAllowedCaptchaTypes`.
+	* Set before any path can mint a session, including the short-circuits
+	* that skip routing, so the site's feature flags hold on every path.
+	* Unset means every type is allowed.
+	*/
+	setAllowedCaptchaTypes(allowed) {
+		this.allowedCaptchaTypes = allowed;
+	}
+	/**
 	* Evaluate the configured routing machine without going through
 	* `sendCaptcha`. Returns the supplied baseline on any failure (no machine,
 	* machine throws, counter fetch failure), matching applyRouter's contract.
@@ -63,15 +73,10 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			d: params.d,
 			tcpToChelloUs: params.tcpToChelloUs,
 			chelloToHandshakeUs: params.chelloToHandshakeUs,
-			synNs: params.synNs,
-			synackNs: params.synackNs,
-			ackNs: params.ackNs,
-			observedTtl: params.observedTtl,
-			tcpMss: params.tcpMss,
-			tcpWscale: params.tcpWscale,
-			tcpOptsFlags: params.tcpOptsFlags,
-			tcpOptsOrder: params.tcpOptsOrder,
-			tcpWindow: params.tcpWindow
+			...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(params),
+			refreshOf: params.refreshOf,
+			refreshCount: params.refreshCount,
+			refreshedAfterMs: params.refreshedAfterMs
 		};
 	}
 	/**
@@ -91,7 +96,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		return require_lang.checkLangRules(this.config, acceptLanguage);
 	}
 	async createSession(input) {
-		const { token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, mode, solvedImagesCount, powDifficulty, userSitekeyIpHash, reason, blocked, deleted, ipInfo, headers, bundleId, currentUrl, iframeUrl, d, tcpToChelloUs, chelloToHandshakeUs, synNs, synackNs, ackNs, observedTtl, tcpMss, tcpWscale, tcpOptsFlags, tcpOptsOrder, tcpWindow, simdReadings, puzzleTolerance, puzzle, isEscalation, originSessionId, isProtect, matchedRule, clientMetaData, webView = false, iFrame = false, decryptedHeadHash = "" } = input;
+		const { token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, mode, solvedImagesCount, powDifficulty, userSitekeyIpHash, reason, blocked, deleted, ipInfo, headers, bundleId, currentUrl, iframeUrl, d, tcpToChelloUs, chelloToHandshakeUs, simdReadings, puzzleTolerance, puzzle, isEscalation, originSessionId, refreshOf, refreshCount, refreshedAfterMs, isProtect, matchedRule, clientMetaData, webView = false, iFrame = false, decryptedHeadHash = "" } = input;
 		const sessionRecord = {
 			sessionId: `${getSessionIDPrefix(this.config.host)}-${(0, uuid.v4)()}`,
 			createdAt: /* @__PURE__ */ new Date(),
@@ -111,6 +116,9 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			iFrame,
 			...isEscalation && { isEscalation: true },
 			...originSessionId && { originSessionId },
+			...refreshOf && { refreshOf },
+			...refreshCount !== void 0 && { refreshCount },
+			...refreshedAfterMs !== void 0 && { refreshedAfterMs },
 			decryptedHeadHash,
 			bundleId,
 			reason,
@@ -127,15 +135,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			d,
 			tcpToChelloUs,
 			chelloToHandshakeUs,
-			synNs,
-			synackNs,
-			ackNs,
-			observedTtl,
-			tcpMss,
-			tcpWscale,
-			tcpOptsFlags,
-			tcpOptsOrder,
-			tcpWindow,
+			...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(input),
 			...matchedRule && { matchedRule },
 			...clientMetaData && { clientMetaData }
 		};
@@ -247,14 +247,16 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			powDifficulty: captchaType === _prosopo_types.CaptchaType.pow ? effectiveParams.powDifficulty : void 0
 		};
 		const routed = this.routingContext ? await require_routingMachine.applyRouter(this.decisionMachineRunner, this.usageCounters, baseline, this.routingContext, this.logger) : baseline;
-		const finalCaptchaType = require_captchaTypeSelection.coerceToEnabledCaptchaType(routed.captchaType, this.routingContext?.frictionlessTypes, this.logger);
+		const enabledCaptchaType = require_captchaTypeSelection.coerceToEnabledCaptchaType(routed.captchaType, this.allowedCaptchaTypes, this.logger);
+		const finalCaptchaType = require_captchaTypeSelection.switchTypeAfterRefreshes(enabledCaptchaType, effectiveParams.refreshCount, this.allowedCaptchaTypes);
+		const switchedByRefreshes = finalCaptchaType !== enabledCaptchaType;
 		const requestedSolvedImagesCount = routed.solvedImagesCount ?? effectiveParams.solvedImagesCount;
 		const imageRoundsBounds = this.routingContext ?? {};
 		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? requestedSolvedImagesCount !== void 0 ? (0, _prosopo_types.clampImageRounds)(requestedSolvedImagesCount, imageRoundsBounds) : requestedSolvedImagesCount : void 0;
 		const finalPowDifficulty = finalCaptchaType === _prosopo_types.CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
-		const finalReason = routed.reason ?? effectiveParams.reason;
+		const finalReason = switchedByRefreshes ? _prosopo_types.FrictionlessReason.PUZZLE_REFRESH_LIMIT : routed.reason ?? effectiveParams.reason;
 		const finalPuzzleOverrides = finalCaptchaType === _prosopo_types.CaptchaType.puzzle ? (() => {
-			const maxLevel = this.routingContext?.puzzleMaxDifficulty ?? _prosopo_types.puzzleMaxDifficultyDefault;
+			const maxLevel = (0, _prosopo_captcha_severity.resolveMaxEscalationLevel)(this.routingContext?.puzzleMaxDifficulty ?? _prosopo_types.puzzleMaxDifficultyDefault, this.routingContext?.platform.isMobile ?? false);
 			const level = finalReason !== void 0 && _prosopo_types.NO_MEASUREMENT_REASONS.has(finalReason) ? 0 : (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count, maxLevel);
 			const difficulty = level > 0 ? require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken) : void 0;
 			const tolerance = routed.puzzleTolerance ?? difficulty?.tolerance;
@@ -264,7 +266,8 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			} : void 0;
 			return {
 				...tolerance !== void 0 && { puzzleTolerance: tolerance },
-				...puzzle !== void 0 && { puzzle }
+				...puzzle !== void 0 && { puzzle },
+				...difficulty !== void 0 && { puzzleLevel: difficulty.level }
 			};
 		})() : {};
 		const blocked = finalCaptchaType === _prosopo_types.CaptchaType.image ? effectiveParams.blocked : void 0;

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -1,5 +1,6 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
 const require_lang = require("../../rules/lang.cjs");
 const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
@@ -566,15 +567,7 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				currentUrl: sessionRecord?.currentUrl,
 				iframeUrl: sessionRecord?.iframeUrl,
 				coords: solution.coords,
-				synNs: sessionRecord?.synNs,
-				synackNs: sessionRecord?.synackNs,
-				ackNs: sessionRecord?.ackNs,
-				observedTtl: sessionRecord?.observedTtl,
-				tcpMss: sessionRecord?.tcpMss,
-				tcpWscale: sessionRecord?.tcpWscale,
-				tcpOptsFlags: sessionRecord?.tcpOptsFlags,
-				tcpOptsOrder: sessionRecord?.tcpOptsOrder,
-				tcpWindow: sessionRecord?.tcpWindow,
+				...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(sessionRecord),
 				trafficPolicies: require_devicePlatform.deriveTrafficPolicies(trafficFilter)
 			};
 			try {

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -1,5 +1,6 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
 const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
 const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
@@ -209,7 +210,8 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		let routingOutput = this.postPowContext ? await this.runPostPowRouting({
 			challengeRecord,
 			challengeSplit,
-			behavioralDataPacked: decryptedBehavioralDataPacked
+			behavioralDataPacked: decryptedBehavioralDataPacked,
+			coords
 		}) : void 0;
 		if ((escalateForMissingCoords || escalateForIpChange) && routingOutput?.captchaType !== _prosopo_types.CaptchaType.image && routingOutput?.captchaType !== _prosopo_types.CaptchaType.puzzle) routingOutput = {
 			captchaType: _prosopo_types.CaptchaType.image,
@@ -228,7 +230,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	*/
 	async runPostPowRouting(args) {
 		if (!this.postPowContext) return void 0;
-		const { challengeRecord, challengeSplit, behavioralDataPacked } = args;
+		const { challengeRecord, challengeSplit, behavioralDataPacked, coords } = args;
 		if (!challengeRecord.sessionId) {
 			this.logger.debug(() => ({ msg: "Skipping post-pow routing: PoW record has no linked session" }));
 			return;
@@ -259,6 +261,8 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			raw: {
 				...this.postPowContext.raw,
 				...behavioralDataPacked && { behavioralDataPacked },
+				...sessionRecord.mode && { mode: sessionRecord.mode },
+				coordsAllZero: require_powTasksUtils.isCoordsAllZero(coords),
 				...sessionRecord.simdReadings && { simd: sessionRecord.simdReadings },
 				...sessionRecord.currentUrl && { currentUrl: sessionRecord.currentUrl },
 				...sessionRecord.iframeUrl && { iframeUrl: sessionRecord.iframeUrl }
@@ -518,15 +522,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				currentUrl: sessionRecord?.currentUrl,
 				iframeUrl: sessionRecord?.iframeUrl,
 				coords: challengeRecord.coords,
-				synNs: sessionRecord?.synNs,
-				synackNs: sessionRecord?.synackNs,
-				ackNs: sessionRecord?.ackNs,
-				observedTtl: sessionRecord?.observedTtl,
-				tcpMss: sessionRecord?.tcpMss,
-				tcpWscale: sessionRecord?.tcpWscale,
-				tcpOptsFlags: sessionRecord?.tcpOptsFlags,
-				tcpOptsOrder: sessionRecord?.tcpOptsOrder,
-				tcpWindow: sessionRecord?.tcpWindow,
+				...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(sessionRecord),
 				trafficPolicies: require_devicePlatform.deriveTrafficPolicies(trafficFilter)
 			};
 			const decision = await this.decisionMachineRunner.decide(decisionInput, logger);

package/dist/cjs/tasks/powCaptcha/powTasksUtils.cjs

@@ -15,6 +15,8 @@ var checkPowSignature = (message, signature, address, signatureType) => {
 		signatureType
 	} });
 };
+var isCoordsAllZero = (coords) => coords !== void 0 && coords.length > 0 && coords.every((group) => group.length > 0 && group.every(([x, y]) => x === 0 && y === 0));
 //#endregion
 exports.checkPowSignature = checkPowSignature;
+exports.isCoordsAllZero = isCoordsAllZero;
 exports.validateSolution = validateSolution;

package/dist/cjs/tasks/puzzle/backgroundBuffer.cjs

@@ -15,12 +15,12 @@ var createPuzzleBackgroundBuffer = (options = {}) => {
 	timer.unref?.();
 	return {
 		take() {
-			const image = ready.pop();
-			if (!image) {
+			const background = ready.pop();
+			if (!background) {
 				starved++;
 				return require_nativeBackground.createBackgroundNative(geometry);
 			}
-			return image;
+			return background;
 		},
 		depth: () => ready.length,
 		starvations: () => starved,

package/dist/cjs/tasks/puzzle/nativeBackground.cjs

@@ -15,15 +15,22 @@ var nativePuzzle = (() => {
 * Byte-identical to `createBackground` from @prosopo/puzzle-assets given the
 * same seed — the JS remains the reference implementation and the contract
 * the differential test pins. Single-use is unchanged and still the caller's
-* responsibility: this mints a fresh CSPRNG seed per call and the seed never
-* leaves the process.
+* responsibility.
+*
+* The seed is returned so the challenge record can keep it and the portal can
+* regenerate this background later. See the secrecy note in prng.ts for where
+* it may and may not go.
 */
 var createBackgroundNative = (geometry = _prosopo_puzzle_assets.DEFAULT_GEOMETRY) => {
 	const { width, height } = geometry;
+	const seed = (0, _prosopo_puzzle_assets.createSeed)();
 	return {
-		data: require_metrics.measureSync("puzzle_background", () => nativePuzzle.generateBackground((0, _prosopo_puzzle_assets.createSeed)(), width, height)),
-		width,
-		height
+		image: {
+			data: require_metrics.measureSync("puzzle_background", () => nativePuzzle.generateBackground(seed, width, height)),
+			width,
+			height
+		},
+		seed
 	};
 };
 //#endregion

package/dist/cjs/tasks/puzzle/puzzleRenderer.cjs

@@ -79,15 +79,16 @@ var isPuzzleRenderAvailable = () => {
 };
 var renderPuzzleImages = async (placement, settings = _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS, pieceSize) => {
 	const background = (require_backgroundBuffer.getPuzzleBackgroundBuffer() ?? require_backgroundBuffer.initPuzzleBackgroundBuffer()).take();
-	if (!background) throw new Error("puzzle renderer: no background available");
-	const rendered = await require_metrics.measureSync("puzzle_render", () => (0, _prosopo_puzzle_assets.renderPuzzle)(background, placement, pieceSize !== void 0 ? {
+	const rendered = await require_metrics.measureSync("puzzle_render", () => (0, _prosopo_puzzle_assets.renderPuzzle)(background.image, placement, pieceSize !== void 0 ? {
 		..._prosopo_puzzle_assets.DEFAULT_GEOMETRY,
 		pieceSize
 	} : _prosopo_puzzle_assets.DEFAULT_GEOMETRY, settings));
 	return {
 		background: (0, _prosopo_puzzle_assets.toDataUri)(rendered.background),
 		piece: (0, _prosopo_puzzle_assets.toDataUri)(rendered.piece),
-		pieceSize: rendered.pieceSize
+		pieceSize: rendered.pieceSize,
+		backgroundSeed: background.seed.toString("hex"),
+		renderSeed: rendered.seed.toString("hex")
 	};
 };
 //#endregion

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -1,5 +1,6 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
 const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
 const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
@@ -470,15 +471,7 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				iframeUrl: sessionRecord?.iframeUrl,
 				coords: challengeRecord.coords,
 				puzzleEvents: challengeRecord.puzzleEvents,
-				synNs: sessionRecord?.synNs,
-				synackNs: sessionRecord?.synackNs,
-				ackNs: sessionRecord?.ackNs,
-				observedTtl: sessionRecord?.observedTtl,
-				tcpMss: sessionRecord?.tcpMss,
-				tcpWscale: sessionRecord?.tcpWscale,
-				tcpOptsFlags: sessionRecord?.tcpOptsFlags,
-				tcpOptsOrder: sessionRecord?.tcpOptsOrder,
-				tcpWindow: sessionRecord?.tcpWindow,
+				...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(sessionRecord),
 				trafficPolicies: require_devicePlatform.deriveTrafficPolicies(trafficFilter)
 			};
 			const decision = await this.decisionMachineRunner.decide(decisionInput, logger);

package/dist/compositeIpAddress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compositeIpAddress.d.ts","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAiB,MAAM,gBAAgB,CAAC;AAOxE,eAAO,MAAM,qBAAqB,OAC7B,MAAM,GAAG,SAAS,KACpB,kBAaF,CAAC;AAuBF,eAAO,MAAM,yBAAyB,uBACjB,kBAAkB,KACpC,SAaF,CAAC;AAuCF,eAAO,MAAM,cAAc,MACvB,kBAAkB,KAClB,kBAAkB,KACnB,OAiBF,CAAC"}
+{"version":3,"file":"compositeIpAddress.d.ts","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAiB,MAAM,gBAAgB,CAAC;AAaxE,eAAO,MAAM,qBAAqB,OAC7B,MAAM,GAAG,SAAS,KACpB,kBAaF,CAAC;AAuBF,eAAO,MAAM,yBAAyB,uBACjB,kBAAkB,KACpC,SAaF,CAAC;AAgDF,eAAO,MAAM,cAAc,MACvB,kBAAkB,KAClB,kBAAkB,KACnB,OAoBF,CAAC"}