@prosopo/provider 5.14.0 → 5.16.0

package/dist/cjs/tasks/interactiveCaptcha/interactiveCaptchaManager.cjs

@@ -0,0 +1,423 @@
+const require_usageCounters = require("../../util/usageCounters.cjs");
+const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
+const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+const require_util = require("../../util.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
+const require_devicePlatform = require("../../utils/devicePlatform.cjs");
+const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
+const require_captchaManager = require("../captchaManager.cjs");
+const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
+const require_powTasksUtils = require("../powCaptcha/powTasksUtils.cjs");
+const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_types = require("@prosopo/types");
+let _polkadot_util = require("@polkadot/util");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
+let _prosopo_util = require("@prosopo/util");
+//#region src/tasks/interactiveCaptcha/interactiveCaptchaManager.ts
+/**
+* Shared pipeline for the captcha types a human solves on screen (puzzle,
+* icon-order). Subclasses supply the record accessors and grading; minting,
+* submission bookkeeping and server verification live here.
+*/
+var InteractiveCaptchaManager = class extends require_captchaManager.CaptchaManager {
+	constructor(db, pair, config, logger, usageCounters) {
+		super(db, pair, config, logger);
+		this.POW_SEPARATOR = _prosopo_types.POW_SEPARATOR;
+		this.decisionMachineRunner = new require_decisionMachineRunner.DecisionMachineRunner(db);
+		this.usageCounters = usageCounters ?? null;
+	}
+	mintChallenge(userAccount, dappAccount) {
+		const requestedAtTimestamp = Date.now();
+		const challenge = `${requestedAtTimestamp}___${userAccount}___${dappAccount}___${Math.floor(Math.random() * 1e6)}`;
+		return {
+			challenge,
+			providerSignature: (0, _polkadot_util.u8aToHex)(this.pair.sign((0, _polkadot_util.stringToHex)(challenge))),
+			requestedAtTimestamp
+		};
+	}
+	/**
+	* Grades a user's submission and records the outcome on the captcha and
+	* session records. Returns whether the solution was correct.
+	*/
+	async submitInteractiveCaptchaSolution(submission) {
+		const { challenge, userTimestampSignature, behavioralData, simdReadings } = submission;
+		require_powTasksUtils.checkPowSignature(challenge, submission.providerChallengeSignature, this.pair.address, _prosopo_types.ApiParams.challenge);
+		const challengeSplit = challenge.split(this.POW_SEPARATOR);
+		const timestamp = Number.parseInt((0, _prosopo_util.at)(challengeSplit, 0));
+		const userAccount = (0, _prosopo_util.at)(challengeSplit, 1);
+		require_powTasksUtils.checkPowSignature(timestamp.toString(), userTimestampSignature, userAccount, _prosopo_types.ApiParams.timestamp);
+		const challengeRecord = await this.getRecordByChallenge(challenge);
+		if (!challengeRecord) {
+			this.logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
+			return false;
+		}
+		const { coords, saltDecodeError } = this.decodeSaltCoords(submission.salt);
+		if (!await this.claimSubmission(challengeRecord)) {
+			this.logger.debug(() => ({ msg: `Challenge already submitted: ${challenge}` }));
+			return false;
+		}
+		if (saltDecodeError) {
+			await this.recordSubmissionResult(challengeRecord, {
+				status: _prosopo_types.CaptchaStatus.disapproved,
+				reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_SALT
+			}, userTimestampSignature, void 0);
+			return false;
+		}
+		if (!(0, _prosopo_util.verifyRecency)(challenge, submission.timeout)) {
+			await this.recordSubmissionResult(challengeRecord, {
+				status: _prosopo_types.CaptchaStatus.disapproved,
+				reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_TIMESTAMP
+			}, userTimestampSignature, coords);
+			return false;
+		}
+		const correct = submission.isCorrect(challengeRecord);
+		const result = correct ? { status: _prosopo_types.CaptchaStatus.approved } : {
+			status: _prosopo_types.CaptchaStatus.disapproved,
+			reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_SOLUTION
+		};
+		if (correct && this.usageCounters) this.usageCounters.incrManyAsync((0, _prosopo_util.at)(challengeSplit, 2), require_usageCounters.buildAllWindowIncrements("solved", this.captchaType, submission.ipAddress.address, userAccount));
+		await submission.persistInteraction();
+		const decodedPayloads = await this.decodeSubmissionPayloads(challengeRecord.sessionId, {
+			behavioural: behavioralData,
+			simd: simdReadings
+		});
+		if (behavioralData) try {
+			const decryptedData = decodedPayloads.behavioural;
+			if (decryptedData) {
+				this.logger?.info(() => ({
+					msg: "Behavioral analysis completed",
+					data: {
+						userAccount,
+						dappAccount: (0, _prosopo_util.at)(challengeSplit, 2),
+						challenge,
+						mouseEventsCount: decryptedData.collector1?.length || 0,
+						touchEventsCount: decryptedData.collector2?.length || 0,
+						clickEventsCount: decryptedData.collector3?.length || 0,
+						scrollEventsCount: decryptedData.collector4?.length || 0,
+						deviceCapability: decryptedData.deviceCapability,
+						captchaResult: correct ? "passed" : "failed"
+					}
+				}));
+				const packedData = {
+					c1: decryptedData.collector1 || [],
+					c2: decryptedData.collector2 || [],
+					c3: decryptedData.collector3 || [],
+					c4: decryptedData.collector4 || [],
+					d: decryptedData.deviceCapability
+				};
+				await this.updateRecord(challenge, {
+					behavioralDataPacked: packedData,
+					deviceCapability: decryptedData.deviceCapability
+				});
+			}
+		} catch (error) {
+			this.logger?.error(() => ({
+				msg: "Failed to process behavioral data",
+				err: error
+			}));
+		}
+		const storedClientMetaData = require_clientMetaData.toStoredClientMetaData(submission.clientMetaData);
+		if (storedClientMetaData) await this.updateRecord(challenge, { clientMetaData: storedClientMetaData });
+		await this.recordSubmissionResult(challengeRecord, result, userTimestampSignature, coords, storedClientMetaData);
+		if (challengeRecord.sessionId && decodedPayloads.simd) await this.recordSessionSimdReadingsIfAbsentWithCache(challengeRecord.sessionId, decodedPayloads.simd, _prosopo_types.SimdReadingsStage.submit);
+		return correct;
+	}
+	/** Invalid salt disapproves the submission rather than being ignored. */
+	decodeSaltCoords(salt) {
+		if (!salt) return {};
+		try {
+			const extractedData = (0, _prosopo_util.extractData)(salt);
+			if (extractedData.length < 2) return {};
+			const coords = [[[extractedData[0], extractedData[1]]]];
+			(0, _prosopo_util.assertCoordsSafe)(coords, "coords");
+			return { coords };
+		} catch (error) {
+			this.logger.warn(() => ({
+				msg: "Failed to extract coordinates from salt",
+				error,
+				salt
+			}));
+			return { saltDecodeError: error };
+		}
+	}
+	async recordSubmissionResult(challengeRecord, result, userSignature, coords, clientMetaData) {
+		await this.updateSubmissionResult(challengeRecord.challenge, result, userSignature, coords);
+		if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+			userSubmitted: true,
+			result,
+			...(0, _prosopo_types.isBlockingCaptchaResult)(this.captchaType, result) && { blocked: true },
+			...clientMetaData && { clientMetaData }
+		});
+	}
+	/**
+	* The post-solve gate the site's server calls: decides whether the token
+	* the widget was given is honoured.
+	*
+	* @param dappAccount - the dapp that is requesting the captcha
+	* @param challenge - the challenge string
+	* @param timeout - milliseconds allowed between submit and verify
+	* @param env - provider environment
+	* @param ip - optional IP address for validation
+	* @param userAccessRulesStorage - storage for querying user access policies
+	* @param email
+	* @param spamEmailDomainCheckingEnabled
+	* @param spamFilter
+	* @param trafficFilter
+	* @param storeMetadata - when true, persists the dapp-server-provided
+	*   `email` on the captcha record for spam-rate analysis.
+	* @param clientSessionId - the session id the site rendered the widget
+	*   with. When supplied, the solve must carry the same value in its
+	*   `clientMetaData` or it is disapproved.
+	*/
+	async serverVerifyInteractiveCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId) {
+		const notVerifiedResponse = { verified: false };
+		const logger = this.logger.with({
+			challenge,
+			dappAccount
+		});
+		const challengeRecord = await this.getRecordByChallenge(challenge);
+		if (!challengeRecord) {
+			logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
+			return notVerifiedResponse;
+		}
+		notVerifiedResponse.sessionId = challengeRecord.sessionId;
+		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoApiError("CAPTCHA.INVALID_SOLUTION", { context: {
+			code: 400,
+			failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
+			challenge
+		} });
+		if (challengeRecord.serverChecked) return notVerifiedResponse;
+		const challengeDappAccount = challengeRecord.dappAccount;
+		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
+			failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
+			dappAccount,
+			challengeDappAccount
+		} });
+		if (!await this.markRecordChecked(challengeRecord.challenge)) return notVerifiedResponse;
+		const submittedAt = challengeRecord.submittedAtTimestamp;
+		if ((submittedAt instanceof Date ? Date.now() - submittedAt.getTime() : Number.POSITIVE_INFINITY) > timeout) {
+			await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.TIMESTAMP_TOO_OLD);
+			return notVerifiedResponse;
+		}
+		if (require_clientMetaData.isClientSessionMismatch(clientSessionId, challengeRecord.clientMetaData?.clientSessionId)) {
+			logger.info(() => ({
+				msg: `Client session mismatch in server ${this.logLabel} verification`,
+				data: { hasRecordedClientSessionId: Boolean(challengeRecord.clientMetaData?.clientSessionId) }
+			}));
+			await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.CLIENT_SESSION_MISMATCH);
+			return notVerifiedResponse;
+		}
+		if (userAccessRulesStorage) try {
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
+			if (blockPolicy) {
+				logger.info(() => ({
+					msg: `User blocked by access policy in server ${this.logLabel} verification`,
+					data: {
+						userAccount: challengeRecord.userAccount,
+						policy: blockPolicy
+					}
+				}));
+				await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK, { matchedRule: (0, _prosopo_user_access_policy.describeMatchedRule)(blockPolicy) });
+				return notVerifiedResponse;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: `Failed to check user access policies in server ${this.logLabel} verification`,
+				error
+			}));
+		}
+		if (email && spamEmailDomainCheckingEnabled) try {
+			if (await this.checkSpamEmail(email)) {
+				const emailDomain = email.split("@")[1] || "unknown";
+				logger.info(() => ({
+					msg: `Spam email domain detected in server ${this.logLabel} verification`,
+					data: { emailDomain }
+				}));
+				await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.SPAM_EMAIL_DOMAIN, null);
+				return notVerifiedResponse;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: `Failed to check spam email domain in server ${this.logLabel} verification`,
+				error
+			}));
+		}
+		const maxEmailSubmissionCount = spamFilter?.enabled && spamFilter.emailRules?.enabled ? spamFilter.emailRules.maxEmailSubmissionCount : void 0;
+		let emailNormalised;
+		if (maxEmailSubmissionCount !== void 0 && email && storeMetadata) {
+			emailNormalised = require_evaluateEmailSpamRules.normaliseEmailForMatching(email);
+			if (emailNormalised) try {
+				const priorCount = await this.db.countCommitmentsByNormalisedEmail(dappAccount, emailNormalised);
+				if (priorCount >= maxEmailSubmissionCount) {
+					logger.info(() => ({
+						msg: `Email submission count exceeded in server ${this.logLabel} verification`,
+						data: {
+							priorCount,
+							maxEmailSubmissionCount
+						}
+					}));
+					await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.SPAM_EMAIL_COUNT_EXCEEDED, null);
+					return notVerifiedResponse;
+				}
+			} catch (error) {
+				logger.warn(() => ({
+					msg: `Failed to check email submission count in server ${this.logLabel} verification`,
+					error
+				}));
+			}
+		}
+		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
+		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
+		{
+			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			if (check.isBlocked) {
+				logger.info(() => ({
+					msg: `Traffic filter rejected request in ${this.logLabel} verification`,
+					data: {
+						ip,
+						reason: check.reason,
+						dnsPeerIp: enrichedDnsEvent?.peerIp,
+						dnsResolverIp: enrichedDnsEvent?.resolverIp,
+						dnsPeerAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
+						dnsResolverAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo),
+						dnsPathValid: enrichedDnsEvent?.pathValid
+					}
+				}));
+				await this.disapproveVerification(challengeRecord, check.reason);
+				return notVerifiedResponse;
+			}
+		}
+		if (storeMetadata && email) await this.updateRecord(challengeRecord.challenge, { metadata: {
+			email,
+			emailNormalised: emailNormalised ?? require_evaluateEmailSpamRules.normaliseEmailForMatching(email)
+		} });
+		if (ip) {
+			const challengeIpAddress = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
+			const ipValidationRules = (await this.db.getClientRecord(dappAccount))?.settings?.ipValidationRules;
+			await this.updateRecord(challengeRecord.challenge, { providedIp: require_compositeIpAddress.getCompositeIpAddress(ip) });
+			if (ipValidationRules?.enabled === true) {
+				const ipValidation = await require_util.deepValidateIpAddress(ip, challengeIpAddress, logger, env.ipInfoService, ipValidationRules, enrichedDnsEvent?.peerIp);
+				if (!ipValidation.isValid) {
+					logger.error(() => ({
+						msg: `IP validation failed for ${this.logLabel} captcha`,
+						data: {
+							ip,
+							challengeIp: challengeIpAddress.address,
+							error: ipValidation.errorMessage,
+							distanceKm: ipValidation.distanceKm
+						}
+					}));
+					await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.FAILED_IP_VALIDATION);
+					return notVerifiedResponse;
+				}
+			}
+		}
+		let score;
+		if (sessionRecord) {
+			const dnsAsymmetry = require_enrichDnsEvent.computeDnsAsymmetry(enrichedDnsEvent, challengeRecord.ipInfo, trafficFilter);
+			if (dnsAsymmetry > 0) sessionRecord.scoreComponents = {
+				...sessionRecord.scoreComponents,
+				dnsAsymmetry
+			};
+			score = require_frictionlessTasksUtils.computeFrictionlessScore(sessionRecord?.scoreComponents);
+			logger.info(() => ({ data: {
+				scoreComponents: { ...sessionRecord?.scoreComponents || {} },
+				score,
+				dnsPeerAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
+				dnsResolverAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo)
+			} }));
+		}
+		try {
+			const decisionInput = {
+				userAccount: challengeRecord.userAccount,
+				dappAccount: challengeRecord.dappAccount,
+				captchaResult: "passed",
+				headers: challengeRecord.headers,
+				captchaType: this.captchaType,
+				behavioralDataPacked: challengeRecord.behavioralDataPacked,
+				deviceCapability: challengeRecord.deviceCapability,
+				countryCode: challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0,
+				ipInfo: challengeRecord.ipInfo,
+				dnsEvent: enrichedDnsEvent,
+				score,
+				threshold: sessionRecord?.threshold,
+				scoreComponents: sessionRecord?.scoreComponents,
+				decryptedHeadHash: sessionRecord?.decryptedHeadHash,
+				userSitekeyIpHash: sessionRecord?.userSitekeyIpHash,
+				simdReadings: sessionRecord?.simdReadings,
+				d: sessionRecord?.d,
+				frictionlessReason: sessionRecord?.reason,
+				ruleType: sessionRecord?.ruleType,
+				webView: sessionRecord?.webView,
+				iFrame: sessionRecord?.iFrame,
+				currentUrl: sessionRecord?.currentUrl,
+				iframeUrl: sessionRecord?.iframeUrl,
+				coords: challengeRecord.coords,
+				...this.decisionMachineEventFields(challengeRecord),
+				...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(sessionRecord),
+				trafficPolicies: require_devicePlatform.deriveTrafficPolicies(trafficFilter)
+			};
+			const decision = await this.decisionMachineRunner.decide(decisionInput, logger);
+			if (decision.decision === _prosopo_types.DecisionMachineDecision.Deny) {
+				logger.info(() => ({
+					msg: `Decision machine denied ${this.logLabel} captcha in server verification`,
+					data: {
+						userAccount: challengeRecord.userAccount,
+						reason: decision.reason,
+						score: decision.score,
+						tags: decision.tags
+					}
+				}));
+				await this.disapproveVerification(challengeRecord, decision.reason || _prosopo_types.ResultReason.CAPTCHA_DECISION_MACHINE_DENIED);
+				return notVerifiedResponse;
+			}
+			logger.debug(() => ({
+				msg: `Decision machine allowed ${this.logLabel} captcha`,
+				data: {
+					reason: decision.reason,
+					score: decision.score,
+					tags: decision.tags
+				}
+			}));
+		} catch (error) {
+			logger.error(() => ({
+				msg: `Failed to run decision machine in server ${this.logLabel} verification`,
+				err: error
+			}));
+		}
+		if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+			serverChecked: true,
+			result: { status: _prosopo_types.CaptchaStatus.approved }
+		});
+		return {
+			verified: true,
+			...score ? { score } : {},
+			...challengeRecord.sessionId && { sessionId: challengeRecord.sessionId }
+		};
+	}
+	/**
+	* Records a server-verification rejection on the captcha record and, unless
+	* `session` is null, on the linked session.
+	*/
+	async disapproveVerification(challengeRecord, reason, session = {}) {
+		const result = {
+			status: _prosopo_types.CaptchaStatus.disapproved,
+			reason
+		};
+		const isBlocked = (0, _prosopo_types.isBlockingCaptchaResult)(this.captchaType, result);
+		await this.updateRecord(challengeRecord.challenge, {
+			result,
+			...isBlocked && { blocked: true }
+		});
+		if (session && challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+			serverChecked: true,
+			result,
+			...isBlocked && { blocked: true },
+			...session
+		});
+	}
+};
+//#endregion
+exports.InteractiveCaptchaManager = InteractiveCaptchaManager;

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -1,20 +1,21 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
-const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
+const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
-const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
-const require_captchaManager = require("../captchaManager.cjs");
-const require_routingMachine = require("../frictionless/routingMachine.cjs");
 const require_util = require("../../util.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
+const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
+const require_captchaManager = require("../captchaManager.cjs");
+const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
-const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
 const require_powTasksUtils = require("./powTasksUtils.cjs");
+const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
+const require_routingMachine = require("../frictionless/routingMachine.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
-let _prosopo_util = require("@prosopo/util");
-let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _polkadot_util = require("@polkadot/util");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
+let _prosopo_util = require("@prosopo/util");
 //#region src/tasks/powCaptcha/powTasks.ts
 var DEFAULT_POW_DIFFICULTY = 4;
 var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
@@ -209,7 +210,8 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		let routingOutput = this.postPowContext ? await this.runPostPowRouting({
 			challengeRecord,
 			challengeSplit,
-			behavioralDataPacked: decryptedBehavioralDataPacked
+			behavioralDataPacked: decryptedBehavioralDataPacked,
+			coords
 		}) : void 0;
 		if ((escalateForMissingCoords || escalateForIpChange) && routingOutput?.captchaType !== _prosopo_types.CaptchaType.image && routingOutput?.captchaType !== _prosopo_types.CaptchaType.puzzle) routingOutput = {
 			captchaType: _prosopo_types.CaptchaType.image,
@@ -228,7 +230,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	*/
 	async runPostPowRouting(args) {
 		if (!this.postPowContext) return void 0;
-		const { challengeRecord, challengeSplit, behavioralDataPacked } = args;
+		const { challengeRecord, challengeSplit, behavioralDataPacked, coords } = args;
 		if (!challengeRecord.sessionId) {
 			this.logger.debug(() => ({ msg: "Skipping post-pow routing: PoW record has no linked session" }));
 			return;
@@ -259,6 +261,8 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			raw: {
 				...this.postPowContext.raw,
 				...behavioralDataPacked && { behavioralDataPacked },
+				...sessionRecord.mode && { mode: sessionRecord.mode },
+				coordsAllZero: require_powTasksUtils.isCoordsAllZero(coords),
 				...sessionRecord.simdReadings && { simd: sessionRecord.simdReadings },
 				...sessionRecord.currentUrl && { currentUrl: sessionRecord.currentUrl },
 				...sessionRecord.iframeUrl && { iframeUrl: sessionRecord.iframeUrl }
@@ -518,15 +522,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				currentUrl: sessionRecord?.currentUrl,
 				iframeUrl: sessionRecord?.iframeUrl,
 				coords: challengeRecord.coords,
-				synNs: sessionRecord?.synNs,
-				synackNs: sessionRecord?.synackNs,
-				ackNs: sessionRecord?.ackNs,
-				observedTtl: sessionRecord?.observedTtl,
-				tcpMss: sessionRecord?.tcpMss,
-				tcpWscale: sessionRecord?.tcpWscale,
-				tcpOptsFlags: sessionRecord?.tcpOptsFlags,
-				tcpOptsOrder: sessionRecord?.tcpOptsOrder,
-				tcpWindow: sessionRecord?.tcpWindow,
+				...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(sessionRecord),
 				trafficPolicies: require_devicePlatform.deriveTrafficPolicies(trafficFilter)
 			};
 			const decision = await this.decisionMachineRunner.decide(decisionInput, logger);

package/dist/cjs/tasks/powCaptcha/powTasksUtils.cjs

@@ -1,7 +1,7 @@
 let _prosopo_common = require("@prosopo/common");
+let _polkadot_util = require("@polkadot/util");
 let _prosopo_util = require("@prosopo/util");
 let _prosopo_util_crypto = require("@prosopo/util-crypto");
-let _polkadot_util = require("@polkadot/util");
 let _noble_hashes_sha2_js = require("@noble/hashes/sha2.js");
 //#region src/tasks/powCaptcha/powTasksUtils.ts
 var validateSolution = (nonce, challenge, difficulty) => (0, _prosopo_util.hashMeetsDifficulty)((0, _noble_hashes_sha2_js.sha256)(new TextEncoder().encode(nonce + challenge)), difficulty);
@@ -15,6 +15,8 @@ var checkPowSignature = (message, signature, address, signatureType) => {
 		signatureType
 	} });
 };
+var isCoordsAllZero = (coords) => coords !== void 0 && coords.length > 0 && coords.every((group) => group.length > 0 && group.every(([x, y]) => x === 0 && y === 0));
 //#endregion
 exports.checkPowSignature = checkPowSignature;
+exports.isCoordsAllZero = isCoordsAllZero;
 exports.validateSolution = validateSolution;

package/dist/cjs/tasks/puzzle/backgroundBuffer.cjs

@@ -15,12 +15,12 @@ var createPuzzleBackgroundBuffer = (options = {}) => {
 	timer.unref?.();
 	return {
 		take() {
-			const image = ready.pop();
-			if (!image) {
+			const background = ready.pop();
+			if (!background) {
 				starved++;
 				return require_nativeBackground.createBackgroundNative(geometry);
 			}
-			return image;
+			return background;
 		},
 		depth: () => ready.length,
 		starvations: () => starved,

package/dist/cjs/tasks/puzzle/nativeBackground.cjs

@@ -15,15 +15,22 @@ var nativePuzzle = (() => {
 * Byte-identical to `createBackground` from @prosopo/puzzle-assets given the
 * same seed — the JS remains the reference implementation and the contract
 * the differential test pins. Single-use is unchanged and still the caller's
-* responsibility: this mints a fresh CSPRNG seed per call and the seed never
-* leaves the process.
+* responsibility.
+*
+* The seed is returned so the challenge record can keep it and the portal can
+* regenerate this background later. See the secrecy note in prng.ts for where
+* it may and may not go.
 */
 var createBackgroundNative = (geometry = _prosopo_puzzle_assets.DEFAULT_GEOMETRY) => {
 	const { width, height } = geometry;
+	const seed = (0, _prosopo_puzzle_assets.createSeed)();
 	return {
-		data: require_metrics.measureSync("puzzle_background", () => nativePuzzle.generateBackground((0, _prosopo_puzzle_assets.createSeed)(), width, height)),
-		width,
-		height
+		image: {
+			data: require_metrics.measureSync("puzzle_background", () => nativePuzzle.generateBackground(seed, width, height)),
+			width,
+			height
+		},
+		seed
 	};
 };
 //#endregion

package/dist/cjs/tasks/puzzle/puzzleRenderer.cjs

@@ -79,15 +79,16 @@ var isPuzzleRenderAvailable = () => {
 };
 var renderPuzzleImages = async (placement, settings = _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS, pieceSize) => {
 	const background = (require_backgroundBuffer.getPuzzleBackgroundBuffer() ?? require_backgroundBuffer.initPuzzleBackgroundBuffer()).take();
-	if (!background) throw new Error("puzzle renderer: no background available");
-	const rendered = await require_metrics.measureSync("puzzle_render", () => (0, _prosopo_puzzle_assets.renderPuzzle)(background, placement, pieceSize !== void 0 ? {
+	const rendered = await require_metrics.measureSync("puzzle_render", () => (0, _prosopo_puzzle_assets.renderPuzzle)(background.image, placement, pieceSize !== void 0 ? {
 		..._prosopo_puzzle_assets.DEFAULT_GEOMETRY,
 		pieceSize
 	} : _prosopo_puzzle_assets.DEFAULT_GEOMETRY, settings));
 	return {
 		background: (0, _prosopo_puzzle_assets.toDataUri)(rendered.background),
 		piece: (0, _prosopo_puzzle_assets.toDataUri)(rendered.piece),
-		pieceSize: rendered.pieceSize
+		pieceSize: rendered.pieceSize,
+		backgroundSeed: background.seed.toString("hex"),
+		renderSeed: rendered.seed.toString("hex")
 	};
 };
 //#endregion