@prosopo/provider 5.14.0 → 5.16.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2022 PROSOPO LIMITED
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/api/admin/apiToggleMaintenanceModeEndpoint.d.ts

@@ -5,6 +5,10 @@ import type { z } from "zod";
 type ToggleMaintenanceModeBodyType = typeof ToggleMaintenanceModeBody;
 export declare function getMaintenanceMode(): boolean;
 export declare function setMaintenanceMode(enabled: boolean): void;
+export declare function getMaintenanceModeSiteKeys(): string[];
+export declare function setMaintenanceModeForSiteKeys(siteKeys: readonly string[], enabled: boolean): void;
+export declare function clearMaintenanceModeSiteKeys(): void;
+export declare function isSiteKeyInMaintenanceMode(siteKey: string | undefined): boolean;
 declare class ApiToggleMaintenanceModeEndpoint implements ApiEndpoint<ToggleMaintenanceModeBodyType> {
     processRequest(args: z.infer<ToggleMaintenanceModeBodyType>, logger?: Logger): Promise<ApiEndpointResponse>;
     getRequestArgsSchema(): ToggleMaintenanceModeBodyType;

package/dist/api/admin/apiToggleMaintenanceModeEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiToggleMaintenanceModeEndpoint.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiToggleMaintenanceModeEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,KAAK,6BAA6B,GAAG,OAAO,yBAAyB,CAAC;AAMtE,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAOD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEzD;AAED,cAAM,gCACL,YAAW,WAAW,CAAC,6BAA6B,CAAC;IAE/C,cAAc,CACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAC5C,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IAgCxB,oBAAoB,IAAI,6BAA6B;CAG5D;AAED,OAAO,EAAE,gCAAgC,EAAE,CAAC"}
+{"version":3,"file":"apiToggleMaintenanceModeEndpoint.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiToggleMaintenanceModeEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,KAAK,6BAA6B,GAAG,OAAO,yBAAyB,CAAC;AAMtE,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAOD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEzD;AAaD,wBAAgB,0BAA0B,IAAI,MAAM,EAAE,CAErD;AAED,wBAAgB,6BAA6B,CAC5C,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,OAAO,EAAE,OAAO,GACd,IAAI,CAKN;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAYD,wBAAgB,0BAA0B,CACzC,OAAO,EAAE,MAAM,GAAG,SAAS,GACzB,OAAO,CAIT;AAED,cAAM,gCACL,YAAW,WAAW,CAAC,6BAA6B,CAAC;IAE/C,cAAc,CACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAC5C,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IAwDxB,oBAAoB,IAAI,6BAA6B;CAG5D;AAED,OAAO,EAAE,gCAAgC,EAAE,CAAC"}

package/dist/api/admin/apiToggleMaintenanceModeEndpoint.js

@@ -18,11 +18,68 @@ function getMaintenanceMode() {
 function setMaintenanceMode(enabled) {
 	process.env.MAINTENANCE_MODE = enabled ? "true" : "false";
 }
+/**
+* Site keys taken out of scoring individually, rather than putting the whole
+* node into maintenance mode.
+*
+* Same durability as the node-wide flag above: per-process, cleared on restart,
+* and set by calling this endpoint on each node. Deliberately not persisted —
+* a forced-pass state that survives a restart unnoticed is worse than one an
+* operator has to re-apply.
+*/
+var maintenanceModeSiteKeys = /* @__PURE__ */ new Set();
+function getMaintenanceModeSiteKeys() {
+	return [...maintenanceModeSiteKeys];
+}
+function setMaintenanceModeForSiteKeys(siteKeys, enabled) {
+	for (const siteKey of siteKeys) if (enabled) maintenanceModeSiteKeys.add(siteKey);
+	else maintenanceModeSiteKeys.delete(siteKey);
+}
+/**
+* Whether this specific site key is in maintenance mode, node-wide or scoped.
+*
+* Callers MUST pass a site key the request has proven it owns. Maintenance mode
+* forces an approval, so deciding it from an unverified, caller-supplied value
+* — the `prosopo-site-key` header, or a site key read out of a request body
+* before its signature is checked — would let anyone claim maintenance for a
+* key they do not control and collect a free pass. The verify handlers call
+* this only after the dapp signature has been verified.
+*/
+function isSiteKeyInMaintenanceMode(siteKey) {
+	if (getMaintenanceMode()) return true;
+	if (!siteKey) return false;
+	return maintenanceModeSiteKeys.has(siteKey);
+}
 var ApiToggleMaintenanceModeEndpoint = class {
 	async processRequest(args, logger) {
-		const { enabled } = args;
+		const { enabled, siteKeys } = args;
 		logger = logger ? logger.with({}, "admin:maintenance:toggle") : getLogger("info", "provider:admin:maintenance:toggle");
 		const previousMode = getMaintenanceMode();
+		if (siteKeys && siteKeys.length > 0) {
+			logger.info(() => ({
+				data: {
+					enabled,
+					siteKeys
+				},
+				msg: "Toggling maintenance mode for site keys"
+			}));
+			setMaintenanceModeForSiteKeys(siteKeys, enabled);
+			const currentSiteKeys = getMaintenanceModeSiteKeys();
+			logger.info(() => ({
+				data: {
+					siteKeys: currentSiteKeys,
+					maintenanceMode: previousMode
+				},
+				msg: "Maintenance mode site keys updated"
+			}));
+			return {
+				status: ApiEndpointResponseStatus.SUCCESS,
+				data: {
+					maintenanceMode: previousMode,
+					maintenanceModeSiteKeys: currentSiteKeys
+				}
+			};
+		}
 		logger.info(() => ({
 			data: {
 				enabled,
@@ -39,7 +96,10 @@ var ApiToggleMaintenanceModeEndpoint = class {
 		}));
 		return {
 			status: ApiEndpointResponseStatus.SUCCESS,
-			data: { maintenanceMode: currentMode }
+			data: {
+				maintenanceMode: currentMode,
+				maintenanceModeSiteKeys: getMaintenanceModeSiteKeys()
+			}
 		};
 	}
 	getRequestArgsSchema() {
@@ -47,4 +107,4 @@ var ApiToggleMaintenanceModeEndpoint = class {
 	}
 };
 //#endregion
-export { ApiToggleMaintenanceModeEndpoint, getMaintenanceMode, setMaintenanceMode };
+export { ApiToggleMaintenanceModeEndpoint, getMaintenanceMode, getMaintenanceModeSiteKeys, isSiteKeyInMaintenanceMode, setMaintenanceMode, setMaintenanceModeForSiteKeys };

package/dist/api/admin/apiToggleMaintenanceModeEndpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiToggleMaintenanceModeEndpoint.js","sourceRoot":"","sources":["../../../src/api/admin/apiToggleMaintenanceModeEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAe,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAQxD,MAAM,UAAU,kBAAkB;IACjC,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;AAC/D,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IAClD,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED,MAAM,gCAAgC;IAGrC,KAAK,CAAC,cAAc,CACnB,IAA4C,EAC5C,MAAe;QAEf,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAEzB,MAAM,GAAG,MAAM;YACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QAE1D,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;QAE1C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;YACzC,GAAG,EAAE,2BAA2B;SAChC,CAAC,CAAC,CAAC;QAEJ,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAEjC,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;QAEzC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;YAC9B,GAAG,EAAE,0BAA0B;SAC/B,CAAC,CAAC,CAAC;QAEJ,OAAO;YACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;YACzC,IAAI,EAAE;gBACL,eAAe,EAAE,WAAW;aAC5B;SACD,CAAC;IACH,CAAC;IAEM,oBAAoB;QAC1B,OAAO,yBAAyB,CAAC;IAClC,CAAC;CACD;AAED,OAAO,EAAE,gCAAgC,EAAE,CAAC"}
+{"version":3,"file":"apiToggleMaintenanceModeEndpoint.js","sourceRoot":"","sources":["../../../src/api/admin/apiToggleMaintenanceModeEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAe,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAQxD,MAAM,UAAU,kBAAkB;IACjC,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;AAC/D,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IAClD,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAWD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD,MAAM,UAAU,0BAA0B;IACzC,OAAO,CAAC,GAAG,uBAAuB,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,QAA2B,EAC3B,OAAgB;IAEhB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO;YAAE,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;;YAC7C,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC3C,uBAAuB,CAAC,KAAK,EAAE,CAAC;AACjC,CAAC;AAYD,MAAM,UAAU,0BAA0B,CACzC,OAA2B;IAE3B,IAAI,kBAAkB,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,gCAAgC;IAGrC,KAAK,CAAC,cAAc,CACnB,IAA4C,EAC5C,MAAe;QAEf,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAEnC,MAAM,GAAG,MAAM;YACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QAE1D,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;QAK1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAClB,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;gBAC3B,GAAG,EAAE,yCAAyC;aAC9C,CAAC,CAAC,CAAC;YACJ,6BAA6B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,eAAe,GAAG,0BAA0B,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAClB,IAAI,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE;gBAClE,GAAG,EAAE,oCAAoC;aACzC,CAAC,CAAC,CAAC;YACJ,OAAO;gBACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;gBACzC,IAAI,EAAE;oBACL,eAAe,EAAE,YAAY;oBAC7B,uBAAuB,EAAE,eAAe;iBACxC;aACD,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;YACzC,GAAG,EAAE,2BAA2B;SAChC,CAAC,CAAC,CAAC;QAEJ,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAEjC,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;QAEzC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;YAC9B,GAAG,EAAE,0BAA0B;SAC/B,CAAC,CAAC,CAAC;QAEJ,OAAO;YACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;YACzC,IAAI,EAAE;gBACL,eAAe,EAAE,WAAW;gBAC5B,uBAAuB,EAAE,0BAA0B,EAAE;aACrD;SACD,CAAC;IACH,CAAC;IAEM,oBAAoB;QAC1B,OAAO,yBAAyB,CAAC;IAClC,CAAC;CACD;AAED,OAAO,EAAE,gCAAgC,EAAE,CAAC"}

package/dist/api/blacklistRequestInspector.js

@@ -1,10 +1,10 @@
-import { recordBlockedRequest } from "./metrics.js";
 import { getCompositeIpAddress } from "../compositeIpAddress.js";
 import { HardBlockVerdictCache, hardBlockCacheKey } from "./hardBlockVerdictCache.js";
+import { recordBlockedRequest } from "./metrics.js";
 import { ApiPrefix, CaptchaStatus, CaptchaType, FrictionlessReason, ResultReason } from "@prosopo/types";
+import { AccessPolicyType, FilterScopeMatch, HEADER_RULE_MARKER, accessRuleHeaderMatches, classifyBrowser, classifyOs, describeMatchedRule, makeAccessRuleHash, userScopeInput } from "@prosopo/user-access-policy";
 import { randomUUID } from "node:crypto";
 import { captchaPolicySeverity } from "@prosopo/captcha-severity";
-import { AccessPolicyType, FilterScopeMatch, HEADER_RULE_MARKER, accessRuleHeaderMatches, classifyBrowser, classifyOs, describeMatchedRule, makeAccessRuleHash, userScopeInput } from "@prosopo/user-access-policy";
 //#region src/api/blacklistRequestInspector.ts
 var getRequestUserScope = (requestHeaders, ja4, ip, user, headHash, coords, countryCode, asn, webBotAuthAgent) => {
 	const userAgent = requestHeaders["user-agent"] ? requestHeaders["user-agent"].toString() : void 0;

package/dist/api/captcha/getAudioCaptchaChallenge.d.ts

@@ -0,0 +1,5 @@
+import type { ProviderEnvironment } from "@prosopo/types-env";
+import type { AccessRulesStorage } from "@prosopo/user-access-policy";
+declare const _default: (env: ProviderEnvironment, userAccessRulesStorage: AccessRulesStorage) => (req: import("express").Request & import("../../express.js").AugmentedRequest, res: import("express").Response, next: import("express").NextFunction) => Promise<void | import("express").Response<any, Record<string, any>>>;
+export default _default;
+//# sourceMappingURL=getAudioCaptchaChallenge.d.ts.map

package/dist/api/captcha/getAudioCaptchaChallenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAudioCaptchaChallenge.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/getAudioCaptchaChallenge.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;8BAyEhE,mBAAmB,0BACA,kBAAkB;AAF3C,wBAUI"}

package/dist/api/captcha/getAudioCaptchaChallenge.js

@@ -0,0 +1,37 @@
+import { resolveAudioRenderSettings } from "../../tasks/audio/audioRenderer.js";
+import { interactiveChallengeHandler } from "./interactiveCaptchaChallenge.js";
+import { buildAudioMaintenanceResponse } from "./maintenanceModeResponses.js";
+import { ApiParams, CaptchaType } from "@prosopo/types";
+//#region src/api/captcha/getAudioCaptchaChallenge.ts
+var issueAudioChallenge = async ({ tasks, user, dapp, clientSettings, trafficVerdict, provenance }) => {
+	const settings = resolveAudioRenderSettings(clientSettings.settings?.audio, trafficVerdict.kind === "challenge" ? trafficVerdict.audioSettings : void 0);
+	const challenge = tasks.audioCaptchaManager.getAudioCaptchaChallenge(user, dapp, settings);
+	await tasks.db.storeAudioCaptchaRecord(challenge.challenge, {
+		requestedAtTimestamp: challenge.requestedAtTimestamp,
+		userAccount: user,
+		dappAccount: dapp
+	}, challenge.answer, challenge.providerSignature, provenance.ipAddress, provenance.headers, provenance.ja4, provenance.sessionId, provenance.ipInfo);
+	return {
+		logData: {
+			characterCount: challenge.characterCount,
+			durationMs: challenge.durationMs
+		},
+		response: {
+			[ApiParams.status]: "ok",
+			[ApiParams.challenge]: challenge.challenge,
+			[ApiParams.clip]: challenge.clip,
+			[ApiParams.characterCount]: challenge.characterCount,
+			[ApiParams.timestamp]: challenge.requestedAtTimestamp.toString(),
+			[ApiParams.signature]: { [ApiParams.provider]: { [ApiParams.challenge]: challenge.providerSignature } }
+		}
+	};
+};
+var getAudioCaptchaChallenge_default = (env, userAccessRulesStorage) => interactiveChallengeHandler(env, userAccessRulesStorage, {
+	captchaType: CaptchaType.audio,
+	label: "audio",
+	manager: (tasks) => tasks.audioCaptchaManager,
+	maintenanceResponse: buildAudioMaintenanceResponse,
+	issue: issueAudioChallenge
+});
+//#endregion
+export { getAudioCaptchaChallenge_default as default };

package/dist/api/captcha/getAudioCaptchaChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAudioCaptchaChallenge.js","sourceRoot":"","sources":["../../../src/api/captcha/getAudioCaptchaChallenge.ts"],"names":[],"mappings":"AAaA,OAAO,EACN,SAAS,EACT,WAAW,GAEX,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAGN,2BAA2B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,mBAAmB,GAAG,KAAK,EAAE,EAClC,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,cAAc,EACd,cAAc,EACd,UAAU,GACa,EAEtB,EAAE;IACH,MAAM,QAAQ,GAAG,0BAA0B,CAC1C,cAAc,CAAC,QAAQ,EAAE,KAAK,EAC9B,cAAc,CAAC,IAAI,KAAK,WAAW;QAClC,CAAC,CAAC,cAAc,CAAC,aAAa;QAC9B,CAAC,CAAC,SAAS,CACZ,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,mBAAmB,CAAC,wBAAwB,CACnE,IAAI,EACJ,IAAI,EACJ,QAAQ,CACR,CAAC;IAIF,MAAM,KAAK,CAAC,EAAE,CAAC,uBAAuB,CACrC,SAAS,CAAC,SAAS,EACnB;QACC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;KACjB,EACD,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,iBAAiB,EAC3B,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,GAAG,EACd,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,MAAM,CACjB,CAAC;IAEF,OAAO;QACN,OAAO,EAAE;YACR,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,UAAU,EAAE,SAAS,CAAC,UAAU;SAChC;QACD,QAAQ,EAAE;YACT,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI;YACxB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,SAAS;YAC1C,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI;YAChC,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,cAAc;YACpD,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,oBAAoB,CAAC,QAAQ,EAAE;YAChE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;gBACtB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;oBACrB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,iBAAiB;iBAClD;aACD;SACD;KACD,CAAC;AACH,CAAC,CAAC;AAKF,eAAe,CACd,GAAwB,EACxB,sBAA0C,EACzC,EAAE,CACH,2BAA2B,CAAC,GAAG,EAAE,sBAAsB,EAAE;IACxD,WAAW,EAAE,WAAW,CAAC,KAAK;IAC9B,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB;IAC7C,mBAAmB,EAAE,6BAA6B;IAClD,KAAK,EAAE,mBAAmB;CAC1B,CAAC,CAAC"}

package/dist/api/captcha/getFrictionlessCaptchaChallenge/constants.d.ts

@@ -1,9 +1,10 @@
-import { type IFrictionlessThreshold } from "@prosopo/types";
+import { type IFrictionlessThreshold, type IFrictionlessTypes, type IUserSettings } from "@prosopo/types";
 export declare const DEFAULT_FRICTIONLESS_THRESHOLD = 0.5;
 export declare const resolveScoreLadder: (configured: IFrictionlessThreshold | number | undefined) => {
     botThreshold: number;
     botImageThreshold: number;
 };
+export declare const resolveSiteAllowedCaptchaTypes: (settings: Pick<Partial<IUserSettings>, "captchaType" | "frictionlessTypes" | "captchaTypeFeatureFlags">) => IFrictionlessTypes;
 export declare const DECRYPTION_FAILED_IMAGE_ROUNDS = 3;
 export declare const MISSING_TOKEN_IMAGE_ROUNDS = 3;
 export declare const MISSING_HEAD_HASH_IMAGE_ROUNDS = 2;

package/dist/api/captcha/getFrictionlessCaptchaChallenge/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/api/captcha/getFrictionlessCaptchaChallenge/constants.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,sBAAsB,EAG3B,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,8BAA8B,MACR,CAAC;AAOpC,eAAO,MAAM,kBAAkB,eAClB,sBAAsB,GAAG,MAAM,GAAG,SAAS,KACrD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAMnD,CAAC;AAWF,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAOhD,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAM5C,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAQhD,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAUjD,eAAO,MAAM,+BAA+B,SACrC,MAAM,sBACQ,MAAM,EAAE,GAAG,SAAS,KACtC,MAEwE,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/api/captcha/getFrictionlessCaptchaChallenge/constants.ts"],"names":[],"mappings":"AAcA,OAAO,EAEN,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAIlB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,8BAA8B,MACR,CAAC;AAOpC,eAAO,MAAM,kBAAkB,eAClB,sBAAsB,GAAG,MAAM,GAAG,SAAS,KACrD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAMnD,CAAC;AAOF,eAAO,MAAM,8BAA8B,aAChC,IAAI,CACb,OAAO,CAAC,aAAa,CAAC,EACtB,aAAa,GAAG,mBAAmB,GAAG,yBAAyB,CAC/D,KACC,kBAOA,CAAC;AAWJ,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAOhD,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAM5C,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAQhD,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAUjD,eAAO,MAAM,+BAA+B,SACrC,MAAM,sBACQ,MAAM,EAAE,GAAG,SAAS,KACtC,MAEwE,CAAC"}

package/dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js

@@ -1,4 +1,4 @@
-import { resolveFrictionlessThreshold } from "@prosopo/types";
+import { CaptchaType, resolveAllowedCaptchaTypes, resolveFrictionlessThreshold } from "@prosopo/types";
 /**
 * A client record's configured ladder, in the terms the decision machine
 * compares against. Thin rename over `resolveFrictionlessThreshold`, which
@@ -12,6 +12,15 @@ var resolveScoreLadder = (configured) => {
 	};
 };
 /**
+* The types any session minted by /frictionless may be. The owner's
+* `frictionlessTypes` only governs the frictionless flow, so a site pinned to
+* a concrete `captchaType` is held to the feature flags alone.
+*/
+var resolveSiteAllowedCaptchaTypes = (settings) => resolveAllowedCaptchaTypes({
+	captchaTypeFeatureFlags: settings.captchaTypeFeatureFlags,
+	...(!settings.captchaType || settings.captchaType === CaptchaType.frictionless) && { frictionlessTypes: settings.frictionlessTypes }
+});
+/**
 * Size an image challenge by how much was actually found. `base` is the
 * sitekey's ordinary image round count; each triggered signal adds a round,
 * capped by `MAX_DETECTOR_EXTRA_IMAGE_ROUNDS`. A session with nothing
@@ -21,4 +30,4 @@ var resolveScoreLadder = (configured) => {
 */
 var getRoundsFromTriggeredDetectors = (base, triggeredDetectors) => base + Math.min(triggeredDetectors?.length ?? 0, 6);
 //#endregion
-export { getRoundsFromTriggeredDetectors, resolveScoreLadder };
+export { getRoundsFromTriggeredDetectors, resolveScoreLadder, resolveSiteAllowedCaptchaTypes };

package/dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../src/api/captcha/getFrictionlessCaptchaChallenge/constants.ts"],"names":[],"mappings":"AAcA,OAAO,EAEN,kCAAkC,EAClC,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,8BAA8B,GAC1C,kCAAkC,CAAC;AAOpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,UAAuD,EACD,EAAE;IACxD,MAAM,MAAM,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO;QACN,YAAY,EAAE,MAAM,CAAC,2BAA2B;QAChD,iBAAiB,EAAE,MAAM,CAAC,0BAA0B;KACpD,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAOhD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAM5C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAQhD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAUjD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC9C,IAAY,EACZ,kBAAwC,EAC/B,EAAE,CACX,IAAI;IACJ,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE,+BAA+B,CAAC,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../src/api/captcha/getFrictionlessCaptchaChallenge/constants.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,WAAW,EAIX,kCAAkC,EAClC,0BAA0B,EAC1B,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,8BAA8B,GAC1C,kCAAkC,CAAC;AAOpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,UAAuD,EACD,EAAE;IACxD,MAAM,MAAM,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO;QACN,YAAY,EAAE,MAAM,CAAC,2BAA2B;QAChD,iBAAiB,EAAE,MAAM,CAAC,0BAA0B;KACpD,CAAC;AACH,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC7C,QAGC,EACoB,EAAE,CACvB,0BAA0B,CAAC;IAC1B,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;IACzD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;QACzB,QAAQ,CAAC,WAAW,KAAK,WAAW,CAAC,YAAY,CAAC,IAAI;QACtD,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC7C,CAAC;CACF,CAAC,CAAC;AAWJ,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAOhD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAM5C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAQhD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAUjD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC9C,IAAY,EACZ,kBAAwC,EAC/B,EAAE,CACX,IAAI;IACJ,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE,+BAA+B,CAAC,CAAC"}

package/dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js

@@ -1,6 +1,6 @@
 import { recordFrictionlessDecision } from "../../metrics.js";
-import { FrictionlessManager, FrictionlessReason as FrictionlessReason$1 } from "../../../tasks/frictionless/frictionlessTasks.js";
 import { timestampDecayFunction } from "../../../tasks/frictionless/frictionlessTasksUtils.js";
+import { FrictionlessManager, FrictionlessReason as FrictionlessReason$1 } from "../../../tasks/frictionless/frictionlessTasks.js";
 import { hashUserAgent } from "../../../utils/hashUserAgent.js";
 import { attachHoneypot } from "./honeypotResponse.js";
 import { getRoundsFromTriggeredDetectors } from "./constants.js";

package/dist/api/captcha/getFrictionlessCaptchaChallenge/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/api/captcha/getFrictionlessCaptchaChallenge/handler.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;8BAuCtD,mBAAmB,0BACA,kBAAkB,WAGpC,OAAO,GAAG,gBAAgB,OAC1B,QAAQ,QACP,YAAY;AAPpB,wBA43BG"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/api/captcha/getFrictionlessCaptchaChallenge/handler.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;8BAgDtD,mBAAmB,0BACA,kBAAkB,WAGpC,OAAO,GAAG,gBAAgB,OAC1B,QAAQ,QACP,YAAY;AAPpB,wBAm6BG"}

package/dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js

@@ -1,29 +1,32 @@
-import { recordBotScore, recordDetectorTriggered, recordFrictionlessDecision } from "../../metrics.js";
-import { buildDnsEventUrl } from "../../dnsEventUrl.js";
+import { rawTlsSignalsForSession } from "../../rawTlsSignalsMiddleware.js";
 import { getCompositeIpAddress } from "../../../compositeIpAddress.js";
-import { getRequestUserScope, normalizeHeadersForMatching } from "../../blacklistRequestInspector.js";
 import { derivePlatform, deriveTrafficPolicies } from "../../../utils/devicePlatform.js";
+import { recordBotScore, recordDetectorTriggered, recordFrictionlessDecision } from "../../metrics.js";
+import { getRequestUserScope, normalizeHeadersForMatching } from "../../blacklistRequestInspector.js";
+import { isAudioAlternativeEnabled, offersAudioAlternative } from "../../../tasks/audioAlternative.js";
+import { buildDnsEventUrl } from "../../dnsEventUrl.js";
+import { coerceToEnabledCaptchaType } from "../../../tasks/captchaTypeSelection.js";
 import { Tasks } from "../../../tasks/tasks.js";
 import { getMaintenanceMode } from "../../admin/apiToggleMaintenanceModeEndpoint.js";
 import { isReservedTestSiteKey } from "../../testSiteKey.js";
 import { normalizeRequestIp } from "../../../utils/normalizeRequestIp.js";
+import { applyTrafficFilterAtRequestTime, handleFrictionlessTrafficFilter } from "../trafficFilterRequestTime.js";
+import { buildFrictionlessMaintenanceResponse } from "../maintenanceModeResponses.js";
 import { hashUserAgent } from "../../../utils/hashUserAgent.js";
 import { hashUserIp } from "../../../utils/hashUserIp.js";
-import { rawTlsSignalsForSession } from "../../rawTlsSignalsMiddleware.js";
-import { buildFrictionlessMaintenanceResponse } from "../maintenanceModeResponses.js";
-import { applyTrafficFilterAtRequestTime, handleFrictionlessTrafficFilter } from "../trafficFilterRequestTime.js";
 import { attachHoneypot } from "./honeypotResponse.js";
 import { handleAccessPolicy } from "./accessPolicy.js";
-import { resolveScoreLadder } from "./constants.js";
+import { resolveScoreLadder, resolveSiteAllowedCaptchaTypes } from "./constants.js";
 import { runDecisionMachine } from "./decisionMachine.js";
 import { decryptIncomingSimdReadings } from "./decryptSimdReadings.js";
+import { resolveRefreshLineage } from "./refreshLineage.js";
 import { resolveSessionDedup } from "./sessionDedup.js";
 import { runConfiguredCaptchaTypeShortCircuit, runEmptyDetectorPoolPowFallback } from "./shortCircuit.js";
 import { ProsopoApiError } from "@prosopo/common";
 import { ApiParams, CaptchaType, GetFrictionlessCaptchaChallengeRequestBody, ModeEnum } from "@prosopo/types";
+import { AccessPolicyType } from "@prosopo/user-access-policy";
 import { flatten, isProtectDeployment, sanitisePageUrl } from "@prosopo/util";
 import { v4 } from "uuid";
-import { AccessPolicyType } from "@prosopo/user-access-policy";
 import { verifyWebBotAuth } from "@prosopo/web-bot-auth";
 //#region src/api/captcha/getFrictionlessCaptchaChallenge/handler.ts
 var handler_default = (env, userAccessRulesStorage) => async (req, res, next) => {
@@ -38,7 +41,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 				}
 			}));
 		});
-		const { token, headHash, dapp, user, mode, simdReadings, detectorSessionId, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl, clientSessionId } = GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
+		const { token, headHash, dapp, user, mode, simdReadings, detectorSessionId, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl, clientSessionId, refreshOf } = GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
 		const currentUrl = sanitisePageUrl(reportedCurrentUrl);
 		const iframeUrl = sanitisePageUrl(reportedIframeUrl);
 		const isProtect = isProtectDeployment(currentUrl, iframeUrl);
@@ -108,6 +111,10 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			i18n: req.i18n,
 			logger: req.logger
 		}));
+		const audioAlternativeEnabled = isAudioAlternativeEnabled(clientRecord.settings);
+		tasks.frictionlessManager.setAudioAlternativeEnabled(audioAlternativeEnabled);
+		const allowedCaptchaTypes = resolveSiteAllowedCaptchaTypes(clientRecord.settings);
+		tasks.frictionlessManager.setAllowedCaptchaTypes(allowedCaptchaTypes);
 		if (dedup) {
 			const dedupCountryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
 			const dedupAsn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
@@ -144,16 +151,17 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 					...dedupTrafficPolicies && { trafficPolicies: dedupTrafficPolicies }
 				}
 			}) : { captchaType: cachedCaptchaType };
-			const dedupConflictsWithRouting = dedupRouted.captchaType !== cachedCaptchaType;
+			const dedupConflictsWithRouting = coerceToEnabledCaptchaType(dedupRouted.captchaType, allowedCaptchaTypes) !== cachedCaptchaType;
+			const dedupConflictsWithAllowedTypes = coerceToEnabledCaptchaType(cachedCaptchaType, allowedCaptchaTypes) !== cachedCaptchaType;
 			let dedupConflictsWithBundle = false;
 			let dedupIncomingBundleId;
 			if (detectorSessionId && dedup.session.bundleId) {
 				dedupIncomingBundleId = (await tasks.frictionlessManager.resolveBundleByDetectorSession(detectorSessionId))?.bundleId;
 				if (dedupIncomingBundleId !== void 0 && dedupIncomingBundleId !== dedup.session.bundleId) dedupConflictsWithBundle = true;
 			}
-			if (dedupConflictsWithPolicy || dedupConflictsWithRouting) {
+			if (dedupConflictsWithPolicy || dedupConflictsWithRouting || dedupConflictsWithAllowedTypes) {
 				req.logger.info(() => ({
-					msg: "Evicting reused session: cached captchaType conflicts with access policy or routing machine",
+					msg: "Evicting reused session: cached captchaType conflicts with access policy, routing machine or allowed types",
 					data: {
 						userSitekeyIpHash,
 						sessionId: dedup.sessionId,
@@ -162,7 +170,8 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 							policyType: dedupAccessPolicy?.type,
 							policyCaptchaType: dedupAccessPolicy?.captchaType
 						},
-						...dedupConflictsWithRouting && { routedCaptchaType: dedupRouted.captchaType }
+						...dedupConflictsWithRouting && { routedCaptchaType: dedupRouted.captchaType },
+						...dedupConflictsWithAllowedTypes && { allowedCaptchaTypes }
 					}
 				}));
 				await tasks.db.checkAndRemoveSession(dedup.sessionId);
@@ -202,7 +211,8 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 					[ApiParams.captchaType]: dedup.captchaType,
 					[ApiParams.sessionId]: dedup.sessionId,
 					[ApiParams.status]: "ok",
-					dns_url: buildDnsEventUrl(dedup.sessionId)
+					dns_url: buildDnsEventUrl(dedup.sessionId),
+					...offersAudioAlternative(dedup.captchaType, audioAlternativeEnabled) && { audioAlternativeAvailable: true }
 				});
 			}
 		}
@@ -306,6 +316,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			...triggeredDetectors && triggeredDetectors.length > 0 && { triggeredDetectors },
 			...shadowDomPenalty !== void 0 && { shadowDomPenalty }
 		};
+		const refreshLineage = await resolveRefreshLineage(tasks.db, refreshOf, dapp, /* @__PURE__ */ new Date());
 		tasks.frictionlessManager.setSessionParams({
 			token: sessionToken,
 			score: botScore,
@@ -326,6 +337,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			...decodedSimdReadings && { simdReadings: decodedSimdReadings },
 			...d !== void 0 && { d },
 			...clientSessionId && { clientMetaData: { clientSessionId } },
+			...refreshLineage,
 			...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
 			...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs },
 			...rawTlsSignalsForSession(req)
@@ -341,7 +353,6 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			score: botScore,
 			imageMaxRounds: clientRecord.settings.imageMaxRounds,
 			imageMinRounds: clientRecord.settings.imageMinRounds,
-			frictionlessTypes: clientRecord.settings.frictionlessTypes,
 			baseImageRounds: env.config.captchas.solved.count,
 			puzzleMaxDifficulty: clientRecord.settings.puzzleMaxDifficulty,
 			platform: derivePlatform(requestUserAgent, webView, { ...typeof ipInfoMobile === "boolean" && { isMobile: ipInfoMobile } }),