@prosopo/provider 5.14.0 → 5.16.0

package/dist/cjs/api/captcha/interactiveCaptchaSolution.cjs

@@ -0,0 +1,77 @@
+const require_validateAddress = require("../validateAddress.cjs");
+const require_tasks = require("../../tasks/tasks.cjs");
+const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../testSiteKey.cjs");
+const require_requestBodySummary = require("../requestBodySummary.cjs");
+let _prosopo_common = require("@prosopo/common");
+//#region src/api/captcha/interactiveCaptchaSolution.ts
+/** Request handling shared by the solution endpoints of the interactive types. */
+var interactiveSolutionHandler = (env, spec) => async (req, res, next) => {
+	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+		req.logger.info(() => ({ msg: "Maintenance mode active - returning verified" }));
+		return res.json({
+			status: "ok",
+			verified: true
+		});
+	}
+	let parsed;
+	const tasks = new require_tasks.Tasks(env, req.logger);
+	try {
+		parsed = spec.parse(req.body);
+	} catch (err) {
+		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err,
+				body: require_requestBodySummary.summariseRequestBody(req)
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { dapp, user } = parsed;
+	require_validateAddress.validateSiteKey(dapp);
+	require_validateAddress.validateAddr(user);
+	const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
+	if (testVerdict !== null) {
+		const response = {
+			status: "ok",
+			verified: testVerdict
+		};
+		return res.json(response);
+	}
+	try {
+		const clientRecord = await tasks.db.getClientRecord(dapp);
+		if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const submitWindowMs = clientRecord.settings.solutionTimeout ?? clientRecord.settings.verifiedTimeout;
+		const response = {
+			status: "ok",
+			verified: await spec.verify(tasks, parsed, submitWindowMs, req)
+		};
+		return res.json(response);
+	} catch (err) {
+		req.logger.error(() => ({
+			err,
+			body: require_requestBodySummary.summariseRequestBody(req),
+			msg: `Error in ${spec.label} captcha solution submission`
+		}));
+		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 500,
+				siteKey: req.body.dapp,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+};
+//#endregion
+exports.interactiveSolutionHandler = interactiveSolutionHandler;

package/dist/cjs/api/captcha/maintenanceModeResponses.cjs

@@ -1,4 +1,6 @@
+const require_audioRenderer = require("../../tasks/audio/audioRenderer.cjs");
 const require_puzzleRenderer = require("../../tasks/puzzle/puzzleRenderer.cjs");
+const require_iconOrderRenderer = require("../../tasks/iconOrder/iconOrderRenderer.cjs");
 let _prosopo_types = require("@prosopo/types");
 let node_crypto = require("node:crypto");
 //#region src/api/captcha/maintenanceModeResponses.ts
@@ -49,8 +51,35 @@ var buildPuzzleMaintenanceResponse = async (user, dapp) => {
 		[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: "" } }
 	};
 };
+var buildAudioMaintenanceResponse = async (user, dapp) => {
+	const timestamp = Date.now();
+	const rendered = require_audioRenderer.renderAudioClip(require_audioRenderer.resolveAudioRenderSettings());
+	return {
+		[_prosopo_types.ApiParams.status]: "ok",
+		[_prosopo_types.ApiParams.challenge]: buildChallenge(user, dapp),
+		[_prosopo_types.ApiParams.clip]: rendered.clip,
+		[_prosopo_types.ApiParams.characterCount]: rendered.characterCount,
+		[_prosopo_types.ApiParams.timestamp]: timestamp.toString(),
+		[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: "" } }
+	};
+};
+var buildIconOrderMaintenanceResponse = async (user, dapp) => {
+	const timestamp = Date.now();
+	const images = await require_iconOrderRenderer.renderIconOrderImages();
+	return {
+		[_prosopo_types.ApiParams.status]: "ok",
+		[_prosopo_types.ApiParams.challenge]: buildChallenge(user, dapp),
+		[_prosopo_types.ApiParams.background]: images.background,
+		[_prosopo_types.ApiParams.legend]: images.legend,
+		[_prosopo_types.ApiParams.legendIconSize]: images.legendIconSize,
+		[_prosopo_types.ApiParams.timestamp]: timestamp.toString(),
+		[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: "" } }
+	};
+};
 //#endregion
+exports.buildAudioMaintenanceResponse = buildAudioMaintenanceResponse;
 exports.buildFrictionlessMaintenanceResponse = buildFrictionlessMaintenanceResponse;
+exports.buildIconOrderMaintenanceResponse = buildIconOrderMaintenanceResponse;
 exports.buildImageMaintenanceResponse = buildImageMaintenanceResponse;
 exports.buildMaintenanceVerificationResponse = buildMaintenanceVerificationResponse;
 exports.buildPowMaintenanceResponse = buildPowMaintenanceResponse;

package/dist/cjs/api/captcha/submitAudioCaptchaSolution.cjs

@@ -0,0 +1,11 @@
+const require_interactiveCaptchaSolution = require("./interactiveCaptchaSolution.cjs");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+//#region src/api/captcha/submitAudioCaptchaSolution.ts
+var submitAudioCaptchaSolution_default = (env) => require_interactiveCaptchaSolution.interactiveSolutionHandler(env, {
+	label: "audio",
+	parse: (body) => _prosopo_types.SubmitAudioCaptchaSolutionBody.parse(body),
+	verify: (tasks, body, submitWindowMs, req) => tasks.audioCaptchaManager.verifyAudioCaptchaSolution(body.challenge, body.signature.provider.challenge, body.answer, body.replays ?? 0, body.audioEvents ?? [], submitWindowMs, body.signature.user.timestamp, (0, _prosopo_util.getIPAddress)(req.ip || ""), body.behavioralData, body.salt, body.simdReadings, body.clientMetaData)
+});
+//#endregion
+exports.default = submitAudioCaptchaSolution_default;

package/dist/cjs/api/captcha/submitIconOrderCaptchaSolution.cjs

@@ -0,0 +1,11 @@
+const require_interactiveCaptchaSolution = require("./interactiveCaptchaSolution.cjs");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+//#region src/api/captcha/submitIconOrderCaptchaSolution.ts
+var submitIconOrderCaptchaSolution_default = (env) => require_interactiveCaptchaSolution.interactiveSolutionHandler(env, {
+	label: "icon-order",
+	parse: (body) => _prosopo_types.SubmitIconOrderCaptchaSolutionBody.parse(body),
+	verify: (tasks, body, submitWindowMs, req) => tasks.iconOrderCaptchaManager.verifyIconOrderCaptchaSolution(body.challenge, body.signature.provider.challenge, body.clicks, body.iconOrderEvents, submitWindowMs, body.signature.user.timestamp, (0, _prosopo_util.getIPAddress)(req.ip || ""), body.behavioralData, body.salt, body.simdReadings, body.clientMetaData)
+});
+//#endregion
+exports.default = submitIconOrderCaptchaSolution_default;

package/dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs

@@ -1,11 +1,11 @@
+const require_rawTlsSignalsMiddleware = require("../rawTlsSignalsMiddleware.cjs");
+const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_validateAddress = require("../validateAddress.cjs");
 const require_captchaTypeSelection = require("../../tasks/captchaTypeSelection.cjs");
 const require_puzzleDifficulty = require("../../tasks/puzzle/puzzleDifficulty.cjs");
-const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_testSiteKey = require("../testSiteKey.cjs");
-const require_rawTlsSignalsMiddleware = require("../rawTlsSignalsMiddleware.cjs");
 const require_requestBodySummary = require("../requestBodySummary.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
@@ -100,8 +100,9 @@ var submitPoWCaptchaSolution_default = (env) => async (req, res, next) => {
 			chelloToHandshakeUs: req.chelloToHandshakeUs,
 			...require_rawTlsSignalsMiddleware.rawTlsSignalsForSession(req)
 		}, {
-			frictionlessTypes: clientRecord.settings?.frictionlessTypes,
-			imageMaxRounds: clientRecord.settings?.imageMaxRounds
+			allowedCaptchaTypes: (0, _prosopo_types.resolveAllowedCaptchaTypes)(clientRecord.settings),
+			imageMaxRounds: clientRecord.settings?.imageMaxRounds,
+			puzzleMaxDifficulty: clientRecord.settings?.puzzleMaxDifficulty
 		});
 		const response = {
 			status: "ok",
@@ -144,17 +145,19 @@ var buildEscalation = async (tasks, result, challenge, perConnectionSignals, sit
 	const originSession = await tasks.db.getSessionRecordBySessionId(powRecord.sessionId);
 	if (!originSession) return void 0;
 	const routed = result.routingOutput;
-	const escalatedType = require_captchaTypeSelection.coerceToEnabledCaptchaType(routed.captchaType, siteConstraints?.frictionlessTypes);
+	const escalatedType = require_captchaTypeSelection.coerceToEnabledCaptchaType(routed.captchaType, siteConstraints?.allowedCaptchaTypes);
 	if (escalatedType === _prosopo_types.CaptchaType.pow) return void 0;
 	const imageMaxRounds = siteConstraints?.imageMaxRounds ?? _prosopo_types.imageMaxRoundsDefault;
 	const escalationPuzzleOverrides = (() => {
 		if (escalatedType !== _prosopo_types.CaptchaType.puzzle) return void 0;
-		const level = (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(routed.solvedImagesCount ?? originSession.solvedImagesCount, tasks.config.captchas.solved.count);
+		const { isMobile } = require_devicePlatform.derivePlatform(originSession.headers?.["user-agent"] ?? "", originSession.webView);
+		const level = (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(routed.solvedImagesCount ?? originSession.solvedImagesCount, tasks.config.captchas.solved.count, (0, _prosopo_captcha_severity.resolveMaxEscalationLevel)(siteConstraints?.puzzleMaxDifficulty, isMobile));
 		if (level === 0) return void 0;
 		const difficulty = require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken);
 		return {
 			puzzleTolerance: difficulty.tolerance,
-			puzzle: difficulty.puzzle
+			puzzle: difficulty.puzzle,
+			puzzleLevel: difficulty.level
 		};
 	})();
 	const selectionReason = routed.reason ?? originSession.reason;
@@ -185,15 +188,7 @@ var buildEscalation = async (tasks, result, challenge, perConnectionSignals, sit
 		originSessionId: originSession.sessionId,
 		tcpToChelloUs: perConnectionSignals?.tcpToChelloUs,
 		chelloToHandshakeUs: perConnectionSignals?.chelloToHandshakeUs,
-		synNs: perConnectionSignals?.synNs,
-		synackNs: perConnectionSignals?.synackNs,
-		ackNs: perConnectionSignals?.ackNs,
-		observedTtl: perConnectionSignals?.observedTtl,
-		tcpMss: perConnectionSignals?.tcpMss,
-		tcpWscale: perConnectionSignals?.tcpWscale,
-		tcpOptsFlags: perConnectionSignals?.tcpOptsFlags,
-		tcpOptsOrder: perConnectionSignals?.tcpOptsOrder,
-		tcpWindow: perConnectionSignals?.tcpWindow,
+		...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(perConnectionSignals),
 		puzzleTolerance: escalationPuzzleOverrides?.puzzleTolerance,
 		puzzle: escalationPuzzleOverrides?.puzzle,
 		clientMetaData: originSession.clientMetaData

package/dist/cjs/api/captcha/submitPuzzleCaptchaSolution.cjs

@@ -1,78 +1,11 @@
-const require_validateAddress = require("../validateAddress.cjs");
-const require_tasks = require("../../tasks/tasks.cjs");
-const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
-const require_testSiteKey = require("../testSiteKey.cjs");
-const require_requestBodySummary = require("../requestBodySummary.cjs");
-let _prosopo_common = require("@prosopo/common");
+const require_interactiveCaptchaSolution = require("./interactiveCaptchaSolution.cjs");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
 //#region src/api/captcha/submitPuzzleCaptchaSolution.ts
-var submitPuzzleCaptchaSolution_default = (env) => async (req, res, next) => {
-	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
-		req.logger.info(() => ({ msg: "Maintenance mode active - returning verified" }));
-		return res.json({
-			status: "ok",
-			verified: true
-		});
-	}
-	let parsed;
-	const tasks = new require_tasks.Tasks(env, req.logger);
-	try {
-		parsed = _prosopo_types.SubmitPuzzleCaptchaSolutionBody.parse(req.body);
-	} catch (err) {
-		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-			context: {
-				code: 400,
-				error: err,
-				body: require_requestBodySummary.summariseRequestBody(req)
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-	}
-	const { challenge, signature, finalX, finalY, puzzleEvents, dapp, user, behavioralData, salt, simdReadings, clientMetaData } = parsed;
-	require_validateAddress.validateSiteKey(dapp);
-	require_validateAddress.validateAddr(user);
-	const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
-	if (testVerdict !== null) {
-		const response = {
-			status: "ok",
-			verified: testVerdict
-		};
-		return res.json(response);
-	}
-	try {
-		const clientRecord = await tasks.db.getClientRecord(dapp);
-		if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-			context: {
-				code: 400,
-				siteKey: dapp
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-		const submitWindowMs = clientRecord.settings.solutionTimeout ?? clientRecord.settings.verifiedTimeout;
-		const response = {
-			status: "ok",
-			verified: await tasks.puzzleCaptchaManager.verifyPuzzleCaptchaSolution(challenge, signature.provider.challenge, finalX, finalY, puzzleEvents, submitWindowMs, signature.user.timestamp, (0, _prosopo_util.getIPAddress)(req.ip || ""), (0, _prosopo_util.flatten)(req.headers), behavioralData, salt, simdReadings, clientMetaData)
-		};
-		return res.json(response);
-	} catch (err) {
-		req.logger.error(() => ({
-			err,
-			body: require_requestBodySummary.summariseRequestBody(req),
-			msg: "Error in puzzle captcha solution submission"
-		}));
-		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: {
-				code: 500,
-				siteKey: req.body.dapp,
-				error: err
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-	}
-};
+var submitPuzzleCaptchaSolution_default = (env) => require_interactiveCaptchaSolution.interactiveSolutionHandler(env, {
+	label: "puzzle",
+	parse: (body) => _prosopo_types.SubmitPuzzleCaptchaSolutionBody.parse(body),
+	verify: (tasks, body, submitWindowMs, req) => tasks.puzzleCaptchaManager.verifyPuzzleCaptchaSolution(body.challenge, body.signature.provider.challenge, body.finalX, body.finalY, body.puzzleEvents, submitWindowMs, body.signature.user.timestamp, (0, _prosopo_util.getIPAddress)(req.ip || ""), (0, _prosopo_util.flatten)(req.headers), body.behavioralData, body.salt, body.simdReadings, body.clientMetaData)
+});
 //#endregion
 exports.default = submitPuzzleCaptchaSolution_default;

package/dist/cjs/api/captcha/trafficFilterRequestTime.cjs

@@ -41,6 +41,9 @@ var applyTrafficFilterAtRequestTime = (ipInfo, trafficFilter, logger) => {
 		puzzleTolerance: resolved.puzzleTolerance,
 		padBytes,
 		puzzleSettings: resolved.puzzleSettings,
+		audioSettings: resolved.audioSettings,
+		iconOrderTolerance: resolved.iconOrderTolerance,
+		iconOrderSettings: resolved.iconOrderSettings,
 		sourceCategories: resolved.sourceCategories
 	};
 };

package/dist/cjs/api/captcha.cjs

@@ -2,10 +2,14 @@ const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_tarpitPadding = require("../utils/tarpitPadding.cjs");
 const require_assignDetectorBundle = require("./captcha/assignDetectorBundle.cjs");
 const require_checkSpamEmail = require("./captcha/checkSpamEmail.cjs");
+const require_getAudioCaptchaChallenge = require("./captcha/getAudioCaptchaChallenge.cjs");
 const require_handler = require("./captcha/getFrictionlessCaptchaChallenge/handler.cjs");
+const require_getIconOrderCaptchaChallenge = require("./captcha/getIconOrderCaptchaChallenge.cjs");
 const require_getImageCaptchaChallenge = require("./captcha/getImageCaptchaChallenge.cjs");
 const require_getPoWCaptchaChallenge = require("./captcha/getPoWCaptchaChallenge.cjs");
 const require_getPuzzleCaptchaChallenge = require("./captcha/getPuzzleCaptchaChallenge.cjs");
+const require_submitAudioCaptchaSolution = require("./captcha/submitAudioCaptchaSolution.cjs");
+const require_submitIconOrderCaptchaSolution = require("./captcha/submitIconOrderCaptchaSolution.cjs");
 const require_submitImageCaptchaSolution = require("./captcha/submitImageCaptchaSolution.cjs");
 const require_submitPoWCaptchaSolution = require("./captcha/submitPoWCaptchaSolution.cjs");
 const require_submitPuzzleCaptchaSolution = require("./captcha/submitPuzzleCaptchaSolution.cjs");
@@ -80,6 +84,10 @@ function prosopoRouter(env) {
 	* Verifies a user's Puzzle solution as being approved or not
 	*/
 	router.post(_prosopo_types.ClientApiPaths.SubmitPuzzleCaptchaSolution, asyncHandler(require_submitPuzzleCaptchaSolution.default(env)));
+	router.post(_prosopo_types.ClientApiPaths.GetAudioCaptchaChallenge, asyncHandler(require_getAudioCaptchaChallenge.default(env, userAccessRulesStorage)));
+	router.post(_prosopo_types.ClientApiPaths.SubmitAudioCaptchaSolution, asyncHandler(require_submitAudioCaptchaSolution.default(env)));
+	router.post(_prosopo_types.ClientApiPaths.GetIconOrderCaptchaChallenge, asyncHandler(require_getIconOrderCaptchaChallenge.default(env, userAccessRulesStorage)));
+	router.post(_prosopo_types.ClientApiPaths.SubmitIconOrderCaptchaSolution, asyncHandler(require_submitIconOrderCaptchaSolution.default(env)));
 	/**
 	* Checks if an email domain is spam
 	*/

package/dist/cjs/api/domainMiddleware.cjs

@@ -4,9 +4,9 @@ const require_apiToggleMaintenanceModeEndpoint = require("./admin/apiToggleMaint
 const require_testSiteKey = require("./testSiteKey.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_util = require("@prosopo/util");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let _prosopo_util_crypto = require("@prosopo/util-crypto");
 let zod = require("zod");
-let _prosopo_api_express_router = require("@prosopo/api-express-router");
 //#region src/api/domainMiddleware.ts
 var domainMiddleware = (env) => {
 	let cachedTasks;

package/dist/cjs/api/ja4Middleware.cjs

@@ -1,7 +1,7 @@
 const require_ja4 = require("./ja4.cjs");
 let _prosopo_logger = require("@prosopo/logger");
-let _prosopo_util_crypto = require("@prosopo/util-crypto");
 let _prosopo_api_express_router = require("@prosopo/api-express-router");
+let _prosopo_util_crypto = require("@prosopo/util-crypto");
 //#region src/api/ja4Middleware.ts
 var DEFAULT_JA4 = "ja4";
 var getJA4 = async (headers, logger) => {

package/dist/cjs/api/rawTlsSignalsMiddleware.cjs

@@ -7,9 +7,44 @@ var HEADER_ACK_NS = "x-tls-ack-ns";
 var HEADER_OBSERVED_TTL = "x-tls-observed-ttl";
 var HEADER_TCP_MSS = "x-tls-tcp-mss";
 var HEADER_TCP_WSCALE = "x-tls-tcp-wscale";
+var HEADER_TCP_WINDOW = "x-tls-tcp-window";
+var HEADER_TCP_OPTS_KINDS = "x-tls-tcp-opts-kinds";
+var HEADER_TCP_OPTS_PRESENT = "x-tls-tcp-opts-present";
+var HEADER_TCP_OPTS_COUNT = "x-tls-tcp-opts-count";
+var HEADER_TCP_TSVAL = "x-tls-tcp-tsval";
+var HEADER_TCP_TSECR = "x-tls-tcp-tsecr";
+var HEADER_TCP_FLAGS = "x-tls-tcp-flags";
+var HEADER_TCP_DATA_OFFSET_RESV = "x-tls-tcp-data-offset-resv";
+var HEADER_TCP_URG_PTR = "x-tls-tcp-urg-ptr";
+var HEADER_IP_IDENT = "x-tls-ip-ident";
+var HEADER_IP_TOTAL_LEN = "x-tls-ip-total-len";
+var HEADER_IP_FRAG_FLAGS = "x-tls-ip-frag-flags";
+var HEADER_IP_TOS = "x-tls-ip-tos";
 var HEADER_TCP_OPTS_FLAGS = "x-tls-tcp-opts-flags";
 var HEADER_TCP_OPTS_ORDER = "x-tls-tcp-opts-order";
-var HEADER_TCP_WINDOW = "x-tls-tcp-window";
+var RAW_TLS_SIGNAL_KEYS = [
+	"synNs",
+	"synackNs",
+	"ackNs",
+	"observedTtl",
+	"tcpMss",
+	"tcpWscale",
+	"tcpWindow",
+	"tcpOptsKinds",
+	"tcpOptsPresent",
+	"tcpOptsCount",
+	"tcpTsval",
+	"tcpTsecr",
+	"tcpFlags",
+	"tcpDataOffsetResv",
+	"tcpUrgPtr",
+	"ipIdent",
+	"ipTotalLen",
+	"ipFragFlags",
+	"ipTos",
+	"tcpOptsFlags",
+	"tcpOptsOrder"
+];
 var parseIntHeader = (raw, logger, headerName, max) => {
 	if (raw === void 0) return;
 	const value = Array.isArray(raw) ? raw[0] : raw;
@@ -31,6 +66,46 @@ var MAX_NS = 2 ** 63;
 var MAX_U8 = 255;
 var MAX_U16 = 65535;
 var MAX_U32 = 4294967295;
+var OPTS_KINDS_SLOTS = 8;
+var MAX_U64 = (1n << 64n) - 1n;
+var parseOptsKindsHeader = (raw, logger) => {
+	if (raw === void 0) return;
+	const value = Array.isArray(raw) ? raw[0] : raw;
+	if (value === void 0 || !/^\d+$/.test(value)) {
+		if (value !== void 0) logger.debug(() => ({
+			msg: "Ignoring malformed raw TLS signal header",
+			data: {
+				header: HEADER_TCP_OPTS_KINDS,
+				raw: value
+			}
+		}));
+		return;
+	}
+	let packed;
+	try {
+		packed = BigInt(value);
+	} catch {
+		return;
+	}
+	if (packed > MAX_U64) {
+		logger.debug(() => ({
+			msg: "Ignoring out-of-range raw TLS signal header",
+			data: {
+				header: HEADER_TCP_OPTS_KINDS,
+				raw: value
+			}
+		}));
+		return;
+	}
+	if (packed === 0n) return;
+	const kinds = [];
+	for (let slot = 0; slot < OPTS_KINDS_SLOTS; slot++) {
+		const kind = Number(packed >> BigInt(slot * 8) & 255n);
+		if (kind === 0) break;
+		kinds.push(kind);
+	}
+	return kinds.length > 0 ? kinds : void 0;
+};
 var getRawTlsSignals = (headers, logger) => {
 	const log = logger ?? (0, _prosopo_logger.getLogger)("info", "provider:raw-tls-signals");
 	return {
@@ -40,37 +115,50 @@ var getRawTlsSignals = (headers, logger) => {
 		observedTtl: parseIntHeader(headers[HEADER_OBSERVED_TTL], log, HEADER_OBSERVED_TTL, MAX_U8),
 		tcpMss: parseIntHeader(headers[HEADER_TCP_MSS], log, HEADER_TCP_MSS, MAX_U16),
 		tcpWscale: parseIntHeader(headers[HEADER_TCP_WSCALE], log, HEADER_TCP_WSCALE, MAX_U8),
+		tcpWindow: parseIntHeader(headers[HEADER_TCP_WINDOW], log, HEADER_TCP_WINDOW, MAX_U16),
+		tcpOptsKinds: parseOptsKindsHeader(headers[HEADER_TCP_OPTS_KINDS], log),
+		tcpOptsPresent: parseIntHeader(headers[HEADER_TCP_OPTS_PRESENT], log, HEADER_TCP_OPTS_PRESENT, MAX_U16),
+		tcpOptsCount: parseIntHeader(headers[HEADER_TCP_OPTS_COUNT], log, HEADER_TCP_OPTS_COUNT, MAX_U8),
+		tcpTsval: parseIntHeader(headers[HEADER_TCP_TSVAL], log, HEADER_TCP_TSVAL, MAX_U32),
+		tcpTsecr: parseIntHeader(headers[HEADER_TCP_TSECR], log, HEADER_TCP_TSECR, MAX_U32),
+		tcpFlags: parseIntHeader(headers[HEADER_TCP_FLAGS], log, HEADER_TCP_FLAGS, MAX_U8),
+		tcpDataOffsetResv: parseIntHeader(headers[HEADER_TCP_DATA_OFFSET_RESV], log, HEADER_TCP_DATA_OFFSET_RESV, MAX_U8),
+		tcpUrgPtr: parseIntHeader(headers[HEADER_TCP_URG_PTR], log, HEADER_TCP_URG_PTR, MAX_U16),
+		ipIdent: parseIntHeader(headers[HEADER_IP_IDENT], log, HEADER_IP_IDENT, MAX_U16),
+		ipTotalLen: parseIntHeader(headers[HEADER_IP_TOTAL_LEN], log, HEADER_IP_TOTAL_LEN, MAX_U16),
+		ipFragFlags: parseIntHeader(headers[HEADER_IP_FRAG_FLAGS], log, HEADER_IP_FRAG_FLAGS, MAX_U16),
+		ipTos: parseIntHeader(headers[HEADER_IP_TOS], log, HEADER_IP_TOS, MAX_U8),
 		tcpOptsFlags: parseIntHeader(headers[HEADER_TCP_OPTS_FLAGS], log, HEADER_TCP_OPTS_FLAGS, MAX_U8),
-		tcpOptsOrder: parseIntHeader(headers[HEADER_TCP_OPTS_ORDER], log, HEADER_TCP_OPTS_ORDER, MAX_U32),
-		tcpWindow: parseIntHeader(headers[HEADER_TCP_WINDOW], log, HEADER_TCP_WINDOW, MAX_U16)
+		tcpOptsOrder: parseIntHeader(headers[HEADER_TCP_OPTS_ORDER], log, HEADER_TCP_OPTS_ORDER, MAX_U32)
 	};
 };
-var rawTlsSignalsForSession = (req) => {
+var rawTlsSignalsForSession = (req) => rawTlsSignalsFromRecord(req);
+/**
+* Pull the raw TLS signals out of a persisted Session — or anything shaped
+* like one — for a decision machine's `raw` bag, or to carry forward onto a
+* new Session record.
+*
+* Six call sites used to name every field by hand, so adding one to the
+* probe meant remembering six places; the fields that were forgotten read as
+* `undefined` and the rules gating on them silently never fired.
+*/
+var rawTlsSignalsFromRecord = (record) => {
 	const out = {};
-	if (req.synNs !== void 0) out.synNs = req.synNs;
-	if (req.synackNs !== void 0) out.synackNs = req.synackNs;
-	if (req.ackNs !== void 0) out.ackNs = req.ackNs;
-	if (req.observedTtl !== void 0) out.observedTtl = req.observedTtl;
-	if (req.tcpMss !== void 0) out.tcpMss = req.tcpMss;
-	if (req.tcpWscale !== void 0) out.tcpWscale = req.tcpWscale;
-	if (req.tcpOptsFlags !== void 0) out.tcpOptsFlags = req.tcpOptsFlags;
-	if (req.tcpOptsOrder !== void 0) out.tcpOptsOrder = req.tcpOptsOrder;
-	if (req.tcpWindow !== void 0) out.tcpWindow = req.tcpWindow;
+	if (!record) return out;
+	for (const key of RAW_TLS_SIGNAL_KEYS) {
+		const value = record[key];
+		if (value !== void 0) Object.assign(out, { [key]: value });
+	}
 	return out;
 };
 var rawTlsSignalsMiddleware = (env) => {
 	return async (req, res, next) => {
 		try {
 			const signals = getRawTlsSignals(req.headers, req.logger);
-			if (signals.synNs !== void 0) req.synNs = signals.synNs;
-			if (signals.synackNs !== void 0) req.synackNs = signals.synackNs;
-			if (signals.ackNs !== void 0) req.ackNs = signals.ackNs;
-			if (signals.observedTtl !== void 0) req.observedTtl = signals.observedTtl;
-			if (signals.tcpMss !== void 0) req.tcpMss = signals.tcpMss;
-			if (signals.tcpWscale !== void 0) req.tcpWscale = signals.tcpWscale;
-			if (signals.tcpOptsFlags !== void 0) req.tcpOptsFlags = signals.tcpOptsFlags;
-			if (signals.tcpOptsOrder !== void 0) req.tcpOptsOrder = signals.tcpOptsOrder;
-			if (signals.tcpWindow !== void 0) req.tcpWindow = signals.tcpWindow;
+			for (const key of RAW_TLS_SIGNAL_KEYS) {
+				const value = signals[key];
+				if (value !== void 0) Object.assign(req, { [key]: value });
+			}
 			if (Object.values(signals).some((v) => v !== void 0)) req.logger = req.logger.with(signals, "rawTlsSignals");
 			next();
 		} catch (err) {
@@ -81,4 +169,5 @@ var rawTlsSignalsMiddleware = (env) => {
 //#endregion
 exports.getRawTlsSignals = getRawTlsSignals;
 exports.rawTlsSignalsForSession = rawTlsSignalsForSession;
+exports.rawTlsSignalsFromRecord = rawTlsSignalsFromRecord;
 exports.rawTlsSignalsMiddleware = rawTlsSignalsMiddleware;

package/dist/cjs/api/startProviderApi.cjs

@@ -1,9 +1,9 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_rawTlsSignalsMiddleware = require("./rawTlsSignalsMiddleware.cjs");
 const require_metrics = require("./metrics.cjs");
 const require_blacklistRequestInspector = require("./blacklistRequestInspector.cjs");
 const require_bundlePool = require("../tasks/detection/bundlePool.cjs");
 const require_block = require("./block.cjs");
-const require_rawTlsSignalsMiddleware = require("./rawTlsSignalsMiddleware.cjs");
 const require_captcha = require("./captcha.cjs");
 const require_verify = require("./verify.cjs");
 const require_ja4Middleware = require("./ja4Middleware.cjs");
@@ -20,13 +20,13 @@ const require_ipInfoMiddleware = require("./ipInfoMiddleware.cjs");
 const require_robotsMiddleware = require("./robotsMiddleware.cjs");
 let _prosopo_logger = require("@prosopo/logger");
 let _prosopo_types = require("@prosopo/types");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let node_fs = require("node:fs");
 node_fs = require_runtime.__toESM(node_fs, 1);
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path, 1);
 let node_https = require("node:https");
 node_https = require_runtime.__toESM(node_https, 1);
-let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let express = require("express");
 express = require_runtime.__toESM(express, 1);
 let node_url = require("node:url");