@prosopo/provider 5.15.0 → 5.16.0

package/dist/cjs/tasks/interactiveCaptcha/interactiveCaptchaManager.cjs

@@ -0,0 +1,423 @@
+const require_usageCounters = require("../../util/usageCounters.cjs");
+const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
+const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+const require_util = require("../../util.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
+const require_devicePlatform = require("../../utils/devicePlatform.cjs");
+const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
+const require_captchaManager = require("../captchaManager.cjs");
+const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
+const require_powTasksUtils = require("../powCaptcha/powTasksUtils.cjs");
+const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_types = require("@prosopo/types");
+let _polkadot_util = require("@polkadot/util");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
+let _prosopo_util = require("@prosopo/util");
+//#region src/tasks/interactiveCaptcha/interactiveCaptchaManager.ts
+/**
+* Shared pipeline for the captcha types a human solves on screen (puzzle,
+* icon-order). Subclasses supply the record accessors and grading; minting,
+* submission bookkeeping and server verification live here.
+*/
+var InteractiveCaptchaManager = class extends require_captchaManager.CaptchaManager {
+	constructor(db, pair, config, logger, usageCounters) {
+		super(db, pair, config, logger);
+		this.POW_SEPARATOR = _prosopo_types.POW_SEPARATOR;
+		this.decisionMachineRunner = new require_decisionMachineRunner.DecisionMachineRunner(db);
+		this.usageCounters = usageCounters ?? null;
+	}
+	mintChallenge(userAccount, dappAccount) {
+		const requestedAtTimestamp = Date.now();
+		const challenge = `${requestedAtTimestamp}___${userAccount}___${dappAccount}___${Math.floor(Math.random() * 1e6)}`;
+		return {
+			challenge,
+			providerSignature: (0, _polkadot_util.u8aToHex)(this.pair.sign((0, _polkadot_util.stringToHex)(challenge))),
+			requestedAtTimestamp
+		};
+	}
+	/**
+	* Grades a user's submission and records the outcome on the captcha and
+	* session records. Returns whether the solution was correct.
+	*/
+	async submitInteractiveCaptchaSolution(submission) {
+		const { challenge, userTimestampSignature, behavioralData, simdReadings } = submission;
+		require_powTasksUtils.checkPowSignature(challenge, submission.providerChallengeSignature, this.pair.address, _prosopo_types.ApiParams.challenge);
+		const challengeSplit = challenge.split(this.POW_SEPARATOR);
+		const timestamp = Number.parseInt((0, _prosopo_util.at)(challengeSplit, 0));
+		const userAccount = (0, _prosopo_util.at)(challengeSplit, 1);
+		require_powTasksUtils.checkPowSignature(timestamp.toString(), userTimestampSignature, userAccount, _prosopo_types.ApiParams.timestamp);
+		const challengeRecord = await this.getRecordByChallenge(challenge);
+		if (!challengeRecord) {
+			this.logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
+			return false;
+		}
+		const { coords, saltDecodeError } = this.decodeSaltCoords(submission.salt);
+		if (!await this.claimSubmission(challengeRecord)) {
+			this.logger.debug(() => ({ msg: `Challenge already submitted: ${challenge}` }));
+			return false;
+		}
+		if (saltDecodeError) {
+			await this.recordSubmissionResult(challengeRecord, {
+				status: _prosopo_types.CaptchaStatus.disapproved,
+				reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_SALT
+			}, userTimestampSignature, void 0);
+			return false;
+		}
+		if (!(0, _prosopo_util.verifyRecency)(challenge, submission.timeout)) {
+			await this.recordSubmissionResult(challengeRecord, {
+				status: _prosopo_types.CaptchaStatus.disapproved,
+				reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_TIMESTAMP
+			}, userTimestampSignature, coords);
+			return false;
+		}
+		const correct = submission.isCorrect(challengeRecord);
+		const result = correct ? { status: _prosopo_types.CaptchaStatus.approved } : {
+			status: _prosopo_types.CaptchaStatus.disapproved,
+			reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_SOLUTION
+		};
+		if (correct && this.usageCounters) this.usageCounters.incrManyAsync((0, _prosopo_util.at)(challengeSplit, 2), require_usageCounters.buildAllWindowIncrements("solved", this.captchaType, submission.ipAddress.address, userAccount));
+		await submission.persistInteraction();
+		const decodedPayloads = await this.decodeSubmissionPayloads(challengeRecord.sessionId, {
+			behavioural: behavioralData,
+			simd: simdReadings
+		});
+		if (behavioralData) try {
+			const decryptedData = decodedPayloads.behavioural;
+			if (decryptedData) {
+				this.logger?.info(() => ({
+					msg: "Behavioral analysis completed",
+					data: {
+						userAccount,
+						dappAccount: (0, _prosopo_util.at)(challengeSplit, 2),
+						challenge,
+						mouseEventsCount: decryptedData.collector1?.length || 0,
+						touchEventsCount: decryptedData.collector2?.length || 0,
+						clickEventsCount: decryptedData.collector3?.length || 0,
+						scrollEventsCount: decryptedData.collector4?.length || 0,
+						deviceCapability: decryptedData.deviceCapability,
+						captchaResult: correct ? "passed" : "failed"
+					}
+				}));
+				const packedData = {
+					c1: decryptedData.collector1 || [],
+					c2: decryptedData.collector2 || [],
+					c3: decryptedData.collector3 || [],
+					c4: decryptedData.collector4 || [],
+					d: decryptedData.deviceCapability
+				};
+				await this.updateRecord(challenge, {
+					behavioralDataPacked: packedData,
+					deviceCapability: decryptedData.deviceCapability
+				});
+			}
+		} catch (error) {
+			this.logger?.error(() => ({
+				msg: "Failed to process behavioral data",
+				err: error
+			}));
+		}
+		const storedClientMetaData = require_clientMetaData.toStoredClientMetaData(submission.clientMetaData);
+		if (storedClientMetaData) await this.updateRecord(challenge, { clientMetaData: storedClientMetaData });
+		await this.recordSubmissionResult(challengeRecord, result, userTimestampSignature, coords, storedClientMetaData);
+		if (challengeRecord.sessionId && decodedPayloads.simd) await this.recordSessionSimdReadingsIfAbsentWithCache(challengeRecord.sessionId, decodedPayloads.simd, _prosopo_types.SimdReadingsStage.submit);
+		return correct;
+	}
+	/** Invalid salt disapproves the submission rather than being ignored. */
+	decodeSaltCoords(salt) {
+		if (!salt) return {};
+		try {
+			const extractedData = (0, _prosopo_util.extractData)(salt);
+			if (extractedData.length < 2) return {};
+			const coords = [[[extractedData[0], extractedData[1]]]];
+			(0, _prosopo_util.assertCoordsSafe)(coords, "coords");
+			return { coords };
+		} catch (error) {
+			this.logger.warn(() => ({
+				msg: "Failed to extract coordinates from salt",
+				error,
+				salt
+			}));
+			return { saltDecodeError: error };
+		}
+	}
+	async recordSubmissionResult(challengeRecord, result, userSignature, coords, clientMetaData) {
+		await this.updateSubmissionResult(challengeRecord.challenge, result, userSignature, coords);
+		if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+			userSubmitted: true,
+			result,
+			...(0, _prosopo_types.isBlockingCaptchaResult)(this.captchaType, result) && { blocked: true },
+			...clientMetaData && { clientMetaData }
+		});
+	}
+	/**
+	* The post-solve gate the site's server calls: decides whether the token
+	* the widget was given is honoured.
+	*
+	* @param dappAccount - the dapp that is requesting the captcha
+	* @param challenge - the challenge string
+	* @param timeout - milliseconds allowed between submit and verify
+	* @param env - provider environment
+	* @param ip - optional IP address for validation
+	* @param userAccessRulesStorage - storage for querying user access policies
+	* @param email
+	* @param spamEmailDomainCheckingEnabled
+	* @param spamFilter
+	* @param trafficFilter
+	* @param storeMetadata - when true, persists the dapp-server-provided
+	*   `email` on the captcha record for spam-rate analysis.
+	* @param clientSessionId - the session id the site rendered the widget
+	*   with. When supplied, the solve must carry the same value in its
+	*   `clientMetaData` or it is disapproved.
+	*/
+	async serverVerifyInteractiveCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId) {
+		const notVerifiedResponse = { verified: false };
+		const logger = this.logger.with({
+			challenge,
+			dappAccount
+		});
+		const challengeRecord = await this.getRecordByChallenge(challenge);
+		if (!challengeRecord) {
+			logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
+			return notVerifiedResponse;
+		}
+		notVerifiedResponse.sessionId = challengeRecord.sessionId;
+		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoApiError("CAPTCHA.INVALID_SOLUTION", { context: {
+			code: 400,
+			failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
+			challenge
+		} });
+		if (challengeRecord.serverChecked) return notVerifiedResponse;
+		const challengeDappAccount = challengeRecord.dappAccount;
+		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
+			failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
+			dappAccount,
+			challengeDappAccount
+		} });
+		if (!await this.markRecordChecked(challengeRecord.challenge)) return notVerifiedResponse;
+		const submittedAt = challengeRecord.submittedAtTimestamp;
+		if ((submittedAt instanceof Date ? Date.now() - submittedAt.getTime() : Number.POSITIVE_INFINITY) > timeout) {
+			await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.TIMESTAMP_TOO_OLD);
+			return notVerifiedResponse;
+		}
+		if (require_clientMetaData.isClientSessionMismatch(clientSessionId, challengeRecord.clientMetaData?.clientSessionId)) {
+			logger.info(() => ({
+				msg: `Client session mismatch in server ${this.logLabel} verification`,
+				data: { hasRecordedClientSessionId: Boolean(challengeRecord.clientMetaData?.clientSessionId) }
+			}));
+			await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.CLIENT_SESSION_MISMATCH);
+			return notVerifiedResponse;
+		}
+		if (userAccessRulesStorage) try {
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
+			if (blockPolicy) {
+				logger.info(() => ({
+					msg: `User blocked by access policy in server ${this.logLabel} verification`,
+					data: {
+						userAccount: challengeRecord.userAccount,
+						policy: blockPolicy
+					}
+				}));
+				await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK, { matchedRule: (0, _prosopo_user_access_policy.describeMatchedRule)(blockPolicy) });
+				return notVerifiedResponse;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: `Failed to check user access policies in server ${this.logLabel} verification`,
+				error
+			}));
+		}
+		if (email && spamEmailDomainCheckingEnabled) try {
+			if (await this.checkSpamEmail(email)) {
+				const emailDomain = email.split("@")[1] || "unknown";
+				logger.info(() => ({
+					msg: `Spam email domain detected in server ${this.logLabel} verification`,
+					data: { emailDomain }
+				}));
+				await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.SPAM_EMAIL_DOMAIN, null);
+				return notVerifiedResponse;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: `Failed to check spam email domain in server ${this.logLabel} verification`,
+				error
+			}));
+		}
+		const maxEmailSubmissionCount = spamFilter?.enabled && spamFilter.emailRules?.enabled ? spamFilter.emailRules.maxEmailSubmissionCount : void 0;
+		let emailNormalised;
+		if (maxEmailSubmissionCount !== void 0 && email && storeMetadata) {
+			emailNormalised = require_evaluateEmailSpamRules.normaliseEmailForMatching(email);
+			if (emailNormalised) try {
+				const priorCount = await this.db.countCommitmentsByNormalisedEmail(dappAccount, emailNormalised);
+				if (priorCount >= maxEmailSubmissionCount) {
+					logger.info(() => ({
+						msg: `Email submission count exceeded in server ${this.logLabel} verification`,
+						data: {
+							priorCount,
+							maxEmailSubmissionCount
+						}
+					}));
+					await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.SPAM_EMAIL_COUNT_EXCEEDED, null);
+					return notVerifiedResponse;
+				}
+			} catch (error) {
+				logger.warn(() => ({
+					msg: `Failed to check email submission count in server ${this.logLabel} verification`,
+					error
+				}));
+			}
+		}
+		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
+		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
+		{
+			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			if (check.isBlocked) {
+				logger.info(() => ({
+					msg: `Traffic filter rejected request in ${this.logLabel} verification`,
+					data: {
+						ip,
+						reason: check.reason,
+						dnsPeerIp: enrichedDnsEvent?.peerIp,
+						dnsResolverIp: enrichedDnsEvent?.resolverIp,
+						dnsPeerAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
+						dnsResolverAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo),
+						dnsPathValid: enrichedDnsEvent?.pathValid
+					}
+				}));
+				await this.disapproveVerification(challengeRecord, check.reason);
+				return notVerifiedResponse;
+			}
+		}
+		if (storeMetadata && email) await this.updateRecord(challengeRecord.challenge, { metadata: {
+			email,
+			emailNormalised: emailNormalised ?? require_evaluateEmailSpamRules.normaliseEmailForMatching(email)
+		} });
+		if (ip) {
+			const challengeIpAddress = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
+			const ipValidationRules = (await this.db.getClientRecord(dappAccount))?.settings?.ipValidationRules;
+			await this.updateRecord(challengeRecord.challenge, { providedIp: require_compositeIpAddress.getCompositeIpAddress(ip) });
+			if (ipValidationRules?.enabled === true) {
+				const ipValidation = await require_util.deepValidateIpAddress(ip, challengeIpAddress, logger, env.ipInfoService, ipValidationRules, enrichedDnsEvent?.peerIp);
+				if (!ipValidation.isValid) {
+					logger.error(() => ({
+						msg: `IP validation failed for ${this.logLabel} captcha`,
+						data: {
+							ip,
+							challengeIp: challengeIpAddress.address,
+							error: ipValidation.errorMessage,
+							distanceKm: ipValidation.distanceKm
+						}
+					}));
+					await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.FAILED_IP_VALIDATION);
+					return notVerifiedResponse;
+				}
+			}
+		}
+		let score;
+		if (sessionRecord) {
+			const dnsAsymmetry = require_enrichDnsEvent.computeDnsAsymmetry(enrichedDnsEvent, challengeRecord.ipInfo, trafficFilter);
+			if (dnsAsymmetry > 0) sessionRecord.scoreComponents = {
+				...sessionRecord.scoreComponents,
+				dnsAsymmetry
+			};
+			score = require_frictionlessTasksUtils.computeFrictionlessScore(sessionRecord?.scoreComponents);
+			logger.info(() => ({ data: {
+				scoreComponents: { ...sessionRecord?.scoreComponents || {} },
+				score,
+				dnsPeerAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
+				dnsResolverAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo)
+			} }));
+		}
+		try {
+			const decisionInput = {
+				userAccount: challengeRecord.userAccount,
+				dappAccount: challengeRecord.dappAccount,
+				captchaResult: "passed",
+				headers: challengeRecord.headers,
+				captchaType: this.captchaType,
+				behavioralDataPacked: challengeRecord.behavioralDataPacked,
+				deviceCapability: challengeRecord.deviceCapability,
+				countryCode: challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0,
+				ipInfo: challengeRecord.ipInfo,
+				dnsEvent: enrichedDnsEvent,
+				score,
+				threshold: sessionRecord?.threshold,
+				scoreComponents: sessionRecord?.scoreComponents,
+				decryptedHeadHash: sessionRecord?.decryptedHeadHash,
+				userSitekeyIpHash: sessionRecord?.userSitekeyIpHash,
+				simdReadings: sessionRecord?.simdReadings,
+				d: sessionRecord?.d,
+				frictionlessReason: sessionRecord?.reason,
+				ruleType: sessionRecord?.ruleType,
+				webView: sessionRecord?.webView,
+				iFrame: sessionRecord?.iFrame,
+				currentUrl: sessionRecord?.currentUrl,
+				iframeUrl: sessionRecord?.iframeUrl,
+				coords: challengeRecord.coords,
+				...this.decisionMachineEventFields(challengeRecord),
+				...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(sessionRecord),
+				trafficPolicies: require_devicePlatform.deriveTrafficPolicies(trafficFilter)
+			};
+			const decision = await this.decisionMachineRunner.decide(decisionInput, logger);
+			if (decision.decision === _prosopo_types.DecisionMachineDecision.Deny) {
+				logger.info(() => ({
+					msg: `Decision machine denied ${this.logLabel} captcha in server verification`,
+					data: {
+						userAccount: challengeRecord.userAccount,
+						reason: decision.reason,
+						score: decision.score,
+						tags: decision.tags
+					}
+				}));
+				await this.disapproveVerification(challengeRecord, decision.reason || _prosopo_types.ResultReason.CAPTCHA_DECISION_MACHINE_DENIED);
+				return notVerifiedResponse;
+			}
+			logger.debug(() => ({
+				msg: `Decision machine allowed ${this.logLabel} captcha`,
+				data: {
+					reason: decision.reason,
+					score: decision.score,
+					tags: decision.tags
+				}
+			}));
+		} catch (error) {
+			logger.error(() => ({
+				msg: `Failed to run decision machine in server ${this.logLabel} verification`,
+				err: error
+			}));
+		}
+		if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+			serverChecked: true,
+			result: { status: _prosopo_types.CaptchaStatus.approved }
+		});
+		return {
+			verified: true,
+			...score ? { score } : {},
+			...challengeRecord.sessionId && { sessionId: challengeRecord.sessionId }
+		};
+	}
+	/**
+	* Records a server-verification rejection on the captcha record and, unless
+	* `session` is null, on the linked session.
+	*/
+	async disapproveVerification(challengeRecord, reason, session = {}) {
+		const result = {
+			status: _prosopo_types.CaptchaStatus.disapproved,
+			reason
+		};
+		const isBlocked = (0, _prosopo_types.isBlockingCaptchaResult)(this.captchaType, result);
+		await this.updateRecord(challengeRecord.challenge, {
+			result,
+			...isBlocked && { blocked: true }
+		});
+		if (session && challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+			serverChecked: true,
+			result,
+			...isBlocked && { blocked: true },
+			...session
+		});
+	}
+};
+//#endregion
+exports.InteractiveCaptchaManager = InteractiveCaptchaManager;

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -1,21 +1,21 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
-const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
-const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
-const require_captchaManager = require("../captchaManager.cjs");
-const require_routingMachine = require("../frictionless/routingMachine.cjs");
 const require_util = require("../../util.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
+const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
+const require_captchaManager = require("../captchaManager.cjs");
+const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
-const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
 const require_powTasksUtils = require("./powTasksUtils.cjs");
+const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
+const require_routingMachine = require("../frictionless/routingMachine.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
-let _prosopo_util = require("@prosopo/util");
-let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _polkadot_util = require("@polkadot/util");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
+let _prosopo_util = require("@prosopo/util");
 //#region src/tasks/powCaptcha/powTasks.ts
 var DEFAULT_POW_DIFFICULTY = 4;
 var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {

package/dist/cjs/tasks/powCaptcha/powTasksUtils.cjs

@@ -1,7 +1,7 @@
 let _prosopo_common = require("@prosopo/common");
+let _polkadot_util = require("@polkadot/util");
 let _prosopo_util = require("@prosopo/util");
 let _prosopo_util_crypto = require("@prosopo/util-crypto");
-let _polkadot_util = require("@polkadot/util");
 let _noble_hashes_sha2_js = require("@noble/hashes/sha2.js");
 //#region src/tasks/powCaptcha/powTasksUtils.ts
 var validateSolution = (nonce, challenge, difficulty) => (0, _prosopo_util.hashMeetsDifficulty)((0, _noble_hashes_sha2_js.sha256)(new TextEncoder().encode(nonce + challenge)), difficulty);