@prosopo/provider 5.15.0 → 5.17.0

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/refreshLineage.cjs

@@ -1,3 +1,4 @@
+let _prosopo_types = require("@prosopo/types");
 //#region src/api/captcha/getFrictionlessCaptchaChallenge/refreshLineage.ts
 /**
 * Work out where a refresh sits in its chain from the session it replaced.
@@ -11,10 +12,20 @@ var resolveRefreshLineage = async (db, refreshOf, siteKey, now) => {
 	const replaced = await db.getSessionRecordBySessionId(refreshOf);
 	if (!replaced || replaced.siteKey !== siteKey) return void 0;
 	return {
-		refreshOf,
-		refreshCount: (replaced.refreshCount ?? 0) + 1,
-		refreshedAfterMs: Math.max(0, now.getTime() - new Date(replaced.createdAt).getTime())
+		lineage: {
+			refreshOf,
+			refreshCount: (replaced.refreshCount ?? 0) + 1,
+			refreshedAfterMs: Math.max(0, now.getTime() - new Date(replaced.createdAt).getTime())
+		},
+		replacedCaptchaType: replaced.captchaType
 	};
 };
+/**
+* Whether to honour the user's request to swap their puzzle for an image
+* challenge: the request must be a genuine refresh of a puzzle session on
+* this site, and the site must have the switch enabled.
+*/
+var isImageSwitchRequestValid = (switchToImage, refresh, switchEnabled) => true === switchToImage && switchEnabled && _prosopo_types.CaptchaType.puzzle === refresh?.replacedCaptchaType;
 //#endregion
+exports.isImageSwitchRequestValid = isImageSwitchRequestValid;
 exports.resolveRefreshLineage = resolveRefreshLineage;

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -68,6 +68,7 @@ var runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
 		}));
 		case _prosopo_types.CaptchaType.pow: return res.json(await input.tasks.frictionlessManager.sendPowCaptcha(sessionParams));
 		case _prosopo_types.CaptchaType.puzzle: return res.json(await input.tasks.frictionlessManager.sendPuzzleCaptcha(sessionParams));
+		case _prosopo_types.CaptchaType.iconOrder: return res.json(await input.tasks.frictionlessManager.sendIconOrderCaptcha(sessionParams));
 		default: throw new Error(`Unhandled configured captchaType in /frictionless short-circuit: ${configuredType}`);
 	}
 };

package/dist/cjs/api/captcha/getIconOrderCaptchaChallenge.cjs

@@ -0,0 +1,37 @@
+const require_iconOrderRenderer = require("../../tasks/iconOrder/iconOrderRenderer.cjs");
+const require_interactiveCaptchaChallenge = require("./interactiveCaptchaChallenge.cjs");
+const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
+let _prosopo_types = require("@prosopo/types");
+//#region src/api/captcha/getIconOrderCaptchaChallenge.ts
+var issueIconOrderChallenge = async ({ tasks, user, dapp, clientSettings, sessionRecord, trafficVerdict, provenance }) => {
+	const challengeVerdict = trafficVerdict.kind === "challenge" ? trafficVerdict : void 0;
+	const tolerance = challengeVerdict?.iconOrderTolerance ?? sessionRecord?.iconOrderTolerance ?? clientSettings?.settings?.iconOrderTolerance;
+	const renderSettings = require_iconOrderRenderer.resolveIconOrderRenderSettings(clientSettings?.settings?.iconOrder, challengeVerdict?.iconOrderSettings ?? sessionRecord?.iconOrder);
+	const challenge = await tasks.iconOrderCaptchaManager.getIconOrderCaptchaChallenge(user, dapp, tolerance, () => require_iconOrderRenderer.renderIconOrderImages(renderSettings));
+	await tasks.db.storeIconOrderCaptchaRecord(challenge.challenge, {
+		requestedAtTimestamp: challenge.requestedAtTimestamp,
+		userAccount: user,
+		dappAccount: dapp
+	}, challenge.targets, challenge.tolerance, challenge.providerSignature, provenance.ipAddress, provenance.headers, provenance.ja4, provenance.sessionId, provenance.ipInfo);
+	return {
+		logData: { tolerance: challenge.tolerance },
+		response: {
+			[_prosopo_types.ApiParams.status]: "ok",
+			[_prosopo_types.ApiParams.challenge]: challenge.challenge,
+			[_prosopo_types.ApiParams.background]: challenge.images.background,
+			[_prosopo_types.ApiParams.legend]: challenge.images.legend,
+			[_prosopo_types.ApiParams.legendIconSize]: challenge.images.legendIconSize,
+			[_prosopo_types.ApiParams.timestamp]: challenge.requestedAtTimestamp.toString(),
+			[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: challenge.providerSignature } }
+		}
+	};
+};
+var getIconOrderCaptchaChallenge_default = (env, userAccessRulesStorage) => require_interactiveCaptchaChallenge.interactiveChallengeHandler(env, userAccessRulesStorage, {
+	captchaType: _prosopo_types.CaptchaType.iconOrder,
+	label: "icon-order",
+	manager: (tasks) => tasks.iconOrderCaptchaManager,
+	maintenanceResponse: require_maintenanceModeResponses.buildIconOrderMaintenanceResponse,
+	issue: issueIconOrderChallenge
+});
+//#endregion
+exports.default = getIconOrderCaptchaChallenge_default;

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -1,12 +1,12 @@
-const require_validateAddress = require("../validateAddress.cjs");
 const require_metrics = require("../metrics.cjs");
 const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const require_validateAddress = require("../validateAddress.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
-const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
+const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_sealedAssetsResolver = require("./sealedAssetsResolver.cjs");
 const require_signedAssetsResolver = require("./signedAssetsResolver.cjs");
 let _prosopo_common = require("@prosopo/common");

package/dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs

@@ -1,14 +1,14 @@
-const require_validateAddress = require("../validateAddress.cjs");
-const require_metrics = require("../metrics.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+const require_metrics = require("../metrics.cjs");
 const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const require_validateAddress = require("../validateAddress.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
-const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
-const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
 const require_requestBodySummary = require("../requestBodySummary.cjs");
+const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
+const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");

package/dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs

@@ -1,144 +1,52 @@
-const require_validateAddress = require("../validateAddress.cjs");
-const require_metrics = require("../metrics.cjs");
-const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
-const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
 const require_puzzleRenderer = require("../../tasks/puzzle/puzzleRenderer.cjs");
-const require_tasks = require("../../tasks/tasks.cjs");
-const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
-const require_testSiteKey = require("../testSiteKey.cjs");
-const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
+const require_interactiveCaptchaChallenge = require("./interactiveCaptchaChallenge.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
-const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
-const require_requestBodySummary = require("../requestBodySummary.cjs");
-let _prosopo_common = require("@prosopo/common");
+const require_constants = require("./getFrictionlessCaptchaChallenge/constants.cjs");
 let _prosopo_types = require("@prosopo/types");
-let _prosopo_util = require("@prosopo/util");
 let _prosopo_puzzle_assets = require("@prosopo/puzzle-assets");
 //#region src/api/captcha/getPuzzleCaptchaChallenge.ts
-var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req, res, next) => {
-	let parsed;
-	try {
-		parsed = _prosopo_types.GetPuzzleCaptchaChallengeRequestBody.parse(req.body);
-	} catch (err) {
-		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-			context: {
-				code: 400,
-				error: err
-			},
-			i18n: req.i18n,
-			logger: req.logger
+var issuePuzzleChallenge = async ({ tasks, user, dapp, origin, clientSettings, sessionRecord, trafficVerdict, provenance }) => {
+	const challengeVerdict = trafficVerdict.kind === "challenge" ? trafficVerdict : void 0;
+	const tolerance = challengeVerdict?.puzzleTolerance ?? sessionRecord?.puzzleTolerance ?? clientSettings?.settings?.puzzleTolerance;
+	const routedPuzzleSettings = challengeVerdict?.puzzleSettings ?? sessionRecord?.puzzle;
+	const effectivePuzzleSettings = require_puzzleRenderer.resolvePuzzleRenderSettings(clientSettings?.settings?.puzzle, routedPuzzleSettings);
+	const effectivePieceSize = require_puzzleRenderer.resolvePuzzlePieceSize(clientSettings?.settings?.puzzle, routedPuzzleSettings);
+	const challenge = await tasks.puzzleCaptchaManager.getPuzzleCaptchaChallenge(user, dapp, origin, tolerance);
+	await tasks.db.storePuzzleCaptchaRecord(challenge.challenge, {
+		requestedAtTimestamp: challenge.requestedAtTimestamp,
+		userAccount: user,
+		dappAccount: dapp
+	}, challenge.targetX, challenge.targetY, challenge.originX, challenge.originY, challenge.tolerance, challenge.providerSignature, provenance.ipAddress, provenance.headers, provenance.ja4, provenance.sessionId, provenance.ipInfo);
+	const images = await require_puzzleRenderer.renderPuzzleImages({
+		targetX: challenge.targetX,
+		targetY: challenge.targetY
+	}, effectivePuzzleSettings, effectivePieceSize);
+	await tasks.db.updatePuzzleCaptchaRecord(challenge.challenge, { render: {
+		...sessionRecord?.puzzleLevel !== void 0 && { level: sessionRecord.puzzleLevel },
+		pieceSize: images.pieceSize,
+		geometry: {
+			width: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.width,
+			height: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.height,
+			notchSize: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.notchSize
+		},
+		settings: {
+			decoyCount: effectivePuzzleSettings.decoyCount,
+			decoyEdgeDarkness: effectivePuzzleSettings.decoyEdgeDarkness,
+			decoyBodyBrightness: effectivePuzzleSettings.decoyBodyBrightness,
+			holeDarken: effectivePuzzleSettings.holeDarken,
+			decoyHoleDarken: effectivePuzzleSettings.decoyHoleDarken
+		},
+		backgroundSeed: images.backgroundSeed,
+		renderSeed: images.renderSeed
+	} }).catch((updateErr) => {
+		tasks.logger.warn(() => ({
+			err: updateErr,
+			msg: "Failed to patch puzzle render inputs onto the challenge record"
 		}));
-	}
-	const { user, dapp, sessionId, simdReadings } = parsed;
-	require_validateAddress.validateSiteKey(dapp);
-	require_validateAddress.validateAddr(user);
-	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
-		req.logger.info(() => ({
-			msg: "Maintenance mode active - returning dummy puzzle challenge",
-			data: {
-				dapp,
-				user,
-				sessionId
-			}
-		}));
-		return res.json(await require_maintenanceModeResponses.buildPuzzleMaintenanceResponse(user, dapp));
-	}
-	if (require_testSiteKey.isReservedTestSiteKey(dapp)) {
-		req.logger.warn(() => ({
-			msg: "Reserved TEST site key - returning dummy puzzle challenge",
-			data: {
-				dapp,
-				user,
-				sessionId
-			}
-		}));
-		return res.json(await require_maintenanceModeResponses.buildPuzzleMaintenanceResponse(user, dapp));
-	}
-	const tasks = new require_tasks.Tasks(env, req.logger);
-	try {
-		const clientSettings = await tasks.db.getClientRecord(dapp);
-		if (!clientSettings) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-			context: {
-				code: 400,
-				siteKey: dapp
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-		const normalizedIp = require_normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
-		if (!normalizedIp) req.logger.warn(() => ({ msg: "Request missing IP; geoblocking will be skipped" }));
-		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
-		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
-		const userAccessPolicy = (await tasks.puzzleCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope, require_blacklistRequestInspector.normalizeHeadersForMatching(req.headers))).find((p) => !p.deferToVerify);
-		const { valid, reason, sessionId: validSessionId } = await tasks.puzzleCaptchaManager.isValidRequest(clientSettings, _prosopo_types.CaptchaType.puzzle, env, sessionId, userAccessPolicy, normalizedIp);
-		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {
-			context: {
-				code: 400,
-				siteKey: dapp,
-				user
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-		const origin = req.headers.origin;
-		if (!origin) return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: {
-				error: "Origin header not found",
-				code: 400,
-				siteKey: dapp,
-				user
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientSettings.settings?.trafficFilter, req.logger);
-		const tolerance = (trafficVerdict.kind === "challenge" ? trafficVerdict.puzzleTolerance : void 0) ?? sessionRecord?.puzzleTolerance ?? clientSettings?.settings?.puzzleTolerance;
-		const routedPuzzleSettings = (trafficVerdict.kind === "challenge" ? trafficVerdict.puzzleSettings : void 0) ?? sessionRecord?.puzzle;
-		const effectivePuzzleSettings = require_puzzleRenderer.resolvePuzzleRenderSettings(clientSettings?.settings?.puzzle, routedPuzzleSettings);
-		const effectivePieceSize = require_puzzleRenderer.resolvePuzzlePieceSize(clientSettings?.settings?.puzzle, routedPuzzleSettings);
-		const challenge = await tasks.puzzleCaptchaManager.getPuzzleCaptchaChallenge(user, dapp, origin, tolerance);
-		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
-			req.logger.warn(() => ({
-				err: updateErr,
-				msg: "Failed to patch session with SIMD readings on puzzle challenge"
-			}));
-		});
-		await tasks.db.storePuzzleCaptchaRecord(challenge.challenge, {
-			requestedAtTimestamp: challenge.requestedAtTimestamp,
-			userAccount: user,
-			dappAccount: dapp
-		}, challenge.targetX, challenge.targetY, challenge.originX, challenge.originY, challenge.tolerance, challenge.providerSignature, require_compositeIpAddress.getCompositeIpAddress(normalizedIp), (0, _prosopo_util.flatten)(req.headers), req.ja4, validSessionId, req.ipInfo);
-		const images = await require_puzzleRenderer.renderPuzzleImages({
-			targetX: challenge.targetX,
-			targetY: challenge.targetY
-		}, effectivePuzzleSettings, effectivePieceSize);
-		await tasks.db.updatePuzzleCaptchaRecord(challenge.challenge, { render: {
-			...sessionRecord?.puzzleLevel !== void 0 && { level: sessionRecord.puzzleLevel },
-			pieceSize: images.pieceSize,
-			geometry: {
-				width: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.width,
-				height: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.height,
-				notchSize: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.notchSize
-			},
-			settings: {
-				decoyCount: effectivePuzzleSettings.decoyCount,
-				decoyEdgeDarkness: effectivePuzzleSettings.decoyEdgeDarkness,
-				decoyBodyBrightness: effectivePuzzleSettings.decoyBodyBrightness,
-				holeDarken: effectivePuzzleSettings.holeDarken,
-				decoyHoleDarken: effectivePuzzleSettings.decoyHoleDarken
-			},
-			backgroundSeed: images.backgroundSeed,
-			renderSeed: images.renderSeed
-		} }).catch((updateErr) => {
-			req.logger.warn(() => ({
-				err: updateErr,
-				msg: "Failed to patch puzzle render inputs onto the challenge record"
-			}));
-		});
-		const padBytes = trafficVerdict.padBytes;
-		const getPuzzleCaptchaResponse = {
+	});
+	return {
+		logData: { tolerance: challenge.tolerance },
+		response: {
 			[_prosopo_types.ApiParams.status]: "ok",
 			[_prosopo_types.ApiParams.challenge]: challenge.challenge,
 			[_prosopo_types.ApiParams.background]: images.background,
@@ -147,40 +55,17 @@ var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => async (
 			[_prosopo_types.ApiParams.originX]: challenge.originX,
 			[_prosopo_types.ApiParams.originY]: challenge.originY,
 			[_prosopo_types.ApiParams.timestamp]: challenge.requestedAtTimestamp.toString(),
-			[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: challenge.providerSignature } }
-		};
-		req.logger.info(() => ({
-			msg: "Puzzle captcha challenge issued",
-			data: {
-				captchaType: _prosopo_types.CaptchaType.puzzle,
-				challenge: challenge.challenge,
-				tolerance: challenge.tolerance,
-				user,
-				dapp,
-				session: sessionId
-			}
-		}));
-		res.locals.padBytes = padBytes;
-		require_metrics.recordCaptchaIssued(_prosopo_types.CaptchaType.puzzle);
-		return res.json(getPuzzleCaptchaResponse);
-	} catch (err) {
-		require_metrics.recordCaptchaIssueError(_prosopo_types.CaptchaType.puzzle);
-		req.logger.error(() => ({
-			err,
-			body: require_requestBodySummary.summariseRequestBody(req),
-			msg: "Error in puzzle captcha challenge request"
-		}));
-		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: {
-				code: 500,
-				siteKey: req.body.dapp,
-				user: req.body.user,
-				error: err
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-	}
+			[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: challenge.providerSignature } },
+			...require_constants.isPuzzleImageSwitchAvailable(clientSettings?.settings ?? {}) && { [_prosopo_types.ApiParams.imageSwitchAvailable]: true }
+		}
+	};
 };
+var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => require_interactiveCaptchaChallenge.interactiveChallengeHandler(env, userAccessRulesStorage, {
+	captchaType: _prosopo_types.CaptchaType.puzzle,
+	label: "puzzle",
+	manager: (tasks) => tasks.puzzleCaptchaManager,
+	maintenanceResponse: require_maintenanceModeResponses.buildPuzzleMaintenanceResponse,
+	issue: issuePuzzleChallenge
+});
 //#endregion
 exports.default = getPuzzleCaptchaChallenge_default;

package/dist/cjs/api/captcha/interactiveCaptchaChallenge.cjs

@@ -0,0 +1,154 @@
+const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+const require_metrics = require("../metrics.cjs");
+const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const require_validateAddress = require("../validateAddress.cjs");
+const require_tasks = require("../../tasks/tasks.cjs");
+const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../testSiteKey.cjs");
+const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
+const require_requestBodySummary = require("../requestBodySummary.cjs");
+const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+//#region src/api/captcha/interactiveCaptchaChallenge.ts
+var capitalise = (text) => text.charAt(0).toUpperCase() + text.slice(1);
+/** Request handling shared by the challenge endpoints of the interactive types. */
+var interactiveChallengeHandler = (env, userAccessRulesStorage, spec) => async (req, res, next) => {
+	const { captchaType, label } = spec;
+	let parsed;
+	try {
+		parsed = _prosopo_types.GetPuzzleCaptchaChallengeRequestBody.parse(req.body);
+	} catch (err) {
+		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { user, dapp, sessionId, simdReadings } = parsed;
+	require_validateAddress.validateSiteKey(dapp);
+	require_validateAddress.validateAddr(user);
+	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+		req.logger.info(() => ({
+			msg: `Maintenance mode active - returning dummy ${label} challenge`,
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(await spec.maintenanceResponse(user, dapp));
+	}
+	if (require_testSiteKey.isReservedTestSiteKey(dapp)) {
+		req.logger.warn(() => ({
+			msg: `Reserved TEST site key - returning dummy ${label} challenge`,
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(await spec.maintenanceResponse(user, dapp));
+	}
+	const tasks = new require_tasks.Tasks(env, req.logger);
+	const manager = spec.manager(tasks);
+	try {
+		const clientSettings = await tasks.db.getClientRecord(dapp);
+		if (!clientSettings) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const normalizedIp = require_normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
+		if (!normalizedIp) req.logger.warn(() => ({ msg: "Request missing IP; geoblocking will be skipped" }));
+		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
+		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
+		const userAccessPolicy = (await manager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope, require_blacklistRequestInspector.normalizeHeadersForMatching(req.headers))).find((p) => !p.deferToVerify);
+		const { valid, reason, sessionId: validSessionId } = await manager.isValidRequest(clientSettings, captchaType, env, sessionId, userAccessPolicy, normalizedIp);
+		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const origin = req.headers.origin;
+		if (!origin) return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				error: "Origin header not found",
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientSettings.settings?.trafficFilter, req.logger);
+		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
+			req.logger.warn(() => ({
+				err: updateErr,
+				msg: `Failed to patch session with SIMD readings on ${label} challenge`
+			}));
+		});
+		const { response, logData } = await spec.issue({
+			tasks,
+			user,
+			dapp,
+			origin,
+			clientSettings,
+			sessionRecord,
+			trafficVerdict,
+			provenance: {
+				ipAddress: require_compositeIpAddress.getCompositeIpAddress(normalizedIp),
+				headers: (0, _prosopo_util.flatten)(req.headers),
+				ja4: req.ja4,
+				sessionId: validSessionId,
+				ipInfo: req.ipInfo
+			}
+		});
+		req.logger.info(() => ({
+			msg: `${capitalise(label)} captcha challenge issued`,
+			data: {
+				captchaType,
+				challenge: response.challenge,
+				...logData,
+				user,
+				dapp,
+				session: sessionId
+			}
+		}));
+		res.locals.padBytes = trafficVerdict.padBytes;
+		require_metrics.recordCaptchaIssued(captchaType);
+		return res.json(response);
+	} catch (err) {
+		require_metrics.recordCaptchaIssueError(captchaType);
+		req.logger.error(() => ({
+			err,
+			body: require_requestBodySummary.summariseRequestBody(req),
+			msg: `Error in ${label} captcha challenge request`
+		}));
+		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 500,
+				siteKey: req.body.dapp,
+				user: req.body.user,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+};
+//#endregion
+exports.interactiveChallengeHandler = interactiveChallengeHandler;

package/dist/cjs/api/captcha/interactiveCaptchaSolution.cjs

@@ -0,0 +1,77 @@
+const require_validateAddress = require("../validateAddress.cjs");
+const require_tasks = require("../../tasks/tasks.cjs");
+const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../testSiteKey.cjs");
+const require_requestBodySummary = require("../requestBodySummary.cjs");
+let _prosopo_common = require("@prosopo/common");
+//#region src/api/captcha/interactiveCaptchaSolution.ts
+/** Request handling shared by the solution endpoints of the interactive types. */
+var interactiveSolutionHandler = (env, spec) => async (req, res, next) => {
+	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+		req.logger.info(() => ({ msg: "Maintenance mode active - returning verified" }));
+		return res.json({
+			status: "ok",
+			verified: true
+		});
+	}
+	let parsed;
+	const tasks = new require_tasks.Tasks(env, req.logger);
+	try {
+		parsed = spec.parse(req.body);
+	} catch (err) {
+		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err,
+				body: require_requestBodySummary.summariseRequestBody(req)
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { dapp, user } = parsed;
+	require_validateAddress.validateSiteKey(dapp);
+	require_validateAddress.validateAddr(user);
+	const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
+	if (testVerdict !== null) {
+		const response = {
+			status: "ok",
+			verified: testVerdict
+		};
+		return res.json(response);
+	}
+	try {
+		const clientRecord = await tasks.db.getClientRecord(dapp);
+		if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const submitWindowMs = clientRecord.settings.solutionTimeout ?? clientRecord.settings.verifiedTimeout;
+		const response = {
+			status: "ok",
+			verified: await spec.verify(tasks, parsed, submitWindowMs, req)
+		};
+		return res.json(response);
+	} catch (err) {
+		req.logger.error(() => ({
+			err,
+			body: require_requestBodySummary.summariseRequestBody(req),
+			msg: `Error in ${spec.label} captcha solution submission`
+		}));
+		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 500,
+				siteKey: req.body.dapp,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+};
+//#endregion
+exports.interactiveSolutionHandler = interactiveSolutionHandler;

package/dist/cjs/api/captcha/maintenanceModeResponses.cjs

@@ -1,4 +1,6 @@
+const require_audioRenderer = require("../../tasks/audio/audioRenderer.cjs");
 const require_puzzleRenderer = require("../../tasks/puzzle/puzzleRenderer.cjs");
+const require_iconOrderRenderer = require("../../tasks/iconOrder/iconOrderRenderer.cjs");
 let _prosopo_types = require("@prosopo/types");
 let node_crypto = require("node:crypto");
 //#region src/api/captcha/maintenanceModeResponses.ts
@@ -49,8 +51,35 @@ var buildPuzzleMaintenanceResponse = async (user, dapp) => {
 		[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: "" } }
 	};
 };
+var buildAudioMaintenanceResponse = async (user, dapp) => {
+	const timestamp = Date.now();
+	const rendered = require_audioRenderer.renderAudioClip(require_audioRenderer.resolveAudioRenderSettings());
+	return {
+		[_prosopo_types.ApiParams.status]: "ok",
+		[_prosopo_types.ApiParams.challenge]: buildChallenge(user, dapp),
+		[_prosopo_types.ApiParams.clip]: rendered.clip,
+		[_prosopo_types.ApiParams.characterCount]: rendered.characterCount,
+		[_prosopo_types.ApiParams.timestamp]: timestamp.toString(),
+		[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: "" } }
+	};
+};
+var buildIconOrderMaintenanceResponse = async (user, dapp) => {
+	const timestamp = Date.now();
+	const images = await require_iconOrderRenderer.renderIconOrderImages();
+	return {
+		[_prosopo_types.ApiParams.status]: "ok",
+		[_prosopo_types.ApiParams.challenge]: buildChallenge(user, dapp),
+		[_prosopo_types.ApiParams.background]: images.background,
+		[_prosopo_types.ApiParams.legend]: images.legend,
+		[_prosopo_types.ApiParams.legendIconSize]: images.legendIconSize,
+		[_prosopo_types.ApiParams.timestamp]: timestamp.toString(),
+		[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: "" } }
+	};
+};
 //#endregion
+exports.buildAudioMaintenanceResponse = buildAudioMaintenanceResponse;
 exports.buildFrictionlessMaintenanceResponse = buildFrictionlessMaintenanceResponse;
+exports.buildIconOrderMaintenanceResponse = buildIconOrderMaintenanceResponse;
 exports.buildImageMaintenanceResponse = buildImageMaintenanceResponse;
 exports.buildMaintenanceVerificationResponse = buildMaintenanceVerificationResponse;
 exports.buildPowMaintenanceResponse = buildPowMaintenanceResponse;

package/dist/cjs/api/captcha/submitAudioCaptchaSolution.cjs

@@ -0,0 +1,11 @@
+const require_interactiveCaptchaSolution = require("./interactiveCaptchaSolution.cjs");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+//#region src/api/captcha/submitAudioCaptchaSolution.ts
+var submitAudioCaptchaSolution_default = (env) => require_interactiveCaptchaSolution.interactiveSolutionHandler(env, {
+	label: "audio",
+	parse: (body) => _prosopo_types.SubmitAudioCaptchaSolutionBody.parse(body),
+	verify: (tasks, body, submitWindowMs, req) => tasks.audioCaptchaManager.verifyAudioCaptchaSolution(body.challenge, body.signature.provider.challenge, body.answer, body.replays ?? 0, body.audioEvents ?? [], submitWindowMs, body.signature.user.timestamp, (0, _prosopo_util.getIPAddress)(req.ip || ""), body.behavioralData, body.salt, body.simdReadings, body.clientMetaData)
+});
+//#endregion
+exports.default = submitAudioCaptchaSolution_default;

package/dist/cjs/api/captcha/submitIconOrderCaptchaSolution.cjs

@@ -0,0 +1,11 @@
+const require_interactiveCaptchaSolution = require("./interactiveCaptchaSolution.cjs");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+//#region src/api/captcha/submitIconOrderCaptchaSolution.ts
+var submitIconOrderCaptchaSolution_default = (env) => require_interactiveCaptchaSolution.interactiveSolutionHandler(env, {
+	label: "icon-order",
+	parse: (body) => _prosopo_types.SubmitIconOrderCaptchaSolutionBody.parse(body),
+	verify: (tasks, body, submitWindowMs, req) => tasks.iconOrderCaptchaManager.verifyIconOrderCaptchaSolution(body.challenge, body.signature.provider.challenge, body.clicks, body.iconOrderEvents, submitWindowMs, body.signature.user.timestamp, (0, _prosopo_util.getIPAddress)(req.ip || ""), body.behavioralData, body.salt, body.simdReadings, body.clientMetaData)
+});
+//#endregion
+exports.default = submitIconOrderCaptchaSolution_default;