@prosopo/provider 5.19.3 → 5.20.0

package/dist/cjs/util.cjs

@@ -11,7 +11,12 @@ function encodeStringAddress(address) {
 	try {
 		return (0, _prosopo_util_crypto.encodeAddress)((0, _polkadot_util_is.isHex)(address) ? (0, _polkadot_util_hex.hexToU8a)(address) : (0, _prosopo_util_crypto.decodeAddress)(address));
 	} catch (err) {
-		throw new _prosopo_common.ProsopoContractError("CONTRACT.INVALID_ADDRESS", { context: { address } });
+		throw new _prosopo_common.ProsopoError({
+			code: "INVALID_DATA",
+			errorSite: "PROV-77",
+			message: "Failed to encode invalid address",
+			context: { address }
+		});
 	}
 }
 function shuffleArray(array) {
@@ -43,7 +48,10 @@ var getIPAddress = (ipAddressString) => {
 			return new ip_address.Address6(ipAddressString);
 		}
 	} catch (e) {
-		throw new _prosopo_common.ProsopoEnvError("API.INVALID_IP");
+		throw new _prosopo_common.ProsopoError({
+			code: "INVALID_IP",
+			errorSite: "PROV-78"
+		});
 	}
 };
 var getIPAddressFromBigInt = (ipAddressBigInt) => {
@@ -51,7 +59,10 @@ var getIPAddressFromBigInt = (ipAddressBigInt) => {
 		if (ipAddressBigInt > 4228250626n) return ip_address.Address6.fromBigInt(BigInt(ipAddressBigInt));
 		return ip_address.Address4.fromBigInt(BigInt(ipAddressBigInt));
 	} catch (e) {
-		throw new _prosopo_common.ProsopoEnvError("API.INVALID_IP");
+		throw new _prosopo_common.ProsopoError({
+			code: "INVALID_IP",
+			errorSite: "PROV-79"
+		});
 	}
 };
 /**

package/dist/cjs/utils/devicePlatform.cjs

@@ -1,16 +1,20 @@
+const require_mobileSignals = require("./mobileSignals.cjs");
 //#region src/utils/devicePlatform.ts
 var APPLE_UA_REGEX = /iPhone|iPad|iPod|Macintosh|Mac OS X/i;
-var MOBILE_UA_REGEX = /Mobile|Android|iPhone|iPad|iPod|Opera Mini|IEMobile/i;
 /**
 * Derive platform flags from server-visible signals. `isWebView` is supplied
 * by the caller because that bit only comes from the encrypted bot-detection
-* payload, not request headers. `isMobile` prefers IPInfo's network-classified
-* mobile bit when present and falls back to UA parsing otherwise.
+* payload, not request headers. `isMobile` is a weighed verdict over whatever
+* signals the caller can supply — see `deriveMobileVerdict`.
 */
-var derivePlatform = (userAgent, webView, ipInfo) => ({
+var derivePlatform = (userAgent, webView, signals = {}) => ({
 	isApple: APPLE_UA_REGEX.test(userAgent),
 	isWebView: webView,
-	isMobile: typeof ipInfo?.isMobile === "boolean" ? ipInfo.isMobile : MOBILE_UA_REGEX.test(userAgent)
+	isMobile: require_mobileSignals.deriveMobileVerdict({
+		...signals,
+		userAgent,
+		webView
+	}).isMobile
 });
 var TRAFFIC_FILTER_CATEGORIES = [
 	"vpn",

package/dist/cjs/utils/mobileSignals.cjs

@@ -0,0 +1,69 @@
+//#region src/utils/mobileSignals.ts
+var MOBILE_UA_REGEX = /Mobile|Android|iPhone|iPad|iPod|Opera Mini|IEMobile/i;
+var DESKTOP_UA_REGEX = /Windows NT|Macintosh|X11|CrOS/i;
+var MOBILE_PLATFORM_HINTS = ["android", "ios"];
+var DESKTOP_PLATFORM_HINTS = [
+	"windows",
+	"macos",
+	"linux",
+	"chrome os"
+];
+var TUNNELLED_MSS_MIN = 1300;
+var TUNNELLED_MSS_MAX = 1430;
+var MOBILE_SIGNAL_WEIGHTS = {
+	userAgentMobile: 3,
+	userAgentDesktop: -3,
+	clientHintMobile: 3,
+	clientHintNotMobile: -3,
+	clientHintPlatformMobile: 3,
+	clientHintPlatformDesktop: -3,
+	touchCapability: 2,
+	pointerCapability: -3,
+	touchEvents: 2,
+	webView: 1,
+	network: 1
+};
+var readHeader = (headers, name) => {
+	const value = headers?.[name];
+	return typeof value === "string" && value !== "" ? value : void 0;
+};
+var deriveMobileVerdict = (signals) => {
+	let score = 0;
+	let corroborated = false;
+	const evidence = [];
+	const vote = (name, evidenceName = name) => {
+		score += MOBILE_SIGNAL_WEIGHTS[name];
+		evidence.push(evidenceName);
+	};
+	const voteCorroborating = (name, evidenceName = name) => {
+		vote(name, evidenceName);
+		corroborated = true;
+	};
+	const userAgent = signals.userAgent ?? "";
+	if (MOBILE_UA_REGEX.test(userAgent)) vote("userAgentMobile");
+	else if (DESKTOP_UA_REGEX.test(userAgent)) vote("userAgentDesktop");
+	const mobileHint = readHeader(signals.headers, "sec-ch-ua-mobile");
+	if (mobileHint === "?1") vote("clientHintMobile");
+	else if (mobileHint === "?0") vote("clientHintNotMobile");
+	const platformHint = readHeader(signals.headers, "sec-ch-ua-platform")?.replaceAll("\"", "").toLowerCase();
+	if (platformHint !== void 0) {
+		if (MOBILE_PLATFORM_HINTS.includes(platformHint)) vote("clientHintPlatformMobile");
+		else if (DESKTOP_PLATFORM_HINTS.includes(platformHint)) vote("clientHintPlatformDesktop");
+	}
+	if (signals.deviceCapability === "mobile") voteCorroborating("touchCapability");
+	else if (signals.deviceCapability === "desktop") vote("pointerCapability");
+	if (signals.touchEventCount !== void 0 && signals.touchEventCount > 0) voteCorroborating("touchEvents");
+	if (signals.webView === true) voteCorroborating("webView");
+	const onCarrier = signals.carrierNetwork === true;
+	const tunnelled = signals.tcpMss !== void 0 && signals.tcpMss >= TUNNELLED_MSS_MIN && signals.tcpMss <= TUNNELLED_MSS_MAX;
+	if (onCarrier || tunnelled) voteCorroborating("network", onCarrier && tunnelled ? "carrierNetwork+tunnelledMss" : onCarrier ? "carrierNetwork" : "tunnelledMss");
+	return {
+		isMobile: score >= 3,
+		corroborated,
+		score,
+		evidence
+	};
+};
+//#endregion
+exports.MOBILE_SIGNAL_WEIGHTS = MOBILE_SIGNAL_WEIGHTS;
+exports.deriveMobileVerdict = deriveMobileVerdict;

package/dist/errorSites.d.ts

@@ -0,0 +1,98 @@
+declare module "@prosopo/common" {
+    interface ErrorSites {
+        "PROV-1": true;
+        "PROV-2": true;
+        "PROV-3": true;
+        "PROV-4": true;
+        "PROV-5": true;
+        "PROV-6": true;
+        "PROV-7": true;
+        "PROV-8": true;
+        "PROV-9": true;
+        "PROV-10": true;
+        "PROV-11": true;
+        "PROV-12": true;
+        "PROV-13": true;
+        "PROV-14": true;
+        "PROV-15": true;
+        "PROV-16": true;
+        "PROV-17": true;
+        "PROV-18": true;
+        "PROV-19": true;
+        "PROV-20": true;
+        "PROV-21": true;
+        "PROV-22": true;
+        "PROV-23": true;
+        "PROV-24": true;
+        "PROV-25": true;
+        "PROV-26": true;
+        "PROV-27": true;
+        "PROV-28": true;
+        "PROV-29": true;
+        "PROV-30": true;
+        "PROV-31": true;
+        "PROV-32": true;
+        "PROV-33": true;
+        "PROV-34": true;
+        "PROV-35": true;
+        "PROV-37": true;
+        "PROV-38": true;
+        "PROV-39": true;
+        "PROV-40": true;
+        "PROV-41": true;
+        "PROV-42": true;
+        "PROV-43": true;
+        "PROV-44": true;
+        "PROV-45": true;
+        "PROV-46": true;
+        "PROV-47": true;
+        "PROV-48": true;
+        "PROV-49": true;
+        "PROV-50": true;
+        "PROV-51": true;
+        "PROV-52": true;
+        "PROV-53": true;
+        "PROV-54": true;
+        "PROV-55": true;
+        "PROV-56": true;
+        "PROV-57": true;
+        "PROV-58": true;
+        "PROV-59": true;
+        "PROV-60": true;
+        "PROV-61": true;
+        "PROV-62": true;
+        "PROV-63": true;
+        "PROV-64": true;
+        "PROV-65": true;
+        "PROV-66": true;
+        "PROV-67": true;
+        "PROV-68": true;
+        "PROV-69": true;
+        "PROV-70": true;
+        "PROV-71": true;
+        "PROV-72": true;
+        "PROV-73": true;
+        "PROV-74": true;
+        "PROV-75": true;
+        "PROV-76": true;
+        "PROV-77": true;
+        "PROV-78": true;
+        "PROV-79": true;
+        "PROV-80": true;
+        "PROV-81": true;
+        "PROV-82": true;
+        "PROV-83": true;
+        "PROV-84": true;
+        "PROV-85": true;
+        "PROV-86": true;
+        "PROV-87": true;
+        "PROV-88": true;
+        "PROV-89": true;
+        "PROV-90": true;
+        "PROV-91": true;
+        "PROV-92": true;
+        "PROV-93": true;
+    }
+}
+export {};
+//# sourceMappingURL=errorSites.d.ts.map

package/dist/errorSites.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorSites.d.ts","sourceRoot":"","sources":["../src/errorSites.ts"],"names":[],"mappings":"AAcA,OAAO,QAAQ,iBAAiB,CAAC;IAChC,UAAU,UAAU;QACnB,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;KAChB;CACD;AAED,OAAO,EAAE,CAAC"}

package/dist/errorSites.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=errorSites.js.map

package/dist/errorSites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorSites.js","sourceRoot":"","sources":["../src/errorSites.ts"],"names":[],"mappings":""}

package/dist/fingerprint/dist/merkle.js

@@ -0,0 +1,69 @@
+import { hexHashArray } from "@prosopo/util-crypto";
+//#region ../fingerprint/dist/merkle.js
+var at = (arr, index) => {
+	const value = arr[index];
+	if (value === void 0) throw new Error(`merkle: index ${index} out of range (length ${arr.length})`);
+	return value;
+};
+/** Hash a pair of child hashes into their parent. */
+var hashMerklePair = (left, right) => hexHashArray([left, right]);
+/**
+* Build every layer of the Merkle tree, bottom-up. Layer 0 is the leaf hashes,
+* the final layer is `[root]`. An odd node at the end of a layer is paired with
+* itself.
+*/
+var buildMerkleLayers = (leafHashes) => {
+	if (leafHashes.length === 0) throw new Error("merkle: cannot build a tree with no leaves");
+	const layers = [[...leafHashes]];
+	let current = leafHashes;
+	while (current.length > 1) {
+		const next = [];
+		for (let i = 0; i < current.length; i += 2) {
+			const left = at(current, i);
+			const right = i + 1 < current.length ? at(current, i + 1) : left;
+			next.push(hashMerklePair(left, right));
+		}
+		layers.push(next);
+		current = next;
+	}
+	return layers;
+};
+var merkleRootFromLayers = (layers) => at(at(layers, layers.length - 1), 0);
+/** Produce the sibling path proving `leafHash` belongs to the tree. */
+var merkleProofFromLayers = (layers, leafHash) => {
+	const proof = [];
+	let hash = leafHash;
+	for (let layerNum = 0; layerNum < layers.length - 1; layerNum++) {
+		const layer = at(layers, layerNum);
+		const index = layer.indexOf(hash);
+		if (index === -1) throw new Error("merkle: leaf hash not present in layer");
+		let partnerIndex = index % 2 === 1 ? index - 1 : index + 1;
+		if (partnerIndex > layer.length - 1) partnerIndex = index;
+		const partner = at(layer, partnerIndex);
+		const pair = partnerIndex > index ? [hash, partner] : [partner, hash];
+		proof.push(pair);
+		hash = hashMerklePair(pair[0], pair[1]);
+	}
+	return [...proof, [merkleRootFromLayers(layers)]];
+};
+/** Verify a leaf + sibling path recomputes to the proof's embedded root. */
+var verifyMerkleProof = (leafHash, proof) => {
+	try {
+		const firstLayer = proof[0];
+		if (firstLayer === void 0 || firstLayer.indexOf(leafHash) === -1) return false;
+		if (proof.length === 1) return at(firstLayer, 0) === leafHash;
+		const root = at(at(proof, proof.length - 1), 0);
+		let hash = leafHash;
+		for (let i = 0; i < proof.length - 1; i++) {
+			const layer = at(proof, i);
+			if (layer.indexOf(hash) === -1) return false;
+			hash = hashMerklePair(at(layer, 0), at(layer, 1));
+			if (at(proof, i + 1).indexOf(hash) === -1) return false;
+		}
+		return hash === root;
+	} catch {
+		return false;
+	}
+};
+//#endregion
+export { buildMerkleLayers, hashMerklePair, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof };

package/dist/fingerprint/dist/proof.js

@@ -0,0 +1,95 @@
+import { buildMerkleLayers, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof } from "./merkle.js";
+import { hexHash } from "@prosopo/util-crypto";
+/**
+* The fixed set of components the client discloses in a proof of fingerprint.
+* Disclosing every component (the previous default) made the proof enormous —
+* each disclosure carries a full Merkle path and its raw value, and components
+* like webgl/audio/fonts have very large values. Selective disclosure keeps the
+* commitment (`root`) over the whole component set while only these cheap,
+* stable scalar components carry a path + value, shrinking the payload ~10x.
+*
+* The provider-side validator's bounds MUST be a subset of these keys: a bounded
+* key that isn't disclosed would always fail validation as `missing:<key>`.
+*/
+var FINGERPRINT_DISCLOSURE_KEYS = [
+	"colorDepth",
+	"cookiesEnabled",
+	"sessionStorage",
+	"localStorage",
+	"timezone",
+	"hardwareConcurrency",
+	"languages",
+	"architecture",
+	"deviceBucket"
+];
+var escapeKey = (key) => key.replace(/([:|\\])/g, "\\$1");
+var componentLeafContent = (key, component) => {
+	const serialized = "error" in component ? "error" : JSON.stringify(component.value);
+	return `${escapeKey(key)}:${serialized}`;
+};
+var disclosureLeafContent = (disclosure) => {
+	const serialized = disclosure.error ? "error" : JSON.stringify(disclosure.value);
+	return `${escapeKey(disclosure.key)}:${serialized}`;
+};
+var leafHashForContent = (content) => hexHash(content);
+/**
+* Build a {@link FingerprintProof} from an already-resolved FingerprintJS
+* components map. The commitment always covers every component (in sorted key
+* order); `discloseKeys` selects which components are revealed (defaulting to
+* all). Keys that are not present in the fingerprint are skipped — a validator
+* should treat an expected-but-absent disclosure as a failure.
+*/
+var buildFingerprintProofFromComponents = (components, discloseKeys) => {
+	const keys = Object.keys(components).sort();
+	if (keys.length === 0) throw new Error("fingerprint proof: no components to commit to");
+	const leafHashes = keys.map((key) => {
+		const component = components[key];
+		if (component === void 0) throw new Error(`fingerprint proof: missing component ${key}`);
+		return leafHashForContent(componentLeafContent(key, component));
+	});
+	const layers = buildMerkleLayers(leafHashes);
+	const root = merkleRootFromLayers(layers);
+	const disclose = discloseKeys ?? keys;
+	const disclosures = [];
+	for (const key of disclose) {
+		const index = keys.indexOf(key);
+		if (index === -1) continue;
+		const component = components[key];
+		const leafHash = leafHashes[index];
+		if (component === void 0 || leafHash === void 0) continue;
+		const proof = merkleProofFromLayers(layers, leafHash);
+		disclosures.push("error" in component ? {
+			key,
+			error: true,
+			proof
+		} : {
+			key,
+			value: component.value,
+			proof
+		});
+	}
+	return {
+		v: 1,
+		root,
+		disclosures
+	};
+};
+/**
+* Structural verification of a proof: every disclosed `(key, value)` re-hashes
+* to a leaf that is proven to belong to the single committed `root`. This is
+* the non-secret half of validation — the value-bounding rules live in the
+* provider-side (closed-source) validator and are layered on top of this.
+*/
+var verifyFingerprintProofStructure = (proof) => {
+	if (proof.v !== 1) return false;
+	if (typeof proof.root !== "string" || proof.disclosures.length === 0) return false;
+	for (const disclosure of proof.disclosures) {
+		if (!verifyMerkleProof(leafHashForContent(disclosureLeafContent(disclosure)), disclosure.proof)) return false;
+		const rootLayer = disclosure.proof[disclosure.proof.length - 1];
+		if (rootLayer === void 0 || rootLayer[0] !== proof.root) return false;
+	}
+	return true;
+};
+var encodeFingerprintProof = (proof) => JSON.stringify(proof);
+//#endregion
+export { FINGERPRINT_DISCLOSURE_KEYS, buildFingerprintProofFromComponents, encodeFingerprintProof, leafHashForContent, verifyFingerprintProofStructure };

package/dist/fingerprint/dist/summary.js

@@ -0,0 +1,73 @@
+import { verifyFingerprintProofStructure } from "./proof.js";
+import { hexHash } from "@prosopo/util-crypto";
+//#region ../fingerprint/dist/summary.js
+/**
+* The disclosed keys that are fixed by the installation and the host. A hash
+* over them names a cohort of devices.
+*
+* `colorDepth` and `hardwareConcurrency` are disclosed too but kept out of the
+* hash and stored beside it, so that the values can be read per cohort rather
+* than only folded into it.
+*/
+var GROUP_KEYS = [
+	"cookiesEnabled",
+	"sessionStorage",
+	"localStorage",
+	"timezone",
+	"languages",
+	"architecture"
+];
+var asNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+/**
+* Reduce an encoded proof to the fields worth storing, or `undefined` when it
+* is absent, unparseable, or fails structural verification.
+*
+* Structural verification is not optional here: an unverified disclosure is a
+* client-asserted value with a decorative Merkle path beside it, and storing
+* one would put a forgeable field into an aggregation that reads as
+* tamper-evident. Whether the values are *plausible* is a separate concern and
+* stays in the routing machine's validator; this only refuses what does not
+* hash together.
+*/
+var summariseFingerprintProof = (encoded) => {
+	if (!encoded) return void 0;
+	let proof;
+	try {
+		proof = JSON.parse(encoded);
+	} catch {
+		return;
+	}
+	if (typeof proof !== "object" || proof === null || typeof proof.root !== "string" || !Array.isArray(proof.disclosures)) return;
+	if (!verifyFingerprintProofStructure(proof)) return void 0;
+	const byKey = /* @__PURE__ */ new Map();
+	for (const disclosure of proof.disclosures) if (!disclosure.error) byKey.set(disclosure.key, disclosure.value);
+	const groupInput = GROUP_KEYS.map((key) => `${key}:${JSON.stringify(byKey.get(key) ?? null)}`).join("|");
+	const disclosed = {};
+	const timezone = byKey.get("timezone");
+	if (typeof timezone === "string") disclosed.timezone = timezone;
+	const languages = byKey.get("languages");
+	if (languages !== void 0) disclosed.languages = JSON.stringify(languages);
+	const architecture = asNumber(byKey.get("architecture"));
+	if (architecture !== void 0) disclosed.architecture = architecture;
+	for (const key of [
+		"cookiesEnabled",
+		"sessionStorage",
+		"localStorage"
+	]) {
+		const value = byKey.get(key);
+		if (typeof value === "boolean") disclosed[key] = value;
+	}
+	const bucketId = byKey.get("deviceBucket");
+	const colorDepth = asNumber(byKey.get("colorDepth"));
+	const hardwareConcurrency = asNumber(byKey.get("hardwareConcurrency"));
+	return {
+		root: proof.root,
+		groupHash: hexHash(groupInput),
+		...typeof bucketId === "string" && bucketId !== "" && { bucketId },
+		...colorDepth !== void 0 && { colorDepth },
+		...hardwareConcurrency !== void 0 && { hardwareConcurrency },
+		...Object.keys(disclosed).length > 0 && { disclosed }
+	};
+};
+//#endregion
+export { summariseFingerprintProof };

package/dist/index.js

@@ -17,9 +17,9 @@ import { createApiAdminRoutesProvider } from "./api/admin/createApiAdminRoutesPr
 import { headerCheckMiddleware } from "./api/headerCheckMiddleware.js";
 import { ignoreMiddleware } from "./api/ignoreMiddleware.js";
 import { robotsMiddleware } from "./api/robotsMiddleware.js";
-import { getClientApiPathsExpectingProsopoHeaders, getUserFromJWT, isTlsAvailable, providerCorsOptions, startProviderApi } from "./api/startProviderApi.js";
+import { getClientApiPathsExpectingProsopoHeaders, getServerVerifyPaths, getUserFromJWT, isTlsAvailable, providerCorsOptions, startProviderApi } from "./api/startProviderApi.js";
 import { migrateFrictionlessLadder, runFrictionlessLadderMigration } from "./migrations/frictionlessLadder.js";
 import { storeCaptchasExternally } from "./schedulers/captchaScheduler.js";
 import { getClientList } from "./schedulers/getClientList.js";
 import { updateSpamEmailDomainsScheduler } from "./schedulers/updateSpamEmailDomains.js";
-export { BlacklistRequestInspector, DEFAULT_JA4, FrictionlessReason, Tasks, asyncHandler, blockMiddleware, checkIfTaskIsRunning, compareIPs, createApiAdminRoutesProvider, deepValidateIpAddress, domainMiddleware, encodeStringAddress, evaluateIpValidationRules, getClientApiPathsExpectingProsopoHeaders, getClientList, getCompositeIpAddress, getHandshakeTiming, getIPAddress, getIPAddressFromBigInt, getIpAddressFromComposite, getJA4, getPrioritisedAccessRule, getRequestUserScope, getUserFromJWT, getVerdictCache, handshakeTimingMiddleware, headerCheckMiddleware, ignoreMiddleware, isSameIpOrigin, isTlsAvailable, ja4Middleware, migrateFrictionlessLadder, normalizeHeadersForMatching, prosopoRouter, prosopoVerifyRouter, providerCorsOptions, publicRouter, rankCandidateRules, robotsMiddleware, runFrictionlessLadderMigration, shuffleArray, startProviderApi, storeCaptchasExternally, updateSpamEmailDomains, updateSpamEmailDomainsScheduler, validateIpAddress };
+export { BlacklistRequestInspector, DEFAULT_JA4, FrictionlessReason, Tasks, asyncHandler, blockMiddleware, checkIfTaskIsRunning, compareIPs, createApiAdminRoutesProvider, deepValidateIpAddress, domainMiddleware, encodeStringAddress, evaluateIpValidationRules, getClientApiPathsExpectingProsopoHeaders, getClientList, getCompositeIpAddress, getHandshakeTiming, getIPAddress, getIPAddressFromBigInt, getIpAddressFromComposite, getJA4, getPrioritisedAccessRule, getRequestUserScope, getServerVerifyPaths, getUserFromJWT, getVerdictCache, handshakeTimingMiddleware, headerCheckMiddleware, ignoreMiddleware, isSameIpOrigin, isTlsAvailable, ja4Middleware, migrateFrictionlessLadder, normalizeHeadersForMatching, prosopoRouter, prosopoVerifyRouter, providerCorsOptions, publicRouter, rankCandidateRules, robotsMiddleware, runFrictionlessLadderMigration, shuffleArray, startProviderApi, storeCaptchasExternally, updateSpamEmailDomains, updateSpamEmailDomainsScheduler, validateIpAddress };

package/dist/tasks/captchaManager.d.ts

@@ -18,7 +18,6 @@ export interface HardBlockRecordView {
     dappAccount: string;
     ipAddress: CompositeIpAddress;
     ja4: string;
-    sessionId?: string;
 }
 export declare class CaptchaManager {
     pair: KeyringPair;
@@ -74,9 +73,9 @@ export declare class CaptchaManager {
     resolveBundleBySessionId(sessionId?: string): Promise<PoolBundleDecrypt | undefined>;
     decryptSimdReadings(encryptedData: string, bundle: PoolBundleDecrypt | undefined): Promise<SimdReadingsResult | null>;
     decryptBehavioralData(encryptedData: string, bundle: PoolBundleDecrypt | undefined): Promise<BehavioralDataResult | null>;
-    checkForHardBlock(userAccessRulesStorage: AccessRulesStorage, challengeRecord: HardBlockRecordView, userAccount: string, headers: RequestHeaders, coords?: [number, number][][], countryCode?: string, asn?: number): Promise<AccessRule | undefined>;
+    checkForHardBlock(userAccessRulesStorage: AccessRulesStorage, challengeRecord: HardBlockRecordView, userAccount: string, headers: RequestHeaders, headHash: string | undefined, coords?: [number, number][][], countryCode?: string, asn?: number): Promise<AccessRule | undefined>;
     checkSpamEmail(email: string): Promise<boolean>;
-    resolveTrafficFilterCheck(env: ProviderEnvironment, recordIpInfo: IPInfoResponse | undefined, trafficFilter: Partial<ITrafficFilter> | undefined, currentIp?: string, enrichedDnsEvent?: EnrichedDnsEvent): Promise<TrafficCheckResult>;
+    resolveTrafficFilterCheck(recordIpInfo: IPInfoResponse | undefined, trafficFilter: Partial<ITrafficFilter> | undefined, currentIpInfo?: IPInfoResponse, enrichedDnsEvent?: EnrichedDnsEvent): Promise<TrafficCheckResult>;
     static canClientSeeScore(tier: Tier, score?: number): boolean;
 }
 //# sourceMappingURL=captchaManager.d.ts.map

package/dist/tasks/captchaManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EAGJ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAYrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IAMpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAmCD,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAmD3B,wBAAwB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC;QACV,WAAW,CAAC,EAAE,oBAAoB,CAAC;QACnC,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KAC5C,CAAC;IA+DW,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAwWF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,WAAW,EACxB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;;;;;;;IAoBb,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EAGtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAGpB,eAAe,CAAC,EAAE,OAAO,CAAC;QAK1B,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAgBF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAsBpE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IA6BlE,OAAO,CAAC,2BAA2B;IAgB7B,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAuCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,mBAAmB,EACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GAIV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA0D5B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IA4C9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;CAG7D"}
+{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EAGJ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAYrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IAMpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAmCD,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAmD3B,wBAAwB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC;QACV,WAAW,CAAC,EAAE,oBAAoB,CAAC;QACnC,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KAC5C,CAAC;IA+DW,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAwWF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,WAAW,EACxB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;;;;;;;IAoBb,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EAGtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAGpB,eAAe,CAAC,EAAE,OAAO,CAAC;QAK1B,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAgBF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAsBpE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IA6BlE,OAAO,CAAC,2BAA2B;IAgB7B,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAuCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,mBAAmB,EACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EAEvB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GAIV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAiD5B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6B/C,yBAAyB,CAC9B,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,aAAa,CAAC,EAAE,cAAc,EAC9B,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAwC9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;CAG7D"}

package/dist/tasks/captchaManager.js

@@ -552,9 +552,7 @@ var CaptchaManager = class CaptchaManager {
 	*
 	* @returns The blocking policy if user should be blocked, undefined otherwise
 	*/
-	async checkForHardBlock(userAccessRulesStorage, challengeRecord, userAccount, headers, coords, countryCode, asn) {
-		let headHash;
-		if (challengeRecord.sessionId) headHash = (await this.db.getSessionRecordBySessionId(challengeRecord.sessionId))?.decryptedHeadHash;
+	async checkForHardBlock(userAccessRulesStorage, challengeRecord, userAccount, headers, headHash, coords, countryCode, asn) {
 		const coordsString = coords ? JSON.stringify(coords) : void 0;
 		const ipAddressRecord = getIpAddressFromComposite(challengeRecord.ipAddress);
 		const userScope = getRequestUserScope(headers, challengeRecord.ja4, ipAddressRecord.address, userAccount, headHash, coordsString, countryCode, asn);
@@ -581,8 +579,9 @@ var CaptchaManager = class CaptchaManager {
 	*   time (ipInfoMiddleware → storeXxxRecord), so by default we reuse it
 	*   instead of hitting the sidecar again.
 	* - If the dapp's server passed up the end user's current IP via the
-	*   verify call, look that up fresh — it's the "now" IP for filtering
-	*   and may differ from the IP that originally requested the captcha.
+	*   verify call, the caller looks that up fresh and passes the result as
+	*   `currentIpInfo` — it's the "now" IP for filtering and may differ from
+	*   the IP that originally requested the captcha.
 	* - When the session carries a `dnsEvent`, its `peerIp` and `resolverIp`
 	*   are enriched and passed alongside the primary IP.
 	* - The abuser category defaults to `{action:"block"}` so abusive
@@ -595,7 +594,7 @@ var CaptchaManager = class CaptchaManager {
 	* updates record / session state differently); this helper just returns
 	* the verdict.
 	*/
-	async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp, enrichedDnsEvent) {
+	async resolveTrafficFilterCheck(recordIpInfo, trafficFilter, currentIpInfo, enrichedDnsEvent) {
 		const effective = {
 			abuser: { action: TrafficFilterAction.Block },
 			...trafficFilter
@@ -604,7 +603,7 @@ var CaptchaManager = class CaptchaManager {
 			isBlocked: false,
 			matches: []
 		};
-		return checkTrafficFilter(currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo, effective, extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
+		return checkTrafficFilter(currentIpInfo ?? recordIpInfo, effective, extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}
 	/**
 	* Does this client's tier entitle it to the bot score, and is there one?