@prosopo/provider 5.19.4 → 5.20.0

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -11,6 +11,7 @@ const require_frictionlessTasksUtils = require("../frictionless/frictionlessTask
 const require_powTasksUtils = require("./powTasksUtils.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
 const require_routingMachine = require("../frictionless/routingMachine.cjs");
+const require_backgroundWrites = require("./backgroundWrites.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _polkadot_util = require("@polkadot/util");
@@ -18,6 +19,7 @@ let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _prosopo_util = require("@prosopo/util");
 //#region src/tasks/powCaptcha/powTasks.ts
 var DEFAULT_POW_DIFFICULTY = 4;
+var verifyOutcomeWrites = new require_backgroundWrites.BackgroundWrites(500);
 var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	constructor(db, pair, config, logger, writeQueue, usageCounters) {
 		super(db, pair, config, logger, writeQueue);
@@ -65,7 +67,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @param behavioralData
 	* @param salt
 	*/
-	async verifyPowCaptchaSolution(challenge, providerChallengeSignature, nonce, timeout, userTimestampSignature, ipAddress, headers, behavioralData, salt, simdReadings, clientMetaData) {
+	async verifyPowCaptchaSolution(challenge, providerChallengeSignature, nonce, timeout, userTimestampSignature, ipAddress, headers, behavioralData, salt, simdReadings, clientMetaData, fingerprintSummary) {
 		require_powTasksUtils.checkPowSignature(challenge, providerChallengeSignature, this.pair.address, _prosopo_types.ApiParams.challenge);
 		const challengeSplit = challenge.split(this.POW_SEPARATOR);
 		const timestamp = Number.parseInt((0, _prosopo_util.at)(challengeSplit, 0));
@@ -134,7 +136,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		};
 		if (correct && this.usageCounters) {
 			const dappAccount = (0, _prosopo_util.at)(challengeSplit, 2);
-			this.usageCounters.incrManyAsync(dappAccount, require_usageCounters.buildAllWindowIncrements("solved", _prosopo_types.CaptchaType.pow, ipAddress.address, userAccount));
+			this.usageCounters.incrManyAsync(dappAccount, require_usageCounters.buildAllWindowIncrements("solved", _prosopo_types.CaptchaType.pow, ipAddress.address, userAccount, void 0, fingerprintSummary?.bucketId));
 		}
 		let behavioralUpdates = {};
 		let decryptedBehavioralDataPacked;
@@ -180,6 +182,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			}));
 		}
 		const recordUpdates = { ...behavioralUpdates };
+		if (fingerprintSummary) recordUpdates.fingerprintSummary = fingerprintSummary;
 		const storedClientMetaData = require_clientMetaData.toStoredClientMetaData(clientMetaData);
 		if (storedClientMetaData) recordUpdates.clientMetaData = storedClientMetaData;
 		if (Object.keys(recordUpdates).length > 0) await this.db.updatePowCaptchaRecord(challenge, recordUpdates);
@@ -294,8 +297,10 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @param clientSessionId - the session id the site rendered the widget
 	*   with. When supplied, the solve must carry the same value in its
 	*   `clientMetaData` or it is disapproved.
+	* @param ipValidationRules - the site's rules for comparing `ip` with the
+	*   ip the challenge was issued to.
 	*/
-	async serverVerifyPowCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId) {
+	async serverVerifyPowCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId, ipValidationRules) {
 		const notVerified = (reason, sessionId) => ({
 			verified: false,
 			reason,
@@ -310,18 +315,26 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
 			return notVerified("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND");
 		}
-		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoApiError("CAPTCHA.INVALID_SOLUTION", { context: {
-			code: 400,
-			failedFuncName: this.serverVerifyPowCaptchaSolution.name,
-			challenge
-		} });
+		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_SOLUTION",
+			errorSite: "PROV-73",
+			context: {
+				failedFuncName: this.serverVerifyPowCaptchaSolution.name,
+				challenge
+			}
+		});
 		if (challengeRecord.serverChecked) return notVerified("API.USER_ALREADY_VERIFIED", challengeRecord.sessionId);
 		const challengeDappAccount = challengeRecord.dappAccount;
-		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
-			failedFuncName: this.serverVerifyPowCaptchaSolution.name,
-			dappAccount,
-			challengeDappAccount
-		} });
+		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoError({
+			code: "SOLUTION_NOT_FOUND",
+			errorSite: "PROV-74",
+			message: "Dapp user solution not found",
+			context: {
+				failedFuncName: this.serverVerifyPowCaptchaSolution.name,
+				dappAccount,
+				challengeDappAccount
+			}
+		});
 		if (await this.db.markDappUserPoWCommitmentsChecked([challengeRecord.challenge]) === 0) return notVerified("API.USER_ALREADY_VERIFIED", challengeRecord.sessionId);
 		const powRecordUpdates = {};
 		let failResult;
@@ -346,8 +359,16 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			};
 			failReason = "API.CLIENT_SESSION_MISMATCH";
 		}
+		const sessionRecordRead = challengeRecord.sessionId ? this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : Promise.resolve(void 0);
+		const enrichedDnsEventRead = sessionRecordRead.then((sessionRecord) => require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip));
+		const currentIpInfoRead = ip && !failResult ? env.ipInfoService.lookup(ip) : Promise.resolve(void 0);
+		for (const read of [
+			sessionRecordRead,
+			enrichedDnsEventRead,
+			currentIpInfoRead
+		]) read.catch(() => void 0);
 		if (!failResult && userAccessRulesStorage) try {
-			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, (await sessionRecordRead)?.decryptedHeadHash, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
 			if (blockPolicy) {
 				logger.info(() => ({
 					msg: "User blocked by access policy in server PoW verification",
@@ -429,10 +450,10 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				}));
 			}
 		}
-		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
-		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
+		const sessionRecord = await sessionRecordRead;
+		const enrichedDnsEvent = await enrichedDnsEventRead;
 		if (!failResult) {
-			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			const check = await this.resolveTrafficFilterCheck(challengeRecord.ipInfo, trafficFilter, await currentIpInfoRead, enrichedDnsEvent);
 			if (check.isBlocked) {
 				logger.info(() => ({
 					msg: "Traffic filter rejected request in PoW verification",
@@ -459,7 +480,6 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		};
 		if (!failResult && ip) {
 			const challengeIpAddress = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
-			const ipValidationRules = (await this.db.getClientRecord(dappAccount))?.settings?.ipValidationRules;
 			powRecordUpdates.providedIp = require_compositeIpAddress.getCompositeIpAddress(ip);
 			if (ipValidationRules?.enabled === true) {
 				const ipValidation = await require_util.deepValidateIpAddress(ip, challengeIpAddress, logger, env.ipInfoService, ipValidationRules, enrichedDnsEvent?.peerIp);
@@ -569,7 +589,12 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.pow, finalResult) && { blocked: true },
 			...matchedRule && { matchedRule }
 		}, true));
-		if (writePromises.length > 0) await Promise.all(writePromises);
+		await verifyOutcomeWrites.add(Promise.all(writePromises), (err) => {
+			logger.error(() => ({
+				msg: "Failed to record the outcome of a PoW verification",
+				err
+			}));
+		});
 		if (failReason) return notVerified(failReason, challengeRecord.sessionId);
 		return {
 			verified: true,

package/dist/cjs/tasks/powCaptcha/powTasksUtils.cjs

@@ -1,19 +1,23 @@
+const require_signatureCheck = require("../signatureCheck.cjs");
 let _prosopo_common = require("@prosopo/common");
-let _polkadot_util = require("@polkadot/util");
 let _prosopo_util = require("@prosopo/util");
-let _prosopo_util_crypto = require("@prosopo/util-crypto");
 let _noble_hashes_sha2_js = require("@noble/hashes/sha2.js");
 //#region src/tasks/powCaptcha/powTasksUtils.ts
 var validateSolution = (nonce, challenge, difficulty) => (0, _prosopo_util.hashMeetsDifficulty)((0, _noble_hashes_sha2_js.sha256)(new TextEncoder().encode(nonce + challenge)), difficulty);
 var checkPowSignature = (message, signature, address, signatureType) => {
-	if (!(0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(message), signature, address).isValid) throw new _prosopo_common.ProsopoApiError("GENERAL.INVALID_SIGNATURE", { context: {
-		ERROR: `Signature is invalid for this message: ${signatureType}`,
-		failedFuncName: checkPowSignature.name,
-		address,
-		message,
-		signature,
-		signatureType
-	} });
+	if (!require_signatureCheck.isSignatureValid(message, signature, address)) throw new _prosopo_common.ProsopoError({
+		code: "UNAUTHORIZED",
+		errorSite: "PROV-75",
+		message: "Invalid signature",
+		context: {
+			ERROR: `Signature is invalid for this message: ${signatureType}`,
+			failedFuncName: checkPowSignature.name,
+			address,
+			message,
+			signature,
+			signatureType
+		}
+	});
 };
 var isCoordsAllZero = (coords) => coords !== void 0 && coords.length > 0 && coords.every((group) => group.length > 0 && group.every(([x, y]) => x === 0 && y === 0));
 //#endregion

package/dist/cjs/tasks/signatureCheck.cjs

@@ -0,0 +1,12 @@
+let _polkadot_util = require("@polkadot/util");
+let _prosopo_util_crypto = require("@prosopo/util-crypto");
+//#region src/tasks/signatureCheck.ts
+var isSignatureValid = (message, signature, address) => {
+	try {
+		return (0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(message), signature, address).isValid;
+	} catch {
+		return false;
+	}
+};
+//#endregion
+exports.isSignatureValid = isSignatureValid;

package/dist/cjs/tasks/tasks.cjs

@@ -23,7 +23,12 @@ var Tasks = class {
 		this.db = env.getDb();
 		this.captchaConfig = env.config.captchas;
 		this.logger = logger || (0, _prosopo_logger.getLogger)((0, _prosopo_logger.parseLogLevel)(env.config.logLevel), "Tasks");
-		if (!env.pair) throw new _prosopo_common.ProsopoEnvError("DEVELOPER.MISSING_PROVIDER_PAIR", { context: { failedFuncName: "Tasks.constructor" } });
+		if (!env.pair) throw new _prosopo_common.ProsopoError({
+			code: "CONFIG_INVALID",
+			errorSite: "PROV-76",
+			message: "Missing provider pair",
+			context: { failedFuncName: "Tasks.constructor" }
+		});
 		this.pair = env.pair;
 		if (this.config.mongoCaptchaUri && this.db instanceof _prosopo_database.ProviderDatabase && !this.db.hasCentralDbStreamer()) {
 			const streamer = new _prosopo_database.CentralDbStreamer(this.config.mongoCaptchaUri, this.logger);

package/dist/cjs/util/usageCounters.cjs

@@ -152,10 +152,15 @@ var UsageCounters = class {
 	}
 };
 /**
-* Helper: produce the standard 24-counter served/solved write set for a given
-* captcha challenge. Used by both served (post-session) and solved hooks.
+* Helper: produce the standard served/solved write set for a given captcha
+* challenge. Used by both served (post-session) and solved hooks.
+*
+* `deviceBucket` is only written when the caller knows one, which for now is
+* the PoW solve path with a verified proof of fingerprint. Omitting it leaves
+* the key absent rather than at zero, so a bucket's count is over the requests
+* that actually proved it.
 */
-var buildAllWindowIncrements = (kind, captchaType, ip, userAccount, peerIp) => {
+var buildAllWindowIncrements = (kind, captchaType, ip, userAccount, peerIp, deviceBucket) => {
 	const out = [];
 	for (const window of [
 		"1m",
@@ -191,6 +196,15 @@ var buildAllWindowIncrements = (kind, captchaType, ip, userAccount, peerIp) => {
 			},
 			value: peerIp
 		});
+		if (deviceBucket) out.push({
+			spec: {
+				kind,
+				captchaType,
+				dimension: "deviceBucket",
+				window
+			},
+			value: deviceBucket
+		});
 		if (captchaType !== "any") {
 			out.push({
 				spec: {
@@ -218,6 +232,15 @@ var buildAllWindowIncrements = (kind, captchaType, ip, userAccount, peerIp) => {
 				},
 				value: peerIp
 			});
+			if (deviceBucket) out.push({
+				spec: {
+					kind,
+					captchaType: "any",
+					dimension: "deviceBucket",
+					window
+				},
+				value: deviceBucket
+			});
 		}
 	}
 	return out;

package/dist/cjs/util.cjs

@@ -11,7 +11,12 @@ function encodeStringAddress(address) {
 	try {
 		return (0, _prosopo_util_crypto.encodeAddress)((0, _polkadot_util_is.isHex)(address) ? (0, _polkadot_util_hex.hexToU8a)(address) : (0, _prosopo_util_crypto.decodeAddress)(address));
 	} catch (err) {
-		throw new _prosopo_common.ProsopoContractError("CONTRACT.INVALID_ADDRESS", { context: { address } });
+		throw new _prosopo_common.ProsopoError({
+			code: "INVALID_DATA",
+			errorSite: "PROV-77",
+			message: "Failed to encode invalid address",
+			context: { address }
+		});
 	}
 }
 function shuffleArray(array) {
@@ -43,7 +48,10 @@ var getIPAddress = (ipAddressString) => {
 			return new ip_address.Address6(ipAddressString);
 		}
 	} catch (e) {
-		throw new _prosopo_common.ProsopoEnvError("API.INVALID_IP");
+		throw new _prosopo_common.ProsopoError({
+			code: "INVALID_IP",
+			errorSite: "PROV-78"
+		});
 	}
 };
 var getIPAddressFromBigInt = (ipAddressBigInt) => {
@@ -51,7 +59,10 @@ var getIPAddressFromBigInt = (ipAddressBigInt) => {
 		if (ipAddressBigInt > 4228250626n) return ip_address.Address6.fromBigInt(BigInt(ipAddressBigInt));
 		return ip_address.Address4.fromBigInt(BigInt(ipAddressBigInt));
 	} catch (e) {
-		throw new _prosopo_common.ProsopoEnvError("API.INVALID_IP");
+		throw new _prosopo_common.ProsopoError({
+			code: "INVALID_IP",
+			errorSite: "PROV-79"
+		});
 	}
 };
 /**

package/dist/errorSites.d.ts

@@ -0,0 +1,98 @@
+declare module "@prosopo/common" {
+    interface ErrorSites {
+        "PROV-1": true;
+        "PROV-2": true;
+        "PROV-3": true;
+        "PROV-4": true;
+        "PROV-5": true;
+        "PROV-6": true;
+        "PROV-7": true;
+        "PROV-8": true;
+        "PROV-9": true;
+        "PROV-10": true;
+        "PROV-11": true;
+        "PROV-12": true;
+        "PROV-13": true;
+        "PROV-14": true;
+        "PROV-15": true;
+        "PROV-16": true;
+        "PROV-17": true;
+        "PROV-18": true;
+        "PROV-19": true;
+        "PROV-20": true;
+        "PROV-21": true;
+        "PROV-22": true;
+        "PROV-23": true;
+        "PROV-24": true;
+        "PROV-25": true;
+        "PROV-26": true;
+        "PROV-27": true;
+        "PROV-28": true;
+        "PROV-29": true;
+        "PROV-30": true;
+        "PROV-31": true;
+        "PROV-32": true;
+        "PROV-33": true;
+        "PROV-34": true;
+        "PROV-35": true;
+        "PROV-37": true;
+        "PROV-38": true;
+        "PROV-39": true;
+        "PROV-40": true;
+        "PROV-41": true;
+        "PROV-42": true;
+        "PROV-43": true;
+        "PROV-44": true;
+        "PROV-45": true;
+        "PROV-46": true;
+        "PROV-47": true;
+        "PROV-48": true;
+        "PROV-49": true;
+        "PROV-50": true;
+        "PROV-51": true;
+        "PROV-52": true;
+        "PROV-53": true;
+        "PROV-54": true;
+        "PROV-55": true;
+        "PROV-56": true;
+        "PROV-57": true;
+        "PROV-58": true;
+        "PROV-59": true;
+        "PROV-60": true;
+        "PROV-61": true;
+        "PROV-62": true;
+        "PROV-63": true;
+        "PROV-64": true;
+        "PROV-65": true;
+        "PROV-66": true;
+        "PROV-67": true;
+        "PROV-68": true;
+        "PROV-69": true;
+        "PROV-70": true;
+        "PROV-71": true;
+        "PROV-72": true;
+        "PROV-73": true;
+        "PROV-74": true;
+        "PROV-75": true;
+        "PROV-76": true;
+        "PROV-77": true;
+        "PROV-78": true;
+        "PROV-79": true;
+        "PROV-80": true;
+        "PROV-81": true;
+        "PROV-82": true;
+        "PROV-83": true;
+        "PROV-84": true;
+        "PROV-85": true;
+        "PROV-86": true;
+        "PROV-87": true;
+        "PROV-88": true;
+        "PROV-89": true;
+        "PROV-90": true;
+        "PROV-91": true;
+        "PROV-92": true;
+        "PROV-93": true;
+    }
+}
+export {};
+//# sourceMappingURL=errorSites.d.ts.map

package/dist/errorSites.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorSites.d.ts","sourceRoot":"","sources":["../src/errorSites.ts"],"names":[],"mappings":"AAcA,OAAO,QAAQ,iBAAiB,CAAC;IAChC,UAAU,UAAU;QACnB,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;KAChB;CACD;AAED,OAAO,EAAE,CAAC"}

package/dist/errorSites.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=errorSites.js.map

package/dist/errorSites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorSites.js","sourceRoot":"","sources":["../src/errorSites.ts"],"names":[],"mappings":""}

package/dist/fingerprint/dist/merkle.js

@@ -0,0 +1,69 @@
+import { hexHashArray } from "@prosopo/util-crypto";
+//#region ../fingerprint/dist/merkle.js
+var at = (arr, index) => {
+	const value = arr[index];
+	if (value === void 0) throw new Error(`merkle: index ${index} out of range (length ${arr.length})`);
+	return value;
+};
+/** Hash a pair of child hashes into their parent. */
+var hashMerklePair = (left, right) => hexHashArray([left, right]);
+/**
+* Build every layer of the Merkle tree, bottom-up. Layer 0 is the leaf hashes,
+* the final layer is `[root]`. An odd node at the end of a layer is paired with
+* itself.
+*/
+var buildMerkleLayers = (leafHashes) => {
+	if (leafHashes.length === 0) throw new Error("merkle: cannot build a tree with no leaves");
+	const layers = [[...leafHashes]];
+	let current = leafHashes;
+	while (current.length > 1) {
+		const next = [];
+		for (let i = 0; i < current.length; i += 2) {
+			const left = at(current, i);
+			const right = i + 1 < current.length ? at(current, i + 1) : left;
+			next.push(hashMerklePair(left, right));
+		}
+		layers.push(next);
+		current = next;
+	}
+	return layers;
+};
+var merkleRootFromLayers = (layers) => at(at(layers, layers.length - 1), 0);
+/** Produce the sibling path proving `leafHash` belongs to the tree. */
+var merkleProofFromLayers = (layers, leafHash) => {
+	const proof = [];
+	let hash = leafHash;
+	for (let layerNum = 0; layerNum < layers.length - 1; layerNum++) {
+		const layer = at(layers, layerNum);
+		const index = layer.indexOf(hash);
+		if (index === -1) throw new Error("merkle: leaf hash not present in layer");
+		let partnerIndex = index % 2 === 1 ? index - 1 : index + 1;
+		if (partnerIndex > layer.length - 1) partnerIndex = index;
+		const partner = at(layer, partnerIndex);
+		const pair = partnerIndex > index ? [hash, partner] : [partner, hash];
+		proof.push(pair);
+		hash = hashMerklePair(pair[0], pair[1]);
+	}
+	return [...proof, [merkleRootFromLayers(layers)]];
+};
+/** Verify a leaf + sibling path recomputes to the proof's embedded root. */
+var verifyMerkleProof = (leafHash, proof) => {
+	try {
+		const firstLayer = proof[0];
+		if (firstLayer === void 0 || firstLayer.indexOf(leafHash) === -1) return false;
+		if (proof.length === 1) return at(firstLayer, 0) === leafHash;
+		const root = at(at(proof, proof.length - 1), 0);
+		let hash = leafHash;
+		for (let i = 0; i < proof.length - 1; i++) {
+			const layer = at(proof, i);
+			if (layer.indexOf(hash) === -1) return false;
+			hash = hashMerklePair(at(layer, 0), at(layer, 1));
+			if (at(proof, i + 1).indexOf(hash) === -1) return false;
+		}
+		return hash === root;
+	} catch {
+		return false;
+	}
+};
+//#endregion
+export { buildMerkleLayers, hashMerklePair, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof };

package/dist/fingerprint/dist/proof.js

@@ -0,0 +1,95 @@
+import { buildMerkleLayers, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof } from "./merkle.js";
+import { hexHash } from "@prosopo/util-crypto";
+/**
+* The fixed set of components the client discloses in a proof of fingerprint.
+* Disclosing every component (the previous default) made the proof enormous —
+* each disclosure carries a full Merkle path and its raw value, and components
+* like webgl/audio/fonts have very large values. Selective disclosure keeps the
+* commitment (`root`) over the whole component set while only these cheap,
+* stable scalar components carry a path + value, shrinking the payload ~10x.
+*
+* The provider-side validator's bounds MUST be a subset of these keys: a bounded
+* key that isn't disclosed would always fail validation as `missing:<key>`.
+*/
+var FINGERPRINT_DISCLOSURE_KEYS = [
+	"colorDepth",
+	"cookiesEnabled",
+	"sessionStorage",
+	"localStorage",
+	"timezone",
+	"hardwareConcurrency",
+	"languages",
+	"architecture",
+	"deviceBucket"
+];
+var escapeKey = (key) => key.replace(/([:|\\])/g, "\\$1");
+var componentLeafContent = (key, component) => {
+	const serialized = "error" in component ? "error" : JSON.stringify(component.value);
+	return `${escapeKey(key)}:${serialized}`;
+};
+var disclosureLeafContent = (disclosure) => {
+	const serialized = disclosure.error ? "error" : JSON.stringify(disclosure.value);
+	return `${escapeKey(disclosure.key)}:${serialized}`;
+};
+var leafHashForContent = (content) => hexHash(content);
+/**
+* Build a {@link FingerprintProof} from an already-resolved FingerprintJS
+* components map. The commitment always covers every component (in sorted key
+* order); `discloseKeys` selects which components are revealed (defaulting to
+* all). Keys that are not present in the fingerprint are skipped — a validator
+* should treat an expected-but-absent disclosure as a failure.
+*/
+var buildFingerprintProofFromComponents = (components, discloseKeys) => {
+	const keys = Object.keys(components).sort();
+	if (keys.length === 0) throw new Error("fingerprint proof: no components to commit to");
+	const leafHashes = keys.map((key) => {
+		const component = components[key];
+		if (component === void 0) throw new Error(`fingerprint proof: missing component ${key}`);
+		return leafHashForContent(componentLeafContent(key, component));
+	});
+	const layers = buildMerkleLayers(leafHashes);
+	const root = merkleRootFromLayers(layers);
+	const disclose = discloseKeys ?? keys;
+	const disclosures = [];
+	for (const key of disclose) {
+		const index = keys.indexOf(key);
+		if (index === -1) continue;
+		const component = components[key];
+		const leafHash = leafHashes[index];
+		if (component === void 0 || leafHash === void 0) continue;
+		const proof = merkleProofFromLayers(layers, leafHash);
+		disclosures.push("error" in component ? {
+			key,
+			error: true,
+			proof
+		} : {
+			key,
+			value: component.value,
+			proof
+		});
+	}
+	return {
+		v: 1,
+		root,
+		disclosures
+	};
+};
+/**
+* Structural verification of a proof: every disclosed `(key, value)` re-hashes
+* to a leaf that is proven to belong to the single committed `root`. This is
+* the non-secret half of validation — the value-bounding rules live in the
+* provider-side (closed-source) validator and are layered on top of this.
+*/
+var verifyFingerprintProofStructure = (proof) => {
+	if (proof.v !== 1) return false;
+	if (typeof proof.root !== "string" || proof.disclosures.length === 0) return false;
+	for (const disclosure of proof.disclosures) {
+		if (!verifyMerkleProof(leafHashForContent(disclosureLeafContent(disclosure)), disclosure.proof)) return false;
+		const rootLayer = disclosure.proof[disclosure.proof.length - 1];
+		if (rootLayer === void 0 || rootLayer[0] !== proof.root) return false;
+	}
+	return true;
+};
+var encodeFingerprintProof = (proof) => JSON.stringify(proof);
+//#endregion
+export { FINGERPRINT_DISCLOSURE_KEYS, buildFingerprintProofFromComponents, encodeFingerprintProof, leafHashForContent, verifyFingerprintProofStructure };

package/dist/fingerprint/dist/summary.js

@@ -0,0 +1,73 @@
+import { verifyFingerprintProofStructure } from "./proof.js";
+import { hexHash } from "@prosopo/util-crypto";
+//#region ../fingerprint/dist/summary.js
+/**
+* The disclosed keys that are fixed by the installation and the host. A hash
+* over them names a cohort of devices.
+*
+* `colorDepth` and `hardwareConcurrency` are disclosed too but kept out of the
+* hash and stored beside it, so that the values can be read per cohort rather
+* than only folded into it.
+*/
+var GROUP_KEYS = [
+	"cookiesEnabled",
+	"sessionStorage",
+	"localStorage",
+	"timezone",
+	"languages",
+	"architecture"
+];
+var asNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+/**
+* Reduce an encoded proof to the fields worth storing, or `undefined` when it
+* is absent, unparseable, or fails structural verification.
+*
+* Structural verification is not optional here: an unverified disclosure is a
+* client-asserted value with a decorative Merkle path beside it, and storing
+* one would put a forgeable field into an aggregation that reads as
+* tamper-evident. Whether the values are *plausible* is a separate concern and
+* stays in the routing machine's validator; this only refuses what does not
+* hash together.
+*/
+var summariseFingerprintProof = (encoded) => {
+	if (!encoded) return void 0;
+	let proof;
+	try {
+		proof = JSON.parse(encoded);
+	} catch {
+		return;
+	}
+	if (typeof proof !== "object" || proof === null || typeof proof.root !== "string" || !Array.isArray(proof.disclosures)) return;
+	if (!verifyFingerprintProofStructure(proof)) return void 0;
+	const byKey = /* @__PURE__ */ new Map();
+	for (const disclosure of proof.disclosures) if (!disclosure.error) byKey.set(disclosure.key, disclosure.value);
+	const groupInput = GROUP_KEYS.map((key) => `${key}:${JSON.stringify(byKey.get(key) ?? null)}`).join("|");
+	const disclosed = {};
+	const timezone = byKey.get("timezone");
+	if (typeof timezone === "string") disclosed.timezone = timezone;
+	const languages = byKey.get("languages");
+	if (languages !== void 0) disclosed.languages = JSON.stringify(languages);
+	const architecture = asNumber(byKey.get("architecture"));
+	if (architecture !== void 0) disclosed.architecture = architecture;
+	for (const key of [
+		"cookiesEnabled",
+		"sessionStorage",
+		"localStorage"
+	]) {
+		const value = byKey.get(key);
+		if (typeof value === "boolean") disclosed[key] = value;
+	}
+	const bucketId = byKey.get("deviceBucket");
+	const colorDepth = asNumber(byKey.get("colorDepth"));
+	const hardwareConcurrency = asNumber(byKey.get("hardwareConcurrency"));
+	return {
+		root: proof.root,
+		groupHash: hexHash(groupInput),
+		...typeof bucketId === "string" && bucketId !== "" && { bucketId },
+		...colorDepth !== void 0 && { colorDepth },
+		...hardwareConcurrency !== void 0 && { hardwareConcurrency },
+		...Object.keys(disclosed).length > 0 && { disclosed }
+	};
+};
+//#endregion
+export { summariseFingerprintProof };

package/dist/index.js

@@ -17,9 +17,9 @@ import { createApiAdminRoutesProvider } from "./api/admin/createApiAdminRoutesPr
 import { headerCheckMiddleware } from "./api/headerCheckMiddleware.js";
 import { ignoreMiddleware } from "./api/ignoreMiddleware.js";
 import { robotsMiddleware } from "./api/robotsMiddleware.js";
-import { getClientApiPathsExpectingProsopoHeaders, getUserFromJWT, isTlsAvailable, providerCorsOptions, startProviderApi } from "./api/startProviderApi.js";
+import { getClientApiPathsExpectingProsopoHeaders, getServerVerifyPaths, getUserFromJWT, isTlsAvailable, providerCorsOptions, startProviderApi } from "./api/startProviderApi.js";
 import { migrateFrictionlessLadder, runFrictionlessLadderMigration } from "./migrations/frictionlessLadder.js";
 import { storeCaptchasExternally } from "./schedulers/captchaScheduler.js";
 import { getClientList } from "./schedulers/getClientList.js";
 import { updateSpamEmailDomainsScheduler } from "./schedulers/updateSpamEmailDomains.js";
-export { BlacklistRequestInspector, DEFAULT_JA4, FrictionlessReason, Tasks, asyncHandler, blockMiddleware, checkIfTaskIsRunning, compareIPs, createApiAdminRoutesProvider, deepValidateIpAddress, domainMiddleware, encodeStringAddress, evaluateIpValidationRules, getClientApiPathsExpectingProsopoHeaders, getClientList, getCompositeIpAddress, getHandshakeTiming, getIPAddress, getIPAddressFromBigInt, getIpAddressFromComposite, getJA4, getPrioritisedAccessRule, getRequestUserScope, getUserFromJWT, getVerdictCache, handshakeTimingMiddleware, headerCheckMiddleware, ignoreMiddleware, isSameIpOrigin, isTlsAvailable, ja4Middleware, migrateFrictionlessLadder, normalizeHeadersForMatching, prosopoRouter, prosopoVerifyRouter, providerCorsOptions, publicRouter, rankCandidateRules, robotsMiddleware, runFrictionlessLadderMigration, shuffleArray, startProviderApi, storeCaptchasExternally, updateSpamEmailDomains, updateSpamEmailDomainsScheduler, validateIpAddress };
+export { BlacklistRequestInspector, DEFAULT_JA4, FrictionlessReason, Tasks, asyncHandler, blockMiddleware, checkIfTaskIsRunning, compareIPs, createApiAdminRoutesProvider, deepValidateIpAddress, domainMiddleware, encodeStringAddress, evaluateIpValidationRules, getClientApiPathsExpectingProsopoHeaders, getClientList, getCompositeIpAddress, getHandshakeTiming, getIPAddress, getIPAddressFromBigInt, getIpAddressFromComposite, getJA4, getPrioritisedAccessRule, getRequestUserScope, getServerVerifyPaths, getUserFromJWT, getVerdictCache, handshakeTimingMiddleware, headerCheckMiddleware, ignoreMiddleware, isSameIpOrigin, isTlsAvailable, ja4Middleware, migrateFrictionlessLadder, normalizeHeadersForMatching, prosopoRouter, prosopoVerifyRouter, providerCorsOptions, publicRouter, rankCandidateRules, robotsMiddleware, runFrictionlessLadderMigration, shuffleArray, startProviderApi, storeCaptchasExternally, updateSpamEmailDomains, updateSpamEmailDomainsScheduler, validateIpAddress };