@prosopo/provider 5.20.1 → 5.20.2

package/.turbo/turbo-build$colon$cjs.log

@@ -25,6 +25,8 @@ ViteCommonJSConfig: .
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/icon-order-assets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/fingerprint/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/fingerprintjs/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/web-bot-auth/tsconfig.json'
   ]
 }
@@ -53,6 +55,8 @@ ViteCommonJSConfig: .
     '@prosopo/datasets',
     '@prosopo/icon-order-assets',
     '@prosopo/load-balancer',
+    '@prosopo/fingerprint',
+    '@prosopo/fingerprintjs',
     '@prosopo/web-bot-auth'
   ]
 }
@@ -205,7 +209,7 @@ dist/cjs/tasks/captchaManager.cjs                                             26
 dist/cjs/tasks/powCaptcha/powTasks.cjs                                        26.90 kB │ gzip: 6.49 kB
 dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 29.43 kB │ gzip: 6.66 kB
 
-✓ built in 128ms
+✓ built in 204ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,5 +1,5 @@
 $ tsc --build --verbose
-7:41:19 PM - Projects in this build: 
+9:34:00 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../locale/tsconfig.json
@@ -24,60 +24,66 @@ $ tsc --build --verbose
     * ../datasets/tsconfig.json
     * ../icon-order-assets/tsconfig.json
     * ../load-balancer/tsconfig.json
+    * ../fingerprintjs/tsconfig.json
+    * ../fingerprint/tsconfig.json
     * ../web-bot-auth/tsconfig.json
     * tsconfig.json
 
-7:41:19 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/vite-plugin-modify-exports-files.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/process.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/tests/loggerBrowser.unit.test.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/tests/apiRoute.unit.test.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/objectUtils.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/errorSites.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/types.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/types.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+9:34:00 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types/provider.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/errorSites.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/tests/env.maintenance.unit.test.ts' is older than output '../env/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/errorSites.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/types.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../audio-assets/tsconfig.json' is up to date because newest input '../audio-assets/src/distort.ts' is older than output '../audio-assets/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../audio-assets/tsconfig.json' is up to date because newest input '../audio-assets/src/distort.ts' is older than output '../audio-assets/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/errorSites.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/mocks/data/captchas.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../icon-order-assets/tsconfig.json' is up to date because newest input '../icon-order-assets/src/background.ts' is older than output '../icon-order-assets/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../icon-order-assets/tsconfig.json' is up to date because newest input '../icon-order-assets/src/background.ts' is older than output '../icon-order-assets/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/productionProviderList.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
+9:34:01 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+9:34:01 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.test.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
 
-7:41:19 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+9:34:01 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
+
+9:34:01 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+
+9:34:01 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -26,6 +26,8 @@ ViteEsmConfig: .
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/icon-order-assets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/fingerprint/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/fingerprintjs/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/web-bot-auth/tsconfig.json'
   ]
 }
@@ -54,6 +56,8 @@ ViteEsmConfig: .
     '@prosopo/datasets',
     '@prosopo/icon-order-assets',
     '@prosopo/load-balancer',
+    '@prosopo/fingerprint',
+    '@prosopo/fingerprintjs',
     '@prosopo/web-bot-auth'
   ]
 }
@@ -61,7 +65,7 @@ ViteEsmConfig: .
 vite v8.1.6 building ssr environment for production...
 Bundle build started
 
-✓ 144 modules transformed.
+✓ 141 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js                                        0.04 kB │ gzip: 0.06 kB
@@ -152,11 +156,9 @@ dist/tasks/puzzle/puzzleDifficulty.js                                     2.50 k
 dist/api/forwardVerify.js                                                 2.59 kB │ gzip: 1.10 kB
 dist/tasks/iconOrderCaptcha/iconOrderTasks.js                             2.59 kB │ gzip: 0.98 kB
 dist/utils/mobileSignals.js                                               2.60 kB │ gzip: 0.97 kB
-dist/fingerprint/dist/merkle.js                                           2.69 kB │ gzip: 1.08 kB
 dist/tasks/frictionless/ipMatch.js                                        2.72 kB │ gzip: 1.34 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            2.73 kB │ gzip: 1.07 kB
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip: 0.55 kB
-dist/fingerprint/dist/summary.js                                          2.90 kB │ gzip: 1.27 kB
 dist/index.js                                                             3.04 kB │ gzip: 0.83 kB
 dist/api/admin/apiDnsEventEndpoint.js                                     3.05 kB │ gzip: 1.18 kB
 dist/tasks/detection/getBotScore.js                                       3.29 kB │ gzip: 1.32 kB
@@ -170,7 +172,6 @@ dist/tasks/puzzleCaptcha/puzzleTasks.js                                   3.67 k
 dist/tasks/spam/evaluateEmailSpamRules.js                                 3.84 kB │ gzip: 1.59 kB
 dist/api/admin/apiToggleMaintenanceModeEndpoint.js                        3.85 kB │ gzip: 1.44 kB
 dist/compositeIpAddress.js                                                3.87 kB │ gzip: 1.66 kB
-dist/fingerprint/dist/proof.js                                            3.96 kB │ gzip: 1.64 kB
 dist/tasks/tasks.js                                                       3.98 kB │ gzip: 1.09 kB
 dist/services/ipComparison.js                                             4.04 kB │ gzip: 1.21 kB
 dist/tasks/spam/checkSpamEmail.js                                         4.12 kB │ gzip: 1.12 kB
@@ -194,7 +195,7 @@ dist/api/healthzGeo.js                                                    6.86 k
 dist/tasks/spam/checkTrafficFilter.js                                     8.49 kB │ gzip: 2.84 kB
 dist/tasks/detection/bundlePool.js                                        8.86 kB │ gzip: 3.34 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       9.52 kB │ gzip: 1.85 kB
-dist/api/captcha/submitPoWCaptchaSolution.js                              9.71 kB │ gzip: 2.92 kB
+dist/api/captcha/submitPoWCaptchaSolution.js                              9.70 kB │ gzip: 2.92 kB
 dist/api/startProviderApi.js                                             10.42 kB │ gzip: 3.58 kB
 dist/tasks/client/clientTasks.js                                         12.17 kB │ gzip: 3.24 kB
 dist/tasks/decisionMachine/decisionMachineRunner.js                      12.17 kB │ gzip: 3.84 kB
@@ -209,7 +210,7 @@ dist/tasks/powCaptcha/powTasks.js                                        25.37 k
 dist/tasks/captchaManager.js                                             25.56 kB │ gzip: 7.55 kB
 dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 27.89 kB │ gzip: 6.60 kB
 
-✓ built in 155ms
+✓ built in 230ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @prosopo/provider
 
+## 5.20.2
+### Patch Changes
+
+- 749fe8a: Finish holding express at 4, and build `@prosopo/fingerprint` before the
+  provider that imports it.
+  
+  v3.8.37 pinned `@prosopo/locale` back to express 4 because the i18next
+  middleware has no express 5 typings, but left `provider`, `cli`,
+  `api-express-router` and the two demos on express 5. That split the workspace:
+  `provider` takes the middleware handler from `locale`, which is now typed for
+  express 4, and hands it to its own express 5 `app.use`, which does not accept
+  it. All six are on express 4 now.
+  
+  Separately, `packages/provider` gained a dependency on `@prosopo/fingerprint`
+  without a matching tsconfig project reference, so `tsc --build` did not build
+  it first. A full build hid this because something else built fingerprint
+  earlier; a partial build of just the packages a consumer needs did not, and
+  failed with "Cannot find module '@prosopo/fingerprint/summary'". The reference
+  is now declared.
+  
+  Lift the express pins together with the dependabot ignore once the middleware
+  ships express 5 typings.
+- Updated dependencies [749fe8a]
+  - @prosopo/api-express-router@3.3.2
+
 ## 5.20.1
 ### Patch Changes
 

package/dist/api/captcha/submitPoWCaptchaSolution.js

@@ -7,12 +7,12 @@ import { Tasks } from "../../tasks/tasks.js";
 import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
 import { resolveTestSiteKeyVerdict } from "../testSiteKey.js";
 import { summariseRequestBody } from "../requestBodySummary.js";
-import { summariseFingerprintProof } from "../../fingerprint/dist/summary.js";
 import { ProsopoError, isProsopoError, isSevereError } from "@prosopo/common";
 import { CaptchaType, SubmitPowCaptchaSolutionBody, imageMaxRoundsDefault, resolveAllowedCaptchaTypes } from "@prosopo/types";
 import { flatten, getIPAddress } from "@prosopo/util";
 import { resolveMaxEscalationLevel, severityToPuzzleDifficulty } from "@prosopo/captcha-severity";
 import { DEFAULT_RENDER_SETTINGS } from "@prosopo/puzzle-assets";
+import { summariseFingerprintProof } from "@prosopo/fingerprint/summary";
 //#region src/api/captcha/submitPoWCaptchaSolution.ts
 var submitPoWCaptchaSolution_default = (env) => async (req, res, next) => {
 	if (getMaintenanceMode()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prosopo/provider",
-  "version": "5.20.1",
+  "version": "5.20.2",
   "author": "PROSOPO LIMITED <info@prosopo.io>",
   "license": "Apache-2.0",
   "type": "module",
@@ -11,7 +11,7 @@
     "@noble/hashes": "2.4.0",
     "@polkadot/util": "14.0.3",
     "@prosopo/api": "4.7.5",
-    "@prosopo/api-express-router": "3.3.1",
+    "@prosopo/api-express-router": "3.3.2",
     "@prosopo/api-route": "2.6.65",
     "@prosopo/audio-assets": "0.2.2",
     "@prosopo/captcha-severity": "1.3.3",
@@ -39,7 +39,7 @@
     "@prosopo/util-crypto": "13.6.1",
     "@prosopo/web-bot-auth": "0.1.4",
     "cron": "3.1.7",
-    "express": "5.3.0",
+    "express": "4.22.2",
     "express-rate-limit": "7.4.0",
     "geolib": "4.0.0",
     "i18next": "26.4.4",
@@ -53,7 +53,7 @@
     "@noble/curves": "2.4.0",
     "@prosopo/config": "3.5.0",
     "@types/cors": "2.8.19",
-    "@types/express": "5.0.6",
+    "@types/express": "4.17.25",
     "@types/node": "22.5.5",
     "@types/pg": "8.23.1",
     "@types/uuid": "11.0.0",

package/dist/fingerprint/dist/merkle.js

@@ -1,69 +0,0 @@
-import { hexHashArray } from "@prosopo/util-crypto";
-//#region ../fingerprint/dist/merkle.js
-var at = (arr, index) => {
-	const value = arr[index];
-	if (value === void 0) throw new Error(`merkle: index ${index} out of range (length ${arr.length})`);
-	return value;
-};
-/** Hash a pair of child hashes into their parent. */
-var hashMerklePair = (left, right) => hexHashArray([left, right]);
-/**
-* Build every layer of the Merkle tree, bottom-up. Layer 0 is the leaf hashes,
-* the final layer is `[root]`. An odd node at the end of a layer is paired with
-* itself.
-*/
-var buildMerkleLayers = (leafHashes) => {
-	if (leafHashes.length === 0) throw new Error("merkle: cannot build a tree with no leaves");
-	const layers = [[...leafHashes]];
-	let current = leafHashes;
-	while (current.length > 1) {
-		const next = [];
-		for (let i = 0; i < current.length; i += 2) {
-			const left = at(current, i);
-			const right = i + 1 < current.length ? at(current, i + 1) : left;
-			next.push(hashMerklePair(left, right));
-		}
-		layers.push(next);
-		current = next;
-	}
-	return layers;
-};
-var merkleRootFromLayers = (layers) => at(at(layers, layers.length - 1), 0);
-/** Produce the sibling path proving `leafHash` belongs to the tree. */
-var merkleProofFromLayers = (layers, leafHash) => {
-	const proof = [];
-	let hash = leafHash;
-	for (let layerNum = 0; layerNum < layers.length - 1; layerNum++) {
-		const layer = at(layers, layerNum);
-		const index = layer.indexOf(hash);
-		if (index === -1) throw new Error("merkle: leaf hash not present in layer");
-		let partnerIndex = index % 2 === 1 ? index - 1 : index + 1;
-		if (partnerIndex > layer.length - 1) partnerIndex = index;
-		const partner = at(layer, partnerIndex);
-		const pair = partnerIndex > index ? [hash, partner] : [partner, hash];
-		proof.push(pair);
-		hash = hashMerklePair(pair[0], pair[1]);
-	}
-	return [...proof, [merkleRootFromLayers(layers)]];
-};
-/** Verify a leaf + sibling path recomputes to the proof's embedded root. */
-var verifyMerkleProof = (leafHash, proof) => {
-	try {
-		const firstLayer = proof[0];
-		if (firstLayer === void 0 || firstLayer.indexOf(leafHash) === -1) return false;
-		if (proof.length === 1) return at(firstLayer, 0) === leafHash;
-		const root = at(at(proof, proof.length - 1), 0);
-		let hash = leafHash;
-		for (let i = 0; i < proof.length - 1; i++) {
-			const layer = at(proof, i);
-			if (layer.indexOf(hash) === -1) return false;
-			hash = hashMerklePair(at(layer, 0), at(layer, 1));
-			if (at(proof, i + 1).indexOf(hash) === -1) return false;
-		}
-		return hash === root;
-	} catch {
-		return false;
-	}
-};
-//#endregion
-export { buildMerkleLayers, hashMerklePair, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof };

package/dist/fingerprint/dist/proof.js

@@ -1,95 +0,0 @@
-import { buildMerkleLayers, merkleProofFromLayers, merkleRootFromLayers, verifyMerkleProof } from "./merkle.js";
-import { hexHash } from "@prosopo/util-crypto";
-/**
-* The fixed set of components the client discloses in a proof of fingerprint.
-* Disclosing every component (the previous default) made the proof enormous —
-* each disclosure carries a full Merkle path and its raw value, and components
-* like webgl/audio/fonts have very large values. Selective disclosure keeps the
-* commitment (`root`) over the whole component set while only these cheap,
-* stable scalar components carry a path + value, shrinking the payload ~10x.
-*
-* The provider-side validator's bounds MUST be a subset of these keys: a bounded
-* key that isn't disclosed would always fail validation as `missing:<key>`.
-*/
-var FINGERPRINT_DISCLOSURE_KEYS = [
-	"colorDepth",
-	"cookiesEnabled",
-	"sessionStorage",
-	"localStorage",
-	"timezone",
-	"hardwareConcurrency",
-	"languages",
-	"architecture",
-	"deviceBucket"
-];
-var escapeKey = (key) => key.replace(/([:|\\])/g, "\\$1");
-var componentLeafContent = (key, component) => {
-	const serialized = "error" in component ? "error" : JSON.stringify(component.value);
-	return `${escapeKey(key)}:${serialized}`;
-};
-var disclosureLeafContent = (disclosure) => {
-	const serialized = disclosure.error ? "error" : JSON.stringify(disclosure.value);
-	return `${escapeKey(disclosure.key)}:${serialized}`;
-};
-var leafHashForContent = (content) => hexHash(content);
-/**
-* Build a {@link FingerprintProof} from an already-resolved FingerprintJS
-* components map. The commitment always covers every component (in sorted key
-* order); `discloseKeys` selects which components are revealed (defaulting to
-* all). Keys that are not present in the fingerprint are skipped — a validator
-* should treat an expected-but-absent disclosure as a failure.
-*/
-var buildFingerprintProofFromComponents = (components, discloseKeys) => {
-	const keys = Object.keys(components).sort();
-	if (keys.length === 0) throw new Error("fingerprint proof: no components to commit to");
-	const leafHashes = keys.map((key) => {
-		const component = components[key];
-		if (component === void 0) throw new Error(`fingerprint proof: missing component ${key}`);
-		return leafHashForContent(componentLeafContent(key, component));
-	});
-	const layers = buildMerkleLayers(leafHashes);
-	const root = merkleRootFromLayers(layers);
-	const disclose = discloseKeys ?? keys;
-	const disclosures = [];
-	for (const key of disclose) {
-		const index = keys.indexOf(key);
-		if (index === -1) continue;
-		const component = components[key];
-		const leafHash = leafHashes[index];
-		if (component === void 0 || leafHash === void 0) continue;
-		const proof = merkleProofFromLayers(layers, leafHash);
-		disclosures.push("error" in component ? {
-			key,
-			error: true,
-			proof
-		} : {
-			key,
-			value: component.value,
-			proof
-		});
-	}
-	return {
-		v: 1,
-		root,
-		disclosures
-	};
-};
-/**
-* Structural verification of a proof: every disclosed `(key, value)` re-hashes
-* to a leaf that is proven to belong to the single committed `root`. This is
-* the non-secret half of validation — the value-bounding rules live in the
-* provider-side (closed-source) validator and are layered on top of this.
-*/
-var verifyFingerprintProofStructure = (proof) => {
-	if (proof.v !== 1) return false;
-	if (typeof proof.root !== "string" || proof.disclosures.length === 0) return false;
-	for (const disclosure of proof.disclosures) {
-		if (!verifyMerkleProof(leafHashForContent(disclosureLeafContent(disclosure)), disclosure.proof)) return false;
-		const rootLayer = disclosure.proof[disclosure.proof.length - 1];
-		if (rootLayer === void 0 || rootLayer[0] !== proof.root) return false;
-	}
-	return true;
-};
-var encodeFingerprintProof = (proof) => JSON.stringify(proof);
-//#endregion
-export { FINGERPRINT_DISCLOSURE_KEYS, buildFingerprintProofFromComponents, encodeFingerprintProof, leafHashForContent, verifyFingerprintProofStructure };

package/dist/fingerprint/dist/summary.js

@@ -1,73 +0,0 @@
-import { verifyFingerprintProofStructure } from "./proof.js";
-import { hexHash } from "@prosopo/util-crypto";
-//#region ../fingerprint/dist/summary.js
-/**
-* The disclosed keys that are fixed by the installation and the host. A hash
-* over them names a cohort of devices.
-*
-* `colorDepth` and `hardwareConcurrency` are disclosed too but kept out of the
-* hash and stored beside it, so that the values can be read per cohort rather
-* than only folded into it.
-*/
-var GROUP_KEYS = [
-	"cookiesEnabled",
-	"sessionStorage",
-	"localStorage",
-	"timezone",
-	"languages",
-	"architecture"
-];
-var asNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
-/**
-* Reduce an encoded proof to the fields worth storing, or `undefined` when it
-* is absent, unparseable, or fails structural verification.
-*
-* Structural verification is not optional here: an unverified disclosure is a
-* client-asserted value with a decorative Merkle path beside it, and storing
-* one would put a forgeable field into an aggregation that reads as
-* tamper-evident. Whether the values are *plausible* is a separate concern and
-* stays in the routing machine's validator; this only refuses what does not
-* hash together.
-*/
-var summariseFingerprintProof = (encoded) => {
-	if (!encoded) return void 0;
-	let proof;
-	try {
-		proof = JSON.parse(encoded);
-	} catch {
-		return;
-	}
-	if (typeof proof !== "object" || proof === null || typeof proof.root !== "string" || !Array.isArray(proof.disclosures)) return;
-	if (!verifyFingerprintProofStructure(proof)) return void 0;
-	const byKey = /* @__PURE__ */ new Map();
-	for (const disclosure of proof.disclosures) if (!disclosure.error) byKey.set(disclosure.key, disclosure.value);
-	const groupInput = GROUP_KEYS.map((key) => `${key}:${JSON.stringify(byKey.get(key) ?? null)}`).join("|");
-	const disclosed = {};
-	const timezone = byKey.get("timezone");
-	if (typeof timezone === "string") disclosed.timezone = timezone;
-	const languages = byKey.get("languages");
-	if (languages !== void 0) disclosed.languages = JSON.stringify(languages);
-	const architecture = asNumber(byKey.get("architecture"));
-	if (architecture !== void 0) disclosed.architecture = architecture;
-	for (const key of [
-		"cookiesEnabled",
-		"sessionStorage",
-		"localStorage"
-	]) {
-		const value = byKey.get(key);
-		if (typeof value === "boolean") disclosed[key] = value;
-	}
-	const bucketId = byKey.get("deviceBucket");
-	const colorDepth = asNumber(byKey.get("colorDepth"));
-	const hardwareConcurrency = asNumber(byKey.get("hardwareConcurrency"));
-	return {
-		root: proof.root,
-		groupHash: hexHash(groupInput),
-		...typeof bucketId === "string" && bucketId !== "" && { bucketId },
-		...colorDepth !== void 0 && { colorDepth },
-		...hardwareConcurrency !== void 0 && { hardwareConcurrency },
-		...Object.keys(disclosed).length > 0 && { disclosed }
-	};
-};
-//#endregion
-export { summariseFingerprintProof };