@prosopo/provider 5.6.2 → 5.6.3

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -316,6 +316,8 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			countryCode,
 			score: botScore,
 			imageMaxRounds: clientRecord.settings.imageMaxRounds,
+			frictionlessTypes: clientRecord.settings.frictionlessTypes,
+			baseImageRounds: env.config.captchas.solved.count,
 			platform: require_devicePlatform.derivePlatform(safeUserAgent, webView, { ...typeof ipInfoMobile === "boolean" && { isMobile: ipInfoMobile } }),
 			raw: {
 				headers: flatHeaders,

package/dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs

@@ -1,5 +1,6 @@
 const require_validateAddress = require("../validateAddress.cjs");
-const require_puzzleRenderer = require("../../tasks/puzzle/puzzleRenderer.cjs");
+const require_puzzleDifficulty = require("../../tasks/puzzle/puzzleDifficulty.cjs");
+const require_captchaTypeSelection = require("../../tasks/captchaTypeSelection.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
@@ -8,6 +9,7 @@ const require_rawTlsSignalsMiddleware = require("../rawTlsSignalsMiddleware.cjs"
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
+let _prosopo_puzzle_assets = require("@prosopo/puzzle-assets");
 //#region src/api/captcha/submitPoWCaptchaSolution.ts
 var submitPoWCaptchaSolution_default = (env) => async (req, res, next) => {
 	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
@@ -95,6 +97,9 @@ var submitPoWCaptchaSolution_default = (env) => async (req, res, next) => {
 			tcpToChelloUs: req.tcpToChelloUs,
 			chelloToHandshakeUs: req.chelloToHandshakeUs,
 			...require_rawTlsSignalsMiddleware.rawTlsSignalsForSession(req)
+		}, {
+			frictionlessTypes: clientRecord.settings?.frictionlessTypes,
+			imageMaxRounds: clientRecord.settings?.imageMaxRounds
 		});
 		const response = {
 			status: "ok",
@@ -128,7 +133,7 @@ var submitPoWCaptchaSolution_default = (env) => async (req, res, next) => {
 * Exported for unit testing only — the handler above is the production entry
 * point.
 */
-var buildEscalation = async (tasks, result, challenge, perConnectionSignals) => {
+var buildEscalation = async (tasks, result, challenge, perConnectionSignals, siteConstraints) => {
 	if (!result.verified || !result.routingOutput) return void 0;
 	const routedType = result.routingOutput.captchaType;
 	if (routedType !== _prosopo_types.CaptchaType.image && routedType !== _prosopo_types.CaptchaType.puzzle) return;
@@ -137,9 +142,21 @@ var buildEscalation = async (tasks, result, challenge, perConnectionSignals) =>
 	const originSession = await tasks.db.getSessionRecordBySessionId(powRecord.sessionId);
 	if (!originSession) return void 0;
 	const routed = result.routingOutput;
-	const escalatedType = require_puzzleRenderer.downgradePuzzleIfUnavailable(routed.captchaType);
+	const escalatedType = require_captchaTypeSelection.coerceToEnabledCaptchaType(routed.captchaType, siteConstraints?.frictionlessTypes);
+	if (escalatedType === _prosopo_types.CaptchaType.pow) return void 0;
+	const imageMaxRounds = siteConstraints?.imageMaxRounds ?? _prosopo_types.imageMaxRoundsDefault;
+	const escalationPuzzleOverrides = (() => {
+		if (escalatedType !== _prosopo_types.CaptchaType.puzzle) return void 0;
+		const level = require_puzzleDifficulty.severityToPuzzleDifficulty(routed.solvedImagesCount ?? originSession.solvedImagesCount, tasks.config.captchas.solved.count);
+		if (level === 0) return void 0;
+		const difficulty = require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken);
+		return {
+			puzzleTolerance: difficulty.tolerance,
+			puzzle: difficulty.puzzle
+		};
+	})();
 	const selectionReason = routed.reason ?? originSession.reason;
-	const newSession = await tasks.frictionlessManager.createSession(originSession.token, originSession.score, originSession.threshold, originSession.scoreComponents, originSession.ipAddress, escalatedType, originSession.siteKey ?? powRecord.dappAccount, escalatedType === _prosopo_types.CaptchaType.image ? routed.solvedImagesCount ?? originSession.solvedImagesCount : void 0, void 0, originSession.userSitekeyIpHash, originSession.webView, originSession.iFrame, originSession.decryptedHeadHash, selectionReason, void 0, void 0, originSession.ipInfo, originSession.headers, originSession.mode, originSession.simdReadings, originSession.entropyMathRandomFingerprint, originSession.entropyCryptoFingerprint, originSession.entropyWallClockOffsetMs, originSession.entropyMathRandomFirst, originSession.bundleId, originSession.currentUrl, perConnectionSignals?.tcpToChelloUs, perConnectionSignals?.chelloToHandshakeUs, true, originSession.iframeUrl, originSession.isProtect, originSession.sessionId, originSession.g, void 0, originSession.i, originSession.sw, originSession.md, originSession.bn, originSession.fs, perConnectionSignals && {
+	const newSession = await tasks.frictionlessManager.createSession(originSession.token, originSession.score, originSession.threshold, originSession.scoreComponents, originSession.ipAddress, escalatedType, originSession.siteKey ?? powRecord.dappAccount, escalatedType === _prosopo_types.CaptchaType.image ? Math.min(routed.solvedImagesCount ?? originSession.solvedImagesCount ?? tasks.config.captchas.solved.count, imageMaxRounds) : void 0, void 0, originSession.userSitekeyIpHash, originSession.webView, originSession.iFrame, originSession.decryptedHeadHash, selectionReason, void 0, void 0, originSession.ipInfo, originSession.headers, originSession.mode, originSession.simdReadings, originSession.entropyMathRandomFingerprint, originSession.entropyCryptoFingerprint, originSession.entropyWallClockOffsetMs, originSession.entropyMathRandomFirst, originSession.bundleId, originSession.currentUrl, perConnectionSignals?.tcpToChelloUs, perConnectionSignals?.chelloToHandshakeUs, true, originSession.iframeUrl, originSession.isProtect, originSession.sessionId, originSession.g, void 0, originSession.i, originSession.sw, originSession.md, originSession.bn, originSession.fs, perConnectionSignals && {
 		synNs: perConnectionSignals.synNs,
 		synackNs: perConnectionSignals.synackNs,
 		ackNs: perConnectionSignals.ackNs,
@@ -149,7 +166,7 @@ var buildEscalation = async (tasks, result, challenge, perConnectionSignals) =>
 		tcpOptsFlags: perConnectionSignals.tcpOptsFlags,
 		tcpOptsOrder: perConnectionSignals.tcpOptsOrder,
 		tcpWindow: perConnectionSignals.tcpWindow
-	});
+	}, escalationPuzzleOverrides);
 	if (tasks.writeQueue) await tasks.writeQueue.cacheSessionEscalation(powRecord.sessionId, newSession.sessionId);
 	return {
 		captchaType: escalatedType,

package/dist/cjs/tasks/captchaTypeSelection.cjs

@@ -0,0 +1,53 @@
+const require_puzzleRenderer = require("./puzzle/puzzleRenderer.cjs");
+let _prosopo_types = require("@prosopo/types");
+//#region src/tasks/captchaTypeSelection.ts
+/**
+* Resolve a requested captcha type against what the site permits and what
+* this provider can render.
+*
+* Call this at every point a session's captchaType is DECIDED, never at the
+* point one is served: `/captcha/puzzle` answers with a puzzle-shaped
+* response and nothing else, so a session minted as a type we cannot fulfil
+* strands the user on INCORRECT_CAPTCHA_TYPE. There are two such mint sites —
+* `sendCaptcha` in frictionlessTasks (which every frictionless path funnels
+* through, after the routing machine has had its say) and `buildEscalation`
+* in submitPoWCaptchaSolution.
+*
+* Because it sits after routing, this covers every upstream selector
+* transitively: the score ladder, the no-measurement gates, access-policy
+* Restrict rules, traffic-filter category policies, routing-machine actions
+* and detector-generated rules.
+*
+* Coercion only ever narrows. A disabled type falls back to the other
+* interactive type if that is permitted, and to PoW otherwise — never the
+* reverse, so this can't hand a user a harder challenge than was asked for.
+*/
+var coerceToEnabledCaptchaType = (requested, frictionlessTypes, logger) => {
+	const types = (0, _prosopo_types.resolveFrictionlessTypes)(frictionlessTypes);
+	const puzzleAllowed = types.puzzle && require_puzzleRenderer.isPuzzleRenderAvailable();
+	const imageAllowed = types.image;
+	const resolved = (() => {
+		switch (requested) {
+			case _prosopo_types.CaptchaType.pow: return _prosopo_types.CaptchaType.pow;
+			case _prosopo_types.CaptchaType.puzzle:
+				if (puzzleAllowed) return _prosopo_types.CaptchaType.puzzle;
+				return imageAllowed ? _prosopo_types.CaptchaType.image : _prosopo_types.CaptchaType.pow;
+			case _prosopo_types.CaptchaType.image:
+				if (imageAllowed) return _prosopo_types.CaptchaType.image;
+				return puzzleAllowed ? _prosopo_types.CaptchaType.puzzle : _prosopo_types.CaptchaType.pow;
+		}
+	})();
+	if (resolved !== requested) logger?.info(() => ({
+		msg: "Captcha type coerced to an enabled type",
+		data: {
+			requested,
+			served: resolved,
+			imageEnabled: types.image,
+			puzzleEnabled: types.puzzle,
+			puzzleRenderable: require_puzzleRenderer.isPuzzleRenderAvailable()
+		}
+	}));
+	return resolved;
+};
+//#endregion
+exports.coerceToEnabledCaptchaType = coerceToEnabledCaptchaType;

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -3,10 +3,12 @@ const require_decisionMachineRunner = require("../decisionMachine/decisionMachin
 const require_dnsEventUrl = require("../../api/dnsEventUrl.cjs");
 const require_lang = require("../../rules/lang.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
+const require_puzzleDifficulty = require("../puzzle/puzzleDifficulty.cjs");
+const require_captchaTypeSelection = require("../captchaTypeSelection.cjs");
 const require_getBotScore = require("../detection/getBotScore.cjs");
-const require_puzzleRenderer = require("../puzzle/puzzleRenderer.cjs");
 const require_routingMachine = require("./routingMachine.cjs");
 let _prosopo_types = require("@prosopo/types");
+let _prosopo_puzzle_assets = require("@prosopo/puzzle-assets");
 let uuid = require("uuid");
 //#region src/tasks/frictionless/frictionlessTasks.ts
 var DEFAULT_MAX_TIMESTAMP_AGE = 600 * 1e3;
@@ -190,15 +192,24 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			powDifficulty: captchaType === _prosopo_types.CaptchaType.pow ? effectiveParams.powDifficulty : void 0
 		};
 		const routed = this.routingContext ? await require_routingMachine.applyRouter(this.decisionMachineRunner, this.usageCounters, baseline, this.routingContext, this.logger) : baseline;
-		const finalCaptchaType = require_puzzleRenderer.downgradePuzzleIfUnavailable(routed.captchaType, this.logger);
+		const finalCaptchaType = require_captchaTypeSelection.coerceToEnabledCaptchaType(routed.captchaType, this.routingContext?.frictionlessTypes, this.logger);
 		const requestedSolvedImagesCount = routed.solvedImagesCount ?? effectiveParams.solvedImagesCount;
-		const imageRoundsCeiling = this.routingContext?.imageMaxRounds;
-		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? requestedSolvedImagesCount !== void 0 && imageRoundsCeiling !== void 0 ? Math.min(requestedSolvedImagesCount, imageRoundsCeiling) : requestedSolvedImagesCount : void 0;
+		const imageRoundsCeiling = this.routingContext?.imageMaxRounds ?? _prosopo_types.imageMaxRoundsDefault;
+		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? requestedSolvedImagesCount !== void 0 ? Math.min(requestedSolvedImagesCount, imageRoundsCeiling) : requestedSolvedImagesCount : void 0;
 		const finalPowDifficulty = finalCaptchaType === _prosopo_types.CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
-		const finalPuzzleOverrides = finalCaptchaType === _prosopo_types.CaptchaType.puzzle ? {
-			...routed.puzzleTolerance !== void 0 && { puzzleTolerance: routed.puzzleTolerance },
-			...routed.puzzle && { puzzle: routed.puzzle }
-		} : {};
+		const finalPuzzleOverrides = finalCaptchaType === _prosopo_types.CaptchaType.puzzle ? (() => {
+			const level = require_puzzleDifficulty.severityToPuzzleDifficulty(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count);
+			const difficulty = level > 0 ? require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken) : void 0;
+			const tolerance = routed.puzzleTolerance ?? difficulty?.tolerance;
+			const puzzle = routed.puzzle || difficulty ? {
+				...difficulty?.puzzle ?? {},
+				...routed.puzzle ?? {}
+			} : void 0;
+			return {
+				...tolerance !== void 0 && { puzzleTolerance: tolerance },
+				...puzzle !== void 0 && { puzzle }
+			};
+		})() : {};
 		const finalReason = routed.reason ?? effectiveParams.reason;
 		const blocked = finalCaptchaType === _prosopo_types.CaptchaType.image ? effectiveParams.blocked : void 0;
 		const sessionRecord = await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, finalCaptchaType, effectiveParams.siteKey, finalSolvedImagesCount, finalPowDifficulty, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, finalReason, blocked, void 0, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g, effectiveParams.matchedRule, effectiveParams.i, effectiveParams.sw, effectiveParams.md, effectiveParams.bn, effectiveParams.fs, {

package/dist/cjs/tasks/puzzle/puzzleDifficulty.cjs

@@ -0,0 +1,208 @@
+const require_stratifiedSampler = require("./stratifiedSampler.cjs");
+//#region src/tasks/puzzle/puzzleDifficulty.ts
+/**
+* Minimum gap that must remain between `decoyHoleDarken` and `holeDarken`.
+*
+* The real cutout has to stay the deepest region on the frame or a human
+* cannot tell target from decoy at all. But pushed too far apart, a solver
+* simply thresholds on brightness and ignores shape. The ladder walks
+* `decoyHoleDarken` down toward `holeDarken` as difficulty rises; this floor
+* is what stops it crossing over. Enforced by clamping every sampled value,
+* not by trusting the band table to be authored correctly.
+*/
+var MIN_DECOY_HOLE_DARKEN_MARGIN = .04;
+/**
+* L0 reproduces the shipped defaults (decoyCount 5, decoyEdgeDarkness 20,
+* decoyHoleDarken 0.7, tolerance 15, pieceScale 0.15-0.45) so a site that
+* never escalates sees no change in behaviour.
+*
+* The numbers above L0 are STARTING POINTS, not calibrated values. They need
+* validating against observed human first-attempt solve rate per level,
+* segmented by device class — see the shadow-calibration note on
+* `severityToPuzzleDifficulty`.
+*/
+var PUZZLE_DIFFICULTY_LEVELS = [
+	{
+		level: 0,
+		tolerance: {
+			min: 14,
+			max: 16
+		},
+		decoyCount: {
+			min: 4,
+			max: 6
+		},
+		decoyHoleDarken: {
+			min: .68,
+			max: .72
+		},
+		decoyEdgeDarkness: {
+			min: 18,
+			max: 22
+		},
+		pieceScale: {
+			min: .15,
+			max: .45
+		}
+	},
+	{
+		level: 1,
+		tolerance: {
+			min: 12,
+			max: 15
+		},
+		decoyCount: {
+			min: 6,
+			max: 10
+		},
+		decoyHoleDarken: {
+			min: .66,
+			max: .7
+		},
+		decoyEdgeDarkness: {
+			min: 20,
+			max: 24
+		},
+		pieceScale: {
+			min: .14,
+			max: .4
+		}
+	},
+	{
+		level: 2,
+		tolerance: {
+			min: 10,
+			max: 13
+		},
+		decoyCount: {
+			min: 10,
+			max: 16
+		},
+		decoyHoleDarken: {
+			min: .64,
+			max: .68
+		},
+		decoyEdgeDarkness: {
+			min: 22,
+			max: 27
+		},
+		pieceScale: {
+			min: .12,
+			max: .34
+		}
+	},
+	{
+		level: 3,
+		tolerance: {
+			min: 8,
+			max: 11
+		},
+		decoyCount: {
+			min: 16,
+			max: 26
+		},
+		decoyHoleDarken: {
+			min: .62,
+			max: .66
+		},
+		decoyEdgeDarkness: {
+			min: 25,
+			max: 30
+		},
+		pieceScale: {
+			min: .1,
+			max: .28
+		}
+	},
+	{
+		level: 4,
+		tolerance: {
+			min: 6,
+			max: 9
+		},
+		decoyCount: {
+			min: 26,
+			max: 40
+		},
+		decoyHoleDarken: {
+			min: .6,
+			max: .64
+		},
+		decoyEdgeDarkness: {
+			min: 28,
+			max: 34
+		},
+		pieceScale: {
+			min: .09,
+			max: .22
+		}
+	}
+];
+var toleranceSampler = require_stratifiedSampler.createStratifiedSampler();
+var decoyCountSampler = require_stratifiedSampler.createStratifiedSampler();
+var decoyHoleDarkenSampler = require_stratifiedSampler.createStratifiedSampler();
+var decoyEdgeDarknessSampler = require_stratifiedSampler.createStratifiedSampler();
+var clampDifficultyLevel = (level, maxLevel = 3) => {
+	const ceiling = Math.min(maxLevel, PUZZLE_DIFFICULTY_LEVELS.length - 1);
+	if (!Number.isFinite(level)) return 0;
+	return Math.max(0, Math.min(Math.floor(level), ceiling));
+};
+/**
+* Map the severity currency every existing call-site already speaks — image
+* rounds — onto a difficulty level.
+*
+* Severity is expressed as rounds ABOVE the site's ordinary count rather than
+* an absolute, because the baseline (`env.config.captchas.solved.count`, or a
+* rule's own `solvedImagesCount`) varies per site. "Two more rounds than
+* normal" means the same thing everywhere; "four rounds" does not.
+*
+* Keeping one ordering here means the score ladder, the no-measurement gates,
+* detector rules and traffic-filter policies cannot drift apart on what
+* counts as more severe.
+*/
+var severityToPuzzleDifficulty = (requestedImageRounds, baseImageRounds, maxLevel = 3) => {
+	if (requestedImageRounds === void 0) return 0;
+	const excess = requestedImageRounds - baseImageRounds;
+	if (!Number.isFinite(excess) || excess <= 0) return clampDifficultyLevel(0, maxLevel);
+	if (excess <= 2) return clampDifficultyLevel(1, maxLevel);
+	if (excess <= 4) return clampDifficultyLevel(2, maxLevel);
+	if (excess <= 6) return clampDifficultyLevel(3, maxLevel);
+	return clampDifficultyLevel(4, maxLevel);
+};
+/**
+* Draw a concrete puzzle config from a level's bands.
+*
+* Sampling is server-side and per-challenge, and is deliberately NOT derived
+* from anything the client supplies (sessionId, token, ip, timestamp). A
+* client-derived seed would let a bot replay a request to obtain the same
+* render, or precompute one offline.
+*
+* `pieceScale` is passed through as a range rather than drawn here: the
+* renderer's own stratified piece-size draw consumes it in
+* `resolvePuzzlePieceSize`, and sampling twice would narrow the distribution.
+*/
+var samplePuzzleDifficulty = (level, holeDarken, maxLevel = 3) => {
+	const index = clampDifficultyLevel(level, maxLevel);
+	const band = PUZZLE_DIFFICULTY_LEVELS[index];
+	const decoyHoleDarkenFloor = holeDarken + MIN_DECOY_HOLE_DARKEN_MARGIN;
+	const sampledDecoyHoleDarken = decoyHoleDarkenSampler.sample(band.decoyHoleDarken.min, band.decoyHoleDarken.max);
+	return {
+		level: index,
+		tolerance: toleranceSampler.sampleInt(band.tolerance.min, band.tolerance.max),
+		puzzle: {
+			decoyCount: decoyCountSampler.sampleInt(band.decoyCount.min, band.decoyCount.max),
+			decoyEdgeDarkness: decoyEdgeDarknessSampler.sampleInt(band.decoyEdgeDarkness.min, band.decoyEdgeDarkness.max),
+			decoyHoleDarken: Math.min(1, Math.max(decoyHoleDarkenFloor, sampledDecoyHoleDarken)),
+			pieceScale: {
+				min: band.pieceScale.min,
+				max: band.pieceScale.max
+			}
+		}
+	};
+};
+//#endregion
+exports.MIN_DECOY_HOLE_DARKEN_MARGIN = MIN_DECOY_HOLE_DARKEN_MARGIN;
+exports.PUZZLE_DIFFICULTY_LEVELS = PUZZLE_DIFFICULTY_LEVELS;
+exports.clampDifficultyLevel = clampDifficultyLevel;
+exports.samplePuzzleDifficulty = samplePuzzleDifficulty;
+exports.severityToPuzzleDifficulty = severityToPuzzleDifficulty;

package/dist/cjs/tasks/puzzle/puzzleRenderer.cjs

@@ -1,4 +1,6 @@
 const require_backgroundBuffer = require("./backgroundBuffer.cjs");
+const require_stratifiedSampler = require("./stratifiedSampler.cjs");
+const require_puzzleDifficulty = require("./puzzleDifficulty.cjs");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_puzzle_assets = require("@prosopo/puzzle-assets");
 //#region src/tasks/puzzle/puzzleRenderer.ts
@@ -33,46 +35,21 @@ var resolvePuzzleRenderSettings = (...overrides) => {
 			decoyHoleDarken: override.decoyHoleDarken
 		};
 	}
+	const floor = resolved.holeDarken + require_puzzleDifficulty.MIN_DECOY_HOLE_DARKEN_MARGIN;
+	if (resolved.decoyHoleDarken < floor) resolved = {
+		...resolved,
+		decoyHoleDarken: Math.min(1, floor)
+	};
 	return resolved;
 };
-/**
-* Number of size buckets used for stratified sampling. The scale range is
-* split into this many equal windows; every window is visited once per
-* cycle before the sequence repeats, so a short run of challenges is
-* guaranteed to span the full range rather than clustering by chance.
-*/
-var PIECE_SIZE_BUCKETS = 8;
-var pieceSizeBucketOrder = [];
-var pieceSizeBucketCursor = 0;
-var shuffleArray = (input) => {
-	const out = [...input];
-	for (let i = out.length - 1; i > 0; i--) {
-		const j = Math.floor(Math.random() * (i + 1));
-		const tmp = out[i];
-		out[i] = out[j];
-		out[j] = tmp;
-	}
-	return out;
-};
-var buildBucketOrder = () => {
-	const half = PIECE_SIZE_BUCKETS >> 1;
-	const smallHalf = shuffleArray(Array.from({ length: half }, (_, i) => i));
-	const largeHalf = shuffleArray(Array.from({ length: half }, (_, i) => i + half));
-	const [first, second] = Math.random() < .5 ? [smallHalf, largeHalf] : [largeHalf, smallHalf];
-	const order = [];
-	for (let i = 0; i < half; i++) {
-		order.push(first[i]);
-		order.push(second[i]);
-	}
-	return order;
-};
+var pieceSizeSampler = require_stratifiedSampler.createStratifiedSampler();
 /**
 * Resolve the effective piece scale range from the same layered
 * client-settings / traffic-filter overrides used for render settings, and
-* draw a per-challenge piece size in pixels. Stratified over
-* `PIECE_SIZE_BUCKETS` windows so the distribution is evenly spread across
-* the range even for short bursts of requests. Rounded to an integer
-* because the pixel buffer is allocated as `size * size * 4`.
+* draw a per-challenge piece size in pixels. Stratified so the distribution
+* is evenly spread across the range even for short bursts of requests.
+* Rounded to an integer because the pixel buffer is allocated as
+* `size * size * 4`.
 */
 var resolvePuzzlePieceSize = (...overrides) => {
 	let min = _prosopo_types.puzzlePieceScaleMinDefault;
@@ -83,14 +60,7 @@ var resolvePuzzlePieceSize = (...overrides) => {
 		if (override.pieceScale.max !== void 0) max = override.pieceScale.max;
 	}
 	if (min > max) min = max;
-	if (pieceSizeBucketCursor >= pieceSizeBucketOrder.length) {
-		pieceSizeBucketOrder = buildBucketOrder();
-		pieceSizeBucketCursor = 0;
-	}
-	const bucket = pieceSizeBucketOrder[pieceSizeBucketCursor];
-	pieceSizeBucketCursor++;
-	const u = (bucket + Math.random()) / PIECE_SIZE_BUCKETS;
-	const scale = min + u * (max - min);
+	const scale = pieceSizeSampler.sample(min, max);
 	return Math.max(1, Math.round(_prosopo_puzzle_assets.DEFAULT_GEOMETRY.width * scale));
 };
 /**
@@ -106,23 +76,6 @@ var resolvePuzzlePieceSize = (...overrides) => {
 var isPuzzleRenderAvailable = () => {
 	return true;
 };
-/**
-* Substitute `image` for `puzzle` when this provider cannot render imagery.
-*
-* Call this at every point a session's captchaType is decided, never at the
-* point one is served. Returns other types untouched.
-*/
-var downgradePuzzleIfUnavailable = (captchaType, logger) => {
-	if (captchaType !== _prosopo_types.CaptchaType.puzzle || isPuzzleRenderAvailable()) return captchaType;
-	logger?.warn(() => ({
-		msg: "Puzzle rendering unavailable - downgrading session to image",
-		data: {
-			requested: captchaType,
-			served: _prosopo_types.CaptchaType.image
-		}
-	}));
-	return _prosopo_types.CaptchaType.image;
-};
 var renderPuzzleImages = async (placement, settings = _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS, pieceSize) => {
 	const background = (require_backgroundBuffer.getPuzzleBackgroundBuffer() ?? require_backgroundBuffer.initPuzzleBackgroundBuffer()).take();
 	if (!background) throw new Error("puzzle renderer: no background available");
@@ -137,7 +90,6 @@ var renderPuzzleImages = async (placement, settings = _prosopo_puzzle_assets.DEF
 	};
 };
 //#endregion
-exports.downgradePuzzleIfUnavailable = downgradePuzzleIfUnavailable;
 exports.isPuzzleRenderAvailable = isPuzzleRenderAvailable;
 exports.renderPuzzleImages = renderPuzzleImages;
 exports.resolvePuzzlePieceSize = resolvePuzzlePieceSize;

package/dist/cjs/tasks/puzzle/stratifiedSampler.cjs

@@ -0,0 +1,61 @@
+let node_crypto = require("node:crypto");
+/**
+* Uniform float in [0, 1), from the CSPRNG rather than `Math.random()`.
+*
+* V8 implements `Math.random()` as xorshift128+, whose internal state is
+* recoverable from a short run of consecutive outputs. That matters here
+* specifically: the point of sampling these knobs is that an automated solver
+* cannot calibrate against a known render, and a predictable stream gives it
+* exactly that — observe a few challenges, recover the state, and every
+* subsequent draw is known in advance. The unpredictability IS the security
+* property, so it has to come from a source built for it.
+*
+* 48 bits (6 bytes) is the most a float64 can hold without rounding, so the
+* result is uniform with no modulo bias.
+*/
+var RANDOM_BYTES = 6;
+var RANDOM_DENOMINATOR = 2 ** (RANDOM_BYTES * 8);
+var secureUnitFloat = () => Number((0, node_crypto.randomBytes)(RANDOM_BYTES).readUIntBE(0, RANDOM_BYTES)) / RANDOM_DENOMINATOR;
+var shuffleArray = (input) => {
+	const out = [...input];
+	for (let i = out.length - 1; i > 0; i--) {
+		const j = (0, node_crypto.randomInt)(0, i + 1);
+		const tmp = out[i];
+		out[i] = out[j];
+		out[j] = tmp;
+	}
+	return out;
+};
+var createStratifiedSampler = (buckets = 8) => {
+	const bucketCount = buckets > 0 && buckets % 2 === 0 ? buckets : 8;
+	let order = [];
+	let cursor = 0;
+	const buildOrder = () => {
+		const half = bucketCount >> 1;
+		const lowHalf = shuffleArray(Array.from({ length: half }, (_, i) => i));
+		const highHalf = shuffleArray(Array.from({ length: half }, (_, i) => i + half));
+		const [first, second] = (0, node_crypto.randomInt)(0, 2) === 0 ? [lowHalf, highHalf] : [highHalf, lowHalf];
+		const next = [];
+		for (let i = 0; i < half; i++) {
+			next.push(first[i]);
+			next.push(second[i]);
+		}
+		return next;
+	};
+	const sample = (min, max) => {
+		if (!(max > min)) return min;
+		if (cursor >= order.length) {
+			order = buildOrder();
+			cursor = 0;
+		}
+		const bucket = order[cursor];
+		cursor++;
+		return min + (bucket + secureUnitFloat()) / bucketCount * (max - min);
+	};
+	return {
+		sample,
+		sampleInt: (min, max) => Math.round(sample(min, max))
+	};
+};
+//#endregion
+exports.createStratifiedSampler = createStratifiedSampler;

package/dist/tasks/captchaTypeSelection.d.ts

@@ -0,0 +1,5 @@
+import type { Logger } from "@prosopo/logger";
+import { CaptchaType, type IFrictionlessTypes } from "@prosopo/types";
+export type ConcreteCaptchaType = CaptchaType.pow | CaptchaType.image | CaptchaType.puzzle;
+export declare const coerceToEnabledCaptchaType: (requested: ConcreteCaptchaType, frictionlessTypes: Partial<IFrictionlessTypes> | undefined, logger?: Logger) => ConcreteCaptchaType;
+//# sourceMappingURL=captchaTypeSelection.d.ts.map

package/dist/tasks/captchaTypeSelection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"captchaTypeSelection.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaTypeSelection.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACN,WAAW,EACX,KAAK,kBAAkB,EAEvB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,MAAM,mBAAmB,GAC5B,WAAW,CAAC,GAAG,GACf,WAAW,CAAC,KAAK,GACjB,WAAW,CAAC,MAAM,CAAC;AAuBtB,eAAO,MAAM,0BAA0B,cAC3B,mBAAmB,qBACX,OAAO,CAAC,kBAAkB,CAAC,GAAG,SAAS,WACjD,MAAM,KACb,mBAsCF,CAAC"}

package/dist/tasks/captchaTypeSelection.js

@@ -0,0 +1,53 @@
+import { isPuzzleRenderAvailable } from "./puzzle/puzzleRenderer.js";
+import { CaptchaType, resolveFrictionlessTypes } from "@prosopo/types";
+//#region src/tasks/captchaTypeSelection.ts
+/**
+* Resolve a requested captcha type against what the site permits and what
+* this provider can render.
+*
+* Call this at every point a session's captchaType is DECIDED, never at the
+* point one is served: `/captcha/puzzle` answers with a puzzle-shaped
+* response and nothing else, so a session minted as a type we cannot fulfil
+* strands the user on INCORRECT_CAPTCHA_TYPE. There are two such mint sites —
+* `sendCaptcha` in frictionlessTasks (which every frictionless path funnels
+* through, after the routing machine has had its say) and `buildEscalation`
+* in submitPoWCaptchaSolution.
+*
+* Because it sits after routing, this covers every upstream selector
+* transitively: the score ladder, the no-measurement gates, access-policy
+* Restrict rules, traffic-filter category policies, routing-machine actions
+* and detector-generated rules.
+*
+* Coercion only ever narrows. A disabled type falls back to the other
+* interactive type if that is permitted, and to PoW otherwise — never the
+* reverse, so this can't hand a user a harder challenge than was asked for.
+*/
+var coerceToEnabledCaptchaType = (requested, frictionlessTypes, logger) => {
+	const types = resolveFrictionlessTypes(frictionlessTypes);
+	const puzzleAllowed = types.puzzle && isPuzzleRenderAvailable();
+	const imageAllowed = types.image;
+	const resolved = (() => {
+		switch (requested) {
+			case CaptchaType.pow: return CaptchaType.pow;
+			case CaptchaType.puzzle:
+				if (puzzleAllowed) return CaptchaType.puzzle;
+				return imageAllowed ? CaptchaType.image : CaptchaType.pow;
+			case CaptchaType.image:
+				if (imageAllowed) return CaptchaType.image;
+				return puzzleAllowed ? CaptchaType.puzzle : CaptchaType.pow;
+		}
+	})();
+	if (resolved !== requested) logger?.info(() => ({
+		msg: "Captcha type coerced to an enabled type",
+		data: {
+			requested,
+			served: resolved,
+			imageEnabled: types.image,
+			puzzleEnabled: types.puzzle,
+			puzzleRenderable: isPuzzleRenderAvailable()
+		}
+	}));
+	return resolved;
+};
+//#endregion
+export { coerceToEnabledCaptchaType };

package/dist/tasks/captchaTypeSelection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"captchaTypeSelection.js","sourceRoot":"","sources":["../../src/tasks/captchaTypeSelection.ts"],"names":[],"mappings":"AAeA,OAAO,EACN,WAAW,EAEX,wBAAwB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AA6BrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,SAA8B,EAC9B,iBAA0D,EAC1D,MAAe,EACO,EAAE;IACxB,MAAM,KAAK,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;IAK1D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC;IAEjC,MAAM,QAAQ,GAAG,CAAC,GAAwB,EAAE;QAC3C,QAAQ,SAAS,EAAE,CAAC;YACnB,KAAK,WAAW,CAAC,GAAG;gBAGnB,OAAO,WAAW,CAAC,GAAG,CAAC;YACxB,KAAK,WAAW,CAAC,MAAM;gBACtB,IAAI,aAAa;oBAAE,OAAO,WAAW,CAAC,MAAM,CAAC;gBAC7C,OAAO,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;YAC3D,KAAK,WAAW,CAAC,KAAK;gBACrB,IAAI,YAAY;oBAAE,OAAO,WAAW,CAAC,KAAK,CAAC;gBAC3C,OAAO,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;QAC9D,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnB,GAAG,EAAE,yCAAyC;YAC9C,IAAI,EAAE;gBACL,SAAS;gBACT,MAAM,EAAE,QAAQ;gBAChB,YAAY,EAAE,KAAK,CAAC,KAAK;gBACzB,aAAa,EAAE,KAAK,CAAC,MAAM;gBAC3B,gBAAgB,EAAE,uBAAuB,EAAE;aAC3C;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC,CAAC"}

package/dist/tasks/frictionless/frictionlessTasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frictionlessTasks.d.ts","sourceRoot":"","sources":["../../../src/tasks/frictionless/frictionlessTasks.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAEN,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,kBAAkB,EAClB,KAAK,8BAA8B,EACnC,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,OAAO,EAEZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAE1E,OAAO,EACN,KAAK,aAAa,EAElB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AAGpF,OAAO,EAAE,KAAK,cAAc,EAAe,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,MAAM,WAAW,yBAA0B,SAAQ,OAAO;CAAG;AAE7D,MAAM,WAAW,uBAAwB,SAAQ,OAAO;CAAG;AAE3D,MAAM,WAAW,0BAA2B,SAAQ,OAAO;CAAG;AAE9D,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,OAAO,CAAC,aAAa,CAAC,CAGpB;IACF,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAwB;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAGpD,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,eAAe,GAAG,IAAI,EAC/D,qBAAqB,CAAC,EAAE,qBAAqB,EAC7C,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI;IAkBrC,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI;IAgBtC,mBAAmB,CACxB,QAAQ,EAAE,sBAAsB,EAChC,GAAG,EAAE,cAAc,GACjB,OAAO,CAAC,oBAAoB,CAAC;IAUhC,gBAAgB,CACf,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC,GAC9D,IAAI;IA0DP,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAMzD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,GAAG,IAAI;IAOlE,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAIxC,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,kBAAkB,EAC7B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,MAAM,EACf,iBAAiB,CAAC,EAAE,MAAM,EAC1B,aAAa,CAAC,EAAE,MAAM,EACtB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,OAAO,UAAQ,EACf,MAAM,UAAQ,EACd,iBAAiB,SAAK,EACtB,MAAM,CAAC,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,QAAQ,EACf,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACtC,4BAA4B,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,EACtE,wBAAwB,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9D,wBAAwB,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9D,sBAAsB,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,EAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAC9B,UAAU,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAClC,aAAa,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,EACxC,mBAAmB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACpD,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACtC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAC5C,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAChB,WAAW,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EACpC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAIlB,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EAGtC,eAAe,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,CAAC,GAC3D,OAAO,CAAC,OAAO,CAAC;IAqGb,gBAAgB,CACrB,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GACzC,OAAO,CAAC,8BAA8B,CAAC;IAIpC,cAAc,CACnB,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GACvC,OAAO,CAAC,8BAA8B,CAAC;IAIpC,iBAAiB,CACtB,MAAM,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC;YAO5B,WAAW;IAmLnB,sBAAsB,CAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC;IAqEhB,yBAAyB,CACxB,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IActD,oBAAoB,CACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IActD,sBAAsB,CACrB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IAetD,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAWlD,OAAO,CAAC,mBAAmB;IAsBrB,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAWI,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;IA4LrB,uBAAuB,CAC5B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,WAAW,GACtB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAG9B"}
+{"version":3,"file":"frictionlessTasks.d.ts","sourceRoot":"","sources":["../../../src/tasks/frictionless/frictionlessTasks.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAEN,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,kBAAkB,EAClB,KAAK,8BAA8B,EACnC,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,OAAO,EAGZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAE1E,OAAO,EACN,KAAK,aAAa,EAElB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AAMpF,OAAO,EAAE,KAAK,cAAc,EAAe,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,MAAM,WAAW,yBAA0B,SAAQ,OAAO;CAAG;AAE7D,MAAM,WAAW,uBAAwB,SAAQ,OAAO;CAAG;AAE3D,MAAM,WAAW,0BAA2B,SAAQ,OAAO;CAAG;AAE9D,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,OAAO,CAAC,aAAa,CAAC,CAGpB;IACF,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAwB;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAGpD,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,eAAe,GAAG,IAAI,EAC/D,qBAAqB,CAAC,EAAE,qBAAqB,EAC7C,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI;IAkBrC,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI;IAgBtC,mBAAmB,CACxB,QAAQ,EAAE,sBAAsB,EAChC,GAAG,EAAE,cAAc,GACjB,OAAO,CAAC,oBAAoB,CAAC;IAUhC,gBAAgB,CACf,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC,GAC9D,IAAI;IA0DP,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAMzD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,GAAG,IAAI;IAOlE,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAIxC,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,kBAAkB,EAC7B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,MAAM,EACf,iBAAiB,CAAC,EAAE,MAAM,EAC1B,aAAa,CAAC,EAAE,MAAM,EACtB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,OAAO,UAAQ,EACf,MAAM,UAAQ,EACd,iBAAiB,SAAK,EACtB,MAAM,CAAC,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,QAAQ,EACf,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACtC,4BAA4B,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,EACtE,wBAAwB,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9D,wBAAwB,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9D,sBAAsB,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,EAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAC9B,UAAU,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAClC,aAAa,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,EACxC,mBAAmB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACpD,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACtC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAC5C,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAChB,WAAW,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EACpC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAIlB,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EAGtC,eAAe,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,CAAC,GAC3D,OAAO,CAAC,OAAO,CAAC;IAqGb,gBAAgB,CACrB,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GACzC,OAAO,CAAC,8BAA8B,CAAC;IAIpC,cAAc,CACnB,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GACvC,OAAO,CAAC,8BAA8B,CAAC;IAIpC,iBAAiB,CACtB,MAAM,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC;YAO5B,WAAW;IA+NnB,sBAAsB,CAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC;IAqEhB,yBAAyB,CACxB,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IActD,oBAAoB,CACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IActD,sBAAsB,CACrB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IAetD,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAWlD,OAAO,CAAC,mBAAmB;IAsBrB,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAWI,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;IA4LrB,uBAAuB,CAC5B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,WAAW,GACtB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAG9B"}