@prosopo/provider 5.8.0 → 5.9.0

package/dist/cjs/api/captcha/signedAssetsResolver.cjs

@@ -0,0 +1,54 @@
+let node_crypto = require("node:crypto");
+var SignedAssetsResolver = class {
+	constructor(options) {
+		this.securityKey = options.securityKey;
+		this.ttlSeconds = options.ttlSeconds ?? 300;
+		this.clientIp = options.clientIp;
+		this.now = options.now ?? (() => Date.now());
+	}
+	sign(path, expires) {
+		const base = `${this.securityKey}${path}${expires}${this.clientIp ?? ""}`;
+		return (0, node_crypto.createHash)("sha256").update(base).digest("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+	}
+	resolveAsset(assetURI) {
+		const url = this.toUrl(assetURI);
+		if (!url) return {
+			URI: assetURI,
+			getURL: () => assetURI
+		};
+		if (url.search !== "") throw new Error(`Cannot sign an asset URL that already has a query string: ${assetURI}`);
+		const expires = Math.floor(this.now() / 1e3) + this.ttlSeconds;
+		const token = this.sign(url.pathname, expires);
+		const signed = `${url.origin}${url.pathname}?token=${token}&expires=${expires}`;
+		return {
+			URI: assetURI,
+			getURL: () => signed
+		};
+	}
+	toUrl(assetURI) {
+		try {
+			const url = new URL(assetURI);
+			return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+		} catch {
+			return;
+		}
+	}
+};
+/**
+* Build the resolver from the environment, or `undefined` when it is not
+* configured. Undefined means `parseCaptchaAssets` passes `item.data`
+* through unchanged — the behaviour before this existed — so the feature is
+* off until a key is deliberately supplied.
+*/
+function getSignedAssetsResolver(clientIp) {
+	const securityKey = process.env.PROSOPO_ASSET_TOKEN_KEY;
+	if (!securityKey) return;
+	return new SignedAssetsResolver({
+		securityKey,
+		ttlSeconds: Number.parseInt(process.env.PROSOPO_ASSET_TOKEN_TTL_SECONDS ?? "", 10) || 300,
+		...process.env.PROSOPO_ASSET_TOKEN_BIND_IP === "true" && clientIp ? { clientIp } : {}
+	});
+}
+//#endregion
+exports.SignedAssetsResolver = SignedAssetsResolver;
+exports.getSignedAssetsResolver = getSignedAssetsResolver;

package/dist/cjs/api/verify.cjs

@@ -331,6 +331,89 @@ function prosopoVerifyRouter(env) {
 			}));
 		}
 	});
+	/**
+	* Verify a Web Bot Auth authenticated session token. Enforces IP binding:
+	* the operator MUST forward `ip` in the request body, and it must equal
+	* the client IP captured on the session at frictionless issuance. Only
+	* tokens minted with captchaType=authenticated are accepted here; a
+	* regular image/pow/puzzle token routed to this endpoint fails with
+	* INCORRECT_CAPTCHA_TYPE.
+	*/
+	router.post(_prosopo_types.ClientApiPaths.VerifyAuthenticatedSession, async (req, res, next) => {
+		if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+			const verificationResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
+			return res.json(verificationResponse);
+		}
+		let parsed;
+		try {
+			parsed = _prosopo_types.VerifySolutionBody.parse(req.body);
+		} catch (err) {
+			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+				context: {
+					code: 400,
+					error: err,
+					body: req.body
+				},
+				i18n: req.i18n,
+				logger: req.logger
+			}));
+		}
+		const { dappSignature, token, ip, clientSessionId } = parsed;
+		try {
+			const { user, dapp, timestamp, commitmentId: sessionId, providerUrl } = (0, _prosopo_types.decodeProcaptchaOutput)(token);
+			const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
+			if (testVerdict !== null) return res.json({
+				status: "ok",
+				verified: testVerdict
+			});
+			const forwarded = await require_forwardVerify.forwardVerifyIfNotIssuer({
+				env,
+				logger: req.logger,
+				path: _prosopo_types.ClientApiPaths.VerifyAuthenticatedSession,
+				providerUrl,
+				dapp,
+				user,
+				body: parsed,
+				alreadyForwarded: req.headers[_prosopo_api.VERIFY_FORWARDED_HEADER] !== void 0
+			});
+			if (forwarded) return res.json(forwarded);
+			const tasks = new require_tasks.Tasks(env, req.logger);
+			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
+			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
+			if (!await tasks.db.getClientRecord(dapp)) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+				context: {
+					code: 400,
+					siteKey: dapp,
+					user
+				},
+				i18n: req.i18n,
+				logger: req.logger
+			}));
+			const keyPair = env.keyring.addFromAddress(dapp);
+			(0, _prosopo_api_express_router.verifySignature)(dappSignature, timestamp.toString(), keyPair);
+			if (!sessionId) return res.json({
+				status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
+				verified: false
+			});
+			const outcome = await tasks.frictionlessManager.verifyAuthenticatedSession(sessionId, ip, clientSessionId);
+			res.json(outcome);
+		} catch (err) {
+			req.logger.error(() => ({
+				err,
+				msg: "Error in verifyAuthenticatedSession",
+				data: { body: req.body }
+			}));
+			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+				context: {
+					code: 500,
+					siteKey: req.body.dapp,
+					user: req.body.user
+				},
+				i18n: req.i18n,
+				logger: req.logger
+			}));
+		}
+	});
 	router.use(_prosopo_api_express_router.handleErrors);
 	return router;
 }

package/dist/cjs/tasks/detection/getBotScore.cjs

@@ -21,6 +21,7 @@ var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded
 	const md = result.md;
 	const bn = result.bn;
 	const fs = result.fs;
+	const b = result.b;
 	if (baseBotScore === void 0 || Number.isNaN(baseBotScore)) return {
 		baseBotScore: 1,
 		timestamp: 0
@@ -44,7 +45,8 @@ var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded
 		sw,
 		md,
 		bn,
-		fs
+		fs,
+		b
 	};
 };
 //#endregion

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -2,10 +2,12 @@ const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_dnsEventUrl = require("../../api/dnsEventUrl.cjs");
 const require_lang = require("../../rules/lang.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_captchaTypeSelection = require("../captchaTypeSelection.cjs");
 const require_getBotScore = require("../detection/getBotScore.cjs");
 const require_puzzleDifficulty = require("../puzzle/puzzleDifficulty.cjs");
+const require_ipMatch = require("./ipMatch.cjs");
 const require_routingMachine = require("./routingMachine.cjs");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_captcha_severity = require("@prosopo/captcha-severity");
@@ -172,6 +174,91 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		}
 		return sessionRecord;
 	}
+	/**
+	* Dedicated issuance path for Web Bot Auth verified requests. The signature
+	* verification already carried the trust decision; there is no captcha to
+	* solve, no bot score to compute, no routing to run. The session is minted
+	* with `captchaType: authenticated`, `agent: true`, `webBotAuthAgent` set to
+	* the verified Signature-Agent URL, and `ipAddress` frozen for the verify-
+	* time IP-binding check. Consumed only by `/client/authenticated/verify`.
+	*/
+	async createAuthenticatedSession(token, ipAddress, webBotAuthAgent, siteKey, userSitekeyIpHash, headers, ipInfo, clientSessionId) {
+		const sessionRecord = {
+			sessionId: `${getSessionIDPrefix(this.config.host)}-${(0, uuid.v4)()}`,
+			createdAt: /* @__PURE__ */ new Date(),
+			token,
+			score: 0,
+			threshold: 0,
+			scoreComponents: { baseScore: 0 },
+			ipAddress,
+			captchaType: _prosopo_types.CaptchaType.authenticated,
+			userSitekeyIpHash,
+			webView: false,
+			iFrame: false,
+			decryptedHeadHash: "",
+			siteKey,
+			serverChecked: false,
+			agent: true,
+			webBotAuthAgent,
+			...ipInfo && { ipInfo },
+			...headers && { headers },
+			...clientSessionId && { clientMetaData: { clientSessionId } }
+		};
+		await this.db.storeSessionRecord(sessionRecord);
+		if (this.writeQueue) {
+			const cacheData = sessionRecord;
+			const cachePromises = [this.writeQueue.cacheSession(sessionRecord.sessionId, cacheData)];
+			if (userSitekeyIpHash) cachePromises.push(this.writeQueue.cacheSessionByHash(userSitekeyIpHash, sessionRecord.sessionId));
+			await Promise.all(cachePromises).catch(() => {});
+		}
+		return sessionRecord;
+	}
+	/**
+	* Verify an authenticated (Web Bot Auth) session. Called from
+	* `/client/authenticated/verify` after the operator forwards their
+	* dApp-signed token. Enforces the four properties that make replay
+	* infeasible:
+	*   1. session exists and was minted with captchaType=authenticated
+	*      (so ordinary captcha tokens can't be redeemed here)
+	*   2. session hasn't been consumed (serverChecked === false)
+	*   3. operator forwarded the client IP (`ip` is required — silently
+	*      dropping the check would nullify the whole binding)
+	*   4. the forwarded IP matches the IP the session was issued to
+	*
+	* Marks serverChecked=true on success so subsequent verifies fail loudly.
+	*/
+	async verifyAuthenticatedSession(sessionId, ip, clientSessionId) {
+		if (!ip) return {
+			verified: false,
+			status: "API.AUTHENTICATED_IP_REQUIRED"
+		};
+		const session = await this.db.getSessionRecordBySessionId(sessionId);
+		if (!session) return {
+			verified: false,
+			status: "API.USER_NOT_VERIFIED_NO_SOLUTION"
+		};
+		if (session.captchaType !== _prosopo_types.CaptchaType.authenticated) return {
+			verified: false,
+			status: "API.INCORRECT_CAPTCHA_TYPE"
+		};
+		if (session.serverChecked) return {
+			verified: false,
+			status: "API.USER_ALREADY_VERIFIED"
+		};
+		if (!require_ipMatch.ipMatchesSession(ip, session.ipAddress)) return {
+			verified: false,
+			status: "API.AUTHENTICATED_IP_MISMATCH"
+		};
+		if (require_clientMetaData.isClientSessionMismatch(clientSessionId, session.clientMetaData?.clientSessionId)) return {
+			verified: false,
+			status: "API.CLIENT_SESSION_MISMATCH"
+		};
+		await this.db.updateSessionRecord(sessionId, { serverChecked: true });
+		return {
+			verified: true,
+			status: "API.USER_VERIFIED"
+		};
+	}
 	async sendImageCaptcha(params) {
 		return this.sendCaptcha(_prosopo_types.CaptchaType.image, params);
 	}
@@ -198,8 +285,10 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		const imageRoundsBounds = this.routingContext ?? {};
 		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? requestedSolvedImagesCount !== void 0 ? (0, _prosopo_types.clampImageRounds)(requestedSolvedImagesCount, imageRoundsBounds) : requestedSolvedImagesCount : void 0;
 		const finalPowDifficulty = finalCaptchaType === _prosopo_types.CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
+		const finalReason = routed.reason ?? effectiveParams.reason;
 		const finalPuzzleOverrides = finalCaptchaType === _prosopo_types.CaptchaType.puzzle ? (() => {
-			const level = (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count);
+			const maxLevel = this.routingContext?.puzzleMaxDifficulty ?? _prosopo_types.puzzleMaxDifficultyDefault;
+			const level = finalReason !== void 0 && _prosopo_types.NO_MEASUREMENT_REASONS.has(finalReason) ? 0 : (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count, maxLevel);
 			const difficulty = level > 0 ? require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken) : void 0;
 			const tolerance = routed.puzzleTolerance ?? difficulty?.tolerance;
 			const puzzle = routed.puzzle || difficulty ? {
@@ -211,7 +300,6 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 				...puzzle !== void 0 && { puzzle }
 			};
 		})() : {};
-		const finalReason = routed.reason ?? effectiveParams.reason;
 		const blocked = finalCaptchaType === _prosopo_types.CaptchaType.image ? effectiveParams.blocked : void 0;
 		const sessionRecord = await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, finalCaptchaType, effectiveParams.siteKey, finalSolvedImagesCount, finalPowDifficulty, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, finalReason, blocked, void 0, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g, effectiveParams.matchedRule, effectiveParams.i, effectiveParams.sw, effectiveParams.md, effectiveParams.bn, effectiveParams.fs, {
 			synNs: effectiveParams.synNs,

package/dist/cjs/tasks/frictionless/ipMatch.cjs

@@ -0,0 +1,45 @@
+const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+//#region src/tasks/frictionless/ipMatch.ts
+/**
+* `CompositeIpAddress` types its halves as `bigint`, but that is only true of
+* a value just built by `getCompositeIpAddress`. Read back off a session the
+* halves are whatever BSON stored — a `Decimal128`, or a `Long` on records
+* written before the Decimal128 migration — so `===` against a real bigint is
+* false for every session that has been through Mongo. Both BSON types
+* stringify to plain digits at IP magnitudes (≤ 2^64, well inside
+* Decimal128's 34 significant digits), so a string round-trip is exact.
+*
+* `null` for anything unparseable rather than a 0n default: two unparseable
+* halves must not compare equal, or garbage would match garbage.
+*/
+var asBigInt = (half) => {
+	if (typeof half === "bigint") return half;
+	if (half === void 0 || half === null) return 0n;
+	try {
+		return BigInt(String(half));
+	} catch {
+		return null;
+	}
+};
+/**
+* Compare an operator-supplied plain-string IP against the CompositeIpAddress
+* captured on a session. Returns true iff the parsed IP has the same type
+* (v4/v6) and numeric halves.
+*
+* Load-bearing for Web Bot Auth IP binding — a leaked authenticated token
+* replayed from a different IP fails here. Malformed operator IPs degrade
+* to {lower: 0n, type: v4} inside getCompositeIpAddress and can never match
+* a real session (a real v4 session has a non-zero `lower`; a real v6 has
+* type=v6). That degradation is deliberate: silently treating garbage as a
+* match would nullify the whole binding.
+*/
+var ipMatchesSession = (operatorIp, sessionIp) => {
+	const parsed = require_compositeIpAddress.getCompositeIpAddress(operatorIp);
+	if (parsed.type !== sessionIp.type) return false;
+	const lower = asBigInt(sessionIp.lower);
+	const upper = asBigInt(sessionIp.upper);
+	if (lower === null || upper === null) return false;
+	return parsed.lower === lower && (parsed.upper ?? 0n) === upper;
+};
+//#endregion
+exports.ipMatchesSession = ipMatchesSession;

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -1,12 +1,12 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_lang = require("../../rules/lang.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
 const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_pairs = require("../../pairs.cjs");
 const require_util = require("../../util.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -1,11 +1,11 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
 const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_routingMachine = require("../frictionless/routingMachine.cjs");
 const require_util = require("../../util.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -1,10 +1,10 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
 const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_util = require("../../util.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");

package/dist/tasks/detection/getBotScore.d.ts

@@ -18,6 +18,7 @@ export declare const getBotScore: (payload: string, headHash: string, privateKey
     md?: undefined;
     bn?: undefined;
     fs?: undefined;
+    b?: undefined;
 } | {
     baseBotScore: number;
     timestamp: number;
@@ -38,5 +39,6 @@ export declare const getBotScore: (payload: string, headHash: string, privateKey
     md: boolean | undefined;
     bn: boolean | undefined;
     fs: boolean | undefined;
+    b: Record<string, string[]> | undefined;
 }>;
 //# sourceMappingURL=getBotScore.d.ts.map

package/dist/tasks/detection/getBotScore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getBotScore.d.ts","sourceRoot":"","sources":["../../../src/tasks/detection/getBotScore.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,YACd,MAAM,YACL,MAAM,qBACG,MAAM,uBACJ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4D3B,CAAC"}
+{"version":3,"file":"getBotScore.d.ts","sourceRoot":"","sources":["../../../src/tasks/detection/getBotScore.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,YACd,MAAM,YACL,MAAM,qBACG,MAAM,uBACJ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8D3B,CAAC"}

package/dist/tasks/detection/getBotScore.js

@@ -21,6 +21,7 @@ var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded
 	const md = result.md;
 	const bn = result.bn;
 	const fs = result.fs;
+	const b = result.b;
 	if (baseBotScore === void 0 || Number.isNaN(baseBotScore)) return {
 		baseBotScore: 1,
 		timestamp: 0
@@ -44,7 +45,8 @@ var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded
 		sw,
 		md,
 		bn,
-		fs
+		fs,
+		b
 	};
 };
 //#endregion

package/dist/tasks/detection/getBotScore.js.map

@@ -1 +1 @@
-{"version":3,"file":"getBotScore.js","sourceRoot":"","sources":["../../../src/tasks/detection/getBotScore.ts"],"names":[],"mappings":"AAeA,OAAO,sBAAsB,MAAM,oBAAoB,CAAC;AAExD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC/B,OAAe,EACf,QAAgB,EAChB,gBAAyB,EACzB,kBAA2B,EAC1B,EAAE;IACH,MAAM,MAAM,GAAG,CAAC,MAAM,sBAAsB,CAC3C,OAAO,EACP,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,CAClB,CAAmB,CAAC;IACrB,MAAM,YAAY,GAAW,MAAM,CAAC,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAW,MAAM,CAAC,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAW,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,SAAS,GAAW,MAAM,CAAC,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAY,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAY,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IACnD,MAAM,iBAAiB,GAAW,MAAM,CAAC,iBAAiB,CAAC;IAC3D,MAAM,kBAAkB,GAAyB,MAAM,CAAC,kBAAkB,CAAC;IAC3E,MAAM,gBAAgB,GAAwB,MAAM,CAAC,gBAAgB,CAAC;IACtE,MAAM,4BAA4B,GACjC,MAAM,CAAC,4BAA4B,CAAC;IACrC,MAAM,wBAAwB,GAC7B,MAAM,CAAC,wBAAwB,CAAC;IACjC,MAAM,wBAAwB,GAC7B,MAAM,CAAC,wBAAwB,CAAC;IACjC,MAAM,sBAAsB,GAC3B,MAAM,CAAC,sBAAsB,CAAC;IAC/B,MAAM,CAAC,GAAuB,MAAM,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,GAAwB,MAAM,CAAC,CAAC,CAAC;IACxC,MAAM,EAAE,GAAwB,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAwB,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAwB,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAwB,MAAM,CAAC,EAAE,CAAC;IAE1C,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO;YACN,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,CAAC;SACZ,CAAC;IACH,CAAC;IAED,OAAO;QACN,YAAY;QACZ,SAAS;QACT,MAAM;QACN,SAAS;QACT,SAAS;QACT,QAAQ;QACR,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,4BAA4B;QAC5B,wBAAwB;QACxB,wBAAwB;QACxB,sBAAsB;QACtB,CAAC;QACD,CAAC;QACD,EAAE;QACF,EAAE;QACF,EAAE;QACF,EAAE;KACF,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"getBotScore.js","sourceRoot":"","sources":["../../../src/tasks/detection/getBotScore.ts"],"names":[],"mappings":"AAeA,OAAO,sBAAsB,MAAM,oBAAoB,CAAC;AAExD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC/B,OAAe,EACf,QAAgB,EAChB,gBAAyB,EACzB,kBAA2B,EAC1B,EAAE;IACH,MAAM,MAAM,GAAG,CAAC,MAAM,sBAAsB,CAC3C,OAAO,EACP,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,CAClB,CAAmB,CAAC;IACrB,MAAM,YAAY,GAAW,MAAM,CAAC,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAW,MAAM,CAAC,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAW,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,SAAS,GAAW,MAAM,CAAC,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAY,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAY,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IACnD,MAAM,iBAAiB,GAAW,MAAM,CAAC,iBAAiB,CAAC;IAC3D,MAAM,kBAAkB,GAAyB,MAAM,CAAC,kBAAkB,CAAC;IAC3E,MAAM,gBAAgB,GAAwB,MAAM,CAAC,gBAAgB,CAAC;IACtE,MAAM,4BAA4B,GACjC,MAAM,CAAC,4BAA4B,CAAC;IACrC,MAAM,wBAAwB,GAC7B,MAAM,CAAC,wBAAwB,CAAC;IACjC,MAAM,wBAAwB,GAC7B,MAAM,CAAC,wBAAwB,CAAC;IACjC,MAAM,sBAAsB,GAC3B,MAAM,CAAC,sBAAsB,CAAC;IAC/B,MAAM,CAAC,GAAuB,MAAM,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,GAAwB,MAAM,CAAC,CAAC,CAAC;IACxC,MAAM,EAAE,GAAwB,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAwB,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAwB,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAwB,MAAM,CAAC,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAyC,MAAM,CAAC,CAAC,CAAC;IAEzD,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO;YACN,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,CAAC;SACZ,CAAC;IACH,CAAC;IAED,OAAO;QACN,YAAY;QACZ,SAAS;QACT,MAAM;QACN,SAAS;QACT,SAAS;QACT,QAAQ;QACR,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,4BAA4B;QAC5B,wBAAwB;QACxB,wBAAwB;QACxB,sBAAsB;QACtB,CAAC;QACD,CAAC;QACD,EAAE;QACF,EAAE;QACF,EAAE;QACF,EAAE;QACF,CAAC;KACD,CAAC;AACH,CAAC,CAAC"}

package/dist/tasks/frictionless/frictionlessTasks.d.ts

@@ -27,6 +27,11 @@ export declare class FrictionlessManager extends CaptchaManager {
     updateScore(score: number, scoreComponents: ScoreComponents): void;
     checkLangRules(acceptLanguage: string): number;
     createSession(token: string, score: number, threshold: number, scoreComponents: ScoreComponents, ipAddress: CompositeIpAddress, captchaType: CaptchaType, siteKey: string, solvedImagesCount?: number, powDifficulty?: number, userSitekeyIpHash?: string, webView?: boolean, iFrame?: boolean, decryptedHeadHash?: string, reason?: FrictionlessReason, blocked?: boolean, deleted?: boolean, ipInfo?: IPInfoResponse, headers?: RequestHeaders, mode?: ModeEnum, simdReadings?: Session["simdReadings"], entropyMathRandomFingerprint?: Session["entropyMathRandomFingerprint"], entropyCryptoFingerprint?: Session["entropyCryptoFingerprint"], entropyWallClockOffsetMs?: Session["entropyWallClockOffsetMs"], entropyMathRandomFirst?: Session["entropyMathRandomFirst"], bundleId?: Session["bundleId"], currentUrl?: Session["currentUrl"], tcpToChelloUs?: Session["tcpToChelloUs"], chelloToHandshakeUs?: Session["chelloToHandshakeUs"], isEscalation?: Session["isEscalation"], iframeUrl?: Session["iframeUrl"], isProtect?: Session["isProtect"], originSessionId?: Session["originSessionId"], g?: Session["g"], matchedRule?: Session["matchedRule"], i?: Session["i"], sw?: Session["sw"], md?: Session["md"], bn?: Session["bn"], fs?: Session["fs"], rawTlsSignals?: Partial<RawTlsSignals>, puzzleOverrides?: Pick<Session, "puzzleTolerance" | "puzzle">): Promise<Session>;
+    createAuthenticatedSession(token: string, ipAddress: CompositeIpAddress, webBotAuthAgent: string, siteKey: string, userSitekeyIpHash?: string, headers?: RequestHeaders, ipInfo?: IPInfoResponse, clientSessionId?: string): Promise<Session>;
+    verifyAuthenticatedSession(sessionId: string, ip: string | undefined, clientSessionId: string | undefined): Promise<{
+        verified: boolean;
+        status: string;
+    }>;
     sendImageCaptcha(params?: Partial<ImageCaptchaSessionParams>): Promise<GetFrictionlessCaptchaResponse>;
     sendPowCaptcha(params?: Partial<PowCaptchaSessionParams>): Promise<GetFrictionlessCaptchaResponse>;
     sendPuzzleCaptcha(params?: Partial<PuzzleCaptchaSessionParams>): Promise<GetFrictionlessCaptchaResponse>;

package/dist/tasks/frictionless/frictionlessTasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frictionlessTasks.d.ts","sourceRoot":"","sources":["../../../src/tasks/frictionless/frictionlessTasks.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAEN,WAAW,EACX,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,KAAK,8BAA8B,EACnC,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,OAAO,EAGZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAE1E,OAAO,EACN,KAAK,aAAa,EAElB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AAGpF,OAAO,EAAE,KAAK,cAAc,EAAe,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,MAAM,WAAW,yBAA0B,SAAQ,OAAO;CAAG;AAE7D,MAAM,WAAW,uBAAwB,SAAQ,OAAO;CAAG;AAE3D,MAAM,WAAW,0BAA2B,SAAQ,OAAO;CAAG;AAE9D,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,OAAO,CAAC,aAAa,CAAC,CAGpB;IACF,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAwB;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAGpD,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,eAAe,GAAG,IAAI,EAC/D,qBAAqB,CAAC,EAAE,qBAAqB,EAC7C,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI;IAkBrC,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI;IAgBtC,mBAAmB,CACxB,QAAQ,EAAE,sBAAsB,EAChC,GAAG,EAAE,cAAc,GACjB,OAAO,CAAC,oBAAoB,CAAC;IAUhC,gBAAgB,CACf,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC,GAC9D,IAAI;IA0DP,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAMzD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,GAAG,IAAI;IAOlE,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAIxC,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,kBAAkB,EAC7B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,MAAM,EACf,iBAAiB,CAAC,EAAE,MAAM,EAC1B,aAAa,CAAC,EAAE,MAAM,EACtB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,OAAO,UAAQ,EACf,MAAM,UAAQ,EACd,iBAAiB,SAAK,EACtB,MAAM,CAAC,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,QAAQ,EACf,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACtC,4BAA4B,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,EACtE,wBAAwB,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9D,wBAAwB,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9D,sBAAsB,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,EAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAC9B,UAAU,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAClC,aAAa,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,EACxC,mBAAmB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACpD,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACtC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAC5C,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAChB,WAAW,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EACpC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAIlB,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EAGtC,eAAe,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,CAAC,GAC3D,OAAO,CAAC,OAAO,CAAC;IAqGb,gBAAgB,CACrB,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GACzC,OAAO,CAAC,8BAA8B,CAAC;IAIpC,cAAc,CACnB,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GACvC,OAAO,CAAC,8BAA8B,CAAC;IAIpC,iBAAiB,CACtB,MAAM,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC;YAO5B,WAAW;IAiOnB,sBAAsB,CAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC;IAqEhB,yBAAyB,CACxB,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IActD,oBAAoB,CACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IActD,sBAAsB,CACrB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IAetD,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAWlD,OAAO,CAAC,mBAAmB;IAsBrB,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAWI,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;CA2L3B"}
+{"version":3,"file":"frictionlessTasks.d.ts","sourceRoot":"","sources":["../../../src/tasks/frictionless/frictionlessTasks.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAEN,WAAW,EACX,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,KAAK,8BAA8B,EACnC,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEb,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,OAAO,EAIZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAE1E,OAAO,EACN,KAAK,aAAa,EAElB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AAIpF,OAAO,EAAE,KAAK,cAAc,EAAe,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,MAAM,WAAW,yBAA0B,SAAQ,OAAO;CAAG;AAE7D,MAAM,WAAW,uBAAwB,SAAQ,OAAO;CAAG;AAE3D,MAAM,WAAW,0BAA2B,SAAQ,OAAO;CAAG;AAE9D,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,OAAO,CAAC,aAAa,CAAC,CAGpB;IACF,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAwB;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAGpD,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,eAAe,GAAG,IAAI,EAC/D,qBAAqB,CAAC,EAAE,qBAAqB,EAC7C,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI;IAkBrC,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI;IAgBtC,mBAAmB,CACxB,QAAQ,EAAE,sBAAsB,EAChC,GAAG,EAAE,cAAc,GACjB,OAAO,CAAC,oBAAoB,CAAC;IAUhC,gBAAgB,CACf,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC,GAC9D,IAAI;IA0DP,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAMzD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,GAAG,IAAI;IAOlE,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAIxC,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,kBAAkB,EAC7B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,MAAM,EACf,iBAAiB,CAAC,EAAE,MAAM,EAC1B,aAAa,CAAC,EAAE,MAAM,EACtB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,OAAO,UAAQ,EACf,MAAM,UAAQ,EACd,iBAAiB,SAAK,EACtB,MAAM,CAAC,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,QAAQ,EACf,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACtC,4BAA4B,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,EACtE,wBAAwB,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9D,wBAAwB,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9D,sBAAsB,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,EAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAC9B,UAAU,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAClC,aAAa,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,EACxC,mBAAmB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACpD,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACtC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAC5C,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAChB,WAAW,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EACpC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAIlB,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EAGtC,eAAe,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,CAAC,GAC3D,OAAO,CAAC,OAAO,CAAC;IA6Gb,0BAA0B,CAC/B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,kBAAkB,EAC7B,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EACf,iBAAiB,CAAC,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc,EACxB,MAAM,CAAC,EAAE,cAAc,EACvB,eAAe,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;IAqEb,0BAA0B,CAC/B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GAAG,SAAS,EACtB,eAAe,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqD3C,gBAAgB,CACrB,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GACzC,OAAO,CAAC,8BAA8B,CAAC;IAIpC,cAAc,CACnB,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GACvC,OAAO,CAAC,8BAA8B,CAAC;IAIpC,iBAAiB,CACtB,MAAM,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC;YAO5B,WAAW;IAwPnB,sBAAsB,CAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC;IAqEhB,yBAAyB,CACxB,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IActD,oBAAoB,CACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IActD,sBAAsB,CACrB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,eAAe,GAC9B;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,eAAe,CAAA;KAAE;IAetD,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAWlD,OAAO,CAAC,mBAAmB;IAsBrB,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAWI,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;CA2L3B"}

package/dist/tasks/frictionless/frictionlessTasks.js

@@ -2,12 +2,14 @@ import { buildAllWindowIncrements } from "../../util/usageCounters.js";
 import { DecisionMachineRunner } from "../decisionMachine/decisionMachineRunner.js";
 import { buildDnsEventUrl } from "../../api/dnsEventUrl.js";
 import { checkLangRules } from "../../rules/lang.js";
+import { isClientSessionMismatch } from "../../utils/clientMetaData.js";
 import { CaptchaManager } from "../captchaManager.js";
 import { coerceToEnabledCaptchaType } from "../captchaTypeSelection.js";
 import { getBotScore } from "../detection/getBotScore.js";
 import { samplePuzzleDifficulty } from "../puzzle/puzzleDifficulty.js";
+import { ipMatchesSession } from "./ipMatch.js";
 import { applyRouter } from "./routingMachine.js";
-import { ApiParams, CaptchaType, FrictionlessReason as FrictionlessReason$1, SimdReadingsStage, clampImageRounds } from "@prosopo/types";
+import { ApiParams, CaptchaType, FrictionlessReason as FrictionlessReason$1, NO_MEASUREMENT_REASONS, SimdReadingsStage, clampImageRounds, puzzleMaxDifficultyDefault } from "@prosopo/types";
 import { severityToPuzzleDifficulty } from "@prosopo/captcha-severity";
 import { DEFAULT_RENDER_SETTINGS } from "@prosopo/puzzle-assets";
 import { v4 } from "uuid";
@@ -172,6 +174,91 @@ var FrictionlessManager = class extends CaptchaManager {
 		}
 		return sessionRecord;
 	}
+	/**
+	* Dedicated issuance path for Web Bot Auth verified requests. The signature
+	* verification already carried the trust decision; there is no captcha to
+	* solve, no bot score to compute, no routing to run. The session is minted
+	* with `captchaType: authenticated`, `agent: true`, `webBotAuthAgent` set to
+	* the verified Signature-Agent URL, and `ipAddress` frozen for the verify-
+	* time IP-binding check. Consumed only by `/client/authenticated/verify`.
+	*/
+	async createAuthenticatedSession(token, ipAddress, webBotAuthAgent, siteKey, userSitekeyIpHash, headers, ipInfo, clientSessionId) {
+		const sessionRecord = {
+			sessionId: `${getSessionIDPrefix(this.config.host)}-${v4()}`,
+			createdAt: /* @__PURE__ */ new Date(),
+			token,
+			score: 0,
+			threshold: 0,
+			scoreComponents: { baseScore: 0 },
+			ipAddress,
+			captchaType: CaptchaType.authenticated,
+			userSitekeyIpHash,
+			webView: false,
+			iFrame: false,
+			decryptedHeadHash: "",
+			siteKey,
+			serverChecked: false,
+			agent: true,
+			webBotAuthAgent,
+			...ipInfo && { ipInfo },
+			...headers && { headers },
+			...clientSessionId && { clientMetaData: { clientSessionId } }
+		};
+		await this.db.storeSessionRecord(sessionRecord);
+		if (this.writeQueue) {
+			const cacheData = sessionRecord;
+			const cachePromises = [this.writeQueue.cacheSession(sessionRecord.sessionId, cacheData)];
+			if (userSitekeyIpHash) cachePromises.push(this.writeQueue.cacheSessionByHash(userSitekeyIpHash, sessionRecord.sessionId));
+			await Promise.all(cachePromises).catch(() => {});
+		}
+		return sessionRecord;
+	}
+	/**
+	* Verify an authenticated (Web Bot Auth) session. Called from
+	* `/client/authenticated/verify` after the operator forwards their
+	* dApp-signed token. Enforces the four properties that make replay
+	* infeasible:
+	*   1. session exists and was minted with captchaType=authenticated
+	*      (so ordinary captcha tokens can't be redeemed here)
+	*   2. session hasn't been consumed (serverChecked === false)
+	*   3. operator forwarded the client IP (`ip` is required — silently
+	*      dropping the check would nullify the whole binding)
+	*   4. the forwarded IP matches the IP the session was issued to
+	*
+	* Marks serverChecked=true on success so subsequent verifies fail loudly.
+	*/
+	async verifyAuthenticatedSession(sessionId, ip, clientSessionId) {
+		if (!ip) return {
+			verified: false,
+			status: "API.AUTHENTICATED_IP_REQUIRED"
+		};
+		const session = await this.db.getSessionRecordBySessionId(sessionId);
+		if (!session) return {
+			verified: false,
+			status: "API.USER_NOT_VERIFIED_NO_SOLUTION"
+		};
+		if (session.captchaType !== CaptchaType.authenticated) return {
+			verified: false,
+			status: "API.INCORRECT_CAPTCHA_TYPE"
+		};
+		if (session.serverChecked) return {
+			verified: false,
+			status: "API.USER_ALREADY_VERIFIED"
+		};
+		if (!ipMatchesSession(ip, session.ipAddress)) return {
+			verified: false,
+			status: "API.AUTHENTICATED_IP_MISMATCH"
+		};
+		if (isClientSessionMismatch(clientSessionId, session.clientMetaData?.clientSessionId)) return {
+			verified: false,
+			status: "API.CLIENT_SESSION_MISMATCH"
+		};
+		await this.db.updateSessionRecord(sessionId, { serverChecked: true });
+		return {
+			verified: true,
+			status: "API.USER_VERIFIED"
+		};
+	}
 	async sendImageCaptcha(params) {
 		return this.sendCaptcha(CaptchaType.image, params);
 	}
@@ -198,8 +285,10 @@ var FrictionlessManager = class extends CaptchaManager {
 		const imageRoundsBounds = this.routingContext ?? {};
 		const finalSolvedImagesCount = finalCaptchaType === CaptchaType.image ? requestedSolvedImagesCount !== void 0 ? clampImageRounds(requestedSolvedImagesCount, imageRoundsBounds) : requestedSolvedImagesCount : void 0;
 		const finalPowDifficulty = finalCaptchaType === CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
+		const finalReason = routed.reason ?? effectiveParams.reason;
 		const finalPuzzleOverrides = finalCaptchaType === CaptchaType.puzzle ? (() => {
-			const level = severityToPuzzleDifficulty(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count);
+			const maxLevel = this.routingContext?.puzzleMaxDifficulty ?? puzzleMaxDifficultyDefault;
+			const level = finalReason !== void 0 && NO_MEASUREMENT_REASONS.has(finalReason) ? 0 : severityToPuzzleDifficulty(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count, maxLevel);
 			const difficulty = level > 0 ? samplePuzzleDifficulty(level, DEFAULT_RENDER_SETTINGS.holeDarken) : void 0;
 			const tolerance = routed.puzzleTolerance ?? difficulty?.tolerance;
 			const puzzle = routed.puzzle || difficulty ? {
@@ -211,7 +300,6 @@ var FrictionlessManager = class extends CaptchaManager {
 				...puzzle !== void 0 && { puzzle }
 			};
 		})() : {};
-		const finalReason = routed.reason ?? effectiveParams.reason;
 		const blocked = finalCaptchaType === CaptchaType.image ? effectiveParams.blocked : void 0;
 		const sessionRecord = await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, finalCaptchaType, effectiveParams.siteKey, finalSolvedImagesCount, finalPowDifficulty, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, finalReason, blocked, void 0, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g, effectiveParams.matchedRule, effectiveParams.i, effectiveParams.sw, effectiveParams.md, effectiveParams.bn, effectiveParams.fs, {
 			synNs: effectiveParams.synNs,