@prosopo/provider 5.8.1 → 5.10.0

package/dist/cjs/api/healthzGeo.cjs

@@ -0,0 +1,209 @@
+let _prosopo_types = require("@prosopo/types");
+let zod = require("zod");
+//#region src/api/healthzGeo.ts
+/**
+* Geo steering for `/healthz`.
+*
+* `/healthz` tells a client which node to pin its captcha calls to. By default
+* a node answers with its own name, so the pin is whatever the DNS layer
+* picked. With steering enabled the node instead answers with the node the
+* caller's country is mapped to, when that node is known to be up.
+*
+* Off by default. With the flag off nothing here runs: no lookup, no poller,
+* no response header, no counter.
+*
+* Configuration (all read once, at first use):
+*
+*   PROSOPO_HEALTHZ_GEO_STEERING
+*     "true" enables steering. Anything else, including unset, disables it.
+*
+*   PROSOPO_HEALTHZ_GEO_ROUTES
+*     JSON object mapping ISO 3166-1 alpha-2 country code to hostname, e.g.
+*     `{"XX":"node1.example.com","YY":"node2.example.com"}`. Keys are
+*     case-insensitive. Countries absent from the map are not steered.
+*
+*     The map is the candidate set: a host that must not receive traffic
+*     simply does not appear in it. Nothing here derives candidates from
+*     anywhere else, so the deployment that generates the map is the single
+*     place that decides which nodes are in rotation.
+*
+*   PROSOPO_HEALTHZ_GEO_PROBE_INTERVAL_MS   (default 30000)
+*   PROSOPO_HEALTHZ_GEO_PROBE_TIMEOUT_MS    (default 2000)
+*     Background health-probe period and per-probe timeout.
+*
+* An invalid or unparseable route map disables steering rather than failing
+* startup — the fallback is the node's own name, which is the default
+* behaviour.
+*/
+var DEFAULT_PROBE_INTERVAL_MS = 3e4;
+var DEFAULT_PROBE_TIMEOUT_MS = 2e3;
+var MIN_PROBE_INTERVAL_MS = 1e3;
+/** Hostname, not a URL: no scheme, no path, no port. */
+var hostnameSchema = zod.z.string().min(1).max(253).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i);
+var routesSchema = zod.z.record(zod.z.string().regex(/^[a-z]{2}$/i), hostnameSchema);
+var parsePositiveInt = (raw, fallback) => {
+	if (raw === void 0) return fallback;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+};
+var parseRoutes = (raw, logger) => {
+	if (!raw || raw.trim().length === 0) return /* @__PURE__ */ new Map();
+	try {
+		const parsed = routesSchema.parse(JSON.parse(raw));
+		return new Map(Object.entries(parsed).map(([country, host]) => [country.toUpperCase(), host]));
+	} catch (err) {
+		logger?.warn(() => ({
+			msg: "PROSOPO_HEALTHZ_GEO_ROUTES is not a valid country->host map; healthz geo steering stays off",
+			err
+		}));
+		return /* @__PURE__ */ new Map();
+	}
+};
+var readHealthzGeoConfig = (envVars = process.env, logger) => {
+	const routes = parseRoutes(envVars.PROSOPO_HEALTHZ_GEO_ROUTES, logger);
+	return {
+		enabled: envVars.PROSOPO_HEALTHZ_GEO_STEERING === "true" && routes.size > 0,
+		routes,
+		probeIntervalMs: Math.max(MIN_PROBE_INTERVAL_MS, parsePositiveInt(envVars.PROSOPO_HEALTHZ_GEO_PROBE_INTERVAL_MS, DEFAULT_PROBE_INTERVAL_MS)),
+		probeTimeoutMs: parsePositiveInt(envVars.PROSOPO_HEALTHZ_GEO_PROBE_TIMEOUT_MS, DEFAULT_PROBE_TIMEOUT_MS)
+	};
+};
+var fetchHealthzProbe = async (host, timeoutMs) => {
+	try {
+		return (await fetch(`https://${host}${_prosopo_types.PublicApiPaths.Healthz}`, {
+			method: "GET",
+			signal: AbortSignal.timeout(timeoutMs)
+		})).ok;
+	} catch {
+		return false;
+	}
+};
+/**
+* Tracks whether each candidate host is answering, in the background.
+*
+* `/healthz` is served before the request pipeline that would otherwise
+* observe a node's health, so nothing else here knows whether a candidate is
+* reachable. Every host starts `false` and only becomes `true` on a successful
+* probe, so a poller that has not run, cannot run, or is failing leaves every
+* candidate down and steering off — degrading to the default behaviour by
+* construction rather than by a fallback branch.
+*
+* The probe never touches the request path: `isUp()` reads a boolean.
+*/
+var TargetHealthMonitor = class {
+	constructor(options) {
+		this.up = /* @__PURE__ */ new Map();
+		this.hosts = [...new Set(options.hosts)];
+		this.intervalMs = options.intervalMs;
+		this.timeoutMs = options.timeoutMs;
+		this.probe = options.probe ?? fetchHealthzProbe;
+		this.logger = options.logger;
+	}
+	isUp(host) {
+		return this.up.get(host) === true;
+	}
+	start() {
+		if (this.timer !== void 0 || this.hosts.length === 0) return;
+		this.pollAll();
+		this.timer = setInterval(() => {
+			this.pollAll();
+		}, this.intervalMs);
+		this.timer.unref?.();
+	}
+	stop() {
+		if (this.timer !== void 0) {
+			clearInterval(this.timer);
+			this.timer = void 0;
+		}
+	}
+	/** One probe round over every candidate. Exposed so tests can await it. */
+	async pollAll() {
+		await Promise.all(this.hosts.map(async (host) => {
+			let healthy = false;
+			try {
+				healthy = await this.probe(host, this.timeoutMs);
+			} catch {
+				healthy = false;
+			}
+			const previous = this.up.get(host);
+			this.up.set(host, healthy);
+			if (previous !== healthy) this.logger?.info(() => ({
+				msg: "healthz geo target health changed",
+				data: {
+					host,
+					healthy
+				}
+			}));
+		}));
+	}
+};
+/**
+* Picks the host `/healthz` should answer with. Pure apart from reading the
+* monitor's booleans and the memory-mapped country lookup — it never awaits
+* anything, so it cannot delay or fail a health check.
+*/
+var HealthzGeoRouter = class {
+	constructor(config, env, monitor) {
+		this.enabled = config.enabled;
+		this.routes = config.routes;
+		this.ipInfoService = env.ipInfoService;
+		this.monitor = monitor ?? new TargetHealthMonitor({
+			hosts: [...new Set(config.routes.values())],
+			intervalMs: config.probeIntervalMs,
+			timeoutMs: config.probeTimeoutMs,
+			logger: env.logger
+		});
+	}
+	start() {
+		if (this.enabled) this.monitor.start();
+	}
+	stop() {
+		this.monitor.stop();
+	}
+	resolveHost(clientIp, ownHost) {
+		if (!this.enabled) return {
+			host: ownHost,
+			outcome: "not_steered"
+		};
+		if (!clientIp) return {
+			host: ownHost,
+			outcome: "geo_unavailable"
+		};
+		if (!this.ipInfoService.isAvailable()) return {
+			host: ownHost,
+			outcome: "geo_unavailable"
+		};
+		const country = this.ipInfoService.country(clientIp);
+		if (!country) return {
+			host: ownHost,
+			outcome: "geo_unavailable"
+		};
+		const target = this.routes.get(country.toUpperCase());
+		if (target === void 0 || target === ownHost) return {
+			host: ownHost,
+			outcome: "not_steered"
+		};
+		if (!this.monitor.isUp(target)) return {
+			host: ownHost,
+			outcome: "target_down"
+		};
+		return {
+			host: target,
+			outcome: "steered"
+		};
+	}
+};
+var cachedRouter;
+var getHealthzGeoRouter = (env) => {
+	if (!cachedRouter) {
+		cachedRouter = new HealthzGeoRouter(readHealthzGeoConfig(process.env, env.logger), env);
+		cachedRouter.start();
+	}
+	return cachedRouter;
+};
+//#endregion
+exports.HealthzGeoRouter = HealthzGeoRouter;
+exports.TargetHealthMonitor = TargetHealthMonitor;
+exports.fetchHealthzProbe = fetchHealthzProbe;
+exports.getHealthzGeoRouter = getHealthzGeoRouter;
+exports.readHealthzGeoConfig = readHealthzGeoConfig;

package/dist/cjs/api/metrics.cjs

@@ -154,6 +154,12 @@ var buildMetrics = () => {
 			help: "1 when the given redis connection is ready, else 0",
 			labelNames: ["actor"],
 			registers: [registry]
+		}),
+		healthzGeoOutcomesTotal: new prom_client.Counter({
+			name: `${PREFIX}healthz_geo_outcomes_total`,
+			help: "Healthz geo steering outcomes (steered/not_steered/target_down/geo_unavailable)",
+			labelNames: ["outcome"],
+			registers: [registry]
 		})
 	};
 };
@@ -202,6 +208,10 @@ var recordSpamEmail = (result) => {
 	if (!metricsEnabled()) return;
 	getMetrics().spamEmailTotal.inc({ result });
 };
+var recordHealthzGeoOutcome = (outcome) => {
+	if (!metricsEnabled()) return;
+	getMetrics().healthzGeoOutcomesTotal.inc({ outcome });
+};
 var setMaintenanceModeGauge = (on) => {
 	if (!metricsEnabled()) return;
 	getMetrics().maintenanceMode.set(on ? 1 : 0);
@@ -257,5 +267,6 @@ exports.recordCaptchaVerify = recordCaptchaVerify;
 exports.recordDetectorTriggered = recordDetectorTriggered;
 exports.recordDomainValidation = recordDomainValidation;
 exports.recordFrictionlessDecision = recordFrictionlessDecision;
+exports.recordHealthzGeoOutcome = recordHealthzGeoOutcome;
 exports.recordSpamEmail = recordSpamEmail;
 exports.setMaintenanceModeGauge = setMaintenanceModeGauge;

package/dist/cjs/api/public.cjs

@@ -1,5 +1,6 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_metrics = require("./metrics.cjs");
+const require_healthzGeo = require("./healthzGeo.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
@@ -14,11 +15,19 @@ express = require_runtime.__toESM(express, 1);
 */
 function publicRouter(env) {
 	const router = express.default.Router();
+	const geo = require_healthzGeo.getHealthzGeoRouter(env);
 	router.get(_prosopo_types.PublicApiPaths.Healthz, (req, res) => {
-		const host = env.config.host && env.config.host.length > 0 ? env.config.host : req.hostname;
+		const ownHost = env.config.host && env.config.host.length > 0 ? env.config.host : req.hostname;
+		if (!geo.enabled) return res.status(200).json({
+			ok: true,
+			host: ownHost
+		});
+		res.set("Cache-Control", "no-store, private");
+		const decision = geo.resolveHost(req.ip, ownHost);
+		require_metrics.recordHealthzGeoOutcome(decision.outcome);
 		return res.status(200).json({
 			ok: true,
-			host
+			host: decision.host
 		});
 	});
 	if (require_metrics.metricsEnabled()) router.get(_prosopo_types.PublicApiPaths.Metrics, require_metrics.metricsHandler(env));
@@ -30,9 +39,11 @@ function publicRouter(env) {
 			const db = env.getDb();
 			const redisConnection = db.getRedisConnection();
 			const redisAccessRulesConnection = db.getRedisAccessRulesConnection();
+			const host = env.config.host && env.config.host.length > 0 ? env.config.host : req.hostname;
 			const response = {
 				version: _prosopo_util.version,
 				message: "Provider online",
+				host,
 				redis: [{
 					actor: "General",
 					isReady: redisConnection.isReady(),

package/dist/cjs/api/verify.cjs

@@ -331,6 +331,89 @@ function prosopoVerifyRouter(env) {
 			}));
 		}
 	});
+	/**
+	* Verify a Web Bot Auth authenticated session token. Enforces IP binding:
+	* the operator MUST forward `ip` in the request body, and it must equal
+	* the client IP captured on the session at frictionless issuance. Only
+	* tokens minted with captchaType=authenticated are accepted here; a
+	* regular image/pow/puzzle token routed to this endpoint fails with
+	* INCORRECT_CAPTCHA_TYPE.
+	*/
+	router.post(_prosopo_types.ClientApiPaths.VerifyAuthenticatedSession, async (req, res, next) => {
+		if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+			const verificationResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
+			return res.json(verificationResponse);
+		}
+		let parsed;
+		try {
+			parsed = _prosopo_types.VerifySolutionBody.parse(req.body);
+		} catch (err) {
+			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+				context: {
+					code: 400,
+					error: err,
+					body: req.body
+				},
+				i18n: req.i18n,
+				logger: req.logger
+			}));
+		}
+		const { dappSignature, token, ip, clientSessionId } = parsed;
+		try {
+			const { user, dapp, timestamp, commitmentId: sessionId, providerUrl } = (0, _prosopo_types.decodeProcaptchaOutput)(token);
+			const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
+			if (testVerdict !== null) return res.json({
+				status: "ok",
+				verified: testVerdict
+			});
+			const forwarded = await require_forwardVerify.forwardVerifyIfNotIssuer({
+				env,
+				logger: req.logger,
+				path: _prosopo_types.ClientApiPaths.VerifyAuthenticatedSession,
+				providerUrl,
+				dapp,
+				user,
+				body: parsed,
+				alreadyForwarded: req.headers[_prosopo_api.VERIFY_FORWARDED_HEADER] !== void 0
+			});
+			if (forwarded) return res.json(forwarded);
+			const tasks = new require_tasks.Tasks(env, req.logger);
+			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
+			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
+			if (!await tasks.db.getClientRecord(dapp)) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+				context: {
+					code: 400,
+					siteKey: dapp,
+					user
+				},
+				i18n: req.i18n,
+				logger: req.logger
+			}));
+			const keyPair = env.keyring.addFromAddress(dapp);
+			(0, _prosopo_api_express_router.verifySignature)(dappSignature, timestamp.toString(), keyPair);
+			if (!sessionId) return res.json({
+				status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
+				verified: false
+			});
+			const outcome = await tasks.frictionlessManager.verifyAuthenticatedSession(sessionId, ip, clientSessionId);
+			res.json(outcome);
+		} catch (err) {
+			req.logger.error(() => ({
+				err,
+				msg: "Error in verifyAuthenticatedSession",
+				data: { body: req.body }
+			}));
+			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+				context: {
+					code: 500,
+					siteKey: req.body.dapp,
+					user: req.body.user
+				},
+				i18n: req.i18n,
+				logger: req.logger
+			}));
+		}
+	});
 	router.use(_prosopo_api_express_router.handleErrors);
 	return router;
 }

package/dist/cjs/tasks/detection/getBotScore.cjs

@@ -21,6 +21,7 @@ var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded
 	const md = result.md;
 	const bn = result.bn;
 	const fs = result.fs;
+	const b = result.b;
 	if (baseBotScore === void 0 || Number.isNaN(baseBotScore)) return {
 		baseBotScore: 1,
 		timestamp: 0
@@ -44,7 +45,8 @@ var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded
 		sw,
 		md,
 		bn,
-		fs
+		fs,
+		b
 	};
 };
 //#endregion

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -2,10 +2,12 @@ const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_dnsEventUrl = require("../../api/dnsEventUrl.cjs");
 const require_lang = require("../../rules/lang.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_captchaTypeSelection = require("../captchaTypeSelection.cjs");
 const require_getBotScore = require("../detection/getBotScore.cjs");
 const require_puzzleDifficulty = require("../puzzle/puzzleDifficulty.cjs");
+const require_ipMatch = require("./ipMatch.cjs");
 const require_routingMachine = require("./routingMachine.cjs");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_captcha_severity = require("@prosopo/captcha-severity");
@@ -79,6 +81,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			entropyMathRandomFirst: params.entropyMathRandomFirst,
 			g: params.g,
 			i: params.i,
+			b: params.b,
 			tcpToChelloUs: params.tcpToChelloUs,
 			chelloToHandshakeUs: params.chelloToHandshakeUs,
 			synNs: params.synNs,
@@ -172,6 +175,91 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		}
 		return sessionRecord;
 	}
+	/**
+	* Dedicated issuance path for Web Bot Auth verified requests. The signature
+	* verification already carried the trust decision; there is no captcha to
+	* solve, no bot score to compute, no routing to run. The session is minted
+	* with `captchaType: authenticated`, `agent: true`, `webBotAuthAgent` set to
+	* the verified Signature-Agent URL, and `ipAddress` frozen for the verify-
+	* time IP-binding check. Consumed only by `/client/authenticated/verify`.
+	*/
+	async createAuthenticatedSession(token, ipAddress, webBotAuthAgent, siteKey, userSitekeyIpHash, headers, ipInfo, clientSessionId) {
+		const sessionRecord = {
+			sessionId: `${getSessionIDPrefix(this.config.host)}-${(0, uuid.v4)()}`,
+			createdAt: /* @__PURE__ */ new Date(),
+			token,
+			score: 0,
+			threshold: 0,
+			scoreComponents: { baseScore: 0 },
+			ipAddress,
+			captchaType: _prosopo_types.CaptchaType.authenticated,
+			userSitekeyIpHash,
+			webView: false,
+			iFrame: false,
+			decryptedHeadHash: "",
+			siteKey,
+			serverChecked: false,
+			agent: true,
+			webBotAuthAgent,
+			...ipInfo && { ipInfo },
+			...headers && { headers },
+			...clientSessionId && { clientMetaData: { clientSessionId } }
+		};
+		await this.db.storeSessionRecord(sessionRecord);
+		if (this.writeQueue) {
+			const cacheData = sessionRecord;
+			const cachePromises = [this.writeQueue.cacheSession(sessionRecord.sessionId, cacheData)];
+			if (userSitekeyIpHash) cachePromises.push(this.writeQueue.cacheSessionByHash(userSitekeyIpHash, sessionRecord.sessionId));
+			await Promise.all(cachePromises).catch(() => {});
+		}
+		return sessionRecord;
+	}
+	/**
+	* Verify an authenticated (Web Bot Auth) session. Called from
+	* `/client/authenticated/verify` after the operator forwards their
+	* dApp-signed token. Enforces the four properties that make replay
+	* infeasible:
+	*   1. session exists and was minted with captchaType=authenticated
+	*      (so ordinary captcha tokens can't be redeemed here)
+	*   2. session hasn't been consumed (serverChecked === false)
+	*   3. operator forwarded the client IP (`ip` is required — silently
+	*      dropping the check would nullify the whole binding)
+	*   4. the forwarded IP matches the IP the session was issued to
+	*
+	* Marks serverChecked=true on success so subsequent verifies fail loudly.
+	*/
+	async verifyAuthenticatedSession(sessionId, ip, clientSessionId) {
+		if (!ip) return {
+			verified: false,
+			status: "API.AUTHENTICATED_IP_REQUIRED"
+		};
+		const session = await this.db.getSessionRecordBySessionId(sessionId);
+		if (!session) return {
+			verified: false,
+			status: "API.USER_NOT_VERIFIED_NO_SOLUTION"
+		};
+		if (session.captchaType !== _prosopo_types.CaptchaType.authenticated) return {
+			verified: false,
+			status: "API.INCORRECT_CAPTCHA_TYPE"
+		};
+		if (session.serverChecked) return {
+			verified: false,
+			status: "API.USER_ALREADY_VERIFIED"
+		};
+		if (!require_ipMatch.ipMatchesSession(ip, session.ipAddress)) return {
+			verified: false,
+			status: "API.AUTHENTICATED_IP_MISMATCH"
+		};
+		if (require_clientMetaData.isClientSessionMismatch(clientSessionId, session.clientMetaData?.clientSessionId)) return {
+			verified: false,
+			status: "API.CLIENT_SESSION_MISMATCH"
+		};
+		await this.db.updateSessionRecord(sessionId, { serverChecked: true });
+		return {
+			verified: true,
+			status: "API.USER_VERIFIED"
+		};
+	}
 	async sendImageCaptcha(params) {
 		return this.sendCaptcha(_prosopo_types.CaptchaType.image, params);
 	}
@@ -198,8 +286,10 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		const imageRoundsBounds = this.routingContext ?? {};
 		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? requestedSolvedImagesCount !== void 0 ? (0, _prosopo_types.clampImageRounds)(requestedSolvedImagesCount, imageRoundsBounds) : requestedSolvedImagesCount : void 0;
 		const finalPowDifficulty = finalCaptchaType === _prosopo_types.CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
+		const finalReason = routed.reason ?? effectiveParams.reason;
 		const finalPuzzleOverrides = finalCaptchaType === _prosopo_types.CaptchaType.puzzle ? (() => {
-			const level = (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count);
+			const maxLevel = this.routingContext?.puzzleMaxDifficulty ?? _prosopo_types.puzzleMaxDifficultyDefault;
+			const level = finalReason !== void 0 && _prosopo_types.NO_MEASUREMENT_REASONS.has(finalReason) ? 0 : (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count, maxLevel);
 			const difficulty = level > 0 ? require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken) : void 0;
 			const tolerance = routed.puzzleTolerance ?? difficulty?.tolerance;
 			const puzzle = routed.puzzle || difficulty ? {
@@ -211,7 +301,6 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 				...puzzle !== void 0 && { puzzle }
 			};
 		})() : {};
-		const finalReason = routed.reason ?? effectiveParams.reason;
 		const blocked = finalCaptchaType === _prosopo_types.CaptchaType.image ? effectiveParams.blocked : void 0;
 		const sessionRecord = await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, finalCaptchaType, effectiveParams.siteKey, finalSolvedImagesCount, finalPowDifficulty, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, finalReason, blocked, void 0, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g, effectiveParams.matchedRule, effectiveParams.i, effectiveParams.sw, effectiveParams.md, effectiveParams.bn, effectiveParams.fs, {
 			synNs: effectiveParams.synNs,
@@ -346,6 +435,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		let entropyMathRandomFirst;
 		let g;
 		let ii;
+		let bb;
 		let sw;
 		let md;
 		let bn;
@@ -371,6 +461,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			const em = decrypted.entropyMathRandomFirst;
 			const gv = decrypted.g;
 			const iv = decrypted.i;
+			const bv = decrypted.b;
 			const swv = decrypted.sw;
 			const mdv = decrypted.md;
 			const bnv = decrypted.bn;
@@ -411,6 +502,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			entropyMathRandomFirst = em;
 			g = gv;
 			ii = iv;
+			bb = bv;
 			sw = swv;
 			md = mdv;
 			bn = bnv;
@@ -469,6 +561,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			entropyMathRandomFirst,
 			g,
 			i: ii,
+			b: bb,
 			sw,
 			md,
 			bn,

package/dist/cjs/tasks/frictionless/ipMatch.cjs

@@ -0,0 +1,45 @@
+const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+//#region src/tasks/frictionless/ipMatch.ts
+/**
+* `CompositeIpAddress` types its halves as `bigint`, but that is only true of
+* a value just built by `getCompositeIpAddress`. Read back off a session the
+* halves are whatever BSON stored — a `Decimal128`, or a `Long` on records
+* written before the Decimal128 migration — so `===` against a real bigint is
+* false for every session that has been through Mongo. Both BSON types
+* stringify to plain digits at IP magnitudes (≤ 2^64, well inside
+* Decimal128's 34 significant digits), so a string round-trip is exact.
+*
+* `null` for anything unparseable rather than a 0n default: two unparseable
+* halves must not compare equal, or garbage would match garbage.
+*/
+var asBigInt = (half) => {
+	if (typeof half === "bigint") return half;
+	if (half === void 0 || half === null) return 0n;
+	try {
+		return BigInt(String(half));
+	} catch {
+		return null;
+	}
+};
+/**
+* Compare an operator-supplied plain-string IP against the CompositeIpAddress
+* captured on a session. Returns true iff the parsed IP has the same type
+* (v4/v6) and numeric halves.
+*
+* Load-bearing for Web Bot Auth IP binding — a leaked authenticated token
+* replayed from a different IP fails here. Malformed operator IPs degrade
+* to {lower: 0n, type: v4} inside getCompositeIpAddress and can never match
+* a real session (a real v4 session has a non-zero `lower`; a real v6 has
+* type=v6). That degradation is deliberate: silently treating garbage as a
+* match would nullify the whole binding.
+*/
+var ipMatchesSession = (operatorIp, sessionIp) => {
+	const parsed = require_compositeIpAddress.getCompositeIpAddress(operatorIp);
+	if (parsed.type !== sessionIp.type) return false;
+	const lower = asBigInt(sessionIp.lower);
+	const upper = asBigInt(sessionIp.upper);
+	if (lower === null || upper === null) return false;
+	return parsed.lower === lower && (parsed.upper ?? 0n) === upper;
+};
+//#endregion
+exports.ipMatchesSession = ipMatchesSession;

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -1,12 +1,12 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_lang = require("../../rules/lang.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
 const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_pairs = require("../../pairs.cjs");
 const require_util = require("../../util.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -1,11 +1,11 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
 const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_routingMachine = require("../frictionless/routingMachine.cjs");
 const require_util = require("../../util.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -1,10 +1,10 @@
 const require_usageCounters = require("../../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
 const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_util = require("../../util.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");

package/dist/tasks/detection/getBotScore.d.ts

@@ -18,6 +18,7 @@ export declare const getBotScore: (payload: string, headHash: string, privateKey
     md?: undefined;
     bn?: undefined;
     fs?: undefined;
+    b?: undefined;
 } | {
     baseBotScore: number;
     timestamp: number;
@@ -38,5 +39,6 @@ export declare const getBotScore: (payload: string, headHash: string, privateKey
     md: boolean | undefined;
     bn: boolean | undefined;
     fs: boolean | undefined;
+    b: Record<string, string[]> | undefined;
 }>;
 //# sourceMappingURL=getBotScore.d.ts.map

package/dist/tasks/detection/getBotScore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getBotScore.d.ts","sourceRoot":"","sources":["../../../src/tasks/detection/getBotScore.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,YACd,MAAM,YACL,MAAM,qBACG,MAAM,uBACJ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4D3B,CAAC"}
+{"version":3,"file":"getBotScore.d.ts","sourceRoot":"","sources":["../../../src/tasks/detection/getBotScore.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,YACd,MAAM,YACL,MAAM,qBACG,MAAM,uBACJ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8D3B,CAAC"}

package/dist/tasks/detection/getBotScore.js

@@ -21,6 +21,7 @@ var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded
 	const md = result.md;
 	const bn = result.bn;
 	const fs = result.fs;
+	const b = result.b;
 	if (baseBotScore === void 0 || Number.isNaN(baseBotScore)) return {
 		baseBotScore: 1,
 		timestamp: 0
@@ -44,7 +45,8 @@ var getBotScore = async (payload, headHash, privateKeyString, innerConfigEncoded
 		sw,
 		md,
 		bn,
-		fs
+		fs,
+		b
 	};
 };
 //#endregion