@prosopo/puzzle-assets 0.1.3

package/CHANGELOG.md

@@ -0,0 +1,39 @@
+# @prosopo/puzzle-assets
+
+## 0.1.3
+### Patch Changes
+
+- a9c0406: Add vite export path
+- 9bf4570: Export code for use in the portal
+
+## 0.1.2
+### Patch Changes
+
+- 572f965: chore(puzzle-assets): mark private to unblock changeset publish
+  
+  `@prosopo/puzzle-assets` was never published to npm (registry returns
+  404). `publish_release` calls `npx changeset publish` which walks every
+  non-private workspace; the trusted-publisher OIDC flow only works for
+  packages that already exist on the registry, so the first-time publish
+  hit `ENEEDAUTH` and aborted the whole job — that's why v3.7.15, v3.7.16
+  and v3.7.17 all failed at the same step and never published the docker
+  image tags either.
+  
+  `puzzle-assets` is only consumed inside the workspace (provider bundles
+  it into the CLI docker image); it has no external consumers, so mark it
+  `private: true`. changeset skips private packages by design, so the
+  release pipeline goes green without needing a legacy npm token or a
+  manual bootstrap publish.
+  
+  If we ever want to publish it externally, drop `private` and either
+  seed a first publish with a legacy `NPM_TOKEN` or configure the package
+  as a trusted publisher on npmjs.com first.
+
+## 0.1.1
+### Patch Changes
+
+- 35f640f: Render puzzle captcha imagery on the provider instead of sending the answer to the client.
+  
+  The challenge used to carry `targetX`/`targetY` and the widget drew the target box straight from them, so any HTTP client could echo the coordinates back as its solution and pass without a browser. The provider now synthesises a background procedurally, cuts the notch into the pixels, and returns the background and piece as data URIs; the target and the tolerance never leave the server.
+  
+  Backgrounds come from the new `@prosopo/puzzle-assets` package and are single-use — reusing one across two challenges would let an attacker diff the composites and recover both notch positions.

package/dist/_virtual/_rolldown/runtime.js

@@ -0,0 +1,3 @@
+import "node:module";
+//#endregion
+export {};

package/dist/background.d.ts

@@ -0,0 +1,4 @@
+import type { Prng } from "./prng.js";
+import type { RgbaImage } from "./types.js";
+export declare const generateBackground: (prng: Prng, width: number, height: number) => RgbaImage;
+//# sourceMappingURL=background.d.ts.map

package/dist/background.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"background.d.ts","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAqF5C,eAAO,MAAM,kBAAkB,SACxB,IAAI,SACH,MAAM,UACL,MAAM,KACZ,SAmFF,CAAC"}

package/dist/background.js

@@ -0,0 +1,131 @@
+import { drawPalette } from "./palette.js";
+//#region src/background.ts
+/**
+* Grain amplitude, in 0-255 units, applied per channel.
+*
+* This is the one knob serving both goals at once. Visually it reads as film
+* grain and stops the mesh gradient banding on 8-bit displays. Structurally it
+* raises the noise floor an edge detector has to clear to find the notch
+* boundary — a perfectly smooth gradient would hand the target over to a Canny
+* filter. Too high and the image looks like TV static, so it stays subtle.
+*/
+var GRAIN_AMPLITUDE = 5;
+var VIGNETTE_STRENGTH = .16;
+var clamp255 = (v) => v < 0 ? 0 : v > 255 ? 255 : v;
+/**
+* Smooth multi-colour blend: every pixel is a Gaussian-weighted mix of the
+* control points, giving the "mesh gradient" look — broad soft colour fields
+* with no hard edges anywhere.
+*
+* The falloff has to be local. Inverse-distance weighting (1/d^2) looks right
+* on paper but at 300x200 every control point is a comparable distance from
+* every pixel, so the weights come out near-equal and the whole frame collapses
+* to the palette's mean — a flat grey-ish wash. A Gaussian with sigma around a
+* third of the frame keeps each point dominant near itself and still blends
+* smoothly in between.
+*/
+var meshColourAt = (points, x, y) => {
+	let wSum = 0;
+	let r = 0;
+	let g = 0;
+	let b = 0;
+	for (const point of points) {
+		const dx = x - point.x;
+		const dy = y - point.y;
+		const w = Math.exp(-(dx * dx + dy * dy) / (2 * point.sigma * point.sigma));
+		wSum += w;
+		r += point.colour.r * w;
+		g += point.colour.g * w;
+		b += point.colour.b * w;
+	}
+	if (wSum < 1e-6) {
+		let best = points[0];
+		if (!best) throw new Error("puzzle-assets: no mesh points");
+		let bestD = Number.POSITIVE_INFINITY;
+		for (const point of points) {
+			const d = (x - point.x) ** 2 + (y - point.y) ** 2;
+			if (d < bestD) {
+				bestD = d;
+				best = point;
+			}
+		}
+		return best.colour;
+	}
+	return {
+		r: r / wSum,
+		g: g / wSum,
+		b: b / wSum
+	};
+};
+/**
+* Synthesise a background. Deterministic in `prng`, so the same seed always
+* yields the same picture — see the seed-secrecy note in prng.ts for why that
+* determinism is safe only while the seed stays on the provider.
+*/
+var generateBackground = (prng, width, height) => {
+	const pointCount = prng.int(4, 6);
+	const palette = drawPalette(prng, pointCount);
+	const blobPalette = drawPalette(prng, 3);
+	const minDimension = Math.min(width, height);
+	const points = [];
+	for (let i = 0; i < pointCount; i++) {
+		const colour = palette[i];
+		if (!colour) throw new Error("puzzle-assets: palette underflow");
+		points.push({
+			x: prng.range(-.15, 1.15) * width,
+			y: prng.range(-.15, 1.15) * height,
+			colour,
+			sigma: prng.range(.26, .48) * minDimension
+		});
+	}
+	const blobs = [];
+	const blobCount = prng.int(2, 4);
+	for (let i = 0; i < blobCount; i++) {
+		const colour = blobPalette[i % blobPalette.length];
+		if (!colour) throw new Error("puzzle-assets: palette underflow");
+		blobs.push({
+			x: prng.range(.1, .9) * width,
+			y: prng.range(.1, .9) * height,
+			sigma: prng.range(.18, .38) * minDimension,
+			colour,
+			alpha: prng.range(.16, .32)
+		});
+	}
+	const data = Buffer.alloc(width * height * 4);
+	const cx = width / 2;
+	const cy = height / 2;
+	const maxRadius = Math.sqrt(cx * cx + cy * cy);
+	for (let y = 0; y < height; y++) for (let x = 0; x < width; x++) {
+		const base = meshColourAt(points, x, y);
+		let r = base.r;
+		let g = base.g;
+		let b = base.b;
+		for (const blob of blobs) {
+			const dx = x - blob.x;
+			const dy = y - blob.y;
+			const a = blob.alpha * Math.exp(-(dx * dx + dy * dy) / (2 * blob.sigma * blob.sigma));
+			r += (blob.colour.r - r) * a;
+			g += (blob.colour.g - g) * a;
+			b += (blob.colour.b - b) * a;
+		}
+		const dxc = x - cx;
+		const dyc = y - cy;
+		const vignette = 1 - VIGNETTE_STRENGTH * ((dxc * dxc + dyc * dyc) / (maxRadius * maxRadius));
+		r *= vignette;
+		g *= vignette;
+		b *= vignette;
+		const grain = (prng.next() - .5) * 2 * GRAIN_AMPLITUDE;
+		const i = (y * width + x) * 4;
+		data[i] = clamp255(Math.round(r + grain));
+		data[i + 1] = clamp255(Math.round(g + grain));
+		data[i + 2] = clamp255(Math.round(b + grain));
+		data[i + 3] = 255;
+	}
+	return {
+		data,
+		width,
+		height
+	};
+};
+//#endregion
+export { generateBackground };

package/dist/background.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAcA,OAAO,EAAY,WAAW,EAAE,MAAM,cAAc,CAAC;AA6BrD,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAcxE,MAAM,YAAY,GAAG,CACpB,MAA4B,EAC5B,CAAS,EACT,CAAS,EACH,EAAE;IACR,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,CAAC;QACV,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QACjB,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5D,IAAI,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;gBACf,KAAK,GAAG,CAAC,CAAC;gBACV,IAAI,GAAG,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;AAClD,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,IAAU,EACV,KAAa,EACb,MAAc,EACF,EAAE;IACd,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAIlC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC;YAGX,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK;YAClC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM;YACnC,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,YAAY;SAC5C,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC;YACV,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK;YAC/B,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,YAAY;YAC5C,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;SAC7B,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAGf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;gBACtB,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;gBACtB,MAAM,CAAC,GACN,IAAI,CAAC,KAAK;oBACV,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAID,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;YACnB,MAAM,QAAQ,GACb,CAAC;gBACD,iBAAiB,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC;YACzE,CAAC,IAAI,QAAQ,CAAC;YACd,CAAC,IAAI,QAAQ,CAAC;YACd,CAAC,IAAI,QAAQ,CAAC;YAEd,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;YAExD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;QACnB,CAAC;IACF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC,CAAC"}

package/dist/browser.d.ts

@@ -0,0 +1,15 @@
+import type { NotchPlacement, PuzzleGeometry, PuzzleRenderSettings, RgbaImage } from "./types.js";
+export { createPrng, createSeed, SEED_BYTES } from "./prng.js";
+export { generateBackground } from "./background.js";
+export { paintDecoys, paintDecoyPiece } from "./decoys.js";
+export type { NotchPlacement, PuzzleGeometry, PuzzleRenderSettings, RenderedPuzzle, RgbaImage, } from "./types.js";
+export declare const DEFAULT_GEOMETRY: PuzzleGeometry;
+export declare const DEFAULT_RENDER_SETTINGS: PuzzleRenderSettings;
+export interface RenderedPuzzleRgba {
+    background: RgbaImage;
+    piece: RgbaImage;
+    pieceSize: number;
+}
+export declare const renderPuzzleToRgba: (background: RgbaImage, placement: NotchPlacement, geometry?: PuzzleGeometry, settings?: PuzzleRenderSettings) => RenderedPuzzleRgba;
+export declare const createBackground: (geometry?: PuzzleGeometry) => RgbaImage;
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,SAAS,EACT,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,YAAY,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,SAAS,GACT,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,gBAAgB,EAAE,cAI9B,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAMrC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,SAAS,CAAC;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CAClB;AAOD,eAAO,MAAM,kBAAkB,eAClB,SAAS,aACV,cAAc,aACf,cAAc,aACd,oBAAoB,KAC5B,kBAuBF,CAAC;AAEF,eAAO,MAAM,gBAAgB,cAClB,cAAc,KACtB,SAC2E,CAAC"}

package/dist/browser.js

@@ -0,0 +1,38 @@
+import "./_virtual/_rolldown/runtime.js";
+import { generateBackground } from "./background.js";
+import { createNotchShape } from "./notch.js";
+import { cutNotch } from "./compose.js";
+import { paintDecoyPiece, paintDecoys } from "./decoys.js";
+import { SEED_BYTES, createPrng, createSeed } from "./prng.js";
+//#region src/browser.ts
+var DEFAULT_GEOMETRY = {
+	width: 300,
+	height: 200,
+	notchSize: 44
+};
+var DEFAULT_RENDER_SETTINGS = {
+	decoyCount: 5,
+	decoyEdgeDarkness: 20,
+	decoyBodyBrightness: 4,
+	holeDarken: .55,
+	decoyHoleDarken: .7
+};
+/**
+* Same pipeline as `renderPuzzle` in index.ts but returns raw RGBA rather
+* than WebP-encoded buffers, so browser consumers can `putImageData` onto
+* a canvas without needing sharp.
+*/
+var renderPuzzleToRgba = (background, placement, geometry = DEFAULT_GEOMETRY, settings = DEFAULT_RENDER_SETTINGS) => {
+	const prng = createPrng(createSeed());
+	const pieceSize = geometry.pieceSize ?? geometry.notchSize;
+	paintDecoys(background, prng, settings.decoyCount, pieceSize, placement, settings.decoyEdgeDarkness, settings.decoyBodyBrightness, settings.decoyHoleDarken);
+	const { background: cut, piece } = cutNotch(prng, background, createNotchShape(prng, pieceSize), pieceSize, placement, settings.holeDarken);
+	return {
+		background: cut,
+		piece,
+		pieceSize
+	};
+};
+var createBackground = (geometry = DEFAULT_GEOMETRY) => generateBackground(createPrng(createSeed()), geometry.width, geometry.height);
+//#endregion
+export { DEFAULT_GEOMETRY, DEFAULT_RENDER_SETTINGS, SEED_BYTES, createBackground, createPrng, createSeed, generateBackground, paintDecoyPiece, paintDecoys, renderPuzzleToRgba };

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAS3D,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC/C,KAAK,EAAE,GAAG;IACV,MAAM,EAAE,GAAG;IACX,SAAS,EAAE,EAAE;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC5D,UAAU,EAAE,CAAC;IACb,iBAAiB,EAAE,EAAE;IACrB,mBAAmB,EAAE,CAAC;IACtB,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE,GAAG;CACpB,CAAC;AAaF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,UAAqB,EACrB,SAAyB,EACzB,WAA2B,gBAAgB,EAC3C,WAAiC,uBAAuB,EACnC,EAAE;IACvB,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;IAC3D,WAAW,CACV,UAAU,EACV,IAAI,EACJ,QAAQ,CAAC,UAAU,EACnB,SAAS,EACT,SAAS,EACT,QAAQ,CAAC,iBAAiB,EAC1B,QAAQ,CAAC,mBAAmB,EAC5B,QAAQ,CAAC,eAAe,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,CAC1C,IAAI,EACJ,UAAU,EACV,KAAK,EACL,SAAS,EACT,SAAS,EACT,QAAQ,CAAC,UAAU,CACnB,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC/B,WAA2B,gBAAgB,EAC/B,EAAE,CACd,kBAAkB,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC"}

package/dist/cjs/_virtual/_rolldown/runtime.cjs

@@ -0,0 +1,23 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+exports.__toESM = __toESM;

package/dist/cjs/background.cjs

@@ -0,0 +1,131 @@
+const require_palette = require("./palette.cjs");
+//#region src/background.ts
+/**
+* Grain amplitude, in 0-255 units, applied per channel.
+*
+* This is the one knob serving both goals at once. Visually it reads as film
+* grain and stops the mesh gradient banding on 8-bit displays. Structurally it
+* raises the noise floor an edge detector has to clear to find the notch
+* boundary — a perfectly smooth gradient would hand the target over to a Canny
+* filter. Too high and the image looks like TV static, so it stays subtle.
+*/
+var GRAIN_AMPLITUDE = 5;
+var VIGNETTE_STRENGTH = .16;
+var clamp255 = (v) => v < 0 ? 0 : v > 255 ? 255 : v;
+/**
+* Smooth multi-colour blend: every pixel is a Gaussian-weighted mix of the
+* control points, giving the "mesh gradient" look — broad soft colour fields
+* with no hard edges anywhere.
+*
+* The falloff has to be local. Inverse-distance weighting (1/d^2) looks right
+* on paper but at 300x200 every control point is a comparable distance from
+* every pixel, so the weights come out near-equal and the whole frame collapses
+* to the palette's mean — a flat grey-ish wash. A Gaussian with sigma around a
+* third of the frame keeps each point dominant near itself and still blends
+* smoothly in between.
+*/
+var meshColourAt = (points, x, y) => {
+	let wSum = 0;
+	let r = 0;
+	let g = 0;
+	let b = 0;
+	for (const point of points) {
+		const dx = x - point.x;
+		const dy = y - point.y;
+		const w = Math.exp(-(dx * dx + dy * dy) / (2 * point.sigma * point.sigma));
+		wSum += w;
+		r += point.colour.r * w;
+		g += point.colour.g * w;
+		b += point.colour.b * w;
+	}
+	if (wSum < 1e-6) {
+		let best = points[0];
+		if (!best) throw new Error("puzzle-assets: no mesh points");
+		let bestD = Number.POSITIVE_INFINITY;
+		for (const point of points) {
+			const d = (x - point.x) ** 2 + (y - point.y) ** 2;
+			if (d < bestD) {
+				bestD = d;
+				best = point;
+			}
+		}
+		return best.colour;
+	}
+	return {
+		r: r / wSum,
+		g: g / wSum,
+		b: b / wSum
+	};
+};
+/**
+* Synthesise a background. Deterministic in `prng`, so the same seed always
+* yields the same picture — see the seed-secrecy note in prng.ts for why that
+* determinism is safe only while the seed stays on the provider.
+*/
+var generateBackground = (prng, width, height) => {
+	const pointCount = prng.int(4, 6);
+	const palette = require_palette.drawPalette(prng, pointCount);
+	const blobPalette = require_palette.drawPalette(prng, 3);
+	const minDimension = Math.min(width, height);
+	const points = [];
+	for (let i = 0; i < pointCount; i++) {
+		const colour = palette[i];
+		if (!colour) throw new Error("puzzle-assets: palette underflow");
+		points.push({
+			x: prng.range(-.15, 1.15) * width,
+			y: prng.range(-.15, 1.15) * height,
+			colour,
+			sigma: prng.range(.26, .48) * minDimension
+		});
+	}
+	const blobs = [];
+	const blobCount = prng.int(2, 4);
+	for (let i = 0; i < blobCount; i++) {
+		const colour = blobPalette[i % blobPalette.length];
+		if (!colour) throw new Error("puzzle-assets: palette underflow");
+		blobs.push({
+			x: prng.range(.1, .9) * width,
+			y: prng.range(.1, .9) * height,
+			sigma: prng.range(.18, .38) * minDimension,
+			colour,
+			alpha: prng.range(.16, .32)
+		});
+	}
+	const data = Buffer.alloc(width * height * 4);
+	const cx = width / 2;
+	const cy = height / 2;
+	const maxRadius = Math.sqrt(cx * cx + cy * cy);
+	for (let y = 0; y < height; y++) for (let x = 0; x < width; x++) {
+		const base = meshColourAt(points, x, y);
+		let r = base.r;
+		let g = base.g;
+		let b = base.b;
+		for (const blob of blobs) {
+			const dx = x - blob.x;
+			const dy = y - blob.y;
+			const a = blob.alpha * Math.exp(-(dx * dx + dy * dy) / (2 * blob.sigma * blob.sigma));
+			r += (blob.colour.r - r) * a;
+			g += (blob.colour.g - g) * a;
+			b += (blob.colour.b - b) * a;
+		}
+		const dxc = x - cx;
+		const dyc = y - cy;
+		const vignette = 1 - VIGNETTE_STRENGTH * ((dxc * dxc + dyc * dyc) / (maxRadius * maxRadius));
+		r *= vignette;
+		g *= vignette;
+		b *= vignette;
+		const grain = (prng.next() - .5) * 2 * GRAIN_AMPLITUDE;
+		const i = (y * width + x) * 4;
+		data[i] = clamp255(Math.round(r + grain));
+		data[i + 1] = clamp255(Math.round(g + grain));
+		data[i + 2] = clamp255(Math.round(b + grain));
+		data[i + 3] = 255;
+	}
+	return {
+		data,
+		width,
+		height
+	};
+};
+//#endregion
+exports.generateBackground = generateBackground;

package/dist/cjs/compose.cjs

@@ -0,0 +1,126 @@
+const require_notch = require("./notch.cjs");
+//#region src/compose.ts
+/**
+* Per-pixel noise added to the piece, in 0-255 units.
+*
+* This is not decoration. The piece is cut from the background, so a
+* pixel-exact copy would let an attacker slide the piece over the background
+* with normalised cross-correlation and land on the target in one pass —
+* which would make the whole server-rendering exercise worthless. The piece is
+* therefore brightness-shifted and re-noised so it correlates well with a
+* region of the background but never perfectly, and the background gets fresh
+* noise around the cut so the seam is not a clean template either.
+*/
+var PIECE_NOISE = 7;
+var PIECE_BRIGHTNESS_RANGE = [-8, 8];
+/**
+* Disturbance ring outside the cut, in px. The ring exists so an edge detector
+* cannot lock onto a clean gradient discontinuity along the seam. The noise
+* tapers linearly to zero at the outer edge so it fades into the ambient
+* background grain instead of terminating in a visible border.
+*/
+var SEAM_NOISE_RADIUS = 3;
+/**
+* Peak amplitude at the seam itself, in 0-255 units. Kept close to the
+* background grain amplitude so the ring reads as continuation of the grain
+* rather than as a halo around the hole.
+*/
+var SEAM_NOISE = 4;
+/**
+* Depth cue on the hole. HOLE_INNER_SHADOW is a fixed within-primitive
+* ratio, but HOLE_DARKEN is caller-provided so operators can tune how
+* obvious the target is versus the decoys.
+*/
+var HOLE_INNER_SHADOW = .45;
+/**
+* Depth cue on the piece itself. A subtle brightness rise just inside the
+* silhouette edge, so the piece reads as raised rather than as a flat sticker.
+* Kept low deliberately — a stronger rim starts to look like a drawn border
+* against the darkened cutout it drops into.
+*/
+var PIECE_EDGE_LIGHT = 8;
+var clamp255 = (v) => v < 0 ? 0 : v > 255 ? 255 : v;
+/**
+* Sample the background at `(x, y)`. Returns `null` when the coordinate
+* sits outside the frame — the piece is clipped at the boundary rather
+* than filled from a clamped edge pixel, so a piece whose placement
+* overhangs the frame simply loses those pixels.
+*/
+var sampleBackground = (image, x, y) => {
+	if (x < 0 || y < 0 || x >= image.width || y >= image.height) return null;
+	const i = (y * image.width + x) * 4;
+	return [
+		image.data[i] ?? 0,
+		image.data[i + 1] ?? 0,
+		image.data[i + 2] ?? 0
+	];
+};
+/**
+* Cut the notch out of `background` and produce the matching piece.
+*
+* `background` is mutated in place — it is a freshly generated, single-use
+* image, so there is nothing to preserve.
+*/
+var cutNotch = (prng, background, shape, size, placement, holeDarken) => {
+	const half = size / 2;
+	const left = Math.round(placement.targetX - half);
+	const top = Math.round(placement.targetY - half);
+	const pieceData = Buffer.alloc(size * size * 4);
+	const brightness = prng.range(PIECE_BRIGHTNESS_RANGE[0], PIECE_BRIGHTNESS_RANGE[1]);
+	for (let ly = 0; ly < size; ly++) for (let lx = 0; lx < size; lx++) {
+		const d = shape.distance(lx, ly);
+		const coverage = require_notch.coverageFromDistance(d);
+		const pi = (ly * size + lx) * 4;
+		if (coverage <= 0) {
+			pieceData[pi + 3] = 0;
+			continue;
+		}
+		const sample = sampleBackground(background, left + lx, top + ly);
+		if (sample === null) {
+			pieceData[pi + 3] = 0;
+			continue;
+		}
+		const [r, g, b] = sample;
+		const edgeLight = d > -2 ? PIECE_EDGE_LIGHT * (1 + d / 2) : 0;
+		const noise = (prng.next() - .5) * 2 * PIECE_NOISE;
+		const delta = brightness + edgeLight + noise;
+		pieceData[pi] = clamp255(Math.round(r + delta));
+		pieceData[pi + 1] = clamp255(Math.round(g + delta));
+		pieceData[pi + 2] = clamp255(Math.round(b + delta));
+		pieceData[pi + 3] = Math.round(coverage * 255);
+	}
+	for (let ly = -SEAM_NOISE_RADIUS; ly < size + SEAM_NOISE_RADIUS; ly++) for (let lx = -SEAM_NOISE_RADIUS; lx < size + SEAM_NOISE_RADIUS; lx++) {
+		const x = left + lx;
+		const y = top + ly;
+		if (x < 0 || y < 0 || x >= background.width || y >= background.height) continue;
+		const bi = (y * background.width + x) * 4;
+		const d = shape.distance(lx, ly);
+		const coverage = require_notch.coverageFromDistance(d);
+		if (coverage > 0) {
+			const r = background.data[bi] ?? 0;
+			const g = background.data[bi + 1] ?? 0;
+			const b = background.data[bi + 2] ?? 0;
+			const factor = holeDarken * (1 - (d > -3 ? HOLE_INNER_SHADOW * (1 + d / 3) : 0));
+			const mix = coverage;
+			background.data[bi] = clamp255(Math.round(r * (1 - mix) + r * factor * mix));
+			background.data[bi + 1] = clamp255(Math.round(g * (1 - mix) + g * factor * mix));
+			background.data[bi + 2] = clamp255(Math.round(b * (1 - mix) + b * factor * mix));
+		} else if (d < SEAM_NOISE_RADIUS) {
+			const falloff = 1 - d / SEAM_NOISE_RADIUS;
+			const noise = (prng.next() - .5) * 2 * SEAM_NOISE * falloff;
+			background.data[bi] = clamp255(Math.round((background.data[bi] ?? 0) + noise));
+			background.data[bi + 1] = clamp255(Math.round((background.data[bi + 1] ?? 0) + noise));
+			background.data[bi + 2] = clamp255(Math.round((background.data[bi + 2] ?? 0) + noise));
+		}
+	}
+	return {
+		background,
+		piece: {
+			data: pieceData,
+			width: size,
+			height: size
+		}
+	};
+};
+//#endregion
+exports.cutNotch = cutNotch;

package/dist/cjs/decoys.cjs

@@ -0,0 +1,105 @@
+const require_notch = require("./notch.cjs");
+//#region src/decoys.ts
+/**
+* Decoys are rendered as shallow indented jigsaw silhouettes: a darker
+* edge with a barely-lifted interior. Edge shading direction (darker at
+* the rim) mirrors the real cutout's inner shadow, so at a glance decoys
+* read as similar shapes and it's not immediately obvious which one is
+* the real target. Edge/body amplitudes come from PuzzleRenderSettings
+* so operators can tune the confusion level per-client from the portal.
+*
+* No drop shadow — a shadow ring picked up WebP artefacts and read as a
+* visible halo around each decoy.
+*/
+/**
+* Minimum centre-to-centre distance from the real notch, in notch-sizes.
+* Zero: decoys may sit right up to (and over) the target region. The cut
+* itself runs after decoy paint, so the darkened hole still wins visually.
+*/
+var NOTCH_CLEARANCE = 0;
+/** Placement retries per decoy before giving up on that slot. */
+var PLACEMENT_ATTEMPTS = 8;
+var clamp255 = (v) => v < 0 ? 0 : v > 255 ? 255 : v;
+var distanceSquared = (cx, cy, other) => {
+	const dx = cx - other.cx;
+	const dy = cy - other.cy;
+	return dx * dx + dy * dy;
+};
+/**
+* Depth cue on decoys, mirroring `HOLE_INNER_SHADOW` in `compose.ts`.
+* Smaller so decoys read as shallower cuts than the real hole.
+*/
+var DECOY_INNER_SHADOW = .35;
+/**
+* Composite a jigsaw-shaped decoration onto `background`, centred on
+* `(cx, cy)`. Mutates `background`. Runs the same signed-distance sampling
+* as the real cut, so the silhouette reads as the same family of shapes.
+*/
+var paintDecoyPiece = (background, prng, size, cx, cy, edgeDarkness, bodyBrightness, holeDarken) => {
+	const shape = require_notch.createNotchShape(prng, size);
+	const half = size / 2;
+	const left = Math.round(cx - half);
+	const top = Math.round(cy - half);
+	for (let ly = 0; ly < size; ly++) for (let lx = 0; lx < size; lx++) {
+		const x = left + lx;
+		const y = top + ly;
+		if (x < 0 || y < 0 || x >= background.width || y >= background.height) continue;
+		const d = shape.distance(lx, ly);
+		const coverage = require_notch.coverageFromDistance(d);
+		if (coverage <= 0) continue;
+		const bi = (y * background.width + x) * 4;
+		const r = background.data[bi] ?? 0;
+		const g = background.data[bi + 1] ?? 0;
+		const b = background.data[bi + 2] ?? 0;
+		const factor = holeDarken * (1 - (d > -3 ? DECOY_INNER_SHADOW * (1 + d / 3) : 0));
+		const dr = r * factor;
+		const dg = g * factor;
+		const db = b * factor;
+		const delta = bodyBrightness - (d > -3 ? edgeDarkness * (1 + d / 3) : 0);
+		const mixR = r * (1 - coverage) + dr * coverage;
+		const mixG = g * (1 - coverage) + dg * coverage;
+		const mixB = b * (1 - coverage) + db * coverage;
+		background.data[bi] = clamp255(Math.round(mixR + delta * coverage));
+		background.data[bi + 1] = clamp255(Math.round(mixG + delta * coverage));
+		background.data[bi + 2] = clamp255(Math.round(mixB + delta * coverage));
+	}
+};
+/**
+* Fractional jitter around the configured decoy count. ±30% means a
+* configured 5 draws anywhere in [4, 6]; a configured 100 draws in [70,
+* 130]. Randomising the count prevents a solver from keying on "exactly N
+* jigsaw regions on the board" as a stable feature.
+*/
+var COUNT_JITTER = .3;
+/**
+* Paint decoys onto `background`. The actual number placed varies per-
+* challenge within ±COUNT_JITTER of `targetCount`, so a solver can't
+* hard-code the expected count. Decoys avoid only the real notch
+* placement (they may freely overlap each other). If a slot cannot be
+* placed after `PLACEMENT_ATTEMPTS`, it is silently dropped — decoys are
+* cosmetic, so an occasional miss is fine.
+*/
+var paintDecoys = (background, prng, targetCount, notchSize, notch, edgeDarkness, bodyBrightness, holeDarken) => {
+	if (targetCount <= 0) return;
+	const jitter = 1 + prng.range(-COUNT_JITTER, COUNT_JITTER);
+	const count = Math.max(0, Math.round(targetCount * jitter));
+	if (count === 0) return;
+	const notchClearanceSq = (notchSize * NOTCH_CLEARANCE) ** 2;
+	const minX = 0;
+	const maxX = background.width;
+	const minY = 0;
+	const maxY = background.height;
+	for (let i = 0; i < count; i++) for (let attempt = 0; attempt < PLACEMENT_ATTEMPTS; attempt++) {
+		const cx = prng.range(minX, maxX);
+		const cy = prng.range(minY, maxY);
+		if (distanceSquared(cx, cy, {
+			cx: notch.targetX,
+			cy: notch.targetY
+		}) < notchClearanceSq) continue;
+		paintDecoyPiece(background, prng, notchSize, cx, cy, edgeDarkness, bodyBrightness, holeDarken);
+		break;
+	}
+};
+//#endregion
+exports.paintDecoyPiece = paintDecoyPiece;
+exports.paintDecoys = paintDecoys;