@prosopo/server 2.10.39 → 2.10.41

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/server@2.10.39 build:cjs
+> @prosopo/server@2.10.41 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -29,13 +29,16 @@ ViteCommonJSConfig: .
     '@prosopo/load-balancer'
   ]
 }
-vite v6.4.1 building SSR bundle for production...
+The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
+vite v8.1.5 building ssr environment for production...
 Bundle build started
-transforming...
-Build end
-✓ 3 modules transformed.
+
+✓ 4 modules transformed.
 rendering chunks...
-dist/cjs/index.cjs   0.57 kB
-dist/cjs/config.cjs  0.92 kB
-dist/cjs/server.cjs  6.26 kB
-✓ built in 158ms
+computing gzip size...
+dist/cjs/index.cjs                       0.65 kB │ gzip: 0.31 kB
+dist/cjs/config.cjs                      0.82 kB │ gzip: 0.41 kB
+dist/cjs/_virtual/_rolldown/runtime.cjs  1.00 kB │ gzip: 0.50 kB
+dist/cjs/server.cjs                      5.73 kB │ gzip: 1.78 kB
+
+✓ built in 46ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/server@2.10.39 build:tsc
+> @prosopo/server@2.10.41 build:tsc
 > tsc --build --verbose
 
-12:17:21 PM - Projects in this build: 
+8:59:18 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -15,27 +15,27 @@
     * ../load-balancer/tsconfig.json
     * tsconfig.json
 
-12:17:21 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/index.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/provider/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/provider/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/batches.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+8:59:18 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/providers.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-12:17:21 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+8:59:18 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-12:17:21 PM - Building project '/home/runner/work/captcha/captcha/packages/server/tsconfig.json'...
+8:59:18 PM - Building project '/home/runner/work/captcha/captcha/packages/server/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/server@2.10.39 build
+> @prosopo/server@2.10.41 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/server@2.10.39 build:cross-env
+> @prosopo/server@2.10.41 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -33,13 +33,16 @@ ViteEsmConfig: .
     '@prosopo/load-balancer'
   ]
 }
-vite v6.4.1 building SSR bundle for production...
+The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
+vite v8.1.5 building ssr environment for production...
 Bundle build started
-transforming...
-Build end
-✓ 3 modules transformed.
+
+✓ 4 modules transformed.
 rendering chunks...
-dist/index.js   0.39 kB
-dist/config.js  0.81 kB
-dist/server.js  6.17 kB
-✓ built in 182ms
+computing gzip size...
+dist/_virtual/_rolldown/runtime.js  0.04 kB │ gzip: 0.06 kB
+dist/index.js                       0.43 kB │ gzip: 0.23 kB
+dist/config.js                      0.78 kB │ gzip: 0.40 kB
+dist/server.js                      5.39 kB │ gzip: 1.68 kB
+
+✓ built in 50ms

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @prosopo/server
 
+## 2.10.41
+### Patch Changes
+
+- e14fce6: chore(deps): bump vite to 6.4.3 and mongoose to 8.24.1, and adjust types for the mongoose 8.24 Document/ObjectId changes
+- Updated dependencies [2c47bb7]
+- Updated dependencies [0e1171c]
+- Updated dependencies [103318c]
+- Updated dependencies [270a8d8]
+- Updated dependencies [e14fce6]
+  - @prosopo/util@3.3.5
+  - @prosopo/types@4.10.0
+  - @prosopo/api@3.5.20
+  - @prosopo/common@3.1.48
+  - @prosopo/keyring@2.9.61
+  - @prosopo/load-balancer@2.10.16
+  - @prosopo/logger@2.0.4
+
+## 2.10.40
+### Patch Changes
+
+- Updated dependencies [a0cb39e]
+  - @prosopo/types@4.9.12
+  - @prosopo/api@3.5.19
+  - @prosopo/keyring@2.9.60
+  - @prosopo/load-balancer@2.10.15
+
 ## 2.10.39
 ### Patch Changes
 

package/dist/_virtual/_rolldown/runtime.js

@@ -0,0 +1,3 @@
+import "node:module";
+//#endregion
+export {};

package/dist/cjs/_virtual/_rolldown/runtime.cjs

@@ -0,0 +1,23 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+exports.__toESM = __toESM;

package/dist/cjs/config.cjs

@@ -1,25 +1,22 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const types = require("@prosopo/types");
-const getServerConfig = () => types.ProsopoServerConfigSchema.parse({
-  defaultEnvironment: process.env.PROSOPO_DEFAULT_ENVIRONMENT,
-  // environmental variables
-  serverUrl: getServerUrl(),
-  dappName: process.env.PROSOPO_DAPP_NAME || "client-example-server",
-  account: {
-    password: "",
-    address: process.env.PROSOPO_SITE_KEY || "",
-    secret: process.env.PROSOPO_SITE_PRIVATE_KEY || ""
-  }
+let _prosopo_types = require("@prosopo/types");
+//#region src/config.ts
+var getServerConfig = () => _prosopo_types.ProsopoServerConfigSchema.parse({
+	defaultEnvironment: process.env.PROSOPO_DEFAULT_ENVIRONMENT,
+	serverUrl: getServerUrl(),
+	dappName: process.env.PROSOPO_DAPP_NAME || "client-example-server",
+	account: {
+		password: "",
+		address: process.env.PROSOPO_SITE_KEY || "",
+		secret: process.env.PROSOPO_SITE_PRIVATE_KEY || ""
+	}
 });
-const getServerUrl = () => {
-  if (process.env.PROSOPO_SERVER_URL) {
-    if (process.env.PROSOPO_SERVER_URL.match(/:\d+/)) {
-      return process.env.PROSOPO_SERVER_URL;
-    }
-    return `${process.env.PROSOPO_SERVER_URL}:${process.env.PROSOPO_SERVER_PORT || 9228}`;
-  }
-  return "https://localhost:9228";
+var getServerUrl = () => {
+	if (process.env.PROSOPO_SERVER_URL) {
+		if (process.env.PROSOPO_SERVER_URL.match(/:\d+/)) return process.env.PROSOPO_SERVER_URL;
+		return `${process.env.PROSOPO_SERVER_URL}:${process.env.PROSOPO_SERVER_PORT || 9228}`;
+	}
+	return "https://localhost:9228";
 };
+//#endregion
 exports.getServerConfig = getServerConfig;
 exports.getServerUrl = getServerUrl;

package/dist/cjs/index.cjs

@@ -1,13 +1,14 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const server = require("./server.cjs");
-const config = require("./config.cjs");
-const keyring = require("@prosopo/keyring");
-const PublicProsopoServer = async (config2) => {
-  const pair = keyring.getPair(void 0, config2.account.address);
-  return new server.ProsopoServer(config2, pair);
+const require_server = require("./server.cjs");
+const require_config = require("./config.cjs");
+let _prosopo_keyring = require("@prosopo/keyring");
+//#region src/index.ts
+var PublicProsopoServer = async (config) => {
+	const pair = (0, _prosopo_keyring.getPair)(void 0, config.account.address);
+	return new require_server.ProsopoServer(config, pair);
 };
-exports.ProsopoServer = server.ProsopoServer;
-exports.getServerConfig = config.getServerConfig;
-exports.getServerUrl = config.getServerUrl;
+//#endregion
+exports.ProsopoServer = require_server.ProsopoServer;
 exports.PublicProsopoServer = PublicProsopoServer;
+exports.getServerConfig = require_config.getServerConfig;
+exports.getServerUrl = require_config.getServerUrl;

package/dist/cjs/server.cjs

@@ -1,200 +1,146 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const api = require("@prosopo/api");
-const common = require("@prosopo/common");
-const keyring = require("@prosopo/keyring");
-const loadBalancer = require("@prosopo/load-balancer");
-const logger = require("@prosopo/logger");
-const types = require("@prosopo/types");
-const util = require("@prosopo/util");
-const i18n = require("i18next");
-class ProsopoServer {
-  constructor(config, pair) {
-    this.config = config;
-    this.pair = pair;
-    this.defaultEnvironment = this.config.defaultEnvironment;
-    this.dappAccount = this.config.account.address;
-    this.logger = logger.getLogger(
-      this.config.logLevel,
-      "@prosopo/server"
-    );
-    this.keyring = new keyring.Keyring({
-      type: "sr25519"
-    });
-  }
-  getProviderApi(providerUrl) {
-    return new api.ProviderApi(providerUrl, this.dappAccount || "");
-  }
-  /**
-   * Verify a token with the issuing provider. Dispatches to the correct
-   * verify endpoint by inspecting the token's declared captchaType:
-   *  - puzzle  → submitPuzzleCaptchaVerify
-   *  - pow     → submitPowCaptchaVerify
-   *  - image   → verifyDappUser
-   * When captchaType is absent (a legacy token minted before the field was
-   * added), fall back to the historical heuristic: presence of `challenge`
-   * routes to PoW, absence routes to image. Legacy puzzle tokens follow the
-   * PoW branch — same behaviour as before this dispatch was introduced.
-   * @param token
-   * @param timeouts
-   * @param providerUrl
-   * @param timestamp
-   * @param user
-   * @param challenge
-   * @param ip
-   * @param email
-   * @param captchaType
-   */
-  async verifyProvider(token, timeouts, providerUrl, timestamp, user, challenge, ip, email, captchaType) {
-    this.logger.info(() => ({
-      data: { providerUrl, captchaType: captchaType ?? "legacy" },
-      msg: "Verifying with provider"
-    }));
-    const dappUserSignature = this.pair?.sign(timestamp.toString());
-    if (!dappUserSignature) {
-      throw new common.ProsopoContractError("CAPTCHA.INVALID_TIMESTAMP", {
-        context: { error: "Timestamp not found" }
-      });
-    }
-    const signatureHex = util.u8aToHex(dappUserSignature);
-    const providerApi = this.getProviderApi(providerUrl);
-    if (captchaType === types.CaptchaType.puzzle) {
-      const puzzleTimeout = this.config.timeouts.puzzle.cachedTimeout;
-      if (!this.isRecent(timestamp, puzzleTimeout, "Puzzle")) {
-        return this.notRecentResponse();
-      }
-      return await providerApi.submitPuzzleCaptchaVerify(
-        token,
-        signatureHex,
-        user,
-        ip,
-        email
-      );
-    }
-    if (captchaType === types.CaptchaType.pow) {
-      const powTimeout = this.config.timeouts.pow.cachedTimeout;
-      if (!this.isRecent(timestamp, powTimeout, "PoW")) {
-        return this.notRecentResponse();
-      }
-      return await providerApi.submitPowCaptchaVerify(
-        token,
-        signatureHex,
-        user,
-        ip,
-        email
-      );
-    }
-    if (captchaType === types.CaptchaType.image) {
-      const imageTimeout2 = this.config.timeouts.image.cachedTimeout;
-      if (!this.isRecent(timestamp, imageTimeout2, "Image")) {
-        return this.notRecentResponse();
-      }
-      return await providerApi.verifyDappUser(
-        token,
-        signatureHex,
-        user,
-        timeouts.image.cachedTimeout,
-        ip,
-        email
-      );
-    }
-    this.logger.warn(() => ({
-      data: { challenge: Boolean(challenge) },
-      msg: "Verifying legacy token without captchaType field; using challenge heuristic"
-    }));
-    if (challenge) {
-      const powTimeout = this.config.timeouts.pow.cachedTimeout;
-      if (!this.isRecent(timestamp, powTimeout, "PoW")) {
-        return this.notRecentResponse();
-      }
-      return await providerApi.submitPowCaptchaVerify(
-        token,
-        signatureHex,
-        user,
-        ip,
-        email
-      );
-    }
-    const imageTimeout = this.config.timeouts.image.cachedTimeout;
-    if (!this.isRecent(timestamp, imageTimeout, "Image")) {
-      return this.notRecentResponse();
-    }
-    return await providerApi.verifyDappUser(
-      token,
-      signatureHex,
-      user,
-      timeouts.image.cachedTimeout,
-      ip,
-      email
-    );
-  }
-  isRecent(timestamp, timeoutMs, label) {
-    if (!timestamp) return false;
-    const recent = Date.now() - timestamp < timeoutMs;
-    if (!recent) {
-      this.logger.error(() => ({
-        data: { timestamp, timeoutMs },
-        msg: `${label} captcha is not recent`
-      }));
-    }
-    return recent;
-  }
-  notRecentResponse() {
-    return {
-      verified: false,
-      status: i18n.t("API.USER_NOT_VERIFIED_TIME_EXPIRED")
-    };
-  }
-  /**
-   * @param token
-   * @param ip
-   * @param email
-   */
-  async isVerified(token, ip, email) {
-    try {
-      const payload = types.decodeProcaptchaOutput(token);
-      const { providerUrl, challenge, timestamp, user, captchaType } = types.ProcaptchaOutputSchema.parse(payload);
-      const providers = await loadBalancer.loadBalancer(this.config.defaultEnvironment);
-      const provider = providers.find((p) => p.url === providerUrl);
-      if (!provider) {
-        this.logger.error(() => ({
-          data: { providerUrl },
-          msg: "Provider not found"
-        }));
-        return {
-          verified: false,
-          status: i18n.t("API.USER_NOT_VERIFIED")
-        };
-      }
-      const verificationResponse = await this.verifyProvider(
-        token,
-        this.config.timeouts,
-        provider.url,
-        Number(timestamp),
-        user,
-        challenge,
-        ip,
-        email,
-        captchaType
-      );
-      this.logger.info(() => ({
-        data: {
-          verificationResponse,
-          providerUrl,
-          user,
-          challenge,
-          captchaType: captchaType ?? "legacy",
-          siteKey: this.pair?.address
-        }
-      }));
-      return verificationResponse;
-    } catch (err) {
-      this.logger.error(() => ({ err, data: { token } }));
-      const code = err instanceof api.HttpError ? err.status : 500;
-      throw new common.ProsopoApiError("API.BAD_REQUEST", {
-        context: { code, token }
-      });
-    }
-  }
-}
+const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
+let _prosopo_api = require("@prosopo/api");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_keyring = require("@prosopo/keyring");
+let _prosopo_load_balancer = require("@prosopo/load-balancer");
+let _prosopo_logger = require("@prosopo/logger");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+let i18next = require("i18next");
+i18next = require_runtime.__toESM(i18next, 1);
+//#region src/server.ts
+var ProsopoServer = class {
+	constructor(config, pair) {
+		this.config = config;
+		this.pair = pair;
+		this.defaultEnvironment = this.config.defaultEnvironment;
+		this.dappAccount = this.config.account.address;
+		this.logger = (0, _prosopo_logger.getLogger)(this.config.logLevel, "@prosopo/server");
+		this.keyring = new _prosopo_keyring.Keyring({ type: "sr25519" });
+	}
+	getProviderApi(providerUrl) {
+		return new _prosopo_api.ProviderApi(providerUrl, this.dappAccount || "");
+	}
+	/**
+	* Verify a token with the issuing provider. Dispatches to the correct
+	* verify endpoint by inspecting the token's declared captchaType:
+	*  - puzzle  → submitPuzzleCaptchaVerify
+	*  - pow     → submitPowCaptchaVerify
+	*  - image   → verifyDappUser
+	* When captchaType is absent (a legacy token minted before the field was
+	* added), fall back to the historical heuristic: presence of `challenge`
+	* routes to PoW, absence routes to image. Legacy puzzle tokens follow the
+	* PoW branch — same behaviour as before this dispatch was introduced.
+	* @param token
+	* @param timeouts
+	* @param providerUrl
+	* @param timestamp
+	* @param user
+	* @param challenge
+	* @param ip
+	* @param email
+	* @param captchaType
+	*/
+	async verifyProvider(token, timeouts, providerUrl, timestamp, user, challenge, ip, email, captchaType) {
+		this.logger.info(() => ({
+			data: {
+				providerUrl,
+				captchaType: captchaType ?? "legacy"
+			},
+			msg: "Verifying with provider"
+		}));
+		const dappUserSignature = this.pair?.sign(timestamp.toString());
+		if (!dappUserSignature) throw new _prosopo_common.ProsopoContractError("CAPTCHA.INVALID_TIMESTAMP", { context: { error: "Timestamp not found" } });
+		const signatureHex = (0, _prosopo_util.u8aToHex)(dappUserSignature);
+		const providerApi = this.getProviderApi(providerUrl);
+		if (captchaType === _prosopo_types.CaptchaType.puzzle) {
+			const puzzleTimeout = this.config.timeouts.puzzle.cachedTimeout;
+			if (!this.isRecent(timestamp, puzzleTimeout, "Puzzle")) return this.notRecentResponse();
+			return await providerApi.submitPuzzleCaptchaVerify(token, signatureHex, user, ip, email);
+		}
+		if (captchaType === _prosopo_types.CaptchaType.pow) {
+			const powTimeout = this.config.timeouts.pow.cachedTimeout;
+			if (!this.isRecent(timestamp, powTimeout, "PoW")) return this.notRecentResponse();
+			return await providerApi.submitPowCaptchaVerify(token, signatureHex, user, ip, email);
+		}
+		if (captchaType === _prosopo_types.CaptchaType.image) {
+			const imageTimeout = this.config.timeouts.image.cachedTimeout;
+			if (!this.isRecent(timestamp, imageTimeout, "Image")) return this.notRecentResponse();
+			return await providerApi.verifyDappUser(token, signatureHex, user, timeouts.image.cachedTimeout, ip, email);
+		}
+		this.logger.warn(() => ({
+			data: { challenge: Boolean(challenge) },
+			msg: "Verifying legacy token without captchaType field; using challenge heuristic"
+		}));
+		if (challenge) {
+			const powTimeout = this.config.timeouts.pow.cachedTimeout;
+			if (!this.isRecent(timestamp, powTimeout, "PoW")) return this.notRecentResponse();
+			return await providerApi.submitPowCaptchaVerify(token, signatureHex, user, ip, email);
+		}
+		const imageTimeout = this.config.timeouts.image.cachedTimeout;
+		if (!this.isRecent(timestamp, imageTimeout, "Image")) return this.notRecentResponse();
+		return await providerApi.verifyDappUser(token, signatureHex, user, timeouts.image.cachedTimeout, ip, email);
+	}
+	isRecent(timestamp, timeoutMs, label) {
+		if (!timestamp) return false;
+		const recent = Date.now() - timestamp < timeoutMs;
+		if (!recent) this.logger.error(() => ({
+			data: {
+				timestamp,
+				timeoutMs
+			},
+			msg: `${label} captcha is not recent`
+		}));
+		return recent;
+	}
+	notRecentResponse() {
+		return {
+			verified: false,
+			status: i18next.default.t("API.USER_NOT_VERIFIED_TIME_EXPIRED")
+		};
+	}
+	/**
+	* @param token
+	* @param ip
+	* @param email
+	*/
+	async isVerified(token, ip, email) {
+		try {
+			const payload = (0, _prosopo_types.decodeProcaptchaOutput)(token);
+			const { providerUrl, challenge, timestamp, user, captchaType } = _prosopo_types.ProcaptchaOutputSchema.parse(payload);
+			const provider = (await (0, _prosopo_load_balancer.loadBalancer)(this.config.defaultEnvironment)).find((p) => p.url === providerUrl);
+			if (!provider) {
+				this.logger.error(() => ({
+					data: { providerUrl },
+					msg: "Provider not found"
+				}));
+				return {
+					verified: false,
+					status: i18next.default.t("API.USER_NOT_VERIFIED")
+				};
+			}
+			const verificationResponse = await this.verifyProvider(token, this.config.timeouts, provider.url, Number(timestamp), user, challenge, ip, email, captchaType);
+			this.logger.info(() => ({ data: {
+				verificationResponse,
+				providerUrl,
+				user,
+				challenge,
+				captchaType: captchaType ?? "legacy",
+				siteKey: this.pair?.address
+			} }));
+			return verificationResponse;
+		} catch (err) {
+			this.logger.error(() => ({
+				err,
+				data: { token }
+			}));
+			const code = err instanceof _prosopo_api.HttpError ? err.status : 500;
+			throw new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", { context: {
+				code,
+				token
+			} });
+		}
+	}
+};
+//#endregion
 exports.ProsopoServer = ProsopoServer;

package/dist/config.js

@@ -1,25 +1,21 @@
 import { ProsopoServerConfigSchema } from "@prosopo/types";
-const getServerConfig = () => ProsopoServerConfigSchema.parse({
-  defaultEnvironment: process.env.PROSOPO_DEFAULT_ENVIRONMENT,
-  // environmental variables
-  serverUrl: getServerUrl(),
-  dappName: process.env.PROSOPO_DAPP_NAME || "client-example-server",
-  account: {
-    password: "",
-    address: process.env.PROSOPO_SITE_KEY || "",
-    secret: process.env.PROSOPO_SITE_PRIVATE_KEY || ""
-  }
+//#region src/config.ts
+var getServerConfig = () => ProsopoServerConfigSchema.parse({
+	defaultEnvironment: process.env.PROSOPO_DEFAULT_ENVIRONMENT,
+	serverUrl: getServerUrl(),
+	dappName: process.env.PROSOPO_DAPP_NAME || "client-example-server",
+	account: {
+		password: "",
+		address: process.env.PROSOPO_SITE_KEY || "",
+		secret: process.env.PROSOPO_SITE_PRIVATE_KEY || ""
+	}
 });
-const getServerUrl = () => {
-  if (process.env.PROSOPO_SERVER_URL) {
-    if (process.env.PROSOPO_SERVER_URL.match(/:\d+/)) {
-      return process.env.PROSOPO_SERVER_URL;
-    }
-    return `${process.env.PROSOPO_SERVER_URL}:${process.env.PROSOPO_SERVER_PORT || 9228}`;
-  }
-  return "https://localhost:9228";
-};
-export {
-  getServerConfig,
-  getServerUrl
+var getServerUrl = () => {
+	if (process.env.PROSOPO_SERVER_URL) {
+		if (process.env.PROSOPO_SERVER_URL.match(/:\d+/)) return process.env.PROSOPO_SERVER_URL;
+		return `${process.env.PROSOPO_SERVER_URL}:${process.env.PROSOPO_SERVER_PORT || 9228}`;
+	}
+	return "https://localhost:9228";
 };
+//#endregion
+export { getServerConfig, getServerUrl };

package/dist/index.js

@@ -1,13 +1,10 @@
+import "./_virtual/_rolldown/runtime.js";
 import { ProsopoServer } from "./server.js";
 import { getServerConfig, getServerUrl } from "./config.js";
 import { getPair } from "@prosopo/keyring";
-const PublicProsopoServer = async (config) => {
-  const pair = getPair(void 0, config.account.address);
-  return new ProsopoServer(config, pair);
-};
-export {
-  ProsopoServer,
-  PublicProsopoServer,
-  getServerConfig,
-  getServerUrl
+//#region src/index.ts
+var PublicProsopoServer = async (config) => {
+	return new ProsopoServer(config, getPair(void 0, config.account.address));
 };
+//#endregion
+export { ProsopoServer, PublicProsopoServer, getServerConfig, getServerUrl };

package/dist/server.js

@@ -1,200 +1,143 @@
-import { ProviderApi, HttpError } from "@prosopo/api";
-import { ProsopoContractError, ProsopoApiError } from "@prosopo/common";
+import { HttpError, ProviderApi } from "@prosopo/api";
+import { ProsopoApiError, ProsopoContractError } from "@prosopo/common";
 import { Keyring } from "@prosopo/keyring";
 import { loadBalancer } from "@prosopo/load-balancer";
 import { getLogger } from "@prosopo/logger";
-import { CaptchaType, decodeProcaptchaOutput, ProcaptchaOutputSchema } from "@prosopo/types";
+import { CaptchaType, ProcaptchaOutputSchema, decodeProcaptchaOutput } from "@prosopo/types";
 import { u8aToHex } from "@prosopo/util";
 import i18n from "i18next";
-class ProsopoServer {
-  constructor(config, pair) {
-    this.config = config;
-    this.pair = pair;
-    this.defaultEnvironment = this.config.defaultEnvironment;
-    this.dappAccount = this.config.account.address;
-    this.logger = getLogger(
-      this.config.logLevel,
-      "@prosopo/server"
-    );
-    this.keyring = new Keyring({
-      type: "sr25519"
-    });
-  }
-  getProviderApi(providerUrl) {
-    return new ProviderApi(providerUrl, this.dappAccount || "");
-  }
-  /**
-   * Verify a token with the issuing provider. Dispatches to the correct
-   * verify endpoint by inspecting the token's declared captchaType:
-   *  - puzzle  → submitPuzzleCaptchaVerify
-   *  - pow     → submitPowCaptchaVerify
-   *  - image   → verifyDappUser
-   * When captchaType is absent (a legacy token minted before the field was
-   * added), fall back to the historical heuristic: presence of `challenge`
-   * routes to PoW, absence routes to image. Legacy puzzle tokens follow the
-   * PoW branch — same behaviour as before this dispatch was introduced.
-   * @param token
-   * @param timeouts
-   * @param providerUrl
-   * @param timestamp
-   * @param user
-   * @param challenge
-   * @param ip
-   * @param email
-   * @param captchaType
-   */
-  async verifyProvider(token, timeouts, providerUrl, timestamp, user, challenge, ip, email, captchaType) {
-    this.logger.info(() => ({
-      data: { providerUrl, captchaType: captchaType ?? "legacy" },
-      msg: "Verifying with provider"
-    }));
-    const dappUserSignature = this.pair?.sign(timestamp.toString());
-    if (!dappUserSignature) {
-      throw new ProsopoContractError("CAPTCHA.INVALID_TIMESTAMP", {
-        context: { error: "Timestamp not found" }
-      });
-    }
-    const signatureHex = u8aToHex(dappUserSignature);
-    const providerApi = this.getProviderApi(providerUrl);
-    if (captchaType === CaptchaType.puzzle) {
-      const puzzleTimeout = this.config.timeouts.puzzle.cachedTimeout;
-      if (!this.isRecent(timestamp, puzzleTimeout, "Puzzle")) {
-        return this.notRecentResponse();
-      }
-      return await providerApi.submitPuzzleCaptchaVerify(
-        token,
-        signatureHex,
-        user,
-        ip,
-        email
-      );
-    }
-    if (captchaType === CaptchaType.pow) {
-      const powTimeout = this.config.timeouts.pow.cachedTimeout;
-      if (!this.isRecent(timestamp, powTimeout, "PoW")) {
-        return this.notRecentResponse();
-      }
-      return await providerApi.submitPowCaptchaVerify(
-        token,
-        signatureHex,
-        user,
-        ip,
-        email
-      );
-    }
-    if (captchaType === CaptchaType.image) {
-      const imageTimeout2 = this.config.timeouts.image.cachedTimeout;
-      if (!this.isRecent(timestamp, imageTimeout2, "Image")) {
-        return this.notRecentResponse();
-      }
-      return await providerApi.verifyDappUser(
-        token,
-        signatureHex,
-        user,
-        timeouts.image.cachedTimeout,
-        ip,
-        email
-      );
-    }
-    this.logger.warn(() => ({
-      data: { challenge: Boolean(challenge) },
-      msg: "Verifying legacy token without captchaType field; using challenge heuristic"
-    }));
-    if (challenge) {
-      const powTimeout = this.config.timeouts.pow.cachedTimeout;
-      if (!this.isRecent(timestamp, powTimeout, "PoW")) {
-        return this.notRecentResponse();
-      }
-      return await providerApi.submitPowCaptchaVerify(
-        token,
-        signatureHex,
-        user,
-        ip,
-        email
-      );
-    }
-    const imageTimeout = this.config.timeouts.image.cachedTimeout;
-    if (!this.isRecent(timestamp, imageTimeout, "Image")) {
-      return this.notRecentResponse();
-    }
-    return await providerApi.verifyDappUser(
-      token,
-      signatureHex,
-      user,
-      timeouts.image.cachedTimeout,
-      ip,
-      email
-    );
-  }
-  isRecent(timestamp, timeoutMs, label) {
-    if (!timestamp) return false;
-    const recent = Date.now() - timestamp < timeoutMs;
-    if (!recent) {
-      this.logger.error(() => ({
-        data: { timestamp, timeoutMs },
-        msg: `${label} captcha is not recent`
-      }));
-    }
-    return recent;
-  }
-  notRecentResponse() {
-    return {
-      verified: false,
-      status: i18n.t("API.USER_NOT_VERIFIED_TIME_EXPIRED")
-    };
-  }
-  /**
-   * @param token
-   * @param ip
-   * @param email
-   */
-  async isVerified(token, ip, email) {
-    try {
-      const payload = decodeProcaptchaOutput(token);
-      const { providerUrl, challenge, timestamp, user, captchaType } = ProcaptchaOutputSchema.parse(payload);
-      const providers = await loadBalancer(this.config.defaultEnvironment);
-      const provider = providers.find((p) => p.url === providerUrl);
-      if (!provider) {
-        this.logger.error(() => ({
-          data: { providerUrl },
-          msg: "Provider not found"
-        }));
-        return {
-          verified: false,
-          status: i18n.t("API.USER_NOT_VERIFIED")
-        };
-      }
-      const verificationResponse = await this.verifyProvider(
-        token,
-        this.config.timeouts,
-        provider.url,
-        Number(timestamp),
-        user,
-        challenge,
-        ip,
-        email,
-        captchaType
-      );
-      this.logger.info(() => ({
-        data: {
-          verificationResponse,
-          providerUrl,
-          user,
-          challenge,
-          captchaType: captchaType ?? "legacy",
-          siteKey: this.pair?.address
-        }
-      }));
-      return verificationResponse;
-    } catch (err) {
-      this.logger.error(() => ({ err, data: { token } }));
-      const code = err instanceof HttpError ? err.status : 500;
-      throw new ProsopoApiError("API.BAD_REQUEST", {
-        context: { code, token }
-      });
-    }
-  }
-}
-export {
-  ProsopoServer
+//#region src/server.ts
+var ProsopoServer = class {
+	constructor(config, pair) {
+		this.config = config;
+		this.pair = pair;
+		this.defaultEnvironment = this.config.defaultEnvironment;
+		this.dappAccount = this.config.account.address;
+		this.logger = getLogger(this.config.logLevel, "@prosopo/server");
+		this.keyring = new Keyring({ type: "sr25519" });
+	}
+	getProviderApi(providerUrl) {
+		return new ProviderApi(providerUrl, this.dappAccount || "");
+	}
+	/**
+	* Verify a token with the issuing provider. Dispatches to the correct
+	* verify endpoint by inspecting the token's declared captchaType:
+	*  - puzzle  → submitPuzzleCaptchaVerify
+	*  - pow     → submitPowCaptchaVerify
+	*  - image   → verifyDappUser
+	* When captchaType is absent (a legacy token minted before the field was
+	* added), fall back to the historical heuristic: presence of `challenge`
+	* routes to PoW, absence routes to image. Legacy puzzle tokens follow the
+	* PoW branch — same behaviour as before this dispatch was introduced.
+	* @param token
+	* @param timeouts
+	* @param providerUrl
+	* @param timestamp
+	* @param user
+	* @param challenge
+	* @param ip
+	* @param email
+	* @param captchaType
+	*/
+	async verifyProvider(token, timeouts, providerUrl, timestamp, user, challenge, ip, email, captchaType) {
+		this.logger.info(() => ({
+			data: {
+				providerUrl,
+				captchaType: captchaType ?? "legacy"
+			},
+			msg: "Verifying with provider"
+		}));
+		const dappUserSignature = this.pair?.sign(timestamp.toString());
+		if (!dappUserSignature) throw new ProsopoContractError("CAPTCHA.INVALID_TIMESTAMP", { context: { error: "Timestamp not found" } });
+		const signatureHex = u8aToHex(dappUserSignature);
+		const providerApi = this.getProviderApi(providerUrl);
+		if (captchaType === CaptchaType.puzzle) {
+			const puzzleTimeout = this.config.timeouts.puzzle.cachedTimeout;
+			if (!this.isRecent(timestamp, puzzleTimeout, "Puzzle")) return this.notRecentResponse();
+			return await providerApi.submitPuzzleCaptchaVerify(token, signatureHex, user, ip, email);
+		}
+		if (captchaType === CaptchaType.pow) {
+			const powTimeout = this.config.timeouts.pow.cachedTimeout;
+			if (!this.isRecent(timestamp, powTimeout, "PoW")) return this.notRecentResponse();
+			return await providerApi.submitPowCaptchaVerify(token, signatureHex, user, ip, email);
+		}
+		if (captchaType === CaptchaType.image) {
+			const imageTimeout = this.config.timeouts.image.cachedTimeout;
+			if (!this.isRecent(timestamp, imageTimeout, "Image")) return this.notRecentResponse();
+			return await providerApi.verifyDappUser(token, signatureHex, user, timeouts.image.cachedTimeout, ip, email);
+		}
+		this.logger.warn(() => ({
+			data: { challenge: Boolean(challenge) },
+			msg: "Verifying legacy token without captchaType field; using challenge heuristic"
+		}));
+		if (challenge) {
+			const powTimeout = this.config.timeouts.pow.cachedTimeout;
+			if (!this.isRecent(timestamp, powTimeout, "PoW")) return this.notRecentResponse();
+			return await providerApi.submitPowCaptchaVerify(token, signatureHex, user, ip, email);
+		}
+		const imageTimeout = this.config.timeouts.image.cachedTimeout;
+		if (!this.isRecent(timestamp, imageTimeout, "Image")) return this.notRecentResponse();
+		return await providerApi.verifyDappUser(token, signatureHex, user, timeouts.image.cachedTimeout, ip, email);
+	}
+	isRecent(timestamp, timeoutMs, label) {
+		if (!timestamp) return false;
+		const recent = Date.now() - timestamp < timeoutMs;
+		if (!recent) this.logger.error(() => ({
+			data: {
+				timestamp,
+				timeoutMs
+			},
+			msg: `${label} captcha is not recent`
+		}));
+		return recent;
+	}
+	notRecentResponse() {
+		return {
+			verified: false,
+			status: i18n.t("API.USER_NOT_VERIFIED_TIME_EXPIRED")
+		};
+	}
+	/**
+	* @param token
+	* @param ip
+	* @param email
+	*/
+	async isVerified(token, ip, email) {
+		try {
+			const payload = decodeProcaptchaOutput(token);
+			const { providerUrl, challenge, timestamp, user, captchaType } = ProcaptchaOutputSchema.parse(payload);
+			const provider = (await loadBalancer(this.config.defaultEnvironment)).find((p) => p.url === providerUrl);
+			if (!provider) {
+				this.logger.error(() => ({
+					data: { providerUrl },
+					msg: "Provider not found"
+				}));
+				return {
+					verified: false,
+					status: i18n.t("API.USER_NOT_VERIFIED")
+				};
+			}
+			const verificationResponse = await this.verifyProvider(token, this.config.timeouts, provider.url, Number(timestamp), user, challenge, ip, email, captchaType);
+			this.logger.info(() => ({ data: {
+				verificationResponse,
+				providerUrl,
+				user,
+				challenge,
+				captchaType: captchaType ?? "legacy",
+				siteKey: this.pair?.address
+			} }));
+			return verificationResponse;
+		} catch (err) {
+			this.logger.error(() => ({
+				err,
+				data: { token }
+			}));
+			throw new ProsopoApiError("API.BAD_REQUEST", { context: {
+				code: err instanceof HttpError ? err.status : 500,
+				token
+			} });
+		}
+	}
 };
+//#endregion
+export { ProsopoServer };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/server",
-	"version": "2.10.39",
+	"version": "2.10.41",
 	"description": "NodeJS package for server side communication with the prosopo captcha client",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -38,28 +38,28 @@
 	"homepage": "https://github.com/prosopo/captcha#readme",
 	"sideEffects": false,
 	"dependencies": {
-		"@prosopo/api": "3.5.18",
-		"@prosopo/common": "3.1.47",
-		"@prosopo/logger": "2.0.3",
-		"@prosopo/keyring": "2.9.59",
-		"@prosopo/load-balancer": "2.10.14",
-		"@prosopo/types": "4.9.11",
-		"@prosopo/util": "3.3.4",
+		"@prosopo/api": "3.5.20",
+		"@prosopo/common": "3.1.48",
+		"@prosopo/logger": "2.0.4",
+		"@prosopo/keyring": "2.9.61",
+		"@prosopo/load-balancer": "2.10.16",
+		"@prosopo/types": "4.10.0",
+		"@prosopo/util": "3.3.5",
 		"i18next": "24.1.0"
 	},
 	"devDependencies": {
 		"@polkadot/util": "13.5.7",
-		"@prosopo/config": "3.3.4",
+		"@prosopo/config": "3.3.5",
 		"@types/node": "22.10.2",
-		"@vitest/coverage-v8": "3.2.4",
+		"@vitest/coverage-v8": "4.1.10",
 		"concurrently": "9.0.1",
 		"del-cli": "6.0.0",
 		"npm-run-all": "4.1.5",
 		"tslib": "2.7.0",
 		"tsx": "4.20.3",
 		"typescript": "5.6.2",
-		"vite": "6.4.1",
-		"vitest": "3.2.4",
+		"vite": "8.1.5",
+		"vitest": "4.1.10",
 		"zod": "3.23.8"
 	}
 }