altcha-lib 2.1.0 → 2.3.0

package/README.md

@@ -55,6 +55,8 @@ The library includes plugins for several popular frameworks to simplify integrat
 
 If your framework is not listed, see the [Advanced Usage](/docs/advanced-usage.md) guide for custom integrations.
 
+All plugins also support remote verification via ALTCHA Sentinel (`verifyServer` option) — see [`/docs/server-signatures.md`](/docs/server-signatures.md#remote-verification-sentinel-api).
+
 ## Documentation
 
 - Advanced Usage: [`/docs/advanced-usage.md`](/docs/advanced-usage.md)
@@ -217,6 +219,32 @@ Returns `VerifyServerSignatureResult` (extends `VerifySolutionResult`):
 | `verified` | `boolean` | Whether the signature is valid. |
 | `verificationData` | `ServerSignatureVerificationData \| null` | Parsed verification data. |
 
+#### `verifyServer(options: VerifyServerOptions): Promise<VerifyServerResult>`
+
+Verifies a payload remotely by calling ALTCHA Sentinel's `POST /v1/verify/signature` API, instead of verifying the HMAC signature locally.
+
+| Option | Type | Description |
+|---|---|---|
+| `payload` | `string \| ServerSignaturePayload \| Record<string, unknown>` | The payload to verify, as received from `POST /v1/verify`. |
+| `url` | `string` | Full URL of the Sentinel `/v1/verify/signature` endpoint. |
+| `secret` | `string?` | API key secret. If provided, Sentinel checks that it matches the API key associated with the payload. |
+| `fetch` | `typeof fetch?` | Custom fetch implementation. Defaults to the global `fetch`. |
+| `headers` | `Record<string, string>?` | Additional headers to send with the request. |
+| `controller` | `AbortController?` | For cancelling the verification request. |
+| `timeout` | `number?` | Per-attempt request timeout in milliseconds. Defaults to `10000`. |
+| `retries` | `number?` | Number of retry attempts after the first try. Defaults to `0`. |
+| `retryDelay` | `number?` | Base delay in milliseconds between retries. Defaults to `300`. |
+| `retryBackoff` | `'fixed' \| 'exponential'?` | Backoff strategy for `retryDelay`. Defaults to `'exponential'`. |
+
+Returns `VerifyServerResult`:
+
+| Field | Type | Description |
+|---|---|---|
+| `verified` | `boolean` | Whether the payload was successfully verified. |
+| `apiKey` | `string \| null?` | API key associated with the verification. |
+| `reason` | `string?` | Reason or error message if verification failed. |
+| `verificationData` | `ServerSignatureVerificationData \| null?` | Verification data returned by Sentinel. |
+
 #### `obfuscate(str: string, options?): Promise<string>`
 
 > Import from `altcha-lib/obfuscation`

package/dist/cjs/v2/frameworks/express.js

@@ -13,15 +13,18 @@ const asyncHandler = (fn) => (req, res, next) => {
     fn(req, res, next).catch(next);
 };
 function create(options) {
-    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, } = options;
+    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, verifyServer: verifyServerOptions, } = options;
     const challengeHandler = asyncHandler(async (req, res) => {
+        if (!deriveKey || !createChallengeParameters) {
+            throw new Error('deriveKey and createChallengeParameters are required to generate challenges. Omit challengeHandler when relying on Sentinel to issue challenges.');
+        }
         const challenge = await (0, pow_js_1.createChallenge)({
             deriveKey,
             hmacSignatureSecret,
             hmacKeySignatureSecret,
             ...createChallengeParameters(),
         });
-        res.json({
+        res.set('Cache-Control', 'no-store').json({
             configuration: setCookie
                 ? {
                     setCookie,
@@ -32,7 +35,7 @@ function create(options) {
     });
     const verifyHandler = asyncHandler(async (req, res) => {
         const payload = await getPayloadFromRequest(req);
-        const result = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+        const result = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
         res.json(result);
     });
     const getPayloadFromRequest = async (req, cookieName) => {
@@ -45,7 +48,7 @@ function create(options) {
         const { throwOnFailure = true } = options;
         return asyncHandler(async (req, res, next) => {
             const payload = await getPayloadFromRequest(req, setCookie?.name);
-            const { error, payload: resultPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+            const { error, payload: resultPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
             res.locals.altcha = {
                 error,
                 payload: resultPayload,

package/dist/cjs/v2/frameworks/fastify.js

@@ -10,7 +10,7 @@ Object.defineProperty(exports, "deriveHmacKeySecret", { enumerable: true, get: f
 const capped_map_js_1 = require("../capped-map.js");
 Object.defineProperty(exports, "CappedMap", { enumerable: true, get: function () { return capped_map_js_1.CappedMap; } });
 function create(options) {
-    const { createChallengeParameters, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, } = options;
+    const { createChallengeParameters, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, verifyServer: verifyServerOptions, } = options;
     const deleteCookie = (reply, name, path = '/') => {
         reply.header('Set-Cookie', `${name}=; Path=${path ?? '/'}; Max-Age=0`);
     };
@@ -34,13 +34,16 @@ function create(options) {
         return request.body?.altcha;
     };
     const challengeHandler = async (request, reply) => {
+        if (!deriveKey || !createChallengeParameters) {
+            throw new Error('deriveKey and createChallengeParameters are required to generate challenges. Omit challengeHandler when relying on Sentinel to issue challenges.');
+        }
         const challenge = await (0, pow_js_1.createChallenge)({
             deriveKey,
             hmacSignatureSecret,
             hmacKeySignatureSecret,
             ...createChallengeParameters(),
         });
-        return reply.send({
+        return reply.header('Cache-Control', 'no-store').send({
             configuration: setCookie
                 ? {
                     setCookie,
@@ -51,14 +54,14 @@ function create(options) {
     };
     const verifyHandler = async (request, reply) => {
         const payload = await getPayloadFromRequest(request);
-        const result = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+        const result = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
         return reply.send(result);
     };
     const middleware = (options = {}) => {
         const { throwOnFailure = true } = options;
         return async (request, reply) => {
             const payload = await getPayloadFromRequest(request, setCookie?.name);
-            const { error, payload: resultPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+            const { error, payload: resultPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
             request.altcha = {
                 error,
                 payload: resultPayload,

package/dist/cjs/v2/frameworks/h3.d.ts

@@ -22,7 +22,7 @@ export declare function create(options: AltchaOptions): {
     verifyHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
         error: string | null;
         payload: import("../types.js").Payload | import("../types.js").ServerSignaturePayload | null;
-        verification: import("../types.js").VerifySolutionResult | null;
+        verification: import("../types.js").VerifySolutionResult | import("../types.js").VerifyServerResult | null;
     }>>;
     getPayloadFromEvent: (event: H3Event, cookieName?: string) => Promise<string | undefined>;
     middleware: (options?: AltchaMiddlewareOptions) => import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/cjs/v2/frameworks/h3.js

@@ -11,8 +11,15 @@ Object.defineProperty(exports, "CappedMap", { enumerable: true, get: function ()
 const shared_js_1 = require("./shared.js");
 Object.defineProperty(exports, "deriveHmacKeySecret", { enumerable: true, get: function () { return shared_js_1.deriveHmacKeySecret; } });
 function create(options) {
-    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, } = options;
-    const challengeHandler = (0, h3_1.defineEventHandler)(async () => {
+    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, verifyServer: verifyServerOptions, } = options;
+    const challengeHandler = (0, h3_1.defineEventHandler)(async (event) => {
+        if (!deriveKey || !createChallengeParameters) {
+            throw new h3_1.HTTPError({
+                message: 'deriveKey and createChallengeParameters are required to generate challenges. Omit challengeHandler when relying on Sentinel to issue challenges.',
+                status: 500,
+            });
+        }
+        (0, h3_1.setResponseHeader)(event, 'Cache-Control', 'no-store');
         return {
             configuration: setCookie
                 ? {
@@ -28,7 +35,7 @@ function create(options) {
         };
     });
     const verifyHandler = (0, h3_1.defineEventHandler)(async (event) => {
-        return await (0, shared_js_1.verify)(await getPayloadFromEvent(event), deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+        return await (0, shared_js_1.verify)(await getPayloadFromEvent(event), deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
     });
     const getPayloadFromEvent = async (event, cookieName) => {
         let payload = undefined;
@@ -59,7 +66,7 @@ function create(options) {
     const middleware = (options = {}) => {
         const { throwOnFailure = true } = options;
         return (0, h3_1.defineEventHandler)(async (event) => {
-            const { error, payload, verification } = await (0, shared_js_1.verify)(await getPayloadFromEvent(event, setCookie?.name), deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+            const { error, payload, verification } = await (0, shared_js_1.verify)(await getPayloadFromEvent(event, setCookie?.name), deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
             event.context.altcha = {
                 error,
                 payload,

package/dist/cjs/v2/frameworks/hono.d.ts

@@ -84,6 +84,24 @@ export declare function create(options: AltchaOptions): {
             invalidSolution: boolean | null;
             time: number;
             verified: boolean;
+        } | {
+            apiKey?: string | null | undefined;
+            reason?: string | undefined;
+            verificationData?: {
+                [x: string]: import("hono/utils/types.js").JSONValue;
+                classification?: import("../types.js").ServerClassification | undefined;
+                email?: string | undefined;
+                expire?: number | undefined;
+                fields?: string[] | undefined;
+                fieldsHash?: string | undefined;
+                id?: string | undefined;
+                ipAddress?: string | undefined;
+                reasons?: string[] | undefined;
+                score?: number | undefined;
+                time?: number | undefined;
+                verified?: boolean | undefined;
+            } | null | undefined;
+            verified: boolean;
         } | null;
     }, import("hono/utils/http-status.js").ContentfulStatusCode, "json">>;
     getPayloadFromContext: (c: Context, cookieName?: string) => Promise<string | undefined>;

package/dist/cjs/v2/frameworks/hono.js

@@ -12,8 +12,14 @@ Object.defineProperty(exports, "CappedMap", { enumerable: true, get: function ()
 const shared_js_1 = require("./shared.js");
 Object.defineProperty(exports, "deriveHmacKeySecret", { enumerable: true, get: function () { return shared_js_1.deriveHmacKeySecret; } });
 function create(options) {
-    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, } = options;
+    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, verifyServer: verifyServerOptions, } = options;
     const challengeHandler = async (c) => {
+        if (!deriveKey || !createChallengeParameters) {
+            throw new http_exception_1.HTTPException(500, {
+                message: 'deriveKey and createChallengeParameters are required to generate challenges. Omit challengeHandler when relying on Sentinel to issue challenges.',
+            });
+        }
+        c.header('Cache-Control', 'no-store');
         return c.json({
             configuration: setCookie
                 ? {
@@ -29,7 +35,7 @@ function create(options) {
         });
     };
     const verifyHandler = async (c) => {
-        return c.json(await (0, shared_js_1.verify)(await getPayloadFromContext(c), deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store));
+        return c.json(await (0, shared_js_1.verify)(await getPayloadFromContext(c), deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions));
     };
     const getPayloadFromContext = async (c, cookieName) => {
         let payload = undefined;
@@ -53,7 +59,7 @@ function create(options) {
     const middleware = (options = {}) => {
         const { throwOnFailure = true } = options;
         return async (c, next) => {
-            const { error, payload, verification } = await (0, shared_js_1.verify)(await getPayloadFromContext(c, setCookie?.name), deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+            const { error, payload, verification } = await (0, shared_js_1.verify)(await getPayloadFromContext(c, setCookie?.name), deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
             c.set('altcha', {
                 error,
                 payload,

package/dist/cjs/v2/frameworks/nestjs.d.ts

@@ -22,13 +22,14 @@ export declare function createAltchaMiddleware(options?: AltchaMiddlewareOptions
     };
 };
 export declare class AltchaService {
-    private readonly hmacSignatureSecret;
+    private readonly hmacSignatureSecret?;
     private readonly hmacKeySignatureSecret?;
     private readonly createChallengeParameters;
-    private readonly deriveKey;
+    private readonly deriveKey?;
     private readonly fieldName;
     private readonly setCookieOptions?;
     private readonly store?;
+    private readonly verifyServerOptions?;
     constructor(options: AltchaOptions);
     get setCookie(): RequireField<SetCookieOptions, 'name'> | undefined;
     getChallenge(): Promise<{
@@ -43,7 +44,7 @@ export declare class AltchaService {
     verify(payload: string | undefined): Promise<{
         error: string | null;
         payload: import("../types.js").Payload | import("../types.js").ServerSignaturePayload | null;
-        verification: import("../types.js").VerifySolutionResult | null;
+        verification: import("../types.js").VerifySolutionResult | import("../types.js").VerifyServerResult | null;
     }>;
 }
 export declare class AltchaController {
@@ -60,7 +61,7 @@ export declare class AltchaController {
     verifySolution(req: Request): Promise<{
         error: string | null;
         payload: import("../types.js").Payload | import("../types.js").ServerSignaturePayload | null;
-        verification: import("../types.js").VerifySolutionResult | null;
+        verification: import("../types.js").VerifySolutionResult | import("../types.js").VerifyServerResult | null;
     }>;
 }
 export declare class AltchaMiddleware implements NestMiddleware {

package/dist/cjs/v2/frameworks/nestjs.js

@@ -67,16 +67,21 @@ let AltchaService = class AltchaService {
         this.fieldName = options.fieldName || 'altcha';
         this.setCookieOptions = options.setCookie;
         this.store = options.store;
+        this.verifyServerOptions = options.verifyServer;
     }
     get setCookie() {
         return this.setCookieOptions;
     }
     async getChallenge() {
+        const { createChallengeParameters, deriveKey } = this;
+        if (!deriveKey || !createChallengeParameters) {
+            throw new common_1.HttpException('deriveKey and createChallengeParameters are required to generate challenges. Omit the /challenge route when relying on Sentinel to issue challenges.', common_1.HttpStatus.INTERNAL_SERVER_ERROR);
+        }
         const challenge = await (0, pow_js_1.createChallenge)({
-            deriveKey: this.deriveKey,
+            deriveKey,
             hmacSignatureSecret: this.hmacSignatureSecret,
             hmacKeySignatureSecret: this.hmacKeySignatureSecret,
-            ...this.createChallengeParameters(),
+            ...createChallengeParameters(),
         });
         return {
             configuration: this.setCookieOptions
@@ -92,7 +97,7 @@ let AltchaService = class AltchaService {
         return req.body?.[this.fieldName];
     }
     async verify(payload) {
-        return (0, shared_js_1.verify)(payload, this.deriveKey, this.hmacSignatureSecret, this.hmacKeySignatureSecret, this.store);
+        return (0, shared_js_1.verify)(payload, this.deriveKey, this.hmacSignatureSecret, this.hmacKeySignatureSecret, this.store, this.verifyServerOptions);
     }
 };
 exports.AltchaService = AltchaService;
@@ -116,6 +121,7 @@ let AltchaController = class AltchaController {
 exports.AltchaController = AltchaController;
 __decorate([
     (0, common_1.Get)('challenge'),
+    (0, common_1.Header)('Cache-Control', 'no-store'),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)

package/dist/cjs/v2/frameworks/nextjs.js

@@ -21,9 +21,12 @@ function deleteCookie(res, name, path) {
     res.headers.append('Set-Cookie', `${name}=; Path=${path ?? '/'}; Max-Age=0`);
 }
 function create(options) {
-    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, } = options;
+    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, verifyServer: verifyServerOptions, } = options;
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async function challengeHandler(_req) {
+        if (!deriveKey || !createChallengeParameters) {
+            throw new Error('deriveKey and createChallengeParameters are required to generate challenges. Omit challengeHandler when relying on Sentinel to issue challenges.');
+        }
         const challenge = await (0, pow_js_1.createChallenge)({
             deriveKey,
             hmacSignatureSecret,
@@ -38,12 +41,14 @@ function create(options) {
                 : undefined,
             ...challenge,
         };
-        const response = Response.json(body);
+        const response = Response.json(body, {
+            headers: { 'Cache-Control': 'no-store' },
+        });
         return response;
     }
     async function verifyHandler(req) {
         const payload = await getPayloadFromRequest(req);
-        const result = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+        const result = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
         return Response.json(result);
     }
     async function getPayloadFromRequest(req, cookieName) {
@@ -67,7 +72,7 @@ function create(options) {
     }
     async function middleware(req, throwOnFailure = true) {
         const payload = await getPayloadFromRequest(req, setCookie?.name);
-        const { error, payload: verifiedPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+        const { error, payload: verifiedPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
         const result = {
             error,
             payload: verifiedPayload,

package/dist/cjs/v2/frameworks/shared.d.ts

@@ -1,8 +1,8 @@
-import { DeriveKeyFunction, Payload, ServerSignaturePayload, VerifySolutionResult } from '../types.js';
-import type { Store } from './types.js';
+import { DeriveKeyFunction, Payload, ServerSignaturePayload, VerifyServerResult, VerifySolutionResult } from '../types.js';
+import type { AltchaVerifyServerOptions, Store } from './types.js';
 export declare function deriveHmacKeySecret(masterSecret: string): Promise<string>;
-export declare function verify(payload: unknown, deriveKey: DeriveKeyFunction, hmacSignatureSecret: string, hmacKeySignatureSecret?: string, store?: Store): Promise<{
+export declare function verify(payload: unknown, deriveKey: DeriveKeyFunction | undefined, hmacSignatureSecret: string | undefined, hmacKeySignatureSecret?: string, store?: Store, verifyServerOptions?: AltchaVerifyServerOptions): Promise<{
     error: string | null;
     payload: Payload | ServerSignaturePayload | null;
-    verification: VerifySolutionResult | null;
+    verification: VerifySolutionResult | VerifyServerResult | null;
 }>;

package/dist/cjs/v2/frameworks/shared.js

@@ -4,12 +4,13 @@ exports.deriveHmacKeySecret = deriveHmacKeySecret;
 exports.verify = verify;
 const pow_js_1 = require("../pow.js");
 const server_signature_js_1 = require("../server-signature.js");
+const verify_server_js_1 = require("../verify-server.js");
 const helpers_js_1 = require("../helpers.js");
 const types_js_1 = require("../types.js");
 async function deriveHmacKeySecret(masterSecret) {
     return (0, helpers_js_1.bufferToHex)(await (0, helpers_js_1.hmac)(types_js_1.HmacAlgorithm.SHA_256, masterSecret, 'derived-secret'));
 }
-async function verify(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store) {
+async function verify(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions) {
     if (!payload) {
         return {
             error: 'ALTCHA payload is missing.',
@@ -33,6 +34,12 @@ async function verify(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureS
     try {
         switch (type) {
             case 'client':
+                if (!deriveKey) {
+                    throw new Error('deriveKey is required to verify self-hosted ALTCHA challenges.');
+                }
+                if (!hmacSignatureSecret) {
+                    throw new Error('hmacSignatureSecret is required to verify self-hosted ALTCHA challenges.');
+                }
                 challengeId = getChallengeId(payload);
                 if (store && challengeId) {
                     await checkChallengeId(store, challengeId);
@@ -44,7 +51,18 @@ async function verify(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureS
                 if (store && challengeId) {
                     await checkChallengeId(store, challengeId);
                 }
-                verification = await verifyServerSignaturePayload(payload, hmacSignatureSecret);
+                if (verifyServerOptions) {
+                    verification = await (0, verify_server_js_1.verifyServer)({
+                        ...verifyServerOptions,
+                        payload: payload,
+                    });
+                }
+                else {
+                    if (!hmacSignatureSecret) {
+                        throw new Error('hmacSignatureSecret or verifyServer must be configured to verify this payload.');
+                    }
+                    verification = await verifyServerSignaturePayload(payload, hmacSignatureSecret);
+                }
                 break;
             default:
                 throw new Error('ALTCHA payload is invalid.');
@@ -59,7 +77,8 @@ async function verify(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureS
     }
     if (!verification?.verified) {
         return {
-            error: 'ALTCHA verification failed.',
+            error: (verification && 'reason' in verification && verification.reason) ||
+                'ALTCHA verification failed.',
             payload: payload,
             verification,
         };

package/dist/cjs/v2/frameworks/sveltekit.js

@@ -27,8 +27,11 @@ async function getPayloadFromEvent(event, fieldName, cookieName) {
     return body?.[fieldName];
 }
 function create(options) {
-    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, } = options;
+    const { createChallengeParameters, deriveKey, fieldName = 'altcha', hmacSignatureSecret, hmacKeySignatureSecret, setCookie, store, verifyServer: verifyServerOptions, } = options;
     async function challengeHandler() {
+        if (!deriveKey || !createChallengeParameters) {
+            (0, kit_1.error)(500, 'deriveKey and createChallengeParameters are required to generate challenges. Omit challengeHandler when relying on Sentinel to issue challenges.');
+        }
         const challenge = await (0, pow_js_1.createChallenge)({
             deriveKey,
             hmacSignatureSecret,
@@ -42,18 +45,18 @@ function create(options) {
                 }
                 : undefined,
             ...challenge,
-        });
+        }, { headers: { 'Cache-Control': 'no-store' } });
     }
     async function verifyHandler(event) {
         const payload = await getPayloadFromEvent(event, fieldName);
-        const result = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+        const result = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
         return (0, kit_1.json)(result);
     }
     function createHandle(middlewareOptions = {}) {
         const { throwOnFailure = true } = middlewareOptions;
         return async ({ event, resolve }) => {
             const payload = await getPayloadFromEvent(event, fieldName, setCookie?.name);
-            const { error: verifyError, payload: resultPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+            const { error: verifyError, payload: resultPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
             event.locals.altcha = {
                 error: verifyError,
                 payload: resultPayload,
@@ -72,7 +75,7 @@ function create(options) {
     }
     async function verifyEvent(event) {
         const payload = await getPayloadFromEvent(event, fieldName, setCookie?.name);
-        const { error: verifyError, payload: resultPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store);
+        const { error: verifyError, payload: resultPayload, verification, } = await (0, shared_js_1.verify)(payload, deriveKey, hmacSignatureSecret, hmacKeySignatureSecret, store, verifyServerOptions);
         if (setCookie) {
             event.cookies.delete(setCookie.name, {
                 path: setCookie.path ?? '/',

package/dist/cjs/v2/frameworks/types.d.ts

@@ -1,14 +1,19 @@
-import type { CreateChallengeOptions, DeriveKeyFunction, Payload, ServerSignaturePayload, SetCookieOptions, VerifySolutionResult } from '../types.js';
+import type { CreateChallengeOptions, DeriveKeyFunction, Payload, ServerSignaturePayload, SetCookieOptions, VerifyServerOptions, VerifyServerResult, VerifySolutionResult } from '../types.js';
+export type AltchaVerifyServerOptions = Omit<VerifyServerOptions, 'payload'>;
 export interface AltchaOptions {
     /**
      * Returns configuration options passed to `createChallenge`.
      * Must include `algorithm` and `cost`; all other `CreateChallengeOptions` fields are optional.
+     * Required to use `challengeHandler`; optional if challenges are issued by Sentinel and
+     * only `verifyServer` is used.
      */
-    createChallengeParameters: () => Pick<CreateChallengeOptions, 'algorithm' | 'cost'> & Partial<CreateChallengeOptions>;
+    createChallengeParameters?: () => Pick<CreateChallengeOptions, 'algorithm' | 'cost'> & Partial<CreateChallengeOptions>;
     /**
      * Algorithm-specific key derivation function used to generate challenge keys.
+     * Required to use `challengeHandler` or to verify self-hosted (client-type) payloads;
+     * optional if challenges are issued by Sentinel and only `verifyServer` is used.
      */
-    deriveKey: DeriveKeyFunction;
+    deriveKey?: DeriveKeyFunction;
     /**
      * Name of the form field that carries the ALTCHA payload.
      * Defaults to `'altcha'` if not specified.
@@ -16,8 +21,10 @@ export interface AltchaOptions {
     fieldName?: string;
     /**
      * HMAC secret used to sign and verify challenge signatures.
+     * Optional if `verifyServer` is configured and only Sentinel-issued (server-signed)
+     * payloads are verified remotely.
      */
-    hmacSignatureSecret: string;
+    hmacSignatureSecret?: string;
     /**
      * HMAC secret used to sign keys in deterministic mode.
      */
@@ -31,6 +38,11 @@ export interface AltchaOptions {
      * Store implementation for tracking used challenges and preventing replay attacks.
      */
     store?: Store;
+    /**
+     * When set, Sentinel-issued (server-signed) payloads are verified remotely via
+     * `POST /v1/verify/signature` instead of locally with `hmacSignatureSecret`.
+     */
+    verifyServer?: AltchaVerifyServerOptions;
 }
 export interface AltchaMiddlewareOptions {
     throwOnFailure?: boolean;
@@ -38,7 +50,7 @@ export interface AltchaMiddlewareOptions {
 export interface AltchaResult {
     error: string | null;
     payload: Payload | ServerSignaturePayload | null;
-    verification: VerifySolutionResult | null;
+    verification: VerifySolutionResult | VerifyServerResult | null;
 }
 export type RequireField<T, K extends keyof T> = Omit<T, K> & Required<Pick<T, K>>;
 export interface Store {

package/dist/cjs/v2/helpers.d.ts

@@ -17,8 +17,6 @@ export declare function delay(ms: number): Promise<void>;
 export declare function hash(algorithm: string, data: ArrayBuffer | string): Promise<Uint8Array>;
 /** Computes an HMAC signature using the Web Crypto API. */
 export declare function hmac(algorithm: HmacAlgorithm, data: string | Uint8Array, keyStr: string): Promise<Uint8Array>;
-/** Inject CSS tag into the document */
-export declare function injectCss(css: string, id?: string): void;
 /** Generates a random integer between the specified minimum and maximum values (inclusive). */
 export declare function randomInt(max: number, min?: number): number;
 /** Recursively sorts object keys alphabetically for deterministic serialization. */

package/dist/cjs/v2/helpers.js

@@ -9,7 +9,6 @@ exports.constantTimeEqual = constantTimeEqual;
 exports.delay = delay;
 exports.hash = hash;
 exports.hmac = hmac;
-exports.injectCss = injectCss;
 exports.randomInt = randomInt;
 exports.sortKeys = sortKeys;
 exports.timeDuration = timeDuration;
@@ -88,17 +87,6 @@ async function hmac(algorithm, data, keyStr) {
         : data);
     return new Uint8Array(signature);
 }
-/** Inject CSS tag into the document */
-function injectCss(css, id = 'altcha-css') {
-    if (typeof document !== 'undefined' &&
-        document &&
-        !document.getElementById(id)) {
-        const style = document.createElement('style');
-        style.id = id;
-        style.textContent = css;
-        document.head.appendChild(style);
-    }
-}
 /** Generates a random integer between the specified minimum and maximum values (inclusive). */
 function randomInt(max, min = 1) {
     const ab = new Uint32Array(1);

package/dist/cjs/v2/index.d.ts

@@ -1,10 +1,11 @@
 import { createChallenge, solveChallenge, solveChallengeWorkers, verifySolution } from './pow.js';
 import { verifyFieldsHash, verifyServerSignature } from './server-signature.js';
+import { verifyServer } from './verify-server.js';
 import { CappedMap } from './capped-map.js';
 import { randomInt } from './helpers.js';
 import { HmacAlgorithm } from './types.js';
 export type * from './types.js';
-export { CappedMap, HmacAlgorithm, createChallenge, randomInt, solveChallenge, solveChallengeWorkers, verifyFieldsHash, verifyServerSignature, verifySolution, };
+export { CappedMap, HmacAlgorithm, createChallenge, randomInt, solveChallenge, solveChallengeWorkers, verifyFieldsHash, verifyServer, verifyServerSignature, verifySolution, };
 declare const _default: {
     CappedMap: typeof CappedMap;
     HmacAlgorithm: typeof HmacAlgorithm;
@@ -13,6 +14,7 @@ declare const _default: {
     solveChallenge: typeof solveChallenge;
     solveChallengeWorkers: typeof solveChallengeWorkers;
     verifyFieldsHash: typeof verifyFieldsHash;
+    verifyServer: typeof verifyServer;
     verifyServerSignature: typeof verifyServerSignature;
     verifySolution: typeof verifySolution;
 };

package/dist/cjs/v2/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifySolution = exports.verifyServerSignature = exports.verifyFieldsHash = exports.solveChallengeWorkers = exports.solveChallenge = exports.randomInt = exports.createChallenge = exports.HmacAlgorithm = exports.CappedMap = void 0;
+exports.verifySolution = exports.verifyServerSignature = exports.verifyServer = exports.verifyFieldsHash = exports.solveChallengeWorkers = exports.solveChallenge = exports.randomInt = exports.createChallenge = exports.HmacAlgorithm = exports.CappedMap = void 0;
 const pow_js_1 = require("./pow.js");
 Object.defineProperty(exports, "createChallenge", { enumerable: true, get: function () { return pow_js_1.createChallenge; } });
 Object.defineProperty(exports, "solveChallenge", { enumerable: true, get: function () { return pow_js_1.solveChallenge; } });
@@ -9,6 +9,8 @@ Object.defineProperty(exports, "verifySolution", { enumerable: true, get: functi
 const server_signature_js_1 = require("./server-signature.js");
 Object.defineProperty(exports, "verifyFieldsHash", { enumerable: true, get: function () { return server_signature_js_1.verifyFieldsHash; } });
 Object.defineProperty(exports, "verifyServerSignature", { enumerable: true, get: function () { return server_signature_js_1.verifyServerSignature; } });
+const verify_server_js_1 = require("./verify-server.js");
+Object.defineProperty(exports, "verifyServer", { enumerable: true, get: function () { return verify_server_js_1.verifyServer; } });
 const capped_map_js_1 = require("./capped-map.js");
 Object.defineProperty(exports, "CappedMap", { enumerable: true, get: function () { return capped_map_js_1.CappedMap; } });
 const helpers_js_1 = require("./helpers.js");
@@ -23,6 +25,7 @@ exports.default = {
     solveChallenge: pow_js_1.solveChallenge,
     solveChallengeWorkers: pow_js_1.solveChallengeWorkers,
     verifyFieldsHash: server_signature_js_1.verifyFieldsHash,
+    verifyServer: verify_server_js_1.verifyServer,
     verifyServerSignature: server_signature_js_1.verifyServerSignature,
     verifySolution: pow_js_1.verifySolution,
 };