altcha 3.0.0-beta.3 → 3.0.0-beta.4

package/dist/plugins/obfuscation.plugin.js

@@ -1,3 +1,111 @@
+const noop = () => {
+};
+function safe_not_equal(a, b) {
+  return a != a ? b == b : a !== b || a !== null && typeof a === "object" || typeof a === "function";
+}
+function subscribe_to_store(store2, run, invalidate) {
+  if (store2 == null) {
+    run(void 0);
+    return noop;
+  }
+  const unsub = untrack(
+    () => store2.subscribe(
+      run,
+      // @ts-expect-error
+      invalidate
+    )
+  );
+  return unsub.unsubscribe ? () => unsub.unsubscribe() : unsub;
+}
+const subscriber_queue = [];
+function writable(value, start = noop) {
+  let stop = null;
+  const subscribers = /* @__PURE__ */ new Set();
+  function set(new_value) {
+    if (safe_not_equal(value, new_value)) {
+      value = new_value;
+      if (stop) {
+        const run_queue = !subscriber_queue.length;
+        for (const subscriber of subscribers) {
+          subscriber[1]();
+          subscriber_queue.push(subscriber, value);
+        }
+        if (run_queue) {
+          for (let i = 0; i < subscriber_queue.length; i += 2) {
+            subscriber_queue[i][0](subscriber_queue[i + 1]);
+          }
+          subscriber_queue.length = 0;
+        }
+      }
+    }
+  }
+  function update(fn) {
+    set(fn(
+      /** @type {T} */
+      value
+    ));
+  }
+  function subscribe(run, invalidate = noop) {
+    const subscriber = [run, invalidate];
+    subscribers.add(subscriber);
+    if (subscribers.size === 1) {
+      stop = start(set, update) || noop;
+    }
+    run(
+      /** @type {T} */
+      value
+    );
+    return () => {
+      subscribers.delete(subscriber);
+      if (subscribers.size === 0 && stop) {
+        stop();
+        stop = null;
+      }
+    };
+  }
+  return { set, update, subscribe };
+}
+function get(store2) {
+  let value;
+  subscribe_to_store(store2, (_) => value = _)();
+  return value;
+}
+let untracking = false;
+function untrack(fn) {
+  var previous_untracking = untracking;
+  try {
+    untracking = true;
+    return fn();
+  } finally {
+    untracking = previous_untracking;
+  }
+}
+function store(defaultValue) {
+  const scope = {
+    get: (name) => {
+      return get(scope.store)[name];
+    },
+    set: (name, value) => {
+      if (typeof name === "string") {
+        Object.assign(get(scope.store), {
+          [name]: value
+        });
+      } else {
+        Object.assign(get(scope.store), name);
+      }
+      scope.store.set(get(scope.store));
+    },
+    store: writable(defaultValue)
+  };
+  return scope;
+}
+globalThis.$altcha = globalThis.$altcha || {
+  algorithms: /* @__PURE__ */ new Map(),
+  defaults: store({}),
+  i18n: store({}),
+  instances: /* @__PURE__ */ new Set(),
+  plugins: /* @__PURE__ */ new Set()
+};
 class BasePlugin {
   constructor(host) {
     this.host = host;
@@ -86,9 +194,45 @@ function hexToBuffer(hex) {
 async function delay(ms) {
   await new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function hmac(algorithm, data, keyStr) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(keyStr),
+    {
+      name: "HMAC",
+      hash: { name: algorithm }
+    },
+    false,
+    ["sign", "verify"]
+  );
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    typeof data === "string" ? new TextEncoder().encode(data) : data
+  );
+  return new Uint8Array(signature);
+}
+function sortKeys(obj) {
+  if (typeof obj !== "object" || obj === null || Array.isArray(obj)) {
+    return obj;
+  }
+  return Object.keys(obj).sort().reduce((acc, key) => {
+    const value = obj[key];
+    if (value !== void 0) {
+      acc[key] = sortKeys(value);
+    }
+    return acc;
+  }, {});
+}
 function timeDuration(start) {
   return Math.floor((performance.now() - start) * 10) / 10;
 }
+var HmacAlgorithm = /* @__PURE__ */ ((HmacAlgorithm2) => {
+  HmacAlgorithm2["SHA_256"] = "SHA-256";
+  HmacAlgorithm2["SHA_384"] = "SHA-384";
+  HmacAlgorithm2["SHA_512"] = "SHA-512";
+  return HmacAlgorithm2;
+})(HmacAlgorithm || {});
 var State = /* @__PURE__ */ ((State2) => {
   State2["CODE"] = "code";
   State2["ERROR"] = "error";
@@ -123,6 +267,62 @@ class PasswordBuffer {
     return this.buffer;
   }
 }
+async function createChallenge(options) {
+  const {
+    algorithm,
+    counter,
+    counterMode = "uint32",
+    cost,
+    deriveKey: deriveKey2,
+    data,
+    expiresAt,
+    hmacAlgorithm = HmacAlgorithm.SHA_256,
+    hmacKeySignatureSecret,
+    hmacSignatureSecret,
+    keyLength = 32,
+    keyPrefix = "00",
+    keyPrefixLength = keyLength / 2,
+    memoryCost,
+    parallelism
+  } = options;
+  const parameters = {
+    algorithm,
+    nonce: bufferToHex(crypto.getRandomValues(new Uint8Array(16))),
+    salt: bufferToHex(crypto.getRandomValues(new Uint8Array(16))),
+    cost,
+    keyLength,
+    memoryCost,
+    parallelism,
+    keyPrefix,
+    expiresAt: expiresAt instanceof Date ? Math.floor(expiresAt.getTime() / 1e3) : expiresAt,
+    data
+  };
+  let deriveKeyResult = null;
+  if (counter !== void 0) {
+    const nonceBuf = hexToBuffer(parameters.nonce);
+    deriveKeyResult = await deriveKey2(
+      parameters,
+      hexToBuffer(parameters.salt),
+      new PasswordBuffer(nonceBuf, counterMode).setCounter(counter)
+    );
+    if (deriveKeyResult.parameters) {
+      Object.assign(parameters, deriveKeyResult.parameters);
+    }
+    parameters.keyPrefix = bufferToHex(deriveKeyResult.derivedKey.slice(0, keyPrefixLength));
+  }
+  if (!hmacSignatureSecret) {
+    return {
+      parameters: sortKeys(parameters)
+    };
+  }
+  return signChallenge(
+    hmacAlgorithm,
+    parameters,
+    deriveKeyResult?.derivedKey,
+    hmacSignatureSecret,
+    hmacKeySignatureSecret
+  );
+}
 async function solveChallenge(options) {
   const {
     challenge,
@@ -248,6 +448,18 @@ async function solveChallengeWorkers(options) {
   }
   return solution || null;
 }
+async function signChallenge(algorithm, parameters, derivedKey, hmacSignatureSecret, hmacKeySignatureSecret) {
+  if (derivedKey && hmacKeySignatureSecret) {
+    parameters.keySignature = bufferToHex(
+      await hmac(algorithm, derivedKey, hmacKeySignatureSecret)
+    );
+  }
+  parameters = sortKeys(parameters);
+  return {
+    parameters,
+    signature: bufferToHex(await hmac(algorithm, JSON.stringify(parameters), hmacSignatureSecret))
+  };
+}
 async function deobfuscate(obfuscatedData, options = {}) {
   let {
     concurrency = Math.max(1, Math.min(4, navigator.hardwareConcurrency)),
@@ -300,7 +512,48 @@ async function deobfuscate(obfuscatedData, options = {}) {
   );
   return new TextDecoder().decode(result);
 }
+async function obfuscate(str, options = {}) {
+  const { deriveKey: deriveKey$1 = deriveKey } = options;
+  const counterMin = options?.counterMin || 20;
+  const counterMax = options?.counterMax || 200;
+  const { parameters } = await createChallenge({
+    algorithm: "PBKDF2/SHA-256",
+    cost: 5e3,
+    deriveKey: deriveKey$1,
+    counter: Math.floor(Math.random() * (counterMax - counterMin + 1)) + counterMin,
+    keyPrefixLength: 32,
+    ...options
+  });
+  const key = await crypto.subtle.importKey(
+    "raw",
+    hexToBuffer(parameters.keyPrefix),
+    { name: "AES-GCM" },
+    false,
+    ["encrypt"]
+  );
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const data = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    new TextEncoder().encode(str)
+  );
+  return btoa(
+    JSON.stringify({
+      parameters: {
+        ...parameters,
+        // Return only half the derived key
+        keyPrefix: parameters.keyPrefix.slice(0, parameters.keyLength || 32)
+      },
+      cipher: {
+        iv: bufferToHex(iv),
+        data: bufferToHex(data)
+      }
+    })
+  );
+}
 class ObfuscationPlugin extends BasePlugin {
+  static deobfuscate = deobfuscate;
+  static obfuscate = obfuscate;
   elTrigger = null;
   activate() {
     this.elTrigger = this.host.querySelector("button");

package/dist/plugins/obfuscation.plugin.min.js

@@ -1 +1 @@
-class e{constructor(e){this.host=e}static register(e){"$altcha"in globalThis&&!globalThis.$altcha.plugins.has(e)&&globalThis.$altcha.plugins.add(e)}async onFetchChallenge(e){}async onRequestServerVerification(e,t){}async onVerify(e){}}function t(e){switch(e){case"PBKDF2/SHA-512":return"SHA-512";case"PBKDF2/SHA-384":return"SHA-384";default:return"SHA-256"}}async function r(e,r,n){const{algorithm:a,cost:o,keyLength:i=32}=e,s=await crypto.subtle.importKey("raw",n,{name:"PBKDF2"},!1,["deriveKey"]),c=await crypto.subtle.deriveKey({name:"PBKDF2",salt:r,iterations:o,hash:t(a)},s,{name:"AES-GCM",length:8*i},!0,["encrypt"]);return{derivedKey:new Uint8Array(await crypto.subtle.exportKey("raw",c))}}function n(e,t){if(t.length>e.length)return!1;for(let r=0;r<t.length;r++)if(e[r]!==t[r])return!1;return!0}function a(e){return Array.from(new Uint8Array(e)).map(e=>e.toString(16).padStart(2,"0")).join("")}function o(e){if(e.length%2!=0)throw new Error(`Hex string must have an even length. Got: ${e}`);const t=new ArrayBuffer(e.length/2),r=new DataView(t);for(let t=0;t<e.length;t+=2){const n=e.substring(t,t+2),a=parseInt(n,16);r.setUint8(t/2,a)}return new Uint8Array(t)}async function i(e){await new Promise(t=>setTimeout(t,e))}function s(e){return Math.floor(10*(performance.now()-e))/10}var c=(e=>(e.CODE="code",e.ERROR="error",e.VERIFIED="verified",e.VERIFYING="verifying",e.UNVERIFIED="unverified",e.EXPIRED="expired",e))(c||{});class l{constructor(e,t="uint32"){this.nonce=e,this.mode=t,this.buffer=new Uint8Array(this.nonce.length+this.COUNTER_BYTES),this.buffer.set(this.nonce,0),this.dataView=new DataView(this.buffer.buffer)}COUNTER_BYTES=4;buffer;dataView;encoder=new TextEncoder;setCounter(e){return"string"===this.mode?function(e,t){const r=new Uint8Array(e.length+t.length);return r.set(e,0),r.set(t,e.length),r}(this.nonce,this.encoder.encode(e.toString())):(this.dataView.setUint32(this.nonce.length,e,!1),this.buffer)}}async function h(e){const{challenge:t,concurrency:r=navigator.hardwareConcurrency,controller:n=new AbortController,createWorker:a,onOutOfMemory:o=e=>e>1?Math.floor(e/2):0,counterMode:i,timeout:s=9e4}=e,c=Math.min(16,Math.max(1,r)),l=[],u=()=>{for(const e of l)e.terminate()};for(let e=0;e<c;e++)l.push(await a(t.parameters.algorithm));let f=null;try{f=await Promise.race(l.map((e,r)=>(n.signal.addEventListener("abort",()=>{e.postMessage({type:"abort"})}),new Promise((n,a)=>{e.addEventListener("error",e=>{a(e)}),e.addEventListener("message",t=>{if(t.data){for(const t of l)t!==e&&t.postMessage({type:"abort"});if(t.data.error)return a(new Error(t.data.error))}n(t.data)}),e.postMessage({challenge:t,counterMode:i,counterStart:r,counterStep:c,timeout:s,type:"work"})}))))}catch(r){if(r instanceof Error&&!!r?.message?.includes("Out of memory")&&o){u();const r=o(c);if(r)return h({...e,challenge:t,controller:n,concurrency:r,createWorker:a})}throw r}finally{u()}return n.signal.aborted?null:f||null}async function u(e,t={}){let{concurrency:c=Math.max(1,Math.min(4,navigator.hardwareConcurrency)),createWorker:u,deriveKey:f=r}=t,g=null;try{g=JSON.parse(atob(e))}catch{throw new Error("Unable to parse obfuscated data.")}if(!g||"object"!=typeof g||!("parameters"in g)||!("cipher"in g))throw new Error("Invalid obfuscated data format.");const d=g.cipher;let w=null;if(!u&&"$altcha"in globalThis&&(u=globalThis.$altcha.algorithms.get(g.parameters.algorithm)),w=u?await h({challenge:g,concurrency:c,createWorker:u}):await async function(e){const{challenge:t,controller:r,counterMode:c="uint32",counterStart:h=0,counterStep:u=1,deriveKey:f,timeout:g=9e4}=e,{nonce:d,keyPrefix:w,salt:y}=t.parameters,m=o(d),p=o(y),b=w.length%2==0?o(w):null,E=new l(m,c),v=performance.now();let T=h,S="",A=v;for(;;){if(r?.signal.aborted||g&&T%10==0&&performance.now()-v>g)return null;const{derivedKey:e}=await f(t.parameters,p,E.setCounter(T));if(T%10==0&&performance.now()-A>200&&(await i(0),A=performance.now()),b?n(e,b):a(e).startsWith(w)){S=a(e);break}T+=u}return{counter:T,derivedKey:S,time:s(v)}}({challenge:g,deriveKey:f}),!w)throw new Error("Unable to find solution.");const y=await crypto.subtle.importKey("raw",o(w.derivedKey),{name:"AES-GCM"},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:o(d.iv)},y,o(d.data));return(new TextDecoder).decode(m)}e.register(class extends e{elTrigger=null;activate(){this.elTrigger=this.host.querySelector("button"),this.elTrigger&&(this.elTrigger.addEventListener("click",this.onTriggerClick.bind(this)),this.host.configure({floatingAnchor:this.elTrigger}))}destroy(){}async onVerify(e){const{minDuration:t=500}=e,r=performance.now(),n=this.host.getAttribute("data-obfuscated");if(n){this.host.reset(c.VERIFYING);try{const e=await u(n);await this.#e(Math.max(0,t-(performance.now()-r))),this.#t(e)}catch(e){this.host.setState(c.ERROR,String(e))}finally{this.host.setState(c.VERIFIED)}return null}}onTriggerClick(e){e.preventDefault(),this.host.show(),this.host.verify().then(()=>{this.host.hide()})}#t(e){let t;if(e.match(/^(mailto|tel|sms|https?):/)){const[r]=e.slice(e.indexOf(":")+1).replace(/^\/\//,"").split("?");t=document.createElement("a"),t.href=e,t.innerText=r}else t=document.createTextNode(e);this.elTrigger&&t&&(this.elTrigger.after(t),this.elTrigger.parentElement?.removeChild(this.elTrigger))}async#e(e){await new Promise(t=>setTimeout(t,e))}});
+const e=()=>{};function t(t,r,n){if(null==t)return r(void 0),e;const a=function(e){var t=o;try{return o=!0,e()}finally{o=t}}(()=>t.subscribe(r,n));return a.unsubscribe?()=>a.unsubscribe():a}const r=[];function n(t,n=e){let a=null;const o=new Set;function i(e){if(i=e,((n=t)!=n?i==i:n!==i||null!==n&&"object"==typeof n||"function"==typeof n)&&(t=e,a)){const e=!r.length;for(const e of o)e[1](),r.push(e,t);if(e){for(let e=0;e<r.length;e+=2)r[e][0](r[e+1]);r.length=0}}var n,i}function s(e){i(e(t))}return{set:i,update:s,subscribe:function(r,c=e){const l=[r,c];return o.add(l),1===o.size&&(a=n(i,s)||e),r(t),()=>{o.delete(l),0===o.size&&a&&(a(),a=null)}}}}function a(e){let r;return t(e,e=>r=e)(),r}let o=!1;function i(e){const t={get:e=>a(t.store)[e],set:(e,r)=>{"string"==typeof e?Object.assign(a(t.store),{[e]:r}):Object.assign(a(t.store),e),t.store.set(a(t.store))},store:n(e)};return t}globalThis.$altcha=globalThis.$altcha||{algorithms:new Map,defaults:i({}),i18n:i({}),instances:new Set,plugins:new Set};class s{constructor(e){this.host=e}static register(e){"$altcha"in globalThis&&!globalThis.$altcha.plugins.has(e)&&globalThis.$altcha.plugins.add(e)}async onFetchChallenge(e){}async onRequestServerVerification(e,t){}async onVerify(e){}}function c(e){switch(e){case"PBKDF2/SHA-512":return"SHA-512";case"PBKDF2/SHA-384":return"SHA-384";default:return"SHA-256"}}async function l(e,t,r){const{algorithm:n,cost:a,keyLength:o=32}=e,i=await crypto.subtle.importKey("raw",r,{name:"PBKDF2"},!1,["deriveKey"]),s=await crypto.subtle.deriveKey({name:"PBKDF2",salt:t,iterations:a,hash:c(n)},i,{name:"AES-GCM",length:8*o},!0,["encrypt"]);return{derivedKey:new Uint8Array(await crypto.subtle.exportKey("raw",s))}}function u(e,t){if(t.length>e.length)return!1;for(let r=0;r<t.length;r++)if(e[r]!==t[r])return!1;return!0}function h(e){return Array.from(new Uint8Array(e)).map(e=>e.toString(16).padStart(2,"0")).join("")}function f(e){if(e.length%2!=0)throw new Error(`Hex string must have an even length. Got: ${e}`);const t=new ArrayBuffer(e.length/2),r=new DataView(t);for(let t=0;t<e.length;t+=2){const n=e.substring(t,t+2),a=parseInt(n,16);r.setUint8(t/2,a)}return new Uint8Array(t)}async function y(e){await new Promise(t=>setTimeout(t,e))}async function g(e,t,r){const n=await crypto.subtle.importKey("raw",(new TextEncoder).encode(r),{name:"HMAC",hash:{name:e}},!1,["sign","verify"]),a=await crypto.subtle.sign("HMAC",n,"string"==typeof t?(new TextEncoder).encode(t):t);return new Uint8Array(a)}function d(e){return"object"!=typeof e||null===e||Array.isArray(e)?e:Object.keys(e).sort().reduce((t,r)=>{const n=e[r];return void 0!==n&&(t[r]=d(n)),t},{})}function m(e){return Math.floor(10*(performance.now()-e))/10}var w=(e=>(e.SHA_256="SHA-256",e.SHA_384="SHA-384",e.SHA_512="SHA-512",e))(w||{}),p=(e=>(e.CODE="code",e.ERROR="error",e.VERIFIED="verified",e.VERIFYING="verifying",e.UNVERIFIED="unverified",e.EXPIRED="expired",e))(p||{});class b{constructor(e,t="uint32"){this.nonce=e,this.mode=t,this.buffer=new Uint8Array(this.nonce.length+this.COUNTER_BYTES),this.buffer.set(this.nonce,0),this.dataView=new DataView(this.buffer.buffer)}COUNTER_BYTES=4;buffer;dataView;encoder=new TextEncoder;setCounter(e){return"string"===this.mode?function(e,t){const r=new Uint8Array(e.length+t.length);return r.set(e,0),r.set(t,e.length),r}(this.nonce,this.encoder.encode(e.toString())):(this.dataView.setUint32(this.nonce.length,e,!1),this.buffer)}}async function S(e){const{algorithm:t,counter:r,counterMode:n="uint32",cost:a,deriveKey:o,data:i,expiresAt:s,hmacAlgorithm:c=w.SHA_256,hmacKeySignatureSecret:l,hmacSignatureSecret:u,keyLength:y=32,keyPrefix:m="00",keyPrefixLength:p=y/2,memoryCost:S,parallelism:v}=e,A={algorithm:t,nonce:h(crypto.getRandomValues(new Uint8Array(16))),salt:h(crypto.getRandomValues(new Uint8Array(16))),cost:a,keyLength:y,memoryCost:S,parallelism:v,keyPrefix:m,expiresAt:s instanceof Date?Math.floor(s.getTime()/1e3):s,data:i};let E=null;if(void 0!==r){const e=f(A.nonce);E=await o(A,f(A.salt),new b(e,n).setCounter(r)),E.parameters&&Object.assign(A,E.parameters),A.keyPrefix=h(E.derivedKey.slice(0,p))}return u?async function(e,t,r,n,a){r&&a&&(t.keySignature=h(await g(e,r,a)));return t=d(t),{parameters:t,signature:h(await g(e,JSON.stringify(t),n))}}(c,A,E?.derivedKey,u,l):{parameters:d(A)}}async function v(e){const{challenge:t,concurrency:r=navigator.hardwareConcurrency,controller:n=new AbortController,createWorker:a,onOutOfMemory:o=e=>e>1?Math.floor(e/2):0,counterMode:i,timeout:s=9e4}=e,c=Math.min(16,Math.max(1,r)),l=[],u=()=>{for(const e of l)e.terminate()};for(let e=0;e<c;e++)l.push(await a(t.parameters.algorithm));let h=null;try{h=await Promise.race(l.map((e,r)=>(n.signal.addEventListener("abort",()=>{e.postMessage({type:"abort"})}),new Promise((n,a)=>{e.addEventListener("error",e=>{a(e)}),e.addEventListener("message",t=>{if(t.data){for(const t of l)t!==e&&t.postMessage({type:"abort"});if(t.data.error)return a(new Error(t.data.error))}n(t.data)}),e.postMessage({challenge:t,counterMode:i,counterStart:r,counterStep:c,timeout:s,type:"work"})}))))}catch(r){if(r instanceof Error&&!!r?.message?.includes("Out of memory")&&o){u();const r=o(c);if(r)return v({...e,challenge:t,controller:n,concurrency:r,createWorker:a})}throw r}finally{u()}return n.signal.aborted?null:h||null}async function A(e,t={}){let{concurrency:r=Math.max(1,Math.min(4,navigator.hardwareConcurrency)),createWorker:n,deriveKey:a=l}=t,o=null;try{o=JSON.parse(atob(e))}catch{throw new Error("Unable to parse obfuscated data.")}if(!o||"object"!=typeof o||!("parameters"in o)||!("cipher"in o))throw new Error("Invalid obfuscated data format.");const i=o.cipher;let s=null;if(!n&&"$altcha"in globalThis&&(n=globalThis.$altcha.algorithms.get(o.parameters.algorithm)),s=n?await v({challenge:o,concurrency:r,createWorker:n}):await async function(e){const{challenge:t,controller:r,counterMode:n="uint32",counterStart:a=0,counterStep:o=1,deriveKey:i,timeout:s=9e4}=e,{nonce:c,keyPrefix:l,salt:g}=t.parameters,d=f(c),w=f(g),p=l.length%2==0?f(l):null,S=new b(d,n),v=performance.now();let A=a,E="",T=v;for(;;){if(r?.signal.aborted||s&&A%10==0&&performance.now()-v>s)return null;const{derivedKey:e}=await i(t.parameters,w,S.setCounter(A));if(A%10==0&&performance.now()-T>200&&(await y(0),T=performance.now()),p?u(e,p):h(e).startsWith(l)){E=h(e);break}A+=o}return{counter:A,derivedKey:E,time:m(v)}}({challenge:o,deriveKey:a}),!s)throw new Error("Unable to find solution.");const c=await crypto.subtle.importKey("raw",f(s.derivedKey),{name:"AES-GCM"},!1,["decrypt"]),g=await crypto.subtle.decrypt({name:"AES-GCM",iv:f(i.iv)},c,f(i.data));return(new TextDecoder).decode(g)}async function E(e,t={}){const{deriveKey:r=l}=t,n=t?.counterMin||20,a=t?.counterMax||200,{parameters:o}=await S({algorithm:"PBKDF2/SHA-256",cost:5e3,deriveKey:r,counter:Math.floor(Math.random()*(a-n+1))+n,keyPrefixLength:32,...t}),i=await crypto.subtle.importKey("raw",f(o.keyPrefix),{name:"AES-GCM"},!1,["encrypt"]),s=crypto.getRandomValues(new Uint8Array(12)),c=await crypto.subtle.encrypt({name:"AES-GCM",iv:s},i,(new TextEncoder).encode(e));return btoa(JSON.stringify({parameters:{...o,keyPrefix:o.keyPrefix.slice(0,o.keyLength||32)},cipher:{iv:h(s),data:h(c)}}))}s.register(class extends s{static deobfuscate=A;static obfuscate=E;elTrigger=null;activate(){this.elTrigger=this.host.querySelector("button"),this.elTrigger&&(this.elTrigger.addEventListener("click",this.onTriggerClick.bind(this)),this.host.configure({floatingAnchor:this.elTrigger}))}destroy(){}async onVerify(e){const{minDuration:t=500}=e,r=performance.now(),n=this.host.getAttribute("data-obfuscated");if(n){this.host.reset(p.VERIFYING);try{const e=await A(n);await this.#e(Math.max(0,t-(performance.now()-r))),this.#t(e)}catch(e){this.host.setState(p.ERROR,String(e))}finally{this.host.setState(p.VERIFIED)}return null}}onTriggerClick(e){e.preventDefault(),this.host.show(),this.host.verify().then(()=>{this.host.hide()})}#t(e){let t;if(e.match(/^(mailto|tel|sms|https?):/)){const[r]=e.slice(e.indexOf(":")+1).replace(/^\/\//,"").split("?");t=document.createElement("a"),t.href=e,t.innerText=r}else t=document.createTextNode(e);this.elTrigger&&t&&(this.elTrigger.after(t),this.elTrigger.parentElement?.removeChild(this.elTrigger))}async#e(e){await new Promise(t=>setTimeout(t,e))}});

package/dist/plugins/obfuscation.plugin.umd.cjs

@@ -2,6 +2,114 @@
   typeof define === "function" && define.amd ? define(factory) : factory();
 })((function() {
   "use strict";
+  const noop = () => {
+  };
+  function safe_not_equal(a, b) {
+    return a != a ? b == b : a !== b || a !== null && typeof a === "object" || typeof a === "function";
+  }
+  function subscribe_to_store(store2, run, invalidate) {
+    if (store2 == null) {
+      run(void 0);
+      return noop;
+    }
+    const unsub = untrack(
+      () => store2.subscribe(
+        run,
+        // @ts-expect-error
+        invalidate
+      )
+    );
+    return unsub.unsubscribe ? () => unsub.unsubscribe() : unsub;
+  }
+  const subscriber_queue = [];
+  function writable(value, start = noop) {
+    let stop = null;
+    const subscribers = /* @__PURE__ */ new Set();
+    function set(new_value) {
+      if (safe_not_equal(value, new_value)) {
+        value = new_value;
+        if (stop) {
+          const run_queue = !subscriber_queue.length;
+          for (const subscriber of subscribers) {
+            subscriber[1]();
+            subscriber_queue.push(subscriber, value);
+          }
+          if (run_queue) {
+            for (let i = 0; i < subscriber_queue.length; i += 2) {
+              subscriber_queue[i][0](subscriber_queue[i + 1]);
+            }
+            subscriber_queue.length = 0;
+          }
+        }
+      }
+    }
+    function update(fn) {
+      set(fn(
+        /** @type {T} */
+        value
+      ));
+    }
+    function subscribe(run, invalidate = noop) {
+      const subscriber = [run, invalidate];
+      subscribers.add(subscriber);
+      if (subscribers.size === 1) {
+        stop = start(set, update) || noop;
+      }
+      run(
+        /** @type {T} */
+        value
+      );
+      return () => {
+        subscribers.delete(subscriber);
+        if (subscribers.size === 0 && stop) {
+          stop();
+          stop = null;
+        }
+      };
+    }
+    return { set, update, subscribe };
+  }
+  function get(store2) {
+    let value;
+    subscribe_to_store(store2, (_) => value = _)();
+    return value;
+  }
+  let untracking = false;
+  function untrack(fn) {
+    var previous_untracking = untracking;
+    try {
+      untracking = true;
+      return fn();
+    } finally {
+      untracking = previous_untracking;
+    }
+  }
+  function store(defaultValue) {
+    const scope = {
+      get: (name) => {
+        return get(scope.store)[name];
+      },
+      set: (name, value) => {
+        if (typeof name === "string") {
+          Object.assign(get(scope.store), {
+            [name]: value
+          });
+        } else {
+          Object.assign(get(scope.store), name);
+        }
+        scope.store.set(get(scope.store));
+      },
+      store: writable(defaultValue)
+    };
+    return scope;
+  }
+  globalThis.$altcha = globalThis.$altcha || {
+    algorithms: /* @__PURE__ */ new Map(),
+    defaults: store({}),
+    i18n: store({}),
+    instances: /* @__PURE__ */ new Set(),
+    plugins: /* @__PURE__ */ new Set()
+  };
   class BasePlugin {
     constructor(host) {
       this.host = host;
@@ -90,9 +198,45 @@
   async function delay(ms) {
     await new Promise((resolve) => setTimeout(resolve, ms));
   }
+  async function hmac(algorithm, data, keyStr) {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      new TextEncoder().encode(keyStr),
+      {
+        name: "HMAC",
+        hash: { name: algorithm }
+      },
+      false,
+      ["sign", "verify"]
+    );
+    const signature = await crypto.subtle.sign(
+      "HMAC",
+      key,
+      typeof data === "string" ? new TextEncoder().encode(data) : data
+    );
+    return new Uint8Array(signature);
+  }
+  function sortKeys(obj) {
+    if (typeof obj !== "object" || obj === null || Array.isArray(obj)) {
+      return obj;
+    }
+    return Object.keys(obj).sort().reduce((acc, key) => {
+      const value = obj[key];
+      if (value !== void 0) {
+        acc[key] = sortKeys(value);
+      }
+      return acc;
+    }, {});
+  }
   function timeDuration(start) {
     return Math.floor((performance.now() - start) * 10) / 10;
   }
+  var HmacAlgorithm = /* @__PURE__ */ ((HmacAlgorithm2) => {
+    HmacAlgorithm2["SHA_256"] = "SHA-256";
+    HmacAlgorithm2["SHA_384"] = "SHA-384";
+    HmacAlgorithm2["SHA_512"] = "SHA-512";
+    return HmacAlgorithm2;
+  })(HmacAlgorithm || {});
   var State = /* @__PURE__ */ ((State2) => {
     State2["CODE"] = "code";
     State2["ERROR"] = "error";
@@ -127,6 +271,62 @@
       return this.buffer;
     }
   }
+  async function createChallenge(options) {
+    const {
+      algorithm,
+      counter,
+      counterMode = "uint32",
+      cost,
+      deriveKey: deriveKey2,
+      data,
+      expiresAt,
+      hmacAlgorithm = HmacAlgorithm.SHA_256,
+      hmacKeySignatureSecret,
+      hmacSignatureSecret,
+      keyLength = 32,
+      keyPrefix = "00",
+      keyPrefixLength = keyLength / 2,
+      memoryCost,
+      parallelism
+    } = options;
+    const parameters = {
+      algorithm,
+      nonce: bufferToHex(crypto.getRandomValues(new Uint8Array(16))),
+      salt: bufferToHex(crypto.getRandomValues(new Uint8Array(16))),
+      cost,
+      keyLength,
+      memoryCost,
+      parallelism,
+      keyPrefix,
+      expiresAt: expiresAt instanceof Date ? Math.floor(expiresAt.getTime() / 1e3) : expiresAt,
+      data
+    };
+    let deriveKeyResult = null;
+    if (counter !== void 0) {
+      const nonceBuf = hexToBuffer(parameters.nonce);
+      deriveKeyResult = await deriveKey2(
+        parameters,
+        hexToBuffer(parameters.salt),
+        new PasswordBuffer(nonceBuf, counterMode).setCounter(counter)
+      );
+      if (deriveKeyResult.parameters) {
+        Object.assign(parameters, deriveKeyResult.parameters);
+      }
+      parameters.keyPrefix = bufferToHex(deriveKeyResult.derivedKey.slice(0, keyPrefixLength));
+    }
+    if (!hmacSignatureSecret) {
+      return {
+        parameters: sortKeys(parameters)
+      };
+    }
+    return signChallenge(
+      hmacAlgorithm,
+      parameters,
+      deriveKeyResult?.derivedKey,
+      hmacSignatureSecret,
+      hmacKeySignatureSecret
+    );
+  }
   async function solveChallenge(options) {
     const {
       challenge,
@@ -252,6 +452,18 @@
     }
     return solution || null;
   }
+  async function signChallenge(algorithm, parameters, derivedKey, hmacSignatureSecret, hmacKeySignatureSecret) {
+    if (derivedKey && hmacKeySignatureSecret) {
+      parameters.keySignature = bufferToHex(
+        await hmac(algorithm, derivedKey, hmacKeySignatureSecret)
+      );
+    }
+    parameters = sortKeys(parameters);
+    return {
+      parameters,
+      signature: bufferToHex(await hmac(algorithm, JSON.stringify(parameters), hmacSignatureSecret))
+    };
+  }
   async function deobfuscate(obfuscatedData, options = {}) {
     let {
       concurrency = Math.max(1, Math.min(4, navigator.hardwareConcurrency)),
@@ -304,7 +516,48 @@
     );
     return new TextDecoder().decode(result);
   }
+  async function obfuscate(str, options = {}) {
+    const { deriveKey: deriveKey$1 = deriveKey } = options;
+    const counterMin = options?.counterMin || 20;
+    const counterMax = options?.counterMax || 200;
+    const { parameters } = await createChallenge({
+      algorithm: "PBKDF2/SHA-256",
+      cost: 5e3,
+      deriveKey: deriveKey$1,
+      counter: Math.floor(Math.random() * (counterMax - counterMin + 1)) + counterMin,
+      keyPrefixLength: 32,
+      ...options
+    });
+    const key = await crypto.subtle.importKey(
+      "raw",
+      hexToBuffer(parameters.keyPrefix),
+      { name: "AES-GCM" },
+      false,
+      ["encrypt"]
+    );
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const data = await crypto.subtle.encrypt(
+      { name: "AES-GCM", iv },
+      key,
+      new TextEncoder().encode(str)
+    );
+    return btoa(
+      JSON.stringify({
+        parameters: {
+          ...parameters,
+          // Return only half the derived key
+          keyPrefix: parameters.keyPrefix.slice(0, parameters.keyLength || 32)
+        },
+        cipher: {
+          iv: bufferToHex(iv),
+          data: bufferToHex(data)
+        }
+      })
+    );
+  }
   class ObfuscationPlugin extends BasePlugin {
+    static deobfuscate = deobfuscate;
+    static obfuscate = obfuscate;
     elTrigger = null;
     activate() {
       this.elTrigger = this.host.querySelector("button");

package/dist/plugins/obfuscation.plugin.umd.min.cjs

@@ -1 +1 @@
-!function(e){"function"==typeof define&&define.amd?define(e):e()}(function(){"use strict";class e{constructor(e){this.host=e}static register(e){"$altcha"in globalThis&&!globalThis.$altcha.plugins.has(e)&&globalThis.$altcha.plugins.add(e)}async onFetchChallenge(e){}async onRequestServerVerification(e,t){}async onVerify(e){}}function t(e){switch(e){case"PBKDF2/SHA-512":return"SHA-512";case"PBKDF2/SHA-384":return"SHA-384";default:return"SHA-256"}}async function r(e,r,n){const{algorithm:a,cost:i,keyLength:o=32}=e,s=await crypto.subtle.importKey("raw",n,{name:"PBKDF2"},!1,["deriveKey"]),c=await crypto.subtle.deriveKey({name:"PBKDF2",salt:r,iterations:i,hash:t(a)},s,{name:"AES-GCM",length:8*o},!0,["encrypt"]);return{derivedKey:new Uint8Array(await crypto.subtle.exportKey("raw",c))}}function n(e,t){if(t.length>e.length)return!1;for(let r=0;r<t.length;r++)if(e[r]!==t[r])return!1;return!0}function a(e){return Array.from(new Uint8Array(e)).map(e=>e.toString(16).padStart(2,"0")).join("")}function i(e){if(e.length%2!=0)throw new Error(`Hex string must have an even length. Got: ${e}`);const t=new ArrayBuffer(e.length/2),r=new DataView(t);for(let t=0;t<e.length;t+=2){const n=e.substring(t,t+2),a=parseInt(n,16);r.setUint8(t/2,a)}return new Uint8Array(t)}async function o(e){await new Promise(t=>setTimeout(t,e))}function s(e){return Math.floor(10*(performance.now()-e))/10}var c=(e=>(e.CODE="code",e.ERROR="error",e.VERIFIED="verified",e.VERIFYING="verifying",e.UNVERIFIED="unverified",e.EXPIRED="expired",e))(c||{});class l{constructor(e,t="uint32"){this.nonce=e,this.mode=t,this.buffer=new Uint8Array(this.nonce.length+this.COUNTER_BYTES),this.buffer.set(this.nonce,0),this.dataView=new DataView(this.buffer.buffer)}COUNTER_BYTES=4;buffer;dataView;encoder=new TextEncoder;setCounter(e){return"string"===this.mode?function(e,t){const r=new Uint8Array(e.length+t.length);return r.set(e,0),r.set(t,e.length),r}(this.nonce,this.encoder.encode(e.toString())):(this.dataView.setUint32(this.nonce.length,e,!1),this.buffer)}}async function h(e){const{challenge:t,concurrency:r=navigator.hardwareConcurrency,controller:n=new AbortController,createWorker:a,onOutOfMemory:i=e=>e>1?Math.floor(e/2):0,counterMode:o,timeout:s=9e4}=e,c=Math.min(16,Math.max(1,r)),l=[],u=()=>{for(const e of l)e.terminate()};for(let e=0;e<c;e++)l.push(await a(t.parameters.algorithm));let f=null;try{f=await Promise.race(l.map((e,r)=>(n.signal.addEventListener("abort",()=>{e.postMessage({type:"abort"})}),new Promise((n,a)=>{e.addEventListener("error",e=>{a(e)}),e.addEventListener("message",t=>{if(t.data){for(const t of l)t!==e&&t.postMessage({type:"abort"});if(t.data.error)return a(new Error(t.data.error))}n(t.data)}),e.postMessage({challenge:t,counterMode:o,counterStart:r,counterStep:c,timeout:s,type:"work"})}))))}catch(r){if(r instanceof Error&&!!r?.message?.includes("Out of memory")&&i){u();const r=i(c);if(r)return h({...e,challenge:t,controller:n,concurrency:r,createWorker:a})}throw r}finally{u()}return n.signal.aborted?null:f||null}async function u(e,t={}){let{concurrency:c=Math.max(1,Math.min(4,navigator.hardwareConcurrency)),createWorker:u,deriveKey:f=r}=t,d=null;try{d=JSON.parse(atob(e))}catch{throw new Error("Unable to parse obfuscated data.")}if(!d||"object"!=typeof d||!("parameters"in d)||!("cipher"in d))throw new Error("Invalid obfuscated data format.");const g=d.cipher;let y=null;if(!u&&"$altcha"in globalThis&&(u=globalThis.$altcha.algorithms.get(d.parameters.algorithm)),y=u?await h({challenge:d,concurrency:c,createWorker:u}):await async function(e){const{challenge:t,controller:r,counterMode:c="uint32",counterStart:h=0,counterStep:u=1,deriveKey:f,timeout:d=9e4}=e,{nonce:g,keyPrefix:y,salt:w}=t.parameters,m=i(g),p=i(w),b=y.length%2==0?i(y):null,E=new l(m,c),v=performance.now();let T=h,S="",A=v;for(;;){if(r?.signal.aborted||d&&T%10==0&&performance.now()-v>d)return null;const{derivedKey:e}=await f(t.parameters,p,E.setCounter(T));if(T%10==0&&performance.now()-A>200&&(await o(0),A=performance.now()),b?n(e,b):a(e).startsWith(y)){S=a(e);break}T+=u}return{counter:T,derivedKey:S,time:s(v)}}({challenge:d,deriveKey:f}),!y)throw new Error("Unable to find solution.");const w=await crypto.subtle.importKey("raw",i(y.derivedKey),{name:"AES-GCM"},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:i(g.iv)},w,i(g.data));return(new TextDecoder).decode(m)}e.register(class extends e{elTrigger=null;activate(){this.elTrigger=this.host.querySelector("button"),this.elTrigger&&(this.elTrigger.addEventListener("click",this.onTriggerClick.bind(this)),this.host.configure({floatingAnchor:this.elTrigger}))}destroy(){}async onVerify(e){const{minDuration:t=500}=e,r=performance.now(),n=this.host.getAttribute("data-obfuscated");if(n){this.host.reset(c.VERIFYING);try{const e=await u(n);await this.#e(Math.max(0,t-(performance.now()-r))),this.#t(e)}catch(e){this.host.setState(c.ERROR,String(e))}finally{this.host.setState(c.VERIFIED)}return null}}onTriggerClick(e){e.preventDefault(),this.host.show(),this.host.verify().then(()=>{this.host.hide()})}#t(e){let t;if(e.match(/^(mailto|tel|sms|https?):/)){const[r]=e.slice(e.indexOf(":")+1).replace(/^\/\//,"").split("?");t=document.createElement("a"),t.href=e,t.innerText=r}else t=document.createTextNode(e);this.elTrigger&&t&&(this.elTrigger.after(t),this.elTrigger.parentElement?.removeChild(this.elTrigger))}async#e(e){await new Promise(t=>setTimeout(t,e))}})});
+!function(e){"function"==typeof define&&define.amd?define(e):e()}(function(){"use strict";const e=()=>{};function t(t,r,n){if(null==t)return r(void 0),e;const a=function(e){var t=i;try{return i=!0,e()}finally{i=t}}(()=>t.subscribe(r,n));return a.unsubscribe?()=>a.unsubscribe():a}const r=[];function n(t,n=e){let a=null;const i=new Set;function o(e){if(o=e,((n=t)!=n?o==o:n!==o||null!==n&&"object"==typeof n||"function"==typeof n)&&(t=e,a)){const e=!r.length;for(const e of i)e[1](),r.push(e,t);if(e){for(let e=0;e<r.length;e+=2)r[e][0](r[e+1]);r.length=0}}var n,o}function s(e){o(e(t))}return{set:o,update:s,subscribe:function(r,c=e){const l=[r,c];return i.add(l),1===i.size&&(a=n(o,s)||e),r(t),()=>{i.delete(l),0===i.size&&a&&(a(),a=null)}}}}function a(e){let r;return t(e,e=>r=e)(),r}let i=!1;function o(e){const t={get:e=>a(t.store)[e],set:(e,r)=>{"string"==typeof e?Object.assign(a(t.store),{[e]:r}):Object.assign(a(t.store),e),t.store.set(a(t.store))},store:n(e)};return t}globalThis.$altcha=globalThis.$altcha||{algorithms:new Map,defaults:o({}),i18n:o({}),instances:new Set,plugins:new Set};class s{constructor(e){this.host=e}static register(e){"$altcha"in globalThis&&!globalThis.$altcha.plugins.has(e)&&globalThis.$altcha.plugins.add(e)}async onFetchChallenge(e){}async onRequestServerVerification(e,t){}async onVerify(e){}}function c(e){switch(e){case"PBKDF2/SHA-512":return"SHA-512";case"PBKDF2/SHA-384":return"SHA-384";default:return"SHA-256"}}async function l(e,t,r){const{algorithm:n,cost:a,keyLength:i=32}=e,o=await crypto.subtle.importKey("raw",r,{name:"PBKDF2"},!1,["deriveKey"]),s=await crypto.subtle.deriveKey({name:"PBKDF2",salt:t,iterations:a,hash:c(n)},o,{name:"AES-GCM",length:8*i},!0,["encrypt"]);return{derivedKey:new Uint8Array(await crypto.subtle.exportKey("raw",s))}}function u(e,t){if(t.length>e.length)return!1;for(let r=0;r<t.length;r++)if(e[r]!==t[r])return!1;return!0}function h(e){return Array.from(new Uint8Array(e)).map(e=>e.toString(16).padStart(2,"0")).join("")}function f(e){if(e.length%2!=0)throw new Error(`Hex string must have an even length. Got: ${e}`);const t=new ArrayBuffer(e.length/2),r=new DataView(t);for(let t=0;t<e.length;t+=2){const n=e.substring(t,t+2),a=parseInt(n,16);r.setUint8(t/2,a)}return new Uint8Array(t)}async function y(e){await new Promise(t=>setTimeout(t,e))}async function g(e,t,r){const n=await crypto.subtle.importKey("raw",(new TextEncoder).encode(r),{name:"HMAC",hash:{name:e}},!1,["sign","verify"]),a=await crypto.subtle.sign("HMAC",n,"string"==typeof t?(new TextEncoder).encode(t):t);return new Uint8Array(a)}function d(e){return"object"!=typeof e||null===e||Array.isArray(e)?e:Object.keys(e).sort().reduce((t,r)=>{const n=e[r];return void 0!==n&&(t[r]=d(n)),t},{})}function m(e){return Math.floor(10*(performance.now()-e))/10}var w=(e=>(e.SHA_256="SHA-256",e.SHA_384="SHA-384",e.SHA_512="SHA-512",e))(w||{}),p=(e=>(e.CODE="code",e.ERROR="error",e.VERIFIED="verified",e.VERIFYING="verifying",e.UNVERIFIED="unverified",e.EXPIRED="expired",e))(p||{});class b{constructor(e,t="uint32"){this.nonce=e,this.mode=t,this.buffer=new Uint8Array(this.nonce.length+this.COUNTER_BYTES),this.buffer.set(this.nonce,0),this.dataView=new DataView(this.buffer.buffer)}COUNTER_BYTES=4;buffer;dataView;encoder=new TextEncoder;setCounter(e){return"string"===this.mode?function(e,t){const r=new Uint8Array(e.length+t.length);return r.set(e,0),r.set(t,e.length),r}(this.nonce,this.encoder.encode(e.toString())):(this.dataView.setUint32(this.nonce.length,e,!1),this.buffer)}}async function S(e){const{algorithm:t,counter:r,counterMode:n="uint32",cost:a,deriveKey:i,data:o,expiresAt:s,hmacAlgorithm:c=w.SHA_256,hmacKeySignatureSecret:l,hmacSignatureSecret:u,keyLength:y=32,keyPrefix:m="00",keyPrefixLength:p=y/2,memoryCost:S,parallelism:v}=e,A={algorithm:t,nonce:h(crypto.getRandomValues(new Uint8Array(16))),salt:h(crypto.getRandomValues(new Uint8Array(16))),cost:a,keyLength:y,memoryCost:S,parallelism:v,keyPrefix:m,expiresAt:s instanceof Date?Math.floor(s.getTime()/1e3):s,data:o};let E=null;if(void 0!==r){const e=f(A.nonce);E=await i(A,f(A.salt),new b(e,n).setCounter(r)),E.parameters&&Object.assign(A,E.parameters),A.keyPrefix=h(E.derivedKey.slice(0,p))}return u?async function(e,t,r,n,a){r&&a&&(t.keySignature=h(await g(e,r,a)));return t=d(t),{parameters:t,signature:h(await g(e,JSON.stringify(t),n))}}(c,A,E?.derivedKey,u,l):{parameters:d(A)}}async function v(e){const{challenge:t,concurrency:r=navigator.hardwareConcurrency,controller:n=new AbortController,createWorker:a,onOutOfMemory:i=e=>e>1?Math.floor(e/2):0,counterMode:o,timeout:s=9e4}=e,c=Math.min(16,Math.max(1,r)),l=[],u=()=>{for(const e of l)e.terminate()};for(let e=0;e<c;e++)l.push(await a(t.parameters.algorithm));let h=null;try{h=await Promise.race(l.map((e,r)=>(n.signal.addEventListener("abort",()=>{e.postMessage({type:"abort"})}),new Promise((n,a)=>{e.addEventListener("error",e=>{a(e)}),e.addEventListener("message",t=>{if(t.data){for(const t of l)t!==e&&t.postMessage({type:"abort"});if(t.data.error)return a(new Error(t.data.error))}n(t.data)}),e.postMessage({challenge:t,counterMode:o,counterStart:r,counterStep:c,timeout:s,type:"work"})}))))}catch(r){if(r instanceof Error&&!!r?.message?.includes("Out of memory")&&i){u();const r=i(c);if(r)return v({...e,challenge:t,controller:n,concurrency:r,createWorker:a})}throw r}finally{u()}return n.signal.aborted?null:h||null}async function A(e,t={}){let{concurrency:r=Math.max(1,Math.min(4,navigator.hardwareConcurrency)),createWorker:n,deriveKey:a=l}=t,i=null;try{i=JSON.parse(atob(e))}catch{throw new Error("Unable to parse obfuscated data.")}if(!i||"object"!=typeof i||!("parameters"in i)||!("cipher"in i))throw new Error("Invalid obfuscated data format.");const o=i.cipher;let s=null;if(!n&&"$altcha"in globalThis&&(n=globalThis.$altcha.algorithms.get(i.parameters.algorithm)),s=n?await v({challenge:i,concurrency:r,createWorker:n}):await async function(e){const{challenge:t,controller:r,counterMode:n="uint32",counterStart:a=0,counterStep:i=1,deriveKey:o,timeout:s=9e4}=e,{nonce:c,keyPrefix:l,salt:g}=t.parameters,d=f(c),w=f(g),p=l.length%2==0?f(l):null,S=new b(d,n),v=performance.now();let A=a,E="",T=v;for(;;){if(r?.signal.aborted||s&&A%10==0&&performance.now()-v>s)return null;const{derivedKey:e}=await o(t.parameters,w,S.setCounter(A));if(A%10==0&&performance.now()-T>200&&(await y(0),T=performance.now()),p?u(e,p):h(e).startsWith(l)){E=h(e);break}A+=i}return{counter:A,derivedKey:E,time:m(v)}}({challenge:i,deriveKey:a}),!s)throw new Error("Unable to find solution.");const c=await crypto.subtle.importKey("raw",f(s.derivedKey),{name:"AES-GCM"},!1,["decrypt"]),g=await crypto.subtle.decrypt({name:"AES-GCM",iv:f(o.iv)},c,f(o.data));return(new TextDecoder).decode(g)}async function E(e,t={}){const{deriveKey:r=l}=t,n=t?.counterMin||20,a=t?.counterMax||200,{parameters:i}=await S({algorithm:"PBKDF2/SHA-256",cost:5e3,deriveKey:r,counter:Math.floor(Math.random()*(a-n+1))+n,keyPrefixLength:32,...t}),o=await crypto.subtle.importKey("raw",f(i.keyPrefix),{name:"AES-GCM"},!1,["encrypt"]),s=crypto.getRandomValues(new Uint8Array(12)),c=await crypto.subtle.encrypt({name:"AES-GCM",iv:s},o,(new TextEncoder).encode(e));return btoa(JSON.stringify({parameters:{...i,keyPrefix:i.keyPrefix.slice(0,i.keyLength||32)},cipher:{iv:h(s),data:h(c)}}))}s.register(class extends s{static deobfuscate=A;static obfuscate=E;elTrigger=null;activate(){this.elTrigger=this.host.querySelector("button"),this.elTrigger&&(this.elTrigger.addEventListener("click",this.onTriggerClick.bind(this)),this.host.configure({floatingAnchor:this.elTrigger}))}destroy(){}async onVerify(e){const{minDuration:t=500}=e,r=performance.now(),n=this.host.getAttribute("data-obfuscated");if(n){this.host.reset(p.VERIFYING);try{const e=await A(n);await this.#e(Math.max(0,t-(performance.now()-r))),this.#t(e)}catch(e){this.host.setState(p.ERROR,String(e))}finally{this.host.setState(p.VERIFIED)}return null}}onTriggerClick(e){e.preventDefault(),this.host.show(),this.host.verify().then(()=>{this.host.hide()})}#t(e){let t;if(e.match(/^(mailto|tel|sms|https?):/)){const[r]=e.slice(e.indexOf(":")+1).replace(/^\/\//,"").split("?");t=document.createElement("a"),t.href=e,t.innerText=r}else t=document.createTextNode(e);this.elTrigger&&t&&(this.elTrigger.after(t),this.elTrigger.parentElement?.removeChild(this.elTrigger))}async#e(e){await new Promise(t=>setTimeout(t,e))}})});

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "altcha",
 	"description": "Privacy-first CAPTCHA widget, compliant with global regulations (GDPR/HIPAA/CCPA/LGDP/DPDPA/PIPL) and WCAG accessible. No tracking, self-verifying.",
-	"version": "3.0.0-beta.3",
+	"version": "3.0.0-beta.4",
 	"license": "MIT",
 	"author": {
 		"name": "Daniel Regeci",