capjs-core 0.1.0

package/LICENSE

@@ -0,0 +1,13 @@
+Copyright 2025 Tiago
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,142 @@
+# capjs-core
+
+Stateless challenge generation and verification for [Cap](https://trycap.dev), the self-hosted CAPTCHA for the modern web.
+
+## Install
+
+```sh
+bun add capjs-core
+# or: npm install capjs-core
+```
+
+## Usage
+
+```js
+import { generateChallenge, validateChallenge } from "capjs-core";
+
+// long, random, high-entropy. keep this consistent across processes.
+const SECRET = process.env.CAP_SECRET;
+
+// 1) Server route: create a challenge
+const challenge = await generateChallenge(SECRET, {
+  scope: "signup",        // optional
+  instrumentation: true,  // optional
+});
+// → { challenge: { c, s, d }, token, expires, instrumentation? }
+
+// 2) Server route: validate the redeemed challenge
+const result = await validateChallenge(SECRET, {
+  token: req.body.token,
+  solutions: req.body.solutions,
+  instr: req.body.instr,
+}, {
+  scope: "signup",
+  // optional: prevent replay
+  consumeNonce: async (sigHex, ttlMs) =>
+    await myStore.setIfNotExists(`cap:${sigHex}`, 1, ttlMs),
+});
+
+if (result.success) {
+  // result.token, result.tokenKey, result.expires, result.scope
+}
+```
+
+## API
+
+### `generateChallenge(secret, opts?) → { challenge, token, expires, instrumentation? }`
+
+- `secret` — string or Buffer ≥16 bytes. Master HMAC key.
+- `opts.challengeCount` — default `50`
+- `opts.challengeSize` — default `32`
+- `opts.challengeDifficulty` — default `4`
+- `opts.expiresMs` — default `600000` (10 min)
+- `opts.scope` — optional string bound to the challenge
+- `opts.extra` — optional object embedded in the JWT payload
+- `opts.instrumentation` — `true` or `{ blockAutomatedBrowsers, obfuscationLevel }`
+- `opts.instrumentationGenerator` — optional custom generator (escape hatch for offloading to a worker pool)
+
+The `token` is a signed JWT containing the challenge config; `expires` is when it expires; `instrumentation` is the deflate+base64 client-side script (if requested).
+
+### `validateChallenge(secret, body, opts?) → { success, ... }`
+
+`body`:
+- `token` — challenge token from `generateChallenge`
+- `solutions` — number array (length = `challenge.c`)
+- `instr` — instrumentation result (if enabled)
+- `instr_blocked`, `instr_timeout` — flags from the widget
+
+`opts`:
+- `scope` — must match the original challenge's scope
+- `tokenTtlMs` — TTL for the redeem token (default 20 min)
+- `consumeNonce(sigHex, ttlMs)` — replay prevention via your storage
+- `signToken(data)` — async fn returning a custom redeem token format
+
+Returns success: `{ success: true, token, tokenKey, expires, scope, iat }`. The default redeem token is `id:secret`; `tokenKey` is `id:HMAC(secret)` — store the key in your DB, give the token to the user, then look it up later by re-running `tokenKey = id:HMAC(submittedSecret)`.
+
+Returns failure: `{ success: false, reason, instr_error? }`. Reasons:
+
+| reason | meaning |
+| --- | --- |
+| `invalid_body` | body isn't an object |
+| `missing_token` | no token provided |
+| `missing_solutions` | solutions missing or not an array |
+| `invalid_token` | JWT signature mismatch / malformed / out-of-bounds params |
+| `scope_mismatch` | token's scope doesn't match `opts.scope` |
+| `expired` | challenge JWT expired |
+| `invalid_solutions` | length mismatch or non-numbers |
+| `nonce_store_error` | your `consumeNonce` callback threw |
+| `already_redeemed` | `consumeNonce` returned `false` |
+| `invalid_solution` | solutions don't satisfy the PoW |
+| `instr_*` | instrumentation failed (with `instr_error: true`) |
+
+## Stateless by design
+
+- No `fs`, no `process.on('SIGINT')`, no in-memory token list.
+- Challenge tokens are signed JWTs (HS256). Verification is pure cryptography.
+- Instrumentation metadata is encrypted (AES-256-GCM) inside the JWT — server doesn't need to remember it.
+- Replay prevention is opt-in via your `consumeNonce` callback (Redis `SET NX EX`, etc.).
+
+## Performance
+
+Apple M-series, bun 1.3, single core, no instrumentation:
+
+| operation | params | ops/s |
+| --- | --- | ---: |
+| `generateChallenge` | defaults (c=50 s=32 d=4) | ~350,000 |
+| `generateChallenge` | small (c=5 s=16 d=2) | ~450,000 |
+| `validateChallenge` | defaults | ~4,400 |
+| `validateChallenge` | small | ~36,000 |
+| `validateChallenge` | invalid token (early-exit) | ~2,400,000 |
+| `validateChallenge` | bad signature (HMAC reject) | ~310,000 |
+
+With instrumentation:
+
+| operation | level | ops/s |
+| --- | --- | ---: |
+| `generateChallenge + instrumentation` | 1 (no obfuscator) | ~10,700 |
+| `generateChallenge + instrumentation` | 3 (default) | ~44 |
+| `generateChallenge + instrumentation` | 8 (string array + control flow) | ~5 |
+
+Instrumentation generation at level 3+ blocks the event loop. If you need higher throughput, supply your own `instrumentationGenerator` that runs in a forked child or worker.
+
+Run `bun test/benchmark.js` to reproduce.
+
+## Migrating from `@cap.js/server`
+
+Unlike Cap's old server library, `capjs-core` does not include a token store. For most users we recommend [Cap Standalone](https://trycap.dev/guide/standalone/) (Docker, batteries included), but if you can't run Docker:
+
+| `@cap.js/server` | `capjs-core` |
+| --- | --- |
+| `new Cap({ ... })` | (no constructor — pass your secret per call) |
+| `cap.createChallenge(opts)` | `generateChallenge(secret, opts)` |
+| `cap.redeemChallenge({ token, solutions })` | `validateChallenge(secret, { token, solutions })` |
+| `cap.validateToken(redeemToken)` | look up `tokenKey` in your DB yourself |
+| `config.storage.tokens.*` | use your own KV |
+| `config.tokens_store_path` | gone (no filesystem) |
+| `SIGINT`/`beforeExit` cleanup | gone (TTL via JWT `exp` and your KV's expiry) |
+
+For replay prevention, pass a `consumeNonce` callback to `validateChallenge`. `capjs-core` calls it with the JWT signature hex and the remaining TTL; you store that hex in your KV (e.g. `SET cap:<sig> 1 NX EX <ttl>`) and return `false` on repeats.
+
+## License
+
+Apache-2.0

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "capjs-core",
+  "version": "0.1.0",
+  "description": "Stateless server-side challenge generator and verifier for Cap, a lightweight, modern open-source CAPTCHA alternative. No storage, no filesystem - bring your own.",
+  "keywords": [
+    "anti-abuse",
+    "anti-automation",
+    "anti-bot",
+    "anti-ddos",
+    "anti-spam",
+    "captcha-alternative",
+    "hashcash",
+    "instrumentation",
+    "pow",
+    "proof-of-work",
+    "stateless",
+    "verification"
+  ],
+  "homepage": "https://github.com/tiagozip/cap#readme",
+  "bugs": {
+    "url": "https://github.com/tiagozip/cap/issues"
+  },
+  "license": "Apache-2.0",
+  "author": "Tiago",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tiagozip/cap.git"
+  },
+  "type": "module",
+  "main": "src/index.js",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "import": "./src/index.js",
+      "default": "./src/index.js"
+    }
+  },
+  "types": "src/index.d.ts",
+  "files": [
+    "src/index.js",
+    "src/index.d.ts",
+    "src/instrumentation.js",
+    "src/prng.js",
+    "src/crypto.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "bun test",
+    "publish:dry": "bun publish --dry-run --access public"
+  },
+  "dependencies": {
+    "esbuild": "^0.28.0"
+  },
+  "optionalDependencies": {
+    "javascript-obfuscator": "^4.2.2"
+  },
+  "devDependencies": {
+    "bun-types": "^1.3.12"
+  }
+}

package/src/crypto.js

@@ -0,0 +1,155 @@
+import crypto from "node:crypto";
+
+const hasBunSha256 =
+  typeof Bun !== "undefined" &&
+  typeof Bun.SHA256 === "function" &&
+  typeof Bun.SHA256.hash === "function";
+
+export function randomHex(bytesCount) {
+  return crypto.randomBytes(bytesCount).toString("hex");
+}
+
+export function sha256Hex(str) {
+  if (hasBunSha256) return Bun.SHA256.hash(str, "hex");
+  return crypto.createHash("sha256").update(str).digest("hex");
+}
+
+export function sha256Bytes(str) {
+  if (hasBunSha256) return Bun.SHA256.hash(str);
+  return crypto.createHash("sha256").update(str).digest();
+}
+
+export function hmacSha256(key, data) {
+  return crypto.createHmac("sha256", key).update(data).digest();
+}
+
+export function timingSafeEqual(a, b) {
+  if (!Buffer.isBuffer(a)) a = Buffer.from(a);
+  if (!Buffer.isBuffer(b)) b = Buffer.from(b);
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+
+export function b64url(input) {
+  const buf = Buffer.isBuffer(input)
+    ? input
+    : input instanceof Uint8Array
+      ? Buffer.from(input)
+      : Buffer.from(input, "utf8");
+  return buf.toString("base64url");
+}
+
+export function b64urlDecode(str) {
+  return Buffer.from(str, "base64url");
+}
+
+const JWT_HEADER_B64 = b64url('{"alg":"HS256","typ":"JWT"}');
+
+export function jwtSign(payloadOrJson, secret) {
+  const json =
+    typeof payloadOrJson === "string"
+      ? payloadOrJson
+      : JSON.stringify(payloadOrJson);
+  const body = b64url(json);
+  const sigInput = `${JWT_HEADER_B64}.${body}`;
+  const sig = hmacSha256(secret, sigInput);
+  return `${sigInput}.${b64url(sig)}`;
+}
+
+export function jwtVerify(token, secret) {
+  if (!token || typeof token !== "string") return null;
+  const firstDot = token.indexOf(".");
+  if (firstDot < 1) return null;
+  const lastDot = token.lastIndexOf(".");
+  if (lastDot === firstDot) return null;
+  if (token.indexOf(".", firstDot + 1) !== lastDot) return null;
+
+  const sigInput = token.substring(0, lastDot);
+  const expected = hmacSha256(secret, sigInput);
+  const actual = b64urlDecode(token.substring(lastDot + 1));
+
+  if (!timingSafeEqual(expected, actual)) return null;
+
+  try {
+    return JSON.parse(
+      b64urlDecode(token.substring(firstDot + 1, lastDot)).toString("utf8"),
+    );
+  } catch {
+    return null;
+  }
+}
+
+export function jwtSigHex(token) {
+  if (!token || typeof token !== "string") return null;
+  const lastDot = token.lastIndexOf(".");
+  if (lastDot === -1) return null;
+  try {
+    return b64urlDecode(token.slice(lastDot + 1)).toString("hex");
+  } catch {
+    return null;
+  }
+}
+
+function deriveKey(secret, info) {
+  return hmacSha256(secret, info);
+}
+
+export function encryptGcm(data, secret, info = "cap:enc-v1") {
+  const key = deriveKey(secret, info);
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+  const plaintext = Buffer.from(JSON.stringify(data), "utf8");
+  const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, tag, encrypted]).toString("base64url");
+}
+
+export function decryptGcm(blob, secret, info = "cap:enc-v1") {
+  try {
+    const buf = Buffer.from(blob, "base64url");
+    if (buf.length < 28) return null;
+    const iv = buf.subarray(0, 12);
+    const tag = buf.subarray(12, 28);
+    const ciphertext = buf.subarray(28);
+    const key = deriveKey(secret, info);
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final(),
+    ]);
+    return JSON.parse(decrypted.toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function parseHexPrefix(target) {
+  const len = target.length;
+  const fullBytes = len >> 1;
+  const bytes = new Uint8Array(fullBytes);
+  for (let i = 0; i < fullBytes; i++) {
+    const a = target.charCodeAt(i * 2);
+    const b = target.charCodeAt(i * 2 + 1);
+    bytes[i] =
+      ((a <= 57 ? a - 48 : (a | 32) - 87) << 4) |
+      (b <= 57 ? b - 48 : (b | 32) - 87);
+  }
+  let partialNibble = -1;
+  if (len & 1) {
+    const c = target.charCodeAt(len - 1);
+    partialNibble = c <= 57 ? c - 48 : (c | 32) - 87;
+  }
+  return { bytes, fullBytes, partialNibble };
+}
+
+export function powMatchesPrefix(hashBytes, parsed) {
+  const { bytes, fullBytes, partialNibble } = parsed;
+  for (let i = 0; i < fullBytes; i++) {
+    if (hashBytes[i] !== bytes[i]) return false;
+  }
+  if (partialNibble !== -1) {
+    if (hashBytes[fullBytes] >> 4 !== partialNibble) return false;
+  }
+  return true;
+}

package/src/index.d.ts

@@ -0,0 +1,99 @@
+export interface ChallengeSpec {
+  c: number;
+  s: number;
+  d: number;
+}
+
+export interface InstrumentationOptions {
+  blockAutomatedBrowsers?: boolean;
+  obfuscationLevel?: number;
+  ttlMs?: number;
+}
+
+export interface GeneratedInstrumentation {
+  id: string;
+  expires: number;
+  expectedVals: number[];
+  vars: string[];
+  blockAutomatedBrowsers: boolean;
+  instrumentation: string;
+}
+
+export interface GenerateChallengeOptions {
+  challengeCount?: number;
+  challengeSize?: number;
+  challengeDifficulty?: number;
+  expiresMs?: number;
+  scope?: string;
+  extra?: Record<string, unknown>;
+  instrumentation?: boolean | InstrumentationOptions;
+  instrumentationGenerator?: (
+    opts: InstrumentationOptions,
+  ) => Promise<GeneratedInstrumentation>;
+}
+
+export interface ChallengeResult {
+  challenge: ChallengeSpec;
+  token: string;
+  expires: number;
+  instrumentation?: string;
+}
+
+export interface InstrumentationPayload {
+  i: string;
+  state: Record<string, number>;
+  ts?: number;
+}
+
+export interface ValidateChallengeBody {
+  token: string;
+  solutions: number[];
+  instr?: InstrumentationPayload;
+  instr_blocked?: boolean;
+  instr_timeout?: boolean;
+}
+
+export interface ValidateChallengeOptions {
+  scope?: string;
+  tokenTtlMs?: number;
+  consumeNonce?: (
+    signatureHex: string,
+    ttlMs: number,
+  ) => Promise<boolean> | boolean;
+  signToken?: (data: {
+    scope: string | null;
+    expires: number;
+    iat?: number;
+  }) => Promise<string> | string;
+}
+
+export interface ValidateChallengeSuccess {
+  success: true;
+  token: string;
+  tokenKey?: string;
+  expires: number;
+  scope: string | null;
+  iat?: number;
+}
+
+export interface ValidateChallengeFailure {
+  success: false;
+  reason: string;
+  instr_error?: boolean;
+  error?: string;
+}
+
+export type ValidateChallengeResult =
+  | ValidateChallengeSuccess
+  | ValidateChallengeFailure;
+
+export function generateChallenge(
+  secret: string | Buffer,
+  opts?: GenerateChallengeOptions,
+): Promise<ChallengeResult>;
+
+export function validateChallenge(
+  secret: string | Buffer,
+  body: ValidateChallengeBody,
+  opts?: ValidateChallengeOptions,
+): Promise<ValidateChallengeResult>;

package/src/index.js

@@ -0,0 +1,229 @@
+import {
+  decryptGcm,
+  encryptGcm,
+  jwtSigHex,
+  jwtSign,
+  jwtVerify,
+  parseHexPrefix,
+  powMatchesPrefix,
+  randomHex,
+  sha256Bytes,
+  sha256Hex,
+} from "./crypto.js";
+import {
+  generateInstrumentation,
+  verifyInstrumentationResult,
+} from "./instrumentation.js";
+import { fnv1a, fnv1aResume, prngFromHash } from "./prng.js";
+
+const DEFAULT_CHALLENGE_COUNT = 50;
+const DEFAULT_CHALLENGE_SIZE = 32;
+const DEFAULT_CHALLENGE_DIFFICULTY = 4;
+const DEFAULT_CHALLENGE_TTL_MS = 10 * 60 * 1000;
+const DEFAULT_TOKEN_TTL_MS = 20 * 60 * 1000;
+
+const MAX_CHALLENGE_COUNT = 1000;
+const MAX_CHALLENGE_SIZE = 256;
+const MAX_CHALLENGE_DIFFICULTY = 16;
+
+function assertSecret(secret) {
+  if (!secret) {
+    throw new Error(
+      "[capjs-core] secret is required. Pass a long, random, high-entropy string and keep it consistent across processes.",
+    );
+  }
+  if (typeof secret !== "string" && !Buffer.isBuffer(secret)) {
+    throw new Error("[capjs-core] secret must be a string or Buffer");
+  }
+  const len =
+    typeof secret === "string"
+      ? Buffer.byteLength(secret, "utf8")
+      : secret.length;
+  if (len < 16) {
+    throw new Error("[capjs-core] secret must be at least 16 bytes for security");
+  }
+}
+
+export async function generateChallenge(secret, opts = {}) {
+  assertSecret(secret);
+
+  const c = opts.challengeCount ?? DEFAULT_CHALLENGE_COUNT;
+  const s = opts.challengeSize ?? DEFAULT_CHALLENGE_SIZE;
+  const d = opts.challengeDifficulty ?? DEFAULT_CHALLENGE_DIFFICULTY;
+  if (
+    !Number.isInteger(c) ||
+    c < 1 ||
+    c > MAX_CHALLENGE_COUNT ||
+    !Number.isInteger(s) ||
+    s < 1 ||
+    s > MAX_CHALLENGE_SIZE ||
+    !Number.isInteger(d) ||
+    d < 1 ||
+    d > MAX_CHALLENGE_DIFFICULTY
+  ) {
+    throw new Error(
+      `[capjs-core] invalid params: c, s must be positive ints (c≤${MAX_CHALLENGE_COUNT}, s≤${MAX_CHALLENGE_SIZE}), d in [1, ${MAX_CHALLENGE_DIFFICULTY}]`,
+    );
+  }
+  const ttlMs = opts.expiresMs ?? DEFAULT_CHALLENGE_TTL_MS;
+  const now = Date.now();
+  const expires = now + ttlMs;
+
+  const payload = {
+    n: randomHex(25),
+    c,
+    s,
+    d,
+    exp: expires,
+    iat: now,
+  };
+  if (opts.scope) payload.sk = String(opts.scope);
+  if (opts.extra && typeof opts.extra === "object") payload.x = opts.extra;
+
+  let instrumentation;
+  if (opts.instrumentation) {
+    const instrOpts =
+      typeof opts.instrumentation === "object" ? opts.instrumentation : {};
+    const generator = opts.instrumentationGenerator || generateInstrumentation;
+    const instr = await generator({ ...instrOpts, ttlMs });
+    payload.ei = encryptGcm(
+      {
+        id: instr.id,
+        expectedVals: instr.expectedVals,
+        vars: instr.vars,
+        blockAutomatedBrowsers: instr.blockAutomatedBrowsers,
+        expires,
+      },
+      secret,
+    );
+    instrumentation = instr.instrumentation;
+  }
+
+  const token = jwtSign(payload, secret);
+  const result = { challenge: { c, s, d }, token, expires };
+  if (instrumentation) result.instrumentation = instrumentation;
+  return result;
+}
+
+function fail(reason, extra) {
+  return { success: false, reason, ...(extra || {}) };
+}
+
+export async function validateChallenge(secret, body, opts = {}) {
+  assertSecret(secret);
+
+  if (!body || typeof body !== "object") return fail("invalid_body");
+  if (!body.token || typeof body.token !== "string")
+    return fail("missing_token");
+  const solutions = body.solutions;
+  if (!Array.isArray(solutions)) return fail("missing_solutions");
+
+  const payload = jwtVerify(body.token, secret);
+  if (!payload) return fail("invalid_token");
+
+  if (opts.scope && payload.sk !== opts.scope) return fail("scope_mismatch");
+
+  if (!payload.exp || payload.exp < Date.now()) return fail("expired");
+
+  const c = payload.c;
+  const size = payload.s;
+  const difficulty = payload.d;
+
+  if (
+    !Number.isInteger(c) ||
+    !Number.isInteger(size) ||
+    !Number.isInteger(difficulty) ||
+    c < 1 ||
+    c > MAX_CHALLENGE_COUNT ||
+    size < 1 ||
+    size > MAX_CHALLENGE_SIZE ||
+    difficulty < 1 ||
+    difficulty > MAX_CHALLENGE_DIFFICULTY
+  ) {
+    return fail("invalid_token");
+  }
+
+  if (solutions.length !== c) return fail("invalid_solutions");
+  for (let i = 0; i < c; i++) {
+    if (typeof solutions[i] !== "number") return fail("invalid_solutions");
+  }
+
+  const token = body.token;
+  const tokenFnv = fnv1a(token);
+  for (let i = 0; i < c; i++) {
+    const idxStr = String(i + 1);
+    const saltSeed = fnv1aResume(tokenFnv, idxStr);
+    const targetSeed = fnv1aResume(saltSeed, "d");
+    const salt = prngFromHash(saltSeed, size);
+    const target = prngFromHash(targetSeed, difficulty);
+    const hash = sha256Bytes(salt + solutions[i]);
+    if (!powMatchesPrefix(hash, parseHexPrefix(target))) {
+      return fail("invalid_solution");
+    }
+  }
+
+  if (payload.ei) {
+    const instrMeta = decryptGcm(payload.ei, secret);
+    if (!instrMeta) return fail("instr_corrupted", { instr_error: true });
+    if (instrMeta.expires && Date.now() > instrMeta.expires) {
+      return fail("instr_expired", { instr_error: true });
+    }
+
+    if (body.instr_blocked === true) {
+      if (instrMeta.blockAutomatedBrowsers) {
+        return fail("instr_automated_browser", { instr_error: true });
+      }
+    } else if (body.instr_timeout === true) {
+      return fail("instr_timeout", { instr_error: true });
+    } else if (body.instr) {
+      const r = verifyInstrumentationResult(instrMeta, body.instr);
+      if (!r.valid)
+        return fail(r.reason || "instr_failed", { instr_error: true });
+    } else {
+      return fail("instr_missing", { instr_error: true });
+    }
+  }
+
+  if (typeof opts.consumeNonce === "function") {
+    const sig = jwtSigHex(body.token);
+    if (!sig) return fail("invalid_token");
+    const ttlMs = Math.max(1, payload.exp - Date.now());
+    let claimed;
+    try {
+      claimed = await opts.consumeNonce(sig, ttlMs);
+    } catch (err) {
+      return fail("nonce_store_error", { error: String(err?.message || err) });
+    }
+    if (!claimed) return fail("already_redeemed");
+  }
+
+  const tokenTtlMs = opts.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
+  const tokenExpires = Date.now() + tokenTtlMs;
+
+  if (typeof opts.signToken === "function") {
+    const signed = await opts.signToken({
+      scope: payload.sk ?? null,
+      expires: tokenExpires,
+      iat: payload.iat,
+    });
+    return {
+      success: true,
+      token: signed,
+      expires: tokenExpires,
+      scope: payload.sk ?? null,
+      iat: payload.iat,
+    };
+  }
+
+  const id = randomHex(8);
+  const verToken = randomHex(15);
+  const tokenHash = sha256Hex(verToken);
+  return {
+    success: true,
+    token: `${id}:${verToken}`,
+    tokenKey: `${id}:${tokenHash}`,
+    expires: tokenExpires,
+    scope: payload.sk ?? null,
+    iat: payload.iat,
+  };
+}

package/src/instrumentation.js

@@ -0,0 +1,538 @@
+import { randomBytes, randomInt } from "node:crypto";
+import { deflateRawSync } from "node:zlib";
+
+let _obfuscator = null;
+async function getObfuscator() {
+  if (_obfuscator !== null) return _obfuscator;
+  try {
+    const mod = await import("javascript-obfuscator");
+    _obfuscator = mod.default ?? mod;
+  } catch {
+    _obfuscator = false;
+  }
+  return _obfuscator;
+}
+
+let _esbuild = null;
+async function getEsbuild() {
+  if (_esbuild !== null) return _esbuild;
+  try {
+    _esbuild = await import("esbuild");
+  } catch {
+    _esbuild = false;
+  }
+  return _esbuild;
+}
+
+const STRING_LITERAL = /(['"])((?:\\.|(?!\1)[^\\])*)\1/g;
+function decodeJsString(quoted, body) {
+  let safe = "";
+  for (let i = 0; i < body.length; i++) {
+    const c = body[i];
+    if (c === "\\") {
+      safe += c + body[++i];
+    } else if (c === '"') {
+      safe += '\\"';
+    } else {
+      safe += c;
+    }
+  }
+  if (quoted === "'") safe = safe.replace(/\\'/g, "'");
+  return JSON.parse(`"${safe}"`);
+}
+
+function customObfuscateStrings(script) {
+  const matches = [...script.matchAll(STRING_LITERAL)];
+  if (matches.length === 0) return script;
+  const seen = new Map();
+  const arr = [];
+  for (const m of matches) {
+    const value = decodeJsString(m[1], m[2]);
+    if (!seen.has(value)) {
+      seen.set(value, arr.length);
+      arr.push(value);
+    }
+  }
+  for (let i = arr.length - 1; i > 0; i--) {
+    const j = randomInt(0, i + 1);
+    [arr[i], arr[j]] = [arr[j], arr[i]];
+  }
+  const newIndex = new Map(arr.map((s, i) => [s, i]));
+  const tName = `_T${randomBytes(3).toString("hex")}`;
+  const out = script.replace(STRING_LITERAL, (_full, q, body) => {
+    const value = decodeJsString(q, body);
+    return `${tName}[${newIndex.get(value)}]`;
+  });
+  return `var ${tName}=${JSON.stringify(arr)};${out}`;
+}
+
+const rHex = (len = 16) => randomBytes(len).toString("hex").slice(0, len);
+
+const fastRnd = (a, b) => a + ((Math.random() * (b - a + 1)) | 0);
+const VAR_LETTERS = "abcdefghijklmnopqrstuvwxyz";
+const VAR_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789";
+const rVar = (len) => {
+  if (!len) len = ((Math.random() * 7) | 0) + 4;
+  let s = VAR_LETTERS[(Math.random() * 26) | 0];
+  for (let i = 1; i < len; i++) s += VAR_CHARS[(Math.random() * 36) | 0];
+  return s;
+};
+const toInt32 = (n) => n | 0;
+
+function domSumMock(x, y, z) {
+  const root = { isRoot: true };
+
+  function buildChain(parent, val) {
+    let cur = parent;
+    let v = val;
+    for (let i = 0; i < 8; i++) {
+      const child = { parentNode: cur, innerText: String(v) };
+      if ((v & 1) === 0) cur = child;
+      v = v >> 1;
+    }
+    return cur;
+  }
+
+  function walk(node, rootRef, sum) {
+    if (!node || node === rootRef) return sum % 256;
+    return walk(node.parentNode, rootRef, sum + parseInt(node.innerText, 10));
+  }
+
+  return toInt32(
+    walk(buildChain(buildChain(buildChain(root, x), y), z), root, 0),
+  );
+}
+
+function shuffle(arr) {
+  for (let i = arr.length - 1; i > 0; i--) {
+    const j = (Math.random() * (i + 1)) | 0;
+    [arr[i], arr[j]] = [arr[j], arr[i]];
+  }
+  return arr;
+}
+
+const WINDOW_PROP_MARKERS = [
+  "_Selenium_IDE_Recorder",
+  "_selenium",
+  "calledSelenium",
+  "__webdriverFunc",
+  "__lastWatirAlert",
+  "__lastWatirConfirm",
+  "__lastWatirPrompt",
+  "_WEBDRIVER_ELEM_CACHE",
+  "ChromeDriverw",
+  "awesomium",
+  "CefSharp",
+  "RunPerfTest",
+  "fmget_targets",
+  "geb",
+  "spawn",
+  "domAutomation",
+  "domAutomationController",
+  "wdioElectron",
+  "callPhantom",
+  "_phantom",
+  "__nightmare",
+  "nightmare",
+  "__playwright__binding__",
+  "__pwInitScripts",
+];
+const DOC_PROP_MARKERS = [
+  "__selenium_evaluate",
+  "selenium-evaluate",
+  "__selenium_unwrapped",
+  "__webdriver_script_fn",
+  "__driver_evaluate",
+  "__webdriver_evaluate",
+  "__fxdriver_evaluate",
+  "__driver_unwrapped",
+  "__webdriver_unwrapped",
+  "__fxdriver_unwrapped",
+  "__webdriver_script_func",
+  "__webdriver_script_function",
+];
+const ATTR_SUBSTRING_MARKERS = ["selenium", "webdriver", "driver"];
+const STACK_SUBSTRING_MARKERS = ["pptr:", "UtilityScript.", "PhantomJS"];
+const WINDOW_PREFIX_MARKERS = ["puppeteer_", "cdc_", "$cdc_"];
+const UA_TOKEN_MARKERS = [
+  "HeadlessChrome",
+  "PhantomJS",
+  "SlimerJS",
+  "headless",
+];
+const WEBGL_VENDOR_MARKER = "Brian Paul";
+const WEBGL_RENDERER_MARKER = "Mesa OffScreen";
+const PRODUCTSUB_GECKO = "20030107";
+const SEQUENTUM_MARKER = "Sequentum";
+
+function hashWith(seed) {
+  return (s) => {
+    let h = seed >>> 0;
+    for (let i = 0; i < s.length; i++) {
+      h ^= s.charCodeAt(i);
+      h = (h + (h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24)) >>> 0;
+    }
+    return h >>> 0;
+  };
+}
+
+function buildBlockChecks(b, id, hF, hSet, h) {
+  const winHashes = WINDOW_PROP_MARKERS.map(h);
+  const docHashes = DOC_PROP_MARKERS.map(h);
+  const attrSubHashes = ATTR_SUBSTRING_MARKERS.map(h);
+  const stackSubHashes = STACK_SUBSTRING_MARKERS.map(h);
+  const winPrefixHashes = WINDOW_PREFIX_MARKERS.map(h);
+  const uaTokHashes = UA_TOKEN_MARKERS.map(h);
+  const webglVendorHash = h(WEBGL_VENDOR_MARKER);
+  const webglRendererHash = h(WEBGL_RENDERER_MARKER);
+  const productSubGeckoHash = h(PRODUCTSUB_GECKO);
+  const sequentumHash = h(SEQUENTUM_MARKER);
+  
+  const checks = [];
+
+  checks.push(
+    `if (!${b}) { try { var d = Object.getOwnPropertyDescriptors(navigator); var __wh = ${h("webdriver")}; for (const k in d) { if (${hF}(k) === __wh) { ${b} = true; break; } } if (!${b}) { var p = Object.getPrototypeOf(navigator); while (p && !${b}) { for (const k of Object.getOwnPropertyNames(p)) { if (${hF}(k) === __wh) { try { if (navigator[k]) ${b} = true; } catch {} break; } } p = Object.getPrototypeOf(p); } } } catch { ${b} = true; } }`,
+  );
+
+  checks.push(
+    `if (!${b} && Object.getOwnPropertyNames(navigator).length !== 0) ${b} = true;`,
+  );
+
+  {
+    const a = rVar();
+    checks.push(
+      `if (!${b}) { var ${a} = ${JSON.stringify(winPrefixHashes)}; for (const k of Object.getOwnPropertyNames(window)) { for (var pl = 4; pl <= 5; pl++) { if (${hSet}(${a}, ${hF}(k.slice(0, pl)))) { ${b} = true; break; } } if (${b}) break; } }`,
+    );
+  }
+
+  {
+    const a = rVar();
+    checks.push(
+      `if (!${b}) { var ${a} = ${JSON.stringify(winHashes)}; for (const k of Object.getOwnPropertyNames(window)) { if (${hSet}(${a}, ${hF}(k))) { ${b} = true; break; } } }`,
+    );
+  }
+
+  {
+    const a = rVar();
+    checks.push(
+      `if (!${b}) { var ${a} = ${JSON.stringify(docHashes)}; for (const k of Object.getOwnPropertyNames(document)) { if (${hSet}(${a}, ${hF}(k))) { ${b} = true; break; } } }`,
+    );
+  }
+
+  {
+    const a = rVar();
+    checks.push(
+      `if (!${b}) { try { var ${a} = ${JSON.stringify(attrSubHashes)}; var an = document.documentElement.getAttributeNames(); for (const n of an) { for (const t of n.split(/[^a-z]+/i)) { if (t && ${hSet}(${a}, ${hF}(t.toLowerCase()))) { ${b} = true; break; } } if (${b}) break; } } catch { ${b} = true; } }`,
+    );
+  }
+
+  {
+    const a = rVar(),
+      st = rVar();
+    checks.push(
+      `if (!${b}) { try { var ${a} = ${JSON.stringify(stackSubHashes)}; var ${st} = (new Error()).stack || ''; for (var i = 0; i + 5 <= ${st}.length; i++) { for (var sl = 5; sl <= 14; sl++) { if (i + sl > ${st}.length) break; if (${hSet}(${a}, ${hF}(${st}.substr(i, sl)))) { ${b} = true; break; } } if (${b}) break; } } catch {} }`,
+    );
+  }
+
+  checks.push(
+    `if (!${b}) { try { if (typeof window.exposedFn !== 'undefined') { var s = window.exposedFn.toString(); for (var i = 0; i + 19 <= s.length; i++) { if (${hF}(s.substr(i, 19)) === ${h("exposeBindingHandle")}) { ${b} = true; break; } } } } catch {} }`,
+  );
+
+  checks.push(
+    `if (!${b} && typeof window.process !== 'undefined') { try { if (${hF}(window.process.type || '') === ${h("renderer")} || (window.process.versions && window.process.versions.electron)) ${b} = true; } catch { ${b} = true; } }`,
+  );
+
+  {
+    const a = rVar();
+    checks.push(
+      `if (!${b}) { try { var ${a} = ${JSON.stringify(uaTokHashes)}; var ua = navigator.userAgent || ''; for (const t of ua.split(/[\\s/(),;]/)) { if (t && ${hSet}(${a}, ${hF}(t))) { ${b} = true; break; } } if (!${b}) { var av = navigator.appVersion || ''; for (const t of av.split(/[\\s/(),;]/)) { if (t && ${hSet}(${a}, ${hF}(t))) { ${b} = true; break; } } } } catch {} }`,
+    );
+  }
+
+  checks.push(
+    `if (!${b}) { try { var c = document.createElement('canvas').getContext('webgl'); if (c) { var v = c.getParameter(c.VENDOR); var r = c.getParameter(c.RENDERER); if (${hF}(v || '') === ${webglVendorHash} && ${hF}(r || '') === ${webglRendererHash}) ${b} = true; } } catch {} }`,
+  );
+
+  checks.push(
+    `if (!${b}) { try { if (document.hasFocus && document.hasFocus() && window.outerWidth === 0 && window.outerHeight === 0) ${b} = true; } catch { ${b} = true; } }`,
+  );
+
+  checks.push(
+    `if (!${b}) { try { var es = Function.prototype.toString.call(eval); var found = false; for (var i = 0; i + 13 <= es.length; i++) { if (${hF}(es.substr(i, 13)) === ${h("[native code]")}) { found = true; break; } } if (!found) ${b} = true; } catch {} }`,
+  );
+
+  checks.push(
+    `if (!${b}) { try { if (typeof Function.prototype.bind === 'undefined') ${b} = true; } catch {} }`,
+  );
+
+  checks.push(
+    `if (!${b}) { try { if (window.external && typeof window.external.toString === 'function') { var s = window.external.toString(); for (var i = 0; i + 9 <= s.length; i++) { if (${hF}(s.substr(i, 9)) === ${sequentumHash}) { ${b} = true; break; } } } } catch { ${b} = true; } }`,
+  );
+
+  {
+    const ok = rVar(),
+      i = rVar();
+    checks.push(
+      `if (!${b}) { try { if (navigator.mimeTypes) { var ${ok} = Object.getPrototypeOf(navigator.mimeTypes) === MimeTypeArray.prototype; for (var ${i} = 0; ${i} < navigator.mimeTypes.length && ${ok}; ${i}++) { ${ok} = Object.getPrototypeOf(navigator.mimeTypes[${i}]) === MimeType.prototype; } if (!${ok}) ${b} = true; } } catch {} }`,
+    );
+  }
+
+  {
+    const ua = rVar(),
+      ps = rVar();
+    checks.push(
+      `if (!${b}) { try { var ${ps} = navigator.productSub; var ${ua} = navigator.userAgent || ''; if (${ps} && ${hF}(${ps}) !== ${productSubGeckoHash}) { var likeBlink = false; for (const t of ${ua}.toLowerCase().split(/[\\s/(),;]/)) { var hh = ${hF}(t); if (hh === ${h("chrome")} || hh === ${h("safari")} || hh === ${h("opera")}) { likeBlink = true; break; } } if (likeBlink) ${b} = true; } } catch {} }`,
+    );
+  }
+
+  {
+    const k = rVar();
+    checks.push(
+      `if (!${b}) { try { var ${k} = Object.getOwnPropertyNames(window); for (const n of ${k}) { var u = n.lastIndexOf('_'); if (u > 3 && u < n.length - 1) { var suf = n.slice(u + 1); var hh = ${hF}(suf); if (hh === ${h("Array")} || hh === ${h("Promise")} || hh === ${h("Symbol")}) { ${b} = true; break; } } } } catch {} }`,
+    );
+  }
+
+  shuffle(checks);
+  const sampled = checks.slice(0, Math.min(checks.length, 8));
+
+  return `let ${b} = false;try {${sampled.join("")}} catch {${b} = true} if (${b}) {parent.postMessage({ type: 'cap:instr', nonce: ${JSON.stringify(id)}, result: '', blocked: true }, '*');return;}`;
+}
+
+function buildClientScript({
+  id,
+  vars,
+  initVals,
+  clientEqs,
+  blockAutomatedBrowsers,
+}) {
+  const seed = randomInt(1, 0x7fffffff);
+  const h = hashWith(seed);
+  const hF = rVar();
+  const hSet = rVar();
+  const evalLocalVar = rVar();
+  const evalSecret = randomInt(1_000_000, 0x7fffffff);
+  const evalA = rVar();
+  const evalB = rVar();
+  const evalC = rVar();
+  const helpers =
+    `function ${hF}(s){let h=${seed}>>>0;for(let i=0;i<s.length;i++){h^=s.charCodeAt(i);h=(h+(h<<1)+(h<<4)+(h<<7)+(h<<8)+(h<<24))>>>0;}return h>>>0;}` +
+    `function ${hSet}(a,v){for(var i=0;i<a.length;i++)if(a[i]===v)return true;return false;}`;
+
+  const blockChecks = blockAutomatedBrowsers
+    ? buildBlockChecks(rVar(), id, hF, hSet, h)
+    : "";
+
+  const dvKey = rVar();
+  const nKey = rVar();
+  const outKey = rVar();
+
+  const envChecks = [
+    `try { const ${nKey}st = (new Error()).stack || ''; if (${nKey}st.indexOf('node:internal') !== -1 || ${nKey}st.indexOf('moduleEvaluation') !== -1 || ${nKey}st.indexOf('loadAndEvaluateModule') !== -1 || ${nKey}st.indexOf('file:///') !== -1 || ${nKey}st.indexOf('[eval]') !== -1 || /\\(native:/.test(${nKey}st)) return null; } catch { return null }`,
+
+    `if (typeof HTMLElement !== 'function' || typeof Window !== 'function' || typeof Document !== 'function' || typeof Navigator !== 'function' || typeof Node !== 'function') return null; if (!(navigator instanceof Navigator) || !(document instanceof Document) || !(window instanceof Window) || !(document.body instanceof HTMLElement)) return null; if (globalThis !== window || window.self !== window || document.defaultView !== window) return null;`,
+
+    `try { const ${nKey}ots = Object.prototype.toString; if (${hF}(${nKey}ots.call(navigator)) !== ${h("[object Navigator]")} || ${hF}(${nKey}ots.call(window)) !== ${h("[object Window]")} || ${hF}(${nKey}ots.call(document)) !== ${h("[object HTMLDocument]")}) return null; } catch { return null }`,
+
+    `try { if (typeof EventTarget !== 'function' || !(document.body instanceof EventTarget) || !(window instanceof EventTarget)) return null; const ${nKey}probe = document.createElement('div'); let ${nKey}fired = 0; const ${nKey}ev = '_c' + (Date.now() & 0xffff).toString(36); const ${nKey}h = (e) => { if (e && e.detail === 0xc0de) ${nKey}fired++; }; ${nKey}probe.addEventListener(${nKey}ev, ${nKey}h); ${nKey}probe.dispatchEvent(new CustomEvent(${nKey}ev, { detail: 0xc0de })); ${nKey}probe.dispatchEvent(new CustomEvent(${nKey}ev, { detail: 0xc0de })); ${nKey}probe.removeEventListener(${nKey}ev, ${nKey}h); ${nKey}probe.dispatchEvent(new CustomEvent(${nKey}ev, { detail: 0xc0de })); if (${nKey}fired !== 2) return null; } catch { return null }`,
+
+    `try { const ${nKey}gf = new Function('return this'); const ${nKey}tg = ${nKey}gf(); if (${nKey}tg !== globalThis) return null; const ${nKey}leakHashes = ${JSON.stringify(["Bun", "process", "module", "require", "global", "__dirname", "Deno"].map(h))}; for (const ${nKey}k of Object.getOwnPropertyNames(${nKey}tg)) { if (${hSet}(${nKey}leakHashes, ${hF}(${nKey}k))) return null; } const ${nKey}fnArgs = new Function('a','b','c','return a+b+c'); if (${nKey}fnArgs.length !== 3) return null; if (${nKey}fnArgs(10,20,30) !== 60) return null; const ${nKey}src = Function.prototype.toString.call(${nKey}fnArgs); if (${nKey}src.indexOf('return a+b+c') === -1) return null; if (${nKey}src.indexOf('apply') !== -1 || ${nKey}src.indexOf('callArgs') !== -1 || ${nKey}src.indexOf('Reflect.') !== -1) return null; let ${nKey}thrown = null; try { new Function('throw new Error("x")')(); } catch (${nKey}e) { ${nKey}thrown = ${nKey}e; } if (!${nKey}thrown || !${nKey}thrown.stack) return null; const ${nKey}st2 = ${nKey}thrown.stack; if (${nKey}st2.indexOf('node:internal') !== -1 || ${nKey}st2.indexOf('moduleEvaluation') !== -1 || ${nKey}st2.indexOf('file:///') !== -1 || ${nKey}st2.indexOf('[eval]') !== -1 || /\\(native:/.test(${nKey}st2)) return null; } catch { return null }`,
+
+    `try { const ${nKey}ie = (0, eval); const ${nKey}eg = ${nKey}ie('this'); if (${nKey}eg !== globalThis) return null; const ${nKey}leak2 = ${JSON.stringify(["Bun", "process", "require", "global", "__dirname", "Deno"].map(h))}; for (const ${nKey}k of Object.getOwnPropertyNames(${nKey}eg)) { if (${hSet}(${nKey}leak2, ${hF}(${nKey}k))) return null; } } catch { return null }`,
+
+    `try { var ${evalLocalVar} = ${evalSecret}; var ${evalA} = '${evalLocalVar.slice(0, 2)}'; var ${evalB} = '${evalLocalVar.slice(2)}'; var ${evalC} = ${evalA} + ${evalB}; var ${evalLocalVar}r1 = (0, eval)('typeof ' + ${evalC}); if (${evalLocalVar}r1 !== 'undefined') return null; var ${evalLocalVar}r2 = eval(${evalC}); if (${evalLocalVar}r2 !== ${evalSecret}) return null; var ${evalLocalVar}r3 = eval(${evalA} + ${evalB} + '+1'); if (${evalLocalVar}r3 !== ${evalSecret + 1}) return null; var ${evalLocalVar}arr = ['(', '(', ')', '=', '>', 't', 'h', 'i', 's', ')', '(', ')']; var ${evalLocalVar}arrow = (0, eval)(${evalLocalVar}arr.join('')); if (${evalLocalVar}arrow !== globalThis) return null; var ${evalLocalVar}r4 = eval('(function(){return ' + ${evalC} + '*2;})()'); if (${evalLocalVar}r4 !== ${evalSecret * 2}) return null; } catch { return null }`,
+  ];
+
+  return `(function(){window.onload=async function(){try {${helpers}const ${dvKey}=await (async function(){${shuffle(envChecks).join("")}${blockChecks}
+      var ${vars[0]}=${initVals[0]};var ${vars[1]}=${initVals[1]};var ${vars[2]}=${initVals[2]};var ${vars[3]}=${initVals[3]};${clientEqs}
+      var ${outKey}={};${outKey}["${vars[0]}"]=${vars[0]};${outKey}["${vars[1]}"]=${vars[1]};${outKey}["${vars[2]}"]=${vars[2]};${outKey}["${vars[3]}"]=${vars[3]};return ${outKey};})();if (!${dvKey} || typeof ${dvKey} !== 'object') return;parent.postMessage({type: 'cap:instr',nonce:${JSON.stringify(id)},result:{i:${JSON.stringify(id)},state:${dvKey},ts:Date.now()}},'*');} catch {}};})();`;
+}
+
+const DEFAULT_TTL_MS = 5 * 60 * 1000;
+
+export async function generateInstrumentation(opts = {}) {
+  const id = rHex(32);
+  const vars = Array.from({ length: 4 }, () => rVar(12));
+  const blockAutomatedBrowsers = opts.blockAutomatedBrowsers === true;
+
+  const initVals = [
+    fastRnd(10, 250),
+    fastRnd(10, 250),
+    fastRnd(10, 250),
+    fastRnd(10, 250),
+  ];
+  const vals = [...initVals];
+
+  const correctKey = fastRnd(1000, 9000);
+  let badKey = fastRnd(1000, 9000);
+  while (badKey === correctKey) {
+    badKey = fastRnd(1000, 9000);
+  }
+
+  vals[0] = toInt32(vals[0] ^ correctKey);
+
+  const fnHelper = rVar();
+  const domHelper = rVar();
+  const helperDecls =
+    `function ${fnHelper}(a,b,c){function F(d){this.v=function(){return this.k^d;}};var p={k:c};var i=new F(a);i.k=b;F.prototype=p;return i.v()|(new F(b)).v();}` +
+    `function ${domHelper}(x,y,z){var d=document.createElement('div');d.style.display='none';document.body.appendChild(d);function A(p,v){for(var i=0;i<8;i++){var c=document.createElement('div');p.appendChild(c);c.innerText=v;if((v&1)==0)p=c;v=v>>1;}return p;}function B(n,r,s){if(!n||n==r)return s%256;while(n.children.length>0)n.removeChild(n.lastElementChild);return B(n.parentNode,r,s+parseInt(n.innerText));}var s=B(A(A(A(d,x),y),z),d,0);d.parentNode.removeChild(d);return s;}`;
+
+  let clientEqs = `${helperDecls}${vars[0]} = ${vars[0]} ^ (navigator.userAgent ? ${correctKey} : ${badKey});`;
+
+  for (let i = 0; i < 20; i++) {
+    const op = fastRnd(0, 5);
+    const dest = fastRnd(0, 3);
+    const src1 = fastRnd(0, 3);
+    const src2 = fastRnd(0, 3);
+    const src3 = fastRnd(0, 3);
+    const vD = vars[dest];
+    const vS1 = vars[src1];
+    const vS2 = vars[src2];
+    const vS3 = vars[src3];
+
+    if (op === 0) {
+      clientEqs += `${vD} = ~(${vD} & ${vS1});`;
+      vals[dest] = toInt32(~(vals[dest] & vals[src1]));
+    } else if (op === 1) {
+      clientEqs += `${vD} = ${vD} ^ ${vS1};`;
+      vals[dest] = toInt32(vals[dest] ^ vals[src1]);
+    } else if (op === 2) {
+      clientEqs += `${vD} = ${vD} | ${vS1};`;
+      vals[dest] = toInt32(vals[dest] | vals[src1]);
+    } else if (op === 3) {
+      clientEqs += `${vD} = ${vD} & ${vS1};`;
+      vals[dest] = toInt32(vals[dest] & vals[src1]);
+    } else if (op === 4) {
+      clientEqs += `${vD} = ${fnHelper}(${vS1}, ${vS2}, ${vD});`;
+      vals[dest] = toInt32(
+        (vals[src2] ^ vals[src1]) | (vals[dest] ^ vals[src2]),
+      );
+    } else {
+      clientEqs += `${vD} = ${domHelper}(${vS1}, ${vS2}, ${vS3});`;
+      vals[dest] = toInt32(domSumMock(vals[src1], vals[src2], vals[src3]));
+    }
+  }
+
+  const salts = [
+    fastRnd(100_000, 999_999),
+    fastRnd(100_000, 999_999),
+    fastRnd(100_000, 999_999),
+    fastRnd(100_000, 999_999),
+  ];
+  for (let i = 0; i < 4; i++) {
+    clientEqs += `${vars[i]}=((${vars[i]}^${salts[i]})&0x7FFFFFFF)%900000+100000;`;
+    vals[i] = (((vals[i] ^ salts[i]) & 0x7fffffff) % 900_000) + 100_000;
+  }
+
+  const script = buildClientScript({
+    id,
+    vars,
+    initVals,
+    clientEqs,
+    blockAutomatedBrowsers,
+  });
+
+  const level = Math.max(1, Math.min(10, opts.obfuscationLevel ?? 3));
+
+  let finalScript;
+  if (level <= 3) {
+    finalScript = script.replace(/\n\s*/g, "\n").replace(/^\s+/gm, "");
+  } else if (level <= 7) {
+    const s = customObfuscateStrings(script);
+    const esbuild = await getEsbuild();
+    if (esbuild) {
+      const out = await esbuild.transform(s, {
+        minify: true,
+        legalComments: "none",
+        target: "es2018",
+      });
+      finalScript = out.code;
+    } else {
+      finalScript = s.replace(/\n\s*/g, "\n").replace(/^\s+/gm, "");
+    }
+  } else {
+    const obfuscator = await getObfuscator();
+    if (!obfuscator) {
+      let s = customObfuscateStrings(script);
+      const esbuild = await getEsbuild();
+      if (esbuild) {
+        const out = await esbuild.transform(s, {
+          minify: true,
+          legalComments: "none",
+          target: "es2018",
+        });
+        s = out.code;
+      }
+      finalScript = s;
+    } else {
+      const opts2 = {
+        compact: true,
+        ignoreRequireImports: true,
+        identifierNamesGenerator: "mangled-shuffled",
+        stringArray: true,
+        stringArrayThreshold: 0.75,
+        stringArrayEncoding: level >= 8 ? ["rc4"] : ["base64"],
+        splitStrings: true,
+        splitStringsChunkLength: randomInt(3, 16),
+        controlFlowFlattening: true,
+        controlFlowFlatteningThreshold: level >= 9 ? 0.75 : 0.4,
+        deadCodeInjection: true,
+        deadCodeInjectionThreshold: level >= 9 ? 0.3 : 0.1,
+        selfDefending: level >= 9,
+        debugProtection: level >= 10,
+        disableConsoleOutput: level >= 10,
+      };
+
+      finalScript = obfuscator.obfuscate(script, opts2).getObfuscatedCode();
+    }
+  }
+
+  const compressed = deflateRawSync(Buffer.from(finalScript, "utf8"), {
+    level: 1,
+  });
+
+  const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+
+  return {
+    id,
+    expires: Date.now() + ttlMs,
+    expectedVals: vals,
+    vars,
+    blockAutomatedBrowsers,
+    instrumentation: Buffer.from(compressed).toString("base64"),
+  };
+}
+
+export function verifyInstrumentationResult(challengeMeta, payload) {
+  if (!challengeMeta || typeof challengeMeta !== "object") {
+    return { valid: false, reason: "missing_meta" };
+  }
+  if (!payload || typeof payload !== "object") {
+    return { valid: false, reason: "missing_output" };
+  }
+
+  if (payload.i !== challengeMeta.id) {
+    return { valid: false, reason: "id_mismatch" };
+  }
+
+  const actual = payload.state;
+  if (!actual || typeof actual !== "object") {
+    return { valid: false, reason: "invalid_state" };
+  }
+
+  if (
+    !Array.isArray(challengeMeta.vars) ||
+    !Array.isArray(challengeMeta.expectedVals)
+  ) {
+    return { valid: false, reason: "invalid_meta" };
+  }
+
+  const match = challengeMeta.vars.every(
+    (v, i) => actual[v] === challengeMeta.expectedVals[i],
+  );
+
+  if (!match) {
+    return { valid: false, reason: "failed_challenge" };
+  }
+
+  return { valid: true };
+}

package/src/prng.js

@@ -0,0 +1,37 @@
+function fnv1a(str) {
+  let hash = 2166136261;
+  for (let i = 0; i < str.length; i++) {
+    hash ^= str.charCodeAt(i);
+    hash +=
+      (hash << 1) + (hash << 4) + (hash << 7) + (hash << 8) + (hash << 24);
+  }
+  return hash >>> 0;
+}
+
+export function fnv1aResume(state, str) {
+  let h = state;
+  for (let i = 0; i < str.length; i++) {
+    h ^= str.charCodeAt(i);
+    h += (h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24);
+  }
+  return h >>> 0;
+}
+
+export function prng(seed, length) {
+  return prngFromHash(fnv1a(seed), length);
+}
+
+export function prngFromHash(initialHash, length) {
+  let state = initialHash;
+  let result = "";
+  while (result.length < length) {
+    state ^= state << 13;
+    state ^= state >>> 17;
+    state ^= state << 5;
+    state >>>= 0;
+    result += state.toString(16).padStart(8, "0");
+  }
+  return result.substring(0, length);
+}
+
+export { fnv1a };