capjs-core 0.1.2 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capjs-core",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Stateless server-side challenge generator and verifier for Cap, a lightweight, modern open-source CAPTCHA alternative. No storage, no filesystem - bring your own.",
   "keywords": [
     "anti-abuse",
@@ -40,9 +40,12 @@
     "src/index.js",
     "src/index.d.ts",
     "src/instrumentation.js",
+    "src/detect.js",
     "src/prng.js",
     "src/crypto.js",
     "src/rsw.js",
+    "src/hashwx.js",
+    "src/hashwx-wasm.js",
     "README.md",
     "LICENSE"
   ],

package/src/detect.js

@@ -0,0 +1,199 @@
+const MOBILE_UA =
+  /Android|iPhone|iPad|iPod|IEMobile|BlackBerry|Mobile Safari|; Mobile|Silk|Kindle|Tizen|Opera Mini/i;
+
+const MAX_FONT_WIDTHS = 64;
+const MAX_TAMPER_KEYS = 8;
+const MAX_TAMPER_KEY_LENGTH = 32;
+const MAX_DETAIL_FIELDS = 6;
+const OUTER_HEIGHT_SLACK = 16;
+
+const isNum = (x) => typeof x === "number" && Number.isFinite(x);
+const isPlainObject = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+
+const PROBE_FIELD_TYPES = {
+  ua: "string",
+  productSub: "string",
+  oscpu: "string",
+  uaDataPresent: "boolean",
+  uaData: "nullableObject",
+  plugins: "object",
+  engine: "object",
+  screen: "object",
+  outerWH: "array",
+  isExtended: "nullableBoolean",
+  fontWidths: "array",
+  tamper: "nullableObject",
+};
+
+const typeOk = (value, kind) => {
+  if (kind === "string") return typeof value === "string";
+  if (kind === "boolean") return typeof value === "boolean";
+  if (kind === "object") return isPlainObject(value);
+  if (kind === "array") return Array.isArray(value);
+  if (kind === "nullableObject") return value === null || isPlainObject(value);
+  if (kind === "nullableBoolean")
+    return value === null || typeof value === "boolean";
+  return false;
+};
+
+export function isMobileVector(S) {
+  if (S?.uaData?.mobile === true) return true;
+  return MOBILE_UA.test(String(S?.ua || ""));
+}
+
+export function probeCompleteness(S, fontStackCount) {
+  if (!isPlainObject(S)) return ["probe"];
+  const bad = [];
+  for (const field of Object.keys(PROBE_FIELD_TYPES)) {
+    if (!typeOk(S[field], PROBE_FIELD_TYPES[field])) bad.push(field);
+  }
+  if (
+    Array.isArray(S.fontWidths) &&
+    isNum(fontStackCount) &&
+    S.fontWidths.length !== fontStackCount
+  ) {
+    bad.push("fontWidths.length");
+  }
+  return bad;
+}
+
+export function geometryStats(fontWidths) {
+  const w = (Array.isArray(fontWidths) ? fontWidths : [])
+    .slice(0, MAX_FONT_WIDTHS)
+    .filter(isNum);
+  if (w.length < 6) return null;
+  let count = 0;
+  const distinct = new Set();
+  for (const x of w) {
+    if (Math.trunc(x) === x) {
+      count++;
+      distinct.add(x);
+    }
+  }
+  return { count, distinct: distinct.size, n: w.length };
+}
+
+export function detectAutomation(S, opts = {}) {
+  if (!S || typeof S !== "object") {
+    return {
+      pass: false,
+      checks: [],
+      blockedBy: ["probe_missing"],
+      riskFlags: [],
+    };
+  }
+
+  const checks = [];
+  const add = (id, passed, detail, gating = true) =>
+    checks.push({ id, passed: passed !== false, detail, gating });
+
+  const incomplete = probeCompleteness(S, opts.fontStackCount);
+  add(
+    "probe_incomplete",
+    incomplete.length === 0,
+    incomplete.length
+      ? `missing or malformed: ${incomplete.slice(0, MAX_DETAIL_FIELDS).join(", ")}`
+      : "all fields present",
+  );
+
+  const gecko =
+    S.engine?.hasMozInnerScreenX === true ||
+    (S.productSub === "20100101" && S.uaDataPresent === false) ||
+    (typeof S.oscpu === "string" && S.oscpu !== "__undefined");
+  const chromium = S.uaDataPresent === true || S.engine?.hasChrome === true;
+  const mobile = isMobileVector(S);
+
+  const geo = geometryStats(S.fontWidths);
+  const quantized = !!geo && geo.count >= 5 && geo.distinct >= 3;
+  add(
+    "geometry_quantized",
+    !quantized,
+    geo
+      ? `${geo.count}/${geo.n} whole-px, ${geo.distinct} distinct`
+      : "not measured",
+  );
+
+  add(
+    "webdriver_true",
+    S.webdriver !== true,
+    `webdriver=${String(S.webdriver)}`,
+  );
+
+  const stripped = chromium && S.webdriver === undefined;
+  add(
+    "webdriver_stripped",
+    !stripped,
+    chromium ? (stripped ? "removed" : "ok") : "not a chromium engine",
+  );
+
+  const contradiction =
+    gecko && (isNum(S.deviceMemory) || S.uaDataPresent === true);
+  add("gecko_contradiction", !contradiction, gecko ? "gecko engine" : "n/a");
+
+  const sc = S.screen || {};
+  const ow = Array.isArray(S.outerWH) ? S.outerWH : [];
+  const iw = Array.isArray(S.innerWH) ? S.innerWH : [];
+  const singleMonitor = S.isExtended === false;
+  const outerTaller =
+    isNum(ow[1]) && isNum(sc.height) && ow[1] > sc.height + OUTER_HEIGHT_SLACK;
+  const exceeds = outerTaller && singleMonitor;
+  add(
+    "window_exceeds_screen",
+    !exceeds,
+    singleMonitor
+      ? exceeds
+        ? `outerHeight ${ow[1]} > screen.height ${sc.height}`
+        : "ok"
+      : "monitor layout unknown",
+  );
+
+  const viewportIsScreen =
+    !mobile &&
+    isNum(iw[0]) &&
+    isNum(iw[1]) &&
+    iw[0] === sc.width &&
+    iw[1] === sc.height &&
+    isNum(ow[1]) &&
+    ow[1] > iw[1];
+  add(
+    "viewport_override",
+    !viewportIsScreen,
+    viewportIsScreen
+      ? `viewport ${iw[0]}x${iw[1]} == screen, window ${ow[1]} tall`
+      : "ok",
+  );
+
+  const brands = Array.isArray(S.uaData?.brands)
+    ? S.uaData.brands.join(" ")
+    : "";
+  const headless =
+    /headlesschrome/i.test(brands) ||
+    /headlesschrome/i.test(String(S.ua || ""));
+  add(
+    "headless_token",
+    !headless,
+    headless ? "HeadlessChrome present" : "absent",
+  );
+
+  const t = isPlainObject(S.tamper) ? S.tamper : {};
+  const tampered = Object.keys(t).filter((k) => t[k] === false);
+  add(
+    "native_tamper",
+    tampered.length === 0,
+    tampered.length
+      ? `JS-overridden: ${tampered
+          .slice(0, MAX_TAMPER_KEYS)
+          .map((k) => String(k).slice(0, MAX_TAMPER_KEY_LENGTH))
+          .join(", ")}`
+      : "native",
+    false,
+  );
+
+  const failed = checks.filter((c) => c.gating && !c.passed);
+  return {
+    pass: failed.length === 0,
+    checks,
+    blockedBy: failed.map((c) => c.id),
+    riskFlags: checks.filter((c) => !c.gating && !c.passed).map((c) => c.id),
+  };
+}

package/src/hashwx-wasm.js

@@ -0,0 +1,185 @@
+// Generated by scripts/vendor-hashwx.mjs. Do not edit.
+// Source: https://github.com/tevador/hashwx @ 74b567a31276a4c5d7cb232a5b7639467f49f961
+// Built with emcc, lowered to WebAssembly 1.0 (MVP).
+// sha256: b1a0dbb3ef444d3c7069e0a5e0a0273ffa4cf8fef62cbbe43761c02f7cd6aff5
+// bytes:  12541
+
+export const HASHWX_WASM_SHA256 =
+  "b1a0dbb3ef444d3c7069e0a5e0a0273ffa4cf8fef62cbbe43761c02f7cd6aff5";
+
+export const HASHWX_WASM_BASE64 =
+  "AGFzbQEAAAABPwxgAX8Bf2ABfwBgAABgAn9/AGACf34BfmACf34AYAF/AX5gBH9/f38AYAN/f34AYAJ/fwF/YAABf2ADf39/" +
+  "AAMaGQIBAAEDBAAAAAAABQYDBwgBAgAACQEBCgsEBQFwAQICBQYBAYICggIGCAF/AUHgpQQLB6YCEAZtZW1vcnkCAAxoYXNo" +
+  "d3hfYWxsb2MAAgtoYXNod3hfZnJlZQADC2hhc2h3eF9tYWtlAAQLaGFzaHd4X2V4ZWMABQtoYXNod3hfc2VlZAAGEGhhc2h3" +
+  "eF9yZWdpc3RlcnMABw1oYXNod3hfbWVtb3J5AAgNaGFzaHd4X21vZHVsZQAJEmhhc2h3eF9tb2R1bGVfc2l6ZQAKEWhhc2h3" +
+  "eF9leGVjX2JlZ2luAAsRaGFzaHd4X2V4ZWNfZmluYWwADAtfaW5pdGlhbGl6ZQARGV9faW5kaXJlY3RfZnVuY3Rpb25fdGFi" +
+  "bGUBABlfZW1zY3JpcHRlbl9zdGFja19yZXN0b3JlABYcZW1zY3JpcHRlbl9zdGFja19nZXRfY3VycmVudAAXCQcBAEEBCwEA" +
+  "CrhJGTQBA38DQCAAQQR0IgEgAUHQHWoiAjYC1B0gASACNgLYHSAAQQFqIgBBwABHDQALQTAQEhoLCQAgACgCABAVC4sBAQF/" +
+  "AkBBiIEBEBMiAUUNACABQQA2AgAgAEEBcQRAIAFBtNgAEBMiADYCACAARQ0BIAFBATYCBCABDwsgAUGALBATIgA2AgAgAEUN" +
+  "ACABQQA2AgQgAQ8LIAFBAWtBfU0EQAJAIAEoAgAiAEUNACABLQAEQQFxBEAgARABDAELIAAQFQsgARAVC0EACzUBAX8gAEEB" +
+  "a0F9TQRAAkAgACgCACIBRQ0AIAAtAARBAXEEQCAAEAEMAQsgARAVCyAAEBULC/gMAQV/IwBBoCxrIgMkACADIAEpAAA3A4As" +
+  "IAMgASkACDcDiCwgAyABKQAQNwOQLCADIAEpABg3A5gsIANBkCxqIQECQCAALQAEQQFxBEAgA0GALGogAxANIAAgASkDCDcD" +
+  "ECAAIAEpAwA3AwggACgCACIAQYAIQZMBEBggAEHCgITZADYAmQEgAEGDgAE7AJcBIABBwoiE8QA2AJMBIABBnQFqIQEDQCAB" +
+  "QYOAATsAACABQQJqIQAgAyAEQbABbGohBkEAIQUDQAJAAkACQAJAAkACQAJAIAYgBUEEdGoiASgCAEEDaw4OAQICAgICAgIC" +
+  "AgMEBQYACyAAQSA6AAAgAS0ACCECIABBwgA6AAIgACACQQJqOgABIAAgASgCDDoAAyABKAIAIQIgAEEgOgAFIAAgAi0A2Qk6" +
+  "AAQgAS0ABCECIABB/sIAOwAHIAAgAkECajoABiAAIAEtAAhBAmo6AAkgAEEKaiEADAULIABBIDoAACABLQAIIQIgAEEgOgAC" +
+  "IAAgAkECajoAASABLQAEIQIgAEH+hAE7AAQgACACQQJqOgADIAEoAgwhAiAAQYrFADsAByAAIAI6AAYgAS0ACCEBIABBoRg7" +
+  "AAogACABQQJqOgAJIABBDGohAAwECyAAQSA6AAAgAS0ACCECIABBwgA6AAIgACACQQJqOgABIAAgASgCDDoAAyABKAIAIQIg" +
+  "AEEgOgAFIAAgAi0A2Qk6AAQgACABLQAEQQJqOgAGIAEoAgAhAiAAQSE6AAggACACLQDmCToAByAAIAEtAAhBAmo6AAkgAEEK" +
+  "aiEADAMLIABBjQopAAA3AA0gAEGICikDADcACCAAQYAKKQMANwAAIABBFWohAAwCCyAAQbAKLwEAOwAQIABBqAopAwA3AAgg" +
+  "AEGgCikDADcAACAAQRJqIQAMAQsgAEH4CikDADcAOCAAQfAKKQMANwAwIABB6AopAwA3ACggAEHgCikDADcAICAAQdgKKQMA" +
+  "NwAYIABB0AopAwA3ABAgAEHICikDADcACCAAQcAKKQMANwAAIABBQGshAAsgBUEBaiIFQQtHDQALIABBCzoAACAAQQFqIQEg" +
+  "BEEBaiIEQSBHDQALIAFBmAkpAAA3AAUgAUGTCSkAADcAACAAQcKAhNkANgAUIABBg4ABOwASIABBwoiE8QA2AA4gAEEYaiEB" +
+  "QQAhBANAIAFBg4ABOwAAIAFBAmohACADIARBsAFsaiEGQQAhBQNAAkACQAJAAkACQAJAIAYgBUEEdGoiASgCAEEDaw4OAQIC" +
+  "AgICAgICAgMEBQUACyABLQAEIQIgAEEgOgAMIABBADsACiAAQqCajLyKpIC1KTcAAiAAQSA6AAAgACACQQJqOgABIAEtAAgh" +
+  "AiAAQcIAOgAOIAAgAkECajoADSAAIAEoAgw6AA8gASgCACECIABB/sIAOwARIAAgAi0A2Qk6ABAgACABLQAIQQJqOgATIABB" +
+  "FGohAAwECyAAQSA6AAAgAS0ACCECIABBIDoAAiAAIAJBAmo6AAEgAS0ABCECIABB/oQBOwAEIAAgAkECajoAAyABKAIMIQIg" +
+  "AEGKxQA7AAcgACACOgAGIAEtAAghASAAQaEYOwAKIAAgAUECajoACSAAQQxqIQAMAwsgAEEgOgAAIAEtAAghAiAAQcIAOgAC" +
+  "IAAgAkECajoAASAAIAEoAgw6AAMgACABKAIALQDZCToABCABLQAEIQIgAEEAOwAPIABCoJqMvIqkgLUpNwAHIABBIDoABSAA" +
+  "IAJBAmo6AAYgASgCACECIABBIToAEiAAIAItAOYJOgARIAAgAS0ACEECajoAEyAAQRRqIQAMAgsgAEGNCikAADcADSAAQYgK" +
+  "KQMANwAIIABBgAopAwA3AAAgAEEVaiEADAELIABBsAovAQA7ABAgAEGoCikDADcACCAAQaAKKQMANwAAIABBEmohAAsgBUEB" +
+  "aiIFQQtHDQALIABBCzoAACAAQQFqIQEgBEEBaiIEQSBHDQALIAFBmAkpAAA3AAUgAUGTCSkAADcAACAAQaAJKQMANwAOIABB" +
+  "qAkpAwA3ABYgAEGwCSkDADcAHiAAQbgJKQMANwAmIABBwAkpAwA3AC4gAEHICSkDADcANiAAQdAJKQMANwA+IABB2AktAAA6" +
+  "AEYMAQsgA0GALGogACgCABANIAAgASkDCDcDECAAIAEpAwA3AwgLIANBoCxqJAAL0hUCDH8HfiMAQZABayIDJAAgA0EIaiIF" +
+  "IABBCGogARAPIANBGGohBgJAAkACQAJAAkACQAJAAkACQAJAAkACQCADKAI4IgRFBEAgBRAQIAMgAykDMCIBNwNAQQIhBQwB" +
+  "CyADIARBAWsiAjYCOEEDIQUgAyAGIAJBA3RqKQMAIgE3A0AgAg0BIANBCGoQEAsgAyAGIAVBA3RqKQMANwNIDAELIAMgBEEC" +
+  "ayIFNgI4IAMgA0EIaiAEQQN0aikDADcDSCAFRQ0BCyADIAVBAWsiAjYCOEEDIQQgAyAGIAJBA3RqKQMANwNQIAJFBEAgA0EI" +
+  "ahAQDAMLIAMgBUECayIENgI4IAMgA0EIaiAFQQN0aikDADcDWCAERQ0BDAMLIANBCGoQECADIAMpAzA3A1BBAiEEDAELIANB" +
+  "CGoQECADIAMpAzAiDzcDYEECIQUMAgsgAyAGIARBA3RqKQMANwNYCyADIARBAWsiAjYCOEEDIQUgAyAGIAJBA3RqKQMAIg83" +
+  "A2AgAg0BIANBCGoQEAsgAyAGIAVBA3RqKQMANwNoDAELIAMgBEECayIFNgI4IAMgA0EIaiAEQQN0aikDADcDaCAFRQ0BCyAD" +
+  "IAVBAWsiBTYCOCADIAYgBUEDdGopAwA3A3AgBQ0BIANBCGoQEEEEIQUMAQsgA0EIahAQIAMgAykDMDcDcEEDIQULIAMgBUEB" +
+  "ayIFNgI4IAYgBUEDdGopAwAhDiADIAEgD4VCeINCA4Q3A4ABIAMgDjcDeEIAIQEgAC0ABEEBcUUEQCAAKAIAIQwjAEGQgAFr" +
+  "IgckACAHIANBQGsiAikDQDcDgIABIAdBgIABaiEIA0ACQEEAIQpBICEAA0AgDCAKQbABbGohDUEAIQZBACEJA0AgACEFIAZB" +
+  "AWohBAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAIA0gBkEEdGoiACgCAEEBaw4QAgMEBQYHCAkKCwwN" +
+  "Dg8QAAELIAUhACAKQQFqIgpBIEcNEyALQQFqIgtBBEcNFUEAIQoMEAsgAiAAKAIIQQN0aiIGIAIgACgCBEEDdGopAwAgBikD" +
+  "ACAANQIMhH43AwAMEAsgAiAAKAIIQQN0aiIGIAIgACgCBEEDdGopAwAgBikDACAANQIMhX43AwAMDwsgAiAAKAIIQQN0aiIG" +
+  "IAIgACgCBEEDdGopAwAgBikDACAANQIMfH43AwAMDgsgAiAAKAIIQQN0aiIGIAIgACgCBEEDdGopAwAgBikDAH4gADUCDIoi" +
+  "ATcDACABpyEJDA0LIAIgACgCCEEDdGoiBiACIAAoAgRBA3RqKQMAIAYpAwAgADUCDIqFNwMADAwLIAIgACgCCEEDdGoiBiAC" +
+  "IAAoAgRBA3RqKQMAIAYpAwAgADUCDIp8NwMADAsLIAIgACgCCEEDdGoiBiAGKQMAIAA1AgyKIAIgACgCBEEDdGopAwB9NwMA" +
+  "DAoLIAIgACgCCEEDdGoiBiACIAAoAgRBA3RqKQMAIAYpAwAgADUCDIeFNwMADAkLIAIgACgCCEEDdGoiBiACIAAoAgRBA3Rq" +
+  "KQMAIAYpAwAgADUCDId8NwMADAgLIAIgACgCCEEDdGoiBiAGKQMAIAA1AgyHIAIgACgCBEEDdGopAwB9NwMADAcLIAIgACgC" +
+  "CEEDdGoiBiACIAAoAgRBA3RqKQMAIAYpAwAgADUCDIiFNwMADAYLIAIgACgCCEEDdGoiBiACIAAoAgRBA3RqKQMAIAYpAwAg" +
+  "ADUCDIh8NwMADAULIAIgACgCCEEDdGoiBiAGKQMAIAA1AgyIIAIgACgCBEEDdGopAwB9NwMADAQLQQAhACAEIQYgBUUNBCAJ" +
+  "QRp0QR91IARxIQYgBSAJQSBxRWshAAwEC0EAIAQgBRshBiAFIAVBAEdrIQAMAwsgCEEIayACKQMANwAAIAhBEGsgAikDCDcA" +
+  "ACAIQRhrIAIpAxA3AAAgCEEgayACKQMYNwAAIAhBKGsgAikDIDcAACAIQTBrIAIpAyg3AAAgCEE4ayACKQMwNwAAIAhBQGoi" +
+  "CCACKQM4NwAADAELA0BBACEJQSAhAANAIAwgCUGwAWxqIQtBACEGQQAhCANAAkAgACEFIAYiBEEBaiEGAkACQAJAAkACQAJA" +
+  "AkACQAJAAkACQAJAAkACQAJAIAsgBEEEdGoiBCgCAEEBaw4QAQIDBAUGBwgJCgsMDQ4QDwALIAIgBCgCCEEDdGoiACAHIAIg" +
+  "BCgCBEEDdGooAgBB//8AcWopAAAgACkDACAENQIMhH43AwAgBSEADA8LIAIgBCgCCEEDdGoiACAHIAIgBCgCBEEDdGooAgBB" +
+  "//8AcWopAAAgACkDACAENQIMhX43AwAgBSEADA4LIAIgBCgCCEEDdGoiACAHIAIgBCgCBEEDdGooAgBB//8AcWopAAAgACkD" +
+  "ACAENQIMfH43AwAgBSEADA0LIAIgBCgCCEEDdGoiACACIAQoAgRBA3RqKQMAIAApAwB+IAQ1AgyKIgE3AwAgAachCCAFIQAM" +
+  "DAsgAiAEKAIIQQN0aiIAIAcgAiAEKAIEQQN0aigCAEH//wBxaikAACAAKQMAIAQ1AgyKhTcDACAFIQAMCwsgAiAEKAIIQQN0" +
+  "aiIAIAcgAiAEKAIEQQN0aigCAEH//wBxaikAACAAKQMAIAQ1AgyKfDcDACAFIQAMCgsgAiAEKAIIQQN0aiIAIAApAwAgBDUC" +
+  "DIogByACIAQoAgRBA3RqKAIAQf//AHFqKQAAfTcDACAFIQAMCQsgAiAEKAIIQQN0aiIAIAcgAiAEKAIEQQN0aigCAEH//wBx" +
+  "aikAACAAKQMAIAQ1AgyHhTcDACAFIQAMCAsgAiAEKAIIQQN0aiIAIAcgAiAEKAIEQQN0aigCAEH//wBxaikAACAAKQMAIAQ1" +
+  "AgyHfDcDACAFIQAMBwsgAiAEKAIIQQN0aiIAIAApAwAgBDUCDIcgByACIAQoAgRBA3RqKAIAQf//AHFqKQAAfTcDACAFIQAM" +
+  "BgsgAiAEKAIIQQN0aiIAIAcgAiAEKAIEQQN0aigCAEH//wBxaikAACAAKQMAIAQ1AgyIhTcDACAFIQAMBQsgAiAEKAIIQQN0" +
+  "aiIAIAcgAiAEKAIEQQN0aigCAEH//wBxaikAACAAKQMAIAQ1AgyIfDcDACAFIQAMBAsgAiAEKAIIQQN0aiIAIAApAwAgBDUC" +
+  "DIggByACIAQoAgRBA3RqKAIAQf//AHFqKQAAfTcDACAFIQAMAwtBACEAIAVFDQIgCEEadEEfdSAGcSEGIAUgCEEgcUVrIQAM" +
+  "AgtBACAGIAUbIQYgBSAFQQBHayEADAELCyAJQQFqIglBIEcNAAsgCkEBaiIKQQRHDQALIAdBkIABaiQADAMLIAUhACAEIQYM" +
+  "AAsACwALCyADIAMpA1giASADKQNQfCIPIAMpA0giDiADKQNAfCISIA5CDYmFIg58IhBCIIk3A1AgAyAQIA5CEYmFNwNIIAMg" +
+  "AykDeCIOIAMpA3B8IhAgAykDaCIRIAMpA2B8IhMgEUINiYUiEXwiFCARQhGJhTcDaCADIBRCIIk3A3AgAykDgAEhESADIBAg" +
+  "DkIQiYUiDiATQiCJfCIQNwNgIAMgDyABQhCJhSIBIBJCIIl8Ig83A0AgAyABQhWJIA+FIgE3A1ggESAOQhWJhSAQhSABhSEB" +
+  "CyADQZABaiQAIAELBwAgAEEYagsHACAAQThqCwgAIABBgAFqCwcAIAAoAgALBgBBtNgAC5IEAQV/IwBBQGoiAyQAIANBCGoi" +
+  "AiAAQQhqIAEQDyADQRhqIQUCQAJAAkAgACAFAn8CQAJAIAAgBQJ/AkACQCAAIAUCfyADKAI4IgRFBEAgAhAQIAAgAykDMDcD" +
+  "OEECDAELIAMgBEEBayICNgI4IAAgBSACQQN0aikDADcDOCACDQEgA0EIahAQQQMLIgJBA3RqKQMANwNADAELIAMgBEECayIC" +
+  "NgI4IAAgA0EIaiIGIARBA3RqKQMANwNAIAINACAGEBAgACADKQMwNwNIQQIMAQsgAyACQQFrIgQ2AjggACAFIARBA3RqKQMA" +
+  "NwNIIAQNASADQQhqEBBBAwsiBEEDdGopAwA3A1AMAQsgAyACQQJrIgQ2AjggACADQQhqIgYgAkEDdGopAwA3A1AgBA0AIAYQ" +
+  "ECAAIAMpAzA3A1hBAgwBCyADIARBAWsiAjYCOCAAIAUgAkEDdGopAwA3A1ggAg0BIANBCGoQEEEDCyICQQN0aikDADcDYAwB" +
+  "CyADIARBAmsiAjYCOCAAIANBCGoiBiAEQQN0aikDADcDYCACDQAgBhAQIAAgAykDMDcDaEEDIQIMAQsgAyACQQFrIgI2Ajgg" +
+  "ACAFIAJBA3RqKQMANwNoIAINACADQQhqEBBBBCECCyAAIAUgAkEDdGpBCGspAwA3A3AgACAAKQNYIAApAziFQniDQgOENwN4" +
+  "IANBQGskAAtfAQJ+IAApA3AiAUIQiSABIAApA2h8hSIBIAApA2AgACkDWHxCIIl8IAApA3ggACkDUCICQhCJIAIgACkDSHyF" +
+  "IgJCFYkgAiAAKQNAIAApAzh8QiCJfIWFhSABQhWJhQteAQJ/IwBBQGoiAiQAIAJBCGogAEJ/EA9BACEAA0AgAkEIaiIDIAEg" +
+  "AEGwAWxqQQAgAEH/AXFBBnBFEA4gAEEBaiIAQR9HDQALIAMgAUHQKmpBAUEAEA4gAkFAayQAC4gLAgt/CH4jAEFAaiIGJAAg" +
+  "AEEQaiEIAkACQAJAAkACQAJAAkACQAJAAkACQAJAIAAoAjAiBEUEQCAAEBAgACkDKCEPQQIhBwwBCyAAIARBAWsiBTYCMEED" +
+  "IQcgCCAFQQN0aikDACEPIAUNASAAEBALIAggB0EDdGopAwAhEAwBCyAAIARBAmsiBzYCMCAAIARBA3RqKQMAIRAgB0UNAQsg" +
+  "ACAHQQFrIgU2AjBBAyEEIAggBUEDdGopAwAhESAFRQRAIAAQEAwDCyAAIAdBAmsiBDYCMCAAIAdBA3RqKQMAIRIgBEUNAQwD" +
+  "CyAAEBAgACkDKCERQQIhBAwBCyAAEBAgACkDKCETQQIhBwwCCyAIIARBA3RqKQMAIRILIAAgBEEBayIFNgIwQQMhByAIIAVB" +
+  "A3RqKQMAIRMgBQ0BIAAQEAsgCCAHQQN0aikDACEUDAELIAAgBEECayIHNgIwIAAgBEEDdGopAwAhFCAHRQ0BCyAAIAdBAWsi" +
+  "BzYCMCAIIAdBA3RqKQMAIRUgBw0BIAAQEEEEIQcMAQsgABAQIAApAyghFUEDIQcLIAAgB0EBayIHNgIwIAggB0EDdGopAwAh" +
+  "FiABQQM2AhAgAUEPNgIAIA+nIQQgASAWQiOCpy0AgAsiBUEBcQR/IARBA3AFIARBCXBBAnQoArALCzYCICAQpyEEIAEgBUEC" +
+  "cQR/IARBA3AFIARBCXBBAnQoArALCzYCMCARpyEEIAEgBUEEcQR/IARBA3AFIARBCXBBAnQoArALCzYCQCASpyEEIAEgBUEI" +
+  "cQR/IARBA3AFIARBCXBBAnQoArALCzYCUCATpyEEIA9CIIghDyAQQiCIIRAgEUIgiCERIBJCIIghEiABIAVBEHEEfyAEQQNw" +
+  "BSAEQQlwQQJ0KAKwCws2AmAgFKchBCAPpyEJIBCnIQogEachCyASpyEMIBNCIIinIQ0gASAFQSBxBH8gBEEDcAUgBEEJcEEC" +
+  "dCgCsAsLNgJwIBRCIIinIQ4gFachBCABIAVBwABxBH8gBEEDcAUgBEEJcEECdCgCsAsLNgKAASAGQoCAgIAQNwMgIAYgBkEg" +
+  "aiIFIAlBAXFBAnRyIgQoAgA2AiQgBEEBNgIAIAZBAjYCKCAGIApBA3BBAnQgBXIiBCgCADYCKCAEQQI2AgAgBkEDNgIsIAYg" +
+  "C0EDcUECdCAFciIEKAIANgIsIARBAzYCACAGQQQ2AjAgBiAMQQVwQQJ0IAVqIgQoAgA2AjAgBEEENgIAIAZBBTYCNCAGIA1B" +
+  "BnBBAnQgBWoiBCgCADYCNCAEQQU2AgAgBkEGNgI4IAYgDkEHcEECdCAFaiIEKAIANgI4IARBBjYCACAGQQc2AjwgBiAVQiCI" +
+  "p0EHcUECdCAFaiIEKAIANgI8IARBBzYCACAGQQg2AgAgBiAGQSBqIgUgAwR/IBZCGIKnQQN0QeAbagUgFqdB/wFxQQN0QeAL" +
+  "agsiBC0AAUECdGooAgA2AgQgBiAELQACQQJ0IAVqKAIANgIIIAYgBC0AA0ECdCAFaigCADYCDCAGIAQtAARBAnQgBWooAgA2" +
+  "AhAgBiAELQAFQQJ0IAVqKAIANgIUIAYgBC0ABkECdCAFaigCADYCGCAGIAQtAAdBAnQgBWooAgA2AhxBACEEA0AgASAEIgNB" +
+  "AWoiBEEEdGoiBSADQQJ0IgMgBkEgamooAgA2AgggBSADIAZqKAIANgIEIAUoAgAhAyAAIAcEfyAHBSAAEBBBBAtBAWsiBzYC" +
+  "MCAIIAdBA3RqKQMAIQ8gBQJ/IANBAk0EQCAPQgOCpy0AoB0MAQsgD0I/gqdBAWogA0EGTQ0AGiAPQgOCp0EBags2AgwgBEEI" +
+  "Rw0ACyABQRA2AqABIAFBDkENIAIbNgKQASAGQUBrJAAL5QIBBX4gASkDACEDIAEpAwghBCAAQQQ2AjAgACAENwMIIAAgAzcD" +
+  "ACAAIARC7d6R85bM3LfkAIUiBUINiSAFIANC9crNg9es27fzAIV8IgWFIgYgAiAEhULzytHLp4zZsvQAhSIEIANC4eSV89bs" +
+  "2bzsAIV8IgN8IgdCIIlCuwGFIARCEIkgA4UiA0IViSAFQiCJIAN8IgOFIgR8IgUgBEIQiYUiBEIViSAEIAZCEYkgB4UiBiAC" +
+  "IAOFfCICQiCJfCIDhSIEQhCJIAQgBSAGQg2JIAKFIgJ8IgVCIIl8IgSFIgZCFYkgBiADIAJCEYkgBYUiAnwiA0IgiXwiBYUi" +
+  "BkIQiSAGIAQgAkINiSADhSICfCIDQiCJfCIEhSIGIAUgAkIRiSADhSICfCIDQiCJfCIFNwMQIAAgAkINiSADhSICQhGJIAIg" +
+  "BHwiAoU3AxggACACQiCJNwMgIAAgBkIViSAFhTcDKAuqAgEFfiAAIAApAwgiASAAKQMohSICQhCJIAIgACkDACIEIAApAyCF" +
+  "fCIChSIFQhWJIAUgACkDGCABhSIBIAApAxAgBIV8IgRCIIl8IgWFIgNCEIkgAyACIAFCDYkgBIUiAXwiAkIgiXwiBIUiA0IV" +
+  "iSADIAUgAiABQhGJhSIBfCICQiCJfCIFhSIDQhCJIAMgBCABQg2JIAKFIgF8IgJCIIl8IgSFIgNCFYkgAyAFIAFCEYkgAoUi" +
+  "AXwiAkIgiXwiBYUiA0IQiSADIAQgAUINiSAChSIBfCICQiCJfCIEhSIDIAUgAUIRiSAChSIBfCICQiCJfCIFNwMQIAAgA0IV" +
+  "iSAFhTcDKCAAIAQgAUINiSAChSIBfCICQiCJNwMgIAAgAUIRiSAChTcDGAsEABAAC4YEAgd/AX4CfyAAQQdqQXhxIgOtIQgC" +
+  "QCAIQgd8Qvj//////////wCDQaQdKAIAIgCtfCIIQv////8PWARAIAinIgI/AEEQdE0NAQtBwB1BMDYCAEF/DAELQaQdIAI2" +
+  "AgAgAAsiAkF/RwRAIAIgA2oiAEEEa0EQNgIAIABBEGsiBEEQNgIAAkACf0HQJSgCACIBBH8gASgCCAVBAAsgAkYEQCACIAJB" +
+  "BGsoAgBBfnEiBmsiBUEEaygCACEHIAEgADYCCCAFIAdBfnEiAWsiACAAKAIAakEEaygCAEEBcQRAIAAoAgQiBCAAKAIIIgU2" +
+  "AgggBSAENgIEIAAgAyAGaiABakEQayIBNgIADAMLIAJBEGsMAQsgAkEQNgIAIAIgADYCCCACIAE2AgQgAkEQNgIMQdAlIAI2" +
+  "AgAgAkEQagsiACAEIABrIgE2AgALIAAgAUF8cWpBBGsgAUEBcjYCACAAAn8gACgCAEEIayIBQf8ATQRAIAFBA3ZBAWsMAQsg" +
+  "AUEdIAFnIgNrdkEEcyADQQJ0a0HuAGogAUH/H00NABpBPyABQR4gA2t2QQJzIANBAXRrQccAaiIBIAFBP08bCyIBQQR0IgNB" +
+  "0B1qNgIEIAAgA0HYHWoiAygCADYCCCADIAA2AgAgACgCCCAANgIEQdglQdglKQMAQgEgAa2GhDcDAAsgAkF/RwvjAwIFfwJ+" +
+  "AkACQANAIABBR0sNAUHYJSkDACIGAn9BCCAAQQNqQXxxIABBCE0bIgBB/wBNBEAgAEEDdkEBawwBCyAAQR0gAGciAWt2QQRz" +
+  "IAFBAnRrQe4AaiAAQf8fTQ0AGkE/IABBHiABa3ZBAnMgAUEBdGtBxwBqIgEgAUE/TxsLIgKtiCIHQgBSBEADQCAHIAd6IgeI" +
+  "IQYCfiACIAenaiICQQR0IgNB2B1qKAIAIgEgA0HQHWoiBEcEQCABIAAQFCIDDQYgASgCBCIDIAEoAggiBTYCCCAFIAM2AgQg" +
+  "ASAENgIIIAEgBCgCBDYCBCAEIAE2AgQgASgCBCABNgIIIAJBAWohAiAGQgGIDAELQdglQdglKQMAQn4gAq2JgzcDACAGQgGF" +
+  "CyIHQgBSDQALQdglKQMAIQYLQT8gBnmnayEEAkAgBlAEQEEAIQIMAQsgBEEEdCIDQdgdaigCACECIAZCgICAgARUDQBB4gAh" +
+  "ASACIANB0B1qIgVGDQADQCACIAAQFCIDDQQgAigCCCICIAVGDQEgASIDQQFrIQEgAw0ACwsgAEEwahASDQALIAJFDQAgAiAE" +
+  "QQR0QdAdaiIBRg0AA0AgAiAAEBQiAw0CIAIoAggiAiABRw0ACwtBACEDCyADC5EDAQV/IABBBGoiBEEHakF4cSIDIAFqIAAg" +
+  "ACgCACICakEEa00EfyAAKAIEIgUgACgCCCIGNgIIIAYgBTYCBCADIARHBEAgACAAQQRrKAIAQX5xayIFIAMgBGsiBCAFKAIA" +
+  "aiIDNgIAIAUgA0F8cWpBBGsgAzYCACAAIARqIgAgAiAEayICNgIACwJ/IAIgAUEYak8EQCAAIAFqIgQgAiABa0EIayICNgII" +
+  "IARBCGoiBSACQXxxakEEayACQQFyNgIAIAQCfyAEKAIIQQhrIgJB/wBNBEAgAkEDdkEBawwBCyACQR0gAmciA2t2QQRzIANB" +
+  "AnRrQe4AaiACQf8fTQ0AGkE/IAJBHiADa3ZBAnMgA0EBdGtBxwBqIgIgAkE/TxsLIgJBBHQiA0HQHWo2AgwgBCADQdgdaiID" +
+  "KAIANgIQIAMgBTYCACAEKAIQIAU2AgRB2CVB2CUpAwBCASACrYaENwMAIAAgAUEIaiICNgIAIAAgAkF8cWoMAQsgACACagtB" +
+  "BGsgAjYCACAAQQRqBUEACwvMAgEFfyAABEAgAEEEayIDKAIAIgQhASADIQIgAEEIaygCACIAIABBfnEiAEcEQCACIABrIgIo" +
+  "AgQiASACKAIIIgU2AgggBSABNgIEIAAgBGohAQsgAyAEaiIAKAIAIgMgACADakEEaygCAEcEQCAAKAIEIgQgACgCCCIANgII" +
+  "IAAgBDYCBCABIANqIQELIAIgATYCACACIAFBfHFqQQRrIAFBAXI2AgAgAgJ/IAIoAgBBCGsiAEH/AE0EQCAAQQN2QQFrDAEL" +
+  "IABnIQMgAEEdIANrdkEEcyADQQJ0a0HuAGogAEH/H00NABpBPyAAQR4gA2t2QQJzIANBAXRrQccAaiIAIABBP08bCyIBQQR0" +
+  "IgBB0B1qNgIEIAIgAEHYHWoiACgCADYCCCAAIAI2AgAgAigCCCACNgIEQdglQdglKQMAQgEgAa2GhDcDAAsLBgAgACQACwQA" +
+  "IwALbwEEfz8AQRB0IQQgACACaiAESyABIAJqIARLcgRAAAsgASAASQRAIAJBAWshA0F/IQRBfyEFBUEAIQMgAiEEQQEhBQsg" +
+  "AyEGAkADQCAGIARGDQEgACAGaiABIAZqLQAAOgAAIAYgBWohBgwACwALCwuPFQcAQYEIC/IBYXNtAQAAAAEGAWACf38AAg8B" +
+  "A2VudgZtZW1vcnkCAAEDAgEABwgBBGV4ZWMAAAqB2AAB/dcAAQ1+IAApAwAhAiAAKQMIIQMgACkDECEEIAApAxghBSAAKQMg" +
+  "IQYgACkDKCEHIAApAzAhCCAAKQM4IQkgACkDQCEKQgAhC0L//wAhDUGAgAEgAWohASABIAo3AwAgDkIBfSIOQgBSDQALIAAg" +
+  "AjcDACAAIAM3AwggACAENwMQIAAgBTcDGCAAIAY3AyAgACAHNwMoIAAgCDcDMCAAIAk3AzgLhIV8AIqKioeHh4iIiH5+fgCF" +
+  "fH2FfH2FfH0AQYAKCxUgCyAMhEIgg1AEQEIBIAt8IQsMAQsAQaAKCxIgC0Igg1AEQEIBIAt8IQsMAQsAQcAKC2MgAUHAAGsh" +
+  "ASABIAI3AzggASADNwMwIAEgBDcDKCABIAU3AyAgASAGNwMYIAEgBzcDECABIAg3AwggASAJNwMABwsTI0MNFSVFGSlJMVFh" +
+  "DhYmRhoqSjJSYhwsTDRUZDhYaHAAQbALCyEEAAAABQAAAAYAAAAHAAAACAAAAAkAAAAKAAAACwAAAAwAQeELC8IRAgEEAwYH" +
+  "BQADBAEGBwUCAAQFBgcBAgMABgMHBQIBBAEABAUCAwcGAQMAAgUEBwYBAwUCAAQHBgEDBgIHAAUEAQMHAgAGBAUBAwcCAAYF" +
+  "BAEDBwIFBAAGAQMHAgYABQQBBAUAAwIHBgEEBQcCAwAGAQQGAAMHAgUBBAYHAgADBQEEBgcCAAUDAQQHAAIGBQMBBAcAAwYC" +
+  "BQEEBwUCAwAGAQQHBQMCAAYBBAcGAwAFAgEFBgcAAgMEAQUGBwACBAMBBQcABgIDBAEFBwAGAgQDAQUHBgADAgQBBQcGAAQC" +
+  "AwEGBAcCAAUDAQYFBwACBAMBBwMCAAYFBAEHAwIGAAQFAQcDAgYABQQBBwQGAgADBQEHBAYDAAUCAQcFAAYCAwQBBwUABgIE" +
+  "AwEHBQYAAgMEAQcFBgACBAMBBwYABQIEAwEHBgQCAAUDAQcGBAMABQIBBwYFAAIDBAIABAYDBwEFAgMAAQcGBAUCAwEABgcE" +
+  "BQIDAQcABgQFAgMBBwAGBQQCBAAHAQYFAwIEAQcDBgUAAgQFBwEDAAYCBAUHAwEABgIEBgcBAAMFAgQHBQMBAAYCBQAGBwME" +
+  "AQIFAQYHAAMEAgUBBgcDAAQCBQEHAAYDBAIFAQcGAAMEAgUGAAcBAwQCBQYHAAEDBAIFBwYAAQQDAgUHBgADAQQCBQcGAAME" +
+  "AQIFBwYABAEDAgYBBQcDAAQCBgEFBwQAAwIGAQUHBAMAAgYBBwUDBAACBgEHBQQDAAIHAQAFBgQDAgcBBAMGAAUCBwEEAwYF" +
+  "AAIHAQUABgQDAgcBBQYAAwQCBwEFBgMABAIHAQUGAwQAAgcBBgUDAAQCBwEGBQQAAwIHAwEABgUEAgcGBQADBAEDAAQBBgcC" +
+  "BQMABAIGBwUBAwAFAgYHBAEDAAYBBQQHAgMCAAEGBwQFAwIAAQcGBAUDAgEABQQHBgMCAQAGBwQFAwIBAAcGBQQDAgEFBwQA" +
+  "BgMCAQYABwUEAwIHAQYABAUDAgcBBgAFBAMEAAcBBgUCAwQGAQcAAgUDBAYCBwAFAQMEBgcCAAUBAwQHAgAGBQEDBQAHBgQC" +
+  "AQMFBgAHAQIEAwUGAgcABAEDBQYHAAECBAMFBgcAAgQBAwUGBwAEAgEDBQcBBgAEAgMFBwIGAAEEAwUHBgABAgQDBgUABwEC" +
+  "BAMGBwAFBAIBAwYHAQUEAAIDBwQBAgYFAAMHBQEGAAQCAwcFAQYEAAIDBwYBBQAEAgMHBgEFAgQAAwcGAQUEAAIEAAMCAQYH" +
+  "BQQAAwIGBwEFBAIABQEDBwYEAgAGAwcBBQQCAAYDBwUBBAIBAAMGBwUEAgEABwYDBQQCAQUDAAcGBAIBBwYABQMEAgYHAwAB" +
+  "BQQCBwADBgEFBAIHBQEDAAYEAwABAgYHBQQDAAEGBwUCBAMAAgUBBwYEAwACBgcBBQQDAAIHBgEFBAMAAgcGBQEEAwAGAgcB" +
+  "BQQDBQIHAQAGBAMFBwIBAAYEAwYAAgcBBQQDBgIABwUBBAMGAgcAAQUEAwYCBwAFAQQFAAYBBwMCBAUDAAIBBwYEBQMBBwIA" +
+  "BgQFAwIHAQAGBAUDBwIBAAYEBgMCAAcBBQQGAwIHAAEFBAYDBwEABQIEBgcFAQIDAAQHAwABBgIFBAcDAAIGBQEEBwUGAQIA" +
+  "AwUAAwIGBAcBBQADBAECBwYFAAMEAgEHBgUABAYBAgcDBQAEBgEHAwIFAAQGAwcCAQUABAcDBgECBQAHBAIGAwEFAgAEAQMH" +
+  "BgUCAAQDAQcGBQIABgcDBAEFAgAGBwQBAwUCAQAGBwMEBQIDAQcEAAYFAgQAAwEHBgUCBwQDAQAGBQIHBgADBAEFAwACBgcE" +
+  "AQUDBAACAQcGBQMEAgABBwYFAwcEAQIABgUDBwQCAQAGBQQABgIHAQMFBAAGAwEHAgUEAwACAQcGBQQDAQcCAAYFBAYABwEC" +
+  "AwUEBgAHAQMCBQQHBgEDAgAFBgAEAQcCAwUGAAQDBwECBQYABAMHAgEFBgQAAgcBAwUGBAADBwIBBQYHBAECAAMGAAMBBQQH" +
+  "AgYAAwEFBwIEBgADAgUEBwEGAAMHBQQBAgYABAUBAgcDBgAEBQEDBwIGAAQFAQcCAwYABAUBBwMCBgAEBQIDBwEGAAQFAgcD" +
+  "AQYABAcFAwECBgAEBwUDAgEGAAUEAQIHAwYABQQCAQcDBgAFBAIHAwEGAAUEAwEHAgYABQQDAgcBBgAHBAUDAQIGAgAEAwcF" +
+  "AQYCAQUHAwQABgIEAAMHAQUGAwABBQQHAgYDBQIHBAABBgQDAQcAAgUGBAUAAgMHAQYEBQcBAgMABgQFBwEDAgAGBAUHAgED" +
+  "AAYFAAQCAQcDBgUABAcDAgEGBwMBBQIABAYHAwEFBAACBgcDAQUEAgAGBwUEAQIDAAcABAUCBgEDBwAFBAMGAQIHAgEEAwYF" +
+  "AAcCAQYFAwQABwIBBgUEAwAHAgUGAAEDBAcDBAEFAgAGBwMFAQYEAgAHAwUCBgQBAAcDBgEFBAACBwMGBQAEAQIHBAYFAQAC" +
+  "AwcEBgUBAgMABwUABAEGAgMHBQMBBgIEAAcFAwEGBAIABwUDAgYBBAAHBgAEBQIBAwcGAAQFAwECBwYDAAUEAQIHBgMBBQQC" +
+  "AAcGAwIFBAEABwYEBQEAAwIHBgQFAQIDAAcGBAUBAwIABwYEBQIBAwAHBgQFAgMBAAcGBAUDAQIABwYEBQMCAQAHBgUEAAMB" +
+  "AgcGBQQBAgMABwYFBAEDAgAHBgUEAgEDAAACBwEDBAUGAAMBBwIEBQYABAECBwMFBgAFAQIDBwQGAAYBAgMEBwUBAAcCAwQF" +
+  "BgEHAAIDBAUGAgAHAQMEBQYCBwABAwQFBgMAAQcCBAUGAwcBAAIEBQYEAAECBwMFBgQHAQIAAwUGBQABAgMHBAYFBwECAwAE" +
+  "BgYAAQIDBAcFBgcBAgMEAAUGBwECAwQFAAcCAAEDBAUGBwMBAAIEBQYHBAECAAMFBgcFAQIDAAQGBwYBAgMEAAUHBgECAwQF" +
+  "AAEJIQBBpB0LA+ASAQ==";

package/src/hashwx.js

@@ -0,0 +1,175 @@
+import crypto from "node:crypto";
+import { HASHWX_WASM_BASE64 } from "./hashwx-wasm.js";
+
+export const HASHWX_SEED_SIZE = 32;
+export const HASHWX_CHALLENGE_SIZE = 32;
+
+export const DEFAULT_HASHWX_NONCES_PER_HASH = 65536;
+export const DEFAULT_HASHWX_DIFFICULTY = 1_000_000;
+export const DEFAULT_HASHWX_CHALLENGE_COUNT = 4;
+
+export const MAX_HASHWX_DIFFICULTY = 1_000_000_000;
+export const MAX_HASHWX_NONCES_PER_HASH = 1_048_576;
+export const MAX_HASHWX_CHALLENGE_COUNT = 64;
+
+const U64_MAX = (1n << 64n) - 1n;
+const HASHWX_INTERPRETED = 0;
+
+function decodeBase64(b64) {
+  if (typeof Buffer !== "undefined")
+    return new Uint8Array(Buffer.from(b64, "base64"));
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+let readyPromise = null;
+
+async function init() {
+  const mod = await WebAssembly.compile(decodeBase64(HASHWX_WASM_BASE64));
+  const instance = new WebAssembly.Instance(mod, {});
+  const exports = instance.exports;
+  if (typeof exports._initialize === "function") exports._initialize();
+
+  const ctx = exports.hashwx_alloc(HASHWX_INTERPRETED);
+  if (ctx <= 0) throw new Error("[capjs-core] hashwx_alloc failed");
+
+  return { exports, ctx, seedPtr: exports.hashwx_seed(ctx) };
+}
+
+export function hashwxReady() {
+  if (!readyPromise) {
+    readyPromise = init().catch((err) => {
+      readyPromise = null;
+      throw err;
+    });
+  }
+  return readyPromise;
+}
+
+export function hashwxTarget(difficulty) {
+  const d = BigInt(difficulty);
+  if (d <= 0n)
+    throw new Error("[capjs-core] hashwx difficulty must be positive");
+  return U64_MAX / d;
+}
+
+export function hashwxSeed(challenge, block) {
+  const buf = new Uint8Array(HASHWX_CHALLENGE_SIZE + 8);
+  buf.set(challenge, 0);
+  let rest = BigInt(block);
+  for (let i = 0; i < 8; i++) {
+    buf[HASHWX_CHALLENGE_SIZE + i] = Number(rest & 0xffn);
+    rest >>= 8n;
+  }
+  return new Uint8Array(crypto.createHash("sha256").update(buf).digest());
+}
+
+export function hashwxHash(state, seed, nonce) {
+  const { exports, ctx, seedPtr } = state;
+  new Uint8Array(exports.memory.buffer, seedPtr, HASHWX_SEED_SIZE).set(seed);
+  exports.hashwx_make(ctx, seedPtr);
+  return BigInt.asUintN(64, exports.hashwx_exec(ctx, nonce));
+}
+
+function parseNonce(value) {
+  if (typeof value === "bigint")
+    return value >= 0n && value <= U64_MAX ? value : null;
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value) || value < 0) return null;
+    return BigInt(value);
+  }
+  if (typeof value !== "string" || !/^[0-9]{1,20}$/.test(value)) return null;
+  const parsed = BigInt(value);
+  return parsed <= U64_MAX ? parsed : null;
+}
+
+function hexToBytes(hex, expectedLength) {
+  if (typeof hex !== "string" || hex.length !== expectedLength * 2) return null;
+  if (!/^[0-9a-f]*$/i.test(hex)) return null;
+  const out = new Uint8Array(expectedLength);
+  for (let i = 0; i < expectedLength; i++) {
+    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+
+export function mintHashwxChallenges(opts = {}) {
+  const difficulty = opts.hashwxDifficulty ?? DEFAULT_HASHWX_DIFFICULTY;
+  const noncesPerHash =
+    opts.hashwxNoncesPerHash ?? DEFAULT_HASHWX_NONCES_PER_HASH;
+  const count = opts.hashwxChallengeCount ?? DEFAULT_HASHWX_CHALLENGE_COUNT;
+
+  if (
+    !Number.isInteger(difficulty) ||
+    difficulty < 1 ||
+    difficulty > MAX_HASHWX_DIFFICULTY
+  ) {
+    throw new Error(
+      `[capjs-core] hashwxDifficulty must be an integer in [1, ${MAX_HASHWX_DIFFICULTY}]`,
+    );
+  }
+  if (
+    !Number.isInteger(noncesPerHash) ||
+    noncesPerHash < 1 ||
+    noncesPerHash > MAX_HASHWX_NONCES_PER_HASH
+  ) {
+    throw new Error(
+      `[capjs-core] hashwxNoncesPerHash must be an integer in [1, ${MAX_HASHWX_NONCES_PER_HASH}]`,
+    );
+  }
+  if (
+    !Number.isInteger(count) ||
+    count < 1 ||
+    count > MAX_HASHWX_CHALLENGE_COUNT
+  ) {
+    throw new Error(
+      `[capjs-core] hashwxChallengeCount must be an integer in [1, ${MAX_HASHWX_CHALLENGE_COUNT}]`,
+    );
+  }
+
+  const each = Math.max(1, Math.round(difficulty / count));
+  const out = [];
+  for (let i = 0; i < count; i++) {
+    const spec = {
+      c: crypto.randomBytes(HASHWX_CHALLENGE_SIZE).toString("hex"),
+      d: each,
+      n: noncesPerHash,
+    };
+    out.push({ payload: { ...spec }, expected: { ...spec } });
+  }
+  return out;
+}
+
+export async function verifyHashwxSolution(expected, solution) {
+  if (!expected || typeof expected !== "object") return false;
+  if (!solution || typeof solution !== "object") return false;
+
+  const challenge = hexToBytes(expected.c, HASHWX_CHALLENGE_SIZE);
+  if (!challenge) return false;
+
+  const noncesPerHash = expected.n;
+  if (
+    !Number.isInteger(noncesPerHash) ||
+    noncesPerHash < 1 ||
+    noncesPerHash > MAX_HASHWX_NONCES_PER_HASH
+  ) {
+    return false;
+  }
+
+  const nonce = parseNonce(solution.nonce);
+  if (nonce === null) return false;
+
+  let target;
+  try {
+    target = hashwxTarget(expected.d);
+  } catch {
+    return false;
+  }
+
+  const state = await hashwxReady();
+  const block = nonce / BigInt(noncesPerHash);
+  const seed = hashwxSeed(challenge, block);
+  return hashwxHash(state, seed, nonce) <= target;
+}

package/src/index.d.ts

@@ -19,7 +19,7 @@ export interface GeneratedInstrumentation {
   instrumentation: string;
 }
 
-export type ProtocolName = "sha256-pow" | "rsw" | "instrumentation";
+export type ProtocolName = "sha256-pow" | "rsw" | "hashwx" | "instrumentation";
 
 export interface RswKeypair {
   N: bigint;
@@ -71,6 +71,13 @@ export interface GenerateChallengeOptions {
   t?: number;
   /** Alternative to `keypair`: pass a pre-built minter (advanced). */
   rsw?: RswMinter;
+
+  /** Expected number of HashWX hashes per solve, across all sub-challenges. Default 1_000_000. */
+  hashwxDifficulty?: number;
+  /** Nonces covered by each generated hash function. Default 65_536. */
+  hashwxNoncesPerHash?: number;
+  /** Independent sub-challenges the difficulty is split across. Default 4. */
+  hashwxChallengeCount?: number;
 }
 
 export interface Format2ChallengeEntry {
@@ -94,14 +101,56 @@ export interface Format2ChallengeResult {
 
 export type ChallengeResult = Format1ChallengeResult | Format2ChallengeResult;
 
+export interface ProbeVector {
+  ua?: string | null;
+  productSub?: string | null;
+  webdriver?: boolean | null;
+  oscpu?: string | null;
+  deviceMemory?: number | null;
+  uaDataPresent?: boolean | null;
+  uaData?: { mobile?: boolean; brands?: string[] } | null;
+  plugins?: { length: number } | null;
+  pdfViewerEnabled?: boolean | null;
+  engine?: { hasMozInnerScreenX: boolean; hasChrome: boolean } | null;
+  screen?: { width: number; height: number } | null;
+  innerWH?: [number, number] | null;
+  outerWH?: [number, number] | null;
+  isExtended?: boolean | null;
+  fontWidths?: number[] | null;
+  tamper?: Record<string, boolean> | null;
+}
+
+export interface DetectionCheck {
+  id: string;
+  passed: boolean;
+  detail: string;
+  gating: boolean;
+}
+
+export interface DetectionResult {
+  pass: boolean;
+  checks: DetectionCheck[];
+  blockedBy: string[];
+  riskFlags: string[];
+}
+
 export interface InstrumentationPayload {
   i: string;
   state: Record<string, number>;
+  p?: ProbeVector;
+  vp?: [number, number];
   ts?: number;
 }
 
-export interface Format2SolutionShaPow { nonce: number | string }
-export interface Format2SolutionRsw { y: string }
+export interface Format2SolutionShaPow {
+  nonce: number | string;
+}
+export interface Format2SolutionRsw {
+  y: string;
+}
+export interface Format2SolutionHashwx {
+  nonce: number | string;
+}
 export interface Format2SolutionInstrumentation {
   instr?: InstrumentationPayload;
   blocked?: boolean;
@@ -110,6 +159,7 @@ export interface Format2SolutionInstrumentation {
 export type Format2Solution =
   | Format2SolutionShaPow
   | Format2SolutionRsw
+  | Format2SolutionHashwx
   | Format2SolutionInstrumentation;
 
 export interface ValidateChallengeBody {
@@ -143,12 +193,16 @@ export interface ValidateChallengeSuccess {
   expires: number;
   scope: string | null;
   iat?: number;
+  /** Non-gating automation signals (e.g. `native_tamper`). Raise difficulty, do not block. */
+  riskFlags: string[];
 }
 
 export interface ValidateChallengeFailure {
   success: false;
   reason: string;
   instr_error?: boolean;
+  /** Ids of the gating detection checks that failed, when reason is `instr_automated_browser`. */
+  blockedBy?: string[];
   error?: string;
 }
 
@@ -184,3 +238,42 @@ export function buildRswMinter(
   args: { N: bigint; p: bigint; q: bigint; t: number; g?: bigint },
   opts?: { bits?: number },
 ): RswMinter;
+
+// ─── HashWX (format-2) helpers ─────────────────────────────────────────────
+export const DEFAULT_HASHWX_DIFFICULTY: number;
+export const DEFAULT_HASHWX_NONCES_PER_HASH: number;
+export const DEFAULT_HASHWX_CHALLENGE_COUNT: number;
+
+export interface HashwxState {
+  exports: WebAssembly.Exports;
+  ctx: number;
+  seedPtr: number;
+}
+
+/** Compiles and initializes the embedded HashWX wasm. Called automatically on
+ *  first verification; await it at boot to move the cost off the first
+ *  request. Resolves to a state handle reusable with `hashwxHash`. */
+export function hashwxReady(): Promise<HashwxState>;
+
+/** Largest 64-bit hash accepted at the given difficulty. */
+export function hashwxTarget(difficulty: number | bigint): bigint;
+
+/** sha256(challenge || u64le(block)), the seed for one generated hash
+ *  function. Each seed covers `hashwxNoncesPerHash` consecutive nonces. */
+export function hashwxSeed(
+  challenge: Uint8Array,
+  block: number | bigint,
+): Uint8Array;
+
+/** Generates the hash function for `seed` and runs it over `nonce`. Returns an
+ *  unsigned 64-bit value; a solution needs it at or below `hashwxTarget(d)`. */
+export function hashwxHash(
+  state: HashwxState,
+  seed: Uint8Array,
+  nonce: bigint,
+): bigint;
+
+/** Pure server-side automation detector over the probe vector the
+ *  instrumentation script ships back. Exposed for testing and for callers
+ *  that run their own instrumentation pipeline. */
+export function detectAutomation(vector: ProbeVector): DetectionResult;

package/src/index.js

@@ -10,7 +10,25 @@ import {
   sha256Bytes,
   sha256Hex,
 } from "./crypto.js";
-import { generateInstrumentation, verifyInstrumentationResult } from "./instrumentation.js";
+import {
+  generateInstrumentation,
+  verifyInstrumentationResult,
+} from "./instrumentation.js";
+
+export { detectAutomation } from "./detect.js";
+
+import { mintHashwxChallenges, verifyHashwxSolution } from "./hashwx.js";
+
+export {
+  DEFAULT_HASHWX_CHALLENGE_COUNT,
+  DEFAULT_HASHWX_DIFFICULTY,
+  DEFAULT_HASHWX_NONCES_PER_HASH,
+  hashwxHash,
+  hashwxReady,
+  hashwxSeed,
+  hashwxTarget,
+} from "./hashwx.js";
+
 import { fnv1a, fnv1aResume, prngFromHash } from "./prng.js";
 import {
   buildRswMinter as _buildRswMinter,
@@ -20,9 +38,9 @@ import {
 
 export {
   buildRswMinter,
+  deserializeRswKeypair,
   generateRswKeypair,
   serializeRswKeypair,
-  deserializeRswKeypair,
 } from "./rsw.js";
 
 const DEFAULT_RSW_T = 75_000;
@@ -38,9 +56,10 @@ function resolveRswMinter(opts) {
     );
   }
 
-  const kp = typeof opts.keypair.N === "string"
-    ? deserializeRswKeypair(opts.keypair)
-    : opts.keypair;
+  const kp =
+    typeof opts.keypair.N === "string"
+      ? deserializeRswKeypair(opts.keypair)
+      : opts.keypair;
 
   const t = opts.t ?? DEFAULT_RSW_T;
   let byT = _minterCache.get(opts.keypair);
@@ -75,9 +94,14 @@ function assertSecret(secret) {
   if (typeof secret !== "string" && !Buffer.isBuffer(secret)) {
     throw new Error("[capjs-core] secret must be a string or Buffer");
   }
-  const len = typeof secret === "string" ? Buffer.byteLength(secret, "utf8") : secret.length;
+  const len =
+    typeof secret === "string"
+      ? Buffer.byteLength(secret, "utf8")
+      : secret.length;
   if (len < 16) {
-    throw new Error("[capjs-core] secret must be at least 16 bytes for security");
+    throw new Error(
+      "[capjs-core] secret must be at least 16 bytes for security",
+    );
   }
 }
 
@@ -123,7 +147,8 @@ export async function generateChallenge(secret, opts = {}) {
 
   let instrumentation;
   if (opts.instrumentation) {
-    const instrOpts = typeof opts.instrumentation === "object" ? opts.instrumentation : {};
+    const instrOpts =
+      typeof opts.instrumentation === "object" ? opts.instrumentation : {};
     const generator = opts.instrumentationGenerator || generateInstrumentation;
     const instr = await generator({ ...instrOpts, ttlMs });
     payload.ei = encryptGcm(
@@ -153,7 +178,8 @@ export async function validateChallenge(secret, body, opts = {}) {
   assertSecret(secret);
 
   if (!body || typeof body !== "object") return fail("invalid_body");
-  if (!body.token || typeof body.token !== "string") return fail("missing_token");
+  if (!body.token || typeof body.token !== "string")
+    return fail("missing_token");
   const solutions = body.solutions;
   if (!Array.isArray(solutions)) return fail("missing_solutions");
 
@@ -205,6 +231,7 @@ export async function validateChallenge(secret, body, opts = {}) {
     }
   }
 
+  let riskFlags = [];
   if (payload.ei) {
     const instrMeta = decryptGcm(payload.ei, secret);
     if (!instrMeta) return fail("instr_corrupted", { instr_error: true });
@@ -220,7 +247,13 @@ export async function validateChallenge(secret, body, opts = {}) {
       return fail("instr_timeout", { instr_error: true });
     } else if (body.instr) {
       const r = verifyInstrumentationResult(instrMeta, body.instr);
-      if (!r.valid) return fail(r.reason || "instr_failed", { instr_error: true });
+      if (!r.valid) {
+        return fail(r.reason || "instr_failed", {
+          instr_error: true,
+          ...(r.blockedBy && { blockedBy: r.blockedBy }),
+        });
+      }
+      if (r.riskFlags?.length) riskFlags = [...riskFlags, ...r.riskFlags];
     } else {
       return fail("instr_missing", { instr_error: true });
     }
@@ -254,6 +287,7 @@ export async function validateChallenge(secret, body, opts = {}) {
       expires: tokenExpires,
       scope: payload.sk ?? null,
       iat: payload.iat,
+      riskFlags,
     };
   }
 
@@ -267,12 +301,15 @@ export async function validateChallenge(secret, body, opts = {}) {
     expires: tokenExpires,
     scope: payload.sk ?? null,
     iat: payload.iat,
+    riskFlags,
   };
 }
 
 async function generateChallengeV2(secret, opts) {
   const protocols =
-    Array.isArray(opts.protocols) && opts.protocols.length ? opts.protocols : ["rsw"];
+    Array.isArray(opts.protocols) && opts.protocols.length
+      ? opts.protocols
+      : ["rsw"];
   const ttlMs = opts.expiresMs ?? DEFAULT_CHALLENGE_TTL_MS;
   const now = Date.now();
   const exp = now + ttlMs;
@@ -314,14 +351,24 @@ async function generateChallengeV2(secret, opts) {
         payload: { N: minter.N_hex, x: x_hex, t: minter.t },
       });
       expected.push({ protocol: "rsw", y: y_hex });
+    } else if (proto === "hashwx") {
+      for (const minted of mintHashwxChallenges(opts)) {
+        challenges.push({ protocol: "hashwx", payload: minted.payload });
+        expected.push({ protocol: "hashwx", ...minted.expected });
+      }
     } else if (proto === "instrumentation") {
       const instrOpts =
-        typeof opts.instrumentation === "object" && opts.instrumentation !== null
+        typeof opts.instrumentation === "object" &&
+        opts.instrumentation !== null
           ? opts.instrumentation
           : {};
-      const generator = opts.instrumentationGenerator || generateInstrumentation;
+      const generator =
+        opts.instrumentationGenerator || generateInstrumentation;
       const instr = await generator({ ...instrOpts, ttlMs });
-      challenges.push({ protocol: "instrumentation", payload: { blob: instr.instrumentation } });
+      challenges.push({
+        protocol: "instrumentation",
+        payload: { blob: instr.instrumentation },
+      });
       expected.push({
         protocol: "instrumentation",
         instrMeta: {
@@ -356,9 +403,11 @@ async function validateChallengeV2(secret, body, payload, opts = {}) {
   if (!payload.exp || payload.exp < Date.now()) return fail("expired");
 
   const decrypted = decryptGcm(payload.ev, secret, "cap:fmt2-v1");
-  if (!decrypted || !Array.isArray(decrypted.expected)) return fail("invalid_token");
+  if (!decrypted || !Array.isArray(decrypted.expected))
+    return fail("invalid_token");
   const expected = decrypted.expected;
   const solutions = body.solutions;
+  let riskFlags = [];
 
   if (solutions.length !== expected.length) return fail("invalid_solutions");
 
@@ -369,11 +418,15 @@ async function validateChallengeV2(secret, body, payload, opts = {}) {
 
     if (e.protocol === "sha256-pow") {
       const nonce = s.nonce;
-      if (typeof nonce !== "number" && typeof nonce !== "string") return fail("invalid_solution");
+      if (typeof nonce !== "number" && typeof nonce !== "string")
+        return fail("invalid_solution");
       const hash = sha256Bytes(e.salt + nonce);
-      if (!powMatchesPrefix(hash, parseHexPrefix(e.target))) return fail("invalid_solution");
+      if (!powMatchesPrefix(hash, parseHexPrefix(e.target)))
+        return fail("invalid_solution");
     } else if (e.protocol === "rsw") {
       if (!verifyRswSolution(e.y, s.y)) return fail("invalid_solution");
+    } else if (e.protocol === "hashwx") {
+      if (!(await verifyHashwxSolution(e, s))) return fail("invalid_solution");
     } else if (e.protocol === "instrumentation") {
       const meta = e.instrMeta;
       if (!meta) return fail("instr_corrupted", { instr_error: true });
@@ -388,7 +441,13 @@ async function validateChallengeV2(secret, body, payload, opts = {}) {
         return fail("instr_timeout", { instr_error: true });
       } else if (s.instr) {
         const r = verifyInstrumentationResult(meta, s.instr);
-        if (!r.valid) return fail(r.reason || "instr_failed", { instr_error: true });
+        if (!r.valid) {
+          return fail(r.reason || "instr_failed", {
+            instr_error: true,
+            ...(r.blockedBy && { blockedBy: r.blockedBy }),
+          });
+        }
+        if (r.riskFlags?.length) riskFlags = [...riskFlags, ...r.riskFlags];
       } else {
         return fail("instr_missing", { instr_error: true });
       }
@@ -425,6 +484,7 @@ async function validateChallengeV2(secret, body, payload, opts = {}) {
       expires: tokenExpires,
       scope: payload.sk ?? null,
       iat: payload.iat,
+      riskFlags,
     };
   }
 
@@ -438,5 +498,6 @@ async function validateChallengeV2(secret, body, payload, opts = {}) {
     expires: tokenExpires,
     scope: payload.sk ?? null,
     iat: payload.iat,
+    riskFlags,
   };
 }

package/src/instrumentation.js

@@ -1,5 +1,6 @@
 import { randomBytes, randomInt } from "node:crypto";
 import { deflateRawSync } from "node:zlib";
+import { detectAutomation } from "./detect.js";
 
 let _obfuscator = null;
 async function getObfuscator() {
@@ -184,6 +185,54 @@ const WEBGL_RENDERER_MARKER = "Mesa OffScreen";
 const PRODUCTSUB_GECKO = "20030107";
 const SEQUENTUM_MARKER = "Sequentum";
 
+const PROBE_FONT_STACKS = [
+  "sans-serif",
+  "serif",
+  "monospace",
+  "Arial",
+  "'Times New Roman'",
+  "'Courier New'",
+  "'Segoe UI'",
+  "'SF Pro Text'",
+  "'Helvetica Neue'",
+  "'Ubuntu'",
+  "'DejaVu Sans'",
+  "'Roboto'",
+  "Tahoma",
+  "Calibri",
+  "'Cantarell'",
+  "'Liberation Sans'",
+  "'Noto Sans'",
+];
+
+function buildProbe(P) {
+  const sf = rVar();
+  const nat = rVar();
+  const fields = [
+    `${sf}("ua",function(){return navigator.userAgent});`,
+    `${sf}("productSub",function(){return navigator.productSub});`,
+    `${sf}("webdriver",function(){return navigator.webdriver});`,
+    `${sf}("oscpu",function(){return navigator.oscpu===undefined?"__undefined":navigator.oscpu});`,
+    `${sf}("deviceMemory",function(){return navigator.deviceMemory});`,
+    `${sf}("uaDataPresent",function(){return !!navigator.userAgentData});`,
+    `${sf}("uaData",function(){var u=navigator.userAgentData;return u?{mobile:u.mobile,brands:(u.brands||[]).map(function(b){return b.brand+"/"+b.version})}:null});`,
+    `${sf}("plugins",function(){return {length:navigator.plugins.length}});`,
+    `${sf}("pdfViewerEnabled",function(){return navigator.pdfViewerEnabled});`,
+    `${sf}("engine",function(){return {hasMozInnerScreenX:typeof window.mozInnerScreenX!=="undefined",hasChrome:typeof window.chrome!=="undefined"}});`,
+    `${sf}("screen",function(){return {width:screen.width,height:screen.height}});`,
+    `${sf}("outerWH",function(){return [outerWidth,outerHeight]});`,
+    `${sf}("isExtended",function(){return screen.isExtended===undefined?null:screen.isExtended});`,
+    `${sf}("fontWidths",function(){var sp=document.createElement("span");sp.style.cssText="position:absolute;left:-9999px;top:-9999px;font-size:72px;white-space:nowrap";sp.textContent="mmmmmmmmmmlli WwWwGg @#Xj";document.body.appendChild(sp);var st=${JSON.stringify(PROBE_FONT_STACKS)};var out=[];for(var i=0;i<st.length;i++){sp.style.fontFamily=st[i];out.push(Math.round(sp.getBoundingClientRect().width*100)/100)}document.body.removeChild(sp);return out});`,
+    `${sf}("tamper",function(){return {getParameterWebGL:${nat}(WebGLRenderingContext.prototype.getParameter),toDataURL:${nat}(HTMLCanvasElement.prototype.toDataURL),getImageData:${nat}(CanvasRenderingContext2D.prototype.getImageData),permissionsQuery:navigator.permissions?${nat}(navigator.permissions.query):true,fnToString:${nat}(Function.prototype.toString)}});`,
+  ];
+  shuffle(fields);
+  return (
+    `var ${P}={};function ${sf}(k,f){try{${P}[k]=f()}catch(e){${P}[k]=null}}` +
+    `function ${nat}(fn){try{return /\\{\\s*\\[native code\\]\\s*\\}/.test(Function.prototype.toString.call(fn))}catch(e){return true}}` +
+    fields.join("")
+  );
+}
+
 function hashWith(seed) {
   return (s) => {
     let h = seed >>> 0;
@@ -348,6 +397,7 @@ function buildClientScript({
   const dvKey = rVar();
   const nKey = rVar();
   const outKey = rVar();
+  const pKey = rVar();
 
   const envChecks = [
     `try { const ${nKey}st = (new Error()).stack || ''; if (${nKey}st.indexOf('node:internal') !== -1 || ${nKey}st.indexOf('moduleEvaluation') !== -1 || ${nKey}st.indexOf('loadAndEvaluateModule') !== -1 || ${nKey}st.indexOf('file:///') !== -1 || ${nKey}st.indexOf('[eval]') !== -1 || /\\(native:/.test(${nKey}st)) return null; } catch { return null }`,
@@ -367,7 +417,7 @@ function buildClientScript({
 
   return `(function(){window.onload=async function(){try {${helpers}const ${dvKey}=await (async function(){${shuffle(envChecks).join("")}${blockChecks}
       var ${vars[0]}=${initVals[0]};var ${vars[1]}=${initVals[1]};var ${vars[2]}=${initVals[2]};var ${vars[3]}=${initVals[3]};${clientEqs}
-      var ${outKey}={};${outKey}["${vars[0]}"]=${vars[0]};${outKey}["${vars[1]}"]=${vars[1]};${outKey}["${vars[2]}"]=${vars[2]};${outKey}["${vars[3]}"]=${vars[3]};return ${outKey};})();if (!${dvKey} || typeof ${dvKey} !== 'object') return;parent.postMessage({type: 'cap:instr',nonce:${JSON.stringify(id)},result:{i:${JSON.stringify(id)},state:${dvKey},ts:Date.now()}},'*');} catch {}};})();`;
+      var ${outKey}={};${outKey}["${vars[0]}"]=${vars[0]};${outKey}["${vars[1]}"]=${vars[1]};${outKey}["${vars[2]}"]=${vars[2]};${outKey}["${vars[3]}"]=${vars[3]};return ${outKey};})();if (!${dvKey} || typeof ${dvKey} !== 'object') return;${buildProbe(pKey)}parent.postMessage({type: 'cap:instr',nonce:${JSON.stringify(id)},result:{i:${JSON.stringify(id)},state:${dvKey},p:${pKey},ts:Date.now()}},'*');} catch {}};})();`;
 }
 
 const DEFAULT_TTL_MS = 5 * 60 * 1000;
@@ -557,5 +607,34 @@ export function verifyInstrumentationResult(challengeMeta, payload) {
     return { valid: false, reason: "failed_challenge" };
   }
 
-  return { valid: true };
+  const probe = payload.p;
+  if (probe && typeof probe === "object") {
+    const vector =
+      Array.isArray(payload.vp) && payload.vp.length === 2
+        ? { ...probe, innerWH: payload.vp }
+        : probe;
+    const d = detectAutomation(vector, {
+      fontStackCount: PROBE_FONT_STACKS.length,
+    });
+    if (challengeMeta.blockAutomatedBrowsers && !d.pass) {
+      return {
+        valid: false,
+        reason: "instr_automated_browser",
+        blockedBy: d.blockedBy,
+        checks: d.checks,
+      };
+    }
+    return {
+      valid: true,
+      riskFlags: d.riskFlags,
+      blockedBy: d.blockedBy,
+      checks: d.checks,
+    };
+  }
+
+  if (challengeMeta.blockAutomatedBrowsers) {
+    return { valid: false, reason: "instr_probe_missing" };
+  }
+
+  return { valid: true, riskFlags: [] };
 }