capjs-core 0.1.3 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capjs-core",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Stateless server-side challenge generator and verifier for Cap, a lightweight, modern open-source CAPTCHA alternative. No storage, no filesystem - bring your own.",
   "keywords": [
     "anti-abuse",
@@ -33,6 +33,13 @@
       "types": "./src/index.d.ts",
       "import": "./src/index.js",
       "default": "./src/index.js"
+    },
+    "./hashwx.wasm": "./src/hashwx.wasm"
+  },
+  "imports": {
+    "#hashwx-load": {
+      "workerd": "./src/hashwx-load.workerd.js",
+      "default": "./src/hashwx-load.js"
     }
   },
   "types": "src/index.d.ts",
@@ -46,6 +53,9 @@
     "src/rsw.js",
     "src/hashwx.js",
     "src/hashwx-wasm.js",
+    "src/hashwx-load.js",
+    "src/hashwx-load.workerd.js",
+    "src/hashwx.wasm",
     "README.md",
     "LICENSE"
   ],

package/src/hashwx-load.js

@@ -0,0 +1,14 @@
+import { HASHWX_WASM_BASE64 } from "./hashwx-wasm.js";
+
+function decodeBase64(b64) {
+  if (typeof Buffer !== "undefined")
+    return new Uint8Array(Buffer.from(b64, "base64"));
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+export function loadHashwxModule() {
+  return WebAssembly.compile(decodeBase64(HASHWX_WASM_BASE64));
+}

package/src/hashwx-load.workerd.js

@@ -0,0 +1,5 @@
+import hashwxModule from "./hashwx.wasm";
+
+export async function loadHashwxModule() {
+  return hashwxModule;
+}

package/src/hashwx.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { HASHWX_WASM_BASE64 } from "./hashwx-wasm.js";
+import { loadHashwxModule } from "#hashwx-load";
 
 export const HASHWX_SEED_SIZE = 32;
 export const HASHWX_CHALLENGE_SIZE = 32;
@@ -15,19 +15,23 @@ export const MAX_HASHWX_CHALLENGE_COUNT = 64;
 const U64_MAX = (1n << 64n) - 1n;
 const HASHWX_INTERPRETED = 0;
 
-function decodeBase64(b64) {
-  if (typeof Buffer !== "undefined")
-    return new Uint8Array(Buffer.from(b64, "base64"));
-  const bin = atob(b64);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
-  return out;
-}
-
 let readyPromise = null;
+let suppliedModule = null;
+
+export function setHashwxModule(module) {
+  if (!(module instanceof WebAssembly.Module))
+    throw new TypeError(
+      "[capjs-core] setHashwxModule expects a WebAssembly.Module",
+    );
+  if (readyPromise)
+    throw new Error(
+      "[capjs-core] setHashwxModule must be called before HashWX initializes",
+    );
+  suppliedModule = module;
+}
 
 async function init() {
-  const mod = await WebAssembly.compile(decodeBase64(HASHWX_WASM_BASE64));
+  const mod = suppliedModule ?? (await loadHashwxModule());
   const instance = new WebAssembly.Instance(mod, {});
   const exports = instance.exports;
   if (typeof exports._initialize === "function") exports._initialize();

package/src/index.d.ts

@@ -250,6 +250,12 @@ export interface HashwxState {
   seedPtr: number;
 }
 
+/** Supplies a precompiled HashWX module for runtimes that forbid compiling
+ *  wasm at runtime. Cloudflare Workers pick up
+ *  the bundled `hashwx.wasm` automatically. Must be called before the first
+ *  verification or `hashwxReady()`. */
+export function setHashwxModule(module: WebAssembly.Module): void;
+
 /** Compiles and initializes the embedded HashWX wasm. Called automatically on
  *  first verification; await it at boot to move the cost off the first
  *  request. Resolves to a state handle reusable with `hashwxHash`. */

package/src/index.js

@@ -27,6 +27,7 @@ export {
   hashwxReady,
   hashwxSeed,
   hashwxTarget,
+  setHashwxModule,
 } from "./hashwx.js";
 
 import { fnv1a, fnv1aResume, prngFromHash } from "./prng.js";
@@ -240,9 +241,12 @@ export async function validateChallenge(secret, body, opts = {}) {
     }
 
     if (body.instr_blocked === true) {
-      if (instrMeta.blockAutomatedBrowsers) {
-        return fail("instr_automated_browser", { instr_error: true });
-      }
+      return fail(
+        instrMeta.blockAutomatedBrowsers
+          ? "instr_automated_browser"
+          : "instr_failed",
+        { instr_error: true },
+      );
     } else if (body.instr_timeout === true) {
       return fail("instr_timeout", { instr_error: true });
     } else if (body.instr) {
@@ -434,9 +438,12 @@ async function validateChallengeV2(secret, body, payload, opts = {}) {
         return fail("instr_expired", { instr_error: true });
       }
       if (s.blocked === true) {
-        if (meta.blockAutomatedBrowsers) {
-          return fail("instr_automated_browser", { instr_error: true });
-        }
+        return fail(
+          meta.blockAutomatedBrowsers
+            ? "instr_automated_browser"
+            : "instr_failed",
+          { instr_error: true },
+        );
       } else if (s.timeout === true) {
         return fail("instr_timeout", { instr_error: true });
       } else if (s.instr) {