engagelab-captcha-sdk 1.0.0

package/src/passive_signals.ts

@@ -0,0 +1,544 @@
+/**
+ * Passive Signal Collection — detect bots through background behavioral analysis.
+ * These signals are collected BEFORE the user interacts with any challenge.
+ */
+
+import { sdkLogger } from './logger';
+
+export interface DeviceMotionResult {
+  sampleCount: number;
+  avgAcceleration: number;
+  stdAcceleration: number;
+  avgRotationRate: number;
+  stdRotationRate: number;
+  hasGravity: boolean;
+}
+
+export interface DeviceOrientationResult {
+  sampleCount: number;
+  avgGammaDelta: number;
+  avgBetaDelta: number;
+  hasData: boolean;
+}
+
+export interface PassiveSignalResult {
+  rafTiming: RafTimingResult;
+  hoverTrap: HoverTrapResult;
+  eventTiming: EventTimingResult;
+  scrollBehavior: ScrollBehaviorResult;
+  idlePattern: IdlePatternResult;
+  inputBehavior: InputBehaviorResult;
+  deviceMotion?: DeviceMotionResult;
+  deviceOrientation?: DeviceOrientationResult;
+}
+
+interface RafTimingResult {
+  avgInterval: number;
+  stdInterval: number;
+  minInterval: number;
+  maxInterval: number;
+  frameCount: number;
+  anomaly: boolean;
+  anomalyType: string;
+}
+
+interface HoverTrapResult {
+  triggered: boolean;
+  hoverCount: number;
+  mouseOverHidden: boolean;
+}
+
+interface EventTimingResult {
+  mousedownToMouseup: number[];
+  mousemoveToClick: number;
+  avgClickDuration: number;
+  hasNaturalVariance: boolean;
+}
+
+interface ScrollBehaviorResult {
+  scrollEvents: number;
+  hasInertia: boolean;
+  avgScrollDelta: number;
+  scrollPatternRegular: boolean;
+}
+
+interface IdlePatternResult {
+  idlePeriods: number;
+  avgIdleDuration: number;
+  hasNaturalPauses: boolean;
+}
+
+interface InputBehaviorResult {
+  keyPressIntervals: number[];
+  hasTypingRhythm: boolean;
+  avgKeyInterval: number;
+  keystrokeDynamics: KeystrokeDynamics;
+}
+
+interface KeystrokeDynamics {
+  dwellTimes: number[];      // How long each key is held (keydown→keyup)
+  flightTimes: number[];     // Time between consecutive keyup→keydown
+  avgDwell: number;
+  avgFlight: number;
+  dwellVariance: number;
+  flightVariance: number;
+  digraphLatencies: Record<string, number[]>;  // Timing for common key pairs
+}
+
+export class PassiveSignalCollector {
+  private rafTimings: number[] = [];
+  private lastRafTime = 0;
+  private rafHandle = 0;
+  private mouseEvents: Array<{ type: string; time: number; x: number; y: number }> = [];
+  private scrollEvents: Array<{ time: number; deltaY: number }> = [];
+  private keyEvents: Array<{ time: number; key: string; type: 'down' | 'up' }> = [];
+  private hoverTrapTriggered = false;
+  private hoverTrapElement: HTMLElement | null = null;
+  private idlePeriods: number[] = [];
+  private lastActivityTime = 0;
+  private collecting = false;
+
+  // Device sensor data
+  private motionSamples: Array<{ accel: number; rotation: number }> = [];
+  private motionHasGravity = false;
+  private orientationDeltas: Array<{ gammaDelta: number; betaDelta: number }> = [];
+  private lastGamma: number | null = null;
+  private lastBeta: number | null = null;
+  private isMobileDevice = false;
+
+  start(): void {
+    if (this.collecting) return;
+    this.collecting = true;
+    this.lastActivityTime = performance.now();
+    sdkLogger.info('PassiveSignals', 'Collector start');
+
+    // 1. Start rAF timing measurement
+    this.measureRaf();
+
+    // 2. Set up hover trap
+    this.setupHoverTrap();
+
+    // 3. Attach event listeners
+    this.attachListeners();
+
+    // 4. Start device sensor collection (mobile only)
+    this.startDeviceSensors();
+  }
+
+  stop(): void {
+    this.collecting = false;
+    cancelAnimationFrame(this.rafHandle);
+    this.removeHoverTrap();
+    this.detachListeners();
+    this.stopDeviceSensors();
+    sdkLogger.info('PassiveSignals', 'Collector stop');
+  }
+
+  getResults(): PassiveSignalResult {
+    const rafTiming = this.analyzeRafTiming();
+    const hoverTrap = this.analyzeHoverTrap();
+    const eventTiming = this.analyzeEventTiming();
+    const scrollBehavior = this.analyzeScrollBehavior();
+    const idlePattern = this.analyzeIdlePattern();
+    const inputBehavior = this.analyzeInputBehavior();
+    const deviceMotion = this.analyzeDeviceMotion();
+    const deviceOrientation = this.analyzeDeviceOrientation();
+    sdkLogger.debug('PassiveSignals', 'Results summary', {
+      rafFrames: rafTiming.frameCount,
+      rafAnomaly: rafTiming.anomaly,
+      hoverTriggered: hoverTrap.triggered,
+      mouseEvents: this.mouseEvents.length,
+      scrollEvents: scrollBehavior.scrollEvents,
+      idlePeriods: idlePattern.idlePeriods,
+      motionSamples: deviceMotion?.sampleCount ?? 0,
+      orientationSamples: deviceOrientation?.sampleCount ?? 0,
+    });
+    const result: PassiveSignalResult = {
+      rafTiming,
+      hoverTrap,
+      eventTiming,
+      scrollBehavior,
+      idlePattern,
+      inputBehavior,
+    };
+    if (deviceMotion) result.deviceMotion = deviceMotion;
+    if (deviceOrientation) result.deviceOrientation = deviceOrientation;
+    return result;
+  }
+
+  // --- rAF Timing ---
+  private measureRaf(): void {
+    const measure = (now: number) => {
+      if (!this.collecting) return;
+      if (this.lastRafTime > 0) {
+        this.rafTimings.push(now - this.lastRafTime);
+      }
+      this.lastRafTime = now;
+      // Collect for up to 120 frames (~2 seconds at 60fps)
+      if (this.rafTimings.length < 120) {
+        this.rafHandle = requestAnimationFrame(measure);
+      }
+    };
+    this.rafHandle = requestAnimationFrame(measure);
+  }
+
+  private analyzeRafTiming(): RafTimingResult {
+    const t = this.rafTimings;
+    if (t.length < 10) {
+      return { avgInterval: 0, stdInterval: 0, minInterval: 0, maxInterval: 0, frameCount: 0, anomaly: false, anomalyType: 'insufficient_data' };
+    }
+
+    const avg = t.reduce((a, b) => a + b, 0) / t.length;
+    const std = Math.sqrt(t.reduce((s, v) => s + (v - avg) ** 2, 0) / t.length);
+    const min = Math.min(...t);
+    const max = Math.max(...t);
+
+    let anomaly = false;
+    let anomalyType = 'none';
+
+    // Real browser at 60fps: avg ~16.67ms, std ~1-3ms
+    // Headless/virtual: avg might be exact 16.67 with std < 0.1
+    // Or completely irregular (batch rendering)
+    if (std < 0.1 && t.length > 30) {
+      anomaly = true;
+      anomalyType = 'perfect_timing'; // Too perfect = virtual display
+    } else if (avg < 5) {
+      anomaly = true;
+      anomalyType = 'too_fast'; // Faster than any real display
+    } else if (avg > 50 && t.length > 20) {
+      anomaly = true;
+      anomalyType = 'too_slow'; // Below 20fps consistently
+    } else if (std > avg * 0.5 && t.length > 30) {
+      anomaly = true;
+      anomalyType = 'highly_irregular'; // No real vsync
+    }
+
+    return { avgInterval: avg, stdInterval: std, minInterval: min, maxInterval: max, frameCount: t.length, anomaly, anomalyType };
+  }
+
+  // --- CSS Hover Trap ---
+  private setupHoverTrap(): void {
+    // Create invisible elements that only real mouse movement would trigger
+    const trap = document.createElement('div');
+    trap.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;pointer-events:none;z-index:-1;opacity:0;';
+
+    // Inner trap element with pointer-events auto
+    const inner = document.createElement('div');
+    inner.style.cssText = 'position:absolute;top:10%;left:10%;width:80%;height:80%;pointer-events:auto;';
+
+    inner.addEventListener('mouseover', () => {
+      this.hoverTrapTriggered = true;
+    });
+
+    trap.appendChild(inner);
+    document.body.appendChild(trap);
+    this.hoverTrapElement = trap;
+  }
+
+  private removeHoverTrap(): void {
+    if (this.hoverTrapElement) {
+      document.body.removeChild(this.hoverTrapElement);
+      this.hoverTrapElement = null;
+    }
+  }
+
+  private analyzeHoverTrap(): HoverTrapResult {
+    const hoverEvents = this.mouseEvents.filter(e => e.type === 'mouseover');
+    return {
+      triggered: this.hoverTrapTriggered,
+      hoverCount: hoverEvents.length,
+      mouseOverHidden: this.hoverTrapTriggered,
+    };
+  }
+
+  // --- Event Listeners ---
+  private onMouseEvent = (e: MouseEvent) => {
+    if (!this.collecting) return;
+    const now = performance.now();
+    this.mouseEvents.push({ type: e.type, time: now, x: e.clientX, y: e.clientY });
+    this.recordActivity(now);
+    // Cap storage
+    if (this.mouseEvents.length > 500) this.mouseEvents.splice(0, 100);
+  };
+
+  private onScrollEvent = (e: Event) => {
+    if (!this.collecting) return;
+    const we = e as WheelEvent;
+    const now = performance.now();
+    this.scrollEvents.push({ time: now, deltaY: we.deltaY || 0 });
+    this.recordActivity(now);
+    if (this.scrollEvents.length > 200) this.scrollEvents.splice(0, 50);
+  };
+
+  private onKeyDown = (e: KeyboardEvent) => {
+    if (!this.collecting) return;
+    const now = performance.now();
+    const key = e.key.length === 1 ? 'char' : e.key;
+    this.keyEvents.push({ time: now, key, type: 'down' });
+    this.recordActivity(now);
+    if (this.keyEvents.length > 400) this.keyEvents.splice(0, 100);
+  };
+
+  private onKeyUp = (e: KeyboardEvent) => {
+    if (!this.collecting) return;
+    const now = performance.now();
+    const key = e.key.length === 1 ? 'char' : e.key;
+    this.keyEvents.push({ time: now, key, type: 'up' });
+    this.recordActivity(now);
+    if (this.keyEvents.length > 400) this.keyEvents.splice(0, 100);
+  };
+
+  private recordActivity(now: number): void {
+    const gap = now - this.lastActivityTime;
+    if (gap > 2000) {
+      this.idlePeriods.push(gap);
+    }
+    this.lastActivityTime = now;
+  }
+
+  private attachListeners(): void {
+    document.addEventListener('mousedown', this.onMouseEvent, { passive: true });
+    document.addEventListener('mouseup', this.onMouseEvent, { passive: true });
+    document.addEventListener('mousemove', this.onMouseEvent, { passive: true });
+    document.addEventListener('mouseover', this.onMouseEvent, { passive: true });
+    document.addEventListener('wheel', this.onScrollEvent, { passive: true });
+    document.addEventListener('keydown', this.onKeyDown, { passive: true });
+    document.addEventListener('keyup', this.onKeyUp, { passive: true });
+  }
+
+  private detachListeners(): void {
+    document.removeEventListener('mousedown', this.onMouseEvent);
+    document.removeEventListener('mouseup', this.onMouseEvent);
+    document.removeEventListener('mousemove', this.onMouseEvent);
+    document.removeEventListener('mouseover', this.onMouseEvent);
+    document.removeEventListener('wheel', this.onScrollEvent);
+    document.removeEventListener('keydown', this.onKeyDown);
+    document.removeEventListener('keyup', this.onKeyUp);
+  }
+
+  // --- Analysis Methods ---
+  private analyzeEventTiming(): EventTimingResult {
+    const downs = this.mouseEvents.filter(e => e.type === 'mousedown');
+    const ups = this.mouseEvents.filter(e => e.type === 'mouseup');
+
+    const clickDurations: number[] = [];
+    for (const down of downs) {
+      const up = ups.find(u => u.time > down.time && u.time - down.time < 1000);
+      if (up) clickDurations.push(up.time - down.time);
+    }
+
+    const moves = this.mouseEvents.filter(e => e.type === 'mousemove');
+    let moveThenClick = 0;
+    if (moves.length > 0 && downs.length > 0) {
+      const lastMove = moves[moves.length - 1];
+      const firstClick = downs[0];
+      moveThenClick = firstClick.time - lastMove.time;
+    }
+
+    const avgClick = clickDurations.length > 0
+      ? clickDurations.reduce((a, b) => a + b, 0) / clickDurations.length
+      : 0;
+
+    const hasVariance = clickDurations.length >= 3 &&
+      (Math.max(...clickDurations) - Math.min(...clickDurations)) > 20;
+
+    return {
+      mousedownToMouseup: clickDurations.slice(0, 10),
+      mousemoveToClick: moveThenClick,
+      avgClickDuration: avgClick,
+      hasNaturalVariance: hasVariance,
+    };
+  }
+
+  private analyzeScrollBehavior(): ScrollBehaviorResult {
+    const se = this.scrollEvents;
+    if (se.length < 3) {
+      return { scrollEvents: se.length, hasInertia: false, avgScrollDelta: 0, scrollPatternRegular: false };
+    }
+
+    const deltas = se.map(s => Math.abs(s.deltaY));
+    const avgDelta = deltas.reduce((a, b) => a + b, 0) / deltas.length;
+
+    // Check for inertia (decreasing deltas = natural scroll)
+    let hasInertia = false;
+    for (let i = 0; i < se.length - 3; i++) {
+      const d1 = Math.abs(se[i].deltaY);
+      const d2 = Math.abs(se[i + 1].deltaY);
+      const d3 = Math.abs(se[i + 2].deltaY);
+      if (d1 > d2 && d2 > d3 && d1 > 10) {
+        hasInertia = true;
+        break;
+      }
+    }
+
+    // Check regularity
+    const intervals = [];
+    for (let i = 1; i < se.length; i++) {
+      intervals.push(se[i].time - se[i - 1].time);
+    }
+    const ivAvg = intervals.reduce((a, b) => a + b, 0) / intervals.length;
+    const ivStd = Math.sqrt(intervals.reduce((s, v) => s + (v - ivAvg) ** 2, 0) / intervals.length);
+    const regular = ivAvg > 0 && ivStd / ivAvg < 0.1;
+
+    return { scrollEvents: se.length, hasInertia, avgScrollDelta: avgDelta, scrollPatternRegular: regular };
+  }
+
+  private analyzeIdlePattern(): IdlePatternResult {
+    const ip = this.idlePeriods;
+    const avgIdle = ip.length > 0 ? ip.reduce((a, b) => a + b, 0) / ip.length : 0;
+    return {
+      idlePeriods: ip.length,
+      avgIdleDuration: avgIdle,
+      hasNaturalPauses: ip.length >= 1 && avgIdle > 500,
+    };
+  }
+
+  private analyzeInputBehavior(): InputBehaviorResult {
+    const ke = this.keyEvents;
+    const intervals: number[] = [];
+    const downEvents = ke.filter(e => e.type === 'down');
+    for (let i = 1; i < downEvents.length; i++) {
+      intervals.push(downEvents[i].time - downEvents[i - 1].time);
+    }
+    const avg = intervals.length > 0 ? intervals.reduce((a, b) => a + b, 0) / intervals.length : 0;
+    const hasRhythm = intervals.length >= 5 && avg > 50 && avg < 500;
+
+    // Keystroke dynamics: dwell times (key hold duration) and flight times
+    const dwellTimes: number[] = [];
+    const flightTimes: number[] = [];
+    const digraphLatencies: Record<string, number[]> = {};
+
+    // Match keydown→keyup pairs for dwell time
+    const pendingDown: Map<string, number> = new Map();
+    const upHistory: Array<{ time: number; key: string }> = [];
+
+    for (const event of ke) {
+      if (event.type === 'down') {
+        pendingDown.set(event.key, event.time);
+        // Flight time: previous keyup → current keydown
+        if (upHistory.length > 0) {
+          const lastUp = upHistory[upHistory.length - 1];
+          const flight = event.time - lastUp.time;
+          if (flight > 0 && flight < 2000) {
+            flightTimes.push(flight);
+            // Digraph: pair of consecutive keys
+            const digraph = `${lastUp.key}_${event.key}`;
+            if (!digraphLatencies[digraph]) digraphLatencies[digraph] = [];
+            digraphLatencies[digraph].push(flight);
+          }
+        }
+      } else if (event.type === 'up') {
+        const downTime = pendingDown.get(event.key);
+        if (downTime !== undefined) {
+          const dwell = event.time - downTime;
+          if (dwell > 0 && dwell < 2000) {
+            dwellTimes.push(dwell);
+          }
+          pendingDown.delete(event.key);
+        }
+        upHistory.push({ time: event.time, key: event.key });
+        if (upHistory.length > 50) upHistory.splice(0, 25);
+      }
+    }
+
+    const mean = (arr: number[]) => arr.length > 0 ? arr.reduce((a, b) => a + b, 0) / arr.length : 0;
+    const variance = (arr: number[]) => {
+      if (arr.length < 2) return 0;
+      const m = mean(arr);
+      return arr.reduce((s, v) => s + (v - m) ** 2, 0) / arr.length;
+    };
+
+    return {
+      keyPressIntervals: intervals.slice(0, 20),
+      hasTypingRhythm: hasRhythm,
+      avgKeyInterval: avg,
+      keystrokeDynamics: {
+        dwellTimes: dwellTimes.slice(0, 30),
+        flightTimes: flightTimes.slice(0, 30),
+        avgDwell: mean(dwellTimes),
+        avgFlight: mean(flightTimes),
+        dwellVariance: variance(dwellTimes),
+        flightVariance: variance(flightTimes),
+        digraphLatencies,
+      },
+    };
+  }
+
+  // --- Device Sensor Collection ---
+  private onDeviceMotion = (e: DeviceMotionEvent) => {
+    if (!this.collecting) return;
+    const a = e.accelerationIncludingGravity;
+    const r = e.rotationRate;
+    if (a) {
+      const accelMag = Math.sqrt((a.x ?? 0) ** 2 + (a.y ?? 0) ** 2 + (a.z ?? 0) ** 2);
+      const rotMag = r ? Math.sqrt((r.alpha ?? 0) ** 2 + (r.beta ?? 0) ** 2 + (r.gamma ?? 0) ** 2) : 0;
+      this.motionSamples.push({ accel: accelMag, rotation: rotMag });
+      if (e.acceleration && (e.acceleration.x !== null || e.acceleration.y !== null)) {
+        this.motionHasGravity = true;
+      }
+    }
+    if (this.motionSamples.length > 200) this.motionSamples.splice(0, 50);
+  };
+
+  private onDeviceOrientation = (e: DeviceOrientationEvent) => {
+    if (!this.collecting) return;
+    const gamma = e.gamma ?? 0;
+    const beta = e.beta ?? 0;
+    if (this.lastGamma !== null && this.lastBeta !== null) {
+      this.orientationDeltas.push({
+        gammaDelta: Math.abs(gamma - this.lastGamma),
+        betaDelta: Math.abs(beta - this.lastBeta),
+      });
+    }
+    this.lastGamma = gamma;
+    this.lastBeta = beta;
+    if (this.orientationDeltas.length > 200) this.orientationDeltas.splice(0, 50);
+  };
+
+  private startDeviceSensors(): void {
+    this.isMobileDevice = navigator.maxTouchPoints > 0;
+    if (!this.isMobileDevice) return;
+    window.addEventListener('devicemotion', this.onDeviceMotion, { passive: true });
+    window.addEventListener('deviceorientation', this.onDeviceOrientation, { passive: true });
+    sdkLogger.debug('PassiveSignals', 'Device sensors started (mobile detected)');
+  }
+
+  private stopDeviceSensors(): void {
+    if (!this.isMobileDevice) return;
+    window.removeEventListener('devicemotion', this.onDeviceMotion);
+    window.removeEventListener('deviceorientation', this.onDeviceOrientation);
+  }
+
+  private analyzeDeviceMotion(): DeviceMotionResult | undefined {
+    if (!this.isMobileDevice) return undefined;
+    const samples = this.motionSamples;
+    const accels = samples.map(s => s.accel);
+    const rots = samples.map(s => s.rotation);
+    const mean = (arr: number[]) => arr.length > 0 ? arr.reduce((a, b) => a + b, 0) / arr.length : 0;
+    const std = (arr: number[]) => {
+      if (arr.length < 2) return 0;
+      const m = mean(arr);
+      return Math.sqrt(arr.reduce((s, v) => s + (v - m) ** 2, 0) / arr.length);
+    };
+    return {
+      sampleCount: samples.length,
+      avgAcceleration: mean(accels),
+      stdAcceleration: std(accels),
+      avgRotationRate: mean(rots),
+      stdRotationRate: std(rots),
+      hasGravity: this.motionHasGravity,
+    };
+  }
+
+  private analyzeDeviceOrientation(): DeviceOrientationResult | undefined {
+    if (!this.isMobileDevice) return undefined;
+    const deltas = this.orientationDeltas;
+    const mean = (arr: number[]) => arr.length > 0 ? arr.reduce((a, b) => a + b, 0) / arr.length : 0;
+    return {
+      sampleCount: deltas.length,
+      avgGammaDelta: mean(deltas.map(d => d.gammaDelta)),
+      avgBetaDelta: mean(deltas.map(d => d.betaDelta)),
+      hasData: deltas.length > 0,
+    };
+  }
+}

package/src/pow.ts

@@ -0,0 +1,120 @@
+import { PowResult } from './types';
+import { sdkLogger } from './logger';
+
+export async function computePoW(challenge: string, difficulty: number): Promise<PowResult> {
+  sdkLogger.info('PoW', 'Computation start', {
+    difficulty,
+    challengeLen: challenge?.length ?? 0,
+    useWorker: typeof Worker !== 'undefined',
+  });
+  const result =
+    typeof Worker !== 'undefined'
+      ? await computeInWorker(challenge, difficulty)
+      : await computeInline(challenge, difficulty);
+  sdkLogger.info('PoW', 'Computation done', {
+    iterations: result.iterations,
+    timeMs: `${result.computationTimeMs.toFixed(1)}ms`,
+    difficulty: result.difficulty,
+  });
+  return result;
+}
+
+function computeInWorker(challenge: string, difficulty: number): Promise<PowResult> {
+  return new Promise((resolve, reject) => {
+    const workerCode = `
+      self.onmessage = async function(e) {
+        const { challenge, difficulty } = e.data;
+        const prefix = '0'.repeat(difficulty);
+        const start = performance.now();
+        let nonce = 0;
+        const encoder = new TextEncoder();
+
+        while (true) {
+          const data = encoder.encode(challenge + nonce.toString());
+          const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+          const hashArray = Array.from(new Uint8Array(hashBuffer));
+          const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+
+          if (hashHex.startsWith(prefix)) {
+            self.postMessage({
+              nonce: nonce.toString(),
+              computationTimeMs: performance.now() - start,
+              iterations: nonce + 1,
+            });
+            return;
+          }
+          nonce++;
+          if (nonce > 10000000) {
+            self.postMessage({ error: 'timeout' });
+            return;
+          }
+        }
+      };
+    `;
+
+    const blob = new Blob([workerCode], { type: 'application/javascript' });
+    const blobUrl = URL.createObjectURL(blob);
+    const worker = new Worker(blobUrl);
+
+    const cleanup = () => { worker.terminate(); URL.revokeObjectURL(blobUrl); };
+
+    const timeout = setTimeout(() => {
+      cleanup();
+      resolve(computeInline(challenge, difficulty));
+    }, 30000);
+
+    worker.onmessage = (e) => {
+      clearTimeout(timeout);
+      cleanup();
+      if (e.data.error) {
+        resolve(computeInline(challenge, difficulty));
+      } else {
+        resolve({
+          challenge,
+          nonce: e.data.nonce,
+          difficulty,
+          computationTimeMs: e.data.computationTimeMs,
+          iterations: e.data.iterations,
+        });
+      }
+    };
+
+    worker.onerror = () => {
+      clearTimeout(timeout);
+      cleanup();
+      resolve(computeInline(challenge, difficulty));
+    };
+
+    worker.postMessage({ challenge, difficulty });
+  });
+}
+
+async function computeInline(challenge: string, difficulty: number): Promise<PowResult> {
+  const prefix = '0'.repeat(difficulty);
+  const start = performance.now();
+  let nonce = 0;
+  const encoder = new TextEncoder();
+
+  while (nonce < 10000000) {
+    const data = encoder.encode(challenge + nonce.toString());
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+
+    if (hashHex.startsWith(prefix)) {
+      return {
+        challenge,
+        nonce: nonce.toString(),
+        difficulty,
+        computationTimeMs: performance.now() - start,
+        iterations: nonce + 1,
+      };
+    }
+    nonce++;
+    if (nonce % 10000 === 0) {
+      await new Promise(r => setTimeout(r, 0));
+    }
+  }
+
+  return { challenge, nonce: '', difficulty, computationTimeMs: performance.now() - start, iterations: nonce };
+}