ribaunt 0.1.5 → 0.2.0

package/README.md

@@ -37,11 +37,14 @@ pnpm add ribaunt
 ## Quick Start
 
 Set a strong secret in your server environment. Keep this server-only.
+Ribaunt requires at least 32 UTF-8 bytes; generate a random value rather than a memorable password.
 
 ```env
 RIBAUNT_SECRET="replace-with-a-long-random-secret"
 ```
 
+> **Upgrading from v0.1:** `verifySolution()` now returns a structured result object, not a boolean. Always check `result.valid`; using the result object directly in an `if` condition is unsafe because JavaScript objects are truthy.
+
 Create two endpoints: one to issue challenges and one to verify solutions.
 
 ```ts
@@ -60,10 +63,10 @@ app.get('/api/captcha/challenge', (_req, res) => {
 
 app.post('/api/captcha/verify', async (req, res) => {
   const { tokens, solutions } = req.body;
-  const valid = await verifySolution(tokens, solutions);
+  const result = await verifySolution(tokens, solutions);
 
-  if (!valid) {
-    return res.status(400).json({ success: false, error: 'Invalid CAPTCHA solution' });
+  if (!result.valid) {
+    return res.status(400).json({ success: false, error: result.reason });
   }
 
   return res.json({ success: true });
@@ -142,10 +145,11 @@ Validate user- or config-controlled values before passing them to `createChallen
 
 ### `verifySolution(tokens, solutions, options?)`
 
-Verifies submitted solutions and returns `Promise<boolean>`.
+Verifies submitted solutions and returns a structured result:
+`{ valid: true }` or `{ valid: false, reason, message }`.
 
 ```ts
-const valid = await verifySolution(tokens, solutions, {
+const result = await verifySolution(tokens, solutions, {
   onWarning: (warning) => {
     console.log('captcha warning', warning.reason, warning.message);
   },
@@ -155,7 +159,7 @@ const valid = await verifySolution(tokens, solutions, {
 Replay prevention defaults to `local`, which blocks token reuse in the current process. For serverless or horizontally scaled deployments, use `replayPrevention: 'remote'` with an atomic distributed store.
 
 ```ts
-const valid = await verifySolution(tokens, solutions, {
+const result = await verifySolution(tokens, solutions, {
   replayPrevention: 'remote',
   replayStore: {
     consume: async (jti, expiresAt) => {

package/SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+Ribaunt is a proof-of-work CAPTCHA library, so security reports are especially
+important when they affect challenge signing, verification bypasses, replay
+prevention, widget behavior, or server-only secret handling.
+
+## Supported Versions
+
+| Version | Security support |
+| --- | --- |
+| Latest npm release | Supported |
+| Older releases | Best effort |
+
+## Reporting a Vulnerability
+
+Please do not open a public GitHub issue for suspected vulnerabilities.
+
+Report vulnerabilities privately through GitHub Security Advisories:
+
+https://github.com/ribaunt/ribaunt/security/advisories/new
+
+Include as much of the following as you can:
+
+- Affected Ribaunt version or commit
+- Reproduction steps
+- Expected and observed behavior
+- Security impact
+- Runtime and browser environment, if relevant
+- Proof of concept, logs, or screenshots
+
+## What to Expect
+
+After receiving a report, maintainers will acknowledge it, investigate the
+issue, and coordinate a fix when appropriate. If the issue is confirmed, the fix
+will be released and a security advisory will be published when disclosure is
+safe.

package/dist/cjs/index.d.ts

@@ -3,22 +3,59 @@ export interface ChallengeSolution {
     nonce: string;
     hash: string;
 }
+export interface ClientCalibration {
+    iterations: number;
+    durationMs: number;
+}
+export interface WorkloadBounds {
+    minDifficulty?: number;
+    maxDifficulty?: number;
+    minAmount?: number;
+    maxAmount?: number;
+}
+export interface AdaptiveWorkloadOptions extends WorkloadBounds {
+    riskScore?: number;
+    targetDurationMs?: number;
+    calibration?: ClientCalibration;
+}
+export interface Workload {
+    difficulty: number;
+    amount: number;
+    estimatedAttempts: number;
+}
+export interface ChallengeOptions {
+    difficulty?: number;
+    amount?: number;
+    ttlSeconds?: number;
+    context?: string;
+    workload?: Pick<Workload, 'difficulty' | 'amount'>;
+}
 export interface ReplayStore {
     consume(jti: string, expiresAt: number): Promise<boolean>;
+    consumeMany?(jtis: string[], expiresAt: number): Promise<boolean>;
 }
 export type ReplayPreventionMode = 'disabled' | 'local' | 'remote';
 export interface VerifySolutionOptions {
     replayPrevention?: ReplayPreventionMode;
     replayStore?: ReplayStore;
+    context?: string;
     debug?: boolean;
     onWarning?: (warning: VerifyWarning) => void;
 }
-export type VerifyWarningReason = 'invalid-token' | 'expired-token' | 'invalid-solution' | 'replay-detected' | 'configuration-error';
+export type VerifyFailureReason = 'invalid-token' | 'expired-token' | 'invalid-solution' | 'context-mismatch' | 'replay-detected' | 'configuration-error';
+export type VerifyWarningReason = VerifyFailureReason;
 export interface VerifyWarning {
     reason: VerifyWarningReason;
     message: string;
     error?: unknown;
 }
+export type VerifySolutionResult = {
+    valid: true;
+} | {
+    valid: false;
+    reason: VerifyFailureReason;
+    message: string;
+};
 export interface SolveChallengeOptions {
     maxIterations?: number;
     maxDurationMs?: number;
@@ -26,34 +63,16 @@ export interface SolveChallengeOptions {
 export declare class LocalReplayStore implements ReplayStore {
     private usedTokens;
     consume(jti: string, expiresAt: number): Promise<boolean>;
+    consumeMany(jtis: string[], expiresAt: number): Promise<boolean>;
     private cleanup;
 }
 /**
- * Creates one or more PoW challenges and returns them as signed JWT tokens.
- *
- * @param difficulty - Number of leading zeros required in the hash (default 5)
- * @param amount - Number of challenges to create (default 4)
- * @param ttlSeconds - Time to live for each challenge in seconds (default 30)
- * @returns An array of JWT challenge tokens
+ * Selects bounded proof-of-work using a server-owned risk floor and untrusted timing calibration.
  */
+export declare function selectWorkload(options?: AdaptiveWorkloadOptions): Workload;
 export declare function createChallenge(difficulty?: number, amount?: number, ttlSeconds?: number): ChallengeToken[];
-/**
- * Solves one or more PoW challenges encoded in JWT tokens.
- *
- * @param token - The JWT challenge token or an array of tokens
- * @param options - Optional guardrails for test/debug usage (`maxIterations`, `maxDurationMs`)
- * @returns The nonce/hash pair for single input or an array of them for multiple tokens
- */
-export declare function solveChallenge(token: ChallengeToken): ChallengeSolution | undefined;
+export declare function createChallenge(options: ChallengeOptions): ChallengeToken[];
 export declare function solveChallenge(token: ChallengeToken, options?: SolveChallengeOptions): ChallengeSolution | undefined;
-export declare function solveChallenge(token: ChallengeToken[]): ChallengeSolution[] | undefined;
 export declare function solveChallenge(token: ChallengeToken[], options?: SolveChallengeOptions): ChallengeSolution[] | undefined;
-/**
- * Verifies a PoW solution returned by the client.
- *
- * @param token - The original JWT issued as the challenge (single token or array of tokens)
- * @param nonce - The nonce/answer submitted by the client (single nonce, array of nonces, or array of solution objects)
- * @returns true only if every provided solution is valid; otherwise false
- */
-export declare function verifySolution(token: ChallengeToken | ChallengeToken[], nonce: number | string | Array<number | string> | ChallengeSolution | ChallengeSolution[], options?: VerifySolutionOptions): Promise<boolean>;
+export declare function verifySolution(token: ChallengeToken | ChallengeToken[], nonce: number | string | Array<number | string> | ChallengeSolution | ChallengeSolution[], options?: VerifySolutionOptions): Promise<VerifySolutionResult>;
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;CAC9C;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,gBAAiB,YAAW,WAAW;IAClD,OAAO,CAAC,UAAU,CAA6B;IAEzC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW/D,OAAO,CAAC,OAAO;CAShB;AAoMD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,GAAE,MAAU,EACtB,MAAM,GAAE,MAAU,EAClB,UAAU,GAAE,MAAW,GACtB,cAAc,EAAE,CAUlB;AA0FD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;AACrF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,cAAc,EACrB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,iBAAiB,GAAG,SAAS,CAAC;AACjC,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAAC;AACzF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,iBAAiB,EAAE,GAAG,SAAS,CAAC;AAwBnC;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,cAAc,GAAG,cAAc,EAAE,EACxC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,iBAAiB,GAAG,iBAAiB,EAAE,EACzF,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAuDlB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAwB,SAAQ,cAAc;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,GAAG,QAAQ,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;CAC9C;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,GACjB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,gBAAiB,YAAW,WAAW;IAClD,OAAO,CAAC,UAAU,CAA6B;IAEzC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAatE,OAAO,CAAC,OAAO;CAMhB;AA+ED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,uBAA4B,GAAG,QAAQ,CAuB9E;AA8CD,wBAAgB,eAAe,CAC7B,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GAClB,cAAc,EAAE,CAAC;AACpB,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,cAAc,EAAE,CAAC;AAkE7E,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,iBAAiB,GAAG,SAAS,CAAC;AACtH,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAAC;AA2E1H,wBAAsB,cAAc,CAClC,KAAK,EAAE,cAAc,GAAG,cAAc,EAAE,EACxC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,iBAAiB,GAAG,iBAAiB,EAAE,EACzF,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CA4E/B"}