@prosopo/cli 3.8.3 → 3.8.5

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/cli@3.8.3 build:cjs
+> @prosopo/cli@3.8.5 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -24,6 +24,7 @@ ViteCommonJSConfig: .
     '/home/runner/work/captcha/captcha/packages/keyring/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/api-express-router/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json'
@@ -50,6 +51,7 @@ ViteCommonJSConfig: .
     '@prosopo/keyring',
     '@prosopo/provider',
     '@prosopo/api-express-router',
+    '@prosopo/captcha-severity',
     '@prosopo/datasets',
     '@prosopo/load-balancer',
     '@prosopo/puzzle-assets'
@@ -79,8 +81,8 @@ dist/cjs/reloader.cjs                              1.87 kB │ gzip: 0.76 kB
 dist/cjs/commands/migrateAbuserScoreThreshold.cjs  2.17 kB │ gzip: 0.90 kB
 dist/cjs/argv.cjs                                  2.30 kB │ gzip: 0.66 kB
 dist/cjs/start.cjs                                 2.45 kB │ gzip: 0.84 kB
-dist/cjs/commands/siteKeyRegisterApi.cjs           3.54 kB │ gzip: 1.17 kB
-dist/cjs/commands/siteKeyRegister.cjs              4.01 kB │ gzip: 1.25 kB
+dist/cjs/commands/siteKeyRegisterApi.cjs           3.70 kB │ gzip: 1.19 kB
+dist/cjs/commands/siteKeyRegister.cjs              4.06 kB │ gzip: 1.22 kB
 dist/cjs/prosopo.config.cjs                        4.58 kB │ gzip: 1.46 kB
 dist/cjs/RateLimiter.cjs                           5.58 kB │ gzip: 0.89 kB
 
@@ -92,4 +94,4 @@ dist/cjs/RateLimiter.cjs                           5.58 kB │ gzip: 0.89 kB
     │                             ╰─────── This `import.meta` will be replaced with an empty object (`{}`) automatically. If this is desired, you can suppress this warning by adding `transform.define: { 'import.meta': {} }`. If `import.meta` needs to be kept as-is, you need to set the output format to `esm`.
 ────╯
 
-✓ built in 59ms
+✓ built in 70ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/cli@3.8.3 build:tsc
+> @prosopo/cli@3.8.5 build:tsc
 > tsc --build --verbose
 
-10:03:05 PM - Projects in this build: 
+10:40:26 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -22,6 +22,7 @@
     * ../types-env/tsconfig.json
     * ../env/tsconfig.json
     * ../api-express-router/tsconfig.json
+    * ../captcha-severity/tsconfig.json
     * ../datasets/tsconfig.json
     * ../load-balancer/tsconfig.json
     * ../puzzle-assets/tsconfig.json
@@ -29,55 +30,57 @@
     * ../../dev/workspace/tsconfig.json
     * tsconfig.json
 
-10:03:05 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/NodejsPolarsNativeFilePlugin.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/batches.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../dotenv/tsconfig.json' is up to date because newest input '../dotenv/src/env.ts' is older than output '../dotenv/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../dotenv/tsconfig.json' is up to date because newest input '../dotenv/src/env.ts' is older than output '../dotenv/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/types.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/tests/apiRoute.unit.test.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/index.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/ruleRecord.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types/captcha.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/redisCacheEscalation.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/tests/typesEnv.test-d.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/tests/env.maintenance.unit.test.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/tests/unit/apiExpressRouterFactory.unit.test.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/index.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../provider/tsconfig.json' is up to date because newest input '../provider/src/utils/normalizeRequestIp.ts' is older than output '../provider/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project '../../dev/workspace/tsconfig.json' is up to date because newest input '../../dev/workspace/src/projectInfo.ts' is older than output '../../dev/workspace/tsconfig.tsbuildinfo'
+10:40:26 PM - Project '../provider/tsconfig.json' is up to date because newest input '../provider/src/utils/devicePlatform.ts' is older than output '../provider/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+10:40:26 PM - Project '../../dev/workspace/tsconfig.json' is up to date because newest input '../../dev/workspace/src/tests/projectInfo.unit.test.ts' is older than output '../../dev/workspace/tsconfig.tsbuildinfo'
 
-10:03:05 PM - Building project '/home/runner/work/captcha/captcha/packages/cli/tsconfig.json'...
+10:40:26 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+
+10:40:26 PM - Building project '/home/runner/work/captcha/captcha/packages/cli/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/cli@3.8.3 build
+> @prosopo/cli@3.8.5 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/cli@3.8.3 build:cross-env
+> @prosopo/cli@3.8.5 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -28,6 +28,7 @@ ViteEsmConfig: .
     '/home/runner/work/captcha/captcha/packages/keyring/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/api-express-router/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json'
@@ -54,6 +55,7 @@ ViteEsmConfig: .
     '@prosopo/keyring',
     '@prosopo/provider',
     '@prosopo/api-express-router',
+    '@prosopo/captcha-severity',
     '@prosopo/datasets',
     '@prosopo/load-balancer',
     '@prosopo/puzzle-assets'
@@ -83,9 +85,9 @@ dist/reloader.js                              1.62 kB │ gzip: 0.69 kB
 dist/argv.js                                  1.98 kB │ gzip: 0.59 kB
 dist/commands/migrateAbuserScoreThreshold.js  2.11 kB │ gzip: 0.89 kB
 dist/start.js                                 2.23 kB │ gzip: 0.82 kB
-dist/commands/siteKeyRegisterApi.js           3.47 kB │ gzip: 1.17 kB
-dist/commands/siteKeyRegister.js              3.85 kB │ gzip: 1.25 kB
+dist/commands/siteKeyRegisterApi.js           3.63 kB │ gzip: 1.19 kB
+dist/commands/siteKeyRegister.js              3.91 kB │ gzip: 1.22 kB
 dist/prosopo.config.js                        4.43 kB │ gzip: 1.47 kB
 dist/RateLimiter.js                           5.16 kB │ gzip: 0.89 kB
 
-✓ built in 64ms
+✓ built in 67ms

package/CHANGELOG.md

@@ -1,5 +1,129 @@
 # @prosopo/cli
 
+## 3.8.5
+### Patch Changes
+
+- 89dd38a: chore(deps): batch the outstanding dependabot bumps into one upgrade
+  
+  Rolls up dependabot PRs #3112, #3127-#3134 and #3159. Majors: `mongoose`
+  8 -> 9, `bson` 6 -> 7, `@noble/curves` 1 -> 2, `@polkadot/util-crypto`
+  13 -> 14, `@typegoose/auto-increment` 4 -> 5, `@babel/preset-env` 7 -> 8,
+  `@types/jsdom` 21 -> 30, `@types/bcrypt` 5 -> 6, `@actions/github` 6 -> 9,
+  `testcontainers` 11 -> 12. The rest are minor/patch.
+  
+  Code changes the majors forced:
+  - `@noble/curves` v2 requires `.js` specifiers and renamed the point API,
+    so `secp256k1.ProjectivePoint.fromHex(...).toRawBytes()` becomes
+    `secp256k1.Point.fromBytes(...).toBytes()`, `RistrettoPoint` becomes
+    `ristretto255.Point`, and `abstract/utils` moves to `utils.js`.
+  - mongoose 9 drops `RootFilterQuery` (now `QueryFilter`), no longer sets
+    `background: true` on schema indexes by default, and no longer declares
+    `id` on `Document`, which un-hid a mismatch between
+    `updateDappUserCommitment`'s `Hash` parameter and the `string` `id` it
+    filters on.
+  - mongoose 9 rejects an aggregation-pipeline update (an array) unless the
+    call passes `updatePipeline: true`, so the six pipeline writes in
+    `ProviderDatabase` now opt in explicitly.
+  - mongoose 9's `castUpdate` throws on a `$setOnInsert` key inside `$set`.
+    `storeUserImageCaptchaSolution` passed its record straight in as the
+    update, and mongoose's `moveImmutableProperties` mutates that object on
+    an upsert -- adding the very `$setOnInsert` key the record then carried
+    into `CentralDbStreamer.streamImageRecord`. Image records stopped
+    reaching the central DB (the streamer is fire-and-forget, so it only
+    logged) and signup verification returned 500. The update is now an
+    explicit `$set` over a shallow copy.
+  - `@prosopo/database` moves from mongodb 6.20 to 7.5 to match the driver
+    mongoose 9 pulls, so bson 7 is the only copy resolvable in the package.
+  - `vitest`/`@vitest/coverage-v8` go to 4.1.11 alongside dependabot's
+    `@vitest/spy` bump; leaving them at 4.1.10 installed a second copy of
+    `@vitest/spy` and broke type inference in the provider test utils.
+- 8a670d3: Remove the provider-side context validation path.
+  
+  The provider read a per-context baseline out of `clientcontextentropies` on the frictionless path and compared a session's head hash against it. The task that wrote that collection was removed from the provider on 2026-08-21, so the read has returned `undefined` ever since and the branch has been dead in every deployment since then. Computing and applying the baseline now happens off-provider.
+  
+  Removed: `contextAwareValidation.ts`, the decision-machine branch that used it, `getClientContextEntropy` on the provider and its database method, the `clientContextEntropy` table registration, the unused `getRoundsFromSimScore` helper, and the `contextAwareEnabled` parameter threaded into image verification — which logged and then did nothing, its return commented out.
+  
+  Also removes the per-site `settings.contextAware` block that configured it, along with `ContextAwareSchema`, `IContextAware`, `IContexts`, `ContextConfigSchema`, `contextAwareThresholdDefault` and `expandContexts`, the legacy `default`/`webview` context keys and their helpers, and `FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED`. The site-key registration CLI no longer writes a `contextAware` default into new sites.
+  
+  `ContextType`, `contextTypeFromSession` and `deviceContextTypes` stay — the off-provider work keys on them. `ClientContextEntropyRecord` and its schema stay for the same reason; only the provider's use of them goes.
+  
+  No behaviour change: every path removed here was already inert.
+- Updated dependencies [7fd6eb2]
+- Updated dependencies [424e467]
+- Updated dependencies [89dd38a]
+- Updated dependencies [4810cb3]
+- Updated dependencies [80f73c1]
+- Updated dependencies [3d2176d]
+- Updated dependencies [8a670d3]
+  - @prosopo/provider@5.7.0
+  - @prosopo/workspace@3.2.1
+  - @prosopo/api@4.1.5
+  - @prosopo/common@3.1.53
+  - @prosopo/dotenv@3.0.54
+  - @prosopo/env@3.6.50
+  - @prosopo/keyring@2.9.84
+  - @prosopo/locale@3.4.1
+  - @prosopo/logger@2.0.8
+  - @prosopo/types@5.6.0
+  - @prosopo/util@3.3.8
+
+## 3.8.4
+### Patch Changes
+
+- a62b994: Context-aware validation buckets by device type, not just webview.
+  
+  Context-aware validation compares a session's head SimHash against a baseline
+  for its context. That context was `default | webview`, which puts a phone and
+  a desktop in the same bucket — and those two emit genuinely different
+  `<head>`s, so the blended baseline matches neither well. Contexts are now the
+  device family crossed with the webview flag: `desktop`, `desktop-webview`,
+  `mobile`, `mobile-webview`, `tablet`, `tablet-webview`.
+  
+  `desktop-webview` is included deliberately. Desktop webviews are a real and
+  notably fraudulent population here (see the Twickets desktop-webview rules),
+  and folding them into the plain `desktop` baseline would let exactly the
+  traffic we want excluded define what "normal desktop" looks like.
+  
+  **Classification.** `deviceTypeFromUserAgent` in `@prosopo/types` is a
+  dependency-free UA classifier, deliberately not ua-parser-js: this module is
+  imported by the browser bundles, and the off-provider entropy sweep has to
+  bucket stored sessions *identically* or it writes baselines the decision
+  machine never looks up. One shared function keeps the two sides in lockstep.
+  Tablets are matched before phones because an iPad's UA carries a
+  `Mobile/<build>` token and an Android tablet is exactly "Android without
+  Mobile". Known gap, documented at the call site: an iPadOS 13+ Safari in
+  desktop mode identifies as a Mac and lands in `desktop` — nothing in the UA
+  separates it from a real Mac, and both sides make the same call, which is
+  what matters for the lookup.
+  
+  **Back-compat.** `default` and `webview` remain valid `ContextType` members,
+  so settings already stored against them keep parsing. `expandContexts` maps a
+  legacy `default` onto the three non-webview families and a legacy `webview`
+  onto the three webview families, at the threshold they were saved with; an
+  explicit device entry always wins over the legacy entry covering it. Nothing
+  downstream of settings parsing branches on the legacy keys, and no data
+  migration is required.
+  
+  **Behaviour change.** A request whose context is not configured now skips
+  context validation instead of borrowing another context's baseline.
+  Previously, configuring a single context validated *every* request against it
+  — with six contexts that would measure desktop traffic against a tablet
+  baseline and reject real users wholesale. `isContextConfigured` is the new
+  guard; `determineContextType` now takes the raw request UA alongside the
+  webview flag.
+  
+  New site-key registrations default to all six device contexts.
+- a447afa: Per-sitekey `imageMinRounds` alongside the existing `imageMaxRounds`.
+  
+  Every source of an image round count — access-policy rules, traffic-filter categories, routing machines, the staleness curve, and the provider's own heuristics — is now clamped into `[imageMinRounds, imageMaxRounds]` via `clampImageRounds`, so the sitekey's settings override its rules in both directions rather than only capping them. `imageMinRounds` defaults to 2, matching the floor that was previously hard-coded, so existing sitekeys are unaffected.
+- Updated dependencies [a62b994]
+- Updated dependencies [a447afa]
+  - @prosopo/types@5.5.3
+  - @prosopo/provider@5.6.4
+  - @prosopo/api@4.1.4
+  - @prosopo/env@3.6.49
+  - @prosopo/keyring@2.9.83
+
 ## 3.8.3
 ### Patch Changes