@prosopo/provider 4.14.3 → 4.15.0

package/dist/cjs/api/blacklistRequestInspector.cjs

@@ -4,6 +4,7 @@ const node_crypto = require("node:crypto");
 const types = require("@prosopo/types");
 const userAccessPolicy = require("@prosopo/user-access-policy");
 const compositeIpAddress = require("../compositeIpAddress.cjs");
+const hardBlockVerdictCache = require("./hardBlockVerdictCache.cjs");
 const metrics = require("./metrics.cjs");
 const getRequestUserScope = (requestHeaders, ja4, ip, user, headHash, coords, countryCode, asn) => {
   const userAgent = requestHeaders["user-agent"] ? requestHeaders["user-agent"].toString() : void 0;
@@ -130,8 +131,30 @@ const rankCandidateRules = (rules, request, requestClientId) => rules.filter((ru
   }
   return ruleHarshness(b) - ruleHarshness(a);
 });
+const verdictCache = new hardBlockVerdictCache.HardBlockVerdictCache();
+const getVerdictCache = () => verdictCache;
+const REQUEST_MEMO_SYMBOL = Symbol.for("prosopo.accessRuleRequestMemo");
+const getOrCreateRequestMemo = (requestMemoHost) => {
+  let memo = requestMemoHost[REQUEST_MEMO_SYMBOL];
+  if (memo === void 0) {
+    memo = /* @__PURE__ */ new Map();
+    requestMemoHost[REQUEST_MEMO_SYMBOL] = memo;
+  }
+  return memo;
+};
 const getPrioritisedAccessRule = async (userAccessRulesStorage, userScope, clientId, options) => {
   const parsedUserScope = userAccessPolicy.userScopeInput.parse(userScope);
+  const blockOnly = options?.blockOnly ?? false;
+  const skipCache = options?.skipCache ?? false;
+  const requestMemoHost = options?.requestMemoHost;
+  const cacheKey = hardBlockVerdictCache.hardBlockCacheKey(clientId, parsedUserScope, blockOnly);
+  const requestMemo = requestMemoHost ? getOrCreateRequestMemo(requestMemoHost) : void 0;
+  if (requestMemo !== void 0) {
+    const memoHit = requestMemo.get(cacheKey);
+    if (memoHit !== void 0) {
+      return memoHit;
+    }
+  }
   const filter = {
     ...clientId && {
       policyScope: {
@@ -141,15 +164,25 @@ const getPrioritisedAccessRule = async (userAccessRulesStorage, userScope, clien
     policyScopeMatch: userAccessPolicy.FilterScopeMatch.Greedy,
     userScope: parsedUserScope,
     userScopeMatch: userAccessPolicy.FilterScopeMatch.Greedy,
-    ...options?.blockOnly && { blockOnly: true }
+    ...blockOnly && { blockOnly: true }
   };
-  const candidates = await userAccessRulesStorage.findRules(
-    filter,
-    true,
-    // matchingFieldsOnly — engages server-side specificity rank
-    true
-  );
-  return rankCandidateRules(candidates, parsedUserScope, clientId);
+  const compute = async () => {
+    const candidates = await userAccessRulesStorage.findRules(
+      filter,
+      true,
+      // matchingFieldsOnly — engages the split-query hot path
+      true
+    );
+    return rankCandidateRules(candidates, parsedUserScope, clientId);
+  };
+  let ranked;
+  if (skipCache) {
+    ranked = await compute();
+  } else {
+    ranked = await verdictCache.getOrCompute(cacheKey, compute);
+  }
+  requestMemo?.set(cacheKey, ranked);
+  return ranked;
 };
 class BlacklistRequestInspector {
   constructor(userAccessRulesStorage, environmentReadinessWaiter, db) {
@@ -169,7 +202,11 @@ class BlacklistRequestInspector {
       request.headers,
       request.body,
       request.logger,
-      request.ipInfo
+      request.ipInfo,
+      // Share the per-request memo so a downstream captcha task
+      // hitting checkForHardBlock in the same request reuses this
+      // lookup rather than re-querying Redis.
+      request
     );
     if (shouldAbortRequest) {
       res.status(403).json({ error: "Forbidden" });
@@ -177,7 +214,7 @@ class BlacklistRequestInspector {
     }
     next();
   }
-  async shouldAbortRequest(requestedRoute, rawIp, ja4, requestHeaders, requestBody, logger, ipInfo) {
+  async shouldAbortRequest(requestedRoute, rawIp, ja4, requestHeaders, requestBody, logger, ipInfo, requestMemoHost) {
     if (this.isApiUnrelatedRoute(requestedRoute)) {
       return false;
     }
@@ -222,7 +259,7 @@ class BlacklistRequestInspector {
         // candidate pool so the SERVER_SIDE_RANK_TOP_N cap can't
         // crowd out hard-block rules in clients with dense Restrict
         // rule populations.
-        { blockOnly: true }
+        { blockOnly: true, requestMemoHost }
       );
       const enforceable = (accessPolicies ?? []).filter(
         (p) => !p.deferToVerify
@@ -352,4 +389,5 @@ class BlacklistRequestInspector {
 exports.BlacklistRequestInspector = BlacklistRequestInspector;
 exports.getPrioritisedAccessRule = getPrioritisedAccessRule;
 exports.getRequestUserScope = getRequestUserScope;
+exports.getVerdictCache = getVerdictCache;
 exports.rankCandidateRules = rankCandidateRules;

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -168,11 +168,11 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
             // Timing values are per-connection so they come from
             // the current request even in the dedup replay path —
             // dedup.session was created on a different TCP conn.
-            ...req.tcpToChelloMs !== void 0 && {
-              tcpToChelloMs: req.tcpToChelloMs
+            ...req.tcpToChelloUs !== void 0 && {
+              tcpToChelloUs: req.tcpToChelloUs
             },
-            ...req.chelloToHandshakeMs !== void 0 && {
-              chelloToHandshakeMs: req.chelloToHandshakeMs
+            ...req.chelloToHandshakeUs !== void 0 && {
+              chelloToHandshakeUs: req.chelloToHandshakeUs
             },
             // currentUrl uses the cached session's value to
             // match the rest of the dedup routing input (score,
@@ -250,7 +250,13 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         flatHeaders,
         sessionMode,
         userSitekeyIpHash,
-        logger: req.logger
+        logger: req.logger,
+        ...req.tcpToChelloUs !== void 0 && {
+          tcpToChelloUs: req.tcpToChelloUs
+        },
+        ...req.chelloToHandshakeUs !== void 0 && {
+          chelloToHandshakeUs: req.chelloToHandshakeUs
+        }
       },
       res
     );
@@ -363,11 +369,11 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
       ...entropyMathRandomFirst !== void 0 && {
         entropyMathRandomFirst
       },
-      ...req.tcpToChelloMs !== void 0 && {
-        tcpToChelloMs: req.tcpToChelloMs
+      ...req.tcpToChelloUs !== void 0 && {
+        tcpToChelloUs: req.tcpToChelloUs
       },
-      ...req.chelloToHandshakeMs !== void 0 && {
-        chelloToHandshakeMs: req.chelloToHandshakeMs
+      ...req.chelloToHandshakeUs !== void 0 && {
+        chelloToHandshakeUs: req.chelloToHandshakeUs
       }
     });
     const ipInfoMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
@@ -385,11 +391,11 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         headers: flatHeaders,
         userAgent: safeUserAgent,
         ...req.ja4 && { ja4: req.ja4 },
-        ...req.tcpToChelloMs !== void 0 && {
-          tcpToChelloMs: req.tcpToChelloMs
+        ...req.tcpToChelloUs !== void 0 && {
+          tcpToChelloUs: req.tcpToChelloUs
         },
-        ...req.chelloToHandshakeMs !== void 0 && {
-          chelloToHandshakeMs: req.chelloToHandshakeMs
+        ...req.chelloToHandshakeUs !== void 0 && {
+          chelloToHandshakeUs: req.chelloToHandshakeUs
         },
         ...currentUrl && { currentUrl }
       }

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -21,7 +21,13 @@ const runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
     ipInfo: input.ipInfo,
     headers: input.flatHeaders,
     mode: input.sessionMode,
-    userSitekeyIpHash: input.userSitekeyIpHash
+    userSitekeyIpHash: input.userSitekeyIpHash,
+    ...input.tcpToChelloUs !== void 0 && {
+      tcpToChelloUs: input.tcpToChelloUs
+    },
+    ...input.chelloToHandshakeUs !== void 0 && {
+      chelloToHandshakeUs: input.chelloToHandshakeUs
+    }
   };
   input.logger.info(() => ({
     msg: "Frictionless decision",

package/dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs

@@ -87,11 +87,11 @@ const submitPoWCaptchaSolution = (env) => async (req, res, next) => {
         userAgent,
         ...req.ja4 && { ja4: req.ja4 },
         ...fingerprintProof && { fingerprintProof },
-        ...req.tcpToChelloMs !== void 0 && {
-          tcpToChelloMs: req.tcpToChelloMs
+        ...req.tcpToChelloUs !== void 0 && {
+          tcpToChelloUs: req.tcpToChelloUs
         },
-        ...req.chelloToHandshakeMs !== void 0 && {
-          chelloToHandshakeMs: req.chelloToHandshakeMs
+        ...req.chelloToHandshakeUs !== void 0 && {
+          chelloToHandshakeUs: req.chelloToHandshakeUs
         }
       }
     });
@@ -120,7 +120,10 @@ const submitPoWCaptchaSolution = (env) => async (req, res, next) => {
         }
       }));
     }
-    const escalation = await buildEscalation(tasks$1, result, challenge);
+    const escalation = await buildEscalation(tasks$1, result, challenge, {
+      tcpToChelloUs: req.tcpToChelloUs,
+      chelloToHandshakeUs: req.chelloToHandshakeUs
+    });
     const response = {
       status: "ok",
       // On escalation the user is not done — they still need to clear
@@ -148,7 +151,7 @@ const submitPoWCaptchaSolution = (env) => async (req, res, next) => {
     );
   }
 };
-const buildEscalation = async (tasks2, result, challenge) => {
+const buildEscalation = async (tasks2, result, challenge, handshakeTiming) => {
   if (!result.verified || !result.routingOutput) return void 0;
   const routedType = result.routingOutput.captchaType;
   if (routedType !== types.CaptchaType.image && routedType !== types.CaptchaType.puzzle) {
@@ -187,7 +190,9 @@ const buildEscalation = async (tasks2, result, challenge) => {
     originSession.entropyCryptoFingerprint,
     originSession.entropyWallClockOffsetMs,
     originSession.entropyMathRandomFirst,
-    originSession.currentUrl
+    originSession.currentUrl,
+    handshakeTiming?.tcpToChelloUs,
+    handshakeTiming?.chelloToHandshakeUs
   );
   if (tasks2.writeQueue) {
     await tasks2.writeQueue.cacheSessionEscalation(

package/dist/cjs/api/handshakeTimingMiddleware.cjs

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const apiExpressRouter = require("@prosopo/api-express-router");
 const logger = require("@prosopo/logger");
-const HEADER_TCP_TO_CHELLO = "x-tls-tcp-to-chello-ms";
-const HEADER_CHELLO_TO_HANDSHAKE = "x-tls-chello-to-handshake-ms";
+const HEADER_TCP_TO_CHELLO = "x-tls-tcp-to-chello-us";
+const HEADER_CHELLO_TO_HANDSHAKE = "x-tls-chello-to-handshake-us";
 const parseTimingHeader = (raw, logger2, headerName) => {
   if (raw === void 0) {
     return void 0;
@@ -25,12 +25,12 @@ const parseTimingHeader = (raw, logger2, headerName) => {
 const getHandshakeTiming = (headers, logger$1) => {
   const log = logger$1 ?? logger.getLogger("info", "provider:handshake-timing");
   return {
-    tcpToChelloMs: parseTimingHeader(
+    tcpToChelloUs: parseTimingHeader(
       headers[HEADER_TCP_TO_CHELLO],
       log,
       HEADER_TCP_TO_CHELLO
     ),
-    chelloToHandshakeMs: parseTimingHeader(
+    chelloToHandshakeUs: parseTimingHeader(
       headers[HEADER_CHELLO_TO_HANDSHAKE],
       log,
       HEADER_CHELLO_TO_HANDSHAKE
@@ -41,17 +41,17 @@ const handshakeTimingMiddleware = (env) => {
   return async (req, res, next) => {
     try {
       const timing = getHandshakeTiming(req.headers, req.logger);
-      if (timing.tcpToChelloMs !== void 0) {
-        req.tcpToChelloMs = timing.tcpToChelloMs;
+      if (timing.tcpToChelloUs !== void 0) {
+        req.tcpToChelloUs = timing.tcpToChelloUs;
       }
-      if (timing.chelloToHandshakeMs !== void 0) {
-        req.chelloToHandshakeMs = timing.chelloToHandshakeMs;
+      if (timing.chelloToHandshakeUs !== void 0) {
+        req.chelloToHandshakeUs = timing.chelloToHandshakeUs;
       }
-      if (timing.tcpToChelloMs !== void 0 || timing.chelloToHandshakeMs !== void 0) {
+      if (timing.tcpToChelloUs !== void 0 || timing.chelloToHandshakeUs !== void 0) {
         req.logger = req.logger.with(
           {
-            tcpToChelloMs: timing.tcpToChelloMs,
-            chelloToHandshakeMs: timing.chelloToHandshakeMs
+            tcpToChelloUs: timing.tcpToChelloUs,
+            chelloToHandshakeUs: timing.chelloToHandshakeUs
           },
           "handshakeTiming"
         );

package/dist/cjs/api/hardBlockVerdictCache.cjs

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const DEFAULT_VERDICT_CACHE_TTL_MS = 1e4;
+const DEFAULT_VERDICT_CACHE_MAX_ENTRIES = 5e4;
+class HardBlockVerdictCache {
+  constructor(ttlMs = DEFAULT_VERDICT_CACHE_TTL_MS, maxEntries = DEFAULT_VERDICT_CACHE_MAX_ENTRIES) {
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+    this.store = /* @__PURE__ */ new Map();
+    this.inflight = /* @__PURE__ */ new Map();
+  }
+  get(key) {
+    const entry = this.store.get(key);
+    if (entry === void 0) {
+      return void 0;
+    }
+    if (entry.expiresAt <= Date.now()) {
+      this.store.delete(key);
+      return void 0;
+    }
+    this.store.delete(key);
+    this.store.set(key, entry);
+    return entry.value;
+  }
+  set(key, value) {
+    this.store.delete(key);
+    if (this.store.size >= this.maxEntries) {
+      const oldest = this.store.keys().next().value;
+      if (oldest !== void 0) {
+        this.store.delete(oldest);
+      }
+    }
+    this.store.set(key, {
+      value,
+      expiresAt: Date.now() + this.ttlMs
+    });
+  }
+  /**
+   * Cache lookup with singleflight dedupe of concurrent misses.
+   *
+   * Fast path: cache hit → return immediately (with LRU move-to-tail
+   * via `get()`).
+   *
+   * Slow path: cache miss →
+   *   1. If an in-flight Promise exists for this key, join it. This
+   *      is the coalescing behaviour — N concurrent identical misses
+   *      all await the same underlying storage call.
+   *   2. Otherwise, invoke `compute()`, register the Promise, and
+   *      populate the cache with the result on resolve. The Promise
+   *      is removed from the in-flight map in a `finally` so a
+   *      rejection doesn't wedge future callers.
+   *
+   * Rejection semantics: if `compute()` throws, all joined waiters
+   * see the same rejection. Callers should handle it — the underlying
+   * `getPrioritisedAccessRule` catches its own storage errors and
+   * returns `[]` (fail-open), so in practice this never propagates.
+   */
+  async getOrCompute(key, compute) {
+    const cached = this.get(key);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const existing = this.inflight.get(key);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const promise = (async () => {
+      const value = await compute();
+      this.set(key, value);
+      return value;
+    })();
+    this.inflight.set(key, promise);
+    try {
+      return await promise;
+    } finally {
+      if (this.inflight.get(key) === promise) {
+        this.inflight.delete(key);
+      }
+    }
+  }
+  // Test/ops hook — the running cache is not exposed on the wire, but
+  // admin tooling (e.g. a rule-mutation notifier) may need to flush
+  // after a bulk insert to bound the staleness window. Clears both
+  // the stored entries and any in-flight Promises so a rule mutation
+  // can't leave a stale computation in flight.
+  clear() {
+    this.store.clear();
+    this.inflight.clear();
+  }
+  size() {
+    return this.store.size;
+  }
+  // Test hook: number of in-flight computations. Not on the hot path.
+  inflightSize() {
+    return this.inflight.size;
+  }
+}
+const hardBlockCacheKey = (clientId, userScope, blockOnly) => {
+  const bo = blockOnly ? "1" : "0";
+  const parts = [
+    clientId ?? "",
+    userScope.numericIp === void 0 ? "" : userScope.numericIp.toString(),
+    userScope.numericIpMaskMin === void 0 ? "" : userScope.numericIpMaskMin.toString(),
+    userScope.numericIpMaskMax === void 0 ? "" : userScope.numericIpMaskMax.toString(),
+    userScope.userId ?? "",
+    userScope.ja4Hash ?? "",
+    userScope.headersHash ?? "",
+    userScope.userAgentHash ?? "",
+    userScope.headHash ?? "",
+    userScope.coords ?? "",
+    userScope.countryCode ?? "",
+    userScope.asn === void 0 ? "" : String(userScope.asn)
+  ];
+  return `${bo}|${parts.join("|")}`;
+};
+exports.DEFAULT_VERDICT_CACHE_MAX_ENTRIES = DEFAULT_VERDICT_CACHE_MAX_ENTRIES;
+exports.DEFAULT_VERDICT_CACHE_TTL_MS = DEFAULT_VERDICT_CACHE_TTL_MS;
+exports.HardBlockVerdictCache = HardBlockVerdictCache;
+exports.hardBlockCacheKey = hardBlockCacheKey;

package/dist/cjs/api/startProviderApi.cjs

@@ -115,6 +115,17 @@ async function startProviderApi(env, admin = false, port) {
       ...api.getExpressApiRuleRateLimits()
     };
     const adminPaths = Object.values(types.AdminApiPaths);
+    const rateLimitHandler = (path2) => (req, res, _next, options) => {
+      env.logger.warn(() => ({
+        msg: "Rate limit exceeded",
+        data: {
+          path: path2,
+          ip: req.ip,
+          siteKey: req.headers["prosopo-site-key"]
+        }
+      }));
+      res.status(options.statusCode).send(options.message);
+    };
     for (const [path2, limit] of Object.entries(rateLimits)) {
       const enumPath = path2;
       if (adminPaths.includes(enumPath)) {
@@ -122,6 +133,7 @@ async function startProviderApi(env, admin = false, port) {
           enumPath,
           rateLimit({
             ...limit,
+            handler: rateLimitHandler(enumPath),
             keyGenerator: (req) => {
               const user = getUserFromJWT(req);
               return user || req.ip || "unknown";
@@ -133,6 +145,7 @@ async function startProviderApi(env, admin = false, port) {
           enumPath,
           rateLimit({
             ...limit,
+            handler: rateLimitHandler(enumPath),
             keyGenerator: (req) => {
               const siteKey = req.headers["prosopo-site-key"];
               return siteKey || req.ip || "unknown";
@@ -140,7 +153,10 @@ async function startProviderApi(env, admin = false, port) {
           })
         );
       } else {
-        apiApp.use(enumPath, rateLimit(limit));
+        apiApp.use(
+          enumPath,
+          rateLimit({ ...limit, handler: rateLimitHandler(enumPath) })
+        );
       }
     }
   }

package/dist/cjs/index.cjs

@@ -63,6 +63,7 @@ exports.compareIPs = ipComparison.compareIPs;
 exports.BlacklistRequestInspector = blacklistRequestInspector.BlacklistRequestInspector;
 exports.getPrioritisedAccessRule = blacklistRequestInspector.getPrioritisedAccessRule;
 exports.getRequestUserScope = blacklistRequestInspector.getRequestUserScope;
+exports.getVerdictCache = blacklistRequestInspector.getVerdictCache;
 exports.rankCandidateRules = blacklistRequestInspector.rankCandidateRules;
 Object.defineProperty(exports, "FrictionlessReason", {
   enumerable: true,

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -73,8 +73,8 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       entropyCryptoFingerprint: params.entropyCryptoFingerprint,
       entropyWallClockOffsetMs: params.entropyWallClockOffsetMs,
       entropyMathRandomFirst: params.entropyMathRandomFirst,
-      tcpToChelloMs: params.tcpToChelloMs,
-      chelloToHandshakeMs: params.chelloToHandshakeMs
+      tcpToChelloUs: params.tcpToChelloUs,
+      chelloToHandshakeUs: params.chelloToHandshakeUs
     };
   }
   updateScore(score, scoreComponents) {
@@ -86,7 +86,7 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
   checkLangRules(acceptLanguage) {
     return lang.checkLangRules(this.config, acceptLanguage);
   }
-  async createSession(token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, currentUrl, tcpToChelloMs, chelloToHandshakeMs) {
+  async createSession(token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, currentUrl, tcpToChelloUs, chelloToHandshakeUs) {
     const sessionRecord = {
       sessionId: `${getSessionIDPrefix(this.config.host)}-${uuid.v4()}`,
       createdAt: /* @__PURE__ */ new Date(),
@@ -120,8 +120,8 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       entropyCryptoFingerprint,
       entropyWallClockOffsetMs,
       entropyMathRandomFirst,
-      tcpToChelloMs,
-      chelloToHandshakeMs
+      tcpToChelloUs,
+      chelloToHandshakeUs
     };
     await this.db.storeSessionRecord(sessionRecord);
     if (this.writeQueue) {
@@ -203,8 +203,8 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       effectiveParams.entropyWallClockOffsetMs,
       effectiveParams.entropyMathRandomFirst,
       effectiveParams.currentUrl,
-      effectiveParams.tcpToChelloMs,
-      effectiveParams.chelloToHandshakeMs
+      effectiveParams.tcpToChelloUs,
+      effectiveParams.chelloToHandshakeUs
     );
     if (this.routingContext && this.usageCounters) {
       this.usageCounters.incrManyAsync(
@@ -257,8 +257,8 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       effectiveParams.entropyWallClockOffsetMs,
       effectiveParams.entropyMathRandomFirst,
       effectiveParams.currentUrl,
-      effectiveParams.tcpToChelloMs,
-      effectiveParams.chelloToHandshakeMs
+      effectiveParams.tcpToChelloUs,
+      effectiveParams.chelloToHandshakeUs
     );
   }
   scoreIncreaseAccessPolicy(accessPolicy, baseBotScore, botScore, scoreComponents) {

package/dist/cjs/tasks/spam/checkTrafficFilter.cjs

@@ -23,7 +23,7 @@ const isDatacenterAllowlisted = (ipInfo, allowlist) => {
   );
   return candidates.some((c) => normalisedAllowlist.includes(c));
 };
-const evaluateIpInfo = (ipInfo, trafficFilter, options) => {
+const evaluateIpInfo = (ipInfo, trafficFilter, isDnsExtra = false) => {
   if (!ipInfo || !ipInfo.isValid) {
     return { isBlocked: false };
   }
@@ -46,7 +46,8 @@ const evaluateIpInfo = (ipInfo, trafficFilter, options) => {
       return { isBlocked: true, reason: types.ResultReason.ABUSER_BLOCKED };
     }
   }
-  if (trafficFilter.blockDatacenter && ipInfo.isDatacenter && ipInfo.providerType !== "isp" && !(options.suppressVpnDatacenterInteraction && ipInfo.isVPN && !trafficFilter.blockVpn) && !isDatacenterAllowlisted(ipInfo, trafficFilter.datacenterNameAllowlist)) {
+  const datacenterSuppressedByCategory = ipInfo.isVPN && !trafficFilter.blockVpn || ipInfo.isProxy && !trafficFilter.blockProxy || ipInfo.isTor && !trafficFilter.blockTor || ipInfo.isCrawler && !trafficFilter.blockCrawler;
+  if (trafficFilter.blockDatacenter && ipInfo.isDatacenter && ipInfo.providerType !== "isp" && !datacenterSuppressedByCategory && !isDatacenterAllowlisted(ipInfo, trafficFilter.datacenterNameAllowlist)) {
     return { isBlocked: true, reason: types.ResultReason.DATACENTER_BLOCKED };
   }
   if (trafficFilter.blockMobile && ipInfo.isMobile) {
@@ -55,15 +56,13 @@ const evaluateIpInfo = (ipInfo, trafficFilter, options) => {
   if (trafficFilter.blockSatellite && ipInfo.isSatellite) {
     return { isBlocked: true, reason: types.ResultReason.SATELLITE_BLOCKED };
   }
-  if (trafficFilter.blockCrawler && ipInfo.isCrawler) {
+  if (!isDnsExtra && trafficFilter.blockCrawler && ipInfo.isCrawler) {
     return { isBlocked: true, reason: types.ResultReason.CRAWLER_BLOCKED };
   }
   return { isBlocked: false };
 };
 const checkTrafficFilter = (ipInfo, trafficFilter, extraIpInfos, dnsPathValid) => {
-  const primary = evaluateIpInfo(ipInfo, trafficFilter, {
-    suppressVpnDatacenterInteraction: true
-  });
+  const primary = evaluateIpInfo(ipInfo, trafficFilter);
   if (primary.isBlocked) {
     return primary;
   }
@@ -71,9 +70,7 @@ const checkTrafficFilter = (ipInfo, trafficFilter, extraIpInfos, dnsPathValid) =
     return { isBlocked: false };
   }
   for (const extra of extraIpInfos ?? []) {
-    const result = evaluateIpInfo(extra, trafficFilter, {
-      suppressVpnDatacenterInteraction: false
-    });
+    const result = evaluateIpInfo(extra, trafficFilter, true);
     if (result.isBlocked) {
       return result;
     }

package/dist/index.js

@@ -19,7 +19,7 @@ import { ignoreMiddleware } from "./api/ignoreMiddleware.js";
 import { robotsMiddleware } from "./api/robotsMiddleware.js";
 import { getCompositeIpAddress, getIpAddressFromComposite } from "./compositeIpAddress.js";
 import { compareIPs } from "./services/ipComparison.js";
-import { BlacklistRequestInspector, getPrioritisedAccessRule, getRequestUserScope, rankCandidateRules } from "./api/blacklistRequestInspector.js";
+import { BlacklistRequestInspector, getPrioritisedAccessRule, getRequestUserScope, getVerdictCache, rankCandidateRules } from "./api/blacklistRequestInspector.js";
 import "./tasks/frictionless/frictionlessTasks.js";
 import { FrictionlessReason } from "@prosopo/types";
 import { Tasks } from "./tasks/tasks.js";
@@ -48,6 +48,7 @@ export {
   getPrioritisedAccessRule,
   getRequestUserScope,
   getUserFromJWT,
+  getVerdictCache,
   handshakeTimingMiddleware,
   headerCheckMiddleware,
   ignoreMiddleware,

package/dist/tasks/captchaManager.d.ts

@@ -42,6 +42,7 @@ export declare class CaptchaManager {
     };
     getPrioritisedAccessPolicies(userAccessRulesStorage: AccessRulesStorage, clientId: string, userScope: UserScope | UserScopeRecord, options?: {
         blockOnly?: boolean;
+        requestMemoHost?: object;
     }): Promise<import("@prosopo/user-access-policy").AccessRule[]>;
     getDetectorKeys(): Promise<string[]>;
     decryptSimdReadings(encryptedData: string, decryptKeys: (string | undefined)[]): Promise<SimdReadingsResult | null>;

package/dist/tasks/captchaManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EACJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AA0BtC,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAiBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,GAC5B,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAe/C,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAsQF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;;;;;;IAkBV,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EACtC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;IAU5B,eAAe,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAYpC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACjC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAkC/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACjC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsEjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA+C9B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAmB9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM;CAGnD"}
+{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EACJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AA0BtC,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAiBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,GAC5B,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAe/C,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAsQF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;;;;;;IAkBV,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAKpB,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAUI,eAAe,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAYpC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACjC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAkC/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACjC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsEjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA+C9B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAmB9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM;CAGnD"}