@prosopo/provider 4.15.14 → 4.15.15

package/dist/cjs/api/handshakeTimingMiddleware.cjs

@@ -1,66 +1,48 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const apiExpressRouter = require("@prosopo/api-express-router");
-const logger = require("@prosopo/logger");
-const HEADER_TCP_TO_CHELLO = "x-tls-tcp-to-chello-us";
-const HEADER_CHELLO_TO_HANDSHAKE = "x-tls-chello-to-handshake-us";
-const parseTimingHeader = (raw, logger2, headerName) => {
-  if (raw === void 0) {
-    return void 0;
-  }
-  const value = Array.isArray(raw) ? raw[0] : raw;
-  if (value === void 0) {
-    return void 0;
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (Number.isNaN(parsed) || parsed < 0) {
-    logger2.debug(() => ({
-      msg: "Ignoring malformed handshake timing header",
-      data: { header: headerName, raw: value }
-    }));
-    return void 0;
-  }
-  return parsed;
+let _prosopo_logger = require("@prosopo/logger");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
+//#region src/api/handshakeTimingMiddleware.ts
+var HEADER_TCP_TO_CHELLO = "x-tls-tcp-to-chello-us";
+var HEADER_CHELLO_TO_HANDSHAKE = "x-tls-chello-to-handshake-us";
+var parseTimingHeader = (raw, logger, headerName) => {
+	if (raw === void 0) return;
+	const value = Array.isArray(raw) ? raw[0] : raw;
+	if (value === void 0) return;
+	const parsed = Number.parseInt(value, 10);
+	if (Number.isNaN(parsed) || parsed < 0) {
+		logger.debug(() => ({
+			msg: "Ignoring malformed handshake timing header",
+			data: {
+				header: headerName,
+				raw: value
+			}
+		}));
+		return;
+	}
+	return parsed;
 };
-const getHandshakeTiming = (headers, logger$1) => {
-  const log = logger$1 ?? logger.getLogger("info", "provider:handshake-timing");
-  return {
-    tcpToChelloUs: parseTimingHeader(
-      headers[HEADER_TCP_TO_CHELLO],
-      log,
-      HEADER_TCP_TO_CHELLO
-    ),
-    chelloToHandshakeUs: parseTimingHeader(
-      headers[HEADER_CHELLO_TO_HANDSHAKE],
-      log,
-      HEADER_CHELLO_TO_HANDSHAKE
-    )
-  };
+var getHandshakeTiming = (headers, logger) => {
+	const log = logger ?? (0, _prosopo_logger.getLogger)("info", "provider:handshake-timing");
+	return {
+		tcpToChelloUs: parseTimingHeader(headers[HEADER_TCP_TO_CHELLO], log, HEADER_TCP_TO_CHELLO),
+		chelloToHandshakeUs: parseTimingHeader(headers[HEADER_CHELLO_TO_HANDSHAKE], log, HEADER_CHELLO_TO_HANDSHAKE)
+	};
 };
-const handshakeTimingMiddleware = (env) => {
-  return async (req, res, next) => {
-    try {
-      const timing = getHandshakeTiming(req.headers, req.logger);
-      if (timing.tcpToChelloUs !== void 0) {
-        req.tcpToChelloUs = timing.tcpToChelloUs;
-      }
-      if (timing.chelloToHandshakeUs !== void 0) {
-        req.chelloToHandshakeUs = timing.chelloToHandshakeUs;
-      }
-      if (timing.tcpToChelloUs !== void 0 || timing.chelloToHandshakeUs !== void 0) {
-        req.logger = req.logger.with(
-          {
-            tcpToChelloUs: timing.tcpToChelloUs,
-            chelloToHandshakeUs: timing.chelloToHandshakeUs
-          },
-          "handshakeTiming"
-        );
-      }
-      next();
-    } catch (err) {
-      return apiExpressRouter.handleErrors(err, req, res, next);
-    }
-  };
+var handshakeTimingMiddleware = (env) => {
+	return async (req, res, next) => {
+		try {
+			const timing = getHandshakeTiming(req.headers, req.logger);
+			if (timing.tcpToChelloUs !== void 0) req.tcpToChelloUs = timing.tcpToChelloUs;
+			if (timing.chelloToHandshakeUs !== void 0) req.chelloToHandshakeUs = timing.chelloToHandshakeUs;
+			if (timing.tcpToChelloUs !== void 0 || timing.chelloToHandshakeUs !== void 0) req.logger = req.logger.with({
+				tcpToChelloUs: timing.tcpToChelloUs,
+				chelloToHandshakeUs: timing.chelloToHandshakeUs
+			}, "handshakeTiming");
+			next();
+		} catch (err) {
+			return (0, _prosopo_api_express_router.handleErrors)(err, req, res, next);
+		}
+	};
 };
+//#endregion
 exports.getHandshakeTiming = getHandshakeTiming;
 exports.handshakeTimingMiddleware = handshakeTimingMiddleware;

package/dist/cjs/api/hardBlockVerdictCache.cjs

@@ -1,118 +1,118 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const DEFAULT_VERDICT_CACHE_TTL_MS = 1e4;
-const DEFAULT_VERDICT_CACHE_MAX_ENTRIES = 5e4;
-class HardBlockVerdictCache {
-  constructor(ttlMs = DEFAULT_VERDICT_CACHE_TTL_MS, maxEntries = DEFAULT_VERDICT_CACHE_MAX_ENTRIES) {
-    this.ttlMs = ttlMs;
-    this.maxEntries = maxEntries;
-    this.store = /* @__PURE__ */ new Map();
-    this.inflight = /* @__PURE__ */ new Map();
-  }
-  get(key) {
-    const entry = this.store.get(key);
-    if (entry === void 0) {
-      return void 0;
-    }
-    if (entry.expiresAt <= Date.now()) {
-      this.store.delete(key);
-      return void 0;
-    }
-    this.store.delete(key);
-    this.store.set(key, entry);
-    return entry.value;
-  }
-  set(key, value) {
-    this.store.delete(key);
-    if (this.store.size >= this.maxEntries) {
-      const oldest = this.store.keys().next().value;
-      if (oldest !== void 0) {
-        this.store.delete(oldest);
-      }
-    }
-    this.store.set(key, {
-      value,
-      expiresAt: Date.now() + this.ttlMs
-    });
-  }
-  /**
-   * Cache lookup with singleflight dedupe of concurrent misses.
-   *
-   * Fast path: cache hit → return immediately (with LRU move-to-tail
-   * via `get()`).
-   *
-   * Slow path: cache miss →
-   *   1. If an in-flight Promise exists for this key, join it. This
-   *      is the coalescing behaviour — N concurrent identical misses
-   *      all await the same underlying storage call.
-   *   2. Otherwise, invoke `compute()`, register the Promise, and
-   *      populate the cache with the result on resolve. The Promise
-   *      is removed from the in-flight map in a `finally` so a
-   *      rejection doesn't wedge future callers.
-   *
-   * Rejection semantics: if `compute()` throws, all joined waiters
-   * see the same rejection. Callers should handle it — the underlying
-   * `getPrioritisedAccessRule` catches its own storage errors and
-   * returns `[]` (fail-open), so in practice this never propagates.
-   */
-  async getOrCompute(key, compute) {
-    const cached = this.get(key);
-    if (cached !== void 0) {
-      return cached;
-    }
-    const existing = this.inflight.get(key);
-    if (existing !== void 0) {
-      return existing;
-    }
-    const promise = (async () => {
-      const value = await compute();
-      this.set(key, value);
-      return value;
-    })();
-    this.inflight.set(key, promise);
-    try {
-      return await promise;
-    } finally {
-      if (this.inflight.get(key) === promise) {
-        this.inflight.delete(key);
-      }
-    }
-  }
-  // Test/ops hook — the running cache is not exposed on the wire, but
-  // admin tooling (e.g. a rule-mutation notifier) may need to flush
-  // after a bulk insert to bound the staleness window. Clears both
-  // the stored entries and any in-flight Promises so a rule mutation
-  // can't leave a stale computation in flight.
-  clear() {
-    this.store.clear();
-    this.inflight.clear();
-  }
-  size() {
-    return this.store.size;
-  }
-  // Test hook: number of in-flight computations. Not on the hot path.
-  inflightSize() {
-    return this.inflight.size;
-  }
-}
-const hardBlockCacheKey = (clientId, userScope, blockOnly) => {
-  const bo = blockOnly ? "1" : "0";
-  const parts = [
-    clientId ?? "",
-    userScope.numericIp === void 0 ? "" : userScope.numericIp.toString(),
-    userScope.numericIpMaskMin === void 0 ? "" : userScope.numericIpMaskMin.toString(),
-    userScope.numericIpMaskMax === void 0 ? "" : userScope.numericIpMaskMax.toString(),
-    userScope.userId ?? "",
-    userScope.ja4Hash ?? "",
-    userScope.headersHash ?? "",
-    userScope.userAgentHash ?? "",
-    userScope.headHash ?? "",
-    userScope.coords ?? "",
-    userScope.countryCode ?? "",
-    userScope.asn === void 0 ? "" : String(userScope.asn)
-  ];
-  return `${bo}|${parts.join("|")}`;
+//#region src/api/hardBlockVerdictCache.ts
+var DEFAULT_VERDICT_CACHE_TTL_MS = 1e4;
+var DEFAULT_VERDICT_CACHE_MAX_ENTRIES = 5e4;
+/**
+* Bounded LRU + TTL cache for hard-block verdicts, with singleflight
+* dedupe of concurrent misses.
+*
+* Eviction is real LRU: `get()` moves the hit entry to the tail of the
+* Map's iteration order (Map iteration = insertion order in JS), so
+* `set()` drops the least-recently-used entry once the cap is reached.
+* Absolute TTL is preserved on hit — `expiresAt` is set at insert and
+* never refreshed, so a hot key can't stay stale beyond ttlMs no matter
+* how often it's accessed.
+*
+* `getOrCompute()` is the singleflight entry point: if a concurrent
+* caller is already computing the value for `key`, joiners return the
+* same in-flight Promise instead of racing to the underlying storage.
+* Kills the wave-1 stampede where N identical concurrent requests all
+* miss the cache simultaneously and all hit Redis before the first has
+* populated the entry.
+*/
+var HardBlockVerdictCache = class {
+	constructor(ttlMs = DEFAULT_VERDICT_CACHE_TTL_MS, maxEntries = DEFAULT_VERDICT_CACHE_MAX_ENTRIES) {
+		this.ttlMs = ttlMs;
+		this.maxEntries = maxEntries;
+		this.store = /* @__PURE__ */ new Map();
+		this.inflight = /* @__PURE__ */ new Map();
+	}
+	get(key) {
+		const entry = this.store.get(key);
+		if (entry === void 0) return;
+		if (entry.expiresAt <= Date.now()) {
+			this.store.delete(key);
+			return;
+		}
+		this.store.delete(key);
+		this.store.set(key, entry);
+		return entry.value;
+	}
+	set(key, value) {
+		this.store.delete(key);
+		if (this.store.size >= this.maxEntries) {
+			const oldest = this.store.keys().next().value;
+			if (oldest !== void 0) this.store.delete(oldest);
+		}
+		this.store.set(key, {
+			value,
+			expiresAt: Date.now() + this.ttlMs
+		});
+	}
+	/**
+	* Cache lookup with singleflight dedupe of concurrent misses.
+	*
+	* Fast path: cache hit → return immediately (with LRU move-to-tail
+	* via `get()`).
+	*
+	* Slow path: cache miss →
+	*   1. If an in-flight Promise exists for this key, join it. This
+	*      is the coalescing behaviour — N concurrent identical misses
+	*      all await the same underlying storage call.
+	*   2. Otherwise, invoke `compute()`, register the Promise, and
+	*      populate the cache with the result on resolve. The Promise
+	*      is removed from the in-flight map in a `finally` so a
+	*      rejection doesn't wedge future callers.
+	*
+	* Rejection semantics: if `compute()` throws, all joined waiters
+	* see the same rejection. Callers should handle it — the underlying
+	* `getPrioritisedAccessRule` catches its own storage errors and
+	* returns `[]` (fail-open), so in practice this never propagates.
+	*/
+	async getOrCompute(key, compute) {
+		const cached = this.get(key);
+		if (cached !== void 0) return cached;
+		const existing = this.inflight.get(key);
+		if (existing !== void 0) return existing;
+		const promise = (async () => {
+			const value = await compute();
+			this.set(key, value);
+			return value;
+		})();
+		this.inflight.set(key, promise);
+		try {
+			return await promise;
+		} finally {
+			if (this.inflight.get(key) === promise) this.inflight.delete(key);
+		}
+	}
+	clear() {
+		this.store.clear();
+		this.inflight.clear();
+	}
+	size() {
+		return this.store.size;
+	}
+	inflightSize() {
+		return this.inflight.size;
+	}
 };
+var hardBlockCacheKey = (clientId, userScope, blockOnly) => {
+	return `${blockOnly ? "1" : "0"}|${[
+		clientId ?? "",
+		userScope.numericIp === void 0 ? "" : userScope.numericIp.toString(),
+		userScope.numericIpMaskMin === void 0 ? "" : userScope.numericIpMaskMin.toString(),
+		userScope.numericIpMaskMax === void 0 ? "" : userScope.numericIpMaskMax.toString(),
+		userScope.userId ?? "",
+		userScope.ja4Hash ?? "",
+		userScope.headersHash ?? "",
+		userScope.userAgentHash ?? "",
+		userScope.headHash ?? "",
+		userScope.coords ?? "",
+		userScope.countryCode ?? "",
+		userScope.asn === void 0 ? "" : String(userScope.asn)
+	].join("|")}`;
+};
+//#endregion
 exports.DEFAULT_VERDICT_CACHE_MAX_ENTRIES = DEFAULT_VERDICT_CACHE_MAX_ENTRIES;
 exports.DEFAULT_VERDICT_CACHE_TTL_MS = DEFAULT_VERDICT_CACHE_TTL_MS;
 exports.HardBlockVerdictCache = HardBlockVerdictCache;

package/dist/cjs/api/headerCheckMiddleware.cjs

@@ -1,36 +1,36 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const apiExpressRouter = require("@prosopo/api-express-router");
-const validateAddress = require("./validateAddress.cjs");
-const headerCheckMiddleware = (env) => {
-  return async (req, res, next) => {
-    try {
-      const user = req.headers["prosopo-user"];
-      const siteKey = req.headers["prosopo-site-key"];
-      if (!user) {
-        unauthorised(res);
-        return;
-      }
-      if (!siteKey) {
-        unauthorised(res);
-        return;
-      }
-      validateAddress.validateSiteKey(siteKey, req.logger);
-      validateAddress.validateAddr(user, void 0, req.logger);
-      req.user = user;
-      req.siteKey = siteKey;
-      req.logger = req.logger.with(
-        {
-          user,
-          siteKey
-        },
-        "header-check"
-      );
-      next();
-    } catch (err) {
-      return apiExpressRouter.handleErrors(err, req, res, next);
-    }
-  };
+const require_validateAddress = require("./validateAddress.cjs");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
+//#region src/api/headerCheckMiddleware.ts
+var headerCheckMiddleware = (env) => {
+	return async (req, res, next) => {
+		try {
+			const user = req.headers["prosopo-user"];
+			const siteKey = req.headers["prosopo-site-key"];
+			if (!user) {
+				unauthorised(res);
+				return;
+			}
+			if (!siteKey) {
+				unauthorised(res);
+				return;
+			}
+			require_validateAddress.validateSiteKey(siteKey, req.logger);
+			require_validateAddress.validateAddr(user, void 0, req.logger);
+			req.user = user;
+			req.siteKey = siteKey;
+			req.logger = req.logger.with({
+				user,
+				siteKey
+			}, "header-check");
+			next();
+		} catch (err) {
+			return (0, _prosopo_api_express_router.handleErrors)(err, req, res, next);
+		}
+	};
 };
-const unauthorised = (res) => res.status(401).json({ error: "Unauthorized", message: "Unauthorized" });
+var unauthorised = (res) => res.status(401).json({
+	error: "Unauthorized",
+	message: "Unauthorized"
+});
+//#endregion
 exports.headerCheckMiddleware = headerCheckMiddleware;

package/dist/cjs/api/ignoreMiddleware.cjs

@@ -1,17 +1,15 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const types = require("@prosopo/types");
+let _prosopo_types = require("@prosopo/types");
+//#region src/api/ignoreMiddleware.ts
 function ignoreMiddleware() {
-  return (req, res, next) => {
-    if (req.originalUrl.indexOf(types.PublicApiPaths.Healthz) !== -1) {
-      return next();
-    }
-    if (req.originalUrl.indexOf(types.ApiPrefix) === -1) {
-      res.statusCode = 404;
-      res.send("Not Found");
-      return;
-    }
-    next();
-  };
+	return (req, res, next) => {
+		if (req.originalUrl.indexOf(_prosopo_types.PublicApiPaths.Healthz) !== -1) return next();
+		if (req.originalUrl.indexOf(_prosopo_types.ApiPrefix) === -1) {
+			res.statusCode = 404;
+			res.send("Not Found");
+			return;
+		}
+		next();
+	};
 }
+//#endregion
 exports.ignoreMiddleware = ignoreMiddleware;

package/dist/cjs/api/ipInfoMiddleware.cjs

@@ -1,20 +1,18 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const ipInfoMiddleware = (env) => {
-  return async (req, _res, next) => {
-    try {
-      const ip = req.ip;
-      if (ip && env.ipInfoService.isAvailable()) {
-        req.ipInfo = await env.ipInfoService.lookup(ip);
-      }
-      next();
-    } catch (err) {
-      req.logger?.warn?.(() => ({
-        msg: "IP info middleware failed",
-        err
-      }));
-      next();
-    }
-  };
+//#region src/api/ipInfoMiddleware.ts
+var ipInfoMiddleware = (env) => {
+	return async (req, _res, next) => {
+		try {
+			const ip = req.ip;
+			if (ip && env.ipInfoService.isAvailable()) req.ipInfo = await env.ipInfoService.lookup(ip);
+			next();
+		} catch (err) {
+			req.logger?.warn?.(() => ({
+				msg: "IP info middleware failed",
+				err
+			}));
+			next();
+		}
+	};
 };
+//#endregion
 exports.ipInfoMiddleware = ipInfoMiddleware;