@prosopo/provider 4.8.0 → 4.9.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/provider@4.8.0 build:cjs
+> @prosopo/provider@4.9.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -53,7 +53,7 @@ ViteCommonJSConfig: .
 Bundle build started
 transforming...
 Build end
-✓ 91 modules transformed.
+✓ 92 modules transformed.
 Entry module "src/tasks/detection/decodeSimd.js" is using named and default exports together. Consumers of your bundle will have to use `..default` to access the default export, which may not be what you want. Use `output.exports: "named"` to disable this warning.
 Entry module "src/tasks/detection/decodeBehavior.js" is using named and default exports together. Consumers of your bundle will have to use `..default` to access the default export, which may not be what you want. Use `output.exports: "named"` to disable this warning.
 rendering chunks...
@@ -75,7 +75,6 @@ rendering chunks...
 dist/cjs/api/captcha/contextAwareValidation.cjs                                0.75 kB
 dist/cjs/tasks/imgCaptcha/imgCaptchaTasksUtils.cjs                             0.84 kB
 dist/cjs/api/validateAddress.cjs                                               0.84 kB
-dist/cjs/pairs.cjs                                                             0.87 kB
 dist/cjs/utils/normalizeRequestIp.cjs                                          0.89 kB
 dist/cjs/api/block.cjs                                                         0.91 kB
 dist/cjs/tasks/dataset/datasetTasks.cjs                                        0.96 kB
@@ -93,6 +92,7 @@ rendering chunks...
 dist/cjs/api/admin/apiUpdateDetectorKeyEndpoint.cjs                            1.31 kB
 dist/cjs/api/admin/apiRemoveDecisionMachineEndpoint.cjs                        1.32 kB
 dist/cjs/api/admin/apiRegisterSiteKeyEndpoint.cjs                              1.34 kB
+dist/cjs/pairs.cjs                                                             1.37 kB
 dist/cjs/api/admin/apiRegisterSiteKeysEndpoint.cjs                             1.46 kB
 dist/cjs/api/admin/apiRemoveSiteKeyEndpoint.cjs                                1.47 kB
 dist/cjs/api/admin/apiRemoveSiteKeysEndpoint.cjs                               1.48 kB
@@ -100,7 +100,6 @@ rendering chunks...
 dist/cjs/api/admin/apiGetAllDecisionMachinesEndpoint.cjs                       1.57 kB
 dist/cjs/compositeIpAddress.cjs                                                1.64 kB
 dist/cjs/schedulers/updateSpamEmailDomains.cjs                                 1.65 kB
-dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     1.67 kB
 dist/cjs/utils/honeypot/phraseBank.cjs                                         1.71 kB
 dist/cjs/api/admin/apiToggleMaintenanceModeEndpoint.cjs                        1.72 kB
 dist/cjs/api/public.cjs                                                        1.74 kB
@@ -112,24 +111,26 @@ rendering chunks...
 dist/cjs/tasks/frictionless/routingMachine.cjs                                 1.86 kB
 dist/cjs/api/captcha/checkSpamEmail.cjs                                        2.10 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs          2.11 kB
-dist/cjs/api/admin/apiDnsEventEndpoint.cjs                                     2.12 kB
 dist/cjs/tasks/spam/updateSpamEmailDomains.cjs                                 2.13 kB
+dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs                                     2.16 kB
+dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     2.24 kB
 dist/cjs/api/captcha.cjs                                                       2.66 kB
 dist/cjs/api/ja4Middleware.cjs                                                 2.74 kB
 dist/cjs/api/captcha/submitPuzzleCaptchaSolution.cjs                           2.85 kB
 dist/cjs/tasks/spam/evaluateEmailSpamRules.cjs                                 3.03 kB
+dist/cjs/api/admin/apiDnsEventEndpoint.cjs                                     3.15 kB
 dist/cjs/api/captcha/submitImageCaptchaSolution.cjs                            3.20 kB
 dist/cjs/utils/dns.cjs                                                         3.38 kB
-dist/cjs/api/admin/apiAdminRoutesProvider.cjs                                  3.56 kB
+dist/cjs/api/admin/apiAdminRoutesProvider.cjs                                  3.61 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs          3.78 kB
 dist/cjs/api/domainMiddleware.cjs                                              3.91 kB
 dist/cjs/index.cjs                                                             4.01 kB
 dist/cjs/services/ipComparison.cjs                                             4.10 kB
 dist/cjs/tasks/spam/checkSpamEmail.cjs                                         4.32 kB
 dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              5.20 kB
-dist/cjs/tasks/tasks.cjs                                                       5.33 kB
-dist/cjs/util/usageCounters.cjs                                                5.40 kB
+dist/cjs/tasks/tasks.cjs                                                       5.35 kB
 dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              5.53 kB
+dist/cjs/util/usageCounters.cjs                                                5.80 kB
 dist/cjs/api/blacklistRequestInspector.cjs                                     6.05 kB
 dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs                                6.23 kB
 dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             6.42 kB
@@ -138,17 +139,17 @@ rendering chunks...
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              10.10 kB
 dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs                      10.19 kB
 dist/cjs/api/verify.cjs                                                       10.85 kB
-dist/cjs/util.cjs                                                             12.22 kB
+dist/cjs/util.cjs                                                             12.59 kB
 dist/cjs/tasks/client/clientTasks.cjs                                         15.63 kB
-dist/cjs/tasks/captchaManager.cjs                                             15.75 kB
+dist/cjs/tasks/captchaManager.cjs                                             16.05 kB
 dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             16.20 kB
 dist/cjs/tasks/detection/decodeSimd.cjs                                       18.20 kB
-dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  19.08 kB
 dist/cjs/tasks/detection/decodeBehavior.cjs                                   19.16 kB
-dist/cjs/tasks/powCaptcha/powTasks.cjs                                        21.06 kB
-dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 26.91 kB
+dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  20.22 kB
+dist/cjs/tasks/powCaptcha/powTasks.cjs                                        22.20 kB
+dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 28.30 kB
 dist/cjs/tasks/detection/decodePayload.cjs                                    44.26 kB
-✓ built in 808ms
+✓ built in 754ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/provider@4.8.0 build:tsc
+> @prosopo/provider@4.9.0 build:tsc
 > tsc --build --verbose
 
-12:30:35 PM - Projects in this build: 
+5:56:48 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -25,47 +25,47 @@
     * ../load-balancer/tsconfig.json
     * tsconfig.json
 
-12:30:35 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/index.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/procaptcha/behavioral.ts' is older than output '../types/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/provider/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/batches.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/index.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/redisClient.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/rule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/databases/centralDbStreamer.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/integration/centralStreamingEnrichment.integration.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/index.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/middlewares/requestLoggerMiddleware.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/apiExpressRouterFactory.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/index.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+5:56:48 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-12:30:35 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+5:56:48 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-12:30:35 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+5:56:48 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/provider@4.8.0 build
+> @prosopo/provider@4.9.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/provider@4.8.0 build:cross-env
+> @prosopo/provider@4.9.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -57,7 +57,7 @@ ViteEsmConfig: .
 Bundle build started
 transforming...
 Build end
-✓ 91 modules transformed.
+✓ 92 modules transformed.
 rendering chunks...
 dist/tasks/index.js                                                       0.06 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge.js                       0.12 kB
@@ -76,7 +76,6 @@ rendering chunks...
 dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js      0.55 kB
 dist/api/captcha/contextAwareValidation.js                                0.63 kB
 dist/api/validateAddress.js                                               0.71 kB
-dist/pairs.js                                                             0.72 kB
 dist/tasks/imgCaptcha/imgCaptchaTasksUtils.js                             0.74 kB
 dist/api/block.js                                                         0.78 kB
 dist/utils/normalizeRequestIp.js                                          0.79 kB
@@ -95,6 +94,7 @@ rendering chunks...
 dist/schedulers/getClientList.js                                          1.10 kB
 dist/schedulers/setClientEntropy.js                                       1.13 kB
 dist/schedulers/captchaScheduler.js                                       1.16 kB
+dist/pairs.js                                                             1.18 kB
 dist/api/admin/apiUpdateDetectorKeyEndpoint.js                            1.18 kB
 dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.19 kB
 dist/api/admin/apiToggleMaintenanceModeEndpoint.js                        1.19 kB
@@ -105,33 +105,34 @@ rendering chunks...
 dist/compositeIpAddress.js                                                1.44 kB
 dist/api/captcha/maintenanceModeResponses.js                              1.47 kB
 dist/schedulers/updateSpamEmailDomains.js                                 1.50 kB
-dist/tasks/spam/checkTrafficFilter.js                                     1.56 kB
 dist/utils/honeypot/phraseBank.js                                         1.57 kB
 dist/api/public.js                                                        1.60 kB
-dist/api/admin/apiDnsEventEndpoint.js                                     1.64 kB
 dist/api/admin/apiClearAllCountersEndpoint.js                             1.66 kB
 dist/api/admin/apiUpdateDecisionMachineEndpoint.js                        1.67 kB
 dist/utils/honeypot/encoders.js                                           1.71 kB
 dist/tasks/frictionless/routingMachine.js                                 1.76 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          1.95 kB
+dist/tasks/dnsEvent/enrichDnsEvent.js                                     1.97 kB
 dist/tasks/spam/updateSpamEmailDomains.js                                 2.03 kB
 dist/api/captcha/checkSpamEmail.js                                        2.08 kB
+dist/tasks/spam/checkTrafficFilter.js                                     2.14 kB
 dist/api/ja4Middleware.js                                                 2.19 kB
 dist/api/captcha.js                                                       2.49 kB
 dist/utils/dns.js                                                         2.57 kB
 dist/index.js                                                             2.66 kB
+dist/api/admin/apiDnsEventEndpoint.js                                     2.66 kB
 dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.78 kB
 dist/tasks/spam/evaluateEmailSpamRules.js                                 2.84 kB
-dist/api/admin/apiAdminRoutesProvider.js                                  2.93 kB
+dist/api/admin/apiAdminRoutesProvider.js                                  2.99 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            3.07 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.js          3.59 kB
 dist/api/domainMiddleware.js                                              3.71 kB
 dist/services/ipComparison.js                                             4.00 kB
 dist/tasks/spam/checkSpamEmail.js                                         4.26 kB
 dist/api/captcha/submitPoWCaptchaSolution.js                              5.09 kB
-dist/tasks/tasks.js                                                       5.13 kB
-dist/util/usageCounters.js                                                5.29 kB
+dist/tasks/tasks.js                                                       5.15 kB
 dist/api/captcha/getImageCaptchaChallenge.js                              5.41 kB
+dist/util/usageCounters.js                                                5.69 kB
 dist/api/blacklistRequestInspector.js                                     5.80 kB
 dist/api/captcha/getPoWCaptchaChallenge.js                                6.00 kB
 dist/api/captcha/getPuzzleCaptchaChallenge.js                             6.17 kB
@@ -140,17 +141,17 @@ rendering chunks...
 dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js               9.76 kB
 dist/tasks/decisionMachine/decisionMachineRunner.js                      10.14 kB
 dist/api/verify.js                                                       10.43 kB
-dist/util.js                                                             11.79 kB
-dist/tasks/captchaManager.js                                             15.10 kB
+dist/util.js                                                             12.17 kB
 dist/tasks/client/clientTasks.js                                         15.37 kB
+dist/tasks/captchaManager.js                                             15.41 kB
 dist/tasks/frictionless/frictionlessTasks.js                             15.89 kB
 dist/tasks/detection/decodeSimd.js                                       18.06 kB
-dist/tasks/puzzleCaptcha/puzzleTasks.js                                  18.83 kB
 dist/tasks/detection/decodeBehavior.js                                   19.03 kB
-dist/tasks/powCaptcha/powTasks.js                                        20.71 kB
-dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.52 kB
+dist/tasks/puzzleCaptcha/puzzleTasks.js                                  19.91 kB
+dist/tasks/powCaptcha/powTasks.js                                        21.79 kB
+dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 27.86 kB
 dist/tasks/detection/decodePayload.js                                    44.24 kB
-✓ built in 1.40s
+✓ built in 1.50s
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @prosopo/provider
 
+## 4.9.0
+### Minor Changes
+
+- bc3813d: Surface dnsEvent observations across the verify and frictionless flows. Each verify path now enriches the session's dnsEvent IPs once and passes the result to the traffic filter, decision machine, IP validation, and usage counters. Adds `scoreComponents.dnsAsymmetry` (Zod + TS interface + mongoose) computed from resolver / peer ipInfo plus path validity, with the score patched onto the session at DNS event ingest time so it weights subsequent reads. Adds `CounterDimension.peerIp` for rate-limit keys keyed on the dnsEvent peer IP.
+- f305c37: Extend `checkTrafficFilter` to accept an optional `extraIpInfos` list and apply the same per-rule checks across additional IPs. Each verify path threads `session.dnsEvent` IPs through `resolveTrafficFilterCheck` so its peer / resolver enrichments are evaluated alongside the primary client IP.
+
+### Patch Changes
+
+- 2d66d8e: Image-captcha widget now forwards the trusted checkbox click `(clientX, clientY)` through `manager.start(x, y)`. `Manager.submit` embeds the pair as a 2-number prefix on the first captcha's solution salt. Provider peels the prefix via length math against `solution.length` (no protocol version flag — older clients keep working unchanged) and prepends it as the first entry of `pairs`, which is written to `UserCommitment.coords`. Adds `peelCheckboxPrefix` helper in `pairs.ts` with round-trip unit tests.
+- Updated dependencies [2972def]
+- Updated dependencies [bc3813d]
+- Updated dependencies [4d05e3f]
+  - @prosopo/types-database@4.9.0
+  - @prosopo/types@4.4.0
+  - @prosopo/database@3.13.10
+  - @prosopo/types-env@2.9.19
+  - @prosopo/api@3.4.10
+  - @prosopo/api-express-router@3.1.20
+  - @prosopo/datasets@3.1.30
+  - @prosopo/env@3.5.10
+  - @prosopo/ipinfo@0.2.16
+  - @prosopo/keyring@2.9.36
+  - @prosopo/load-balancer@2.9.12
+  - @prosopo/user-access-policy@3.8.1
+
+## 4.8.1
+### Patch Changes
+
+- 8a30164: `checkTrafficFilter` no longer treats VPN traffic that exits from a datacenter IP as datacenter traffic. Commercial VPNs (Mullvad, NordVPN, ProtonVPN, …) all run on cloud providers, so operators who enabled `blockDatacenter` but not `blockVpn` were silently catching VPN end-users they did not intend to block. The datacenter rule is now suppressed when `ipInfo.isVPN` is true and `blockVpn` is false. Closes prosopo/captcha-private#3479.
+
 ## 4.8.0
 ### Minor Changes
 

package/dist/api/admin/apiAdminRoutesProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiAdminRoutesProvider.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiAdminRoutesProvider.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAgBlD,cAAM,sBAAuB,YAAW,iBAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,KAAK;IAEzC,SAAS,IAAI,SAAS;CAuC7B;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"apiAdminRoutesProvider.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiAdminRoutesProvider.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAgBlD,cAAM,sBAAuB,YAAW,iBAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,KAAK;IAEzC,SAAS,IAAI,SAAS;CA0C7B;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/api/admin/apiAdminRoutesProvider.js

@@ -48,7 +48,10 @@ class ApiAdminRoutesProvider {
         this.tasks.clientTaskManager
       ),
       [AdminApiPaths.ToggleMaintenanceMode]: new ApiToggleMaintenanceModeEndpoint(),
-      [AdminApiPaths.DnsEvent]: new ApiDnsEventEndpoint(this.tasks.db)
+      [AdminApiPaths.DnsEvent]: new ApiDnsEventEndpoint(
+        this.tasks.db,
+        this.tasks.env.ipInfoService
+      )
     };
   }
 }

package/dist/api/admin/apiAdminRoutesProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiAdminRoutesProvider.js","sourceRoot":"","sources":["../../../src/api/admin/apiAdminRoutesProvider.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF,MAAM,sBAAsB;IAC3B,YAAoC,KAAY;QAAZ,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAE7C,SAAS;QACf,OAAO;YACN,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,IAAI,0BAA0B,CAC9D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,IAAI,2BAA2B,CAChE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,4BAA4B,CAClE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,4BAA4B,CAClE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACnE,CAAC,aAAa,CAAC,sBAAsB,CAAC,EACrC,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACpE,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,IAAI,6BAA6B,CACpE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACnE,CAAC,aAAa,CAAC,yBAAyB,CAAC,EACxC,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,IAAI,2BAA2B,CAChE,IAAI,CAAC,KAAK,CAAC,aAAa,CACxB;YACD,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,IAAI,wBAAwB,CAC1D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,IAAI,yBAAyB,CAC5D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,EAAE;YACvC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;CACD;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"apiAdminRoutesProvider.js","sourceRoot":"","sources":["../../../src/api/admin/apiAdminRoutesProvider.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF,MAAM,sBAAsB;IAC3B,YAAoC,KAAY;QAAZ,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAE7C,SAAS;QACf,OAAO;YACN,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,IAAI,0BAA0B,CAC9D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,IAAI,2BAA2B,CAChE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,4BAA4B,CAClE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,4BAA4B,CAClE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACnE,CAAC,aAAa,CAAC,sBAAsB,CAAC,EACrC,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACpE,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,IAAI,6BAA6B,CACpE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACnE,CAAC,aAAa,CAAC,yBAAyB,CAAC,EACxC,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,IAAI,2BAA2B,CAChE,IAAI,CAAC,KAAK,CAAC,aAAa,CACxB;YACD,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,IAAI,wBAAwB,CAC1D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,IAAI,yBAAyB,CAC5D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAC5B;YACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EACpC,IAAI,gCAAgC,EAAE;YACvC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,mBAAmB,CAChD,IAAI,CAAC,KAAK,CAAC,EAAE,EACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAC5B;SACD,CAAC;IACH,CAAC;CACD;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/api/admin/apiDnsEventEndpoint.d.ts

@@ -1,4 +1,5 @@
 import { type ApiEndpoint, type ApiEndpointResponse } from "@prosopo/api-route";
+import type { IIpInfoService } from "@prosopo/ipinfo";
 import { type Logger } from "@prosopo/logger";
 import { type DnsEvent, DnsEventBatchSchema } from "@prosopo/types";
 import type { IProviderDatabase } from "@prosopo/types-database";
@@ -11,9 +12,11 @@ export declare const dnsEventToFields: (event: DnsEvent) => {
 };
 declare class ApiDnsEventEndpoint implements ApiEndpoint<DnsEventBatchSchemaType> {
     private readonly db;
-    constructor(db: IProviderDatabase);
+    private readonly ipInfoService?;
+    constructor(db: IProviderDatabase, ipInfoService?: IIpInfoService | undefined);
     processRequest(args: z.infer<DnsEventBatchSchemaType>, logger?: Logger): Promise<ApiEndpointResponse>;
     getRequestArgsSchema(): DnsEventBatchSchemaType;
+    private recomputeDnsAsymmetry;
 }
 export { ApiDnsEventEndpoint };
 //# sourceMappingURL=apiDnsEventEndpoint.d.ts.map

package/dist/api/admin/apiDnsEventEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiDnsEventEndpoint.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiDnsEventEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,KAAK,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,KAAK,uBAAuB,GAAG,OAAO,mBAAmB,CAAC;AAG1D,eAAO,MAAM,gBAAgB,UACrB,QAAQ,KACb;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAW7D,CAAC;AAEF,cAAM,mBAAoB,YAAW,WAAW,CAAC,uBAAuB,CAAC;IACrD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,iBAAiB;IAEnD,cAAc,CACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IA6CxB,oBAAoB,IAAI,uBAAuB;CAGtD;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"apiDnsEventEndpoint.d.ts","sourceRoot":"","sources":["../../../src/api/admin/apiDnsEventEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,KAAK,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAM7B,KAAK,uBAAuB,GAAG,OAAO,mBAAmB,CAAC;AAG1D,eAAO,MAAM,gBAAgB,UACrB,QAAQ,KACb;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAW7D,CAAC;AAEF,cAAM,mBAAoB,YAAW,WAAW,CAAC,uBAAuB,CAAC;IAEvE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBADd,EAAE,EAAE,iBAAiB,EACrB,aAAa,CAAC,EAAE,cAAc,YAAA;IAG1C,cAAc,CACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IA8CxB,oBAAoB,IAAI,uBAAuB;YAIxC,qBAAqB;CA8BnC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/api/admin/apiDnsEventEndpoint.js

@@ -1,6 +1,7 @@
 import { ApiEndpointResponseStatus } from "@prosopo/api-route";
 import { getLogger } from "@prosopo/logger";
 import { DnsEventBatchSchema } from "@prosopo/types";
+import { enrichDnsEvent, computeDnsAsymmetry } from "../../tasks/dnsEvent/enrichDnsEvent.js";
 const dnsEventToFields = (event) => {
   if (event.kind === "dns") {
     return { resolverIp: event.src_ip };
@@ -14,8 +15,9 @@ const dnsEventToFields = (event) => {
   return out;
 };
 class ApiDnsEventEndpoint {
-  constructor(db) {
+  constructor(db, ipInfoService) {
     this.db = db;
+    this.ipInfoService = ipInfoService;
   }
   async processRequest(args, logger) {
     logger = logger || getLogger("info", import.meta.url);
@@ -37,6 +39,7 @@ class ApiDnsEventEndpoint {
         );
         if (matched) {
           stored += 1;
+          await this.recomputeDnsAsymmetry(sessionId, logger);
         }
       } catch (err) {
         errors += 1;
@@ -59,6 +62,33 @@ class ApiDnsEventEndpoint {
   getRequestArgsSchema() {
     return DnsEventBatchSchema;
   }
+  async recomputeDnsAsymmetry(sessionId, logger) {
+    if (!this.ipInfoService) return;
+    try {
+      const session = await this.db.getSessionRecordBySessionId(sessionId);
+      if (!session?.dnsEvent) return;
+      const enriched = await enrichDnsEvent(
+        session.dnsEvent,
+        this.ipInfoService,
+        session.ipInfo?.ip
+      );
+      const dnsAsymmetry = computeDnsAsymmetry(enriched, session.ipInfo);
+      if (dnsAsymmetry > 0) {
+        await this.db.updateSessionRecord(sessionId, {
+          scoreComponents: {
+            ...session.scoreComponents,
+            dnsAsymmetry
+          }
+        });
+      }
+    } catch (err) {
+      logger.warn(() => ({
+        err,
+        data: { sessionId },
+        msg: "Failed to recompute dnsAsymmetry after DNS event merge"
+      }));
+    }
+  }
 }
 export {
   ApiDnsEventEndpoint,

package/dist/api/admin/apiDnsEventEndpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiDnsEventEndpoint.js","sourceRoot":"","sources":["../../../src/api/admin/apiDnsEventEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAe,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAiB,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAOpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC/B,KAAe,EACiD,EAAE;IAClE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAA4C;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;KACpB,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,mBAAmB;IACxB,YAAoC,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAE7D,KAAK,CAAC,cAAc,CACnB,IAAsC,EACtC,MAAe;QAEf,MAAM,GAAG,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAExB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;YAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,SAAS;YACV,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,oBAAoB,CACjD,SAAS,EACT,MAAM,EACN,GAAG,CACH,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,CAAC;gBACb,CAAC;YACF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBAClB,GAAG;oBACH,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;oBACrC,GAAG,EAAE,wCAAwC;iBAC7C,CAAC,CAAC,CAAC;YACL,CAAC;QACF,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YACjD,GAAG,EAAE,2BAA2B;SAChC,CAAC,CAAC,CAAC;QAEJ,OAAO;YACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;YACzC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SACxB,CAAC;IACH,CAAC;IAEM,oBAAoB;QAC1B,OAAO,mBAAmB,CAAC;IAC5B,CAAC;CACD;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"apiDnsEventEndpoint.js","sourceRoot":"","sources":["../../../src/api/admin/apiDnsEventEndpoint.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAe,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAiB,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EACN,mBAAmB,EACnB,cAAc,GACd,MAAM,wCAAwC,CAAC;AAKhD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC/B,KAAe,EACiD,EAAE;IAClE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAA4C;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;KACpB,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,mBAAmB;IACxB,YACkB,EAAqB,EACrB,aAA8B;QAD9B,OAAE,GAAF,EAAE,CAAmB;QACrB,kBAAa,GAAb,aAAa,CAAiB;IAC7C,CAAC;IAEJ,KAAK,CAAC,cAAc,CACnB,IAAsC,EACtC,MAAe;QAEf,MAAM,GAAG,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAExB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;YAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,SAAS;YACV,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,oBAAoB,CACjD,SAAS,EACT,MAAM,EACN,GAAG,CACH,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,CAAC;oBACZ,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACrD,CAAC;YACF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBAClB,GAAG;oBACH,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;oBACrC,GAAG,EAAE,wCAAwC;iBAC7C,CAAC,CAAC,CAAC;YACL,CAAC;QACF,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YACjD,GAAG,EAAE,2BAA2B;SAChC,CAAC,CAAC,CAAC;QAEJ,OAAO;YACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;YACzC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SACxB,CAAC;IACH,CAAC;IAEM,oBAAoB;QAC1B,OAAO,mBAAmB,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAClC,SAAiB,EACjB,MAAc;QAEd,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAChC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,EAAE,QAAQ;gBAAE,OAAO;YAC/B,MAAM,QAAQ,GAAG,MAAM,cAAc,CACpC,OAAO,CAAC,QAAQ,EAChB,IAAI,CAAC,aAAa,EAClB,OAAO,CAAC,MAAM,EAAE,EAAE,CAClB,CAAC;YACF,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACnE,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE;oBAC5C,eAAe,EAAE;wBAChB,GAAG,OAAO,CAAC,eAAe;wBAC1B,YAAY;qBACZ;iBACD,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAClB,GAAG;gBACH,IAAI,EAAE,EAAE,SAAS,EAAE;gBACnB,GAAG,EAAE,wDAAwD;aAC7D,CAAC,CAAC,CAAC;QACL,CAAC;IACF,CAAC;CACD;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/cjs/api/admin/apiAdminRoutesProvider.cjs

@@ -50,7 +50,10 @@ class ApiAdminRoutesProvider {
         this.tasks.clientTaskManager
       ),
       [types.AdminApiPaths.ToggleMaintenanceMode]: new apiToggleMaintenanceModeEndpoint.ApiToggleMaintenanceModeEndpoint(),
-      [types.AdminApiPaths.DnsEvent]: new apiDnsEventEndpoint.ApiDnsEventEndpoint(this.tasks.db)
+      [types.AdminApiPaths.DnsEvent]: new apiDnsEventEndpoint.ApiDnsEventEndpoint(
+        this.tasks.db,
+        this.tasks.env.ipInfoService
+      )
     };
   }
 }

package/dist/cjs/api/admin/apiDnsEventEndpoint.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const apiRoute = require("@prosopo/api-route");
 const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
+const enrichDnsEvent = require("../../tasks/dnsEvent/enrichDnsEvent.cjs");
 var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
 const dnsEventToFields = (event) => {
   if (event.kind === "dns") {
@@ -17,8 +18,9 @@ const dnsEventToFields = (event) => {
   return out;
 };
 class ApiDnsEventEndpoint {
-  constructor(db) {
+  constructor(db, ipInfoService) {
     this.db = db;
+    this.ipInfoService = ipInfoService;
   }
   async processRequest(args, logger$1) {
     logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiDnsEventEndpoint.cjs", document.baseURI).href);
@@ -40,6 +42,7 @@ class ApiDnsEventEndpoint {
         );
         if (matched) {
           stored += 1;
+          await this.recomputeDnsAsymmetry(sessionId, logger$1);
         }
       } catch (err) {
         errors += 1;
@@ -62,6 +65,33 @@ class ApiDnsEventEndpoint {
   getRequestArgsSchema() {
     return types.DnsEventBatchSchema;
   }
+  async recomputeDnsAsymmetry(sessionId, logger2) {
+    if (!this.ipInfoService) return;
+    try {
+      const session = await this.db.getSessionRecordBySessionId(sessionId);
+      if (!session?.dnsEvent) return;
+      const enriched = await enrichDnsEvent.enrichDnsEvent(
+        session.dnsEvent,
+        this.ipInfoService,
+        session.ipInfo?.ip
+      );
+      const dnsAsymmetry = enrichDnsEvent.computeDnsAsymmetry(enriched, session.ipInfo);
+      if (dnsAsymmetry > 0) {
+        await this.db.updateSessionRecord(sessionId, {
+          scoreComponents: {
+            ...session.scoreComponents,
+            dnsAsymmetry
+          }
+        });
+      }
+    } catch (err) {
+      logger2.warn(() => ({
+        err,
+        data: { sessionId },
+        msg: "Failed to recompute dnsAsymmetry after DNS event merge"
+      }));
+    }
+  }
 }
 exports.ApiDnsEventEndpoint = ApiDnsEventEndpoint;
 exports.dnsEventToFields = dnsEventToFields;

package/dist/cjs/pairs.cjs

@@ -11,6 +11,19 @@ const constructPairList = (list) => {
   }
   return pairList;
 };
+const peelCheckboxPrefix = (flat, solutionLengths) => {
+  const firstFlat = flat[0];
+  const firstLen = solutionLengths[0];
+  if (firstFlat === void 0 || firstLen === void 0) {
+    return { flat };
+  }
+  if (firstFlat.length === 2 * firstLen + 2) {
+    const checkbox = [util.at(firstFlat, 0), util.at(firstFlat, 1)];
+    const stripped = [firstFlat.slice(2), ...flat.slice(1)];
+    return { checkbox, flat: stripped };
+  }
+  return { flat };
+};
 const containsIdenticalPairs = (pairsLists) => {
   const set = /* @__PURE__ */ new Set();
   for (const pairList of pairsLists) {
@@ -25,3 +38,4 @@ const containsIdenticalPairs = (pairsLists) => {
 };
 exports.constructPairList = constructPairList;
 exports.containsIdenticalPairs = containsIdenticalPairs;
+exports.peelCheckboxPrefix = peelCheckboxPrefix;

package/dist/cjs/tasks/captchaManager.cjs

@@ -5,6 +5,7 @@ const types = require("@prosopo/types");
 const userAccessPolicy = require("@prosopo/user-access-policy");
 const blacklistRequestInspector = require("../api/blacklistRequestInspector.cjs");
 const compositeIpAddress = require("../compositeIpAddress.cjs");
+const enrichDnsEvent = require("./dnsEvent/enrichDnsEvent.cjs");
 const checkSpamEmail = require("./spam/checkSpamEmail.cjs");
 const checkTrafficFilter = require("./spam/checkTrafficFilter.cjs");
 var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
@@ -400,6 +401,8 @@ class CaptchaManager {
    * - If the dapp's server passed up the end user's current IP via the
    *   verify call, look that up fresh — it's the "now" IP for filtering
    *   and may differ from the IP that originally requested the captcha.
+   * - When the session carries a `dnsEvent`, its `peerIp` and `resolverIp`
+   *   are enriched and passed alongside the primary IP.
    * - `blockAbuser` defaults to true so abusive networks are always
    *   blocked even when the site hasn't configured a trafficFilter.
    * - Returns `{ isBlocked: false }` if every filter flag is off, without
@@ -409,14 +412,18 @@ class CaptchaManager {
    * updates record / session state differently); this helper just returns
    * the verdict.
    */
-  async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp) {
+  async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp, enrichedDnsEvent) {
     const effective = { blockAbuser: true, ...trafficFilter };
     const hasAny = Object.values(effective).some((v) => v);
     if (!hasAny) {
       return { isBlocked: false };
     }
     const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
-    return checkTrafficFilter.checkTrafficFilter(ipInfo, effective);
+    return checkTrafficFilter.checkTrafficFilter(
+      ipInfo,
+      effective,
+      enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent)
+    );
   }
   static canClientSeeScore(tier, score) {
     return score && tier && tier !== types.Tier.Free;