@prosopo/provider 5.10.2 → 5.10.3

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/provider@5.10.2 build:cjs
+> @prosopo/provider@5.10.3 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -123,11 +123,11 @@ dist/cjs/tasks/puzzle/stratifiedSampler.cjs                                    2
 dist/cjs/tasks/frictionless/frictionlessTasksUtils.cjs                         2.21 kB │ gzip:  1.10 kB
 dist/cjs/tasks/captchaTypeSelection.cjs                                        2.44 kB │ gzip:  1.04 kB
 dist/cjs/api/admin/apiDnsEventEndpoint.cjs                                     2.59 kB │ gzip:  1.00 kB
-dist/cjs/tasks/detection/getBotScore.cjs                                       2.63 kB │ gzip:  0.96 kB
 dist/cjs/utils/dns.cjs                                                         2.66 kB │ gzip:  1.02 kB
 dist/cjs/api/forwardVerify.cjs                                                 2.66 kB │ gzip:  1.12 kB
 dist/cjs/tasks/puzzle/puzzleDifficulty.cjs                                     2.66 kB │ gzip:  1.10 kB
 dist/cjs/api/public.cjs                                                        2.67 kB │ gzip:  1.05 kB
+dist/cjs/tasks/detection/getBotScore.cjs                                       2.67 kB │ gzip:  0.97 kB
 dist/cjs/api/captcha/checkSpamEmail.cjs                                        2.73 kB │ gzip:  0.95 kB
 dist/cjs/api/captcha/submitPuzzleCaptchaSolution.cjs                           2.77 kB │ gzip:  0.99 kB
 dist/cjs/api/captcha/assignDetectorBundle.cjs                                  2.90 kB │ gzip:  1.15 kB
@@ -155,26 +155,26 @@ dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              7
 dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     7.47 kB │ gzip:  2.48 kB
 dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             7.56 kB │ gzip:  2.03 kB
 dist/cjs/api/metrics.cjs                                                       7.96 kB │ gzip:  2.23 kB
-dist/cjs/tasks/detection/bundlePool.cjs                                        8.89 kB │ gzip:  3.29 kB
+dist/cjs/tasks/detection/bundlePool.cjs                                        9.12 kB │ gzip:  3.34 kB
 dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              9.54 kB │ gzip:  2.81 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs      10.33 kB │ gzip:  1.82 kB
 dist/cjs/api/startProviderApi.cjs                                             11.62 kB │ gzip:  3.70 kB
 dist/cjs/tasks/client/clientTasks.cjs                                         11.73 kB │ gzip:  3.04 kB
-dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs                      12.32 kB │ gzip:  3.81 kB
+dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs                      12.57 kB │ gzip:  3.87 kB
 dist/cjs/api/blacklistRequestInspector.cjs                                    13.10 kB │ gzip:  4.41 kB
 dist/cjs/util.cjs                                                             13.15 kB │ gzip:  3.26 kB
 dist/cjs/api/verify.cjs                                                       16.79 kB │ gzip:  2.93 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              20.65 kB │ gzip:  4.74 kB
-dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             20.69 kB │ gzip:  5.49 kB
-dist/cjs/tasks/captchaManager.cjs                                             23.52 kB │ gzip:  6.78 kB
+dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             20.75 kB │ gzip:  5.51 kB
+dist/cjs/tasks/captchaManager.cjs                                             23.59 kB │ gzip:  6.81 kB
 dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.03 kB │ gzip:  5.15 kB
 dist/cjs/tasks/powCaptcha/powTasks.cjs                                        24.84 kB │ gzip:  5.97 kB
 dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 27.96 kB │ gzip:  6.37 kB
 dist/cjs/tasks/detection/decodeBehavior.cjs                                   32.24 kB │ gzip: 10.32 kB
 dist/cjs/tasks/detection/decodeSimd.cjs                                       36.03 kB │ gzip: 11.96 kB
-dist/cjs/tasks/detection/decodePayload.cjs                                    53.96 kB │ gzip: 18.08 kB
+dist/cjs/tasks/detection/decodePayload.cjs                                    54.63 kB │ gzip: 19.30 kB
 
-✓ built in 173ms
+✓ built in 180ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/provider@5.10.2 build:tsc
+> @prosopo/provider@5.10.3 build:tsc
 > tsc --build --verbose
 
-5:39:46 AM - Projects in this build: 
+1:05:09 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -28,53 +28,53 @@
     * ../web-bot-auth/tsconfig.json
     * tsconfig.json
 
-5:39:46 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/tests/apiRoute.unit.test.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/batches.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/types.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-5:39:46 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/ruleRecord.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/tests/typesEnv.test-d.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/tests/env.maintenance.unit.test.ts' is older than output '../env/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/tests/env.maintenance.unit.test.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/mocks/data/captchas.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/productionProviderList.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/productionProviderList.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
+1:05:09 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
 
-5:39:47 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+1:05:09 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-5:39:47 AM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+1:05:09 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/provider@5.10.2 build
+> @prosopo/provider@5.10.3 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/provider@5.10.2 build:cross-env
+> @prosopo/provider@5.10.3 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -132,10 +132,10 @@ dist/utils/dns.js                                                         2.36 k
 dist/api/admin/apiDnsEventEndpoint.js                                     2.43 kB │ gzip:  0.96 kB
 dist/api/captcha/checkSpamEmail.js                                        2.47 kB │ gzip:  0.91 kB
 dist/tasks/puzzle/puzzleDifficulty.js                                     2.50 kB │ gzip:  1.09 kB
-dist/tasks/detection/getBotScore.js                                       2.55 kB │ gzip:  0.95 kB
 dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.55 kB │ gzip:  0.96 kB
 dist/api/forwardVerify.js                                                 2.59 kB │ gzip:  1.10 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            2.59 kB │ gzip:  1.00 kB
+dist/tasks/detection/getBotScore.js                                       2.59 kB │ gzip:  0.95 kB
 dist/api/captcha/assignDetectorBundle.js                                  2.69 kB │ gzip:  1.11 kB
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip:  0.55 kB
 dist/index.js                                                             2.92 kB │ gzip:  0.80 kB
@@ -159,26 +159,26 @@ dist/api/captcha/getPuzzleCaptchaChallenge.js                             6.84 k
 dist/api/healthzGeo.js                                                    6.86 kB │ gzip:  2.68 kB
 dist/tasks/spam/checkTrafficFilter.js                                     7.16 kB │ gzip:  2.45 kB
 dist/api/metrics.js                                                       7.36 kB │ gzip:  2.19 kB
-dist/tasks/detection/bundlePool.js                                        8.46 kB │ gzip:  3.25 kB
+dist/tasks/detection/bundlePool.js                                        8.69 kB │ gzip:  3.30 kB
 dist/api/captcha/submitPoWCaptchaSolution.js                              9.02 kB │ gzip:  2.76 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       9.36 kB │ gzip:  1.80 kB
 dist/api/startProviderApi.js                                              9.93 kB │ gzip:  3.42 kB
 dist/tasks/client/clientTasks.js                                         11.27 kB │ gzip:  3.00 kB
-dist/tasks/decisionMachine/decisionMachineRunner.js                      11.93 kB │ gzip:  3.75 kB
+dist/tasks/decisionMachine/decisionMachineRunner.js                      12.19 kB │ gzip:  3.81 kB
 dist/api/blacklistRequestInspector.js                                    12.46 kB │ gzip:  4.37 kB
 dist/util.js                                                             12.47 kB │ gzip:  3.20 kB
 dist/api/verify.js                                                       15.12 kB │ gzip:  2.82 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              19.13 kB │ gzip:  4.63 kB
-dist/tasks/frictionless/frictionlessTasks.js                             20.12 kB │ gzip:  5.46 kB
+dist/tasks/frictionless/frictionlessTasks.js                             20.18 kB │ gzip:  5.48 kB
 dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.62 kB │ gzip:  5.10 kB
-dist/tasks/captchaManager.js                                             23.01 kB │ gzip:  6.72 kB
+dist/tasks/captchaManager.js                                             23.08 kB │ gzip:  6.74 kB
 dist/tasks/powCaptcha/powTasks.js                                        23.47 kB │ gzip:  5.93 kB
 dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.44 kB │ gzip:  6.31 kB
 dist/tasks/detection/decodeBehavior.js                                   32.26 kB │ gzip: 10.34 kB
 dist/tasks/detection/decodeSimd.js                                       36.06 kB │ gzip: 12.00 kB
-dist/tasks/detection/decodePayload.js                                    53.87 kB │ gzip: 18.06 kB
+dist/tasks/detection/decodePayload.js                                    54.54 kB │ gzip: 19.29 kB
 
-✓ built in 170ms
+✓ built in 152ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @prosopo/provider
 
+## 5.10.3
+### Patch Changes
+
+- f4e4a83: chore(deps): roll up the open dependabot bumps (react 19.3, mongoose 9.10, @polkadot/util 14, redis 6, cron-parser 5, react-i18next 17 with i18next 26, @scure/base 2, cypress 16, rollup/babel plugin majors, vitest 4.1.11, angular 20.3.28, js-yaml)
+- c386199: Carry each detector bundle's `payloadLayout` from its pool entry through to the decoder.
+  
+  Pool bundles now ship an extra opaque per-bundle value alongside the private key and inner config, and the decoder needs it to read what that bundle's detector produced. The pool loader reads it from `{id}.json`, the persist and admin-push paths keep it, and the frictionless decrypt passes it to `decodePayload` along with the key.
+  
+  Bundles without one — pools built before this — behave exactly as before, so a provider can be updated ahead of its pool.
+  
+  Covered by pool tests that the value survives load, persist and reload, and by the existing decrypt tests.
+- 4d45e3d: Stop `DecisionMachineRunner` retaining every instance, and re-roll the frictionless widget onto another provider on an unrecognised error.
+  
+  `DecisionMachineRunner` enrolled itself in a module-level `Set` so an artifact upload could flush every runner's cache. That assumed runners were built once per process; they are built per request, and nothing pruned the set, so it grew for as long as the process lived and construction eventually began to fail. `WeakRef` did not bound it — the set held the wrapper, which outlives its referent. The registry is replaced by a generation counter: an invalidation bumps it, and a runner drops its cache when the value it carries no longer matches. Nothing holds a runner reference, so there is nothing to grow.
+  
+  The widget compounded it. The HTTP client does not throw on a 400 with a JSON body, so a provider-side failure came back looking like a normal result, and the frictionless guard turned it into a terminal error — no fallback, no retry, no restart timer. One unhealthy provider stranded the user on its first response even when every other node was healthy. Errors whose key we do not recognise are now thrown, which hands them to the existing provider re-roll. Integration faults (site key, origin, captcha type) and policy denials still display as before: another provider returns the same answer, and for those the message is the point. Errors with no key at all are unchanged, since hard blocks arrive in that shape. A site's error callback now also fires once retries are exhausted, which it previously did not.
+- Updated dependencies [f4e4a83]
+- Updated dependencies [c386199]
+- Updated dependencies [d710b7f]
+- Updated dependencies [d4e9425]
+- Updated dependencies [ae121df]
+- Updated dependencies [0be8838]
+  - @prosopo/api-express-router@3.1.88
+  - @prosopo/captcha-severity@1.1.1
+  - @prosopo/common@3.1.56
+  - @prosopo/database@4.0.34
+  - @prosopo/datasets@3.1.83
+  - @prosopo/keyring@2.9.90
+  - @prosopo/locale@3.4.3
+  - @prosopo/native-ja4@0.0.6
+  - @prosopo/native-merkle@0.0.6
+  - @prosopo/redis-client@1.0.36
+  - @prosopo/types-database@5.5.4
+  - @prosopo/types@5.8.4
+  - @prosopo/user-access-policy@3.14.4
+  - @prosopo/util-crypto@13.5.32
+  - @prosopo/web-bot-auth@0.1.1
+  - @prosopo/util@3.3.10
+  - @prosopo/api@4.2.4
+  - @prosopo/api-route@2.6.59
+  - @prosopo/env@3.6.57
+  - @prosopo/ipinfo@0.4.3
+  - @prosopo/load-balancer@2.10.45
+  - @prosopo/logger@2.0.10
+  - @prosopo/types-env@2.11.3
+
 ## 5.10.2
 ### Patch Changes
 

package/dist/cjs/tasks/captchaManager.cjs

@@ -345,7 +345,8 @@ var CaptchaManager = class CaptchaManager {
 		const bundle = bundleId ? require_bundlePool.getDetectorBundlePool()?.get(bundleId) : void 0;
 		return bundle ? {
 			key: bundle.privateKey,
-			innerConfig: bundle.innerConfig
+			innerConfig: bundle.innerConfig,
+			...bundle.payloadLayout && { payloadLayout: bundle.payloadLayout }
 		} : void 0;
 	}
 	/**

package/dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs

@@ -43,46 +43,49 @@ var ARTIFACT_CACHE_TTL_MS = Number.parseInt(process.env.DECISION_MACHINE_ARTIFAC
 var DEFAULT_DECISION = { decision: _prosopo_types.DecisionMachineDecision.Allow };
 var RequiredCountersSchema = zod.z.array(_prosopo_types.CounterSpecSchema);
 /**
-* WeakSet-style registry of every live runner. Populated in the constructor
-* and consulted by {@link invalidateAllDecisionMachineArtifactCaches} so an
-* artifact upload can flush every runner's in-memory artifact cache in one
-* call. Held as `WeakRef` so a runner that goes out of scope is garbage
-* collected — this map only ever grows in prod (runners are constructed
-* per task class at process start and live for the process's lifetime) so
-* a plain array would also work, but `WeakRef` is defensive.
+* Bumped by {@link invalidateAllDecisionMachineArtifactCaches}. A runner
+* caches the value it last saw and drops its artifact cache whenever the two
+* diverge, which flushes every runner — including ones built after the
+* invalidation — without holding a reference to any of them.
+*
+* This replaces a registry of live runners, which assumed runners were built
+* once per process. They are built per request, so the registry grew without
+* bound and construction eventually began to fail. `WeakRef` did not bound
+* it: the set held the wrapper, which outlives its referent.
 */
-var liveRunners = /* @__PURE__ */ new Set();
+var artifactCacheGeneration = 0;
 /**
 * Flush every runner's in-memory artifact cache. Companion to
 * {@link invalidateDecisionMachineScriptCache}. Call both after any
 * `upsertDecisionMachineArtifact` upload.
 */
 var invalidateAllDecisionMachineArtifactCaches = () => {
-	for (const ref of liveRunners) {
-		const runner = ref.deref();
-		if (runner === void 0) {
-			liveRunners.delete(ref);
-			continue;
-		}
-		runner.invalidateArtifactCache();
-	}
+	artifactCacheGeneration++;
 };
 var DecisionMachineRunner = class DecisionMachineRunner {
 	constructor(db) {
 		this.db = db;
 		this.artifactCache = /* @__PURE__ */ new Map();
-		liveRunners.add(new WeakRef(this));
+		this.seenArtifactCacheGeneration = artifactCacheGeneration;
 	}
 	/** Drop every entry in this runner's artifact cache. */
 	invalidateArtifactCache() {
 		this.artifactCache.clear();
 	}
+	/** Drop the cache if an invalidation happened since it was last consulted. */
+	dropArtifactCacheIfStale() {
+		if (this.seenArtifactCacheGeneration !== artifactCacheGeneration) {
+			this.seenArtifactCacheGeneration = artifactCacheGeneration;
+			this.artifactCache.clear();
+		}
+	}
 	/** Build a cache key for a given scope + kind + dappAccount tuple. */
 	static cacheKey(scope, kind, dappAccount) {
 		return `${scope}:${kind}:${dappAccount ?? ""}`;
 	}
 	/** Return a cached artifact if still fresh, or undefined. */
 	getCachedArtifact(scope, kind, dappAccount) {
+		this.dropArtifactCacheIfStale();
 		const entry = this.artifactCache.get(DecisionMachineRunner.cacheKey(scope, kind, dappAccount));
 		if (!entry) return null;
 		if (Date.now() - entry.cachedAt > ARTIFACT_CACHE_TTL_MS) {

package/dist/cjs/tasks/detection/bundlePool.cjs

@@ -7,8 +7,8 @@ let node_path = require("node:path");
 * Loads a pool of precomputed, obfuscated detector bundles from disk and caches
 * them in memory — the Node analogue of the Rust "bumblebee" `bundle_manager`.
 * Each bundle is a `{id}.js` (served to the browser) paired with a `{id}.json`
-* (`{ privateKey, innerConfig }`, kept server-side) produced by the catcher
-* `bundle:pool` build script.
+* (`{ privateKey, innerConfig, payloadLayout }`, kept server-side) produced by
+* the catcher `bundle:pool` build script.
 *
 * A bundle is assigned per detector session by {@link DetectorBundlePool.at},
 * served by id, and resolved again at decryption time so the provider uses the
@@ -67,11 +67,13 @@ var DetectorBundlePool = class {
 					continue;
 				}
 				if (expectedRelease && !release) unstamped++;
+				const payloadLayout = typeof secrets.payloadLayout === "string" ? secrets.payloadLayout : void 0;
 				next.set(bundleId, {
 					js,
 					privateKey: secrets.privateKey,
 					innerConfig: secrets.innerConfig,
-					...release && { release }
+					...release && { release },
+					...payloadLayout && { payloadLayout }
 				});
 			} catch (error) {
 				logger.warn?.("failed to load bundle pool entry", {
@@ -167,7 +169,8 @@ function persistDetectorBundlePool(bundles, dir = globalPoolDir) {
 		(0, node_fs.writeFileSync)(jsonTmp, JSON.stringify({
 			privateKey: bundle.privateKey,
 			innerConfig: bundle.innerConfig,
-			...bundle.release && { release: bundle.release }
+			...bundle.release && { release: bundle.release },
+			...bundle.payloadLayout && { payloadLayout: bundle.payloadLayout }
 		}), {
 			encoding: "utf8",
 			mode: 384