@prosopo/provider 5.12.3 → 5.13.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/provider@5.12.3 build:cjs
+> @prosopo/provider@5.13.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -32,6 +32,7 @@ ViteCommonJSConfig: .
 {
   externals: [
     '@prosopo/api-route',
+The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
     '@prosopo/logger',
     '@prosopo/util',
     '@prosopo/api-express-router',
@@ -55,7 +56,6 @@ ViteCommonJSConfig: .
     '@prosopo/web-bot-auth'
   ]
 }
-The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
@@ -104,7 +104,6 @@ dist/cjs/tasks/puzzle/backgroundBuffer.cjs                                     1
 dist/cjs/utils/clientMetaData.cjs                                              1.48 kB │ gzip: 0.72 kB
 dist/cjs/tasks/detection/assignSecret.cjs                                      1.48 kB │ gzip: 0.75 kB
 dist/cjs/api/assetDocument.cjs                                                 1.50 kB │ gzip: 0.81 kB
-dist/cjs/compositeIpAddress.cjs                                                1.55 kB │ gzip: 0.57 kB
 dist/cjs/api/admin/apiGetAllDecisionMachinesEndpoint.cjs                       1.59 kB │ gzip: 0.60 kB
 dist/cjs/schedulers/updateSpamEmailDomains.cjs                                 1.64 kB │ gzip: 0.62 kB
 dist/cjs/utils/honeypot/encoders.cjs                                           1.66 kB │ gzip: 0.67 kB
@@ -137,6 +136,7 @@ dist/cjs/api/public.cjs                                                        2
 dist/cjs/api/captcha/maintenanceModeResponses.cjs                              2.91 kB │ gzip: 0.77 kB
 dist/cjs/api/captcha/submitImageCaptchaSolution.cjs                            2.93 kB │ gzip: 1.03 kB
 dist/cjs/tasks/detection/getBotScore.cjs                                       3.37 kB │ gzip: 1.33 kB
+dist/cjs/compositeIpAddress.cjs                                                3.39 kB │ gzip: 1.36 kB
 dist/cjs/api/captcha/assetSealFormat.cjs                                       3.59 kB │ gzip: 1.37 kB
 dist/cjs/api/captcha/assignDetectorBundle.cjs                                  3.63 kB │ gzip: 1.37 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs          3.66 kB │ gzip: 1.35 kB
@@ -153,7 +153,7 @@ dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4
 dist/cjs/api/captcha.cjs                                                       4.51 kB │ gzip: 1.40 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs          4.56 kB │ gzip: 1.07 kB
 dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs                                     4.84 kB │ gzip: 1.74 kB
-dist/cjs/index.cjs                                                             4.95 kB │ gzip: 1.03 kB
+dist/cjs/index.cjs                                                             5.02 kB │ gzip: 1.05 kB
 dist/cjs/tasks/tasks.cjs                                                       5.07 kB │ gzip: 1.57 kB
 dist/cjs/tasks/detection/decoderPool.cjs                                       5.47 kB │ gzip: 2.06 kB
 dist/cjs/util/usageCounters.cjs                                                5.72 kB │ gzip: 2.03 kB
@@ -174,12 +174,12 @@ dist/cjs/api/blacklistRequestInspector.cjs                                    13
 dist/cjs/api/verify.cjs                                                       16.79 kB │ gzip: 2.93 kB
 dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             18.37 kB │ gzip: 4.89 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              20.05 kB │ gzip: 4.59 kB
-dist/cjs/tasks/captchaManager.cjs                                             23.94 kB │ gzip: 7.10 kB
 dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.12 kB │ gzip: 5.17 kB
-dist/cjs/tasks/powCaptcha/powTasks.cjs                                        24.99 kB │ gzip: 6.02 kB
+dist/cjs/tasks/captchaManager.cjs                                             24.62 kB │ gzip: 7.42 kB
+dist/cjs/tasks/powCaptcha/powTasks.cjs                                        25.55 kB │ gzip: 6.16 kB
 dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 27.94 kB │ gzip: 6.36 kB
 
-✓ built in 147ms
+✓ built in 191ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/provider@5.12.3 build:tsc
+> @prosopo/provider@5.13.0 build:tsc
 > tsc --build --verbose
 
-10:41:07 PM - Projects in this build: 
+9:06:33 AM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -28,53 +28,53 @@
     * ../web-bot-auth/tsconfig.json
     * tsconfig.json
 
-10:41:07 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/tests/loggerBrowser.unit.test.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/process.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/objectUtils.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/error.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/index.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/types.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/redisClient.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/index.ts' is older than output '../env/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/middlewares/requestLoggerMiddleware.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/tests/unit/testDoubles.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/captcha.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
+9:06:33 AM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+9:06:33 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-10:41:07 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+9:06:33 AM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/provider@5.12.3 build
+> @prosopo/provider@5.13.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/provider@5.12.3 build:cross-env
+> @prosopo/provider@5.13.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -106,7 +106,6 @@ dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 k
 dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip: 0.51 kB
 dist/tasks/dataset/datasetTasksUtils.js                                   1.30 kB │ gzip: 0.48 kB
 dist/api/assetDocument.js                                                 1.36 kB │ gzip: 0.75 kB
-dist/compositeIpAddress.js                                                1.36 kB │ gzip: 0.55 kB
 dist/tasks/detection/assignSecret.js                                      1.42 kB │ gzip: 0.74 kB
 dist/utils/clientMetaData.js                                              1.42 kB │ gzip: 0.72 kB
 dist/api/admin/apiGetAllDecisionMachinesEndpoint.js                       1.48 kB │ gzip: 0.57 kB
@@ -141,7 +140,8 @@ dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.55 k
 dist/api/forwardVerify.js                                                 2.59 kB │ gzip: 1.10 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            2.59 kB │ gzip: 1.00 kB
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip: 0.55 kB
-dist/index.js                                                             2.92 kB │ gzip: 0.80 kB
+dist/index.js                                                             2.95 kB │ gzip: 0.81 kB
+dist/compositeIpAddress.js                                                3.15 kB │ gzip: 1.34 kB
 dist/tasks/detection/getBotScore.js                                       3.29 kB │ gzip: 1.32 kB
 dist/api/captcha/assetSealFormat.js                                       3.38 kB │ gzip: 1.34 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.39 kB │ gzip: 1.32 kB
@@ -179,11 +179,11 @@ dist/api/verify.js                                                       15.12 k
 dist/tasks/frictionless/frictionlessTasks.js                             17.80 kB │ gzip: 4.86 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              18.54 kB │ gzip: 4.48 kB
 dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.71 kB │ gzip: 5.12 kB
-dist/tasks/captchaManager.js                                             23.44 kB │ gzip: 7.03 kB
-dist/tasks/powCaptcha/powTasks.js                                        23.61 kB │ gzip: 5.97 kB
+dist/tasks/captchaManager.js                                             24.12 kB │ gzip: 7.34 kB
+dist/tasks/powCaptcha/powTasks.js                                        24.13 kB │ gzip: 6.12 kB
 dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.42 kB │ gzip: 6.30 kB
 
-✓ built in 150ms
+✓ built in 484ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # @prosopo/provider
 
+## 5.13.0
+### Minor Changes
+
+- 85a1bb9: Seal captcha image paths into opaque URLs, opened by a CDN edge script.
+  
+  An image URL used to say which image it was: `https://cdn.example.net/dataset/images/abc.webp`. Signed URLs already stop a harvested URL being refetched forever, but the path stays in plain sight, and the path is a stable identifier for the image behind it — which makes it a usable key for caching answers between sessions.
+  
+  The path is now AES-256-GCM sealed, with an expiry, into an opaque blob drawn fresh every time:
+  
+  ```
+  https://cdn.example.net/s/AgHk1n...Qx9.webp
+  ```
+  
+  The edge script opens it, puts the canonical path back on the request, and the CDN serves the one object that path names. The same image therefore has a different URL in every session, with nothing in the URL to group those together, and there is still only one cached copy and one stored object.
+  
+  Sealing happens strictly below `item.data`. The item hash, the captchaId and the datasetId are untouched, so nothing about the dataset or how a solution is verified changes.
+  
+  The provider seals with `node:crypto`, because `AssetsResolver.resolveAsset` is synchronous and every WebCrypto call returns a promise; the edge opens with WebCrypto, because that is what its runtime has. The wire format, the validation and the base64url alphabet live in one module both ends import, and a test seals with one end and opens with the other so the two cannot drift.
+  
+  Inert unless its key is configured, since a sealed URL is unservable until the matching edge script is live. Configured, it takes precedence over the signed resolver; leaving the signing key in place keeps that as the fallback for any zone not yet moved over. More than one key opens at a time, so keys can be rotated without a flag day. `npm run -w @prosopo/provider build:edge` emits the edge script as a single file. Rollout order, environment variables and rotation are documented for operators outside this repository.
+  
+  Test coverage: 51 unit tests over the wire format, the sealer, the resolver and the edge handler — round trip, tamper, truncation, expiry at the boundary, swapped key id, rotation across two live keys, path traversal and prefix confinement, URL shape and per-call uniqueness, passthrough of requests that are not sealed, idempotency when the handler runs at both hooks, and the provider-seals/edge-opens interop.
+
+### Patch Changes
+
+- 4c9b84b: Escalate a PoW solve to an image captcha when it arrives from a different address than the challenge.
+  
+  A PoW challenge is bound to the user account and the site key and to nothing about where the request came from, so a solved challenge can be carried to any host that wants a free pass. The issuing address is already on the record, so binding to it costs nothing: `verifyPowCaptchaSolution` now compares it against the address submitting the solve and escalates when they differ, under a new `IP_CHANGED` reason.
+  
+  Escalation, not denial. A phone handing off between towers mid-solve is a real user and should pay a picture rather than be turned away. For the same reason IPv6 is judged on the /64 alone — the interface identifier in the low 64 bits rotates by design under RFC 8981, several times a day on one unchanged connection — and an address we could not read counts as unchanged.
+  
+  Only applies where a session is linked, since escalation carries the originating session's risk profile forward. Missing coordinates still takes precedence as the reported reason when both fire.
+- 2cca36e: Report a bot score of zero to Pro and Enterprise instead of dropping the field.
+  
+  `canClientSeeScore` tested `score && tier && tier !== Tier.Free`. A session with nothing wrong with it scores 0, which is falsy, so `score` was omitted from the siteverify response for exactly those users: a paying customer got a score for every suspicious visitor and no score at all for their cleanest ones, which reads as "no score available" rather than "no risk".
+  
+  Invisible in production today because `Math.random() * 0.3` is added to every score, making an exact 0 all but impossible. Removing that noise — captcha-private#4433, where this was found — is what would have exposed it.
+  
+  The function also returned `number | boolean | undefined` from its `&&` chain; it now returns `boolean`.
+- Updated dependencies [4c9b84b]
+- Updated dependencies [f13bea8]
+  - @prosopo/types@5.10.1
+  - @prosopo/load-balancer@2.11.0
+  - @prosopo/api@4.3.4
+  - @prosopo/api-express-router@3.1.94
+  - @prosopo/database@4.0.40
+  - @prosopo/datasets@3.1.90
+  - @prosopo/env@3.6.63
+  - @prosopo/ipinfo@0.4.9
+  - @prosopo/keyring@2.9.96
+  - @prosopo/types-database@5.6.4
+  - @prosopo/types-env@2.11.9
+  - @prosopo/user-access-policy@3.14.10
+
 ## 5.12.3
 ### Patch Changes
 

package/dist/cjs/compositeIpAddress.cjs

@@ -38,9 +38,53 @@ var getIpAddressFromComposite = (compositeIpAddress) => {
 	}
 };
 var getBigInt = (number) => BigInt(number || 0n);
+/**
+* Mongo hands these back as Decimal128 rather than the `number | bigint` the
+* type promises, and `BigInt(Decimal128)` throws. Route through the string
+* form, and report a value we cannot read as absent rather than throwing.
+*/
+var readPart = (value) => {
+	if (value === void 0 || value === null) return void 0;
+	try {
+		return BigInt(value.toString());
+	} catch {
+		return;
+	}
+};
+/**
+* The value `getCompositeIpAddress` returns when it could not read an
+* address at all. 0.0.0.0 is not a client address, so nothing legitimate is
+* being swallowed by treating it as "we don't know".
+*/
+var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPart(ip.lower) === 0n;
+/**
+* Do two observations of a client come from the same place on the network?
+*
+* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
+* interface identifier in the low 64 bits is designed to rotate (RFC 8981
+* privacy extensions), often several times a day on one unchanged connection,
+* so comparing it would call an ordinary phone a different host.
+*
+* A value we do not actually have counts as the same — one that will not
+* parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
+* address it could not read. This answer gates extra friction for a real
+* user, and a gap in what we recorded is not evidence against them.
+*/
+var isSameIpOrigin = (a, b) => {
+	if (isUnknownIp(a) || isUnknownIp(b)) return true;
+	if (a.type !== b.type) return false;
+	const compare = (left, right) => {
+		const leftPart = readPart(left);
+		const rightPart = readPart(right);
+		if (leftPart === void 0 || rightPart === void 0) return true;
+		return leftPart === rightPart;
+	};
+	return a.type === _prosopo_types.IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+};
 var never = () => {
 	throw new Error("Unhandled type");
 };
 //#endregion
 exports.getCompositeIpAddress = getCompositeIpAddress;
 exports.getIpAddressFromComposite = getIpAddressFromComposite;
+exports.isSameIpOrigin = isSameIpOrigin;

package/dist/cjs/index.cjs

@@ -50,6 +50,7 @@ exports.getVerdictCache = require_blacklistRequestInspector.getVerdictCache;
 exports.handshakeTimingMiddleware = require_handshakeTimingMiddleware.handshakeTimingMiddleware;
 exports.headerCheckMiddleware = require_headerCheckMiddleware.headerCheckMiddleware;
 exports.ignoreMiddleware = require_ignoreMiddleware.ignoreMiddleware;
+exports.isSameIpOrigin = require_compositeIpAddress.isSameIpOrigin;
 exports.isTlsAvailable = require_startProviderApi.isTlsAvailable;
 exports.ja4Middleware = require_ja4Middleware.ja4Middleware;
 exports.migrateFrictionlessLadder = require_frictionlessLadder.migrateFrictionlessLadder;

package/dist/cjs/tasks/captchaManager.cjs

@@ -564,8 +564,22 @@ var CaptchaManager = class CaptchaManager {
 		const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
 		return require_checkTrafficFilter.checkTrafficFilter(ipInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}
+	/**
+	* Does this client's tier entitle it to the bot score, and is there one?
+	*
+	* `score !== undefined`, not `score`: a session with nothing wrong with it
+	* scores 0, and a truthiness test dropped the field for exactly those
+	* users — a paying customer reading `score` got a present field for
+	* every suspicious visitor and a missing one for their cleanest. It has
+	* been invisible because `Math.random() * 0.3` makes an exact 0 all but
+	* impossible; taking that noise out (see captcha-private#4433) is what
+	* would expose it.
+	*
+	* Returning `boolean` rather than the old `number | boolean | undefined`,
+	* which came from `&&`-chaining the score and the tier.
+	*/
 	static canClientSeeScore(tier, score) {
-		return score && tier && tier !== _prosopo_types.Tier.Free;
+		return score !== void 0 && tier !== _prosopo_types.Tier.Free;
 	}
 };
 //#endregion

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -190,14 +190,24 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		await Promise.all(writePromises);
 		if (!correct) return { verified: correct };
 		const escalateForMissingCoords = !coords && Boolean(challengeRecord.sessionId);
+		const solveIp = require_compositeIpAddress.getCompositeIpAddress(ipAddress);
+		const escalateForIpChange = Boolean(challengeRecord.sessionId) && !require_compositeIpAddress.isSameIpOrigin(challengeRecord.ipAddress, solveIp);
+		if (escalateForIpChange) this.logger.info(() => ({
+			msg: "PoW solve arrived from a different address than the challenge",
+			data: {
+				challenge,
+				issuedType: challengeRecord.ipAddress.type,
+				solvedType: solveIp.type
+			}
+		}));
 		let routingOutput = this.postPowContext ? await this.runPostPowRouting({
 			challengeRecord,
 			challengeSplit,
 			behavioralDataPacked: decryptedBehavioralDataPacked
 		}) : void 0;
-		if (escalateForMissingCoords && routingOutput?.captchaType !== _prosopo_types.CaptchaType.image && routingOutput?.captchaType !== _prosopo_types.CaptchaType.puzzle) routingOutput = {
+		if ((escalateForMissingCoords || escalateForIpChange) && routingOutput?.captchaType !== _prosopo_types.CaptchaType.image && routingOutput?.captchaType !== _prosopo_types.CaptchaType.puzzle) routingOutput = {
 			captchaType: _prosopo_types.CaptchaType.image,
-			reason: _prosopo_types.FrictionlessReason.MISSING_COORDINATES
+			reason: escalateForMissingCoords ? _prosopo_types.FrictionlessReason.MISSING_COORDINATES : _prosopo_types.FrictionlessReason.IP_CHANGED
 		};
 		return {
 			verified: correct,

package/dist/compositeIpAddress.d.ts

@@ -2,4 +2,5 @@ import type { IPAddress } from "@prosopo/types";
 import { type CompositeIpAddress } from "@prosopo/types";
 export declare const getCompositeIpAddress: (ip: string | IPAddress) => CompositeIpAddress;
 export declare const getIpAddressFromComposite: (compositeIpAddress: CompositeIpAddress) => IPAddress;
+export declare const isSameIpOrigin: (a: CompositeIpAddress, b: CompositeIpAddress) => boolean;
 //# sourceMappingURL=compositeIpAddress.d.ts.map

package/dist/compositeIpAddress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compositeIpAddress.d.ts","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAiB,MAAM,gBAAgB,CAAC;AAOxE,eAAO,MAAM,qBAAqB,OAC7B,MAAM,GAAG,SAAS,KACpB,kBAaF,CAAC;AAuBF,eAAO,MAAM,yBAAyB,uBACjB,kBAAkB,KACpC,SAaF,CAAC"}
+{"version":3,"file":"compositeIpAddress.d.ts","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAiB,MAAM,gBAAgB,CAAC;AAOxE,eAAO,MAAM,qBAAqB,OAC7B,MAAM,GAAG,SAAS,KACpB,kBAaF,CAAC;AAuBF,eAAO,MAAM,yBAAyB,uBACjB,kBAAkB,KACpC,SAaF,CAAC;AAuCF,eAAO,MAAM,cAAc,MACvB,kBAAkB,KAClB,kBAAkB,KACnB,OAiBF,CAAC"}

package/dist/compositeIpAddress.js

@@ -38,8 +38,51 @@ var getIpAddressFromComposite = (compositeIpAddress) => {
 	}
 };
 var getBigInt = (number) => BigInt(number || 0n);
+/**
+* Mongo hands these back as Decimal128 rather than the `number | bigint` the
+* type promises, and `BigInt(Decimal128)` throws. Route through the string
+* form, and report a value we cannot read as absent rather than throwing.
+*/
+var readPart = (value) => {
+	if (value === void 0 || value === null) return void 0;
+	try {
+		return BigInt(value.toString());
+	} catch {
+		return;
+	}
+};
+/**
+* The value `getCompositeIpAddress` returns when it could not read an
+* address at all. 0.0.0.0 is not a client address, so nothing legitimate is
+* being swallowed by treating it as "we don't know".
+*/
+var isUnknownIp = (ip) => ip.type === IpAddressType.v4 && readPart(ip.lower) === 0n;
+/**
+* Do two observations of a client come from the same place on the network?
+*
+* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
+* interface identifier in the low 64 bits is designed to rotate (RFC 8981
+* privacy extensions), often several times a day on one unchanged connection,
+* so comparing it would call an ordinary phone a different host.
+*
+* A value we do not actually have counts as the same — one that will not
+* parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
+* address it could not read. This answer gates extra friction for a real
+* user, and a gap in what we recorded is not evidence against them.
+*/
+var isSameIpOrigin = (a, b) => {
+	if (isUnknownIp(a) || isUnknownIp(b)) return true;
+	if (a.type !== b.type) return false;
+	const compare = (left, right) => {
+		const leftPart = readPart(left);
+		const rightPart = readPart(right);
+		if (leftPart === void 0 || rightPart === void 0) return true;
+		return leftPart === rightPart;
+	};
+	return a.type === IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+};
 var never = () => {
 	throw new Error("Unhandled type");
 };
 //#endregion
-export { getCompositeIpAddress, getIpAddressFromComposite };
+export { getCompositeIpAddress, getIpAddressFromComposite, isSameIpOrigin };

package/dist/compositeIpAddress.js.map

@@ -1 +1 @@
-{"version":3,"file":"compositeIpAddress.js","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAeA,OAAO,EAA2B,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACpC,EAAsB,EACD,EAAE;IACvB,IAAI,SAAoB,CAAC;IAEzB,IAAI,CAAC;QACJ,SAAS,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO;YACN,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,aAAa,CAAC,EAAE;SACtB,CAAC;IACH,CAAC;IAED,OAAO,yBAAyB,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CACjC,SAAoB,EACC,EAAE;IACvB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;IAErC,IAAI,SAAS,YAAY,QAAQ,EAAE,CAAC;QACnC,OAAO;YACN,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,aAAa,CAAC,EAAE;SACtB,CAAC;IACH,CAAC;IAED,SAA4B,CAAC;IAE7B,OAAO;QACN,KAAK,EAAE,SAAS,GAAG,aAAa;QAChC,KAAK,EAAE,SAAS,IAAI,QAAQ;QAC5B,IAAI,EAAE,aAAa,CAAC,EAAE;KACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACxC,kBAAsC,EAC1B,EAAE;IACd,QAAQ,kBAAkB,CAAC,IAAI,EAAE,CAAC;QACjC,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,QAAQ,CAAC,UAAU,CACzB,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;gBAChD,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CACtD,CAAC;QACH;YACC,KAAK,EAAE,CAAC;YACR,OAAO,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,MAAmC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAEhF,MAAM,KAAK,GAAG,GAAU,EAAE;IACzB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC,CAAC"}
+{"version":3,"file":"compositeIpAddress.js","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAeA,OAAO,EAA2B,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACpC,EAAsB,EACD,EAAE;IACvB,IAAI,SAAoB,CAAC;IAEzB,IAAI,CAAC;QACJ,SAAS,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO;YACN,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,aAAa,CAAC,EAAE;SACtB,CAAC;IACH,CAAC;IAED,OAAO,yBAAyB,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CACjC,SAAoB,EACC,EAAE;IACvB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;IAErC,IAAI,SAAS,YAAY,QAAQ,EAAE,CAAC;QACnC,OAAO;YACN,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,aAAa,CAAC,EAAE;SACtB,CAAC;IACH,CAAC;IAED,SAA4B,CAAC;IAE7B,OAAO;QACN,KAAK,EAAE,SAAS,GAAG,aAAa;QAChC,KAAK,EAAE,SAAS,IAAI,QAAQ;QAC5B,IAAI,EAAE,aAAa,CAAC,EAAE;KACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACxC,kBAAsC,EAC1B,EAAE;IACd,QAAQ,kBAAkB,CAAC,IAAI,EAAE,CAAC;QACjC,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,QAAQ,CAAC,UAAU,CACzB,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;gBAChD,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CACtD,CAAC;QACH;YACC,KAAK,EAAE,CAAC;YACR,OAAO,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,MAAmC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAOhF,MAAM,QAAQ,GAAG,CAAC,KAAkC,EAAsB,EAAE;IAC3E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,CAAC;QACJ,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAOF,MAAM,WAAW,GAAG,CAAC,EAAsB,EAAW,EAAE,CACvD,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;AAe3D,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,CAAqB,EACrB,CAAqB,EACX,EAAE;IACZ,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,OAAO,GAAG,CACf,IAAiC,EACjC,KAAkC,EACxB,EAAE;QACZ,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,QAAQ,KAAK,SAAS,CAAC;IAC/B,CAAC,CAAC;IAEF,OAAO,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE;QACjC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,GAAU,EAAE;IACzB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import "./_virtual/_rolldown/runtime.js";
-import { getCompositeIpAddress, getIpAddressFromComposite } from "./compositeIpAddress.js";
+import { getCompositeIpAddress, getIpAddressFromComposite, isSameIpOrigin } from "./compositeIpAddress.js";
 import { BlacklistRequestInspector, getPrioritisedAccessRule, getRequestUserScope, getVerdictCache, normalizeHeadersForMatching, rankCandidateRules } from "./api/blacklistRequestInspector.js";
 import { FrictionlessReason } from "./tasks/frictionless/frictionlessTasks.js";
 import { compareIPs } from "./services/ipComparison.js";
@@ -22,4 +22,4 @@ import { migrateFrictionlessLadder, runFrictionlessLadderMigration } from "./mig
 import { storeCaptchasExternally } from "./schedulers/captchaScheduler.js";
 import { getClientList } from "./schedulers/getClientList.js";
 import { updateSpamEmailDomainsScheduler } from "./schedulers/updateSpamEmailDomains.js";
-export { BlacklistRequestInspector, DEFAULT_JA4, FrictionlessReason, Tasks, asyncHandler, blockMiddleware, checkIfTaskIsRunning, compareIPs, createApiAdminRoutesProvider, deepValidateIpAddress, domainMiddleware, encodeStringAddress, evaluateIpValidationRules, getClientApiPathsExpectingProsopoHeaders, getClientList, getCompositeIpAddress, getHandshakeTiming, getIPAddress, getIPAddressFromBigInt, getIpAddressFromComposite, getJA4, getPrioritisedAccessRule, getRequestUserScope, getUserFromJWT, getVerdictCache, handshakeTimingMiddleware, headerCheckMiddleware, ignoreMiddleware, isTlsAvailable, ja4Middleware, migrateFrictionlessLadder, normalizeHeadersForMatching, prosopoRouter, prosopoVerifyRouter, publicRouter, rankCandidateRules, robotsMiddleware, runFrictionlessLadderMigration, shuffleArray, startProviderApi, storeCaptchasExternally, updateSpamEmailDomains, updateSpamEmailDomainsScheduler, validateIpAddress };
+export { BlacklistRequestInspector, DEFAULT_JA4, FrictionlessReason, Tasks, asyncHandler, blockMiddleware, checkIfTaskIsRunning, compareIPs, createApiAdminRoutesProvider, deepValidateIpAddress, domainMiddleware, encodeStringAddress, evaluateIpValidationRules, getClientApiPathsExpectingProsopoHeaders, getClientList, getCompositeIpAddress, getHandshakeTiming, getIPAddress, getIPAddressFromBigInt, getIpAddressFromComposite, getJA4, getPrioritisedAccessRule, getRequestUserScope, getUserFromJWT, getVerdictCache, handshakeTimingMiddleware, headerCheckMiddleware, ignoreMiddleware, isSameIpOrigin, isTlsAvailable, ja4Middleware, migrateFrictionlessLadder, normalizeHeadersForMatching, prosopoRouter, prosopoVerifyRouter, publicRouter, rankCandidateRules, robotsMiddleware, runFrictionlessLadderMigration, shuffleArray, startProviderApi, storeCaptchasExternally, updateSpamEmailDomains, updateSpamEmailDomainsScheduler, validateIpAddress };

package/dist/tasks/captchaManager.d.ts

@@ -71,6 +71,6 @@ export declare class CaptchaManager {
     checkForHardBlock(userAccessRulesStorage: AccessRulesStorage, challengeRecord: PoWCaptchaRecord | PuzzleCaptchaRecord | UserCommitment, userAccount: string, headers: RequestHeaders, coords?: [number, number][][], countryCode?: string, asn?: number): Promise<AccessRule | undefined>;
     checkSpamEmail(email: string): Promise<boolean>;
     resolveTrafficFilterCheck(env: ProviderEnvironment, recordIpInfo: IPInfoResponse | undefined, trafficFilter: Partial<ITrafficFilter> | undefined, currentIp?: string, enrichedDnsEvent?: EnrichedDnsEvent): Promise<TrafficCheckResult>;
-    static canClientSeeScore(tier: Tier, score?: number): boolean | 0 | undefined;
+    static canClientSeeScore(tier: Tier, score?: number): boolean;
 }
 //# sourceMappingURL=captchaManager.d.ts.map

package/dist/tasks/captchaManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EAEJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAQrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IAMpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAkCD,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAmD3B,wBAAwB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC;QACV,WAAW,CAAC,EAAE,oBAAoB,CAAC;QACnC,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KAC5C,CAAC;IA+DW,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAmSF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;;;;;;;IAoBb,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EAGtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAGpB,eAAe,CAAC,EAAE,OAAO,CAAC;QAK1B,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAgBF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAsBpE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IA6BlE,OAAO,CAAC,2BAA2B;IAgB7B,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GAIV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA0D5B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IA8B9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM;CAGnD"}
+{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EAEJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAQrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IAMpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAkCD,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAmD3B,wBAAwB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC;QACV,WAAW,CAAC,EAAE,oBAAoB,CAAC;QACnC,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KAC5C,CAAC;IA+DW,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAmSF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;;;;;;;IAoBb,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EAGtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAGpB,eAAe,CAAC,EAAE,OAAO,CAAC;QAK1B,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAgBF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAsBpE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IA6BlE,OAAO,CAAC,2BAA2B;IAgB7B,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GAIV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA0D5B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IA4C9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;CAG7D"}

package/dist/tasks/captchaManager.js

@@ -563,8 +563,22 @@ var CaptchaManager = class CaptchaManager {
 		};
 		return checkTrafficFilter(currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo, effective, extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}
+	/**
+	* Does this client's tier entitle it to the bot score, and is there one?
+	*
+	* `score !== undefined`, not `score`: a session with nothing wrong with it
+	* scores 0, and a truthiness test dropped the field for exactly those
+	* users — a paying customer reading `score` got a present field for
+	* every suspicious visitor and a missing one for their cleanest. It has
+	* been invisible because `Math.random() * 0.3` makes an exact 0 all but
+	* impossible; taking that noise out (see captcha-private#4433) is what
+	* would expose it.
+	*
+	* Returning `boolean` rather than the old `number | boolean | undefined`,
+	* which came from `&&`-chaining the score and the tier.
+	*/
 	static canClientSeeScore(tier, score) {
-		return score && tier && tier !== Tier.Free;
+		return score !== void 0 && tier !== Tier.Free;
 	}
 };
 //#endregion