@prosopo/provider 5.12.3 → 5.13.1

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/provider@5.12.3 build:cjs
+> @prosopo/provider@5.13.1 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -104,7 +104,6 @@ dist/cjs/tasks/puzzle/backgroundBuffer.cjs                                     1
 dist/cjs/utils/clientMetaData.cjs                                              1.48 kB │ gzip: 0.72 kB
 dist/cjs/tasks/detection/assignSecret.cjs                                      1.48 kB │ gzip: 0.75 kB
 dist/cjs/api/assetDocument.cjs                                                 1.50 kB │ gzip: 0.81 kB
-dist/cjs/compositeIpAddress.cjs                                                1.55 kB │ gzip: 0.57 kB
 dist/cjs/api/admin/apiGetAllDecisionMachinesEndpoint.cjs                       1.59 kB │ gzip: 0.60 kB
 dist/cjs/schedulers/updateSpamEmailDomains.cjs                                 1.64 kB │ gzip: 0.62 kB
 dist/cjs/utils/honeypot/encoders.cjs                                           1.66 kB │ gzip: 0.67 kB
@@ -137,6 +136,7 @@ dist/cjs/api/public.cjs                                                        2
 dist/cjs/api/captcha/maintenanceModeResponses.cjs                              2.91 kB │ gzip: 0.77 kB
 dist/cjs/api/captcha/submitImageCaptchaSolution.cjs                            2.93 kB │ gzip: 1.03 kB
 dist/cjs/tasks/detection/getBotScore.cjs                                       3.37 kB │ gzip: 1.33 kB
+dist/cjs/compositeIpAddress.cjs                                                3.39 kB │ gzip: 1.36 kB
 dist/cjs/api/captcha/assetSealFormat.cjs                                       3.59 kB │ gzip: 1.37 kB
 dist/cjs/api/captcha/assignDetectorBundle.cjs                                  3.63 kB │ gzip: 1.37 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs          3.66 kB │ gzip: 1.35 kB
@@ -153,7 +153,7 @@ dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4
 dist/cjs/api/captcha.cjs                                                       4.51 kB │ gzip: 1.40 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs          4.56 kB │ gzip: 1.07 kB
 dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs                                     4.84 kB │ gzip: 1.74 kB
-dist/cjs/index.cjs                                                             4.95 kB │ gzip: 1.03 kB
+dist/cjs/index.cjs                                                             5.02 kB │ gzip: 1.05 kB
 dist/cjs/tasks/tasks.cjs                                                       5.07 kB │ gzip: 1.57 kB
 dist/cjs/tasks/detection/decoderPool.cjs                                       5.47 kB │ gzip: 2.06 kB
 dist/cjs/util/usageCounters.cjs                                                5.72 kB │ gzip: 2.03 kB
@@ -163,7 +163,7 @@ dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              7
 dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     7.47 kB │ gzip: 2.48 kB
 dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             7.56 kB │ gzip: 2.03 kB
 dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              9.12 kB │ gzip: 2.71 kB
-dist/cjs/tasks/detection/bundlePool.cjs                                        9.24 kB │ gzip: 3.37 kB
+dist/cjs/tasks/detection/bundlePool.cjs                                        9.29 kB │ gzip: 3.38 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs      10.33 kB │ gzip: 1.82 kB
 dist/cjs/api/startProviderApi.cjs                                             11.73 kB │ gzip: 3.72 kB
 dist/cjs/tasks/client/clientTasks.cjs                                         11.73 kB │ gzip: 3.04 kB
@@ -174,12 +174,12 @@ dist/cjs/api/blacklistRequestInspector.cjs                                    13
 dist/cjs/api/verify.cjs                                                       16.79 kB │ gzip: 2.93 kB
 dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             18.37 kB │ gzip: 4.89 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              20.05 kB │ gzip: 4.59 kB
-dist/cjs/tasks/captchaManager.cjs                                             23.94 kB │ gzip: 7.10 kB
-dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.12 kB │ gzip: 5.17 kB
-dist/cjs/tasks/powCaptcha/powTasks.cjs                                        24.99 kB │ gzip: 6.02 kB
-dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 27.94 kB │ gzip: 6.36 kB
+dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.30 kB │ gzip: 5.20 kB
+dist/cjs/tasks/captchaManager.cjs                                             24.67 kB │ gzip: 7.42 kB
+dist/cjs/tasks/powCaptcha/powTasks.cjs                                        25.74 kB │ gzip: 6.20 kB
+dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 28.13 kB │ gzip: 6.40 kB
 
-✓ built in 147ms
+✓ built in 195ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/provider@5.12.3 build:tsc
+> @prosopo/provider@5.13.1 build:tsc
 > tsc --build --verbose
 
-10:41:07 PM - Projects in this build: 
+3:37:46 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -28,53 +28,53 @@
     * ../web-bot-auth/tsconfig.json
     * tsconfig.json
 
-10:41:07 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/tests/loggerBrowser.unit.test.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/process.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/objectUtils.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/index.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/tests/testRedisConnection.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+3:37:46 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types.test-d.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/index.ts' is older than output '../env/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/tests/env.maintenance.unit.test.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/middlewares/requestLoggerMiddleware.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/tests/unit/testDoubles.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/captcha.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/captcha.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/developmentProviderUrl.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
+3:37:47 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
 
-10:41:07 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+3:37:47 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-10:41:07 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+3:37:47 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/provider@5.12.3 build
+> @prosopo/provider@5.13.1 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/provider@5.12.3 build:cross-env
+> @prosopo/provider@5.13.1 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -106,7 +106,6 @@ dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 k
 dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip: 0.51 kB
 dist/tasks/dataset/datasetTasksUtils.js                                   1.30 kB │ gzip: 0.48 kB
 dist/api/assetDocument.js                                                 1.36 kB │ gzip: 0.75 kB
-dist/compositeIpAddress.js                                                1.36 kB │ gzip: 0.55 kB
 dist/tasks/detection/assignSecret.js                                      1.42 kB │ gzip: 0.74 kB
 dist/utils/clientMetaData.js                                              1.42 kB │ gzip: 0.72 kB
 dist/api/admin/apiGetAllDecisionMachinesEndpoint.js                       1.48 kB │ gzip: 0.57 kB
@@ -141,7 +140,8 @@ dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.55 k
 dist/api/forwardVerify.js                                                 2.59 kB │ gzip: 1.10 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            2.59 kB │ gzip: 1.00 kB
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip: 0.55 kB
-dist/index.js                                                             2.92 kB │ gzip: 0.80 kB
+dist/index.js                                                             2.95 kB │ gzip: 0.81 kB
+dist/compositeIpAddress.js                                                3.15 kB │ gzip: 1.34 kB
 dist/tasks/detection/getBotScore.js                                       3.29 kB │ gzip: 1.32 kB
 dist/api/captcha/assetSealFormat.js                                       3.38 kB │ gzip: 1.34 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.39 kB │ gzip: 1.32 kB
@@ -167,7 +167,7 @@ dist/api/captcha/getPuzzleCaptchaChallenge.js                             6.84 k
 dist/api/healthzGeo.js                                                    6.86 kB │ gzip: 2.68 kB
 dist/tasks/spam/checkTrafficFilter.js                                     7.16 kB │ gzip: 2.45 kB
 dist/api/captcha/submitPoWCaptchaSolution.js                              8.60 kB │ gzip: 2.66 kB
-dist/tasks/detection/bundlePool.js                                        8.80 kB │ gzip: 3.32 kB
+dist/tasks/detection/bundlePool.js                                        8.86 kB │ gzip: 3.34 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       9.36 kB │ gzip: 1.80 kB
 dist/api/startProviderApi.js                                             10.02 kB │ gzip: 3.45 kB
 dist/api/metrics.js                                                      11.27 kB │ gzip: 3.53 kB
@@ -178,12 +178,12 @@ dist/api/blacklistRequestInspector.js                                    12.75 k
 dist/api/verify.js                                                       15.12 kB │ gzip: 2.82 kB
 dist/tasks/frictionless/frictionlessTasks.js                             17.80 kB │ gzip: 4.86 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              18.54 kB │ gzip: 4.48 kB
-dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.71 kB │ gzip: 5.12 kB
-dist/tasks/captchaManager.js                                             23.44 kB │ gzip: 7.03 kB
-dist/tasks/powCaptcha/powTasks.js                                        23.61 kB │ gzip: 5.97 kB
-dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.42 kB │ gzip: 6.30 kB
+dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.90 kB │ gzip: 5.16 kB
+dist/tasks/captchaManager.js                                             24.17 kB │ gzip: 7.35 kB
+dist/tasks/powCaptcha/powTasks.js                                        24.32 kB │ gzip: 6.15 kB
+dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.61 kB │ gzip: 6.34 kB
 
-✓ built in 150ms
+✓ built in 196ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,107 @@
 # @prosopo/provider
 
+## 5.13.1
+### Patch Changes
+
+- fda0eba: Decision machines can now see which page the captcha was rendered on. `currentUrl` (the top-frame page) and `iframeUrl` (the widget's own frame, when embedded) were already stored on the session and already read back from the database, but the verify-time path never passed them to the decision machine, so rules always saw them as undefined.
+  
+  They are now forwarded on all three verify paths (image, PoW and puzzle). No behaviour changes on its own — it just makes the fields available to rules that need to treat an embedded widget differently from a first-party one.
+  
+  Both values are reported by the client and are not checked against the request's Origin or Referer header, so a rule must not hand out an exemption on the strength of these fields alone.
+- 1728cd0: Carry the detector bundle's `keyMap` through the pool push.
+  
+  `keyMap` is an opaque per-bundle decode parameter, written alongside each
+  bundle by the pool build and meaningless without it — the same contract as
+  `payloadLayout`. The admin pool-replace body schema never declared it, so zod
+  stripped it from every push, and the endpoint's persist step then wrote the
+  bundle back to disk without it.
+  
+  The result was a pool the provider served but could not decode: the push
+  returned success with `persisted: true`, the bundles loaded and sessions were
+  assigned them, but what they produced could not be read. Pools copied onto the
+  volume were unaffected, because that path never goes through the schema.
+  
+  Adds `keyMap` to `ReplaceDetectorPoolBody` and writes it in
+  `persistDetectorBundlePool`.
+- 20542d8: Send page scroll events with the captcha's behavioural data.
+  
+  The widget now passes a fourth collector, the page's scroll position and the
+  time of each scroll, alongside mouse, touch and click data, and the provider
+  stores it as `c4` on the captcha record. People scroll in uneven bursts while
+  bots tend to scroll at a steady rate, so this gives detection something to
+  work with. Detector bundles that predate the scroll tracker simply send no
+  `c4`.
+- Updated dependencies [fda0eba]
+- Updated dependencies [1728cd0]
+- Updated dependencies [20542d8]
+- Updated dependencies [eebe6ee]
+  - @prosopo/types@5.10.2
+  - @prosopo/types-database@5.6.5
+  - @prosopo/api@4.3.5
+  - @prosopo/api-express-router@3.1.95
+  - @prosopo/database@4.0.41
+  - @prosopo/datasets@3.1.91
+  - @prosopo/env@3.6.64
+  - @prosopo/ipinfo@0.4.10
+  - @prosopo/keyring@2.9.97
+  - @prosopo/load-balancer@2.11.1
+  - @prosopo/types-env@2.11.10
+  - @prosopo/user-access-policy@3.14.11
+
+## 5.13.0
+### Minor Changes
+
+- 85a1bb9: Seal captcha image paths into opaque URLs, opened by a CDN edge script.
+  
+  An image URL used to say which image it was: `https://cdn.example.net/dataset/images/abc.webp`. Signed URLs already stop a harvested URL being refetched forever, but the path stays in plain sight, and the path is a stable identifier for the image behind it — which makes it a usable key for caching answers between sessions.
+  
+  The path is now AES-256-GCM sealed, with an expiry, into an opaque blob drawn fresh every time:
+  
+  ```
+  https://cdn.example.net/s/AgHk1n...Qx9.webp
+  ```
+  
+  The edge script opens it, puts the canonical path back on the request, and the CDN serves the one object that path names. The same image therefore has a different URL in every session, with nothing in the URL to group those together, and there is still only one cached copy and one stored object.
+  
+  Sealing happens strictly below `item.data`. The item hash, the captchaId and the datasetId are untouched, so nothing about the dataset or how a solution is verified changes.
+  
+  The provider seals with `node:crypto`, because `AssetsResolver.resolveAsset` is synchronous and every WebCrypto call returns a promise; the edge opens with WebCrypto, because that is what its runtime has. The wire format, the validation and the base64url alphabet live in one module both ends import, and a test seals with one end and opens with the other so the two cannot drift.
+  
+  Inert unless its key is configured, since a sealed URL is unservable until the matching edge script is live. Configured, it takes precedence over the signed resolver; leaving the signing key in place keeps that as the fallback for any zone not yet moved over. More than one key opens at a time, so keys can be rotated without a flag day. `npm run -w @prosopo/provider build:edge` emits the edge script as a single file. Rollout order, environment variables and rotation are documented for operators outside this repository.
+  
+  Test coverage: 51 unit tests over the wire format, the sealer, the resolver and the edge handler — round trip, tamper, truncation, expiry at the boundary, swapped key id, rotation across two live keys, path traversal and prefix confinement, URL shape and per-call uniqueness, passthrough of requests that are not sealed, idempotency when the handler runs at both hooks, and the provider-seals/edge-opens interop.
+
+### Patch Changes
+
+- 4c9b84b: Escalate a PoW solve to an image captcha when it arrives from a different address than the challenge.
+  
+  A PoW challenge is bound to the user account and the site key and to nothing about where the request came from, so a solved challenge can be carried to any host that wants a free pass. The issuing address is already on the record, so binding to it costs nothing: `verifyPowCaptchaSolution` now compares it against the address submitting the solve and escalates when they differ, under a new `IP_CHANGED` reason.
+  
+  Escalation, not denial. A phone handing off between towers mid-solve is a real user and should pay a picture rather than be turned away. For the same reason IPv6 is judged on the /64 alone — the interface identifier in the low 64 bits rotates by design under RFC 8981, several times a day on one unchanged connection — and an address we could not read counts as unchanged.
+  
+  Only applies where a session is linked, since escalation carries the originating session's risk profile forward. Missing coordinates still takes precedence as the reported reason when both fire.
+- 2cca36e: Report a bot score of zero to Pro and Enterprise instead of dropping the field.
+  
+  `canClientSeeScore` tested `score && tier && tier !== Tier.Free`. A session with nothing wrong with it scores 0, which is falsy, so `score` was omitted from the siteverify response for exactly those users: a paying customer got a score for every suspicious visitor and no score at all for their cleanest ones, which reads as "no score available" rather than "no risk".
+  
+  Invisible in production today because `Math.random() * 0.3` is added to every score, making an exact 0 all but impossible. Removing that noise — captcha-private#4433, where this was found — is what would have exposed it.
+  
+  The function also returned `number | boolean | undefined` from its `&&` chain; it now returns `boolean`.
+- Updated dependencies [4c9b84b]
+- Updated dependencies [f13bea8]
+  - @prosopo/types@5.10.1
+  - @prosopo/load-balancer@2.11.0
+  - @prosopo/api@4.3.4
+  - @prosopo/api-express-router@3.1.94
+  - @prosopo/database@4.0.40
+  - @prosopo/datasets@3.1.90
+  - @prosopo/env@3.6.63
+  - @prosopo/ipinfo@0.4.9
+  - @prosopo/keyring@2.9.96
+  - @prosopo/types-database@5.6.4
+  - @prosopo/types-env@2.11.9
+  - @prosopo/user-access-policy@3.14.10
+
 ## 5.12.3
 ### Patch Changes
 

package/dist/cjs/compositeIpAddress.cjs

@@ -38,9 +38,53 @@ var getIpAddressFromComposite = (compositeIpAddress) => {
 	}
 };
 var getBigInt = (number) => BigInt(number || 0n);
+/**
+* Mongo hands these back as Decimal128 rather than the `number | bigint` the
+* type promises, and `BigInt(Decimal128)` throws. Route through the string
+* form, and report a value we cannot read as absent rather than throwing.
+*/
+var readPart = (value) => {
+	if (value === void 0 || value === null) return void 0;
+	try {
+		return BigInt(value.toString());
+	} catch {
+		return;
+	}
+};
+/**
+* The value `getCompositeIpAddress` returns when it could not read an
+* address at all. 0.0.0.0 is not a client address, so nothing legitimate is
+* being swallowed by treating it as "we don't know".
+*/
+var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPart(ip.lower) === 0n;
+/**
+* Do two observations of a client come from the same place on the network?
+*
+* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
+* interface identifier in the low 64 bits is designed to rotate (RFC 8981
+* privacy extensions), often several times a day on one unchanged connection,
+* so comparing it would call an ordinary phone a different host.
+*
+* A value we do not actually have counts as the same — one that will not
+* parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
+* address it could not read. This answer gates extra friction for a real
+* user, and a gap in what we recorded is not evidence against them.
+*/
+var isSameIpOrigin = (a, b) => {
+	if (isUnknownIp(a) || isUnknownIp(b)) return true;
+	if (a.type !== b.type) return false;
+	const compare = (left, right) => {
+		const leftPart = readPart(left);
+		const rightPart = readPart(right);
+		if (leftPart === void 0 || rightPart === void 0) return true;
+		return leftPart === rightPart;
+	};
+	return a.type === _prosopo_types.IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+};
 var never = () => {
 	throw new Error("Unhandled type");
 };
 //#endregion
 exports.getCompositeIpAddress = getCompositeIpAddress;
 exports.getIpAddressFromComposite = getIpAddressFromComposite;
+exports.isSameIpOrigin = isSameIpOrigin;

package/dist/cjs/index.cjs

@@ -50,6 +50,7 @@ exports.getVerdictCache = require_blacklistRequestInspector.getVerdictCache;
 exports.handshakeTimingMiddleware = require_handshakeTimingMiddleware.handshakeTimingMiddleware;
 exports.headerCheckMiddleware = require_headerCheckMiddleware.headerCheckMiddleware;
 exports.ignoreMiddleware = require_ignoreMiddleware.ignoreMiddleware;
+exports.isSameIpOrigin = require_compositeIpAddress.isSameIpOrigin;
 exports.isTlsAvailable = require_startProviderApi.isTlsAvailable;
 exports.ja4Middleware = require_ja4Middleware.ja4Middleware;
 exports.migrateFrictionlessLadder = require_frictionlessLadder.migrateFrictionlessLadder;

package/dist/cjs/tasks/captchaManager.cjs

@@ -491,6 +491,7 @@ var CaptchaManager = class CaptchaManager {
 					c1Length: result.collector1?.length || 0,
 					c2Length: result.collector2?.length || 0,
 					c3Length: result.collector3?.length || 0,
+					c4Length: result.collector4?.length || 0,
 					deviceCapability: result.deviceCapability
 				}
 			}));
@@ -564,8 +565,22 @@ var CaptchaManager = class CaptchaManager {
 		const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
 		return require_checkTrafficFilter.checkTrafficFilter(ipInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}
+	/**
+	* Does this client's tier entitle it to the bot score, and is there one?
+	*
+	* `score !== undefined`, not `score`: a session with nothing wrong with it
+	* scores 0, and a truthiness test dropped the field for exactly those
+	* users — a paying customer reading `score` got a present field for
+	* every suspicious visitor and a missing one for their cleanest. It has
+	* been invisible because `Math.random() * 0.3` makes an exact 0 all but
+	* impossible; taking that noise out (see captcha-private#4433) is what
+	* would expose it.
+	*
+	* Returning `boolean` rather than the old `number | boolean | undefined`,
+	* which came from `&&`-chaining the score and the tier.
+	*/
 	static canClientSeeScore(tier, score) {
-		return score && tier && tier !== _prosopo_types.Tier.Free;
+		return score !== void 0 && tier !== _prosopo_types.Tier.Free;
 	}
 };
 //#endregion

package/dist/cjs/tasks/detection/bundlePool.cjs

@@ -7,8 +7,8 @@ let node_path = require("node:path");
 * Loads a pool of precomputed, obfuscated detector bundles from disk and caches
 * them in memory — the Node analogue of the Rust "bumblebee" `bundle_manager`.
 * Each bundle is a `{id}.js` (served to the browser) paired with a `{id}.json`
-* (`{ privateKey, innerConfig, payloadLayout }`, kept server-side) produced by
-* the catcher `bundle:pool` build script.
+* (`{ privateKey, innerConfig, payloadLayout, keyMap }`, kept server-side)
+* produced by the catcher `bundle:pool` build script.
 *
 * A bundle is assigned per detector session by {@link DetectorBundlePool.at},
 * served by id, and resolved again at decryption time so the provider uses the
@@ -172,7 +172,8 @@ function persistDetectorBundlePool(bundles, dir = globalPoolDir) {
 			privateKey: bundle.privateKey,
 			innerConfig: bundle.innerConfig,
 			...bundle.release && { release: bundle.release },
-			...bundle.payloadLayout && { payloadLayout: bundle.payloadLayout }
+			...bundle.payloadLayout && { payloadLayout: bundle.payloadLayout },
+			...bundle.keyMap && { keyMap: bundle.keyMap }
 		}), {
 			encoding: "utf8",
 			mode: 384

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -142,6 +142,7 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 							mouseEventsCount: decryptedData.collector1?.length || 0,
 							touchEventsCount: decryptedData.collector2?.length || 0,
 							clickEventsCount: decryptedData.collector3?.length || 0,
+							scrollEventsCount: decryptedData.collector4?.length || 0,
 							deviceCapability: decryptedData.deviceCapability
 						}
 					}));
@@ -149,6 +150,7 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 						c1: decryptedData.collector1 || [],
 						c2: decryptedData.collector2 || [],
 						c3: decryptedData.collector3 || [],
+						c4: decryptedData.collector4 || [],
 						d: decryptedData.deviceCapability
 					};
 					deviceCapability = decryptedData.deviceCapability;
@@ -550,6 +552,8 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				ruleType: sessionRecord?.ruleType,
 				webView: sessionRecord?.webView,
 				iFrame: sessionRecord?.iFrame,
+				currentUrl: sessionRecord?.currentUrl,
+				iframeUrl: sessionRecord?.iframeUrl,
 				coords: solution.coords,
 				synNs: sessionRecord?.synNs,
 				synackNs: sessionRecord?.synackNs,

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -150,6 +150,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 						mouseEventsCount: decryptedData.collector1?.length || 0,
 						touchEventsCount: decryptedData.collector2?.length || 0,
 						clickEventsCount: decryptedData.collector3?.length || 0,
+						scrollEventsCount: decryptedData.collector4?.length || 0,
 						deviceCapability: decryptedData.deviceCapability,
 						captchaResult: correct ? "passed" : "failed"
 					}
@@ -158,6 +159,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 					c1: decryptedData.collector1 || [],
 					c2: decryptedData.collector2 || [],
 					c3: decryptedData.collector3 || [],
+					c4: decryptedData.collector4 || [],
 					d: decryptedData.deviceCapability
 				};
 				behavioralUpdates = {
@@ -190,14 +192,24 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		await Promise.all(writePromises);
 		if (!correct) return { verified: correct };
 		const escalateForMissingCoords = !coords && Boolean(challengeRecord.sessionId);
+		const solveIp = require_compositeIpAddress.getCompositeIpAddress(ipAddress);
+		const escalateForIpChange = Boolean(challengeRecord.sessionId) && !require_compositeIpAddress.isSameIpOrigin(challengeRecord.ipAddress, solveIp);
+		if (escalateForIpChange) this.logger.info(() => ({
+			msg: "PoW solve arrived from a different address than the challenge",
+			data: {
+				challenge,
+				issuedType: challengeRecord.ipAddress.type,
+				solvedType: solveIp.type
+			}
+		}));
 		let routingOutput = this.postPowContext ? await this.runPostPowRouting({
 			challengeRecord,
 			challengeSplit,
 			behavioralDataPacked: decryptedBehavioralDataPacked
 		}) : void 0;
-		if (escalateForMissingCoords && routingOutput?.captchaType !== _prosopo_types.CaptchaType.image && routingOutput?.captchaType !== _prosopo_types.CaptchaType.puzzle) routingOutput = {
+		if ((escalateForMissingCoords || escalateForIpChange) && routingOutput?.captchaType !== _prosopo_types.CaptchaType.image && routingOutput?.captchaType !== _prosopo_types.CaptchaType.puzzle) routingOutput = {
 			captchaType: _prosopo_types.CaptchaType.image,
-			reason: _prosopo_types.FrictionlessReason.MISSING_COORDINATES
+			reason: escalateForMissingCoords ? _prosopo_types.FrictionlessReason.MISSING_COORDINATES : _prosopo_types.FrictionlessReason.IP_CHANGED
 		};
 		return {
 			verified: correct,
@@ -499,6 +511,8 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				ruleType: sessionRecord?.ruleType,
 				webView: sessionRecord?.webView,
 				iFrame: sessionRecord?.iFrame,
+				currentUrl: sessionRecord?.currentUrl,
+				iframeUrl: sessionRecord?.iframeUrl,
 				coords: challengeRecord.coords,
 				synNs: sessionRecord?.synNs,
 				synackNs: sessionRecord?.synackNs,

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -147,6 +147,7 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 						mouseEventsCount: decryptedData.collector1?.length || 0,
 						touchEventsCount: decryptedData.collector2?.length || 0,
 						clickEventsCount: decryptedData.collector3?.length || 0,
+						scrollEventsCount: decryptedData.collector4?.length || 0,
 						deviceCapability: decryptedData.deviceCapability,
 						captchaResult: correct ? "passed" : "failed"
 					}
@@ -155,6 +156,7 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 					c1: decryptedData.collector1 || [],
 					c2: decryptedData.collector2 || [],
 					c3: decryptedData.collector3 || [],
+					c4: decryptedData.collector4 || [],
 					d: decryptedData.deviceCapability
 				};
 				await this.db.updatePuzzleCaptchaRecord(challenge, {
@@ -467,6 +469,8 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				ruleType: sessionRecord?.ruleType,
 				webView: sessionRecord?.webView,
 				iFrame: sessionRecord?.iFrame,
+				currentUrl: sessionRecord?.currentUrl,
+				iframeUrl: sessionRecord?.iframeUrl,
 				coords: challengeRecord.coords,
 				puzzleEvents: challengeRecord.puzzleEvents,
 				synNs: sessionRecord?.synNs,

package/dist/compositeIpAddress.d.ts

@@ -2,4 +2,5 @@ import type { IPAddress } from "@prosopo/types";
 import { type CompositeIpAddress } from "@prosopo/types";
 export declare const getCompositeIpAddress: (ip: string | IPAddress) => CompositeIpAddress;
 export declare const getIpAddressFromComposite: (compositeIpAddress: CompositeIpAddress) => IPAddress;
+export declare const isSameIpOrigin: (a: CompositeIpAddress, b: CompositeIpAddress) => boolean;
 //# sourceMappingURL=compositeIpAddress.d.ts.map

package/dist/compositeIpAddress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compositeIpAddress.d.ts","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAiB,MAAM,gBAAgB,CAAC;AAOxE,eAAO,MAAM,qBAAqB,OAC7B,MAAM,GAAG,SAAS,KACpB,kBAaF,CAAC;AAuBF,eAAO,MAAM,yBAAyB,uBACjB,kBAAkB,KACpC,SAaF,CAAC"}
+{"version":3,"file":"compositeIpAddress.d.ts","sourceRoot":"","sources":["../src/compositeIpAddress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAiB,MAAM,gBAAgB,CAAC;AAOxE,eAAO,MAAM,qBAAqB,OAC7B,MAAM,GAAG,SAAS,KACpB,kBAaF,CAAC;AAuBF,eAAO,MAAM,yBAAyB,uBACjB,kBAAkB,KACpC,SAaF,CAAC;AAuCF,eAAO,MAAM,cAAc,MACvB,kBAAkB,KAClB,kBAAkB,KACnB,OAiBF,CAAC"}

package/dist/compositeIpAddress.js

@@ -38,8 +38,51 @@ var getIpAddressFromComposite = (compositeIpAddress) => {
 	}
 };
 var getBigInt = (number) => BigInt(number || 0n);
+/**
+* Mongo hands these back as Decimal128 rather than the `number | bigint` the
+* type promises, and `BigInt(Decimal128)` throws. Route through the string
+* form, and report a value we cannot read as absent rather than throwing.
+*/
+var readPart = (value) => {
+	if (value === void 0 || value === null) return void 0;
+	try {
+		return BigInt(value.toString());
+	} catch {
+		return;
+	}
+};
+/**
+* The value `getCompositeIpAddress` returns when it could not read an
+* address at all. 0.0.0.0 is not a client address, so nothing legitimate is
+* being swallowed by treating it as "we don't know".
+*/
+var isUnknownIp = (ip) => ip.type === IpAddressType.v4 && readPart(ip.lower) === 0n;
+/**
+* Do two observations of a client come from the same place on the network?
+*
+* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
+* interface identifier in the low 64 bits is designed to rotate (RFC 8981
+* privacy extensions), often several times a day on one unchanged connection,
+* so comparing it would call an ordinary phone a different host.
+*
+* A value we do not actually have counts as the same — one that will not
+* parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
+* address it could not read. This answer gates extra friction for a real
+* user, and a gap in what we recorded is not evidence against them.
+*/
+var isSameIpOrigin = (a, b) => {
+	if (isUnknownIp(a) || isUnknownIp(b)) return true;
+	if (a.type !== b.type) return false;
+	const compare = (left, right) => {
+		const leftPart = readPart(left);
+		const rightPart = readPart(right);
+		if (leftPart === void 0 || rightPart === void 0) return true;
+		return leftPart === rightPart;
+	};
+	return a.type === IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+};
 var never = () => {
 	throw new Error("Unhandled type");
 };
 //#endregion
-export { getCompositeIpAddress, getIpAddressFromComposite };
+export { getCompositeIpAddress, getIpAddressFromComposite, isSameIpOrigin };