@prosopo/provider 5.14.0 → 5.15.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,7 +1,4 @@
-
-> @prosopo/provider@5.14.0 build:cjs
-> NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
-
+$ NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 ViteCommonJSConfig: .
 {
   tsConfigPaths: [
@@ -59,7 +56,7 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 120 modules transformed.
+✓ 121 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/tasks/index.cjs                                                       0.08 kB │ gzip: 0.07 kB
@@ -76,6 +73,7 @@ dist/cjs/utils/hashUserIp.cjs                                                  0
 dist/cjs/api/testSiteKey.cjs                                                   0.65 kB │ gzip: 0.32 kB
 dist/cjs/utils/hashUserAgent.cjs                                               0.66 kB │ gzip: 0.40 kB
 dist/cjs/api/validateAddress.cjs                                               0.80 kB │ gzip: 0.36 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/refreshLineage.cjs        0.82 kB │ gzip: 0.46 kB
 dist/cjs/api/ja4.cjs                                                           0.85 kB │ gzip: 0.47 kB
 dist/cjs/api/dnsEventUrl.cjs                                                   0.85 kB │ gzip: 0.46 kB
 dist/cjs/tasks/dataset/datasetTasks.cjs                                        0.92 kB │ gzip: 0.41 kB
@@ -84,23 +82,22 @@ dist/cjs/_virtual/_rolldown/runtime.cjs                                        1
 dist/cjs/api/headerCheckMiddleware.cjs                                         1.02 kB │ gzip: 0.45 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.cjs      1.03 kB │ gzip: 0.53 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.cjs          1.03 kB │ gzip: 0.45 kB
-dist/cjs/tasks/powCaptcha/powTasksUtils.cjs                                    1.05 kB │ gzip: 0.50 kB
 dist/cjs/api/admin/apiRegisterSiteKeyEndpoint.cjs                              1.07 kB │ gzip: 0.48 kB
 dist/cjs/api/admin/apiRegisterSiteKeysEndpoint.cjs                             1.14 kB │ gzip: 0.52 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/constants.cjs             1.15 kB │ gzip: 0.60 kB
 dist/cjs/utils/normalizeRequestIp.cjs                                          1.16 kB │ gzip: 0.52 kB
 dist/cjs/api/admin/apiRemoveSiteKeysEndpoint.cjs                               1.16 kB │ gzip: 0.50 kB
-dist/cjs/tasks/puzzle/nativeBackground.cjs                                     1.16 kB │ gzip: 0.62 kB
 dist/cjs/api/admin/apiRemoveSiteKeyEndpoint.cjs                                1.17 kB │ gzip: 0.50 kB
 dist/cjs/schedulers/captchaScheduler.cjs                                       1.21 kB │ gzip: 0.50 kB
 dist/cjs/api/detectorPoolBodyParser.cjs                                        1.22 kB │ gzip: 0.63 kB
+dist/cjs/tasks/powCaptcha/powTasksUtils.cjs                                    1.26 kB │ gzip: 0.59 kB
 dist/cjs/api/block.cjs                                                         1.28 kB │ gzip: 0.48 kB
 dist/cjs/schedulers/getClientList.cjs                                          1.28 kB │ gzip: 0.55 kB
+dist/cjs/tasks/puzzle/nativeBackground.cjs                                     1.31 kB │ gzip: 0.68 kB
 dist/cjs/api/admin/apiGetDecisionMachineEndpoint.cjs                           1.33 kB │ gzip: 0.52 kB
 dist/cjs/api/admin/apiRemoveDecisionMachineEndpoint.cjs                        1.36 kB │ gzip: 0.52 kB
 dist/cjs/api/admin/apiRemoveAllDecisionMachinesEndpoint.cjs                    1.36 kB │ gzip: 0.54 kB
-dist/cjs/tasks/puzzle/backgroundBuffer.cjs                                     1.44 kB │ gzip: 0.54 kB
 dist/cjs/tasks/dataset/datasetTasksUtils.cjs                                   1.45 kB │ gzip: 0.49 kB
+dist/cjs/tasks/puzzle/backgroundBuffer.cjs                                     1.46 kB │ gzip: 0.54 kB
 dist/cjs/utils/clientMetaData.cjs                                              1.48 kB │ gzip: 0.72 kB
 dist/cjs/tasks/detection/assignSecret.cjs                                      1.48 kB │ gzip: 0.75 kB
 dist/cjs/api/assetDocument.cjs                                                 1.50 kB │ gzip: 0.81 kB
@@ -110,6 +107,7 @@ dist/cjs/utils/honeypot/encoders.cjs                                           1
 dist/cjs/api/admin/apiReplaceDetectorPoolEndpoint.cjs                          1.67 kB │ gzip: 0.71 kB
 dist/cjs/utils/devicePlatform.cjs                                              1.72 kB │ gzip: 0.91 kB
 dist/cjs/api/admin/apiGetSessionEndpoint.cjs                                   1.75 kB │ gzip: 0.82 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/constants.cjs             1.76 kB │ gzip: 0.79 kB
 dist/cjs/api/ja4Middleware.cjs                                                 1.76 kB │ gzip: 0.79 kB
 dist/cjs/api/adminAuthOptions.cjs                                              1.77 kB │ gzip: 0.82 kB
 dist/cjs/api/admin/apiUpdateDecisionMachineEndpoint.cjs                        1.77 kB │ gzip: 0.60 kB
@@ -127,7 +125,6 @@ dist/cjs/tasks/frictionless/routingMachine.cjs                                 2
 dist/cjs/tasks/frictionless/frictionlessTasksUtils.cjs                         2.21 kB │ gzip: 1.10 kB
 dist/cjs/api/captcha/signedAssetsResolver.cjs                                  2.24 kB │ gzip: 1.00 kB
 dist/cjs/api/captcha/sealedAssetsResolver.cjs                                  2.37 kB │ gzip: 0.98 kB
-dist/cjs/tasks/captchaTypeSelection.cjs                                        2.44 kB │ gzip: 1.04 kB
 dist/cjs/utils/dns.cjs                                                         2.66 kB │ gzip: 1.02 kB
 dist/cjs/api/forwardVerify.cjs                                                 2.66 kB │ gzip: 1.12 kB
 dist/cjs/tasks/puzzle/puzzleDifficulty.cjs                                     2.66 kB │ gzip: 1.10 kB
@@ -138,21 +135,21 @@ dist/cjs/api/captcha/submitPuzzleCaptchaSolution.cjs                           2
 dist/cjs/api/captcha/submitImageCaptchaSolution.cjs                            3.09 kB │ gzip: 1.06 kB
 dist/cjs/api/admin/apiDnsEventEndpoint.cjs                                     3.20 kB │ gzip: 1.22 kB
 dist/cjs/tasks/detection/getBotScore.cjs                                       3.37 kB │ gzip: 1.33 kB
-dist/cjs/compositeIpAddress.cjs                                                3.39 kB │ gzip: 1.36 kB
 dist/cjs/api/captcha/assetSealFormat.cjs                                       3.59 kB │ gzip: 1.37 kB
 dist/cjs/api/captcha/assignDetectorBundle.cjs                                  3.63 kB │ gzip: 1.37 kB
+dist/cjs/tasks/captchaTypeSelection.cjs                                        3.64 kB │ gzip: 1.53 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs          3.66 kB │ gzip: 1.35 kB
 dist/cjs/api/admin/apiAdminRoutesProvider.cjs                                  3.67 kB │ gzip: 0.62 kB
 dist/cjs/utils/tarpitPadding.cjs                                               3.71 kB │ gzip: 1.51 kB
 dist/cjs/tasks/tasks.cjs                                                       3.82 kB │ gzip: 1.07 kB
-dist/cjs/api/rawTlsSignalsMiddleware.cjs                                       3.84 kB │ gzip: 1.16 kB
 dist/cjs/api/domainMiddleware.cjs                                              3.95 kB │ gzip: 1.28 kB
 dist/cjs/tasks/spam/evaluateEmailSpamRules.cjs                                 4.03 kB │ gzip: 1.60 kB
 dist/cjs/services/ipComparison.cjs                                             4.06 kB │ gzip: 1.22 kB
+dist/cjs/compositeIpAddress.cjs                                                4.11 kB │ gzip: 1.69 kB
 dist/cjs/tasks/spam/checkSpamEmail.cjs                                         4.14 kB │ gzip: 1.14 kB
 dist/cjs/api/cpuProfiler.cjs                                                   4.21 kB │ gzip: 1.78 kB
 dist/cjs/api/captcha/trafficFilterRequestTime.cjs                              4.27 kB │ gzip: 1.55 kB
-dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4.36 kB │ gzip: 1.55 kB
+dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4.38 kB │ gzip: 1.56 kB
 dist/cjs/api/hardBlockVerdictCache.cjs                                         4.39 kB │ gzip: 1.74 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs          4.56 kB │ gzip: 1.07 kB
 dist/cjs/api/captcha.cjs                                                       4.64 kB │ gzip: 1.43 kB
@@ -161,13 +158,14 @@ dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs                                     4
 dist/cjs/index.cjs                                                             5.02 kB │ gzip: 1.05 kB
 dist/cjs/tasks/detection/decoderPool.cjs                                       5.47 kB │ gzip: 2.06 kB
 dist/cjs/util/usageCounters.cjs                                                5.72 kB │ gzip: 2.03 kB
+dist/cjs/api/rawTlsSignalsMiddleware.cjs                                       6.44 kB │ gzip: 1.98 kB
 dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs                                6.92 kB │ gzip: 1.94 kB
 dist/cjs/api/healthzGeo.cjs                                                    7.03 kB │ gzip: 2.70 kB
 dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              7.47 kB │ gzip: 2.09 kB
-dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             7.75 kB │ gzip: 2.08 kB
 dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     7.97 kB │ gzip: 2.63 kB
-dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              9.28 kB │ gzip: 2.74 kB
+dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             8.77 kB │ gzip: 2.31 kB
 dist/cjs/tasks/detection/bundlePool.cjs                                        9.29 kB │ gzip: 3.38 kB
+dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              9.33 kB │ gzip: 2.76 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs      10.33 kB │ gzip: 1.82 kB
 dist/cjs/api/startProviderApi.cjs                                             11.96 kB │ gzip: 3.79 kB
 dist/cjs/tasks/client/clientTasks.cjs                                         12.31 kB │ gzip: 3.23 kB
@@ -176,14 +174,14 @@ dist/cjs/util.cjs                                                             13
 dist/cjs/api/blacklistRequestInspector.cjs                                    13.39 kB │ gzip: 4.50 kB
 dist/cjs/api/metrics.cjs                                                      13.94 kB │ gzip: 4.32 kB
 dist/cjs/api/verify.cjs                                                       18.33 kB │ gzip: 3.16 kB
-dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             18.43 kB │ gzip: 4.88 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              20.15 kB │ gzip: 4.63 kB
-dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.26 kB │ gzip: 5.18 kB
-dist/cjs/tasks/captchaManager.cjs                                             25.12 kB │ gzip: 7.48 kB
-dist/cjs/tasks/powCaptcha/powTasks.cjs                                        25.99 kB │ gzip: 6.23 kB
-dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 28.93 kB │ gzip: 6.55 kB
+dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             19.27 kB │ gzip: 5.13 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              20.94 kB │ gzip: 4.79 kB
+dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.07 kB │ gzip: 5.15 kB
+dist/cjs/tasks/captchaManager.cjs                                             25.58 kB │ gzip: 7.54 kB
+dist/cjs/tasks/powCaptcha/powTasks.cjs                                        25.94 kB │ gzip: 6.23 kB
+dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 28.74 kB │ gzip: 6.51 kB
 
-✓ built in 218ms
+✓ built in 144ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,5 @@
-
-> @prosopo/provider@5.14.0 build:tsc
-> tsc --build --verbose
-
-12:39:18 PM - Projects in this build: 
+$ tsc --build --verbose
+1:38:17 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -28,53 +25,53 @@
     * ../web-bot-auth/tsconfig.json
     * tsconfig.json
 
-12:39:18 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/error.ts' is older than output '../common/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/index.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/ruleRecord.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/tests/typesEnv.test-d.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/developmentProviderUrl.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
+1:38:17 PM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/verify.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
 
-12:39:18 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+1:38:17 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-12:39:18 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+1:38:17 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,11 +1,5 @@
-
-> @prosopo/provider@5.14.0 build
-> npm run build:cross-env -- --mode ${NODE_ENV:-development}
-
-
-> @prosopo/provider@5.14.0 build:cross-env
-> vite build --config vite.esm.config.ts --mode production
-
+$ pnpm run build:cross-env --mode ${NODE_ENV:-development}
+$ vite build --config vite.esm.config.ts --mode production
 ViteEsmConfig: .
 {
   tsConfigPaths: [
@@ -63,7 +57,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 120 modules transformed.
+✓ 121 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js                                        0.04 kB │ gzip: 0.06 kB
@@ -81,28 +75,28 @@ dist/utils/hashUserIp.js                                                  0.52 k
 dist/api/testSiteKey.js                                                   0.56 kB │ gzip: 0.30 kB
 dist/utils/hashUserAgent.js                                               0.63 kB │ gzip: 0.39 kB
 dist/api/validateAddress.js                                               0.70 kB │ gzip: 0.33 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/refreshLineage.js        0.80 kB │ gzip: 0.46 kB
 dist/api/dnsEventUrl.js                                                   0.80 kB │ gzip: 0.44 kB
 dist/api/ja4.js                                                           0.80 kB │ gzip: 0.44 kB
 dist/tasks/dataset/datasetTasks.js                                        0.85 kB │ gzip: 0.39 kB
-dist/tasks/powCaptcha/powTasksUtils.js                                    0.89 kB │ gzip: 0.46 kB
 dist/api/captcha/assetSeal.js                                             0.91 kB │ gzip: 0.50 kB
 dist/api/headerCheckMiddleware.js                                         0.91 kB │ gzip: 0.43 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js      0.95 kB │ gzip: 0.51 kB
 dist/api/admin/apiRegisterSiteKeyEndpoint.js                              1.00 kB │ gzip: 0.46 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.js          1.01 kB │ gzip: 0.45 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             1.04 kB │ gzip: 0.57 kB
-dist/tasks/puzzle/nativeBackground.js                                     1.06 kB │ gzip: 0.58 kB
 dist/api/detectorPoolBodyParser.js                                        1.07 kB │ gzip: 0.57 kB
 dist/api/admin/apiRemoveSiteKeysEndpoint.js                               1.07 kB │ gzip: 0.48 kB
+dist/tasks/powCaptcha/powTasksUtils.js                                    1.07 kB │ gzip: 0.54 kB
 dist/api/admin/apiRegisterSiteKeysEndpoint.js                             1.08 kB │ gzip: 0.50 kB
 dist/api/admin/apiRemoveSiteKeyEndpoint.js                                1.08 kB │ gzip: 0.48 kB
 dist/api/block.js                                                         1.08 kB │ gzip: 0.46 kB
 dist/schedulers/captchaScheduler.js                                       1.11 kB │ gzip: 0.48 kB
 dist/utils/normalizeRequestIp.js                                          1.14 kB │ gzip: 0.52 kB
 dist/schedulers/getClientList.js                                          1.19 kB │ gzip: 0.53 kB
+dist/tasks/puzzle/nativeBackground.js                                     1.21 kB │ gzip: 0.64 kB
 dist/api/admin/apiGetDecisionMachineEndpoint.js                           1.26 kB │ gzip: 0.50 kB
-dist/tasks/puzzle/backgroundBuffer.js                                     1.26 kB │ gzip: 0.51 kB
 dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 kB │ gzip: 0.51 kB
+dist/tasks/puzzle/backgroundBuffer.js                                     1.27 kB │ gzip: 0.51 kB
 dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip: 0.51 kB
 dist/tasks/dataset/datasetTasksUtils.js                                   1.33 kB │ gzip: 0.48 kB
 dist/api/assetDocument.js                                                 1.36 kB │ gzip: 0.75 kB
@@ -112,6 +106,7 @@ dist/api/admin/apiGetAllDecisionMachinesEndpoint.js                       1.48 k
 dist/schedulers/updateSpamEmailDomains.js                                 1.52 kB │ gzip: 0.60 kB
 dist/api/admin/apiReplaceDetectorPoolEndpoint.js                          1.57 kB │ gzip: 0.68 kB
 dist/api/ja4Middleware.js                                                 1.59 kB │ gzip: 0.75 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             1.61 kB │ gzip: 0.76 kB
 dist/utils/honeypot/encoders.js                                           1.62 kB │ gzip: 0.67 kB
 dist/api/admin/apiGetSessionEndpoint.js                                   1.66 kB │ gzip: 0.80 kB
 dist/api/admin/apiToggleMaintenanceModeEndpoint.js                        1.66 kB │ gzip: 0.69 kB
@@ -131,7 +126,6 @@ dist/tasks/puzzle/stratifiedSampler.js                                    2.14 k
 dist/tasks/frictionless/frictionlessTasksUtils.js                         2.16 kB │ gzip: 1.09 kB
 dist/api/captcha/maintenanceModeResponses.js                              2.16 kB │ gzip: 0.73 kB
 dist/tasks/frictionless/routingMachine.js                                 2.20 kB │ gzip: 0.93 kB
-dist/tasks/captchaTypeSelection.js                                        2.22 kB │ gzip: 1.03 kB
 dist/api/captcha/sealedAssetsResolver.js                                  2.26 kB │ gzip: 0.97 kB
 dist/utils/dns.js                                                         2.36 kB │ gzip: 0.95 kB
 dist/api/public.js                                                        2.45 kB │ gzip: 0.98 kB
@@ -143,17 +137,17 @@ dist/api/captcha/submitImageCaptchaSolution.js                            2.69 k
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip: 0.55 kB
 dist/index.js                                                             2.95 kB │ gzip: 0.81 kB
 dist/api/admin/apiDnsEventEndpoint.js                                     3.05 kB │ gzip: 1.18 kB
-dist/compositeIpAddress.js                                                3.15 kB │ gzip: 1.34 kB
 dist/tasks/detection/getBotScore.js                                       3.29 kB │ gzip: 1.32 kB
+dist/tasks/captchaTypeSelection.js                                        3.34 kB │ gzip: 1.50 kB
 dist/api/captcha/assetSealFormat.js                                       3.38 kB │ gzip: 1.34 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.39 kB │ gzip: 1.32 kB
 dist/api/captcha/assignDetectorBundle.js                                  3.40 kB │ gzip: 1.34 kB
 dist/tasks/tasks.js                                                       3.44 kB │ gzip: 1.01 kB
 dist/api/domainMiddleware.js                                              3.61 kB │ gzip: 1.24 kB
 dist/utils/tarpitPadding.js                                               3.67 kB │ gzip: 1.51 kB
-dist/api/rawTlsSignalsMiddleware.js                                       3.69 kB │ gzip: 1.13 kB
 dist/tasks/spam/evaluateEmailSpamRules.js                                 3.84 kB │ gzip: 1.59 kB
-dist/tasks/puzzle/puzzleRenderer.js                                       3.99 kB │ gzip: 1.52 kB
+dist/compositeIpAddress.js                                                3.87 kB │ gzip: 1.66 kB
+dist/tasks/puzzle/puzzleRenderer.js                                       4.02 kB │ gzip: 1.53 kB
 dist/services/ipComparison.js                                             4.04 kB │ gzip: 1.21 kB
 dist/api/captcha/trafficFilterRequestTime.js                              4.06 kB │ gzip: 1.53 kB
 dist/tasks/spam/checkSpamEmail.js                                         4.12 kB │ gzip: 1.12 kB
@@ -165,12 +159,13 @@ dist/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.js          4.35 k
 dist/tasks/dnsEvent/enrichDnsEvent.js                                     4.71 kB │ gzip: 1.72 kB
 dist/tasks/detection/decoderPool.js                                       5.34 kB │ gzip: 2.02 kB
 dist/util/usageCounters.js                                                5.65 kB │ gzip: 2.01 kB
+dist/api/rawTlsSignalsMiddleware.js                                       6.25 kB │ gzip: 1.95 kB
 dist/api/captcha/getPoWCaptchaChallenge.js                                6.25 kB │ gzip: 1.87 kB
 dist/api/captcha/getImageCaptchaChallenge.js                              6.69 kB │ gzip: 2.03 kB
 dist/api/healthzGeo.js                                                    6.86 kB │ gzip: 2.68 kB
-dist/api/captcha/getPuzzleCaptchaChallenge.js                             7.00 kB │ gzip: 2.01 kB
 dist/tasks/spam/checkTrafficFilter.js                                     7.63 kB │ gzip: 2.61 kB
-dist/api/captcha/submitPoWCaptchaSolution.js                              8.70 kB │ gzip: 2.69 kB
+dist/api/captcha/getPuzzleCaptchaChallenge.js                             7.95 kB │ gzip: 2.24 kB
+dist/api/captcha/submitPoWCaptchaSolution.js                              8.72 kB │ gzip: 2.70 kB
 dist/tasks/detection/bundlePool.js                                        8.86 kB │ gzip: 3.34 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       9.36 kB │ gzip: 1.80 kB
 dist/api/startProviderApi.js                                             10.22 kB │ gzip: 3.50 kB
@@ -180,14 +175,14 @@ dist/util.js                                                             12.47 k
 dist/api/blacklistRequestInspector.js                                    12.75 kB │ gzip: 4.46 kB
 dist/api/metrics.js                                                      13.17 kB │ gzip: 4.27 kB
 dist/api/verify.js                                                       16.55 kB │ gzip: 3.04 kB
-dist/tasks/frictionless/frictionlessTasks.js                             17.86 kB │ gzip: 4.86 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              18.63 kB │ gzip: 4.53 kB
-dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.85 kB │ gzip: 5.14 kB
-dist/tasks/powCaptcha/powTasks.js                                        24.56 kB │ gzip: 6.17 kB
-dist/tasks/captchaManager.js                                             24.61 kB │ gzip: 7.41 kB
-dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 27.41 kB │ gzip: 6.51 kB
+dist/tasks/frictionless/frictionlessTasks.js                             18.61 kB │ gzip: 5.10 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              19.35 kB │ gzip: 4.68 kB
+dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.62 kB │ gzip: 5.09 kB
+dist/tasks/powCaptcha/powTasks.js                                        24.47 kB │ gzip: 6.18 kB
+dist/tasks/captchaManager.js                                             25.06 kB │ gzip: 7.47 kB
+dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 27.18 kB │ gzip: 6.46 kB
 
-✓ built in 219ms
+✓ built in 142ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,133 @@
 # @prosopo/provider
 
+## 5.15.0
+### Minor Changes
+
+- 1c13037: Add `captchaTypeFeatureFlags` to site settings, starting with `puzzle`. Setting
+  `puzzle: false` stops a site being served the puzzle captcha by any path: its
+  configured `captchaType`, `frictionlessTypes`, access policies, the traffic
+  filter, routing machines, PoW escalation, and puzzle sessions that already
+  exist. A site pinned to puzzle gets an image captcha instead (or PoW if image is
+  also off). The field is optional and has no stored default, so sites that never
+  set it behave exactly as before. The flag is meant for Prosopo staff, not site
+  owners.
+- f961dab: Store everything needed to redraw a puzzle, so the portal can show the exact challenge a user was served.
+  
+  Until now a puzzle record kept the target, the origin and the accuracy required (`tolerance`), and
+  nothing else. The things that decide what the puzzle actually looked like — how many decoy shapes were
+  scattered on it, how dark they were, how big the piece was, and which background was used — were
+  picked per challenge and then thrown away. So you could see that someone failed by 11px and had no way
+  to know whether they had been handed an easy puzzle or a nasty one.
+  
+  Puzzle records now carry a `render` object with all of it: the difficulty ladder level, the piece size,
+  the frame geometry, the five render settings, and the two 128-bit seeds that regenerate the imagery.
+  Given those, the portal reproduces the background and the piece byte for byte.
+  
+  To make that possible the renderer had to become reproducible. `renderPuzzle` and `createBackground`
+  now take an optional seed and report the one they used, instead of generating one internally and
+  discarding it; the background pool hands out each image together with its seed. Default behaviour is
+  unchanged — omit the seed and you still get a fresh random one.
+  
+  The ladder level is new on the session too (`puzzleLevel`), because it was computed when the puzzle
+  was escalated and never written down anywhere. It is absent when the ladder did not choose the
+  puzzle — a site-configured puzzle or a traffic-filter override has no level.
+  
+  The record is patched after the imagery is produced rather than written with the rest of the record,
+  because the piece size and the seeds only exist once the render has run, and the target has to be
+  durable before it is expressed in pixels. If that patch fails it is logged and ignored: losing a
+  diagnostic must not cost the user their solve. Records written before this change, and any challenge
+  whose render threw, simply have no `render`.
+  
+  **The seeds are secret.** `puzzle-assets/src/prng.ts` explains why: they regenerate the clean
+  background, and a clean background can be diffed against the composite to read the target position
+  straight off. They were previously barred from leaving the provider entirely. They may now sit on the
+  captcha record, and nowhere else — not in a response, not in a log, not on the session. Anything that
+  exposes a puzzle record to a caller has to drop `render.backgroundSeed` and `render.renderSeed`, and
+  must not serve them at all while the challenge is still live. The comment in `prng.ts` now says so.
+  
+  Test coverage. Three guards, each confirmed to fail when the thing it protects is broken:
+  `renderReplay.unit.test.ts` re-renders from the stored fields and asserts the bytes match, with one
+  case per field asserting that changing *only* that field changes the output — so a record missing a
+  field cannot pass; `puzzleRenderer.unit.test.ts` replays through the same entry points the portal would
+  use, which catches a background paired with the wrong seed; and `schemas.test.ts` asserts every
+  sub-field survives a strict-mode mongoose write, since a field absent from the schema is dropped
+  silently and would store nothing at all.
+- 1ce9482: Cap automatic puzzle escalation one rung lower on touch devices than on pointer devices.
+  
+  The puzzle's `tolerance` is an absolute CSS-pixel target and the widget renders into a fixed 300x200 container on every device, so a difficulty level asks the same placement accuracy of a fingertip as it does of a mouse.
+  
+  `MAX_AUTO_ESCALATION_LEVEL_TOUCH` and `resolveMaxEscalationLevel(siteMaxLevel, isTouch)` are new in `@prosopo/captcha-severity`. The resolver takes the stricter of the site's own `puzzleMaxDifficulty` and the device ceiling, so a site set to 3 or 4 cannot out-vote the touch ceiling and a site pinned to 0 is not raised by it.
+  
+  The provider now calls it from both places a puzzle difficulty is chosen: `sendCaptcha`, which reads `routingContext.platform.isMobile`, and the post-PoW escalation in `submitPoWCaptchaSolution`, which derives the platform from the originating session. That second path previously ignored the site's `puzzleMaxDifficulty` entirely and always clamped to the global ceiling; it now respects both caps.
+  
+  Desktop behaviour is unchanged, and L4 stays unreachable by automatic escalation on either device.
+- dcb691b: Add a refresh control to the puzzle captcha.
+  
+  A user who can't solve the puzzle they were given can now ask for a different one, from a button in the puzzle's header. The replacement comes through a new frictionless session, like a wrong answer already does.
+  
+  The widget tells the provider which session was refreshed (`refreshOf`). The provider then records `refreshOf`, `refreshCount` and `refreshedAfterMs` on the new session, so refresh behaviour can be scored later. After three refreshes in a row it serves an image challenge instead, with reason `PUZZLE_REFRESH_LIMIT`. It only does this if the site has image enabled. The switch only goes from puzzle to image, so a client that lies about its refreshes can only make its own challenge harder. A client that leaves the field out gets a normal session, the same as reloading the page.
+  
+  The image widget's reload button now reports itself as a refresh too. That way a user who was moved onto image isn't sent back to the puzzle by their next reload.
+
+### Patch Changes
+
+- 7d57d2a: A proof-of-work solve is checked against the address the challenge was issued to, and a mismatch sends the user to an image captcha instead of approving them. That check compared the whole IPv4 address, so it fired for anyone whose address moved between asking for the challenge and solving it — which is normal behaviour on mobile and on carrier NAT, where the low octet gets reassigned mid-session. One EE subscriber was seen moving one address along in four seconds.
+  
+  It now compares the /24, so a reassignment inside the same pool reads as the same place on the network. IPv6 already worked this way on the /64, for the same reason, and is unchanged. A solve arriving from a genuinely different network is still caught and still escalates, so the point of the check survives.
+  
+  Unit tests cover a low-octet reassignment, both ends of a /24, two different /24s, and a pair of adjacent addresses that straddle the /24 boundary.
+- 2118584: Trim the comments on the puzzle difficulty device ceiling. No behaviour change.
+- 80b7780: Post-PoW routing now receives the widget mode from the originating session and whether the submitted click coords were all (0,0), so a routing rule can escalate visible-mode solves that carry no real click position.
+- dd4c27c: Store the whole-SYN fields the tcp-probe sidecar now reports.
+  
+  The sidecar's handshake record grew from 80 to 104 bytes and the tail was reordered (prosopo/Protect#1167). chaddy was updated to read both layouts and to forward the new fields as their own headers (prosopo/chaddy#16, #17); this is the provider side of that, so the values have somewhere to land instead of being dropped at the middleware.
+  
+  Twelve new fields on `Session`, all optional: `tcpOptsKinds`, `tcpOptsPresent`, `tcpOptsCount`, `tcpTsval`, `tcpTsecr`, `tcpFlags`, `tcpDataOffsetResv`, `tcpUrgPtr`, `ipIdent`, `ipTotalLen`, `ipFragFlags`, `ipTos`. They are surfaced on the decision-machine input the same way the existing TCP fields are, so routing and verify rules can read them.
+  
+  `tcpOptsKinds` is stored decoded — the IANA kind number of each TCP option in wire order, `[2, 4, 8, 1, 3]` on an ordinary Linux SYN. The probe emits it packed into a u64, and a u64 reaches 2^64 while a JS number is exact only to 2^53, so the packed form could not be held without rounding; the rounding would land in the low bytes, which are the option kinds themselves. The array holds the same information and is queryable per position. It also replaces the old `tcpOptsOrder`, which packed 4 bits per option and so could not tell MSS from TCP Fast Open, or Window Scale from MD5, and could not represent MPTCP at all.
+  
+  `tcpOptsFlags` and `tcpOptsOrder` are kept and still read. A pronode running an older chaddy still sends them, and years of rows hold them, so removing them would both lose the rollout window and break any routing rule already reading them. They go undefined on new sessions once the fleet is rolled.
+  
+  `tcpTsval` and `tcpTsecr` are written only when the Timestamps option was actually on the SYN. A TSval of 0 is legal and a TSecr of 0 is expected, so neither can use zero to mean absent.
+  
+  Six places named every one of these fields by hand — the middleware's copy onto the request, the session write, and four task files building the decision-machine bag. They now all go through one list, with a compile-time check that every field of `RawTlsSignals` is on it. That is not tidying: the Session projection comment in `@prosopo/types-database` records a field being missed in exactly this way, after which the rules reading it got `undefined` and silently never fired against real traffic.
+  
+  Separately, the provider compose no longer defaults the sidecar to `prosopo/tcp-probe:latest`. The probe's reply is a bare fixed-size struct with no version in it, so the image tag is the only statement of which layout a host serves, and publishing `:latest` would change that on every pronode at the next pull with nobody running a deploy. The default is now the `0.1.1` both Protect inventories already pin.
+  
+  Tests: the new headers all parse; a packed value above 2^53 decodes without losing its low bytes; the kind pairs the old encoding aliased stay distinct; a trailing end-of-option-list terminates the list rather than appearing in it; an all-zero packed value reads as absent rather than as an empty list; malformed and out-of-range values are ignored; the legacy header pair is still read; and a zero is kept rather than dropped, since `ipIdent` 0 and `tcpTsecr` 0 are real readings.
+- Updated dependencies [1c13037]
+- Updated dependencies [f961dab]
+- Updated dependencies [a17e8eb]
+- Updated dependencies [7d57d2a]
+- Updated dependencies [2118584]
+- Updated dependencies [1ce9482]
+- Updated dependencies [6e2eb55]
+- Updated dependencies [dcb691b]
+- Updated dependencies [80b7780]
+- Updated dependencies [dd4c27c]
+  - @prosopo/types@5.13.0
+  - @prosopo/types-database@5.8.0
+  - @prosopo/puzzle-assets@0.2.0
+  - @prosopo/util@3.3.14
+  - @prosopo/captcha-severity@1.2.0
+  - @prosopo/api@4.4.0
+  - @prosopo/locale@3.7.0
+  - @prosopo/api-express-router@3.2.1
+  - @prosopo/common@3.1.62
+  - @prosopo/database@4.1.4
+  - @prosopo/datasets@3.2.1
+  - @prosopo/env@3.6.69
+  - @prosopo/ipinfo@0.4.14
+  - @prosopo/keyring@2.10.1
+  - @prosopo/load-balancer@2.11.5
+  - @prosopo/types-env@2.11.15
+  - @prosopo/user-access-policy@3.14.15
+  - @prosopo/api-route@2.6.63
+  - @prosopo/logger@2.1.3
+  - @prosopo/redis-client@1.0.40
+  - @prosopo/util-crypto@13.6.0
+  - @prosopo/web-bot-auth@0.1.3
+
 ## 5.14.0
 ### Minor Changes