@prosopo/provider 5.19.3 → 5.20.0

package/dist/cjs/api/verify.cjs

@@ -36,13 +36,11 @@ var decodeTokenOr400 = (token, i18n, logger, next) => {
 	try {
 		return (0, _prosopo_types.decodeProcaptchaOutput)(token);
 	} catch (error) {
-		next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-			context: {
-				code: 400,
-				error
-			},
-			i18n,
-			logger
+		next(new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-37",
+			message: "Error parsing captcha",
+			cause: error
 		}));
 		return null;
 	}
@@ -52,13 +50,12 @@ var dappSignatureError = (signature, message, pair, req) => {
 		(0, _prosopo_api_express_router.verifySignature)(signature, message, pair);
 		return;
 	} catch {
-		return new _prosopo_common.ProsopoApiError("GENERAL.INVALID_SIGNATURE", {
-			context: {
-				code: 400,
-				siteKey: pair.address
-			},
-			i18n: req.i18n,
-			logger: req.logger
+		return new _prosopo_common.ProsopoError({
+			code: "UNAUTHORIZED",
+			errorSite: "PROV-38",
+			message: "Invalid signature",
+			status: 400,
+			context: { siteKey: pair.address }
 		});
 	}
 };
@@ -77,14 +74,12 @@ var interactiveVerifyHandler = ({ env, userAccessRulesStorage, path, label, hand
 	try {
 		parsed = _prosopo_types.ServerPuzzleCaptchaVerifyRequestBody.parse(req.body);
 	} catch (err) {
-		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-			context: {
-				code: 400,
-				error: err,
-				body: require_requestBodySummary.summariseRequestBody(req)
-			},
-			i18n: req.i18n,
-			logger: req.logger
+		return next(new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-39",
+			message: "Error parsing captcha",
+			cause: err,
+			context: { body: require_requestBodySummary.summariseRequestBody(req) }
 		}));
 	}
 	try {
@@ -115,13 +110,10 @@ var interactiveVerifyHandler = ({ env, userAccessRulesStorage, path, label, hand
 		(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
 		(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
 		const clientRecord = await tasks.db.getClientRecord(dapp);
-		if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-			context: {
-				code: 400,
-				siteKey: dapp
-			},
-			i18n: req.i18n,
-			logger: req.logger
+		if (!clientRecord) return next(new _prosopo_common.ProsopoError({
+			code: "SITE_KEY_NOT_REGISTERED",
+			errorSite: "PROV-40",
+			context: { siteKey: dapp }
 		}));
 		if (!challenge) {
 			const unverifiedResponse = {
@@ -151,13 +143,11 @@ var interactiveVerifyHandler = ({ env, userAccessRulesStorage, path, label, hand
 			err,
 			data: { body: require_requestBodySummary.summariseRequestBody(req) }
 		}));
-		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: {
-				code: 500,
-				error: err
-			},
-			i18n: req.i18n,
-			logger: req.logger
+		return next(new _prosopo_common.ProsopoError({
+			code: "UNEXPECTED",
+			errorSite: "PROV-41",
+			message: "BadRequest",
+			cause: err
 		}));
 	}
 };
@@ -217,14 +207,12 @@ function prosopoVerifyRouter(env) {
 		try {
 			parsed = _prosopo_types.VerifySolutionBody.parse(req.body);
 		} catch (err) {
-			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-				context: {
-					code: 400,
-					error: err,
-					body: require_requestBodySummary.summariseRequestBody(req)
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			return next(new _prosopo_common.ProsopoError({
+				code: "INVALID_REQUEST",
+				errorSite: "PROV-42",
+				message: "Error parsing captcha",
+				cause: err,
+				context: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 		}
 		const { dappSignature, token, ip, maxVerifiedTime, email, clientSessionId } = parsed;
@@ -255,14 +243,13 @@ function prosopoVerifyRouter(env) {
 			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
 			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
 			const clientRecord = await tasks.db.getClientRecord(dapp);
-			if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			if (!clientRecord) return next(new _prosopo_common.ProsopoError({
+				code: "SITE_KEY_NOT_REGISTERED",
+				errorSite: "PROV-43",
 				context: {
-					code: 400,
 					siteKey: dapp,
 					user
-				},
-				i18n: req.i18n,
-				logger: req.logger
+				}
 			}));
 			const keyPair = env.keyring.addFromAddress(dapp);
 			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), keyPair, req);
@@ -285,14 +272,14 @@ function prosopoVerifyRouter(env) {
 				msg: "Error in verifyImageCaptchaSolution",
 				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
-			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			return next(new _prosopo_common.ProsopoError({
+				code: "UNEXPECTED",
+				errorSite: "PROV-44",
+				message: "BadRequest",
 				context: {
-					code: 500,
 					siteKey: req.body.dapp,
 					user: req.body.user
-				},
-				i18n: req.i18n,
-				logger: req.logger
+				}
 			}));
 		}
 	});
@@ -313,14 +300,12 @@ function prosopoVerifyRouter(env) {
 		try {
 			parsed = _prosopo_types.ServerPowCaptchaVerifyRequestBody.parse(req.body);
 		} catch (err) {
-			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-				context: {
-					code: 400,
-					error: err,
-					body: require_requestBodySummary.summariseRequestBody(req)
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			return next(new _prosopo_common.ProsopoError({
+				code: "INVALID_REQUEST",
+				errorSite: "PROV-45",
+				message: "Error parsing captcha",
+				cause: err,
+				context: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 		}
 		try {
@@ -351,13 +336,10 @@ function prosopoVerifyRouter(env) {
 			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
 			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
 			const clientRecord = await tasks.db.getClientRecord(dapp);
-			if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-				context: {
-					code: 400,
-					siteKey: dapp
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			if (!clientRecord) return next(new _prosopo_common.ProsopoError({
+				code: "SITE_KEY_NOT_REGISTERED",
+				errorSite: "PROV-46",
+				context: { siteKey: dapp }
 			}));
 			if (!challenge) {
 				const unverifiedResponse = {
@@ -377,7 +359,7 @@ function prosopoVerifyRouter(env) {
 				const maintenanceResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
 				return res.json(maintenanceResponse);
 			}
-			const { verified, score, reason, sessionId } = await tasks.powCaptchaManager.serverVerifyPowCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
+			const { verified, score, reason, sessionId } = await tasks.powCaptchaManager.serverVerifyPowCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId, clientRecord.settings.ipValidationRules);
 			const verificationResponse = tasks.powCaptchaManager.getVerificationResponse(verified, clientRecord, req.i18n.t, score, reason, sessionId);
 			return res.json(verificationResponse);
 		} catch (err) {
@@ -386,13 +368,11 @@ function prosopoVerifyRouter(env) {
 				err,
 				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
-			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-				context: {
-					code: 500,
-					error: err
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			return next(new _prosopo_common.ProsopoError({
+				code: "UNEXPECTED",
+				errorSite: "PROV-47",
+				message: "BadRequest",
+				cause: err
 			}));
 		}
 	});
@@ -437,14 +417,12 @@ function prosopoVerifyRouter(env) {
 		try {
 			parsed = _prosopo_types.VerifySolutionBody.parse(req.body);
 		} catch (err) {
-			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-				context: {
-					code: 400,
-					error: err,
-					body: require_requestBodySummary.summariseRequestBody(req)
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			return next(new _prosopo_common.ProsopoError({
+				code: "INVALID_REQUEST",
+				errorSite: "PROV-48",
+				message: "Error parsing captcha",
+				cause: err,
+				context: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 		}
 		const { dappSignature, token, ip, clientSessionId } = parsed;
@@ -471,14 +449,13 @@ function prosopoVerifyRouter(env) {
 			const tasks = new require_tasks.Tasks(env, req.logger);
 			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
 			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
-			if (!await tasks.db.getClientRecord(dapp)) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			if (!await tasks.db.getClientRecord(dapp)) return next(new _prosopo_common.ProsopoError({
+				code: "SITE_KEY_NOT_REGISTERED",
+				errorSite: "PROV-49",
 				context: {
-					code: 400,
 					siteKey: dapp,
 					user
-				},
-				i18n: req.i18n,
-				logger: req.logger
+				}
 			}));
 			const keyPair = env.keyring.addFromAddress(dapp);
 			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), keyPair, req);
@@ -503,14 +480,14 @@ function prosopoVerifyRouter(env) {
 				msg: "Error in verifyAuthenticatedSession",
 				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
-			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			return next(new _prosopo_common.ProsopoError({
+				code: "UNEXPECTED",
+				errorSite: "PROV-50",
+				message: "BadRequest",
 				context: {
-					code: 500,
 					siteKey: req.body.dapp,
 					user: req.body.user
-				},
-				i18n: req.i18n,
-				logger: req.logger
+				}
 			}));
 		}
 	});

package/dist/cjs/index.cjs

@@ -45,6 +45,7 @@ exports.getIpAddressFromComposite = require_compositeIpAddress.getIpAddressFromC
 exports.getJA4 = require_ja4Middleware.getJA4;
 exports.getPrioritisedAccessRule = require_blacklistRequestInspector.getPrioritisedAccessRule;
 exports.getRequestUserScope = require_blacklistRequestInspector.getRequestUserScope;
+exports.getServerVerifyPaths = require_startProviderApi.getServerVerifyPaths;
 exports.getUserFromJWT = require_startProviderApi.getUserFromJWT;
 exports.getVerdictCache = require_blacklistRequestInspector.getVerdictCache;
 exports.handshakeTimingMiddleware = require_handshakeTimingMiddleware.handshakeTimingMiddleware;

package/dist/cjs/tasks/captchaManager.cjs

@@ -552,9 +552,7 @@ var CaptchaManager = class CaptchaManager {
 	*
 	* @returns The blocking policy if user should be blocked, undefined otherwise
 	*/
-	async checkForHardBlock(userAccessRulesStorage, challengeRecord, userAccount, headers, coords, countryCode, asn) {
-		let headHash;
-		if (challengeRecord.sessionId) headHash = (await this.db.getSessionRecordBySessionId(challengeRecord.sessionId))?.decryptedHeadHash;
+	async checkForHardBlock(userAccessRulesStorage, challengeRecord, userAccount, headers, headHash, coords, countryCode, asn) {
 		const coordsString = coords ? JSON.stringify(coords) : void 0;
 		const ipAddressRecord = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
 		const userScope = require_blacklistRequestInspector.getRequestUserScope(headers, challengeRecord.ja4, ipAddressRecord.address, userAccount, headHash, coordsString, countryCode, asn);
@@ -581,8 +579,9 @@ var CaptchaManager = class CaptchaManager {
 	*   time (ipInfoMiddleware → storeXxxRecord), so by default we reuse it
 	*   instead of hitting the sidecar again.
 	* - If the dapp's server passed up the end user's current IP via the
-	*   verify call, look that up fresh — it's the "now" IP for filtering
-	*   and may differ from the IP that originally requested the captcha.
+	*   verify call, the caller looks that up fresh and passes the result as
+	*   `currentIpInfo` — it's the "now" IP for filtering and may differ from
+	*   the IP that originally requested the captcha.
 	* - When the session carries a `dnsEvent`, its `peerIp` and `resolverIp`
 	*   are enriched and passed alongside the primary IP.
 	* - The abuser category defaults to `{action:"block"}` so abusive
@@ -595,7 +594,7 @@ var CaptchaManager = class CaptchaManager {
 	* updates record / session state differently); this helper just returns
 	* the verdict.
 	*/
-	async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp, enrichedDnsEvent) {
+	async resolveTrafficFilterCheck(recordIpInfo, trafficFilter, currentIpInfo, enrichedDnsEvent) {
 		const effective = {
 			abuser: { action: _prosopo_types.TrafficFilterAction.Block },
 			...trafficFilter
@@ -604,8 +603,7 @@ var CaptchaManager = class CaptchaManager {
 			isBlocked: false,
 			matches: []
 		};
-		const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
-		return require_checkTrafficFilter.checkTrafficFilter(ipInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
+		return require_checkTrafficFilter.checkTrafficFilter(currentIpInfo ?? recordIpInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}
 	/**
 	* Does this client's tier entitle it to the bot score, and is there one?

package/dist/cjs/tasks/client/clientTasks.cjs

@@ -126,9 +126,11 @@ var ClientTaskManager = class {
 			if (newClientRecords) await this.providerDB.updateClientRecords(newClientRecords);
 			await this.providerDB.updateScheduledTaskStatus(taskID, _prosopo_types.ScheduledTaskStatus.Completed, { data: { clientRecords: newClientRecords.length } });
 		} catch (e) {
-			const getClientListError = new _prosopo_common.ProsopoApiError("DATABASE.UNKNOWN", {
-				context: { error: e },
-				logger: this.logger
+			const getClientListError = new _prosopo_common.ProsopoError({
+				code: "DB_QUERY_FAILED",
+				errorSite: "PROV-51",
+				message: "Unknown database error",
+				cause: e
 			});
 			this.logger.error(() => ({
 				err: getClientListError,
@@ -170,12 +172,14 @@ var ClientTaskManager = class {
 		await this.providerDB.removeClientRecords(accounts);
 	}
 	async updateDecisionMachine(scope, runtime, source, dappAccount, language, name, version, captchaType, kind) {
-		if (scope === _prosopo_types.DecisionMachineScope.Dapp && !dappAccount) throw new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+		if (scope === _prosopo_types.DecisionMachineScope.Dapp && !dappAccount) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-52",
+			message: "BadRequest",
 			context: {
 				scope,
 				dappAccount
-			},
-			logger: this.logger
+			}
 		});
 		const now = /* @__PURE__ */ new Date();
 		await this.providerDB.upsertDecisionMachineArtifact({
@@ -218,9 +222,11 @@ var ClientTaskManager = class {
 	}
 	async getDecisionMachine(id) {
 		const artifact = await this.providerDB.getDecisionMachineArtifactById(id);
-		if (!artifact) throw new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: { id },
-			logger: this.logger
+		if (!artifact) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-53",
+			message: "BadRequest",
+			context: { id }
 		});
 		return {
 			_id: artifact._id.toString(),
@@ -239,22 +245,29 @@ var ClientTaskManager = class {
 	}
 	async removeDecisionMachine(id) {
 		const success = await this.providerDB.removeDecisionMachineArtifact(id);
-		if (!success) throw new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+		if (!success) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-54",
+			message: "BadRequest",
 			context: {
 				id,
 				message: "Decision machine not found"
-			},
-			logger: this.logger
+			}
 		});
+		require_decisionMachineRunner.invalidateAllDecisionMachineArtifactCaches();
+		require_decisionMachineRunner.invalidateDecisionMachineScriptCache();
 		return {
 			success,
 			deletedId: id
 		};
 	}
 	async removeAllDecisionMachines() {
+		const deletedCount = await this.providerDB.removeAllDecisionMachineArtifacts();
+		require_decisionMachineRunner.invalidateAllDecisionMachineArtifactCaches();
+		require_decisionMachineRunner.invalidateDecisionMachineScriptCache();
 		return {
 			success: true,
-			deletedCount: await this.providerDB.removeAllDecisionMachineArtifacts()
+			deletedCount
 		};
 	}
 	/**

package/dist/cjs/tasks/dataset/datasetTasksUtils.cjs

@@ -2,16 +2,36 @@ let _prosopo_common = require("@prosopo/common");
 let _prosopo_datasets = require("@prosopo/datasets");
 //#region src/tasks/dataset/datasetTasksUtils.ts
 var providerValidateDataset = async (datasetRaw, minSolvedCaptchas, minUnsolvedCaptchas) => {
-	if (datasetRaw.captchas.length < minSolvedCaptchas + minUnsolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.CAPTCHAS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
+	if (datasetRaw.captchas.length < minSolvedCaptchas + minUnsolvedCaptchas) throw new _prosopo_common.ProsopoError({
+		code: "DATASET_INVALID",
+		errorSite: "PROV-55",
+		message: "Number of captchas in dataset is less than configured number of captchas",
+		context: { failedFuncName: providerValidateDataset.name }
+	});
 	const solutions = datasetRaw.captchas.map((captcha) => captcha.solution ? 1 : 0).reduce((partialSum, b) => partialSum + b, 0);
-	if (solutions < minSolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.SOLUTIONS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
-	if (datasetRaw.captchas.length - solutions < minUnsolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.CAPTCHAS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
+	if (solutions < minSolvedCaptchas) throw new _prosopo_common.ProsopoError({
+		code: "DATASET_INVALID",
+		errorSite: "PROV-56",
+		message: "Number of solutions in dataset is less than configured number of solutions",
+		context: { failedFuncName: providerValidateDataset.name }
+	});
+	if (datasetRaw.captchas.length - solutions < minUnsolvedCaptchas) throw new _prosopo_common.ProsopoError({
+		code: "DATASET_INVALID",
+		errorSite: "PROV-57",
+		message: "Number of captchas in dataset is less than configured number of captchas",
+		context: { failedFuncName: providerValidateDataset.name }
+	});
 	const dataset = await (0, _prosopo_datasets.buildDataset)(datasetRaw);
-	if (!dataset.datasetId || !dataset.datasetContentId) throw new _prosopo_common.ProsopoEnvError("DATASET.DATASET_ID_UNDEFINED", { context: {
-		failedFuncName: providerValidateDataset.name,
-		datasetId: dataset.datasetId,
-		datasetContentId: dataset.datasetContentId
-	} });
+	if (!dataset.datasetId || !dataset.datasetContentId) throw new _prosopo_common.ProsopoError({
+		code: "DATASET_INVALID",
+		errorSite: "PROV-58",
+		message: "Dataset id undefined",
+		context: {
+			failedFuncName: providerValidateDataset.name,
+			datasetId: dataset.datasetId,
+			datasetContentId: dataset.datasetContentId
+		}
+	});
 	return dataset;
 };
 //#endregion

package/dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs

@@ -44,18 +44,20 @@ var ARTIFACT_CACHE_TTL_MS = Number.parseInt(process.env.DECISION_MACHINE_ARTIFAC
 var DEFAULT_DECISION = { decision: _prosopo_types.DecisionMachineDecision.Allow };
 var RequiredCountersSchema = zod.z.array(_prosopo_types.CounterSpecSchema);
 /**
-* Bumped by {@link invalidateAllDecisionMachineArtifactCaches}. A runner
-* caches the value it last saw and drops its artifact cache whenever the two
-* diverge, which flushes every runner — including ones built after the
-* invalidation — without holding a reference to any of them.
-*
-* This replaces a registry of live runners, which assumed runners were built
-* once per process. They are built per request, so the registry grew without
-* bound and construction eventually began to fail. `WeakRef` did not bound
-* it: the set held the wrapper, which outlives its referent.
+* Bumped by {@link invalidateAllDecisionMachineArtifactCaches}. Each cache
+* records the generation it was filled under and is discarded once the two
+* diverge, which flushes every cache without holding a reference to any of
+* them.
 */
 var artifactCacheGeneration = 0;
 /**
+* Runners are built per request, so a cache owned by the runner never served
+* a second lookup and every decision paid two Mongo reads. The cache lives
+* with the database the runner reads from instead: one per process in
+* production, and still isolated between test doubles.
+*/
+var artifactCaches = /* @__PURE__ */ new WeakMap();
+/**
 * Flush every runner's in-memory artifact cache. Companion to
 * {@link invalidateDecisionMachineScriptCache}. Call both after any
 * `upsertDecisionMachineArtifact` upload.
@@ -66,19 +68,20 @@ var invalidateAllDecisionMachineArtifactCaches = () => {
 var DecisionMachineRunner = class DecisionMachineRunner {
 	constructor(db) {
 		this.db = db;
-		this.artifactCache = /* @__PURE__ */ new Map();
-		this.seenArtifactCacheGeneration = artifactCacheGeneration;
 	}
-	/** Drop every entry in this runner's artifact cache. */
+	/** Drop every cached artifact read from this runner's database. */
 	invalidateArtifactCache() {
 		this.artifactCache.clear();
 	}
-	/** Drop the cache if an invalidation happened since it was last consulted. */
-	dropArtifactCacheIfStale() {
-		if (this.seenArtifactCacheGeneration !== artifactCacheGeneration) {
-			this.seenArtifactCacheGeneration = artifactCacheGeneration;
-			this.artifactCache.clear();
-		}
+	get artifactCache() {
+		const cache = artifactCaches.get(this.db);
+		if (cache && cache.generation === artifactCacheGeneration) return cache.entries;
+		const fresh = {
+			generation: artifactCacheGeneration,
+			entries: /* @__PURE__ */ new Map()
+		};
+		artifactCaches.set(this.db, fresh);
+		return fresh.entries;
 	}
 	/** Build a cache key for a given scope + kind + dappAccount tuple. */
 	static cacheKey(scope, kind, dappAccount) {
@@ -86,7 +89,6 @@ var DecisionMachineRunner = class DecisionMachineRunner {
 	}
 	/** Return a cached artifact if still fresh, or undefined. */
 	getCachedArtifact(scope, kind, dappAccount) {
-		this.dropArtifactCacheIfStale();
 		const entry = this.artifactCache.get(DecisionMachineRunner.cacheKey(scope, kind, dappAccount));
 		if (!entry) return null;
 		if (Date.now() - entry.cachedAt > ARTIFACT_CACHE_TTL_MS) {

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -282,7 +282,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			const maxLevel = (0, _prosopo_captcha_severity.resolveMaxEscalationLevel)(this.routingContext?.puzzleMaxDifficulty ?? _prosopo_types.puzzleMaxDifficultyDefault, this.routingContext?.platform.isMobile ?? false);
 			const ceiling = finalReason === _prosopo_types.FrictionlessReason.OLD_TIMESTAMP ? Math.min(maxLevel, _prosopo_captcha_severity.MAX_STALE_PAYLOAD_LEVEL) : maxLevel;
 			const level = finalReason !== void 0 && _prosopo_types.NO_MEASUREMENT_REASONS.has(finalReason) ? 0 : (0, _prosopo_captcha_severity.severityToPuzzleDifficulty)(requestedSolvedImagesCount, this.routingContext?.baseImageRounds ?? this.config.captchas.solved.count, ceiling);
-			const difficulty = level > 0 ? require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken) : void 0;
+			const difficulty = level > 0 ? require_puzzleDifficulty.samplePuzzleDifficulty(level, _prosopo_puzzle_assets.DEFAULT_RENDER_SETTINGS.holeDarken, ceiling) : void 0;
 			const tolerance = routed.puzzleTolerance ?? difficulty?.tolerance;
 			const puzzle = routed.puzzle || difficulty ? {
 				...difficulty?.puzzle ?? {},

package/dist/cjs/tasks/frictionless/routingMachine.cjs

@@ -56,14 +56,15 @@ var applyRouter = async (runner, counters, baseline, ctx, logger, phase = "route
 };
 /**
 * Map machine-declared CounterSpecs onto the values that the provider knows
-* how to read (IP and userAccount). Specs whose dimension we cannot resolve
-* are silently skipped.
+* how to read. Specs whose dimension we cannot resolve are silently skipped,
+* so a rule naming `deviceBucket` on a request that disclosed no proof of
+* fingerprint simply does not get that key.
 */
 var specsToReads = (specs, ctx) => {
 	const out = [];
 	for (const spec of specs) {
-		const value = spec.dimension === "ip" ? ctx.ip : spec.dimension === "userAccount" ? ctx.userAccount : void 0;
-		if (value === void 0) continue;
+		const value = resolveDimension(spec.dimension, ctx);
+		if (value === void 0 || value === "") continue;
 		out.push({
 			spec,
 			value
@@ -71,5 +72,13 @@ var specsToReads = (specs, ctx) => {
 	}
 	return out;
 };
+var resolveDimension = (dimension, ctx) => {
+	switch (dimension) {
+		case "ip": return ctx.ip;
+		case "userAccount": return ctx.userAccount;
+		case "deviceBucket": return ctx.raw.fingerprintSummary?.bucketId;
+		case "peerIp": return;
+	}
+};
 //#endregion
 exports.applyRouter = applyRouter;