@prosopo/provider 5.19.4 → 5.20.1

package/dist/cjs/index.cjs

@@ -45,6 +45,7 @@ exports.getIpAddressFromComposite = require_compositeIpAddress.getIpAddressFromC
 exports.getJA4 = require_ja4Middleware.getJA4;
 exports.getPrioritisedAccessRule = require_blacklistRequestInspector.getPrioritisedAccessRule;
 exports.getRequestUserScope = require_blacklistRequestInspector.getRequestUserScope;
+exports.getServerVerifyPaths = require_startProviderApi.getServerVerifyPaths;
 exports.getUserFromJWT = require_startProviderApi.getUserFromJWT;
 exports.getVerdictCache = require_blacklistRequestInspector.getVerdictCache;
 exports.handshakeTimingMiddleware = require_handshakeTimingMiddleware.handshakeTimingMiddleware;

package/dist/cjs/tasks/captchaManager.cjs

@@ -552,9 +552,7 @@ var CaptchaManager = class CaptchaManager {
 	*
 	* @returns The blocking policy if user should be blocked, undefined otherwise
 	*/
-	async checkForHardBlock(userAccessRulesStorage, challengeRecord, userAccount, headers, coords, countryCode, asn) {
-		let headHash;
-		if (challengeRecord.sessionId) headHash = (await this.db.getSessionRecordBySessionId(challengeRecord.sessionId))?.decryptedHeadHash;
+	async checkForHardBlock(userAccessRulesStorage, challengeRecord, userAccount, headers, headHash, coords, countryCode, asn) {
 		const coordsString = coords ? JSON.stringify(coords) : void 0;
 		const ipAddressRecord = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
 		const userScope = require_blacklistRequestInspector.getRequestUserScope(headers, challengeRecord.ja4, ipAddressRecord.address, userAccount, headHash, coordsString, countryCode, asn);
@@ -581,8 +579,9 @@ var CaptchaManager = class CaptchaManager {
 	*   time (ipInfoMiddleware → storeXxxRecord), so by default we reuse it
 	*   instead of hitting the sidecar again.
 	* - If the dapp's server passed up the end user's current IP via the
-	*   verify call, look that up fresh — it's the "now" IP for filtering
-	*   and may differ from the IP that originally requested the captcha.
+	*   verify call, the caller looks that up fresh and passes the result as
+	*   `currentIpInfo` — it's the "now" IP for filtering and may differ from
+	*   the IP that originally requested the captcha.
 	* - When the session carries a `dnsEvent`, its `peerIp` and `resolverIp`
 	*   are enriched and passed alongside the primary IP.
 	* - The abuser category defaults to `{action:"block"}` so abusive
@@ -595,7 +594,7 @@ var CaptchaManager = class CaptchaManager {
 	* updates record / session state differently); this helper just returns
 	* the verdict.
 	*/
-	async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp, enrichedDnsEvent) {
+	async resolveTrafficFilterCheck(recordIpInfo, trafficFilter, currentIpInfo, enrichedDnsEvent) {
 		const effective = {
 			abuser: { action: _prosopo_types.TrafficFilterAction.Block },
 			...trafficFilter
@@ -604,8 +603,7 @@ var CaptchaManager = class CaptchaManager {
 			isBlocked: false,
 			matches: []
 		};
-		const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
-		return require_checkTrafficFilter.checkTrafficFilter(ipInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
+		return require_checkTrafficFilter.checkTrafficFilter(currentIpInfo ?? recordIpInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}
 	/**
 	* Does this client's tier entitle it to the bot score, and is there one?

package/dist/cjs/tasks/client/clientTasks.cjs

@@ -126,9 +126,11 @@ var ClientTaskManager = class {
 			if (newClientRecords) await this.providerDB.updateClientRecords(newClientRecords);
 			await this.providerDB.updateScheduledTaskStatus(taskID, _prosopo_types.ScheduledTaskStatus.Completed, { data: { clientRecords: newClientRecords.length } });
 		} catch (e) {
-			const getClientListError = new _prosopo_common.ProsopoApiError("DATABASE.UNKNOWN", {
-				context: { error: e },
-				logger: this.logger
+			const getClientListError = new _prosopo_common.ProsopoError({
+				code: "DB_QUERY_FAILED",
+				errorSite: "PROV-51",
+				message: "Unknown database error",
+				cause: e
 			});
 			this.logger.error(() => ({
 				err: getClientListError,
@@ -170,12 +172,14 @@ var ClientTaskManager = class {
 		await this.providerDB.removeClientRecords(accounts);
 	}
 	async updateDecisionMachine(scope, runtime, source, dappAccount, language, name, version, captchaType, kind) {
-		if (scope === _prosopo_types.DecisionMachineScope.Dapp && !dappAccount) throw new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+		if (scope === _prosopo_types.DecisionMachineScope.Dapp && !dappAccount) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-52",
+			message: "BadRequest",
 			context: {
 				scope,
 				dappAccount
-			},
-			logger: this.logger
+			}
 		});
 		const now = /* @__PURE__ */ new Date();
 		await this.providerDB.upsertDecisionMachineArtifact({
@@ -218,9 +222,11 @@ var ClientTaskManager = class {
 	}
 	async getDecisionMachine(id) {
 		const artifact = await this.providerDB.getDecisionMachineArtifactById(id);
-		if (!artifact) throw new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: { id },
-			logger: this.logger
+		if (!artifact) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-53",
+			message: "BadRequest",
+			context: { id }
 		});
 		return {
 			_id: artifact._id.toString(),
@@ -239,22 +245,29 @@ var ClientTaskManager = class {
 	}
 	async removeDecisionMachine(id) {
 		const success = await this.providerDB.removeDecisionMachineArtifact(id);
-		if (!success) throw new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+		if (!success) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-54",
+			message: "BadRequest",
 			context: {
 				id,
 				message: "Decision machine not found"
-			},
-			logger: this.logger
+			}
 		});
+		require_decisionMachineRunner.invalidateAllDecisionMachineArtifactCaches();
+		require_decisionMachineRunner.invalidateDecisionMachineScriptCache();
 		return {
 			success,
 			deletedId: id
 		};
 	}
 	async removeAllDecisionMachines() {
+		const deletedCount = await this.providerDB.removeAllDecisionMachineArtifacts();
+		require_decisionMachineRunner.invalidateAllDecisionMachineArtifactCaches();
+		require_decisionMachineRunner.invalidateDecisionMachineScriptCache();
 		return {
 			success: true,
-			deletedCount: await this.providerDB.removeAllDecisionMachineArtifacts()
+			deletedCount
 		};
 	}
 	/**

package/dist/cjs/tasks/dataset/datasetTasksUtils.cjs

@@ -2,16 +2,36 @@ let _prosopo_common = require("@prosopo/common");
 let _prosopo_datasets = require("@prosopo/datasets");
 //#region src/tasks/dataset/datasetTasksUtils.ts
 var providerValidateDataset = async (datasetRaw, minSolvedCaptchas, minUnsolvedCaptchas) => {
-	if (datasetRaw.captchas.length < minSolvedCaptchas + minUnsolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.CAPTCHAS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
+	if (datasetRaw.captchas.length < minSolvedCaptchas + minUnsolvedCaptchas) throw new _prosopo_common.ProsopoError({
+		code: "DATASET_INVALID",
+		errorSite: "PROV-55",
+		message: "Number of captchas in dataset is less than configured number of captchas",
+		context: { failedFuncName: providerValidateDataset.name }
+	});
 	const solutions = datasetRaw.captchas.map((captcha) => captcha.solution ? 1 : 0).reduce((partialSum, b) => partialSum + b, 0);
-	if (solutions < minSolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.SOLUTIONS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
-	if (datasetRaw.captchas.length - solutions < minUnsolvedCaptchas) throw new _prosopo_common.ProsopoEnvError("DATASET.CAPTCHAS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
+	if (solutions < minSolvedCaptchas) throw new _prosopo_common.ProsopoError({
+		code: "DATASET_INVALID",
+		errorSite: "PROV-56",
+		message: "Number of solutions in dataset is less than configured number of solutions",
+		context: { failedFuncName: providerValidateDataset.name }
+	});
+	if (datasetRaw.captchas.length - solutions < minUnsolvedCaptchas) throw new _prosopo_common.ProsopoError({
+		code: "DATASET_INVALID",
+		errorSite: "PROV-57",
+		message: "Number of captchas in dataset is less than configured number of captchas",
+		context: { failedFuncName: providerValidateDataset.name }
+	});
 	const dataset = await (0, _prosopo_datasets.buildDataset)(datasetRaw);
-	if (!dataset.datasetId || !dataset.datasetContentId) throw new _prosopo_common.ProsopoEnvError("DATASET.DATASET_ID_UNDEFINED", { context: {
-		failedFuncName: providerValidateDataset.name,
-		datasetId: dataset.datasetId,
-		datasetContentId: dataset.datasetContentId
-	} });
+	if (!dataset.datasetId || !dataset.datasetContentId) throw new _prosopo_common.ProsopoError({
+		code: "DATASET_INVALID",
+		errorSite: "PROV-58",
+		message: "Dataset id undefined",
+		context: {
+			failedFuncName: providerValidateDataset.name,
+			datasetId: dataset.datasetId,
+			datasetContentId: dataset.datasetContentId
+		}
+	});
 	return dataset;
 };
 //#endregion

package/dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs

@@ -44,18 +44,20 @@ var ARTIFACT_CACHE_TTL_MS = Number.parseInt(process.env.DECISION_MACHINE_ARTIFAC
 var DEFAULT_DECISION = { decision: _prosopo_types.DecisionMachineDecision.Allow };
 var RequiredCountersSchema = zod.z.array(_prosopo_types.CounterSpecSchema);
 /**
-* Bumped by {@link invalidateAllDecisionMachineArtifactCaches}. A runner
-* caches the value it last saw and drops its artifact cache whenever the two
-* diverge, which flushes every runner — including ones built after the
-* invalidation — without holding a reference to any of them.
-*
-* This replaces a registry of live runners, which assumed runners were built
-* once per process. They are built per request, so the registry grew without
-* bound and construction eventually began to fail. `WeakRef` did not bound
-* it: the set held the wrapper, which outlives its referent.
+* Bumped by {@link invalidateAllDecisionMachineArtifactCaches}. Each cache
+* records the generation it was filled under and is discarded once the two
+* diverge, which flushes every cache without holding a reference to any of
+* them.
 */
 var artifactCacheGeneration = 0;
 /**
+* Runners are built per request, so a cache owned by the runner never served
+* a second lookup and every decision paid two Mongo reads. The cache lives
+* with the database the runner reads from instead: one per process in
+* production, and still isolated between test doubles.
+*/
+var artifactCaches = /* @__PURE__ */ new WeakMap();
+/**
 * Flush every runner's in-memory artifact cache. Companion to
 * {@link invalidateDecisionMachineScriptCache}. Call both after any
 * `upsertDecisionMachineArtifact` upload.
@@ -66,19 +68,20 @@ var invalidateAllDecisionMachineArtifactCaches = () => {
 var DecisionMachineRunner = class DecisionMachineRunner {
 	constructor(db) {
 		this.db = db;
-		this.artifactCache = /* @__PURE__ */ new Map();
-		this.seenArtifactCacheGeneration = artifactCacheGeneration;
 	}
-	/** Drop every entry in this runner's artifact cache. */
+	/** Drop every cached artifact read from this runner's database. */
 	invalidateArtifactCache() {
 		this.artifactCache.clear();
 	}
-	/** Drop the cache if an invalidation happened since it was last consulted. */
-	dropArtifactCacheIfStale() {
-		if (this.seenArtifactCacheGeneration !== artifactCacheGeneration) {
-			this.seenArtifactCacheGeneration = artifactCacheGeneration;
-			this.artifactCache.clear();
-		}
+	get artifactCache() {
+		const cache = artifactCaches.get(this.db);
+		if (cache && cache.generation === artifactCacheGeneration) return cache.entries;
+		const fresh = {
+			generation: artifactCacheGeneration,
+			entries: /* @__PURE__ */ new Map()
+		};
+		artifactCaches.set(this.db, fresh);
+		return fresh.entries;
 	}
 	/** Build a cache key for a given scope + kind + dappAccount tuple. */
 	static cacheKey(scope, kind, dappAccount) {
@@ -86,7 +89,6 @@ var DecisionMachineRunner = class DecisionMachineRunner {
 	}
 	/** Return a cached artifact if still fresh, or undefined. */
 	getCachedArtifact(scope, kind, dappAccount) {
-		this.dropArtifactCacheIfStale();
 		const entry = this.artifactCache.get(DecisionMachineRunner.cacheKey(scope, kind, dappAccount));
 		if (!entry) return null;
 		if (Date.now() - entry.cachedAt > ARTIFACT_CACHE_TTL_MS) {

package/dist/cjs/tasks/frictionless/routingMachine.cjs

@@ -56,14 +56,15 @@ var applyRouter = async (runner, counters, baseline, ctx, logger, phase = "route
 };
 /**
 * Map machine-declared CounterSpecs onto the values that the provider knows
-* how to read (IP and userAccount). Specs whose dimension we cannot resolve
-* are silently skipped.
+* how to read. Specs whose dimension we cannot resolve are silently skipped,
+* so a rule naming `deviceBucket` on a request that disclosed no proof of
+* fingerprint simply does not get that key.
 */
 var specsToReads = (specs, ctx) => {
 	const out = [];
 	for (const spec of specs) {
-		const value = spec.dimension === "ip" ? ctx.ip : spec.dimension === "userAccount" ? ctx.userAccount : void 0;
-		if (value === void 0) continue;
+		const value = resolveDimension(spec.dimension, ctx);
+		if (value === void 0 || value === "") continue;
 		out.push({
 			spec,
 			value
@@ -71,5 +72,13 @@ var specsToReads = (specs, ctx) => {
 	}
 	return out;
 };
+var resolveDimension = (dimension, ctx) => {
+	switch (dimension) {
+		case "ip": return ctx.ip;
+		case "userAccount": return ctx.userAccount;
+		case "deviceBucket": return ctx.raw.fingerprintSummary?.bucketId;
+		case "peerIp": return;
+	}
+};
 //#endregion
 exports.applyRouter = applyRouter;

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -8,6 +8,7 @@ const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
+const require_signatureCheck = require("../signatureCheck.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
 const require_lang = require("../../rules/lang.cjs");
 const require_pairs = require("../../pairs.cjs");
@@ -29,24 +30,38 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	}
 	async getCaptchaWithProof(datasetId, solved, size) {
 		const captchaDocs = await this.db.getRandomCaptcha(solved, datasetId, size);
-		if (!captchaDocs) throw new _prosopo_common.ProsopoEnvError("DATABASE.CAPTCHA_GET_FAILED", { context: {
-			failedFuncName: this.getCaptchaWithProof.name,
-			datasetId,
-			solved,
-			size
-		} });
+		if (!captchaDocs) throw new _prosopo_common.ProsopoError({
+			code: "DB_QUERY_FAILED",
+			errorSite: "PROV-59",
+			message: "Failed to get captcha",
+			context: {
+				failedFuncName: this.getCaptchaWithProof.name,
+				datasetId,
+				solved,
+				size
+			}
+		});
 		return captchaDocs;
 	}
 	async getRandomCaptchasAndRequestHash(datasetId, userAccount, ipAddress, captchaConfig, threshold, sessionId, ipInfo) {
 		const dataset = await this.db.getDatasetDetails(datasetId);
-		if (!dataset) throw new _prosopo_common.ProsopoEnvError("DATABASE.DATASET_GET_FAILED", { context: {
-			failedFuncName: this.getRandomCaptchasAndRequestHash.name,
-			dataset,
-			datasetId
-		} });
+		if (!dataset) throw new _prosopo_common.ProsopoError({
+			code: "DB_QUERY_FAILED",
+			errorSite: "PROV-60",
+			message: "Failed to get dataset",
+			context: {
+				failedFuncName: this.getRandomCaptchasAndRequestHash.name,
+				dataset,
+				datasetId
+			}
+		});
 		const unsolvedCount = Math.abs(Math.trunc(captchaConfig.unsolved.count));
 		const solvedCount = Math.abs(Math.trunc(captchaConfig.solved.count));
-		if (!solvedCount) throw new _prosopo_common.ProsopoEnvError("CONFIG.INVALID_CAPTCHA_NUMBER");
+		if (!solvedCount) throw new _prosopo_common.ProsopoError({
+			code: "CONFIG_INVALID",
+			errorSite: "PROV-61",
+			message: "Please configure captchas configurations correctly"
+		});
 		const solved = await this.getCaptchaWithProof(datasetId, true, solvedCount);
 		let unsolved = [];
 		if (unsolvedCount) unsolved = await this.getCaptchaWithProof(datasetId, false, unsolvedCount);
@@ -81,23 +96,33 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @return {Promise<DappUserSolutionResult>} result containing the contract event
 	*/
 	async dappUserSolution(userAccount, dappAccount, requestHash, captchas, userTimestampSignature, timestamp, providerRequestHashSignature, ipAddress, headers, ja4, behavioralData, ipInfo, simdReadings, clientMetaData) {
-		if (!(0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(timestamp.toString()), userTimestampSignature, userAccount).isValid) {
-			const err = new _prosopo_common.ProsopoEnvError("GENERAL.INVALID_SIGNATURE", { context: {
-				failedFuncName: this.dappUserSolution.name,
-				userAccount
-			} });
+		if (!require_signatureCheck.isSignatureValid(timestamp.toString(), userTimestampSignature, userAccount)) {
+			const err = new _prosopo_common.ProsopoError({
+				code: "UNAUTHORIZED",
+				errorSite: "PROV-62",
+				message: "Invalid signature",
+				context: {
+					failedFuncName: this.dappUserSolution.name,
+					userAccount
+				}
+			});
 			this.logger.info(() => ({
 				err,
 				msg: "Invalid user timestamp signature"
 			}));
 			throw err;
 		}
-		if (!(0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(requestHash.toString()), providerRequestHashSignature, this.pair.address).isValid) {
-			const err = new _prosopo_common.ProsopoEnvError("GENERAL.INVALID_SIGNATURE", { context: {
-				failedFuncName: this.dappUserSolution.name,
-				userAccount,
-				error: "requestHash signature is invalid"
-			} });
+		if (!require_signatureCheck.isSignatureValid(requestHash.toString(), providerRequestHashSignature, this.pair.address)) {
+			const err = new _prosopo_common.ProsopoError({
+				code: "UNAUTHORIZED",
+				errorSite: "PROV-63",
+				message: "Invalid signature",
+				context: {
+					failedFuncName: this.dappUserSolution.name,
+					userAccount,
+					error: "requestHash signature is invalid"
+				}
+			});
 			this.logger.info(() => ({
 				err,
 				msg: "Invalid provider requestHash signature"
@@ -130,7 +155,12 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			const inputMethodsDeclared = receivedCaptchas.some((c) => c.inputMethods !== void 0);
 			const { tree, commitmentId } = require_imgCaptchaTasksUtils.buildTreeAndGetCommitmentId(receivedCaptchas);
 			const datasetId = (0, _prosopo_util.at)(storedCaptchas, 0).datasetId;
-			if (!datasetId) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.ID_MISMATCH", { context: { failedFuncName: this.dappUserSolution.name } });
+			if (!datasetId) throw new _prosopo_common.ProsopoError({
+				code: "INVALID_DATA",
+				errorSite: "PROV-64",
+				message: "captcha id mismatch",
+				context: { failedFuncName: this.dappUserSolution.name }
+			});
 			if (!await this.db.updatePendingImageCommitmentStatus(requestHash)) {
 				this.logger.info(() => ({ msg: "Request hash already consumed by a concurrent submission" }));
 				return response;
@@ -198,7 +228,11 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			await this.db.storeUserImageCaptchaSolution(receivedCaptchas, commit);
 			const solutionRecords = await Promise.all(storedCaptchas.map(async (captcha) => {
 				const solutionRecord = await this.db.getSolutionByCaptchaId(captcha.captchaId);
-				if (!solutionRecord) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.SOLUTION_NOT_FOUND", { context: { failedFuncName: this.dappUserSolution.name } });
+				if (!solutionRecord) throw new _prosopo_common.ProsopoError({
+					code: "SOLUTION_NOT_FOUND",
+					errorSite: "PROV-65",
+					context: { failedFuncName: this.dappUserSolution.name }
+				});
 				return solutionRecord;
 			}));
 			const totalImages = storedCaptchas[0]?.items.length || 0;
@@ -276,14 +310,24 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		const receivedCaptchas = (0, _prosopo_datasets.parseAndSortCaptchaSolutions)(captchas);
 		const captchaIds = receivedCaptchas.map((captcha) => captcha.captchaId);
 		const storedCaptchas = await this.db.getCaptchaById(captchaIds);
-		if (!storedCaptchas || receivedCaptchas.length !== storedCaptchas.length) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.INVALID_CAPTCHA_ID", { context: {
-			failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
-			captchas
-		} });
-		if (!storedCaptchas.every((captcha) => captcha.datasetId === (0, _prosopo_util.at)(storedCaptchas, 0).datasetId)) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DIFFERENT_DATASET_IDS", { context: {
-			failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
-			captchas
-		} });
+		if (!storedCaptchas || receivedCaptchas.length !== storedCaptchas.length) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_DATA",
+			errorSite: "PROV-66",
+			message: "Invalid captcha id",
+			context: {
+				failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
+				captchas
+			}
+		});
+		if (!storedCaptchas.every((captcha) => captcha.datasetId === (0, _prosopo_util.at)(storedCaptchas, 0).datasetId)) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_DATA",
+			errorSite: "PROV-67",
+			message: "Dataset ids do not match",
+			context: {
+				failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
+				captchas
+			}
+		});
 		return {
 			storedCaptchas,
 			receivedCaptchas,
@@ -312,10 +356,15 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	}
 	async getDappUserCommitmentById(commitmentId) {
 		const dappUserSolution = await this.db.getDappUserCommitmentById(commitmentId);
-		if (!dappUserSolution) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
-			failedFuncName: this.getDappUserCommitmentById.name,
-			commitmentId
-		} });
+		if (!dappUserSolution) throw new _prosopo_common.ProsopoError({
+			code: "SOLUTION_NOT_FOUND",
+			errorSite: "PROV-68",
+			message: "Dapp user solution not found",
+			context: {
+				failedFuncName: this.getDappUserCommitmentById.name,
+				commitmentId
+			}
+		});
 		return dappUserSolution;
 	}
 	async verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, disallowWebView, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId) {
@@ -378,8 +427,9 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			};
 			failStatus = _prosopo_types.ResultReason.CLIENT_SESSION_MISMATCH;
 		}
+		const sessionRecord = solution.sessionId ? await this.getSessionRecordWithOriginFallback(solution.sessionId) : void 0;
 		if (!failStatus && userAccessRulesStorage) try {
-			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, solution, solution.userAccount, solution.headers, solution.coords, solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0, solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0);
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, solution, solution.userAccount, solution.headers, sessionRecord?.decryptedHeadHash, solution.coords, solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0, solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0);
 			if (blockPolicy) {
 				logger.info(() => ({
 					msg: "User blocked by access policy in server image verification",
@@ -462,10 +512,9 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				}));
 			}
 		}
-		const sessionRecord = solution.sessionId ? await this.getSessionRecordWithOriginFallback(solution.sessionId) : void 0;
 		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? solution.ipInfo?.ip);
 		if (!failStatus) {
-			const check = await this.resolveTrafficFilterCheck(env, solution.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			const check = await this.resolveTrafficFilterCheck(solution.ipInfo, trafficFilter, ip ? await env.ipInfoService.lookup(ip) : void 0, enrichedDnsEvent);
 			if (check.isBlocked) {
 				logger.info(() => ({
 					msg: "Traffic filter rejected request",

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasksUtils.cjs

@@ -17,10 +17,15 @@ var nativeMerkle = (() => {
 * CaptchaMerkleTree so callers can still generate proofs.
 */
 var buildTreeAndGetCommitmentId = (captchaSolutions) => {
-	if (captchaSolutions.length === 0) throw new _prosopo_common.ProsopoEnvError("CONTRACT.CAPTCHA_SOLUTION_COMMITMENT_DOES_NOT_EXIST", { context: {
-		failedFuncName: buildTreeAndGetCommitmentId.name,
-		commitmentId: null
-	} });
+	if (captchaSolutions.length === 0) throw new _prosopo_common.ProsopoError({
+		code: "RECORD_NOT_FOUND",
+		errorSite: "PROV-69",
+		message: "Captcha solution commitment does not exist",
+		context: {
+			failedFuncName: buildTreeAndGetCommitmentId.name,
+			commitmentId: null
+		}
+	});
 	const layers = require_metrics.measureSync("merkle_build", () => {
 		const solutionsHashed = captchaSolutions.map((captcha) => nativeMerkle.computeCaptchaSolutionHash(captcha.captchaId, captcha.captchaContentId, captcha.solution, captcha.salt));
 		return nativeMerkle.buildMerkleLayers(solutionsHashed);
@@ -28,10 +33,15 @@ var buildTreeAndGetCommitmentId = (captchaSolutions) => {
 	const tree = new _prosopo_datasets.CaptchaMerkleTree();
 	tree.hydrateFromLayers(layers);
 	const commitmentId = tree.root?.hash;
-	if (!commitmentId) throw new _prosopo_common.ProsopoEnvError("CONTRACT.CAPTCHA_SOLUTION_COMMITMENT_DOES_NOT_EXIST", { context: {
-		failedFuncName: buildTreeAndGetCommitmentId.name,
-		commitmentId
-	} });
+	if (!commitmentId) throw new _prosopo_common.ProsopoError({
+		code: "RECORD_NOT_FOUND",
+		errorSite: "PROV-70",
+		message: "Captcha solution commitment does not exist",
+		context: {
+			failedFuncName: buildTreeAndGetCommitmentId.name,
+			commitmentId
+		}
+	});
 	return {
 		tree,
 		commitmentId

package/dist/cjs/tasks/interactiveCaptcha/interactiveCaptchaManager.cjs

@@ -183,18 +183,26 @@ var InteractiveCaptchaManager = class extends require_captchaManager.CaptchaMana
 			return notVerifiedResponse;
 		}
 		notVerifiedResponse.sessionId = challengeRecord.sessionId;
-		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoApiError("CAPTCHA.INVALID_SOLUTION", { context: {
-			code: 400,
-			failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
-			challenge
-		} });
+		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_SOLUTION",
+			errorSite: "PROV-71",
+			context: {
+				failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
+				challenge
+			}
+		});
 		if (challengeRecord.serverChecked) return notVerifiedResponse;
 		const challengeDappAccount = challengeRecord.dappAccount;
-		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
-			failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
-			dappAccount,
-			challengeDappAccount
-		} });
+		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoError({
+			code: "SOLUTION_NOT_FOUND",
+			errorSite: "PROV-72",
+			message: "Dapp user solution not found",
+			context: {
+				failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
+				dappAccount,
+				challengeDappAccount
+			}
+		});
 		if (!await this.markRecordChecked(challengeRecord.challenge)) return notVerifiedResponse;
 		const submittedAt = challengeRecord.submittedAtTimestamp;
 		if ((submittedAt instanceof Date ? Date.now() - submittedAt.getTime() : Number.POSITIVE_INFINITY) > timeout) {
@@ -209,8 +217,9 @@ var InteractiveCaptchaManager = class extends require_captchaManager.CaptchaMana
 			await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.CLIENT_SESSION_MISMATCH);
 			return notVerifiedResponse;
 		}
+		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
 		if (userAccessRulesStorage) try {
-			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, sessionRecord?.decryptedHeadHash, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
 			if (blockPolicy) {
 				logger.info(() => ({
 					msg: `User blocked by access policy in server ${this.logLabel} verification`,
@@ -268,10 +277,9 @@ var InteractiveCaptchaManager = class extends require_captchaManager.CaptchaMana
 				}));
 			}
 		}
-		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
 		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
 		{
-			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			const check = await this.resolveTrafficFilterCheck(challengeRecord.ipInfo, trafficFilter, ip ? await env.ipInfoService.lookup(ip) : void 0, enrichedDnsEvent);
 			if (check.isBlocked) {
 				logger.info(() => ({
 					msg: `Traffic filter rejected request in ${this.logLabel} verification`,

package/dist/cjs/tasks/powCaptcha/backgroundWrites.cjs

@@ -0,0 +1,24 @@
+//#region src/tasks/powCaptcha/backgroundWrites.ts
+/**
+* Lets writes finish after the response, but once `limit` are still pending
+* the caller waits for its own, so a slow database cannot pile them up.
+*/
+var BackgroundWrites = class {
+	constructor(limit) {
+		this.limit = limit;
+		this.pending = 0;
+	}
+	async add(writes, onError) {
+		const settled = writes.then(() => void 0, onError);
+		if (this.pending >= this.limit) {
+			await settled;
+			return;
+		}
+		this.pending++;
+		settled.finally(() => {
+			this.pending--;
+		});
+	}
+};
+//#endregion
+exports.BackgroundWrites = BackgroundWrites;