@prosopo/provider 5.5.1 → 5.6.1

package/dist/api/captcha/submitPoWCaptchaSolution.js

@@ -2,9 +2,9 @@ import { validateAddr, validateSiteKey } from "../validateAddress.js";
 import { downgradePuzzleIfUnavailable } from "../../tasks/puzzle/puzzleRenderer.js";
 import { Tasks } from "../../tasks/tasks.js";
 import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
+import { resolveTestSiteKeyVerdict } from "../testSiteKey.js";
 import { derivePlatform } from "../../utils/devicePlatform.js";
 import { rawTlsSignalsForSession } from "../rawTlsSignalsMiddleware.js";
-import { resolveTestSiteKeyVerdict } from "../testSiteKey.js";
 import { ProsopoApiError } from "@prosopo/common";
 import { CaptchaType, SubmitPowCaptchaSolutionBody } from "@prosopo/types";
 import { flatten, getIPAddress } from "@prosopo/util";

package/dist/api/hardBlockVerdictCache.d.ts

@@ -14,5 +14,5 @@ export declare class HardBlockVerdictCache {
     size(): number;
     inflightSize(): number;
 }
-export declare const hardBlockCacheKey: (clientId: string | undefined, userScope: UserScope, blockOnly: boolean) => string;
+export declare const hardBlockCacheKey: (clientId: string | undefined, userScope: UserScope, blockOnly: boolean, includeDeferred?: boolean) => string;
 //# sourceMappingURL=hardBlockVerdictCache.d.ts.map

package/dist/api/hardBlockVerdictCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hardBlockVerdictCache.d.ts","sourceRoot":"","sources":["../../src/api/hardBlockVerdictCache.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAWzE,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAOnD,eAAO,MAAM,iCAAiC,QAAS,CAAC;AAyBxD,qBAAa,qBAAqB;IAUhC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAV5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAMvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;gBAGnD,KAAK,GAAE,MAAqC,EAC5C,UAAU,GAAE,MAA0C;IAGxE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,SAAS;IAkB1C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI;IAyCrC,YAAY,CACjB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,GAClC,OAAO,CAAC,UAAU,EAAE,CAAC;IAkCxB,KAAK,IAAI,IAAI;IAKb,IAAI,IAAI,MAAM;IAKd,YAAY,IAAI,MAAM;CAGtB;AAOD,eAAO,MAAM,iBAAiB,aACnB,MAAM,GAAG,SAAS,aACjB,SAAS,aACT,OAAO,KAChB,MAqBF,CAAC"}
+{"version":3,"file":"hardBlockVerdictCache.d.ts","sourceRoot":"","sources":["../../src/api/hardBlockVerdictCache.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAWzE,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAOnD,eAAO,MAAM,iCAAiC,QAAS,CAAC;AAyBxD,qBAAa,qBAAqB;IAUhC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAV5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAMvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;gBAGnD,KAAK,GAAE,MAAqC,EAC5C,UAAU,GAAE,MAA0C;IAGxE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,SAAS;IAkB1C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI;IAyCrC,YAAY,CACjB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,GAClC,OAAO,CAAC,UAAU,EAAE,CAAC;IAkCxB,KAAK,IAAI,IAAI;IAKb,IAAI,IAAI,MAAM;IAKd,YAAY,IAAI,MAAM;CAGtB;AAWD,eAAO,MAAM,iBAAiB,aACnB,MAAM,GAAG,SAAS,aACjB,SAAS,aACT,OAAO,gCAEhB,MAqBF,CAAC"}

package/dist/api/hardBlockVerdictCache.js

@@ -96,8 +96,8 @@ var HardBlockVerdictCache = class {
 		return this.inflight.size;
 	}
 };
-var hardBlockCacheKey = (clientId, userScope, blockOnly) => {
-	return `${blockOnly ? "1" : "0"}|${[
+var hardBlockCacheKey = (clientId, userScope, blockOnly, includeDeferred = false) => {
+	return `${`${blockOnly ? "1" : "0"}${includeDeferred ? "d" : ""}`}|${[
 		clientId ?? "",
 		userScope.numericIp === void 0 ? "" : userScope.numericIp.toString(),
 		userScope.numericIpMaskMin === void 0 ? "" : userScope.numericIpMaskMin.toString(),

package/dist/api/hardBlockVerdictCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"hardBlockVerdictCache.js","sourceRoot":"","sources":["../../src/api/hardBlockVerdictCache.ts"],"names":[],"mappings":"AAyBA,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAOnD,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAyBxD,MAAM,OAAO,qBAAqB;IASjC,YACkB,QAAgB,4BAA4B,EAC5C,aAAqB,iCAAiC;QADtD,UAAK,GAAL,KAAK,CAAuC;QAC5C,eAAU,GAAV,UAAU,CAA4C;QAVvD,UAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;QAMtC,aAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAKlE,CAAC;IAEJ,GAAG,CAAC,GAAW;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QAClB,CAAC;QAKD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAmB;QAKnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAIxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YACnB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;SAClC,CAAC,CAAC;IACJ,CAAC;IAsBD,KAAK,CAAC,YAAY,CACjB,GAAW,EACX,OAAoC;QAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrB,OAAO,KAAK,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO,MAAM,OAAO,CAAC;QACtB,CAAC;gBAAS,CAAC;YAMV,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IAOD,KAAK;QACJ,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IAGD,YAAY;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC3B,CAAC;CACD;AAOD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAChC,QAA4B,EAC5B,SAAoB,EACpB,SAAkB,EACT,EAAE;IACX,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG;QACb,QAAQ,IAAI,EAAE;QACd,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE;QACvE,SAAS,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE;QACxC,SAAS,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE;QACxC,SAAS,CAAC,MAAM,IAAI,EAAE;QACtB,SAAS,CAAC,OAAO,IAAI,EAAE;QACvB,SAAS,CAAC,WAAW,IAAI,EAAE;QAC3B,SAAS,CAAC,aAAa,IAAI,EAAE;QAC7B,SAAS,CAAC,QAAQ,IAAI,EAAE;QACxB,SAAS,CAAC,MAAM,IAAI,EAAE;QACtB,SAAS,CAAC,WAAW,IAAI,EAAE;QAC3B,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;KACxD,CAAC;IACF,OAAO,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,CAAC,CAAC"}
+{"version":3,"file":"hardBlockVerdictCache.js","sourceRoot":"","sources":["../../src/api/hardBlockVerdictCache.ts"],"names":[],"mappings":"AAyBA,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAOnD,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAyBxD,MAAM,OAAO,qBAAqB;IASjC,YACkB,QAAgB,4BAA4B,EAC5C,aAAqB,iCAAiC;QADtD,UAAK,GAAL,KAAK,CAAuC;QAC5C,eAAU,GAAV,UAAU,CAA4C;QAVvD,UAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;QAMtC,aAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAKlE,CAAC;IAEJ,GAAG,CAAC,GAAW;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QAClB,CAAC;QAKD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAmB;QAKnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAIxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YACnB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;SAClC,CAAC,CAAC;IACJ,CAAC;IAsBD,KAAK,CAAC,YAAY,CACjB,GAAW,EACX,OAAoC;QAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrB,OAAO,KAAK,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO,MAAM,OAAO,CAAC;QACtB,CAAC;gBAAS,CAAC;YAMV,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IAOD,KAAK;QACJ,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IAGD,YAAY;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC3B,CAAC;CACD;AAWD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAChC,QAA4B,EAC5B,SAAoB,EACpB,SAAkB,EAClB,eAAe,GAAG,KAAK,EACd,EAAE;IACX,MAAM,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG;QACb,QAAQ,IAAI,EAAE;QACd,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE;QACvE,SAAS,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE;QACxC,SAAS,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE;QACxC,SAAS,CAAC,MAAM,IAAI,EAAE;QACtB,SAAS,CAAC,OAAO,IAAI,EAAE;QACvB,SAAS,CAAC,WAAW,IAAI,EAAE;QAC3B,SAAS,CAAC,aAAa,IAAI,EAAE;QAC7B,SAAS,CAAC,QAAQ,IAAI,EAAE;QACxB,SAAS,CAAC,MAAM,IAAI,EAAE;QACtB,SAAS,CAAC,WAAW,IAAI,EAAE;QAC3B,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;KACxD,CAAC;IACF,OAAO,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,CAAC,CAAC"}

package/dist/cjs/api/blacklistRequestInspector.cjs

@@ -130,9 +130,10 @@ var getOrCreateRequestMemo = (requestMemoHost) => {
 var getPrioritisedAccessRule = async (userAccessRulesStorage, userScope, clientId, options) => {
 	const parsedUserScope = _prosopo_user_access_policy.userScopeInput.parse(userScope);
 	const blockOnly = options?.blockOnly ?? false;
+	const includeDeferred = options?.includeDeferred ?? false;
 	const skipCache = options?.skipCache ?? false;
 	const requestMemoHost = options?.requestMemoHost;
-	const cacheKey = require_hardBlockVerdictCache.hardBlockCacheKey(clientId, parsedUserScope, blockOnly);
+	const cacheKey = require_hardBlockVerdictCache.hardBlockCacheKey(clientId, parsedUserScope, blockOnly, includeDeferred);
 	const requestMemo = requestMemoHost ? getOrCreateRequestMemo(requestMemoHost) : void 0;
 	if (requestMemo !== void 0) {
 		const memoHit = requestMemo.get(cacheKey);
@@ -143,7 +144,8 @@ var getPrioritisedAccessRule = async (userAccessRulesStorage, userScope, clientI
 		policyScopeMatch: _prosopo_user_access_policy.FilterScopeMatch.Greedy,
 		userScope: parsedUserScope,
 		userScopeMatch: _prosopo_user_access_policy.FilterScopeMatch.Greedy,
-		...blockOnly && { blockOnly: true }
+		...blockOnly && { blockOnly: true },
+		...includeDeferred && { includeDeferred: true }
 	};
 	const compute = async () => {
 		return rankCandidateRules(await userAccessRulesStorage.findRules(filter, true, true), parsedUserScope, clientId);

package/dist/cjs/api/block.cjs

@@ -1,11 +1,17 @@
 const require_blacklistRequestInspector = require("./blacklistRequestInspector.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("./admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("./testSiteKey.cjs");
 //#region src/api/block.ts
+var isReservedTestSiteKeyRequest = (req) => {
+	const siteKey = req.headers?.["prosopo-site-key"];
+	return typeof siteKey === "string" && require_testSiteKey.isReservedTestSiteKey(siteKey);
+};
 var blockMiddleware = (providerEnvironment) => {
 	let blacklistRequestInspector;
 	const environmentReadinessWaiter = providerEnvironment.isReady.bind(providerEnvironment);
 	return (req, res, next) => {
 		if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) return next();
+		if (isReservedTestSiteKeyRequest(req)) return next();
 		if (!blacklistRequestInspector) try {
 			const db = providerEnvironment.getDb();
 			const userAccessRulesStorage = db.getUserAccessRulesStorage();

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/constants.cjs

@@ -1,5 +1,26 @@
-//#region src/api/captcha/getFrictionlessCaptchaChallenge/constants.ts
-var DEFAULT_FRICTIONLESS_THRESHOLD = .5;
+let _prosopo_types = require("@prosopo/types");
+_prosopo_types.frictionlessPuzzleThresholdDefault;
+/**
+* A client record's configured ladder, in the terms the decision machine
+* compares against. Thin rename over `resolveFrictionlessThreshold`, which
+* owns the tolerance for records written before the ladder existed.
+*/
+var resolveScoreLadder = (configured) => {
+	const ladder = (0, _prosopo_types.resolveFrictionlessThreshold)(configured);
+	return {
+		botThreshold: ladder.frictionlessPuzzleThreshold,
+		botImageThreshold: ladder.frictionlessImageThreshold
+	};
+};
+/**
+* Size an image challenge by how much was actually found. `base` is the
+* sitekey's ordinary image round count; each triggered signal adds a round,
+* capped by `MAX_DETECTOR_EXTRA_IMAGE_ROUNDS`. A session with nothing
+* triggered gets exactly the baseline.
+*
+* The caller is still responsible for clamping to `imageMaxRounds`.
+*/
+var getRoundsFromTriggeredDetectors = (base, triggeredDetectors) => base + Math.min(triggeredDetectors?.length ?? 0, 6);
 var getRoundsFromSimScore = (simScore) => {
 	if (simScore >= .9) return 0;
 	if (simScore >= .8) return 3;
@@ -9,5 +30,6 @@ var getRoundsFromSimScore = (simScore) => {
 	return 8;
 };
 //#endregion
-exports.DEFAULT_FRICTIONLESS_THRESHOLD = DEFAULT_FRICTIONLESS_THRESHOLD;
 exports.getRoundsFromSimScore = getRoundsFromSimScore;
+exports.getRoundsFromTriggeredDetectors = getRoundsFromTriggeredDetectors;
+exports.resolveScoreLadder = resolveScoreLadder;

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs

@@ -149,6 +149,31 @@ var runDecisionMachine = async (input, handle) => {
 			headers: flatHeaders
 		}));
 	}
+	const scoredImageRounds = Math.min(require_constants.getRoundsFromTriggeredDetectors(env.config.captchas.solved.count, input.triggeredDetectors), clientRecord.settings.imageMaxRounds);
+	const botImageThreshold = input.botImageThreshold;
+	if (botImageThreshold > input.botThreshold && Number(botScore) > input.botThreshold && Number(botScore) < botImageThreshold) {
+		req.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "bot_score_puzzle_band",
+				captchaType: _prosopo_types.CaptchaType.puzzle,
+				botScore,
+				botThreshold: input.botThreshold,
+				botImageThreshold,
+				token: input.token
+			}
+		}));
+		require_metrics.recordFrictionlessDecision("bot_score_puzzle_band");
+		require_honeypotResponse.attachHoneypot(res, clientRecord);
+		return res.json(await tasks.frictionlessManager.sendPuzzleCaptcha({
+			solvedImagesCount: scoredImageRounds,
+			userSitekeyIpHash,
+			reason: _prosopo_types.FrictionlessReason.BOT_SCORE_PUZZLE_BAND,
+			siteKey: dapp,
+			ipInfo,
+			headers: flatHeaders
+		}));
+	}
 	if (Number(botScore) > input.botThreshold) {
 		req.logger.info(() => ({
 			msg: "Bot score is greater than threshold",
@@ -162,13 +187,15 @@ var runDecisionMachine = async (input, handle) => {
 			msg: "Frictionless decision",
 			data: {
 				decision: "bot_score_above_threshold",
-				captchaType: _prosopo_types.CaptchaType.image
+				captchaType: _prosopo_types.CaptchaType.image,
+				solvedImagesCount: scoredImageRounds,
+				triggeredDetectorCount: input.triggeredDetectors?.length ?? 0
 			}
 		}));
 		require_metrics.recordFrictionlessDecision("bot_score_above_threshold");
 		require_honeypotResponse.attachHoneypot(res, clientRecord);
 		return res.json(await tasks.frictionlessManager.sendImageCaptcha({
-			solvedImagesCount: Math.min(env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds),
+			solvedImagesCount: scoredImageRounds,
 			userSitekeyIpHash,
 			reason: _prosopo_types.FrictionlessReason.BOT_SCORE_ABOVE_THRESHOLD,
 			siteKey: dapp,

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -4,17 +4,17 @@ const require_metrics = require("../../metrics.cjs");
 const require_blacklistRequestInspector = require("../../blacklistRequestInspector.cjs");
 const require_tasks = require("../../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../../testSiteKey.cjs");
 const require_devicePlatform = require("../../../utils/devicePlatform.cjs");
 const require_hashUserAgent = require("../../../utils/hashUserAgent.cjs");
 const require_hashUserIp = require("../../../utils/hashUserIp.cjs");
 const require_normalizeRequestIp = require("../../../utils/normalizeRequestIp.cjs");
 const require_rawTlsSignalsMiddleware = require("../../rawTlsSignalsMiddleware.cjs");
-const require_testSiteKey = require("../../testSiteKey.cjs");
 const require_maintenanceModeResponses = require("../maintenanceModeResponses.cjs");
 const require_trafficFilterRequestTime = require("../trafficFilterRequestTime.cjs");
 const require_honeypotResponse = require("./honeypotResponse.cjs");
 const require_accessPolicy = require("./accessPolicy.cjs");
-require("./constants.cjs");
+const require_constants = require("./constants.cjs");
 const require_decisionMachine = require("./decisionMachine.cjs");
 const require_decryptSimdReadings = require("./decryptSimdReadings.cjs");
 const require_sessionDedup = require("./sessionDedup.cjs");
@@ -266,7 +266,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 		}));
 		require_metrics.recordBotScore(botScore);
 		if (triggeredDetectors && triggeredDetectors.length > 0) require_metrics.recordDetectorTriggered(triggeredDetectors);
-		const botThreshold = clientRecord.settings?.frictionlessThreshold || .5;
+		const { botThreshold, botImageThreshold } = require_constants.resolveScoreLadder(clientRecord.settings?.frictionlessThreshold);
 		let scoreComponents = {
 			baseScore: baseBotScore,
 			...lScore && { lScore },
@@ -312,6 +312,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			ip: normalizedIp,
 			countryCode,
 			score: botScore,
+			imageMaxRounds: clientRecord.settings.imageMaxRounds,
 			platform: require_devicePlatform.derivePlatform(safeUserAgent, webView, { ...typeof ipInfoMobile === "boolean" && { isMobile: ipInfoMobile } }),
 			raw: {
 				headers: flatHeaders,
@@ -325,7 +326,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 				...iframeUrl && { iframeUrl }
 			}
 		});
-		const userAccessPolicy = accessPolicies.find((p) => !p.deferToVerify);
+		const userAccessPolicy = accessPolicies.find((p) => !(p.deferToVerify === true && p.type === _prosopo_user_access_policy.AccessPolicyType.Block));
 		const accessPolicyOutcome = await require_accessPolicy.handleAccessPolicy({
 			tasks,
 			clientRecord,
@@ -376,6 +377,8 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			token,
 			headHash,
 			botThreshold,
+			botImageThreshold,
+			triggeredDetectors,
 			currentUrl,
 			iframeUrl
 		}, {

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -1,6 +1,6 @@
 const require_bundlePool = require("../../../tasks/detection/bundlePool.cjs");
 const require_honeypotResponse = require("./honeypotResponse.cjs");
-require("./constants.cjs");
+const require_constants = require("./constants.cjs");
 let _prosopo_types = require("@prosopo/types");
 let uuid = require("uuid");
 //#region src/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.ts
@@ -9,7 +9,7 @@ var buildBypassSessionParams = async (input) => {
 	return {
 		token: input.token || `nodetector-${(0, uuid.v4)()}`,
 		score: 0,
-		threshold: input.clientRecord.settings?.frictionlessThreshold ?? .5,
+		threshold: require_constants.resolveScoreLadder(input.clientRecord.settings?.frictionlessThreshold).botThreshold,
 		scoreComponents: { baseScore: 0 },
 		ipAddress: input.ipAddress,
 		webView: false,

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -3,6 +3,7 @@ const require_metrics = require("../metrics.cjs");
 const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
@@ -58,6 +59,17 @@ var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (r
 		}));
 		return res.json(require_maintenanceModeResponses.buildImageMaintenanceResponse());
 	}
+	if (require_testSiteKey.isReservedTestSiteKey(dapp)) {
+		req.logger.warn(() => ({
+			msg: "Reserved TEST site key - returning dummy image challenge",
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(require_maintenanceModeResponses.buildImageMaintenanceResponse());
+	}
 	const tasks = new require_tasks.Tasks(env, req.logger);
 	try {
 		const clientRecord = await tasks.db.getClientRecord(dapp);
@@ -73,7 +85,9 @@ var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (r
 		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
 		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
 		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
-		const userAccessPolicy = (await tasks.imgCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)).find((p) => !p.deferToVerify);
+		const accessPolicies = await tasks.imgCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope);
+		const userAccessPolicy = accessPolicies.find((p) => !p.deferToVerify);
+		const deferredParamsPolicy = accessPolicies.find((p) => p.deferToVerify === true);
 		const { valid, reason, sessionId: validSessionId, solvedImagesCount } = await tasks.imgCaptchaManager.isValidRequest(clientRecord, _prosopo_types.CaptchaType.image, env, sessionId, userAccessPolicy, normalizedIp);
 		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {
 			context: {
@@ -87,8 +101,8 @@ var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (r
 		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientRecord.settings?.trafficFilter, req.logger);
 		const trafficSolvedImagesCount = trafficVerdict.kind === "challenge" ? trafficVerdict.solvedImagesCount : void 0;
 		const captchaConfig = {
-			solved: { count: Math.min(trafficSolvedImagesCount || solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds ?? _prosopo_types.imageMaxRoundsDefault) },
-			unsolved: { count: userAccessPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count }
+			solved: { count: Math.min(trafficSolvedImagesCount || solvedImagesCount || userAccessPolicy?.solvedImagesCount || deferredParamsPolicy?.solvedImagesCount || env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds ?? _prosopo_types.imageMaxRoundsDefault) },
+			unsolved: { count: userAccessPolicy?.unsolvedImagesCount || deferredParamsPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count }
 		};
 		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
 			req.logger.warn(() => ({

package/dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs

@@ -4,6 +4,7 @@ const require_metrics = require("../metrics.cjs");
 const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
@@ -39,6 +40,17 @@ var getPoWCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req
 		}));
 		return res.json(require_maintenanceModeResponses.buildPowMaintenanceResponse(user, dapp));
 	}
+	if (require_testSiteKey.isReservedTestSiteKey(dapp)) {
+		req.logger.warn(() => ({
+			msg: "Reserved TEST site key - returning dummy PoW challenge",
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(require_maintenanceModeResponses.buildPowMaintenanceResponse(user, dapp));
+	}
 	const tasks = new require_tasks.Tasks(env, req.logger);
 	try {
 		const clientSettings = await tasks.db.getClientRecord(dapp);
@@ -56,7 +68,9 @@ var getPoWCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req
 		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
 		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
 		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
-		const userAccessPolicy = (await tasks.powCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)).find((p) => !p.deferToVerify);
+		const accessPolicies = await tasks.powCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope);
+		const userAccessPolicy = accessPolicies.find((p) => !p.deferToVerify);
+		const deferredParamsPolicy = accessPolicies.find((p) => p.deferToVerify === true);
 		const { valid, reason, sessionId: validSessionId, powDifficulty } = await tasks.powCaptchaManager.isValidRequest(clientSettings, _prosopo_types.CaptchaType.pow, env, sessionId, userAccessPolicy, normalizedIp);
 		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {
 			context: {
@@ -79,7 +93,7 @@ var getPoWCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req
 			logger: req.logger
 		}));
 		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientSettings.settings?.trafficFilter, req.logger);
-		const difficulty = (trafficVerdict.kind === "challenge" ? trafficVerdict.powDifficulty : void 0) || powDifficulty || userAccessPolicy?.powDifficulty || clientSettings?.settings?.powDifficulty;
+		const difficulty = (trafficVerdict.kind === "challenge" ? trafficVerdict.powDifficulty : void 0) || powDifficulty || userAccessPolicy?.powDifficulty || deferredParamsPolicy?.powDifficulty || clientSettings?.settings?.powDifficulty;
 		const challenge = await tasks.powCaptchaManager.getPowCaptchaChallenge(user, dapp, origin, difficulty);
 		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
 			req.logger.warn(() => ({

package/dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs

@@ -5,6 +5,7 @@ const require_blacklistRequestInspector = require("../blacklistRequestInspector.
 const require_puzzleRenderer = require("../../tasks/puzzle/puzzleRenderer.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
@@ -40,6 +41,17 @@ var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => async (
 		}));
 		return res.json(await require_maintenanceModeResponses.buildPuzzleMaintenanceResponse(user, dapp));
 	}
+	if (require_testSiteKey.isReservedTestSiteKey(dapp)) {
+		req.logger.warn(() => ({
+			msg: "Reserved TEST site key - returning dummy puzzle challenge",
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(await require_maintenanceModeResponses.buildPuzzleMaintenanceResponse(user, dapp));
+	}
 	const tasks = new require_tasks.Tasks(env, req.logger);
 	try {
 		const clientSettings = await tasks.db.getClientRecord(dapp);

package/dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs

@@ -2,9 +2,9 @@ const require_validateAddress = require("../validateAddress.cjs");
 const require_puzzleRenderer = require("../../tasks/puzzle/puzzleRenderer.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../testSiteKey.cjs");
 const require_devicePlatform = require("../../utils/devicePlatform.cjs");
 const require_rawTlsSignalsMiddleware = require("../rawTlsSignalsMiddleware.cjs");
-const require_testSiteKey = require("../testSiteKey.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");

package/dist/cjs/api/hardBlockVerdictCache.cjs

@@ -96,8 +96,8 @@ var HardBlockVerdictCache = class {
 		return this.inflight.size;
 	}
 };
-var hardBlockCacheKey = (clientId, userScope, blockOnly) => {
-	return `${blockOnly ? "1" : "0"}|${[
+var hardBlockCacheKey = (clientId, userScope, blockOnly, includeDeferred = false) => {
+	return `${`${blockOnly ? "1" : "0"}${includeDeferred ? "d" : ""}`}|${[
 		clientId ?? "",
 		userScope.numericIp === void 0 ? "" : userScope.numericIp.toString(),
 		userScope.numericIpMaskMin === void 0 ? "" : userScope.numericIpMaskMin.toString(),

package/dist/cjs/index.cjs

@@ -17,6 +17,7 @@ const require_headerCheckMiddleware = require("./api/headerCheckMiddleware.cjs")
 const require_ignoreMiddleware = require("./api/ignoreMiddleware.cjs");
 const require_robotsMiddleware = require("./api/robotsMiddleware.cjs");
 const require_startProviderApi = require("./api/startProviderApi.cjs");
+const require_frictionlessLadder = require("./migrations/frictionlessLadder.cjs");
 const require_captchaScheduler = require("./schedulers/captchaScheduler.cjs");
 const require_getClientList = require("./schedulers/getClientList.cjs");
 const require_updateSpamEmailDomains$1 = require("./schedulers/updateSpamEmailDomains.cjs");
@@ -51,11 +52,13 @@ exports.headerCheckMiddleware = require_headerCheckMiddleware.headerCheckMiddlew
 exports.ignoreMiddleware = require_ignoreMiddleware.ignoreMiddleware;
 exports.isTlsAvailable = require_startProviderApi.isTlsAvailable;
 exports.ja4Middleware = require_ja4Middleware.ja4Middleware;
+exports.migrateFrictionlessLadder = require_frictionlessLadder.migrateFrictionlessLadder;
 exports.prosopoRouter = require_captcha.prosopoRouter;
 exports.prosopoVerifyRouter = require_verify.prosopoVerifyRouter;
 exports.publicRouter = require_public.publicRouter;
 exports.rankCandidateRules = require_blacklistRequestInspector.rankCandidateRules;
 exports.robotsMiddleware = require_robotsMiddleware.robotsMiddleware;
+exports.runFrictionlessLadderMigration = require_frictionlessLadder.runFrictionlessLadderMigration;
 exports.shuffleArray = require_util.shuffleArray;
 exports.startProviderApi = require_startProviderApi.startProviderApi;
 exports.storeCaptchasExternally = require_captchaScheduler.storeCaptchasExternally;

package/dist/cjs/migrations/frictionlessLadder.cjs

@@ -0,0 +1,59 @@
+let _prosopo_types = require("@prosopo/types");
+//#region src/migrations/frictionlessLadder.ts
+/** Already the ladder object? Anything else gets rewritten. */
+var isLadder = (value) => typeof value === "object" && value !== null && "frictionlessPuzzleThreshold" in value && "frictionlessImageThreshold" in value;
+/**
+* Rewrite any pre-ladder `frictionlessThreshold` on this provider's client
+* records. Each record's existing number becomes its puzzle rung verbatim, so
+* no site's silent-pass boundary moves.
+*
+* Idempotent — records already carrying the object shape are skipped, so
+* restarting the container repeatedly is free after the first pass.
+*/
+var migrateFrictionlessLadder = async (db, logger) => {
+	const clients = db.tables?.client;
+	if (!clients) {
+		logger.warn(() => ({ msg: "Frictionless ladder migration skipped - no client table" }));
+		return {
+			scanned: 0,
+			migrated: 0
+		};
+	}
+	const records = await clients.find().lean();
+	const ops = records.filter((record) => record.account !== void 0 && !isLadder(record.settings?.frictionlessThreshold)).map((record) => {
+		const current = record.settings?.frictionlessThreshold;
+		return { updateOne: {
+			filter: { account: record.account },
+			update: { $set: { "settings.frictionlessThreshold": (0, _prosopo_types.resolveFrictionlessThreshold)(typeof current === "number" ? current : void 0) } }
+		} };
+	});
+	if (ops.length > 0) await clients.bulkWrite(ops);
+	logger.info(() => ({
+		msg: "Frictionless ladder migration complete",
+		data: {
+			scanned: records.length,
+			migrated: ops.length
+		}
+	}));
+	return {
+		scanned: records.length,
+		migrated: ops.length
+	};
+};
+/**
+* Boot-time wrapper. Never throws: a failed migration must not stop the
+* provider from serving, because the read path already handles the old shape.
+*/
+var runFrictionlessLadderMigration = async (db, logger) => {
+	try {
+		await migrateFrictionlessLadder(db, logger);
+	} catch (err) {
+		logger.error(() => ({
+			err,
+			msg: "Frictionless ladder migration failed - continuing startup"
+		}));
+	}
+};
+//#endregion
+exports.migrateFrictionlessLadder = migrateFrictionlessLadder;
+exports.runFrictionlessLadderMigration = runFrictionlessLadderMigration;

package/dist/cjs/tasks/captchaManager.cjs

@@ -438,7 +438,10 @@ var CaptchaManager = class CaptchaManager {
 		const coordsString = coords ? JSON.stringify(coords) : void 0;
 		const ipAddressRecord = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
 		const userScope = require_blacklistRequestInspector.getRequestUserScope(headers, challengeRecord.ja4, ipAddressRecord.address, userAccount, headHash, coordsString, countryCode, asn);
-		return findHardBlockPolicy(await this.getPrioritisedAccessPolicies(userAccessRulesStorage, challengeRecord.dappAccount, userScope, { blockOnly: true }));
+		return findHardBlockPolicy(await this.getPrioritisedAccessPolicies(userAccessRulesStorage, challengeRecord.dappAccount, userScope, {
+			blockOnly: true,
+			includeDeferred: true
+		}));
 	}
 	/**
 	* Checks if the provided email address has a domain in the spam email domain list.

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -189,7 +189,9 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		};
 		const routed = this.routingContext ? await require_routingMachine.applyRouter(this.decisionMachineRunner, this.usageCounters, baseline, this.routingContext, this.logger) : baseline;
 		const finalCaptchaType = require_puzzleRenderer.downgradePuzzleIfUnavailable(routed.captchaType, this.logger);
-		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? routed.solvedImagesCount ?? effectiveParams.solvedImagesCount : void 0;
+		const requestedSolvedImagesCount = routed.solvedImagesCount ?? effectiveParams.solvedImagesCount;
+		const imageRoundsCeiling = this.routingContext?.imageMaxRounds;
+		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? requestedSolvedImagesCount !== void 0 && imageRoundsCeiling !== void 0 ? Math.min(requestedSolvedImagesCount, imageRoundsCeiling) : requestedSolvedImagesCount : void 0;
 		const finalPowDifficulty = finalCaptchaType === _prosopo_types.CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
 		const blocked = finalCaptchaType === _prosopo_types.CaptchaType.image ? effectiveParams.blocked : void 0;
 		const sessionRecord = await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, finalCaptchaType, effectiveParams.siteKey, finalSolvedImagesCount, finalPowDifficulty, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, effectiveParams.reason, blocked, void 0, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g, effectiveParams.matchedRule, effectiveParams.i, effectiveParams.sw, effectiveParams.md, effectiveParams.bn, effectiveParams.fs, {

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export * from "./api/handshakeTimingMiddleware.js";
 export * from "./api/public.js";
 export * from "./api/domainMiddleware.js";
 export * from "./api/startProviderApi.js";
+export * from "./migrations/frictionlessLadder.js";
 export * from "./schedulers/captchaScheduler.js";
 export * from "./schedulers/getClientList.js";
 export * from "./schedulers/updateSpamEmailDomains.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oCAAoC,CAAC;AACnD,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oCAAoC,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oCAAoC,CAAC;AACnD,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAE1C,cAAc,oCAAoC,CAAC;AACnD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oCAAoC,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/index.js

@@ -18,7 +18,8 @@ import { headerCheckMiddleware } from "./api/headerCheckMiddleware.js";
 import { ignoreMiddleware } from "./api/ignoreMiddleware.js";
 import { robotsMiddleware } from "./api/robotsMiddleware.js";
 import { getClientApiPathsExpectingProsopoHeaders, getUserFromJWT, isTlsAvailable, startProviderApi } from "./api/startProviderApi.js";
+import { migrateFrictionlessLadder, runFrictionlessLadderMigration } from "./migrations/frictionlessLadder.js";
 import { storeCaptchasExternally } from "./schedulers/captchaScheduler.js";
 import { getClientList } from "./schedulers/getClientList.js";
 import { updateSpamEmailDomainsScheduler } from "./schedulers/updateSpamEmailDomains.js";
-export { BlacklistRequestInspector, DEFAULT_JA4, FrictionlessReason, Tasks, asyncHandler, blockMiddleware, checkIfTaskIsRunning, compareIPs, createApiAdminRoutesProvider, deepValidateIpAddress, domainMiddleware, encodeStringAddress, evaluateIpValidationRules, getClientApiPathsExpectingProsopoHeaders, getClientList, getCompositeIpAddress, getHandshakeTiming, getIPAddress, getIPAddressFromBigInt, getIpAddressFromComposite, getJA4, getPrioritisedAccessRule, getRequestUserScope, getUserFromJWT, getVerdictCache, handshakeTimingMiddleware, headerCheckMiddleware, ignoreMiddleware, isTlsAvailable, ja4Middleware, prosopoRouter, prosopoVerifyRouter, publicRouter, rankCandidateRules, robotsMiddleware, shuffleArray, startProviderApi, storeCaptchasExternally, updateSpamEmailDomains, updateSpamEmailDomainsScheduler, validateIpAddress };
+export { BlacklistRequestInspector, DEFAULT_JA4, FrictionlessReason, Tasks, asyncHandler, blockMiddleware, checkIfTaskIsRunning, compareIPs, createApiAdminRoutesProvider, deepValidateIpAddress, domainMiddleware, encodeStringAddress, evaluateIpValidationRules, getClientApiPathsExpectingProsopoHeaders, getClientList, getCompositeIpAddress, getHandshakeTiming, getIPAddress, getIPAddressFromBigInt, getIpAddressFromComposite, getJA4, getPrioritisedAccessRule, getRequestUserScope, getUserFromJWT, getVerdictCache, handshakeTimingMiddleware, headerCheckMiddleware, ignoreMiddleware, isTlsAvailable, ja4Middleware, migrateFrictionlessLadder, prosopoRouter, prosopoVerifyRouter, publicRouter, rankCandidateRules, robotsMiddleware, runFrictionlessLadderMigration, shuffleArray, startProviderApi, storeCaptchasExternally, updateSpamEmailDomains, updateSpamEmailDomainsScheduler, validateIpAddress };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oCAAoC,CAAC;AACnD,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oCAAoC,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oCAAoC,CAAC;AACnD,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAE1C,cAAc,oCAAoC,CAAC;AACnD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oCAAoC,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/migrations/frictionlessLadder.d.ts

@@ -0,0 +1,9 @@
+import type { Logger } from "@prosopo/logger";
+import type { IProviderDatabase } from "@prosopo/types-database";
+export type FrictionlessLadderMigrationResult = {
+    scanned: number;
+    migrated: number;
+};
+export declare const migrateFrictionlessLadder: (db: IProviderDatabase, logger: Logger) => Promise<FrictionlessLadderMigrationResult>;
+export declare const runFrictionlessLadderMigration: (db: IProviderDatabase, logger: Logger) => Promise<void>;
+//# sourceMappingURL=frictionlessLadder.d.ts.map

package/dist/migrations/frictionlessLadder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frictionlessLadder.d.ts","sourceRoot":"","sources":["../../src/migrations/frictionlessLadder.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAcjE,MAAM,MAAM,iCAAiC,GAAG;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CACjB,CAAC;AAUF,eAAO,MAAM,yBAAyB,OACjC,iBAAiB,UACb,MAAM,KACZ,OAAO,CAAC,iCAAiC,CAyC3C,CAAC;AAMF,eAAO,MAAM,8BAA8B,OACtC,iBAAiB,UACb,MAAM,KACZ,OAAO,CAAC,IAAI,CASd,CAAC"}

package/dist/migrations/frictionlessLadder.js

@@ -0,0 +1,58 @@
+import { resolveFrictionlessThreshold } from "@prosopo/types";
+//#region src/migrations/frictionlessLadder.ts
+/** Already the ladder object? Anything else gets rewritten. */
+var isLadder = (value) => typeof value === "object" && value !== null && "frictionlessPuzzleThreshold" in value && "frictionlessImageThreshold" in value;
+/**
+* Rewrite any pre-ladder `frictionlessThreshold` on this provider's client
+* records. Each record's existing number becomes its puzzle rung verbatim, so
+* no site's silent-pass boundary moves.
+*
+* Idempotent — records already carrying the object shape are skipped, so
+* restarting the container repeatedly is free after the first pass.
+*/
+var migrateFrictionlessLadder = async (db, logger) => {
+	const clients = db.tables?.client;
+	if (!clients) {
+		logger.warn(() => ({ msg: "Frictionless ladder migration skipped - no client table" }));
+		return {
+			scanned: 0,
+			migrated: 0
+		};
+	}
+	const records = await clients.find().lean();
+	const ops = records.filter((record) => record.account !== void 0 && !isLadder(record.settings?.frictionlessThreshold)).map((record) => {
+		const current = record.settings?.frictionlessThreshold;
+		return { updateOne: {
+			filter: { account: record.account },
+			update: { $set: { "settings.frictionlessThreshold": resolveFrictionlessThreshold(typeof current === "number" ? current : void 0) } }
+		} };
+	});
+	if (ops.length > 0) await clients.bulkWrite(ops);
+	logger.info(() => ({
+		msg: "Frictionless ladder migration complete",
+		data: {
+			scanned: records.length,
+			migrated: ops.length
+		}
+	}));
+	return {
+		scanned: records.length,
+		migrated: ops.length
+	};
+};
+/**
+* Boot-time wrapper. Never throws: a failed migration must not stop the
+* provider from serving, because the read path already handles the old shape.
+*/
+var runFrictionlessLadderMigration = async (db, logger) => {
+	try {
+		await migrateFrictionlessLadder(db, logger);
+	} catch (err) {
+		logger.error(() => ({
+			err,
+			msg: "Frictionless ladder migration failed - continuing startup"
+		}));
+	}
+};
+//#endregion
+export { migrateFrictionlessLadder, runFrictionlessLadderMigration };