@prosopo/provider 5.6.3 → 5.7.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/provider@5.6.3 build:cjs
+> @prosopo/provider@5.7.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -22,13 +22,13 @@ ViteCommonJSConfig: .
     '/home/runner/work/captcha/captcha/packages/api/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/types-env/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/keyring/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json'
   ]
 }
 {
-The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
   externals: [
     '@prosopo/api-route',
     '@prosopo/logger',
@@ -47,15 +47,17 @@ ViteCommonJSConfig: .
     '@prosopo/api',
     '@prosopo/types-env',
     '@prosopo/keyring',
+    '@prosopo/captcha-severity',
     '@prosopo/datasets',
     '@prosopo/load-balancer',
     '@prosopo/puzzle-assets'
   ]
 }
+The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 108 modules transformed.
+✓ 107 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/tasks/index.cjs                                                       0.08 kB │ gzip:  0.07 kB
@@ -71,7 +73,6 @@ dist/cjs/utils/hashUserIp.cjs                                                  0
 dist/cjs/api/testSiteKey.cjs                                                   0.65 kB │ gzip:  0.32 kB
 dist/cjs/utils/hashUserAgent.cjs                                               0.66 kB │ gzip:  0.40 kB
 dist/cjs/api/validateAddress.cjs                                               0.80 kB │ gzip:  0.36 kB
-dist/cjs/tasks/frictionless/frictionlessTasksUtils.cjs                         0.85 kB │ gzip:  0.43 kB
 dist/cjs/api/ja4.cjs                                                           0.85 kB │ gzip:  0.47 kB
 dist/cjs/api/dnsEventUrl.cjs                                                   0.85 kB │ gzip:  0.46 kB
 dist/cjs/tasks/dataset/datasetTasks.cjs                                        0.92 kB │ gzip:  0.41 kB
@@ -82,10 +83,10 @@ dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.cjs          1
 dist/cjs/tasks/powCaptcha/powTasksUtils.cjs                                    1.05 kB │ gzip:  0.50 kB
 dist/cjs/api/admin/apiRegisterSiteKeyEndpoint.cjs                              1.07 kB │ gzip:  0.48 kB
 dist/cjs/api/admin/apiRegisterSiteKeysEndpoint.cjs                             1.14 kB │ gzip:  0.52 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/constants.cjs             1.15 kB │ gzip:  0.60 kB
 dist/cjs/utils/normalizeRequestIp.cjs                                          1.16 kB │ gzip:  0.52 kB
 dist/cjs/api/admin/apiRemoveSiteKeysEndpoint.cjs                               1.16 kB │ gzip:  0.50 kB
 dist/cjs/api/admin/apiRemoveSiteKeyEndpoint.cjs                                1.17 kB │ gzip:  0.50 kB
-dist/cjs/api/captcha/contextAwareValidation.cjs                                1.17 kB │ gzip:  0.46 kB
 dist/cjs/schedulers/captchaScheduler.cjs                                       1.21 kB │ gzip:  0.50 kB
 dist/cjs/api/block.cjs                                                         1.28 kB │ gzip:  0.48 kB
 dist/cjs/schedulers/getClientList.cjs                                          1.28 kB │ gzip:  0.55 kB
@@ -95,7 +96,6 @@ dist/cjs/api/admin/apiRemoveAllDecisionMachinesEndpoint.cjs                    1
 dist/cjs/tasks/puzzle/backgroundBuffer.cjs                                     1.37 kB │ gzip:  0.52 kB
 dist/cjs/pairs.cjs                                                             1.39 kB │ gzip:  0.60 kB
 dist/cjs/tasks/dataset/datasetTasksUtils.cjs                                   1.42 kB │ gzip:  0.49 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/constants.cjs             1.42 kB │ gzip:  0.66 kB
 dist/cjs/utils/clientMetaData.cjs                                              1.48 kB │ gzip:  0.72 kB
 dist/cjs/compositeIpAddress.cjs                                                1.55 kB │ gzip:  0.57 kB
 dist/cjs/tasks/detection/getBotScore.cjs                                       1.55 kB │ gzip:  0.55 kB
@@ -118,56 +118,57 @@ dist/cjs/tasks/frictionless/routingMachine.cjs                                 2
 dist/cjs/api/public.cjs                                                        2.18 kB │ gzip:  0.91 kB
 dist/cjs/migrations/frictionlessLadder.cjs                                     2.19 kB │ gzip:  0.95 kB
 dist/cjs/tasks/puzzle/stratifiedSampler.cjs                                    2.20 kB │ gzip:  1.08 kB
+dist/cjs/tasks/frictionless/frictionlessTasksUtils.cjs                         2.21 kB │ gzip:  1.10 kB
 dist/cjs/tasks/captchaTypeSelection.cjs                                        2.44 kB │ gzip:  1.04 kB
 dist/cjs/api/admin/apiDnsEventEndpoint.cjs                                     2.59 kB │ gzip:  1.00 kB
 dist/cjs/utils/dns.cjs                                                         2.66 kB │ gzip:  1.02 kB
 dist/cjs/api/forwardVerify.cjs                                                 2.66 kB │ gzip:  1.12 kB
+dist/cjs/tasks/puzzle/puzzleDifficulty.cjs                                     2.66 kB │ gzip:  1.10 kB
 dist/cjs/api/captcha/checkSpamEmail.cjs                                        2.73 kB │ gzip:  0.95 kB
 dist/cjs/api/captcha/submitPuzzleCaptchaSolution.cjs                           2.77 kB │ gzip:  0.99 kB
 dist/cjs/api/captcha/maintenanceModeResponses.cjs                              2.91 kB │ gzip:  0.77 kB
 dist/cjs/api/captcha/submitImageCaptchaSolution.cjs                            2.93 kB │ gzip:  1.03 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs          3.64 kB │ gzip:  1.35 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs          3.66 kB │ gzip:  1.35 kB
 dist/cjs/api/admin/apiAdminRoutesProvider.cjs                                  3.67 kB │ gzip:  0.62 kB
 dist/cjs/api/rawTlsSignalsMiddleware.cjs                                       3.84 kB │ gzip:  1.16 kB
 dist/cjs/api/domainMiddleware.cjs                                              3.85 kB │ gzip:  1.26 kB
 dist/cjs/services/ipComparison.cjs                                             3.98 kB │ gzip:  1.20 kB
 dist/cjs/tasks/spam/evaluateEmailSpamRules.cjs                                 4.03 kB │ gzip:  1.60 kB
-dist/cjs/api/captcha/trafficFilterRequestTime.cjs                              4.12 kB │ gzip:  1.52 kB
 dist/cjs/tasks/spam/checkSpamEmail.cjs                                         4.14 kB │ gzip:  1.14 kB
-dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4.24 kB │ gzip:  1.51 kB
+dist/cjs/api/captcha/trafficFilterRequestTime.cjs                              4.17 kB │ gzip:  1.53 kB
+dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4.25 kB │ gzip:  1.51 kB
 dist/cjs/api/hardBlockVerdictCache.cjs                                         4.27 kB │ gzip:  1.70 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs          4.44 kB │ gzip:  1.05 kB
 dist/cjs/api/captcha.cjs                                                       4.51 kB │ gzip:  1.40 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs          4.56 kB │ gzip:  1.07 kB
 dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs                                     4.84 kB │ gzip:  1.74 kB
 dist/cjs/index.cjs                                                             4.85 kB │ gzip:  1.01 kB
 dist/cjs/tasks/tasks.cjs                                                       5.07 kB │ gzip:  1.57 kB
 dist/cjs/util/usageCounters.cjs                                                5.72 kB │ gzip:  2.03 kB
-dist/cjs/tasks/puzzle/puzzleDifficulty.cjs                                     5.78 kB │ gzip:  2.05 kB
 dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs                                6.65 kB │ gzip:  1.87 kB
-dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              7.01 kB │ gzip:  2.00 kB
+dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              6.98 kB │ gzip:  1.99 kB
+dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     7.47 kB │ gzip:  2.48 kB
 dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             7.48 kB │ gzip:  2.00 kB
 dist/cjs/api/metrics.cjs                                                       7.51 kB │ gzip:  2.12 kB
-dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     7.65 kB │ gzip:  2.55 kB
 dist/cjs/tasks/detection/bundlePool.cjs                                        8.72 kB │ gzip:  3.26 kB
-dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              8.85 kB │ gzip:  2.66 kB
+dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              8.93 kB │ gzip:  2.68 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs      10.33 kB │ gzip:  1.82 kB
 dist/cjs/api/startProviderApi.cjs                                             11.62 kB │ gzip:  3.70 kB
 dist/cjs/tasks/client/clientTasks.cjs                                         11.73 kB │ gzip:  3.04 kB
 dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs                      12.32 kB │ gzip:  3.81 kB
-dist/cjs/api/blacklistRequestInspector.cjs                                    12.41 kB │ gzip:  4.31 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs      12.53 kB │ gzip:  2.29 kB
+dist/cjs/api/blacklistRequestInspector.cjs                                    12.38 kB │ gzip:  4.27 kB
 dist/cjs/util.cjs                                                             13.25 kB │ gzip:  3.22 kB
-dist/cjs/api/verify.cjs                                                       13.86 kB │ gzip:  2.60 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              18.28 kB │ gzip:  4.29 kB
-dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             20.36 kB │ gzip:  5.39 kB
+dist/cjs/api/verify.cjs                                                       13.81 kB │ gzip:  2.58 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              18.33 kB │ gzip:  4.30 kB
+dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             20.29 kB │ gzip:  5.36 kB
 dist/cjs/tasks/captchaManager.cjs                                             22.33 kB │ gzip:  6.35 kB
 dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.03 kB │ gzip:  5.15 kB
 dist/cjs/tasks/powCaptcha/powTasks.cjs                                        24.84 kB │ gzip:  5.97 kB
-dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 28.41 kB │ gzip:  6.47 kB
+dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 28.20 kB │ gzip:  6.41 kB
 dist/cjs/tasks/detection/decodeBehavior.cjs                                   32.24 kB │ gzip: 10.32 kB
 dist/cjs/tasks/detection/decodeSimd.cjs                                       36.03 kB │ gzip: 11.96 kB
 dist/cjs/tasks/detection/decodePayload.cjs                                    49.79 kB │ gzip: 16.98 kB
 
-✓ built in 194ms
+✓ built in 209ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/provider@5.6.3 build:tsc
+> @prosopo/provider@5.7.0 build:tsc
 > tsc --build --verbose
 
-10:02:57 PM - Projects in this build: 
+10:40:18 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -21,54 +21,57 @@
     * ../types-env/tsconfig.json
     * ../env/tsconfig.json
     * ../api-express-router/tsconfig.json
+    * ../captcha-severity/tsconfig.json
     * ../datasets/tsconfig.json
     * ../load-balancer/tsconfig.json
     * ../puzzle-assets/tsconfig.json
     * tsconfig.json
 
-10:02:57 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/NodejsPolarsNativeFilePlugin.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/tests/apiRoute.unit.test.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/index.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/batches.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/types.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/ruleRecord.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types/captcha.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/redisCacheEscalation.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/tests/typesEnv.test-d.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/tests/env.maintenance.unit.test.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/tests/unit/apiExpressRouterFactory.unit.test.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+10:40:18 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/index.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+10:40:18 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-10:02:57 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+10:40:18 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+
+10:40:18 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/provider@5.6.3 build
+> @prosopo/provider@5.7.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/provider@5.6.3 build:cross-env
+> @prosopo/provider@5.7.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -26,6 +26,7 @@ ViteEsmConfig: .
     '/home/runner/work/captcha/captcha/packages/api/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/types-env/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/keyring/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json'
@@ -50,6 +51,7 @@ ViteEsmConfig: .
     '@prosopo/api',
     '@prosopo/types-env',
     '@prosopo/keyring',
+    '@prosopo/captcha-severity',
     '@prosopo/datasets',
     '@prosopo/load-balancer',
     '@prosopo/puzzle-assets'
@@ -59,7 +61,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 108 modules transformed.
+✓ 107 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js                                        0.04 kB │ gzip:  0.06 kB
@@ -76,7 +78,6 @@ dist/utils/hashUserIp.js                                                  0.52 k
 dist/api/testSiteKey.js                                                   0.56 kB │ gzip:  0.30 kB
 dist/utils/hashUserAgent.js                                               0.63 kB │ gzip:  0.39 kB
 dist/api/validateAddress.js                                               0.70 kB │ gzip:  0.33 kB
-dist/tasks/frictionless/frictionlessTasksUtils.js                         0.79 kB │ gzip:  0.42 kB
 dist/api/dnsEventUrl.js                                                   0.80 kB │ gzip:  0.44 kB
 dist/api/ja4.js                                                           0.80 kB │ gzip:  0.44 kB
 dist/tasks/dataset/datasetTasks.js                                        0.85 kB │ gzip:  0.39 kB
@@ -85,11 +86,11 @@ dist/api/headerCheckMiddleware.js                                         0.91 k
 dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js      0.95 kB │ gzip:  0.51 kB
 dist/api/admin/apiRegisterSiteKeyEndpoint.js                              1.00 kB │ gzip:  0.46 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.js          1.01 kB │ gzip:  0.45 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             1.04 kB │ gzip:  0.57 kB
 dist/api/admin/apiRemoveSiteKeysEndpoint.js                               1.07 kB │ gzip:  0.48 kB
 dist/api/admin/apiRegisterSiteKeysEndpoint.js                             1.08 kB │ gzip:  0.50 kB
 dist/api/admin/apiRemoveSiteKeyEndpoint.js                                1.08 kB │ gzip:  0.48 kB
 dist/api/block.js                                                         1.08 kB │ gzip:  0.46 kB
-dist/api/captcha/contextAwareValidation.js                                1.09 kB │ gzip:  0.45 kB
 dist/schedulers/captchaScheduler.js                                       1.11 kB │ gzip:  0.48 kB
 dist/utils/normalizeRequestIp.js                                          1.14 kB │ gzip:  0.52 kB
 dist/pairs.js                                                             1.19 kB │ gzip:  0.58 kB
@@ -97,7 +98,6 @@ dist/schedulers/getClientList.js                                          1.19 k
 dist/tasks/puzzle/backgroundBuffer.js                                     1.20 kB │ gzip:  0.50 kB
 dist/api/admin/apiGetDecisionMachineEndpoint.js                           1.26 kB │ gzip:  0.50 kB
 dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 kB │ gzip:  0.51 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             1.27 kB │ gzip:  0.63 kB
 dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip:  0.51 kB
 dist/tasks/dataset/datasetTasksUtils.js                                   1.30 kB │ gzip:  0.48 kB
 dist/compositeIpAddress.js                                                1.36 kB │ gzip:  0.55 kB
@@ -122,56 +122,57 @@ dist/api/captcha/assignDetectorBundle.js                                  1.90 k
 dist/migrations/frictionlessLadder.js                                     2.12 kB │ gzip:  0.93 kB
 dist/tasks/puzzle/stratifiedSampler.js                                    2.14 kB │ gzip:  1.07 kB
 dist/tasks/frictionless/routingMachine.js                                 2.16 kB │ gzip:  0.91 kB
+dist/tasks/frictionless/frictionlessTasksUtils.js                         2.16 kB │ gzip:  1.09 kB
 dist/api/captcha/maintenanceModeResponses.js                              2.16 kB │ gzip:  0.73 kB
 dist/tasks/captchaTypeSelection.js                                        2.22 kB │ gzip:  1.03 kB
 dist/utils/dns.js                                                         2.36 kB │ gzip:  0.95 kB
 dist/api/admin/apiDnsEventEndpoint.js                                     2.43 kB │ gzip:  0.96 kB
 dist/api/captcha/checkSpamEmail.js                                        2.47 kB │ gzip:  0.91 kB
+dist/tasks/puzzle/puzzleDifficulty.js                                     2.50 kB │ gzip:  1.09 kB
 dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.55 kB │ gzip:  0.96 kB
 dist/api/forwardVerify.js                                                 2.59 kB │ gzip:  1.10 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            2.59 kB │ gzip:  1.00 kB
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip:  0.55 kB
 dist/index.js                                                             2.86 kB │ gzip:  0.78 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.38 kB │ gzip:  1.32 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.39 kB │ gzip:  1.32 kB
 dist/api/domainMiddleware.js                                              3.52 kB │ gzip:  1.22 kB
 dist/api/rawTlsSignalsMiddleware.js                                       3.69 kB │ gzip:  1.13 kB
 dist/tasks/spam/evaluateEmailSpamRules.js                                 3.84 kB │ gzip:  1.59 kB
-dist/api/captcha/trafficFilterRequestTime.js                              3.89 kB │ gzip:  1.49 kB
-dist/tasks/puzzle/puzzleRenderer.js                                       3.90 kB │ gzip:  1.49 kB
+dist/tasks/puzzle/puzzleRenderer.js                                       3.91 kB │ gzip:  1.49 kB
+dist/api/captcha/trafficFilterRequestTime.js                              3.94 kB │ gzip:  1.51 kB
 dist/services/ipComparison.js                                             3.96 kB │ gzip:  1.19 kB
 dist/api/captcha.js                                                       4.05 kB │ gzip:  1.31 kB
 dist/tasks/spam/checkSpamEmail.js                                         4.12 kB │ gzip:  1.12 kB
 dist/api/hardBlockVerdictCache.js                                         4.14 kB │ gzip:  1.69 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.js          4.26 kB │ gzip:  1.05 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.js          4.35 kB │ gzip:  1.07 kB
 dist/tasks/tasks.js                                                       4.69 kB │ gzip:  1.51 kB
 dist/tasks/dnsEvent/enrichDnsEvent.js                                     4.71 kB │ gzip:  1.72 kB
-dist/tasks/puzzle/puzzleDifficulty.js                                     5.50 kB │ gzip:  2.02 kB
 dist/util/usageCounters.js                                                5.65 kB │ gzip:  2.01 kB
 dist/api/captcha/getPoWCaptchaChallenge.js                                6.02 kB │ gzip:  1.81 kB
-dist/api/captcha/getImageCaptchaChallenge.js                              6.38 kB │ gzip:  1.95 kB
+dist/api/captcha/getImageCaptchaChallenge.js                              6.28 kB │ gzip:  1.94 kB
 dist/api/captcha/getPuzzleCaptchaChallenge.js                             6.77 kB │ gzip:  1.95 kB
 dist/api/metrics.js                                                       6.96 kB │ gzip:  2.09 kB
-dist/tasks/spam/checkTrafficFilter.js                                     7.32 kB │ gzip:  2.53 kB
+dist/tasks/spam/checkTrafficFilter.js                                     7.16 kB │ gzip:  2.45 kB
 dist/tasks/detection/bundlePool.js                                        8.30 kB │ gzip:  3.21 kB
-dist/api/captcha/submitPoWCaptchaSolution.js                              8.37 kB │ gzip:  2.62 kB
+dist/api/captcha/submitPoWCaptchaSolution.js                              8.41 kB │ gzip:  2.63 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       9.36 kB │ gzip:  1.80 kB
 dist/api/startProviderApi.js                                              9.93 kB │ gzip:  3.42 kB
 dist/tasks/client/clientTasks.js                                         11.27 kB │ gzip:  3.00 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js      11.51 kB │ gzip:  2.27 kB
-dist/api/blacklistRequestInspector.js                                    11.85 kB │ gzip:  4.28 kB
+dist/api/blacklistRequestInspector.js                                    11.79 kB │ gzip:  4.24 kB
 dist/tasks/decisionMachine/decisionMachineRunner.js                      11.93 kB │ gzip:  3.75 kB
-dist/api/verify.js                                                       12.52 kB │ gzip:  2.49 kB
+dist/api/verify.js                                                       12.48 kB │ gzip:  2.48 kB
 dist/util.js                                                             12.57 kB │ gzip:  3.17 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              17.07 kB │ gzip:  4.20 kB
-dist/tasks/frictionless/frictionlessTasks.js                             19.88 kB │ gzip:  5.37 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              17.12 kB │ gzip:  4.21 kB
+dist/tasks/frictionless/frictionlessTasks.js                             19.77 kB │ gzip:  5.32 kB
 dist/tasks/captchaManager.js                                             21.82 kB │ gzip:  6.29 kB
 dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.62 kB │ gzip:  5.11 kB
 dist/tasks/powCaptcha/powTasks.js                                        23.47 kB │ gzip:  5.93 kB
-dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.97 kB │ gzip:  6.43 kB
+dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.67 kB │ gzip:  6.34 kB
 dist/tasks/detection/decodeBehavior.js                                   32.26 kB │ gzip: 10.34 kB
 dist/tasks/detection/decodeSimd.js                                       36.06 kB │ gzip: 12.00 kB
 dist/tasks/detection/decodePayload.js                                    49.69 kB │ gzip: 16.96 kB
 
-✓ built in 212ms
+✓ built in 143ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,209 @@
 # @prosopo/provider
 
+## 5.7.0
+### Minor Changes
+
+- 8a670d3: Remove the provider-side context validation path.
+  
+  The provider read a per-context baseline out of `clientcontextentropies` on the frictionless path and compared a session's head hash against it. The task that wrote that collection was removed from the provider on 2026-08-21, so the read has returned `undefined` ever since and the branch has been dead in every deployment since then. Computing and applying the baseline now happens off-provider.
+  
+  Removed: `contextAwareValidation.ts`, the decision-machine branch that used it, `getClientContextEntropy` on the provider and its database method, the `clientContextEntropy` table registration, the unused `getRoundsFromSimScore` helper, and the `contextAwareEnabled` parameter threaded into image verification — which logged and then did nothing, its return commented out.
+  
+  Also removes the per-site `settings.contextAware` block that configured it, along with `ContextAwareSchema`, `IContextAware`, `IContexts`, `ContextConfigSchema`, `contextAwareThresholdDefault` and `expandContexts`, the legacy `default`/`webview` context keys and their helpers, and `FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED`. The site-key registration CLI no longer writes a `contextAware` default into new sites.
+  
+  `ContextType`, `contextTypeFromSession` and `deviceContextTypes` stay — the off-provider work keys on them. `ClientContextEntropyRecord` and its schema stay for the same reason; only the provider's use of them goes.
+  
+  No behaviour change: every path removed here was already inert.
+
+### Patch Changes
+
+- 7fd6eb2: Add a `browser` match dimension to access rules.
+  
+  Rules can now be scoped to the browser classified server-side from the request
+  User-Agent (`chrome`, `safari`, `firefox`, `edge`, `opera`, `samsung_internet`,
+  `wechat`, `facebook`, `instagram`, `ie`, `unknown`), mirroring the existing `os`
+  dimension. The classifier duplicates `@prosopo/decision-machines`' `uaClassify`
+  because the provider request path cannot depend on that package.
+  
+  Also fixes `os` never getting its own probe on the Redis split-query hot path:
+  `SCALAR_USER_SCOPE_FIELDS` in `redisRulesSplitQuery` had not been updated when
+  the OS dimension landed, so an OS-only rule was reachable only via the
+  `no-user-scope` fall-through, competing for that probe's candidate budget
+  against genuine client-wide blocks.
+  
+  The Redis index gains a `browser` TAG field. `createRedisIndex` hashes the index
+  definition and drops/recreates when the hash changes, so this needs no manual
+  migration — verified locally: the index came back carrying `browser` and the
+  stored hash moved to match.
+- 424e467: Add `@prosopo/captcha-severity` and use it for the access rules and the traffic filter.
+  
+  "Which captcha challenge is stricter" is one idea with several callers, and each answered it with its own table: the traffic filter combining multiple `challenge` matches on one request (`resolveChallengePolicy`), the access rules breaking ties between equally-specific rules (`ruleHarshness`), and downstream routing consumers. They agreed on the order — image > puzzle > pow > frictionless — but nothing held them to it, and they disagreed on the encoding.
+  
+  The new package has **zero dependencies**, deliberately. Captcha types are string enums, so a plain `string` parameter accepts them without importing `CaptchaType` — and that import would not be free, because it lives in a module that pulls zod in for its schemas. Some consumers bundle this standalone under a hard source-size ceiling that a runtime dependency on the `@prosopo/types` barrel has breached before.
+  
+  Two APIs, because "stricter" means two different things:
+  
+  - `rankCaptchaType` / `isStricterCaptchaType` compare the **type alone**, for callers that choose the type independently of its settings — as the traffic filter does, picking the strictest type and then separately merging the hardest parameters from every matched category.
+  - `captchaPolicySeverity` / `isStricterCaptchaPolicy` compare a **whole policy**, type first and its own difficulty setting second, for callers where one complete policy must beat another and a tie on type alone would otherwise be decided by argument order.
+  
+  **Fixes an ordering bug in the access rules.** `ruleHarshness` scored `base + solvedImagesCount` with tiers 10 apart, and `solvedImagesCount` is validated by `imageMaxRoundsFieldSchema` — `number().int().min(2)`, with no upper bound and an `imageMaxRounds` default of 32. A `Restrict[pow]` rule carrying 32 rounds therefore scored 42 and outranked a `Restrict[image]` rule at 30, exactly inverting the intended order; 11 rounds on a puzzle rule was enough to do it. The intra-type component is now clamped below the tier gap, so no setting can lift a rule over a stricter captcha type.
+  
+  One further behaviour change: pow rules now break ties on `powDifficulty` rather than `solvedImagesCount`. Rule authoring drops `solvedImagesCount` for pow, so every pow rule previously scored at the bottom of its tier regardless of difficulty. Image and puzzle both keep `solvedImagesCount` — it is the severity currency they share, which the provider maps onto a puzzle difficulty level via `severityToPuzzleDifficulty` rather than treating as a literal round count.
+- 89dd38a: chore(deps): batch the outstanding dependabot bumps into one upgrade
+  
+  Rolls up dependabot PRs #3112, #3127-#3134 and #3159. Majors: `mongoose`
+  8 -> 9, `bson` 6 -> 7, `@noble/curves` 1 -> 2, `@polkadot/util-crypto`
+  13 -> 14, `@typegoose/auto-increment` 4 -> 5, `@babel/preset-env` 7 -> 8,
+  `@types/jsdom` 21 -> 30, `@types/bcrypt` 5 -> 6, `@actions/github` 6 -> 9,
+  `testcontainers` 11 -> 12. The rest are minor/patch.
+  
+  Code changes the majors forced:
+  - `@noble/curves` v2 requires `.js` specifiers and renamed the point API,
+    so `secp256k1.ProjectivePoint.fromHex(...).toRawBytes()` becomes
+    `secp256k1.Point.fromBytes(...).toBytes()`, `RistrettoPoint` becomes
+    `ristretto255.Point`, and `abstract/utils` moves to `utils.js`.
+  - mongoose 9 drops `RootFilterQuery` (now `QueryFilter`), no longer sets
+    `background: true` on schema indexes by default, and no longer declares
+    `id` on `Document`, which un-hid a mismatch between
+    `updateDappUserCommitment`'s `Hash` parameter and the `string` `id` it
+    filters on.
+  - mongoose 9 rejects an aggregation-pipeline update (an array) unless the
+    call passes `updatePipeline: true`, so the six pipeline writes in
+    `ProviderDatabase` now opt in explicitly.
+  - mongoose 9's `castUpdate` throws on a `$setOnInsert` key inside `$set`.
+    `storeUserImageCaptchaSolution` passed its record straight in as the
+    update, and mongoose's `moveImmutableProperties` mutates that object on
+    an upsert -- adding the very `$setOnInsert` key the record then carried
+    into `CentralDbStreamer.streamImageRecord`. Image records stopped
+    reaching the central DB (the streamer is fire-and-forget, so it only
+    logged) and signup verification returned 500. The update is now an
+    explicit `$set` over a shallow copy.
+  - `@prosopo/database` moves from mongodb 6.20 to 7.5 to match the driver
+    mongoose 9 pulls, so bson 7 is the only copy resolvable in the package.
+  - `vitest`/`@vitest/coverage-v8` go to 4.1.11 alongside dependabot's
+    `@vitest/spy` bump; leaving them at 4.1.10 installed a second copy of
+    `@vitest/spy` and broke type inference in the provider test utils.
+- 4810cb3: Fix `computeFrictionlessScore` returning `NaN` when `scoreComponents` carries a non-numeric field.
+  
+  The score was summed with `Object.values(...).reduce((acc, val) => acc + val, 0)` over every defined value. `ScoreComponents` also carries two non-numeric diagnostic fields — `triggeredDetectors` (`number[]`) and `shadowDomPenalty` (`boolean`) — and neither has an arithmetic weight anywhere in the scoring path. `+` on an array coerces the accumulator to a string, so any numeric component summed *after* an array turned the running total into string concatenation and the final `Math.min(1, ...)` into `NaN`:
+  
+  ```
+  0.42 + []    -> "0.42"
+  "0.42" + 0.3 -> "0.420.3"
+  Math.min(1, "0.420.3") -> NaN
+  ```
+  
+  This was reachable in production rather than theoretical. The Mongoose schema declares `triggeredDetectors` as an array path and Mongoose defaults array paths to `[]`, so the field is present on every session read back from the database even when the frictionless handler omitted it; the pow / puzzle / image tasks then spread `dnsAsymmetry` on afterwards, landing it after the array in key order. Every solve-time recompute on a session with `dnsAsymmetry > 0` produced `NaN`.
+  
+  Only numeric values now contribute. `shadowDomPenalty` no longer silently adds a full `1.0` when true. A genuinely numeric `NaN` component still propagates — `typeof NaN === "number"`, so it survives the filter deliberately — because a score that cannot be computed must not read as a low one.
+  
+  The recomputed value is not persisted (neither `sessions` nor `usercommitments` stores it) and no decide rule currently branches on `input.score`, so the impact to date was a `NaN` in the solve-time log line and in `DecisionMachineInput.score`.
+- 3d2176d: Move the puzzle difficulty ladder into `@prosopo/captcha-severity`, so every consumer derives a difficulty from one table.
+  
+  `PUZZLE_DIFFICULTY_LEVELS`, `MAX_AUTO_ESCALATION_LEVEL`, `MIN_DECOY_HOLE_DARKEN_MARGIN`, `clampDifficultyLevel` and `severityToPuzzleDifficulty` lived in `provider/src/tasks/puzzle/puzzleDifficulty.ts`, reachable only from inside the provider — the severity package's own docs described the ladder at length but did not hold it. Anything else that has to answer "what difficulty is this puzzle" had to restate the mapping, and the consumers that author and edit puzzle rules sit outside the provider.
+  
+  They can import it now. The severity package already answers "which of these policies is stricter" off `solvedImagesCount`; the ladder answers what a puzzle policy carrying that number is actually served at, which is the same question one step further in.
+  
+  Sampling a concrete render from a level's bands stays in the provider as `samplePuzzleDifficulty`: it needs `IPuzzleSettings` from `@prosopo/types` and a `node:crypto`-backed sampler, and the severity package's zero-dependency, browser-safe property is load-bearing for consumers that bundle it standalone.
+  
+  Adds `puzzleDifficultyToSeverity`, the inverse of `severityToPuzzleDifficulty`. Writers need that direction — a rule editor turning a chosen difficulty into the field the rule carries, or rule authoring normalising a count inherited from the image path. Each level spans two rounds, so without a canonical value per level a writer picks between numbers that produce the identical puzzle, and the difference survives only to break severity ties arbitrarily. The round-trip is pinned by tests.
+  
+  No behaviour change in the provider: same table, same thresholds, same clamping.
+- Updated dependencies [7fd6eb2]
+- Updated dependencies [424e467]
+- Updated dependencies [1b77849]
+- Updated dependencies [89dd38a]
+- Updated dependencies [80f73c1]
+- Updated dependencies [3d2176d]
+- Updated dependencies [8fce190]
+- Updated dependencies [8a670d3]
+  - @prosopo/user-access-policy@3.12.33
+  - @prosopo/captcha-severity@1.1.0
+  - @prosopo/util-crypto@13.5.31
+  - @prosopo/api@4.1.5
+  - @prosopo/api-express-router@3.1.81
+  - @prosopo/api-route@2.6.57
+  - @prosopo/common@3.1.53
+  - @prosopo/database@4.0.27
+  - @prosopo/datasets@3.1.77
+  - @prosopo/env@3.6.50
+  - @prosopo/ipinfo@0.3.22
+  - @prosopo/keyring@2.9.84
+  - @prosopo/load-balancer@2.10.39
+  - @prosopo/locale@3.4.1
+  - @prosopo/logger@2.0.8
+  - @prosopo/redis-client@1.0.34
+  - @prosopo/types@5.6.0
+  - @prosopo/types-database@5.4.0
+  - @prosopo/types-env@2.10.44
+  - @prosopo/util@3.3.8
+  - @prosopo/native-ja4@0.0.4
+  - @prosopo/native-merkle@0.0.4
+
+## 5.6.4
+### Patch Changes
+
+- a62b994: Context-aware validation buckets by device type, not just webview.
+  
+  Context-aware validation compares a session's head SimHash against a baseline
+  for its context. That context was `default | webview`, which puts a phone and
+  a desktop in the same bucket — and those two emit genuinely different
+  `<head>`s, so the blended baseline matches neither well. Contexts are now the
+  device family crossed with the webview flag: `desktop`, `desktop-webview`,
+  `mobile`, `mobile-webview`, `tablet`, `tablet-webview`.
+  
+  `desktop-webview` is included deliberately. Desktop webviews are a real and
+  notably fraudulent population here (see the Twickets desktop-webview rules),
+  and folding them into the plain `desktop` baseline would let exactly the
+  traffic we want excluded define what "normal desktop" looks like.
+  
+  **Classification.** `deviceTypeFromUserAgent` in `@prosopo/types` is a
+  dependency-free UA classifier, deliberately not ua-parser-js: this module is
+  imported by the browser bundles, and the off-provider entropy sweep has to
+  bucket stored sessions *identically* or it writes baselines the decision
+  machine never looks up. One shared function keeps the two sides in lockstep.
+  Tablets are matched before phones because an iPad's UA carries a
+  `Mobile/<build>` token and an Android tablet is exactly "Android without
+  Mobile". Known gap, documented at the call site: an iPadOS 13+ Safari in
+  desktop mode identifies as a Mac and lands in `desktop` — nothing in the UA
+  separates it from a real Mac, and both sides make the same call, which is
+  what matters for the lookup.
+  
+  **Back-compat.** `default` and `webview` remain valid `ContextType` members,
+  so settings already stored against them keep parsing. `expandContexts` maps a
+  legacy `default` onto the three non-webview families and a legacy `webview`
+  onto the three webview families, at the threshold they were saved with; an
+  explicit device entry always wins over the legacy entry covering it. Nothing
+  downstream of settings parsing branches on the legacy keys, and no data
+  migration is required.
+  
+  **Behaviour change.** A request whose context is not configured now skips
+  context validation instead of borrowing another context's baseline.
+  Previously, configuring a single context validated *every* request against it
+  — with six contexts that would measure desktop traffic against a tablet
+  baseline and reject real users wholesale. `isContextConfigured` is the new
+  guard; `determineContextType` now takes the raw request UA alongside the
+  webview flag.
+  
+  New site-key registrations default to all six device contexts.
+- a447afa: Per-sitekey `imageMinRounds` alongside the existing `imageMaxRounds`.
+  
+  Every source of an image round count — access-policy rules, traffic-filter categories, routing machines, the staleness curve, and the provider's own heuristics — is now clamped into `[imageMinRounds, imageMaxRounds]` via `clampImageRounds`, so the sitekey's settings override its rules in both directions rather than only capping them. `imageMinRounds` defaults to 2, matching the floor that was previously hard-coded, so existing sitekeys are unaffected.
+- Updated dependencies [a62b994]
+- Updated dependencies [a447afa]
+  - @prosopo/types@5.5.3
+  - @prosopo/types-database@5.3.4
+  - @prosopo/api@4.1.4
+  - @prosopo/api-express-router@3.1.80
+  - @prosopo/database@4.0.26
+  - @prosopo/datasets@3.1.76
+  - @prosopo/env@3.6.49
+  - @prosopo/ipinfo@0.3.21
+  - @prosopo/keyring@2.9.83
+  - @prosopo/load-balancer@2.10.38
+  - @prosopo/types-env@2.10.43
+  - @prosopo/user-access-policy@3.12.32
+
 ## 5.6.3
 ### Patch Changes
 

package/dist/api/blacklistRequestInspector.d.ts

@@ -4,7 +4,7 @@ import type { IProviderDatabase } from "@prosopo/types-database";
 import { type AccessRule, type AccessRulesStorage, type UserScope, type UserScopeRecord } from "@prosopo/user-access-policy";
 import type { NextFunction, Request, Response } from "express";
 import { HardBlockVerdictCache } from "./hardBlockVerdictCache.js";
-export declare const getRequestUserScope: (requestHeaders: Record<string, unknown>, ja4?: string, ip?: string, user?: string, headHash?: string, coords?: string, countryCode?: string, asn?: number) => Pick<UserScopeRecord, "userId" | "ja4Hash" | "userAgent" | "ip" | "headHash" | "coords" | "countryCode" | "asn" | "os">;
+export declare const getRequestUserScope: (requestHeaders: Record<string, unknown>, ja4?: string, ip?: string, user?: string, headHash?: string, coords?: string, countryCode?: string, asn?: number) => Pick<UserScopeRecord, "userId" | "ja4Hash" | "userAgent" | "ip" | "headHash" | "coords" | "countryCode" | "asn" | "os" | "browser">;
 export declare const rankCandidateRules: (rules: AccessRule[], request: UserScope, requestClientId: string | undefined) => AccessRule[];
 export declare const getVerdictCache: () => HardBlockVerdictCache;
 export type GetPrioritisedAccessRuleOptions = {