@prosopo/provider 5.6.4 → 5.8.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/provider@5.6.4 build:cjs
+> @prosopo/provider@5.8.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -22,6 +22,7 @@ ViteCommonJSConfig: .
     '/home/runner/work/captcha/captcha/packages/api/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/types-env/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/keyring/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json'
@@ -46,6 +47,7 @@ ViteCommonJSConfig: .
     '@prosopo/api',
     '@prosopo/types-env',
     '@prosopo/keyring',
+    '@prosopo/captcha-severity',
     '@prosopo/datasets',
     '@prosopo/load-balancer',
     '@prosopo/puzzle-assets'
@@ -55,7 +57,7 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 108 modules transformed.
+✓ 107 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/tasks/index.cjs                                                       0.08 kB │ gzip:  0.07 kB
@@ -71,7 +73,6 @@ dist/cjs/utils/hashUserIp.cjs                                                  0
 dist/cjs/api/testSiteKey.cjs                                                   0.65 kB │ gzip:  0.32 kB
 dist/cjs/utils/hashUserAgent.cjs                                               0.66 kB │ gzip:  0.40 kB
 dist/cjs/api/validateAddress.cjs                                               0.80 kB │ gzip:  0.36 kB
-dist/cjs/tasks/frictionless/frictionlessTasksUtils.cjs                         0.85 kB │ gzip:  0.43 kB
 dist/cjs/api/ja4.cjs                                                           0.85 kB │ gzip:  0.47 kB
 dist/cjs/api/dnsEventUrl.cjs                                                   0.85 kB │ gzip:  0.46 kB
 dist/cjs/tasks/dataset/datasetTasks.cjs                                        0.92 kB │ gzip:  0.41 kB
@@ -82,6 +83,7 @@ dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.cjs          1
 dist/cjs/tasks/powCaptcha/powTasksUtils.cjs                                    1.05 kB │ gzip:  0.50 kB
 dist/cjs/api/admin/apiRegisterSiteKeyEndpoint.cjs                              1.07 kB │ gzip:  0.48 kB
 dist/cjs/api/admin/apiRegisterSiteKeysEndpoint.cjs                             1.14 kB │ gzip:  0.52 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/constants.cjs             1.15 kB │ gzip:  0.60 kB
 dist/cjs/utils/normalizeRequestIp.cjs                                          1.16 kB │ gzip:  0.52 kB
 dist/cjs/api/admin/apiRemoveSiteKeysEndpoint.cjs                               1.16 kB │ gzip:  0.50 kB
 dist/cjs/api/admin/apiRemoveSiteKeyEndpoint.cjs                                1.17 kB │ gzip:  0.50 kB
@@ -94,7 +96,6 @@ dist/cjs/api/admin/apiRemoveAllDecisionMachinesEndpoint.cjs                    1
 dist/cjs/tasks/puzzle/backgroundBuffer.cjs                                     1.37 kB │ gzip:  0.52 kB
 dist/cjs/pairs.cjs                                                             1.39 kB │ gzip:  0.60 kB
 dist/cjs/tasks/dataset/datasetTasksUtils.cjs                                   1.42 kB │ gzip:  0.49 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/constants.cjs             1.42 kB │ gzip:  0.66 kB
 dist/cjs/utils/clientMetaData.cjs                                              1.48 kB │ gzip:  0.72 kB
 dist/cjs/compositeIpAddress.cjs                                                1.55 kB │ gzip:  0.57 kB
 dist/cjs/tasks/detection/getBotScore.cjs                                       1.55 kB │ gzip:  0.55 kB
@@ -112,16 +113,17 @@ dist/cjs/utils/honeypot/phraseBank.cjs                                         1
 dist/cjs/api/handshakeTimingMiddleware.cjs                                     1.88 kB │ gzip:  0.71 kB
 dist/cjs/api/admin/apiClearAllCountersEndpoint.cjs                             2.01 kB │ gzip:  0.78 kB
 dist/cjs/api/captcha/assignDetectorBundle.cjs                                  2.03 kB │ gzip:  0.86 kB
-dist/cjs/api/captcha/contextAwareValidation.cjs                                2.09 kB │ gzip:  0.90 kB
 dist/cjs/tasks/spam/updateSpamEmailDomains.cjs                                 2.12 kB │ gzip:  0.85 kB
 dist/cjs/tasks/frictionless/routingMachine.cjs                                 2.17 kB │ gzip:  0.91 kB
 dist/cjs/api/public.cjs                                                        2.18 kB │ gzip:  0.91 kB
 dist/cjs/migrations/frictionlessLadder.cjs                                     2.19 kB │ gzip:  0.95 kB
 dist/cjs/tasks/puzzle/stratifiedSampler.cjs                                    2.20 kB │ gzip:  1.08 kB
+dist/cjs/tasks/frictionless/frictionlessTasksUtils.cjs                         2.21 kB │ gzip:  1.10 kB
 dist/cjs/tasks/captchaTypeSelection.cjs                                        2.44 kB │ gzip:  1.04 kB
 dist/cjs/api/admin/apiDnsEventEndpoint.cjs                                     2.59 kB │ gzip:  1.00 kB
 dist/cjs/utils/dns.cjs                                                         2.66 kB │ gzip:  1.02 kB
 dist/cjs/api/forwardVerify.cjs                                                 2.66 kB │ gzip:  1.12 kB
+dist/cjs/tasks/puzzle/puzzleDifficulty.cjs                                     2.66 kB │ gzip:  1.10 kB
 dist/cjs/api/captcha/checkSpamEmail.cjs                                        2.73 kB │ gzip:  0.95 kB
 dist/cjs/api/captcha/submitPuzzleCaptchaSolution.cjs                           2.77 kB │ gzip:  0.99 kB
 dist/cjs/api/captcha/maintenanceModeResponses.cjs                              2.91 kB │ gzip:  0.77 kB
@@ -134,40 +136,39 @@ dist/cjs/services/ipComparison.cjs                                             3
 dist/cjs/tasks/spam/evaluateEmailSpamRules.cjs                                 4.03 kB │ gzip:  1.60 kB
 dist/cjs/tasks/spam/checkSpamEmail.cjs                                         4.14 kB │ gzip:  1.14 kB
 dist/cjs/api/captcha/trafficFilterRequestTime.cjs                              4.17 kB │ gzip:  1.53 kB
-dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4.24 kB │ gzip:  1.51 kB
+dist/cjs/tasks/puzzle/puzzleRenderer.cjs                                       4.25 kB │ gzip:  1.51 kB
 dist/cjs/api/hardBlockVerdictCache.cjs                                         4.27 kB │ gzip:  1.70 kB
 dist/cjs/api/captcha.cjs                                                       4.51 kB │ gzip:  1.40 kB
 dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs          4.56 kB │ gzip:  1.07 kB
 dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs                                     4.84 kB │ gzip:  1.74 kB
-dist/cjs/index.cjs                                                             4.85 kB │ gzip:  1.01 kB
+dist/cjs/index.cjs                                                             4.95 kB │ gzip:  1.03 kB
 dist/cjs/tasks/tasks.cjs                                                       5.07 kB │ gzip:  1.57 kB
 dist/cjs/util/usageCounters.cjs                                                5.72 kB │ gzip:  2.03 kB
-dist/cjs/tasks/puzzle/puzzleDifficulty.cjs                                     5.78 kB │ gzip:  2.05 kB
-dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs                                6.65 kB │ gzip:  1.87 kB
-dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              6.98 kB │ gzip:  1.99 kB
-dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             7.48 kB │ gzip:  2.00 kB
+dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs                                6.73 kB │ gzip:  1.89 kB
+dist/cjs/api/captcha/getImageCaptchaChallenge.cjs                              7.06 kB │ gzip:  2.01 kB
+dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     7.47 kB │ gzip:  2.48 kB
 dist/cjs/api/metrics.cjs                                                       7.51 kB │ gzip:  2.12 kB
-dist/cjs/tasks/spam/checkTrafficFilter.cjs                                     7.65 kB │ gzip:  2.55 kB
+dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs                             7.56 kB │ gzip:  2.03 kB
 dist/cjs/tasks/detection/bundlePool.cjs                                        8.72 kB │ gzip:  3.26 kB
-dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              8.85 kB │ gzip:  2.66 kB
+dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs                              8.93 kB │ gzip:  2.68 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs      10.33 kB │ gzip:  1.82 kB
 dist/cjs/api/startProviderApi.cjs                                             11.62 kB │ gzip:  3.70 kB
 dist/cjs/tasks/client/clientTasks.cjs                                         11.73 kB │ gzip:  3.04 kB
 dist/cjs/tasks/decisionMachine/decisionMachineRunner.cjs                      12.32 kB │ gzip:  3.81 kB
-dist/cjs/api/blacklistRequestInspector.cjs                                    12.41 kB │ gzip:  4.31 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs      12.47 kB │ gzip:  2.26 kB
-dist/cjs/util.cjs                                                             13.25 kB │ gzip:  3.22 kB
-dist/cjs/api/verify.cjs                                                       13.86 kB │ gzip:  2.60 kB
-dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              18.33 kB │ gzip:  4.30 kB
-dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             20.34 kB │ gzip:  5.38 kB
-dist/cjs/tasks/captchaManager.cjs                                             22.33 kB │ gzip:  6.35 kB
+dist/cjs/api/blacklistRequestInspector.cjs                                    13.02 kB │ gzip:  4.39 kB
+dist/cjs/util.cjs                                                             13.33 kB │ gzip:  3.24 kB
+dist/cjs/api/verify.cjs                                                       13.81 kB │ gzip:  2.58 kB
+dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs              18.49 kB │ gzip:  4.32 kB
+dist/cjs/tasks/frictionless/frictionlessTasks.cjs                             20.29 kB │ gzip:  5.36 kB
+dist/cjs/tasks/captchaManager.cjs                                             22.43 kB │ gzip:  6.38 kB
 dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs                                  24.03 kB │ gzip:  5.15 kB
 dist/cjs/tasks/powCaptcha/powTasks.cjs                                        24.84 kB │ gzip:  5.97 kB
-dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 28.41 kB │ gzip:  6.47 kB
+dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs                                 27.96 kB │ gzip:  6.37 kB
 dist/cjs/tasks/detection/decodeBehavior.cjs                                   32.24 kB │ gzip: 10.32 kB
 dist/cjs/tasks/detection/decodeSimd.cjs                                       36.03 kB │ gzip: 11.96 kB
 dist/cjs/tasks/detection/decodePayload.cjs                                    49.79 kB │ gzip: 16.98 kB
 
-✓ built in 113ms
+✓ built in 191ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/cjs/tasks/detection/decodeSimd.js

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/provider@5.6.4 build:tsc
+> @prosopo/provider@5.8.0 build:tsc
 > tsc --build --verbose
 
-1:56:54 PM - Projects in this build: 
+1:16:06 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -21,54 +21,57 @@
     * ../types-env/tsconfig.json
     * ../env/tsconfig.json
     * ../api-express-router/tsconfig.json
+    * ../captcha-severity/tsconfig.json
     * ../datasets/tsconfig.json
     * ../load-balancer/tsconfig.json
     * ../puzzle-assets/tsconfig.json
     * tsconfig.json
 
-1:56:54 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/index.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/index.ts' is older than output '../types/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/utils/batches.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/rule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types.test-d.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/index.ts' is older than output '../env/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/index.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/tests/unit/testDoubles.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+1:16:06 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+1:16:06 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-1:56:54 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
+1:16:06 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+
+1:16:06 PM - Building project '/home/runner/work/captcha/captcha/packages/provider/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/provider@5.6.4 build
+> @prosopo/provider@5.8.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/provider@5.6.4 build:cross-env
+> @prosopo/provider@5.8.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -26,6 +26,7 @@ ViteEsmConfig: .
     '/home/runner/work/captcha/captcha/packages/api/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/types-env/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/keyring/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json'
@@ -50,6 +51,7 @@ ViteEsmConfig: .
     '@prosopo/api',
     '@prosopo/types-env',
     '@prosopo/keyring',
+    '@prosopo/captcha-severity',
     '@prosopo/datasets',
     '@prosopo/load-balancer',
     '@prosopo/puzzle-assets'
@@ -59,7 +61,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 108 modules transformed.
+✓ 107 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js                                        0.04 kB │ gzip:  0.06 kB
@@ -76,7 +78,6 @@ dist/utils/hashUserIp.js                                                  0.52 k
 dist/api/testSiteKey.js                                                   0.56 kB │ gzip:  0.30 kB
 dist/utils/hashUserAgent.js                                               0.63 kB │ gzip:  0.39 kB
 dist/api/validateAddress.js                                               0.70 kB │ gzip:  0.33 kB
-dist/tasks/frictionless/frictionlessTasksUtils.js                         0.79 kB │ gzip:  0.42 kB
 dist/api/dnsEventUrl.js                                                   0.80 kB │ gzip:  0.44 kB
 dist/api/ja4.js                                                           0.80 kB │ gzip:  0.44 kB
 dist/tasks/dataset/datasetTasks.js                                        0.85 kB │ gzip:  0.39 kB
@@ -85,6 +86,7 @@ dist/api/headerCheckMiddleware.js                                         0.91 k
 dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js      0.95 kB │ gzip:  0.51 kB
 dist/api/admin/apiRegisterSiteKeyEndpoint.js                              1.00 kB │ gzip:  0.46 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.js          1.01 kB │ gzip:  0.45 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             1.04 kB │ gzip:  0.57 kB
 dist/api/admin/apiRemoveSiteKeysEndpoint.js                               1.07 kB │ gzip:  0.48 kB
 dist/api/admin/apiRegisterSiteKeysEndpoint.js                             1.08 kB │ gzip:  0.50 kB
 dist/api/admin/apiRemoveSiteKeyEndpoint.js                                1.08 kB │ gzip:  0.48 kB
@@ -96,7 +98,6 @@ dist/schedulers/getClientList.js                                          1.19 k
 dist/tasks/puzzle/backgroundBuffer.js                                     1.20 kB │ gzip:  0.50 kB
 dist/api/admin/apiGetDecisionMachineEndpoint.js                           1.26 kB │ gzip:  0.50 kB
 dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 kB │ gzip:  0.51 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             1.27 kB │ gzip:  0.63 kB
 dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip:  0.51 kB
 dist/tasks/dataset/datasetTasksUtils.js                                   1.30 kB │ gzip:  0.48 kB
 dist/compositeIpAddress.js                                                1.36 kB │ gzip:  0.55 kB
@@ -118,25 +119,26 @@ dist/tasks/spam/updateSpamEmailDomains.js                                 1.87 k
 dist/api/admin/apiClearAllCountersEndpoint.js                             1.89 kB │ gzip:  0.76 kB
 dist/api/public.js                                                        1.90 kB │ gzip:  0.83 kB
 dist/api/captcha/assignDetectorBundle.js                                  1.90 kB │ gzip:  0.84 kB
-dist/api/captcha/contextAwareValidation.js                                1.99 kB │ gzip:  0.88 kB
 dist/migrations/frictionlessLadder.js                                     2.12 kB │ gzip:  0.93 kB
 dist/tasks/puzzle/stratifiedSampler.js                                    2.14 kB │ gzip:  1.07 kB
 dist/tasks/frictionless/routingMachine.js                                 2.16 kB │ gzip:  0.91 kB
+dist/tasks/frictionless/frictionlessTasksUtils.js                         2.16 kB │ gzip:  1.09 kB
 dist/api/captcha/maintenanceModeResponses.js                              2.16 kB │ gzip:  0.73 kB
 dist/tasks/captchaTypeSelection.js                                        2.22 kB │ gzip:  1.03 kB
 dist/utils/dns.js                                                         2.36 kB │ gzip:  0.95 kB
 dist/api/admin/apiDnsEventEndpoint.js                                     2.43 kB │ gzip:  0.96 kB
 dist/api/captcha/checkSpamEmail.js                                        2.47 kB │ gzip:  0.91 kB
+dist/tasks/puzzle/puzzleDifficulty.js                                     2.50 kB │ gzip:  1.09 kB
 dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.55 kB │ gzip:  0.96 kB
 dist/api/forwardVerify.js                                                 2.59 kB │ gzip:  1.10 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            2.59 kB │ gzip:  1.00 kB
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip:  0.55 kB
-dist/index.js                                                             2.86 kB │ gzip:  0.78 kB
+dist/index.js                                                             2.92 kB │ gzip:  0.80 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.39 kB │ gzip:  1.32 kB
 dist/api/domainMiddleware.js                                              3.52 kB │ gzip:  1.22 kB
 dist/api/rawTlsSignalsMiddleware.js                                       3.69 kB │ gzip:  1.13 kB
 dist/tasks/spam/evaluateEmailSpamRules.js                                 3.84 kB │ gzip:  1.59 kB
-dist/tasks/puzzle/puzzleRenderer.js                                       3.90 kB │ gzip:  1.49 kB
+dist/tasks/puzzle/puzzleRenderer.js                                       3.91 kB │ gzip:  1.49 kB
 dist/api/captcha/trafficFilterRequestTime.js                              3.94 kB │ gzip:  1.51 kB
 dist/services/ipComparison.js                                             3.96 kB │ gzip:  1.19 kB
 dist/api/captcha.js                                                       4.05 kB │ gzip:  1.31 kB
@@ -145,33 +147,32 @@ dist/api/hardBlockVerdictCache.js                                         4.14 k
 dist/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.js          4.35 kB │ gzip:  1.07 kB
 dist/tasks/tasks.js                                                       4.69 kB │ gzip:  1.51 kB
 dist/tasks/dnsEvent/enrichDnsEvent.js                                     4.71 kB │ gzip:  1.72 kB
-dist/tasks/puzzle/puzzleDifficulty.js                                     5.50 kB │ gzip:  2.02 kB
 dist/util/usageCounters.js                                                5.65 kB │ gzip:  2.01 kB
-dist/api/captcha/getPoWCaptchaChallenge.js                                6.02 kB │ gzip:  1.81 kB
-dist/api/captcha/getImageCaptchaChallenge.js                              6.28 kB │ gzip:  1.94 kB
-dist/api/captcha/getPuzzleCaptchaChallenge.js                             6.77 kB │ gzip:  1.95 kB
+dist/api/captcha/getPoWCaptchaChallenge.js                                6.09 kB │ gzip:  1.83 kB
+dist/api/captcha/getImageCaptchaChallenge.js                              6.35 kB │ gzip:  1.96 kB
+dist/api/captcha/getPuzzleCaptchaChallenge.js                             6.84 kB │ gzip:  1.97 kB
 dist/api/metrics.js                                                       6.96 kB │ gzip:  2.09 kB
-dist/tasks/spam/checkTrafficFilter.js                                     7.32 kB │ gzip:  2.53 kB
+dist/tasks/spam/checkTrafficFilter.js                                     7.16 kB │ gzip:  2.45 kB
 dist/tasks/detection/bundlePool.js                                        8.30 kB │ gzip:  3.21 kB
-dist/api/captcha/submitPoWCaptchaSolution.js                              8.37 kB │ gzip:  2.62 kB
+dist/api/captcha/submitPoWCaptchaSolution.js                              8.41 kB │ gzip:  2.63 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       9.36 kB │ gzip:  1.80 kB
 dist/api/startProviderApi.js                                              9.93 kB │ gzip:  3.42 kB
 dist/tasks/client/clientTasks.js                                         11.27 kB │ gzip:  3.00 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js      11.34 kB │ gzip:  2.23 kB
-dist/api/blacklistRequestInspector.js                                    11.85 kB │ gzip:  4.28 kB
 dist/tasks/decisionMachine/decisionMachineRunner.js                      11.93 kB │ gzip:  3.75 kB
-dist/api/verify.js                                                       12.52 kB │ gzip:  2.49 kB
-dist/util.js                                                             12.57 kB │ gzip:  3.17 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              17.12 kB │ gzip:  4.21 kB
-dist/tasks/frictionless/frictionlessTasks.js                             19.85 kB │ gzip:  5.35 kB
-dist/tasks/captchaManager.js                                             21.82 kB │ gzip:  6.29 kB
+dist/api/blacklistRequestInspector.js                                    12.38 kB │ gzip:  4.35 kB
+dist/api/verify.js                                                       12.48 kB │ gzip:  2.48 kB
+dist/util.js                                                             12.65 kB │ gzip:  3.18 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              17.24 kB │ gzip:  4.23 kB
+dist/tasks/frictionless/frictionlessTasks.js                             19.77 kB │ gzip:  5.32 kB
+dist/tasks/captchaManager.js                                             21.92 kB │ gzip:  6.32 kB
 dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.62 kB │ gzip:  5.11 kB
 dist/tasks/powCaptcha/powTasks.js                                        23.47 kB │ gzip:  5.93 kB
-dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.97 kB │ gzip:  6.43 kB
+dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 26.44 kB │ gzip:  6.30 kB
 dist/tasks/detection/decodeBehavior.js                                   32.26 kB │ gzip: 10.34 kB
 dist/tasks/detection/decodeSimd.js                                       36.06 kB │ gzip: 12.00 kB
 dist/tasks/detection/decodePayload.js                                    49.69 kB │ gzip: 16.96 kB
 
-✓ built in 103ms
+✓ built in 143ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,212 @@
 # @prosopo/provider
 
+## 5.8.0
+### Minor Changes
+
+- e22d5fb: Add an arbitrary-header match dimension to user access policies.
+  
+  A `Block` or `Restrict` rule can now target a named request header with an `equals`, `contains`, `notEquals`, `notContains`, `notEqualsAny` or `notContainsAny` operator. The negated operators back the portal's allow-list mode — block unless the header matches; the `*Any` pair carries a list of accepted values in `headerValue` so an allow-list over several values of the same header fires only when the header matches none of them (separate single-value rules would each fire on the other's value and block everything). Because substring `contains` and per-rule operators can't be expressed as a Redis TAG query — and an allow-list rule must still fire on a request that omits the header — the header condition is carried on the rule as `headerName`/`headerValue`/`headerOperator` and evaluated in code against the raw request headers, while an indexed `headerMatch` sentinel makes every header rule a matching candidate for every request. Header rules contribute one point to rule specificity ranking, mirroring the other scalar dimensions.
+  
+  The raw request headers are a **required** argument of `getPrioritisedAccessRule` / `CaptchaManager.getPrioritisedAccessPolicies`, with no default. A negated header operator treats a missing header as "does not match", so a lookup that quietly ran with an empty header map would fire every allow-list rule on every request. Every lookup now passes them: the request-time block middleware, the verify-path hard-block check, the `/frictionless` policy and dedup lookups, and the image / PoW / puzzle challenge endpoints.
+  
+  `getPrioritisedAccessRule` now caches only the candidate fetch and ranks per request, because the header verdict depends on data that is not part of the cache key. This also closes a latent gap where `os` was never part of `hardBlockCacheKey`, so a cached ranked list could serve one operating system's verdict to a request from another.
+
+### Patch Changes
+
+- 6f57ee9: chore(deps-dev): bump @types/uuid from 10.0.0 to 11.0.0
+- 6f57ee9: chore(deps): bump the npm-minor-and-patch group across 1 directory with 3 updates
+- c59f8a6: Remove the account-wide commitment fallback from image captcha verification.
+  
+  `verifyImageCaptchaSolution` fell back to `getDappUserCommitmentByAccount` when
+  the token carried no `commitmentId`, returning the first *approved* commitment
+  in the account's history — any age, any session.
+  
+  That fallback predates the Procaptcha token (#1263, 2024-06-06), which has
+  carried `commitmentId` on every image solve since; `Manager.ts` sets it
+  unconditionally for this captcha type, and it is `optional()` on the schema only
+  because PoW shares the token shape and identifies its work by `challenge`.
+  
+  It could only ever return the wrong record. For a returning user whose current
+  solve was not yet approved it produced an approved commitment from an earlier
+  visit, which carries no `clientSessionId`, so the session correlation compared
+  the live id against `undefined` and reported `CLIENT_SESSION_MISMATCH` — a token
+  replay that never happened. Observed in production at scale on the image
+  path while PoW, which resolves its exact challenge record, was unaffected.
+  
+  Verification now requires a `commitmentId` and returns
+  `API.USER_NOT_VERIFIED_NO_SOLUTION` without one. A token that names no
+  commitment cannot be verified against one.
+- Updated dependencies [f8a41fe]
+- Updated dependencies [6f57ee9]
+- Updated dependencies [6f57ee9]
+- Updated dependencies [6f57ee9]
+- Updated dependencies [6f57ee9]
+- Updated dependencies [e22d5fb]
+- Updated dependencies [9386e5e]
+- Updated dependencies [6fd727c]
+- Updated dependencies [b6918c0]
+- Updated dependencies [d288371]
+  - @prosopo/database@4.0.28
+  - @prosopo/user-access-policy@3.13.0
+  - @prosopo/native-ja4@0.0.5
+  - @prosopo/native-merkle@0.0.5
+  - @prosopo/types@5.7.0
+  - @prosopo/util@3.3.9
+  - @prosopo/puzzle-assets@0.1.4
+  - @prosopo/types-database@5.4.1
+  - @prosopo/env@3.6.51
+  - @prosopo/api@4.1.6
+  - @prosopo/api-express-router@3.1.82
+  - @prosopo/api-route@2.6.58
+  - @prosopo/common@3.1.54
+  - @prosopo/datasets@3.1.78
+  - @prosopo/ipinfo@0.3.23
+  - @prosopo/keyring@2.9.85
+  - @prosopo/load-balancer@2.10.40
+  - @prosopo/logger@2.0.9
+  - @prosopo/redis-client@1.0.35
+  - @prosopo/types-env@2.10.45
+
+## 5.7.0
+### Minor Changes
+
+- 8a670d3: Remove the provider-side context validation path.
+  
+  The provider read a per-context baseline out of `clientcontextentropies` on the frictionless path and compared a session's head hash against it. The task that wrote that collection was removed from the provider on 2026-08-21, so the read has returned `undefined` ever since and the branch has been dead in every deployment since then. Computing and applying the baseline now happens off-provider.
+  
+  Removed: `contextAwareValidation.ts`, the decision-machine branch that used it, `getClientContextEntropy` on the provider and its database method, the `clientContextEntropy` table registration, the unused `getRoundsFromSimScore` helper, and the `contextAwareEnabled` parameter threaded into image verification — which logged and then did nothing, its return commented out.
+  
+  Also removes the per-site `settings.contextAware` block that configured it, along with `ContextAwareSchema`, `IContextAware`, `IContexts`, `ContextConfigSchema`, `contextAwareThresholdDefault` and `expandContexts`, the legacy `default`/`webview` context keys and their helpers, and `FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED`. The site-key registration CLI no longer writes a `contextAware` default into new sites.
+  
+  `ContextType`, `contextTypeFromSession` and `deviceContextTypes` stay — the off-provider work keys on them. `ClientContextEntropyRecord` and its schema stay for the same reason; only the provider's use of them goes.
+  
+  No behaviour change: every path removed here was already inert.
+
+### Patch Changes
+
+- 7fd6eb2: Add a `browser` match dimension to access rules.
+  
+  Rules can now be scoped to the browser classified server-side from the request
+  User-Agent (`chrome`, `safari`, `firefox`, `edge`, `opera`, `samsung_internet`,
+  `wechat`, `facebook`, `instagram`, `ie`, `unknown`), mirroring the existing `os`
+  dimension. The classifier duplicates `@prosopo/decision-machines`' `uaClassify`
+  because the provider request path cannot depend on that package.
+  
+  Also fixes `os` never getting its own probe on the Redis split-query hot path:
+  `SCALAR_USER_SCOPE_FIELDS` in `redisRulesSplitQuery` had not been updated when
+  the OS dimension landed, so an OS-only rule was reachable only via the
+  `no-user-scope` fall-through, competing for that probe's candidate budget
+  against genuine client-wide blocks.
+  
+  The Redis index gains a `browser` TAG field. `createRedisIndex` hashes the index
+  definition and drops/recreates when the hash changes, so this needs no manual
+  migration — verified locally: the index came back carrying `browser` and the
+  stored hash moved to match.
+- 424e467: Add `@prosopo/captcha-severity` and use it for the access rules and the traffic filter.
+  
+  "Which captcha challenge is stricter" is one idea with several callers, and each answered it with its own table: the traffic filter combining multiple `challenge` matches on one request (`resolveChallengePolicy`), the access rules breaking ties between equally-specific rules (`ruleHarshness`), and downstream routing consumers. They agreed on the order — image > puzzle > pow > frictionless — but nothing held them to it, and they disagreed on the encoding.
+  
+  The new package has **zero dependencies**, deliberately. Captcha types are string enums, so a plain `string` parameter accepts them without importing `CaptchaType` — and that import would not be free, because it lives in a module that pulls zod in for its schemas. Some consumers bundle this standalone under a hard source-size ceiling that a runtime dependency on the `@prosopo/types` barrel has breached before.
+  
+  Two APIs, because "stricter" means two different things:
+  
+  - `rankCaptchaType` / `isStricterCaptchaType` compare the **type alone**, for callers that choose the type independently of its settings — as the traffic filter does, picking the strictest type and then separately merging the hardest parameters from every matched category.
+  - `captchaPolicySeverity` / `isStricterCaptchaPolicy` compare a **whole policy**, type first and its own difficulty setting second, for callers where one complete policy must beat another and a tie on type alone would otherwise be decided by argument order.
+  
+  **Fixes an ordering bug in the access rules.** `ruleHarshness` scored `base + solvedImagesCount` with tiers 10 apart, and `solvedImagesCount` is validated by `imageMaxRoundsFieldSchema` — `number().int().min(2)`, with no upper bound and an `imageMaxRounds` default of 32. A `Restrict[pow]` rule carrying 32 rounds therefore scored 42 and outranked a `Restrict[image]` rule at 30, exactly inverting the intended order; 11 rounds on a puzzle rule was enough to do it. The intra-type component is now clamped below the tier gap, so no setting can lift a rule over a stricter captcha type.
+  
+  One further behaviour change: pow rules now break ties on `powDifficulty` rather than `solvedImagesCount`. Rule authoring drops `solvedImagesCount` for pow, so every pow rule previously scored at the bottom of its tier regardless of difficulty. Image and puzzle both keep `solvedImagesCount` — it is the severity currency they share, which the provider maps onto a puzzle difficulty level via `severityToPuzzleDifficulty` rather than treating as a literal round count.
+- 89dd38a: chore(deps): batch the outstanding dependabot bumps into one upgrade
+  
+  Rolls up dependabot PRs #3112, #3127-#3134 and #3159. Majors: `mongoose`
+  8 -> 9, `bson` 6 -> 7, `@noble/curves` 1 -> 2, `@polkadot/util-crypto`
+  13 -> 14, `@typegoose/auto-increment` 4 -> 5, `@babel/preset-env` 7 -> 8,
+  `@types/jsdom` 21 -> 30, `@types/bcrypt` 5 -> 6, `@actions/github` 6 -> 9,
+  `testcontainers` 11 -> 12. The rest are minor/patch.
+  
+  Code changes the majors forced:
+  - `@noble/curves` v2 requires `.js` specifiers and renamed the point API,
+    so `secp256k1.ProjectivePoint.fromHex(...).toRawBytes()` becomes
+    `secp256k1.Point.fromBytes(...).toBytes()`, `RistrettoPoint` becomes
+    `ristretto255.Point`, and `abstract/utils` moves to `utils.js`.
+  - mongoose 9 drops `RootFilterQuery` (now `QueryFilter`), no longer sets
+    `background: true` on schema indexes by default, and no longer declares
+    `id` on `Document`, which un-hid a mismatch between
+    `updateDappUserCommitment`'s `Hash` parameter and the `string` `id` it
+    filters on.
+  - mongoose 9 rejects an aggregation-pipeline update (an array) unless the
+    call passes `updatePipeline: true`, so the six pipeline writes in
+    `ProviderDatabase` now opt in explicitly.
+  - mongoose 9's `castUpdate` throws on a `$setOnInsert` key inside `$set`.
+    `storeUserImageCaptchaSolution` passed its record straight in as the
+    update, and mongoose's `moveImmutableProperties` mutates that object on
+    an upsert -- adding the very `$setOnInsert` key the record then carried
+    into `CentralDbStreamer.streamImageRecord`. Image records stopped
+    reaching the central DB (the streamer is fire-and-forget, so it only
+    logged) and signup verification returned 500. The update is now an
+    explicit `$set` over a shallow copy.
+  - `@prosopo/database` moves from mongodb 6.20 to 7.5 to match the driver
+    mongoose 9 pulls, so bson 7 is the only copy resolvable in the package.
+  - `vitest`/`@vitest/coverage-v8` go to 4.1.11 alongside dependabot's
+    `@vitest/spy` bump; leaving them at 4.1.10 installed a second copy of
+    `@vitest/spy` and broke type inference in the provider test utils.
+- 4810cb3: Fix `computeFrictionlessScore` returning `NaN` when `scoreComponents` carries a non-numeric field.
+  
+  The score was summed with `Object.values(...).reduce((acc, val) => acc + val, 0)` over every defined value. `ScoreComponents` also carries two non-numeric diagnostic fields — `triggeredDetectors` (`number[]`) and `shadowDomPenalty` (`boolean`) — and neither has an arithmetic weight anywhere in the scoring path. `+` on an array coerces the accumulator to a string, so any numeric component summed *after* an array turned the running total into string concatenation and the final `Math.min(1, ...)` into `NaN`:
+  
+  ```
+  0.42 + []    -> "0.42"
+  "0.42" + 0.3 -> "0.420.3"
+  Math.min(1, "0.420.3") -> NaN
+  ```
+  
+  This was reachable in production rather than theoretical. The Mongoose schema declares `triggeredDetectors` as an array path and Mongoose defaults array paths to `[]`, so the field is present on every session read back from the database even when the frictionless handler omitted it; the pow / puzzle / image tasks then spread `dnsAsymmetry` on afterwards, landing it after the array in key order. Every solve-time recompute on a session with `dnsAsymmetry > 0` produced `NaN`.
+  
+  Only numeric values now contribute. `shadowDomPenalty` no longer silently adds a full `1.0` when true. A genuinely numeric `NaN` component still propagates — `typeof NaN === "number"`, so it survives the filter deliberately — because a score that cannot be computed must not read as a low one.
+  
+  The recomputed value is not persisted (neither `sessions` nor `usercommitments` stores it) and no decide rule currently branches on `input.score`, so the impact to date was a `NaN` in the solve-time log line and in `DecisionMachineInput.score`.
+- 3d2176d: Move the puzzle difficulty ladder into `@prosopo/captcha-severity`, so every consumer derives a difficulty from one table.
+  
+  `PUZZLE_DIFFICULTY_LEVELS`, `MAX_AUTO_ESCALATION_LEVEL`, `MIN_DECOY_HOLE_DARKEN_MARGIN`, `clampDifficultyLevel` and `severityToPuzzleDifficulty` lived in `provider/src/tasks/puzzle/puzzleDifficulty.ts`, reachable only from inside the provider — the severity package's own docs described the ladder at length but did not hold it. Anything else that has to answer "what difficulty is this puzzle" had to restate the mapping, and the consumers that author and edit puzzle rules sit outside the provider.
+  
+  They can import it now. The severity package already answers "which of these policies is stricter" off `solvedImagesCount`; the ladder answers what a puzzle policy carrying that number is actually served at, which is the same question one step further in.
+  
+  Sampling a concrete render from a level's bands stays in the provider as `samplePuzzleDifficulty`: it needs `IPuzzleSettings` from `@prosopo/types` and a `node:crypto`-backed sampler, and the severity package's zero-dependency, browser-safe property is load-bearing for consumers that bundle it standalone.
+  
+  Adds `puzzleDifficultyToSeverity`, the inverse of `severityToPuzzleDifficulty`. Writers need that direction — a rule editor turning a chosen difficulty into the field the rule carries, or rule authoring normalising a count inherited from the image path. Each level spans two rounds, so without a canonical value per level a writer picks between numbers that produce the identical puzzle, and the difference survives only to break severity ties arbitrarily. The round-trip is pinned by tests.
+  
+  No behaviour change in the provider: same table, same thresholds, same clamping.
+- Updated dependencies [7fd6eb2]
+- Updated dependencies [424e467]
+- Updated dependencies [1b77849]
+- Updated dependencies [89dd38a]
+- Updated dependencies [80f73c1]
+- Updated dependencies [3d2176d]
+- Updated dependencies [8fce190]
+- Updated dependencies [8a670d3]
+  - @prosopo/user-access-policy@3.12.33
+  - @prosopo/captcha-severity@1.1.0
+  - @prosopo/util-crypto@13.5.31
+  - @prosopo/api@4.1.5
+  - @prosopo/api-express-router@3.1.81
+  - @prosopo/api-route@2.6.57
+  - @prosopo/common@3.1.53
+  - @prosopo/database@4.0.27
+  - @prosopo/datasets@3.1.77
+  - @prosopo/env@3.6.50
+  - @prosopo/ipinfo@0.3.22
+  - @prosopo/keyring@2.9.84
+  - @prosopo/load-balancer@2.10.39
+  - @prosopo/locale@3.4.1
+  - @prosopo/logger@2.0.8
+  - @prosopo/redis-client@1.0.34
+  - @prosopo/types@5.6.0
+  - @prosopo/types-database@5.4.0
+  - @prosopo/types-env@2.10.44
+  - @prosopo/util@3.3.8
+  - @prosopo/native-ja4@0.0.4
+  - @prosopo/native-merkle@0.0.4
+
 ## 5.6.4
 ### Patch Changes