@prosopo/user-access-policy 3.11.2 → 3.12.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/user-access-policy@3.11.2 build:cjs
+> @prosopo/user-access-policy@3.12.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -33,40 +33,41 @@ ViteCommonJSConfig: .
 Bundle build started
 transforming...
 Build end
-✓ 34 modules transformed.
+✓ 35 modules transformed.
 rendering chunks...
-dist/cjs/api/delete/.export.cjs              0.01 kB
-dist/cjs/api/read/.export.cjs                0.01 kB
-dist/cjs/api/write/.export.cjs               0.01 kB
-dist/cjs/mongoose/.export.cjs                0.23 kB
-dist/cjs/rulesStorage.cjs                    0.34 kB
-dist/cjs/rule.cjs                            0.34 kB
-dist/cjs/redis/.export.cjs                   0.36 kB
-dist/cjs/ruleInput/.export.cjs               0.46 kB
-dist/cjs/api/.export.cjs                     0.57 kB
-dist/cjs/classifyOs.cjs                      0.62 kB
-dist/cjs/api/delete/deleteAllRules.cjs       0.77 kB
-dist/cjs/ruleRecord.cjs                      0.84 kB
-dist/cjs/api/read/getMissingIds.cjs          1.15 kB
-dist/cjs/api/read/fetchRules.cjs             1.22 kB
-dist/cjs/redis/redisRulesStorage.cjs         1.35 kB
-dist/cjs/.export.cjs                         1.37 kB
-dist/cjs/api/delete/deleteRules.cjs          1.51 kB
-dist/cjs/mongoose/mongooseRuleSchema.cjs     1.52 kB
-dist/cjs/api/delete/deleteRuleGroups.cjs     1.57 kB
-dist/cjs/api/write/rehashRules.cjs           1.64 kB
-dist/cjs/api/read/findRuleIds.cjs            1.65 kB
-dist/cjs/ruleInput/policyInput.cjs           1.70 kB
-dist/cjs/redis/redisClient.cjs               2.09 kB
-dist/cjs/ruleInput/ruleInput.cjs             2.11 kB
-dist/cjs/api/rulesApiClient.cjs              2.60 kB
-dist/cjs/redis/reader/redisAggregate.cjs     2.61 kB
-dist/cjs/ruleInput/userScopeInput.cjs        2.67 kB
-dist/cjs/redis/redisRuleIndex.cjs            2.95 kB
-dist/cjs/transformRule.cjs                   3.05 kB
-dist/cjs/api/write/insertRules.cjs           3.38 kB
-dist/cjs/redis/redisRulesWriter.cjs          3.44 kB
-dist/cjs/redis/reader/redisRulesQuery.cjs    4.47 kB
-dist/cjs/api/ruleApiRoutes.cjs               4.55 kB
-dist/cjs/redis/reader/redisRulesReader.cjs  11.59 kB
-✓ built in 490ms
+dist/cjs/api/delete/.export.cjs                  0.01 kB
+dist/cjs/api/read/.export.cjs                    0.01 kB
+dist/cjs/api/write/.export.cjs                   0.01 kB
+dist/cjs/mongoose/.export.cjs                    0.23 kB
+dist/cjs/rulesStorage.cjs                        0.34 kB
+dist/cjs/redis/.export.cjs                       0.36 kB
+dist/cjs/rule.cjs                                0.46 kB
+dist/cjs/ruleInput/.export.cjs                   0.46 kB
+dist/cjs/api/.export.cjs                         0.57 kB
+dist/cjs/classifyOs.cjs                          0.62 kB
+dist/cjs/api/delete/deleteAllRules.cjs           0.77 kB
+dist/cjs/ruleRecord.cjs                          0.84 kB
+dist/cjs/api/read/getMissingIds.cjs              1.15 kB
+dist/cjs/api/read/fetchRules.cjs                 1.22 kB
+dist/cjs/redis/redisRulesStorage.cjs             1.35 kB
+dist/cjs/.export.cjs                             1.37 kB
+dist/cjs/api/delete/deleteRules.cjs              1.51 kB
+dist/cjs/mongoose/mongooseRuleSchema.cjs         1.52 kB
+dist/cjs/api/delete/deleteRuleGroups.cjs         1.57 kB
+dist/cjs/api/write/rehashRules.cjs               1.64 kB
+dist/cjs/api/read/findRuleIds.cjs                1.65 kB
+dist/cjs/redis/redisClient.cjs                   2.09 kB
+dist/cjs/ruleInput/ruleInput.cjs                 2.11 kB
+dist/cjs/ruleInput/policyInput.cjs               2.14 kB
+dist/cjs/redis/reader/redisRulesSplitQuery.cjs   2.43 kB
+dist/cjs/api/rulesApiClient.cjs                  2.60 kB
+dist/cjs/redis/reader/redisAggregate.cjs         2.61 kB
+dist/cjs/ruleInput/userScopeInput.cjs            2.67 kB
+dist/cjs/transformRule.cjs                       3.05 kB
+dist/cjs/redis/redisRuleIndex.cjs                3.07 kB
+dist/cjs/api/write/insertRules.cjs               3.38 kB
+dist/cjs/redis/redisRulesWriter.cjs              3.68 kB
+dist/cjs/api/ruleApiRoutes.cjs                   4.55 kB
+dist/cjs/redis/reader/redisRulesQuery.cjs        4.60 kB
+dist/cjs/redis/reader/redisRulesReader.cjs      15.32 kB
+✓ built in 540ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/user-access-policy@3.11.2 build:tsc
+> @prosopo/user-access-policy@3.12.0 build:tsc
 > tsc --build --verbose
 
-9:21:58 AM - Projects in this build: 
+11:41:51 AM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -15,27 +15,27 @@
     * ../api/tsconfig.json
     * tsconfig.json
 
-9:21:58 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/vite-plugin-fix-absolute-imports.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/NodejsPolarsNativeFilePlugin.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/useTranslation.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/useTranslation.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/provider/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/provider/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+11:41:52 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-9:21:58 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+11:41:52 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-9:21:58 AM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
+11:41:52 AM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/user-access-policy@3.11.2 build
+> @prosopo/user-access-policy@3.12.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/user-access-policy@3.11.2 build:cross-env
+> @prosopo/user-access-policy@3.12.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -37,40 +37,41 @@ ViteEsmConfig: .
 Bundle build started
 transforming...
 Build end
-✓ 34 modules transformed.
+✓ 35 modules transformed.
 rendering chunks...
-dist/api/delete/.export.js              0.00 kB
-dist/api/read/.export.js                0.00 kB
-dist/api/write/.export.js               0.00 kB
-dist/mongoose/.export.js                0.11 kB
-dist/redis/.export.js                   0.20 kB
-dist/rulesStorage.js                    0.23 kB
-dist/rule.js                            0.24 kB
-dist/ruleInput/.export.js               0.27 kB
-dist/api/.export.js                     0.37 kB
-dist/classifyOs.js                      0.51 kB
-dist/ruleRecord.js                      0.62 kB
-dist/api/delete/deleteAllRules.js       0.67 kB
-dist/.export.js                         0.93 kB
-dist/api/read/getMissingIds.js          1.01 kB
-dist/api/read/fetchRules.js             1.08 kB
-dist/redis/redisRulesStorage.js         1.21 kB
-dist/mongoose/mongooseRuleSchema.js     1.41 kB
-dist/api/delete/deleteRules.js          1.44 kB
-dist/api/delete/deleteRuleGroups.js     1.44 kB
-dist/ruleInput/policyInput.js           1.50 kB
-dist/api/read/findRuleIds.js            1.54 kB
-dist/api/write/rehashRules.js           1.54 kB
-dist/ruleInput/ruleInput.js             1.76 kB
-dist/redis/redisClient.js               1.90 kB
-dist/api/rulesApiClient.js              2.36 kB
-dist/ruleInput/userScopeInput.js        2.44 kB
-dist/redis/reader/redisAggregate.js     2.46 kB
-dist/redis/redisRuleIndex.js            2.49 kB
-dist/transformRule.js                   2.76 kB
-dist/api/write/insertRules.js           3.22 kB
-dist/redis/redisRulesWriter.js          3.22 kB
-dist/redis/reader/redisRulesQuery.js    4.29 kB
-dist/api/ruleApiRoutes.js               4.33 kB
-dist/redis/reader/redisRulesReader.js  10.71 kB
-✓ built in 440ms
+dist/api/delete/.export.js                  0.00 kB
+dist/api/read/.export.js                    0.00 kB
+dist/api/write/.export.js                   0.00 kB
+dist/mongoose/.export.js                    0.11 kB
+dist/redis/.export.js                       0.20 kB
+dist/rulesStorage.js                        0.23 kB
+dist/ruleInput/.export.js                   0.27 kB
+dist/rule.js                                0.32 kB
+dist/api/.export.js                         0.37 kB
+dist/classifyOs.js                          0.51 kB
+dist/ruleRecord.js                          0.62 kB
+dist/api/delete/deleteAllRules.js           0.67 kB
+dist/.export.js                             0.93 kB
+dist/api/read/getMissingIds.js              1.01 kB
+dist/api/read/fetchRules.js                 1.08 kB
+dist/redis/redisRulesStorage.js             1.21 kB
+dist/mongoose/mongooseRuleSchema.js         1.41 kB
+dist/api/delete/deleteRules.js              1.44 kB
+dist/api/delete/deleteRuleGroups.js         1.44 kB
+dist/api/read/findRuleIds.js                1.54 kB
+dist/api/write/rehashRules.js               1.54 kB
+dist/ruleInput/ruleInput.js                 1.76 kB
+dist/redis/redisClient.js                   1.90 kB
+dist/ruleInput/policyInput.js               1.96 kB
+dist/redis/reader/redisRulesSplitQuery.js   2.35 kB
+dist/api/rulesApiClient.js                  2.36 kB
+dist/ruleInput/userScopeInput.js            2.44 kB
+dist/redis/reader/redisAggregate.js         2.46 kB
+dist/redis/redisRuleIndex.js                2.58 kB
+dist/transformRule.js                       2.76 kB
+dist/api/write/insertRules.js               3.22 kB
+dist/redis/redisRulesWriter.js              3.47 kB
+dist/api/ruleApiRoutes.js                   4.33 kB
+dist/redis/reader/redisRulesQuery.js        4.45 kB
+dist/redis/reader/redisRulesReader.js      14.33 kB
+✓ built in 569ms

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @prosopo/user-access-policy
 
+## 3.12.0
+### Minor Changes
+
+- 7d7e767: perf(access-rules): split-query hot path + verdict cache with LRU and singleflight
+  
+  Reworks the block-lookup Redis path so per-request latency is bounded by matching-rules-per-request rather than total rules in the tenant. Rule populations in the 10k+ range no longer degrade tail latency.
+  
+  Key changes:
+  
+  - **Split-query read path**: `redisRulesSplitQuery.ts` builds one FT sub-query per populated request field (numericIp exact + CIDR, ja4Hash, userId, headHash, coords, countryCode, asn), each hitting a discriminating posting-list index instead of a single wide FT.AGGREGATE that scaled linearly in total rule count.
+  - **`clientId="global"` sentinel**: writer stamps the sentinel on rules with no clientId so queries probe `@clientId:{X|global|ismissing}` instead of the expensive `ismissing()` set-difference walk. Transition-safe — legacy rules match via the ismissing branch until a rehash migrates them.
+  - **HardBlockVerdictCache**: bounded LRU + TTL (10 s / 50k entries) with real LRU move-to-tail on hit and **singleflight `getOrCompute`** dedupe of concurrent misses — the wave-1 stampede fix for the frontend retry-loop shape.
+  - **Request-scoped memo**: attached to `req` so blockMiddleware + downstream in-request checks share one Redis round-trip.
+  
+  Measured impact under 100-concurrent × 10-wave retry storm against a 19.3k-rule population: wave-1 p99 drops from 23 ms → 3 ms, throughput jumps from 28.5k → 61.5k req/s per process, 50 identical concurrent misses collapse to 1 storage call.
+
+### Patch Changes
+
+- Updated dependencies [b3f351b]
+- Updated dependencies [17bc76e]
+  - @prosopo/types@4.9.6
+  - @prosopo/api@3.5.13
+
+## 3.11.3
+### Patch Changes
+
+- Updated dependencies [6cb3218]
+  - @prosopo/types@4.9.5
+  - @prosopo/api@3.5.12
+
 ## 3.11.2
 ### Patch Changes
 

package/dist/api/delete/deleteRules.d.ts

@@ -1,9 +1,9 @@
 import { type ApiEndpoint, type ApiEndpointResponse } from "@prosopo/api-route";
 import type { Logger } from "@prosopo/logger";
-import { type ZodType } from "zod";
+import { type ZodType, z } from "zod";
 import { type AccessRulesFilterInput } from "#policy/ruleInput/ruleInput.js";
 import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-type DeleteRulesSchema = ZodType<AccessRulesFilterInput[]>;
+type DeleteRulesSchema = ZodType<AccessRulesFilterInput[], z.ZodTypeDef, unknown>;
 export declare class DeleteRulesEndpoint implements ApiEndpoint<DeleteRulesSchema> {
     private readonly accessRulesStorage;
     private readonly logger;

package/dist/api/delete/deleteRules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deleteRules.d.ts","sourceRoot":"","sources":["../../../src/api/delete/deleteRules.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,KAAK,OAAO,EAAK,MAAM,KAAK,CAAC;AACtC,OAAO,EACN,KAAK,sBAAsB,EAG3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,KAAK,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,WAAW,CAAC,iBAAiB,CAAC;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM;IAGzB,oBAAoB,IAAI,iBAAiB;IAI1C,cAAc,CACnB,IAAI,EAAE,sBAAsB,EAAE,EAC9B,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;CAoC/B"}
+{"version":3,"file":"deleteRules.d.ts","sourceRoot":"","sources":["../../../src/api/delete/deleteRules.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EACN,KAAK,sBAAsB,EAG3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,KAAK,iBAAiB,GAAG,OAAO,CAC/B,sBAAsB,EAAE,EACxB,CAAC,CAAC,UAAU,EACZ,OAAO,CACP,CAAC;AAEF,qBAAa,mBAAoB,YAAW,WAAW,CAAC,iBAAiB,CAAC;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM;IAGzB,oBAAoB,IAAI,iBAAiB;IAI1C,cAAc,CACnB,IAAI,EAAE,sBAAsB,EAAE,EAC9B,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;CAoC/B"}

package/dist/api/delete/deleteRules.js.map

@@ -1 +1 @@
-{"version":3,"file":"deleteRules.js","sourceRoot":"","sources":["../../../src/api/delete/deleteRules.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAEN,sBAAsB,EACtB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AAKxC,MAAM,OAAO,mBAAmB;IAC/B,YACkB,kBAAsC,EACtC,MAAc;QADd,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAEG,oBAAoB;QAC1B,OAAO,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,IAA8B,EAC9B,MAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAClC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;YAEpE,MAAM,0BAA0B,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;gBAGtE,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAE5C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;oBAEzD,YAAY,IAAI,aAAa,CAAC,MAAM,CAAC;oBAErC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;wBACf,GAAG,EAAE,wBAAwB;wBAC7B,IAAI,EAAE;4BACL,gBAAgB;4BAChB,aAAa;yBACb;qBACD,CAAC,CAAC,CAAC;gBACL,CAAC;YACF,CAAC,CAAC,CAAC;QACJ,CAAC;QAED,OAAO;YACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;YACzC,IAAI,EAAE;gBACL,aAAa,EAAE,YAAY;aAC3B;SACD,CAAC;IACH,CAAC;CACD"}
+{"version":3,"file":"deleteRules.js","sourceRoot":"","sources":["../../../src/api/delete/deleteRules.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAEN,sBAAsB,EACtB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AAWxC,MAAM,OAAO,mBAAmB;IAC/B,YACkB,kBAAsC,EACtC,MAAc;QADd,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAEG,oBAAoB;QAC1B,OAAO,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,IAA8B,EAC9B,MAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAClC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;YAEpE,MAAM,0BAA0B,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;gBAGtE,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAE5C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;oBAEzD,YAAY,IAAI,aAAa,CAAC,MAAM,CAAC;oBAErC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;wBACf,GAAG,EAAE,wBAAwB;wBAC7B,IAAI,EAAE;4BACL,gBAAgB;4BAChB,aAAa;yBACb;qBACD,CAAC,CAAC,CAAC;gBACL,CAAC;YACF,CAAC,CAAC,CAAC;QACJ,CAAC;QAED,OAAO;YACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;YACzC,IAAI,EAAE;gBACL,aAAa,EAAE,YAAY;aAC3B;SACD,CAAC;IACH,CAAC;CACD"}

package/dist/api/read/findRuleIds.d.ts

@@ -3,7 +3,7 @@ import type { Logger } from "@prosopo/logger";
 import { type ZodType, z } from "zod";
 import { type AccessRulesFilterInput } from "#policy/ruleInput/ruleInput.js";
 import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-type FindRulesSchema = ZodType<AccessRulesFilterInput[]>;
+type FindRulesSchema = ZodType<AccessRulesFilterInput[], z.ZodTypeDef, unknown>;
 export type RuleIdsResponse = {
     ruleIds: string[];
 };

package/dist/api/read/findRuleIds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"findRuleIds.d.ts","sourceRoot":"","sources":["../../../src/api/read/findRuleIds.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EACN,KAAK,sBAAsB,EAG3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,KAAK,eAAe,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;AAEzD,MAAM,MAAM,eAAe,GAAG;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;EAE4C,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,GAAG;IAC3D,IAAI,CAAC,EAAE,eAAe,CAAC;CACvB,CAAC;AAEF,qBAAa,mBAAoB,YAAW,WAAW,CAAC,eAAe,CAAC;IAEtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM;IAGzB,oBAAoB,IAAI,eAAe;IAIxC,cAAc,CACnB,IAAI,EAAE,sBAAsB,EAAE,EAC9B,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,CAAC;CAsCnC"}
+{"version":3,"file":"findRuleIds.d.ts","sourceRoot":"","sources":["../../../src/api/read/findRuleIds.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EACN,KAAK,sBAAsB,EAG3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,KAAK,eAAe,GAAG,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAEhF,MAAM,MAAM,eAAe,GAAG;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;EAE4C,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,GAAG;IAC3D,IAAI,CAAC,EAAE,eAAe,CAAC;CACvB,CAAC;AAEF,qBAAa,mBAAoB,YAAW,WAAW,CAAC,eAAe,CAAC;IAEtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM;IAGzB,oBAAoB,IAAI,eAAe;IAIxC,cAAc,CACnB,IAAI,EAAE,sBAAsB,EAAE,EAC9B,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,CAAC;CAsCnC"}

package/dist/api/read/findRuleIds.js.map

@@ -1 +1 @@
-{"version":3,"file":"findRuleIds.js","sourceRoot":"","sources":["../../../src/api/read/findRuleIds.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAgB,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE3E,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAEN,sBAAsB,EACtB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AASxC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CACQ,CAAoC,CAAC;AAMzE,MAAM,OAAO,mBAAmB;IAC/B,YACkB,kBAAsC,EACtC,MAAc;QADd,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAEG,oBAAoB;QAC1B,OAAO,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,IAA8B,EAC9B,MAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,0BAA0B,CACrD,IAAI,EACJ,KAAK,EAAE,gBAAgB,EAAE,EAAE;YAC1B,MAAM,WAAW,GAAG,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;YAEpE,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC/C,WAAW,EACX,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAC/D,CAAC;YAEF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CACD,CAAC;QAEF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QAGrC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5C,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACf,GAAG,EAAE,sBAAsB;YAC3B,IAAI,EAAE;gBACL,eAAe,EAAE,OAAO,CAAC,MAAM;gBAC/B,gBAAgB,EAAE,aAAa,CAAC,MAAM;gBACtC,aAAa,EAAE,IAAI;gBACnB,QAAQ,EAAE,aAAa;aACvB;SACD,CAAC,CAAC,CAAC;QAEJ,OAAO;YACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;YACzC,IAAI,EAAE;gBACL,OAAO,EAAE,aAAa;aACtB;SACD,CAAC;IACH,CAAC;CACD"}
+{"version":3,"file":"findRuleIds.js","sourceRoot":"","sources":["../../../src/api/read/findRuleIds.ts"],"names":[],"mappings":"AAcA,OAAO,EAGN,yBAAyB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAgB,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE3E,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAEN,sBAAsB,EACtB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AAWxC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CACQ,CAAoC,CAAC;AAMzE,MAAM,OAAO,mBAAmB;IAC/B,YACkB,kBAAsC,EACtC,MAAc;QADd,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAEG,oBAAoB;QAC1B,OAAO,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,IAA8B,EAC9B,MAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,0BAA0B,CACrD,IAAI,EACJ,KAAK,EAAE,gBAAgB,EAAE,EAAE;YAC1B,MAAM,WAAW,GAAG,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;YAEpE,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC/C,WAAW,EACX,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAC/D,CAAC;YAEF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CACD,CAAC;QAEF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QAGrC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5C,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACf,GAAG,EAAE,sBAAsB;YAC3B,IAAI,EAAE;gBACL,eAAe,EAAE,OAAO,CAAC,MAAM;gBAC/B,gBAAgB,EAAE,aAAa,CAAC,MAAM;gBACtC,aAAa,EAAE,IAAI;gBACnB,QAAQ,EAAE,aAAa;aACvB;SACD,CAAC,CAAC,CAAC;QAEJ,OAAO;YACN,MAAM,EAAE,yBAAyB,CAAC,OAAO;YACzC,IAAI,EAAE;gBACL,OAAO,EAAE,aAAa;aACtB;SACD,CAAC;IACH,CAAC;CACD"}

package/dist/cjs/redis/reader/redisRulesQuery.cjs

@@ -87,12 +87,13 @@ const getUserScopeFieldQuery = (fieldName, fieldValue, scopeMatch, fullScope) =>
   const queryValue = FIELDS_REQUIRING_ESCAPE.has(fieldName) ? escapeTagValue(stringValue) : stringValue;
   return `@${fieldName}:{${queryValue}}`;
 };
+const GLOBAL_MATCH_CLAUSE_INNER = `@clientId:{${rule.GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
 const getPolicyScopeQuery = (policyScope, scopeMatch) => {
   const clientId = policyScope?.clientId;
   if ("string" === typeof clientId) {
-    return rulesStorage.FilterScopeMatch.Exact === scopeMatch ? `@clientId:{${clientId}}` : `( @clientId:{${clientId}} | ismissing(@clientId) )`;
+    return rulesStorage.FilterScopeMatch.Exact === scopeMatch ? `@clientId:{${clientId}}` : `( @clientId:{${clientId}} | ${GLOBAL_MATCH_CLAUSE_INNER} )`;
   }
-  return rulesStorage.FilterScopeMatch.Exact === scopeMatch ? "ismissing(@clientId)" : "";
+  return rulesStorage.FilterScopeMatch.Exact === scopeMatch ? `( ${GLOBAL_MATCH_CLAUSE_INNER} )` : "";
 };
 const getRulesRedisQuery = (filter, matchingFieldsOnly) => {
   const { policyScope, userScope } = filter;

package/dist/cjs/redis/reader/redisRulesReader.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const util = require("node:util");
 const common = require("@prosopo/common");
 const redisRulesQuery = require("./redisRulesQuery.cjs");
+const redisRulesSplitQuery = require("./redisRulesSplitQuery.cjs");
 const redisClient = require("../redisClient.cjs");
 const redisRuleIndex = require("../redisRuleIndex.cjs");
 const rule = require("../../rule.cjs");
@@ -27,6 +28,7 @@ function _interopNamespaceDefault(e) {
 const util__namespace = /* @__PURE__ */ _interopNamespaceDefault(util);
 const SERVER_SIDE_RANK_TOP_N = 20;
 const GREEDY_MAX_CANDIDATES = redisClient.REDIS_BATCH_SIZE * 10;
+const SPLIT_MAX_CANDIDATES_PER_SUB = 500;
 const SPECIFICITY_EXPR = [
   "exists(@clientId)",
   "exists(@userId)",
@@ -94,14 +96,112 @@ class RedisRulesReader {
   }
   async findRules(filter, matchingFieldsOnly = false, skipEmptyUserScopes = true) {
     const query = redisRulesQuery.getRulesRedisQuery(filter, matchingFieldsOnly);
-    if (skipEmptyUserScopes && query === "ismissing(@clientId)") {
+    if (skipEmptyUserScopes && // Sentinel query shape emitted by getPolicyScopeQuery when the
+    // caller passed neither a userScope nor a clientId — i.e. an
+    // empty filter that would otherwise resolve to "all global
+    // rules". Guard so an accidentally-empty filter can't return
+    // the full global rule set. The exact literal must stay in
+    // sync with GLOBAL_MATCH_CLAUSE_INNER over there.
+    query === "( @clientId:{global} | ismissing(@clientId) )") {
       return [];
     }
+    if (matchingFieldsOnly && filter.blockOnly && filter.userScope !== void 0) {
+      return this.findBlockRulesSplit(filter);
+    }
     if (matchingFieldsOnly) {
       return this.findRulesRanked(filter, query);
     }
     return this.findRulesGreedy(filter, query);
   }
+  // Union candidate keys from each split sub-query, de-dupe, HGETALL,
+  // parse, hand back to `getPrioritisedAccessRule` for JS-side ranking.
+  // Ranking stays in JS because rankCandidateRules already encodes the
+  // strict "every populated rule field matches request" semantics —
+  // FT can't express that shape cheaply and the previous server-side
+  // APPLY / SORTBY imposed the linear-per-rule cost we're eliminating.
+  async findBlockRulesSplit(filter) {
+    const userScope = filter.userScope;
+    if (userScope === void 0) {
+      return [];
+    }
+    const clientId = filter.policyScope?.clientId;
+    const subQueries = redisRulesSplitQuery.buildScopedBlockSubQueries(userScope, clientId);
+    try {
+      const keyLists = await Promise.all(
+        subQueries.map(
+          (sub) => redisAggregate.aggregateRedisKeys(
+            this.client,
+            sub.query,
+            this.logger,
+            void 0,
+            // Per-sub-query cap. Each probe hits a discriminating
+            // index (e.g. numericIp posting list), so the natural
+            // cardinality is tiny — this cap only fires on
+            // pathological rule-set shapes and mirrors
+            // SPLIT_MAX_CANDIDATES_PER_SUB below.
+            SPLIT_MAX_CANDIDATES_PER_SUB
+          ).catch((err) => {
+            this.logger.error(() => ({
+              err,
+              data: {
+                inspect: util__namespace.inspect(
+                  { subKind: sub.kind, query: sub.query },
+                  { depth: null }
+                )
+              },
+              msg: "failed to execute split block sub-query"
+            }));
+            return [];
+          })
+        )
+      );
+      const uniqueKeys = /* @__PURE__ */ new Set();
+      for (const list of keyLists) {
+        for (const key of list) {
+          uniqueKeys.add(key);
+        }
+      }
+      if (uniqueKeys.size === 0) {
+        return [];
+      }
+      const ruleKeys = [...uniqueKeys];
+      this.logger.debug(() => ({
+        msg: "Executed split block sub-queries",
+        data: {
+          inspect: util__namespace.inspect(
+            {
+              subQueryCount: subQueries.length,
+              uniqueCandidates: ruleKeys.length,
+              perSubQueryCounts: keyLists.map((l, i) => ({
+                kind: subQueries[i]?.kind,
+                found: l.length
+              })),
+              filter
+            },
+            { depth: null }
+          )
+        }
+      }));
+      const { records } = await redisClient.fetchRedisHashRecords(
+        this.client,
+        ruleKeys,
+        this.logger
+      );
+      const nonEmptyRecords = records.filter(
+        (record) => Object.keys(record).length > 0
+      );
+      return redisClient.parseRedisRecords(nonEmptyRecords, ruleInput.accessRuleInput, this.logger);
+    } catch (e) {
+      this.logger.error(() => ({
+        err: e,
+        data: {
+          inspect: util__namespace.inspect({ filter }, { depth: null })
+        },
+        msg: "failed to execute split block query set"
+      }));
+      return [];
+    }
+  }
   async findRulesRanked(filter, query) {
     try {
       const reply = await this.client.ft.aggregate(

package/dist/cjs/redis/reader/redisRulesSplitQuery.cjs

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const rule = require("../../rule.cjs");
+const escapeTagValue = (value) => value.replace(/([,.<>{}\[\]"':;!@#$%^&*()\-+=~|/\\])/g, "\\$1");
+const FIELDS_REQUIRING_ESCAPE = /* @__PURE__ */ new Set([
+  "coords"
+]);
+const NUMERIC_FIELDS = /* @__PURE__ */ new Set(["asn"]);
+const SCALAR_USER_SCOPE_FIELDS = [
+  "userId",
+  "ja4Hash",
+  "headersHash",
+  "userAgentHash",
+  "headHash",
+  "coords",
+  "countryCode",
+  "asn"
+];
+const ALL_USER_SCOPE_FIELDS = [
+  ...SCALAR_USER_SCOPE_FIELDS,
+  "numericIp",
+  "numericIpMaskMin",
+  "numericIpMaskMax"
+];
+const GLOBAL_SCOPE_INNER = `@clientId:{${rule.GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
+const buildScopeClause = (clientId) => {
+  if (clientId === void 0) {
+    return `( ${GLOBAL_SCOPE_INNER} )`;
+  }
+  return `( @clientId:{${clientId}} | ${GLOBAL_SCOPE_INNER} )`;
+};
+const buildFieldClause = (field, value) => {
+  if (value === void 0) {
+    return null;
+  }
+  const stringValue = String(value);
+  if (NUMERIC_FIELDS.has(field)) {
+    return `@${field}:[${stringValue} ${stringValue}]`;
+  }
+  const queryValue = FIELDS_REQUIRING_ESCAPE.has(field) ? escapeTagValue(stringValue) : stringValue;
+  return `@${field}:{${queryValue}}`;
+};
+const buildScopedBlockSubQueries = (userScope, clientId) => {
+  const typeClause = `@type:{${rule.AccessPolicyType.Block}}`;
+  const scopeClause = buildScopeClause(clientId);
+  const prefix = `${typeClause} ${scopeClause}`;
+  const subQueries = [];
+  for (const field of SCALAR_USER_SCOPE_FIELDS) {
+    const clause = buildFieldClause(field, userScope[field]);
+    if (clause === null) {
+      continue;
+    }
+    subQueries.push({
+      kind: `field:${field}`,
+      query: `${prefix} ${clause}`
+    });
+  }
+  const requestIp = userScope.numericIp;
+  if (requestIp !== void 0) {
+    subQueries.push({
+      kind: "ip:exact",
+      query: `${prefix} @numericIp:[${requestIp} ${requestIp}]`
+    });
+    subQueries.push({
+      kind: "ip:mask",
+      query: `${prefix} @numericIpMaskMin:[-inf ${requestIp}] @numericIpMaskMax:[${requestIp} +inf]`
+    });
+  }
+  const noScopeIsmissing = ALL_USER_SCOPE_FIELDS.map(
+    (field) => `ismissing(@${field})`
+  ).join(" ");
+  subQueries.push({
+    kind: "no-user-scope",
+    query: `${prefix} ${noScopeIsmissing}`
+  });
+  return subQueries;
+};
+exports.buildScopedBlockSubQueries = buildScopedBlockSubQueries;

package/dist/cjs/redis/redisRuleIndex.cjs

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const search = require("@redis/search");
 const transformRule = require("../transformRule.cjs");
+const rule = require("../rule.cjs");
 const userIpRedisSchema = {
   numericIpMaskMin: { type: search.SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
   numericIpMaskMax: { type: search.SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
@@ -50,7 +51,8 @@ const accessRulesRedisIndex = {
     PREFIX: [ACCESS_RULE_REDIS_KEY_PREFIX]
   }
 };
-const getAccessRuleRedisKey = (rule) => ACCESS_RULE_REDIS_KEY_PREFIX + transformRule.makeAccessRuleHash(rule);
+const getAccessRuleRedisKey = (rule2) => ACCESS_RULE_REDIS_KEY_PREFIX + transformRule.makeAccessRuleHash(rule2);
+exports.GLOBAL_CLIENT_SCOPE_SENTINEL = rule.GLOBAL_CLIENT_SCOPE_SENTINEL;
 exports.ACCESS_RULES_REDIS_INDEX_NAME = ACCESS_RULES_REDIS_INDEX_NAME;
 exports.ACCESS_RULE_REDIS_KEY_PREFIX = ACCESS_RULE_REDIS_KEY_PREFIX;
 exports.accessRuleRedisSchema = accessRuleRedisSchema;

package/dist/cjs/redis/redisRulesWriter.cjs

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const common = require("@prosopo/common");
 const redisClient = require("./redisClient.cjs");
+const rule = require("../rule.cjs");
 const redisRuleIndex = require("./redisRuleIndex.cjs");
 class RedisRulesWriter {
   constructor(client, logger) {
@@ -51,9 +52,9 @@ class RedisRulesWriter {
   async insertRuleEntries(ruleEntries) {
     const queries = this.client.multi();
     const ruleKeys = ruleEntries.map((ruleEntry) => {
-      const { rule, expiresUnixTimestamp } = ruleEntry;
-      const ruleKey = redisRuleIndex.getAccessRuleRedisKey(rule);
-      const ruleValue = getRedisRuleValue(rule);
+      const { rule: rule2, expiresUnixTimestamp } = ruleEntry;
+      const ruleKey = redisRuleIndex.getAccessRuleRedisKey(rule2);
+      const ruleValue = getRedisRuleValue(rule2);
       queries.hSet(ruleKey, ruleValue);
       if (expiresUnixTimestamp) {
         const MILLISECOND_THRESHOLD = 1e10;
@@ -70,9 +71,19 @@ class RedisRulesWriter {
     return ruleKeys;
   }
 }
-const getRedisRuleValue = (rule) => Object.fromEntries(
-  Object.entries(rule).map(([key, value]) => [key, String(value)])
-);
+const getRedisRuleValue = (rule$1) => {
+  const record = {};
+  for (const [key, value] of Object.entries(rule$1)) {
+    if (value === void 0) {
+      continue;
+    }
+    record[key] = String(value);
+  }
+  if (record.clientId === void 0) {
+    record.clientId = rule.GLOBAL_CLIENT_SCOPE_SENTINEL;
+  }
+  return record;
+};
 class DummyRedisRulesWriter {
   constructor(logger) {
     this.logger = logger;