@prosopo/user-access-policy 3.12.14 → 3.12.16

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/user-access-policy@3.12.14 build:cjs
+> @prosopo/user-access-policy@3.12.16 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -33,7 +33,7 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 37 modules transformed.
+✓ 38 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/api/accessRulesApiClient.cjs            0.00 kB │ gzip: 0.02 kB
@@ -56,12 +56,13 @@ dist/cjs/api/delete/deleteRuleGroups.cjs         1.43 kB │ gzip: 0.65 kB
 dist/cjs/api/write/rehashRules.cjs               1.48 kB │ gzip: 0.56 kB
 dist/cjs/api/delete/deleteRules.cjs              1.52 kB │ gzip: 0.65 kB
 dist/cjs/mongoose/mongooseRuleSchema.cjs         1.52 kB │ gzip: 0.42 kB
-dist/cjs/.export.cjs                             1.55 kB │ gzip: 0.39 kB
 dist/cjs/api/read/findRuleIds.cjs                1.58 kB │ gzip: 0.66 kB
+dist/cjs/.export.cjs                             1.68 kB │ gzip: 0.42 kB
 dist/cjs/redis/redisClient.cjs                   1.92 kB │ gzip: 0.72 kB
 dist/cjs/classifyOs.cjs                          2.04 kB │ gzip: 1.05 kB
 dist/cjs/ruleInput/policyInput.cjs               2.09 kB │ gzip: 0.79 kB
 dist/cjs/ruleInput/ruleInput.cjs                 2.24 kB │ gzip: 0.67 kB
+dist/cjs/matchedRule.cjs                         2.29 kB │ gzip: 1.03 kB
 dist/cjs/ruleInput/userScopeInput.cjs            2.44 kB │ gzip: 0.77 kB
 dist/cjs/api/rulesApiClient.cjs                  2.53 kB │ gzip: 0.68 kB
 dist/cjs/redis/reader/redisAggregate.cjs         2.57 kB │ gzip: 1.04 kB
@@ -74,4 +75,4 @@ dist/cjs/redis/reader/redisRulesSplitQuery.cjs   4.27 kB │ gzip: 1.92 kB
 dist/cjs/redis/reader/redisRulesQuery.cjs        4.49 kB │ gzip: 1.51 kB
 dist/cjs/redis/reader/redisRulesReader.cjs      11.61 kB │ gzip: 2.81 kB
 
-✓ built in 162ms
+✓ built in 140ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/user-access-policy@3.12.14 build:tsc
+> @prosopo/user-access-policy@3.12.16 build:tsc
 > tsc --build --verbose
 
-7:04:59 AM - Projects in this build: 
+8:07:49 AM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -15,27 +15,27 @@
     * ../api/tsconfig.json
     * tsconfig.json
 
-7:04:59 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/vite-plugin-copy.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-7:04:59 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-7:04:59 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-7:04:59 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-7:04:59 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-7:04:59 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-7:05:00 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-7:05:00 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/index.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-7:05:00 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-7:05:00 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/api.test-d.ts' is older than output '../api/tsconfig.tsbuildinfo'
+8:07:49 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-7:05:00 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+8:07:49 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-7:05:00 AM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
+8:07:49 AM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/user-access-policy@3.12.14 build
+> @prosopo/user-access-policy@3.12.16 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/user-access-policy@3.12.14 build:cross-env
+> @prosopo/user-access-policy@3.12.16 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -37,7 +37,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 37 modules transformed.
+✓ 38 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js          0.04 kB │ gzip: 0.06 kB
@@ -53,7 +53,7 @@ dist/api/.export.js                         0.31 kB │ gzip: 0.16 kB
 dist/rule.js                                0.36 kB │ gzip: 0.23 kB
 dist/ruleRecord.js                          0.66 kB │ gzip: 0.33 kB
 dist/api/delete/deleteAllRules.js           0.73 kB │ gzip: 0.37 kB
-dist/.export.js                             0.91 kB │ gzip: 0.29 kB
+dist/.export.js                             0.98 kB │ gzip: 0.31 kB
 dist/api/read/getMissingIds.js              1.02 kB │ gzip: 0.48 kB
 dist/api/read/fetchRules.js                 1.07 kB │ gzip: 0.49 kB
 dist/redis/redisRulesStorage.js             1.22 kB │ gzip: 0.45 kB
@@ -68,6 +68,7 @@ dist/ruleInput/policyInput.js               1.84 kB │ gzip: 0.73 kB
 dist/classifyOs.js                          1.98 kB │ gzip: 1.03 kB
 dist/ruleInput/userScopeInput.js            2.09 kB │ gzip: 0.67 kB
 dist/api/rulesApiClient.js                  2.12 kB │ gzip: 0.62 kB
+dist/matchedRule.js                         2.22 kB │ gzip: 1.00 kB
 dist/redis/reader/redisAggregate.js         2.35 kB │ gzip: 0.99 kB
 dist/transformRule.js                       2.40 kB │ gzip: 0.94 kB
 dist/redis/redisRuleIndex.js                2.44 kB │ gzip: 0.73 kB
@@ -78,4 +79,4 @@ dist/redis/reader/redisRulesSplitQuery.js   4.18 kB │ gzip: 1.89 kB
 dist/redis/reader/redisRulesQuery.js        4.30 kB │ gzip: 1.47 kB
 dist/redis/reader/redisRulesReader.js      10.19 kB │ gzip: 2.68 kB
 
-✓ built in 110ms
+✓ built in 165ms

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @prosopo/user-access-policy
 
+## 3.12.16
+### Patch Changes
+
+- Updated dependencies [0def557]
+  - @prosopo/types@5.1.0
+  - @prosopo/api@4.0.5
+
+## 3.12.15
+### Patch Changes
+
+- 216f8cd: Record the access rule that actually fired on the record it acted on, so the
+  audit page can name the exact policy behind a block rather than echoing its
+  optional free-text description.
+  
+  Access rules are ephemeral — client rules carry a TTL and are reaped by
+  Mongo's `expiry` index — so an audit row can't answer "which policy blocked
+  me?" by joining to the live rules collection: by the time anyone looks, the
+  rule is usually gone. `describeMatchedRule` snapshots the matched rule (policy
+  type, captcha type, `deferToVerify`, description, rule group, and its scope
+  conditions in record form) onto `Session.matchedRule` at enforcement time.
+  
+  Previously only the request-time block middleware recorded any rule identity,
+  and only as a hash, a field-name list and a description. It is now written by
+  every access-policy path: the block middleware, the frictionless entry (block,
+  auto-ban, forced captcha type, and score-only restrict alike), and the
+  verify-time hard-block check in the PoW / image / puzzle flows — which is where
+  `deferToVerify` rules land, and where "why was I rejected?" was least obvious.
+  
+  `checkForHardBlock` now returns the whole `AccessRule` rather than just its
+  policy half; the runtime value was always the full rule.
+- Updated dependencies [216f8cd]
+  - @prosopo/types@5.0.4
+  - @prosopo/api@4.0.4
+
 ## 3.12.14
 ### Patch Changes
 

package/dist/.export.d.ts

@@ -1,6 +1,7 @@
 export * from "./ruleInput/.export.js";
 export { makeAccessRuleHash, transformAccessRuleRecordIntoRule, transformAccessRuleIntoRecord, } from "./transformRule.js";
 export { type AccessRule, type AccessPolicy, type PolicyScope, type UserScope, AccessPolicyType, } from "./rule.js";
+export { describeMatchedRule } from "./matchedRule.js";
 export { classifyOs, OS_NAMES, type OsName } from "./classifyOs.js";
 export { type AccessRulesFilter, type AccessRulesStorage, type AccessRuleEntry, FilterScopeMatch, } from "./rulesStorage.js";
 export { type AccessRuleRecord, type UserScopeRecord, type UserScopeRecordField, userScopeRecordFields, getUserScopeRecordFromAccessRuleRecord, } from "./ruleRecord.js";

package/dist/.export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}

package/dist/.export.js

@@ -5,6 +5,7 @@ import { accessPolicyInput, policyScopeInput } from "./ruleInput/policyInput.js"
 import { userScopeInput } from "./ruleInput/userScopeInput.js";
 import { accessRuleInput } from "./ruleInput/ruleInput.js";
 import { makeAccessRuleHash, transformAccessRuleIntoRecord, transformAccessRuleRecordIntoRule } from "./transformRule.js";
-import { OS_NAMES, classifyOs } from "./classifyOs.js";
 import { getUserScopeRecordFromAccessRuleRecord, userScopeRecordFields } from "./ruleRecord.js";
-export { AccessPolicyType, FilterScopeMatch, OS_NAMES, accessPolicyInput, accessRuleInput, classifyOs, getUserScopeRecordFromAccessRuleRecord, makeAccessRuleHash, policyScopeInput, transformAccessRuleIntoRecord, transformAccessRuleRecordIntoRule, userScopeInput, userScopeRecordFields };
+import { describeMatchedRule } from "./matchedRule.js";
+import { OS_NAMES, classifyOs } from "./classifyOs.js";
+export { AccessPolicyType, FilterScopeMatch, OS_NAMES, accessPolicyInput, accessRuleInput, classifyOs, describeMatchedRule, getUserScopeRecordFromAccessRuleRecord, makeAccessRuleHash, policyScopeInput, transformAccessRuleIntoRecord, transformAccessRuleRecordIntoRule, userScopeInput, userScopeRecordFields };

package/dist/.export.js.map

@@ -1 +1 @@
-{"version":3,"file":".export.js","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAKN,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAe,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EAIN,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAIN,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":".export.js","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAKN,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAe,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EAIN,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAIN,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}

package/dist/cjs/.export.cjs

@@ -5,14 +5,16 @@ const require_ruleInput_policyInput = require("./ruleInput/policyInput.cjs");
 const require_ruleInput_userScopeInput = require("./ruleInput/userScopeInput.cjs");
 const require_ruleInput_ruleInput = require("./ruleInput/ruleInput.cjs");
 const require_transformRule = require("./transformRule.cjs");
-const require_classifyOs = require("./classifyOs.cjs");
 const require_ruleRecord = require("./ruleRecord.cjs");
+const require_matchedRule = require("./matchedRule.cjs");
+const require_classifyOs = require("./classifyOs.cjs");
 exports.AccessPolicyType = require_rule.AccessPolicyType;
 exports.FilterScopeMatch = require_rulesStorage.FilterScopeMatch;
 exports.OS_NAMES = require_classifyOs.OS_NAMES;
 exports.accessPolicyInput = require_ruleInput_policyInput.accessPolicyInput;
 exports.accessRuleInput = require_ruleInput_ruleInput.accessRuleInput;
 exports.classifyOs = require_classifyOs.classifyOs;
+exports.describeMatchedRule = require_matchedRule.describeMatchedRule;
 exports.getUserScopeRecordFromAccessRuleRecord = require_ruleRecord.getUserScopeRecordFromAccessRuleRecord;
 exports.makeAccessRuleHash = require_transformRule.makeAccessRuleHash;
 exports.policyScopeInput = require_ruleInput_policyInput.policyScopeInput;

package/dist/cjs/matchedRule.cjs

@@ -0,0 +1,59 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_transformRule = require("./transformRule.cjs");
+const require_ruleRecord = require("./ruleRecord.cjs");
+//#region src/matchedRule.ts
+var MAX_CONDITION_VALUE_LENGTH = 256;
+var toCondition = (field, value) => {
+	if (value === void 0 || value === null) return void 0;
+	const asString = typeof value === "string" ? value : String(value);
+	if (asString.length === 0) return void 0;
+	return asString.length > MAX_CONDITION_VALUE_LENGTH ? {
+		field,
+		value: `${asString.slice(0, MAX_CONDITION_VALUE_LENGTH)}…`,
+		truncated: true
+	} : {
+		field,
+		value: asString
+	};
+};
+/**
+* Derive the rule's populated scope fields in record form.
+*
+* Goes through `transformAccessRuleIntoRecord` so the IP triple collapses back
+* to the human-readable `ip` / `ipMask` the operator originally typed, rather
+* than the numeric range the matcher works in, and so the field names match
+* the vocabulary the portal's Access Control page already labels conditions
+* with (`ip`, `ipMask`, `userAgent`, `ja4Hash`, …).
+*/
+var deriveConditions = (rule) => {
+	let scope;
+	try {
+		scope = require_ruleRecord.getUserScopeRecordFromAccessRuleRecord(require_transformRule.transformAccessRuleIntoRecord(rule));
+	} catch {
+		return [];
+	}
+	const conditions = [];
+	for (const field of require_ruleRecord.userScopeRecordFields) {
+		const condition = toCondition(field, scope[field]);
+		if (condition) conditions.push(condition);
+	}
+	return conditions;
+};
+/**
+* Snapshot a matched rule for persistence alongside the request it acted on.
+*
+* Total function: every rule shape yields a value, so callers can inline it
+* into a record literal without a try/catch of their own.
+*/
+var describeMatchedRule = (rule) => ({
+	ruleHash: require_transformRule.makeAccessRuleHash(rule),
+	policyType: rule.type,
+	conditions: deriveConditions(rule),
+	...rule.description !== void 0 && { description: rule.description },
+	...rule.captchaType !== void 0 && { captchaType: rule.captchaType },
+	...rule.deferToVerify !== void 0 && { deferToVerify: rule.deferToVerify },
+	...rule.groupId !== void 0 && { ruleGroupId: rule.groupId },
+	...rule.clientId !== void 0 && { clientId: rule.clientId }
+});
+//#endregion
+exports.describeMatchedRule = describeMatchedRule;

package/dist/matchedRule.d.ts

@@ -0,0 +1,4 @@
+import type { MatchedAccessRule } from "@prosopo/types";
+import type { AccessRule } from "#policy/rule.js";
+export declare const describeMatchedRule: (rule: AccessRule) => MatchedAccessRule;
+//# sourceMappingURL=matchedRule.d.ts.map

package/dist/matchedRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matchedRule.d.ts","sourceRoot":"","sources":["../src/matchedRule.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,iBAAiB,EAAwB,MAAM,gBAAgB,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAwElD,eAAO,MAAM,mBAAmB,SAAU,UAAU,KAAG,iBAWrD,CAAC"}

package/dist/matchedRule.js

@@ -0,0 +1,59 @@
+import "./_virtual/_rolldown/runtime.js";
+import { makeAccessRuleHash, transformAccessRuleIntoRecord } from "./transformRule.js";
+import { getUserScopeRecordFromAccessRuleRecord, userScopeRecordFields } from "./ruleRecord.js";
+//#region src/matchedRule.ts
+var MAX_CONDITION_VALUE_LENGTH = 256;
+var toCondition = (field, value) => {
+	if (value === void 0 || value === null) return void 0;
+	const asString = typeof value === "string" ? value : String(value);
+	if (asString.length === 0) return void 0;
+	return asString.length > MAX_CONDITION_VALUE_LENGTH ? {
+		field,
+		value: `${asString.slice(0, MAX_CONDITION_VALUE_LENGTH)}…`,
+		truncated: true
+	} : {
+		field,
+		value: asString
+	};
+};
+/**
+* Derive the rule's populated scope fields in record form.
+*
+* Goes through `transformAccessRuleIntoRecord` so the IP triple collapses back
+* to the human-readable `ip` / `ipMask` the operator originally typed, rather
+* than the numeric range the matcher works in, and so the field names match
+* the vocabulary the portal's Access Control page already labels conditions
+* with (`ip`, `ipMask`, `userAgent`, `ja4Hash`, …).
+*/
+var deriveConditions = (rule) => {
+	let scope;
+	try {
+		scope = getUserScopeRecordFromAccessRuleRecord(transformAccessRuleIntoRecord(rule));
+	} catch {
+		return [];
+	}
+	const conditions = [];
+	for (const field of userScopeRecordFields) {
+		const condition = toCondition(field, scope[field]);
+		if (condition) conditions.push(condition);
+	}
+	return conditions;
+};
+/**
+* Snapshot a matched rule for persistence alongside the request it acted on.
+*
+* Total function: every rule shape yields a value, so callers can inline it
+* into a record literal without a try/catch of their own.
+*/
+var describeMatchedRule = (rule) => ({
+	ruleHash: makeAccessRuleHash(rule),
+	policyType: rule.type,
+	conditions: deriveConditions(rule),
+	...rule.description !== void 0 && { description: rule.description },
+	...rule.captchaType !== void 0 && { captchaType: rule.captchaType },
+	...rule.deferToVerify !== void 0 && { deferToVerify: rule.deferToVerify },
+	...rule.groupId !== void 0 && { ruleGroupId: rule.groupId },
+	...rule.clientId !== void 0 && { clientId: rule.clientId }
+});
+//#endregion
+export { describeMatchedRule };

package/dist/matchedRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matchedRule.js","sourceRoot":"","sources":["../src/matchedRule.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEN,sCAAsC,EACtC,qBAAqB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,kBAAkB,EAClB,6BAA6B,GAC7B,MAAM,0BAA0B,CAAC;AAMlC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,MAAM,WAAW,GAAG,CACnB,KAA2B,EAC3B,KAAc,EACqB,EAAE;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5D,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,QAAQ,CAAC,MAAM,GAAG,0BAA0B;QAClD,CAAC,CAAC;YACA,KAAK;YACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,GAAG;YAC1D,SAAS,EAAE,IAAI;SACf;QACF,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC,CAAC;AAWF,MAAM,gBAAgB,GAAG,CAAC,IAAgB,EAA0B,EAAE;IACrE,IAAI,KAAqD,CAAC;IAC1D,IAAI,CAAC;QACJ,KAAK,GAAG,sCAAsC,CAC7C,6BAA6B,CAAC,IAAI,CAAC,CACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAIR,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,IAAI,SAAS,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAgB,EAAqB,EAAE,CAAC,CAAC;IAC5E,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;IAClC,UAAU,EAAE,IAAI,CAAC,IAAI;IACrB,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;IAClC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACxE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACxE,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;QACvC,aAAa,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAChE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;CAC/D,CAAC,CAAC"}

package/dist/tests/matchedRule.unit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=matchedRule.unit.test.d.ts.map

package/dist/tests/matchedRule.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matchedRule.unit.test.d.ts","sourceRoot":"","sources":["../../src/tests/matchedRule.unit.test.ts"],"names":[],"mappings":""}

package/dist/tests/matchedRule.unit.test.js

@@ -0,0 +1,142 @@
+import { CaptchaType, MatchedAccessRuleSchema } from "@prosopo/types";
+import { Address4 } from "ip-address";
+import { describe, expect, it } from "vitest";
+import { describeMatchedRule } from "#policy/matchedRule.js";
+import { AccessPolicyType } from "#policy/rule.js";
+import { userScopeRecordFields } from "#policy/ruleRecord.js";
+import { makeAccessRuleHash } from "#policy/transformRule.js";
+describe("describeMatchedRule", () => {
+    it("carries the policy half of the rule", () => {
+        const rule = {
+            type: AccessPolicyType.Restrict,
+            captchaType: CaptchaType.image,
+            description: "6 rounds for this ASN",
+            deferToVerify: true,
+            clientId: "site-key",
+            groupId: "group-1",
+            ja4Hash: "t13d1516h2_8daaf6152771_b186095e22b6",
+        };
+        expect(describeMatchedRule(rule)).toEqual({
+            ruleHash: makeAccessRuleHash(rule),
+            policyType: AccessPolicyType.Restrict,
+            captchaType: CaptchaType.image,
+            description: "6 rounds for this ASN",
+            deferToVerify: true,
+            clientId: "site-key",
+            ruleGroupId: "group-1",
+            conditions: [
+                {
+                    field: "ja4Hash",
+                    value: "t13d1516h2_8daaf6152771_b186095e22b6",
+                },
+            ],
+        });
+    });
+    it("omits policy fields the rule did not set rather than emitting undefined", () => {
+        const described = describeMatchedRule({ type: AccessPolicyType.Block });
+        expect(described).toEqual({
+            ruleHash: makeAccessRuleHash({ type: AccessPolicyType.Block }),
+            policyType: AccessPolicyType.Block,
+            conditions: [],
+        });
+        expect(Object.keys(described)).not.toContain("description");
+        expect(Object.keys(described)).not.toContain("ruleGroupId");
+    });
+    it("reports a single IP in the form the operator typed, not the numeric one", () => {
+        const { conditions } = describeMatchedRule({
+            type: AccessPolicyType.Block,
+            numericIp: new Address4("192.0.2.44").bigInt(),
+        });
+        expect(conditions).toEqual([{ field: "ip", value: "192.0.2.44" }]);
+    });
+    it("collapses an IP range back to its CIDR", () => {
+        const { conditions } = describeMatchedRule({
+            type: AccessPolicyType.Block,
+            numericIpMaskMin: new Address4("198.51.100.64").bigInt(),
+            numericIpMaskMax: new Address4("198.51.100.127").bigInt(),
+        });
+        expect(conditions).toEqual([
+            { field: "ipMask", value: "198.51.100.64/26" },
+        ]);
+    });
+    it("stringifies a numeric asn", () => {
+        const { conditions } = describeMatchedRule({
+            type: AccessPolicyType.Block,
+            asn: 205016,
+        });
+        expect(conditions).toEqual([{ field: "asn", value: "205016" }]);
+    });
+    it("reports every populated scope field, in record vocabulary", () => {
+        const { conditions } = describeMatchedRule({
+            type: AccessPolicyType.Block,
+            userId: "user",
+            ja4Hash: "ja4",
+            headersHash: "headers",
+            userAgentHash: "ua",
+            headHash: "head",
+            coords: "[[1,2]]",
+            countryCode: "GB",
+            asn: 1,
+            os: "macos",
+            numericIp: new Address4("203.0.113.5").bigInt(),
+        });
+        expect(conditions.map((condition) => condition.field)).toEqual([
+            "userId",
+            "ja4Hash",
+            "headersHash",
+            "userAgent",
+            "headHash",
+            "coords",
+            "countryCode",
+            "asn",
+            "os",
+            "ip",
+        ]);
+        for (const condition of conditions) {
+            expect(userScopeRecordFields).toContain(condition.field);
+        }
+    });
+    it("truncates an oversized coords polygon and flags it", () => {
+        const coords = JSON.stringify([Array.from({ length: 200 }, () => [1, 2])]);
+        const { conditions } = describeMatchedRule({
+            type: AccessPolicyType.Block,
+            coords,
+        });
+        const [condition] = conditions;
+        expect(condition?.truncated).toBe(true);
+        expect(condition?.value.length).toBe(257);
+        expect(coords.startsWith(condition?.value.slice(0, -1) ?? "")).toBe(true);
+    });
+    it("leaves a value at the cap untruncated", () => {
+        const coords = "x".repeat(256);
+        const { conditions } = describeMatchedRule({
+            type: AccessPolicyType.Block,
+            coords,
+        });
+        expect(conditions).toEqual([{ field: "coords", value: coords }]);
+    });
+    it("still describes a rule whose scope cannot be transformed", () => {
+        const rule = {
+            type: AccessPolicyType.Block,
+            description: "unrepresentable range",
+            numericIpMaskMin: new Address4("198.51.100.200").bigInt(),
+            numericIpMaskMax: new Address4("198.51.100.1").bigInt(),
+        };
+        expect(() => describeMatchedRule(rule)).not.toThrow();
+        expect(describeMatchedRule(rule)).toEqual({
+            ruleHash: makeAccessRuleHash(rule),
+            policyType: AccessPolicyType.Block,
+            description: "unrepresentable range",
+            conditions: [],
+        });
+    });
+    it("produces a value the persisted schema accepts", () => {
+        const described = describeMatchedRule({
+            type: AccessPolicyType.Restrict,
+            captchaType: CaptchaType.pow,
+            countryCode: "CN",
+        });
+        expect(MatchedAccessRuleSchema.safeParse(described).success).toBe(true);
+    });
+});
+//# sourceMappingURL=matchedRule.unit.test.js.map

package/dist/tests/matchedRule.unit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matchedRule.unit.test.js","sourceRoot":"","sources":["../../src/tests/matchedRule.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAmB,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC9C,MAAM,IAAI,GAAe;YACxB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,WAAW,EAAE,uBAAuB;YACpC,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,sCAAsC;SAC/C,CAAC;QAEF,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,UAAU,EAAE,gBAAgB,CAAC,QAAQ;YACrC,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,WAAW,EAAE,uBAAuB;YACpC,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,UAAU;YAIpB,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE;gBACX;oBACC,KAAK,EAAE,SAAS;oBAChB,KAAK,EAAE,sCAAsC;iBAC7C;aACD;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAClF,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC;QAExE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;YACzB,QAAQ,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC9D,UAAU,EAAE,gBAAgB,CAAC,KAAK;YAClC,UAAU,EAAE,EAAE;SACd,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAClF,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,SAAS,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE;SAC9C,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,gBAAgB,EAAE,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE;YACxD,gBAAgB,EAAE,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE;SACzD,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YAC1B,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;SAC9C,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACpC,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,GAAG,EAAE,MAAM;SACX,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACpE,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,SAAS;YAGtB,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,CAAC;YACN,EAAE,EAAE,OAAO;YACX,SAAS,EAAE,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,QAAQ;YACR,SAAS;YACT,aAAa;YACb,WAAW;YACX,UAAU;YACV,QAAQ;YACR,aAAa;YACb,KAAK;YACL,IAAI;YACJ,IAAI;SACJ,CAAC,CAAC;QAEH,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACpC,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,MAAM;SACN,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC;QAC/B,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,MAAM;SACN,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAInE,MAAM,IAAI,GAAe;YACxB,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,uBAAuB;YACpC,gBAAgB,EAAE,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE;YACzD,gBAAgB,EAAE,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;SACvD,CAAC;QAEF,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,UAAU,EAAE,gBAAgB,CAAC,KAAK;YAClC,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,EAAE;SACd,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,SAAS,GAAG,mBAAmB,CAAC;YACrC,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,WAAW,EAAE,WAAW,CAAC,GAAG;YAC5B,WAAW,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/user-access-policy",
-	"version": "3.12.14",
+	"version": "3.12.16",
 	"type": "module",
 	"engines": {
 		"node": "^24",
@@ -43,12 +43,12 @@
 		"test": "npm run test:unit && npm run test:integration"
 	},
 	"dependencies": {
-		"@prosopo/api": "4.0.3",
+		"@prosopo/api": "4.0.5",
 		"@prosopo/api-route": "2.6.55",
 		"@prosopo/common": "3.1.50",
 		"@prosopo/logger": "2.0.6",
 		"@prosopo/redis-client": "1.0.32",
-		"@prosopo/types": "5.0.3",
+		"@prosopo/types": "5.1.0",
 		"@prosopo/util": "3.3.6",
 		"@redis/search": "5.0.0",
 		"cidr-calc": "1.0.4",
@@ -58,7 +58,7 @@
 		"zod": "3.23.8"
 	},
 	"devDependencies": {
-		"@prosopo/config": "3.3.7",
+		"@prosopo/config": "3.3.8",
 		"@prosopo/util-crypto": "13.5.30",
 		"@types/node": "22.10.2",
 		"fast-glob": "3.3.2",

package/src/.export.ts

@@ -28,6 +28,8 @@ export {
 	AccessPolicyType,
 } from "./rule.js";
 
+export { describeMatchedRule } from "./matchedRule.js";
+
 export { classifyOs, OS_NAMES, type OsName } from "./classifyOs.js";
 
 export {