@prosopo/user-access-policy 3.12.32 → 3.13.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/user-access-policy@3.12.32 build:cjs
+> @prosopo/user-access-policy@3.13.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -33,7 +33,7 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 38 modules transformed.
+✓ 40 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/api/accessRulesApiClient.cjs            0.00 kB │ gzip: 0.02 kB
@@ -47,32 +47,34 @@ dist/cjs/rule.cjs                                0.45 kB │ gzip: 0.26 kB
 dist/cjs/api/.export.cjs                         0.53 kB │ gzip: 0.21 kB
 dist/cjs/ruleInput/.export.cjs                   0.57 kB │ gzip: 0.20 kB
 dist/cjs/api/delete/deleteAllRules.cjs           0.79 kB │ gzip: 0.41 kB
-dist/cjs/ruleRecord.cjs                          0.83 kB │ gzip: 0.35 kB
+dist/cjs/ruleRecord.cjs                          0.90 kB │ gzip: 0.38 kB
 dist/cjs/_virtual/_rolldown/runtime.cjs          1.00 kB │ gzip: 0.50 kB
 dist/cjs/api/read/getMissingIds.cjs              1.12 kB │ gzip: 0.51 kB
 dist/cjs/api/read/fetchRules.cjs                 1.22 kB │ gzip: 0.54 kB
 dist/cjs/redis/redisRulesStorage.cjs             1.41 kB │ gzip: 0.49 kB
 dist/cjs/api/delete/deleteRuleGroups.cjs         1.43 kB │ gzip: 0.65 kB
+dist/cjs/classifyBrowser.cjs                     1.45 kB │ gzip: 0.73 kB
 dist/cjs/api/write/rehashRules.cjs               1.48 kB │ gzip: 0.56 kB
 dist/cjs/api/delete/deleteRules.cjs              1.52 kB │ gzip: 0.65 kB
-dist/cjs/mongoose/mongooseRuleSchema.cjs         1.52 kB │ gzip: 0.42 kB
 dist/cjs/api/read/findRuleIds.cjs                1.58 kB │ gzip: 0.66 kB
-dist/cjs/.export.cjs                             1.68 kB │ gzip: 0.42 kB
+dist/cjs/mongoose/mongooseRuleSchema.cjs         1.79 kB │ gzip: 0.45 kB
 dist/cjs/redis/redisClient.cjs                   1.92 kB │ gzip: 0.72 kB
 dist/cjs/classifyOs.cjs                          2.04 kB │ gzip: 1.05 kB
 dist/cjs/ruleInput/policyInput.cjs               2.09 kB │ gzip: 0.79 kB
 dist/cjs/ruleInput/ruleInput.cjs                 2.28 kB │ gzip: 0.69 kB
 dist/cjs/matchedRule.cjs                         2.29 kB │ gzip: 1.03 kB
-dist/cjs/ruleInput/userScopeInput.cjs            2.44 kB │ gzip: 0.77 kB
+dist/cjs/.export.cjs                             2.44 kB │ gzip: 0.57 kB
 dist/cjs/api/rulesApiClient.cjs                  2.53 kB │ gzip: 0.68 kB
 dist/cjs/redis/reader/redisAggregate.cjs         2.57 kB │ gzip: 1.04 kB
+dist/cjs/ruleInput/userScopeInput.cjs            2.67 kB │ gzip: 0.81 kB
 dist/cjs/transformRule.cjs                       2.90 kB │ gzip: 1.03 kB
-dist/cjs/redis/redisRuleIndex.cjs                3.12 kB │ gzip: 0.82 kB
 dist/cjs/api/write/insertRules.cjs               3.12 kB │ gzip: 1.09 kB
 dist/cjs/redis/redisRulesWriter.cjs              3.50 kB │ gzip: 1.15 kB
+dist/cjs/redis/redisRuleIndex.cjs                3.55 kB │ gzip: 0.85 kB
 dist/cjs/api/ruleApiRoutes.cjs                   4.14 kB │ gzip: 1.06 kB
 dist/cjs/redis/reader/redisRulesQuery.cjs        4.76 kB │ gzip: 1.58 kB
-dist/cjs/redis/reader/redisRulesSplitQuery.cjs   5.15 kB │ gzip: 2.16 kB
-dist/cjs/redis/reader/redisRulesReader.cjs      11.68 kB │ gzip: 2.84 kB
+dist/cjs/redis/reader/redisRulesSplitQuery.cjs   5.17 kB │ gzip: 2.17 kB
+dist/cjs/headerMatch.cjs                         5.74 kB │ gzip: 2.25 kB
+dist/cjs/redis/reader/redisRulesReader.cjs      11.85 kB │ gzip: 2.88 kB
 
-✓ built in 90ms
+✓ built in 116ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/user-access-policy@3.12.32 build:tsc
+> @prosopo/user-access-policy@3.13.0 build:tsc
 > tsc --build --verbose
 
-1:56:23 PM - Projects in this build: 
+1:15:14 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -15,27 +15,27 @@
     * ../api/tsconfig.json
     * tsconfig.json
 
-1:56:23 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/index.ts' is older than output '../types/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/utils/batches.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/index.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+1:15:14 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-1:56:23 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+1:15:14 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-1:56:23 PM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
+1:15:14 PM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/user-access-policy@3.12.32 build
+> @prosopo/user-access-policy@3.13.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/user-access-policy@3.12.32 build:cross-env
+> @prosopo/user-access-policy@3.13.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -37,7 +37,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 38 modules transformed.
+✓ 40 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js          0.04 kB │ gzip: 0.06 kB
@@ -51,32 +51,34 @@ dist/rulesStorage.js                        0.29 kB │ gzip: 0.19 kB
 dist/ruleInput/.export.js                   0.30 kB │ gzip: 0.14 kB
 dist/api/.export.js                         0.31 kB │ gzip: 0.16 kB
 dist/rule.js                                0.36 kB │ gzip: 0.23 kB
-dist/ruleRecord.js                          0.66 kB │ gzip: 0.33 kB
 dist/api/delete/deleteAllRules.js           0.73 kB │ gzip: 0.37 kB
-dist/.export.js                             0.98 kB │ gzip: 0.31 kB
+dist/ruleRecord.js                          0.74 kB │ gzip: 0.35 kB
 dist/api/read/getMissingIds.js              1.02 kB │ gzip: 0.48 kB
 dist/api/read/fetchRules.js                 1.07 kB │ gzip: 0.49 kB
 dist/redis/redisRulesStorage.js             1.22 kB │ gzip: 0.45 kB
 dist/api/delete/deleteRuleGroups.js         1.32 kB │ gzip: 0.61 kB
 dist/api/delete/deleteRules.js              1.36 kB │ gzip: 0.58 kB
+dist/classifyBrowser.js                     1.38 kB │ gzip: 0.71 kB
 dist/api/read/findRuleIds.js                1.39 kB │ gzip: 0.60 kB
 dist/api/write/rehashRules.js               1.42 kB │ gzip: 0.53 kB
-dist/mongoose/mongooseRuleSchema.js         1.47 kB │ gzip: 0.40 kB
+dist/.export.js                             1.43 kB │ gzip: 0.42 kB
+dist/mongoose/mongooseRuleSchema.js         1.74 kB │ gzip: 0.43 kB
 dist/redis/redisClient.js                   1.78 kB │ gzip: 0.68 kB
 dist/ruleInput/ruleInput.js                 1.80 kB │ gzip: 0.63 kB
 dist/ruleInput/policyInput.js               1.84 kB │ gzip: 0.73 kB
 dist/classifyOs.js                          1.98 kB │ gzip: 1.03 kB
-dist/ruleInput/userScopeInput.js            2.09 kB │ gzip: 0.67 kB
 dist/api/rulesApiClient.js                  2.12 kB │ gzip: 0.62 kB
 dist/matchedRule.js                         2.22 kB │ gzip: 1.00 kB
+dist/ruleInput/userScopeInput.js            2.31 kB │ gzip: 0.70 kB
 dist/redis/reader/redisAggregate.js         2.35 kB │ gzip: 0.99 kB
 dist/transformRule.js                       2.40 kB │ gzip: 0.94 kB
-dist/redis/redisRuleIndex.js                2.51 kB │ gzip: 0.74 kB
 dist/api/write/insertRules.js               2.87 kB │ gzip: 1.03 kB
+dist/redis/redisRuleIndex.js                2.87 kB │ gzip: 0.77 kB
 dist/redis/redisRulesWriter.js              3.03 kB │ gzip: 1.07 kB
 dist/api/ruleApiRoutes.js                   3.68 kB │ gzip: 0.99 kB
 dist/redis/reader/redisRulesQuery.js        4.53 kB │ gzip: 1.54 kB
-dist/redis/reader/redisRulesSplitQuery.js   4.96 kB │ gzip: 2.13 kB
-dist/redis/reader/redisRulesReader.js      10.27 kB │ gzip: 2.70 kB
+dist/redis/reader/redisRulesSplitQuery.js   4.98 kB │ gzip: 2.14 kB
+dist/headerMatch.js                         5.51 kB │ gzip: 2.22 kB
+dist/redis/reader/redisRulesReader.js      10.44 kB │ gzip: 2.74 kB
 
-✓ built in 85ms
+✓ built in 149ms

package/CHANGELOG.md

@@ -1,5 +1,96 @@
 # @prosopo/user-access-policy
 
+## 3.13.0
+### Minor Changes
+
+- e22d5fb: Add an arbitrary-header match dimension to user access policies.
+  
+  A `Block` or `Restrict` rule can now target a named request header with an `equals`, `contains`, `notEquals`, `notContains`, `notEqualsAny` or `notContainsAny` operator. The negated operators back the portal's allow-list mode — block unless the header matches; the `*Any` pair carries a list of accepted values in `headerValue` so an allow-list over several values of the same header fires only when the header matches none of them (separate single-value rules would each fire on the other's value and block everything). Because substring `contains` and per-rule operators can't be expressed as a Redis TAG query — and an allow-list rule must still fire on a request that omits the header — the header condition is carried on the rule as `headerName`/`headerValue`/`headerOperator` and evaluated in code against the raw request headers, while an indexed `headerMatch` sentinel makes every header rule a matching candidate for every request. Header rules contribute one point to rule specificity ranking, mirroring the other scalar dimensions.
+  
+  The raw request headers are a **required** argument of `getPrioritisedAccessRule` / `CaptchaManager.getPrioritisedAccessPolicies`, with no default. A negated header operator treats a missing header as "does not match", so a lookup that quietly ran with an empty header map would fire every allow-list rule on every request. Every lookup now passes them: the request-time block middleware, the verify-path hard-block check, the `/frictionless` policy and dedup lookups, and the image / PoW / puzzle challenge endpoints.
+  
+  `getPrioritisedAccessRule` now caches only the candidate fetch and ranks per request, because the header verdict depends on data that is not part of the cache key. This also closes a latent gap where `os` was never part of `hardBlockCacheKey`, so a cached ranked list could serve one operating system's verdict to a request from another.
+
+### Patch Changes
+
+- 6f57ee9: chore(deps): bump yargs from 17.7.2 to 18.1.0
+- 6f57ee9: chore(deps): bump the npm-minor-and-patch group across 1 directory with 3 updates
+- Updated dependencies [6f57ee9]
+- Updated dependencies [d288371]
+  - @prosopo/types@5.7.0
+  - @prosopo/util@3.3.9
+  - @prosopo/api@4.1.6
+  - @prosopo/api-route@2.6.58
+  - @prosopo/common@3.1.54
+  - @prosopo/logger@2.0.9
+  - @prosopo/redis-client@1.0.35
+
+## 3.12.33
+### Patch Changes
+
+- 7fd6eb2: Add a `browser` match dimension to access rules.
+  
+  Rules can now be scoped to the browser classified server-side from the request
+  User-Agent (`chrome`, `safari`, `firefox`, `edge`, `opera`, `samsung_internet`,
+  `wechat`, `facebook`, `instagram`, `ie`, `unknown`), mirroring the existing `os`
+  dimension. The classifier duplicates `@prosopo/decision-machines`' `uaClassify`
+  because the provider request path cannot depend on that package.
+  
+  Also fixes `os` never getting its own probe on the Redis split-query hot path:
+  `SCALAR_USER_SCOPE_FIELDS` in `redisRulesSplitQuery` had not been updated when
+  the OS dimension landed, so an OS-only rule was reachable only via the
+  `no-user-scope` fall-through, competing for that probe's candidate budget
+  against genuine client-wide blocks.
+  
+  The Redis index gains a `browser` TAG field. `createRedisIndex` hashes the index
+  definition and drops/recreates when the hash changes, so this needs no manual
+  migration — verified locally: the index came back carrying `browser` and the
+  stored hash moved to match.
+- 89dd38a: chore(deps): batch the outstanding dependabot bumps into one upgrade
+  
+  Rolls up dependabot PRs #3112, #3127-#3134 and #3159. Majors: `mongoose`
+  8 -> 9, `bson` 6 -> 7, `@noble/curves` 1 -> 2, `@polkadot/util-crypto`
+  13 -> 14, `@typegoose/auto-increment` 4 -> 5, `@babel/preset-env` 7 -> 8,
+  `@types/jsdom` 21 -> 30, `@types/bcrypt` 5 -> 6, `@actions/github` 6 -> 9,
+  `testcontainers` 11 -> 12. The rest are minor/patch.
+  
+  Code changes the majors forced:
+  - `@noble/curves` v2 requires `.js` specifiers and renamed the point API,
+    so `secp256k1.ProjectivePoint.fromHex(...).toRawBytes()` becomes
+    `secp256k1.Point.fromBytes(...).toBytes()`, `RistrettoPoint` becomes
+    `ristretto255.Point`, and `abstract/utils` moves to `utils.js`.
+  - mongoose 9 drops `RootFilterQuery` (now `QueryFilter`), no longer sets
+    `background: true` on schema indexes by default, and no longer declares
+    `id` on `Document`, which un-hid a mismatch between
+    `updateDappUserCommitment`'s `Hash` parameter and the `string` `id` it
+    filters on.
+  - mongoose 9 rejects an aggregation-pipeline update (an array) unless the
+    call passes `updatePipeline: true`, so the six pipeline writes in
+    `ProviderDatabase` now opt in explicitly.
+  - mongoose 9's `castUpdate` throws on a `$setOnInsert` key inside `$set`.
+    `storeUserImageCaptchaSolution` passed its record straight in as the
+    update, and mongoose's `moveImmutableProperties` mutates that object on
+    an upsert -- adding the very `$setOnInsert` key the record then carried
+    into `CentralDbStreamer.streamImageRecord`. Image records stopped
+    reaching the central DB (the streamer is fire-and-forget, so it only
+    logged) and signup verification returned 500. The update is now an
+    explicit `$set` over a shallow copy.
+  - `@prosopo/database` moves from mongodb 6.20 to 7.5 to match the driver
+    mongoose 9 pulls, so bson 7 is the only copy resolvable in the package.
+  - `vitest`/`@vitest/coverage-v8` go to 4.1.11 alongside dependabot's
+    `@vitest/spy` bump; leaving them at 4.1.10 installed a second copy of
+    `@vitest/spy` and broke type inference in the provider test utils.
+- Updated dependencies [89dd38a]
+- Updated dependencies [80f73c1]
+- Updated dependencies [8a670d3]
+  - @prosopo/api@4.1.5
+  - @prosopo/api-route@2.6.57
+  - @prosopo/common@3.1.53
+  - @prosopo/logger@2.0.8
+  - @prosopo/redis-client@1.0.34
+  - @prosopo/types@5.6.0
+  - @prosopo/util@3.3.8
+
 ## 3.12.32
 ### Patch Changes
 

package/dist/.export.d.ts

@@ -3,6 +3,8 @@ export { makeAccessRuleHash, transformAccessRuleRecordIntoRule, transformAccessR
 export { type AccessRule, type AccessPolicy, type PolicyScope, type UserScope, AccessPolicyType, } from "./rule.js";
 export { describeMatchedRule } from "./matchedRule.js";
 export { classifyOs, OS_NAMES, type OsName } from "./classifyOs.js";
+export { classifyBrowser, BROWSER_NAMES, type BrowserName, } from "./classifyBrowser.js";
+export { HEADER_OPERATORS, type HeaderOperator, HEADER_RULE_MARKER, isHeaderOperator, evaluateHeaderCondition, accessRuleHeaderMatches, encodeHeaderValueList, decodeHeaderValueList, } from "./headerMatch.js";
 export { type AccessRulesFilter, type AccessRulesStorage, type AccessRuleEntry, FilterScopeMatch, } from "./rulesStorage.js";
 export { type AccessRuleRecord, type UserScopeRecord, type UserScopeRecordField, userScopeRecordFields, getUserScopeRecordFromAccessRuleRecord, } from "./ruleRecord.js";
 //# sourceMappingURL=.export.d.ts.map

package/dist/.export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,eAAe,EACf,aAAa,EACb,KAAK,WAAW,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,gBAAgB,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}

package/dist/.export.js

@@ -8,4 +8,6 @@ import { makeAccessRuleHash, transformAccessRuleIntoRecord, transformAccessRuleR
 import { getUserScopeRecordFromAccessRuleRecord, userScopeRecordFields } from "./ruleRecord.js";
 import { describeMatchedRule } from "./matchedRule.js";
 import { OS_NAMES, classifyOs } from "./classifyOs.js";
-export { AccessPolicyType, FilterScopeMatch, OS_NAMES, accessPolicyInput, accessRuleInput, classifyOs, describeMatchedRule, getUserScopeRecordFromAccessRuleRecord, makeAccessRuleHash, policyScopeInput, transformAccessRuleIntoRecord, transformAccessRuleRecordIntoRule, userScopeInput, userScopeRecordFields };
+import { BROWSER_NAMES, classifyBrowser } from "./classifyBrowser.js";
+import { HEADER_OPERATORS, HEADER_RULE_MARKER, accessRuleHeaderMatches, decodeHeaderValueList, encodeHeaderValueList, evaluateHeaderCondition, isHeaderOperator } from "./headerMatch.js";
+export { AccessPolicyType, BROWSER_NAMES, FilterScopeMatch, HEADER_OPERATORS, HEADER_RULE_MARKER, OS_NAMES, accessPolicyInput, accessRuleHeaderMatches, accessRuleInput, classifyBrowser, classifyOs, decodeHeaderValueList, describeMatchedRule, encodeHeaderValueList, evaluateHeaderCondition, getUserScopeRecordFromAccessRuleRecord, isHeaderOperator, makeAccessRuleHash, policyScopeInput, transformAccessRuleIntoRecord, transformAccessRuleRecordIntoRule, userScopeInput, userScopeRecordFields };

package/dist/.export.js.map

@@ -1 +1 @@
-{"version":3,"file":".export.js","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAKN,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAe,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EAIN,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAIN,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":".export.js","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAKN,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAe,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,eAAe,EACf,aAAa,GAEb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,gBAAgB,EAEhB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAIN,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAIN,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}

package/dist/cjs/.export.cjs

@@ -8,14 +8,25 @@ const require_transformRule = require("./transformRule.cjs");
 const require_ruleRecord = require("./ruleRecord.cjs");
 const require_matchedRule = require("./matchedRule.cjs");
 const require_classifyOs = require("./classifyOs.cjs");
+const require_classifyBrowser = require("./classifyBrowser.cjs");
+const require_headerMatch = require("./headerMatch.cjs");
 exports.AccessPolicyType = require_rule.AccessPolicyType;
+exports.BROWSER_NAMES = require_classifyBrowser.BROWSER_NAMES;
 exports.FilterScopeMatch = require_rulesStorage.FilterScopeMatch;
+exports.HEADER_OPERATORS = require_headerMatch.HEADER_OPERATORS;
+exports.HEADER_RULE_MARKER = require_headerMatch.HEADER_RULE_MARKER;
 exports.OS_NAMES = require_classifyOs.OS_NAMES;
 exports.accessPolicyInput = require_ruleInput_policyInput.accessPolicyInput;
+exports.accessRuleHeaderMatches = require_headerMatch.accessRuleHeaderMatches;
 exports.accessRuleInput = require_ruleInput_ruleInput.accessRuleInput;
+exports.classifyBrowser = require_classifyBrowser.classifyBrowser;
 exports.classifyOs = require_classifyOs.classifyOs;
+exports.decodeHeaderValueList = require_headerMatch.decodeHeaderValueList;
 exports.describeMatchedRule = require_matchedRule.describeMatchedRule;
+exports.encodeHeaderValueList = require_headerMatch.encodeHeaderValueList;
+exports.evaluateHeaderCondition = require_headerMatch.evaluateHeaderCondition;
 exports.getUserScopeRecordFromAccessRuleRecord = require_ruleRecord.getUserScopeRecordFromAccessRuleRecord;
+exports.isHeaderOperator = require_headerMatch.isHeaderOperator;
 exports.makeAccessRuleHash = require_transformRule.makeAccessRuleHash;
 exports.policyScopeInput = require_ruleInput_policyInput.policyScopeInput;
 exports.transformAccessRuleIntoRecord = require_transformRule.transformAccessRuleIntoRecord;

package/dist/cjs/classifyBrowser.cjs

@@ -0,0 +1,44 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/classifyBrowser.ts
+/**
+* Kept in step with `@prosopo/decision-machines`' `uaClassify` — as `classifyOs`
+* is — but defined here because the provider request path cannot depend on that
+* package.
+*/
+var BROWSER_NAMES = [
+	"chrome",
+	"safari",
+	"firefox",
+	"edge",
+	"opera",
+	"samsung_internet",
+	"wechat",
+	"facebook",
+	"instagram",
+	"ie",
+	"unknown"
+];
+/**
+* Branch order is load-bearing: every browser below Chrome also carries a
+* `chrome/` token, and Safari's signature appears in nearly every WebKit UA.
+*
+* Reads the User-Agent rather than the `sec-ch-ua` client hint because a client
+* can simply omit client hints, but stripping the UA breaks far more.
+*/
+var classifyBrowser = (userAgent) => {
+	const ua = (userAgent || "").toLowerCase();
+	if (/\bedg(?:e|a|ios)?\//.test(ua)) return "edge";
+	if (/samsungbrowser/.test(ua)) return "samsung_internet";
+	if (/\bopr\/|opera/.test(ua)) return "opera";
+	if (/micromessenger/.test(ua)) return "wechat";
+	if (/fban|fbav|fbios/.test(ua)) return "facebook";
+	if (/instagram/.test(ua)) return "instagram";
+	if (/firefox|fxios/.test(ua)) return "firefox";
+	if (/msie|trident/.test(ua)) return "ie";
+	if (/\bchrome\/|\bcrios\//.test(ua)) return "chrome";
+	if (/safari\//.test(ua)) return "safari";
+	return "unknown";
+};
+//#endregion
+exports.BROWSER_NAMES = BROWSER_NAMES;
+exports.classifyBrowser = classifyBrowser;

package/dist/cjs/headerMatch.cjs

@@ -0,0 +1,122 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/headerMatch.ts
+/**
+* Operators for an access rule's arbitrary-header condition.
+*
+* `equals` / `contains` are the deny-list operators (block when the request's
+* header matches). `notEquals` / `notContains` are their allow-list negations
+* (block when the request's header does NOT match — including when the header
+* is absent), so an allow-list card that says "only let requests with header X
+* through" desugars to `notEquals` / `notContains` Block rules, exactly the way
+* the OS allow-list desugars to Block rules on the complement.
+*
+* `notEqualsAny` / `notContainsAny` are the multi-value form of those two: the
+* rule's `headerValue` holds a list (see `encodeHeaderValueList`) and the rule
+* blocks unless the request's header matches *one of* the listed values. They
+* exist because an allow-list over several values of the SAME header cannot be
+* expressed as several single-value rules — each rule fires independently, so
+* `notEquals ios` + `notEquals android` blocks both an iOS and an Android
+* request. One rule holding both values is the only way to get the "any of"
+* semantics the allow-list needs.
+*/
+var HEADER_OPERATORS = [
+	"equals",
+	"contains",
+	"notEquals",
+	"notContains",
+	"notEqualsAny",
+	"notContainsAny"
+];
+var isHeaderOperator = (value) => value !== void 0 && HEADER_OPERATORS.includes(value);
+/**
+* Sentinel value carried both on every request's user scope (see
+* `getRequestUserScope`) and on every header-restriction rule. Header rules
+* match on data (`headerName` / `headerValue` / `headerOperator`) that Redis
+* cannot evaluate — substring `contains` and per-rule operators aren't
+* expressible as a TAG query, and an allow-list rule must still fire on a
+* request that OMITS the target header, so candidate selection can't key off
+* header presence. Redis returns header rules via the reader's
+* `no-user-scope` fall-through probe (they constrain none of the indexed
+* scope dimensions); this marker is what keeps them candidates through the
+* JS-side `ruleApplies` scalar check, which would otherwise drop a rule
+* carrying a scope field the request lacks. The concrete condition is then
+* checked by `accessRuleHeaderMatches`.
+*/
+var HEADER_RULE_MARKER = "1";
+/**
+* Encode the value list carried by a multi-value operator (`notEqualsAny` /
+* `notContainsAny`) into the single `headerValue` string an access rule can
+* store. JSON rather than a delimiter because header values are arbitrary
+* text — any separator we picked could legitimately occur inside a value.
+*/
+var encodeHeaderValueList = (values) => JSON.stringify(values);
+/**
+* Inverse of {@link encodeHeaderValueList}, tolerant of rules written by hand
+* (e.g. via the access-policy CLI) that carry a single literal value instead of
+* an encoded list.
+*
+* Returns `undefined` for a value that looks list-encoded but isn't usable — an
+* empty list, a non-array, non-string members, or malformed JSON. Callers treat
+* that as a malformed rule and decline to fire it, so a garbled list can't
+* silently block all traffic.
+*/
+var decodeHeaderValueList = (value) => {
+	if (!value.trimStart().startsWith("[")) return [value];
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return;
+	}
+	if (!Array.isArray(parsed) || parsed.length === 0 || !parsed.every((entry) => typeof entry === "string")) return;
+	return parsed;
+};
+/**
+* Evaluate a single header condition against a request's headers. Returns
+* `true` when the condition is satisfied — i.e. when a Block rule carrying it
+* should fire for this request.
+*
+* `headers` is expected to be keyed by lower-cased header name (HTTP header
+* names are case-insensitive); `headerName` is lower-cased here defensively.
+* The negated operators treat an absent header as "not matching the value",
+* which is what makes an allow-list block a request that drops the header.
+*/
+var evaluateHeaderCondition = (headerName, operator, value, headers) => {
+	const actual = headers[headerName.toLowerCase()];
+	switch (operator) {
+		case "equals": return actual !== void 0 && actual === value;
+		case "contains": return actual?.includes(value) ?? false;
+		case "notEquals": return actual === void 0 || actual !== value;
+		case "notContains": return actual === void 0 || !actual.includes(value);
+		case "notEqualsAny": {
+			const values = decodeHeaderValueList(value);
+			if (values === void 0) return false;
+			return actual === void 0 || !values.includes(actual);
+		}
+		case "notContainsAny": {
+			const values = decodeHeaderValueList(value);
+			if (values === void 0) return false;
+			return actual === void 0 || !values.some((candidate) => actual.includes(candidate));
+		}
+	}
+};
+/**
+* Whether a rule's header condition (if any) is satisfied by the request's
+* headers. A rule with no `headerName` carries no header constraint, so it is
+* treated as satisfied and the rule's other dimensions decide the match. A
+* rule with a `headerName` but an unrecognised operator is malformed and never
+* matches (fail-safe: a garbled rule must not silently block traffic).
+*/
+var accessRuleHeaderMatches = (rule, headers) => {
+	if (rule.headerName === void 0) return true;
+	if (!isHeaderOperator(rule.headerOperator)) return false;
+	return evaluateHeaderCondition(rule.headerName, rule.headerOperator, rule.headerValue ?? "", headers);
+};
+//#endregion
+exports.HEADER_OPERATORS = HEADER_OPERATORS;
+exports.HEADER_RULE_MARKER = HEADER_RULE_MARKER;
+exports.accessRuleHeaderMatches = accessRuleHeaderMatches;
+exports.decodeHeaderValueList = decodeHeaderValueList;
+exports.encodeHeaderValueList = encodeHeaderValueList;
+exports.evaluateHeaderCondition = evaluateHeaderCondition;
+exports.isHeaderOperator = isHeaderOperator;

package/dist/cjs/mongoose/mongooseRuleSchema.cjs

@@ -36,6 +36,26 @@ var userAttributesSchema = {
 	os: {
 		type: String,
 		required: false
+	},
+	browser: {
+		type: String,
+		required: false
+	},
+	headerMatch: {
+		type: String,
+		required: false
+	},
+	headerName: {
+		type: String,
+		required: false
+	},
+	headerValue: {
+		type: String,
+		required: false
+	},
+	headerOperator: {
+		type: String,
+		required: false
 	}
 };
 var userIpSchema = {

package/dist/cjs/redis/reader/redisRulesReader.cjs

@@ -25,6 +25,8 @@ var SPECIFICITY_EXPR = [
 	"exists(@countryCode)",
 	"exists(@asn)",
 	"exists(@os)",
+	"exists(@browser)",
+	"exists(@headerMatch)",
 	"exists(@numericIp)",
 	"exists(@numericIpMaskMin)"
 ].join(" + ");
@@ -52,6 +54,11 @@ var RULE_LOAD_FIELDS = [
 	"@countryCode",
 	"@asn",
 	"@os",
+	"@browser",
+	"@headerMatch",
+	"@headerName",
+	"@headerValue",
+	"@headerOperator",
 	"@numericIp",
 	"@numericIpMaskMin",
 	"@numericIpMaskMax"
@@ -68,6 +75,7 @@ var readerSpecificity = (rule) => {
 	if (rule.countryCode !== void 0) score++;
 	if (rule.asn !== void 0) score++;
 	if (rule.os !== void 0) score++;
+	if (rule.browser !== void 0) score++;
 	if (rule.numericIp !== void 0) score++;
 	if (rule.numericIpMaskMin !== void 0) score++;
 	return score;

package/dist/cjs/redis/reader/redisRulesSplitQuery.cjs

@@ -13,7 +13,9 @@ var SCALAR_USER_SCOPE_FIELDS = [
 	"headHash",
 	"coords",
 	"countryCode",
-	"asn"
+	"asn",
+	"os",
+	"browser"
 ];
 var ALL_USER_SCOPE_FIELDS = [
 	...SCALAR_USER_SCOPE_FIELDS,

package/dist/cjs/redis/redisRuleIndex.cjs

@@ -54,6 +54,26 @@ var userAttributesRedisSchema = {
 	os: {
 		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
 		INDEXMISSING: true
+	},
+	browser: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headerMatch: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headerName: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headerValue: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headerOperator: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
 	}
 };
 var userScopeRedisSchema = {

package/dist/cjs/ruleInput/userScopeInput.cjs

@@ -15,7 +15,12 @@ var userAttributesSchema = zod.z.object({
 	coords: zod.z.coerce.string().optional(),
 	countryCode: zod.z.coerce.string().optional(),
 	asn: zod.z.coerce.number().int().nonnegative().optional(),
-	os: zod.z.coerce.string().optional()
+	os: zod.z.coerce.string().optional(),
+	browser: zod.z.coerce.string().optional(),
+	headerMatch: zod.z.coerce.string().optional(),
+	headerName: zod.z.coerce.string().optional(),
+	headerValue: zod.z.coerce.string().optional(),
+	headerOperator: zod.z.coerce.string().optional()
 });
 var userAttributesInput = zod.z.object({
 	...userAttributesSchema.shape,

package/dist/cjs/ruleRecord.cjs

@@ -9,7 +9,12 @@ var userAttributesRecordFields = [
 	"coords",
 	"countryCode",
 	"asn",
-	"os"
+	"os",
+	"browser",
+	"headerMatch",
+	"headerName",
+	"headerValue",
+	"headerOperator"
 ];
 var userIpRecordFields = ["ip", "ipMask"];
 var userScopeRecordFields = [...userAttributesRecordFields, ...userIpRecordFields];

package/dist/classifyBrowser.d.ts

@@ -0,0 +1,4 @@
+export declare const BROWSER_NAMES: readonly ["chrome", "safari", "firefox", "edge", "opera", "samsung_internet", "wechat", "facebook", "instagram", "ie", "unknown"];
+export type BrowserName = (typeof BROWSER_NAMES)[number];
+export declare const classifyBrowser: (userAgent: string | undefined) => BrowserName;
+//# sourceMappingURL=classifyBrowser.d.ts.map

package/dist/classifyBrowser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifyBrowser.d.ts","sourceRoot":"","sources":["../src/classifyBrowser.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,aAAa,mIAYhB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AASzD,eAAO,MAAM,eAAe,cAAe,MAAM,GAAG,SAAS,KAAG,WAkC/D,CAAC"}