@prosopo/user-access-policy 3.12.33 → 3.14.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/user-access-policy@3.12.33 build:cjs
+> @prosopo/user-access-policy@3.14.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -33,7 +33,7 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 39 modules transformed.
+✓ 40 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/api/accessRulesApiClient.cjs            0.00 kB │ gzip: 0.02 kB
@@ -43,11 +43,11 @@ dist/cjs/api/write/.export.cjs                   0.00 kB │ gzip: 0.02 kB
 dist/cjs/mongoose/.export.cjs                    0.25 kB │ gzip: 0.16 kB
 dist/cjs/rulesStorage.cjs                        0.34 kB │ gzip: 0.22 kB
 dist/cjs/redis/.export.cjs                       0.40 kB │ gzip: 0.18 kB
-dist/cjs/rule.cjs                                0.45 kB │ gzip: 0.26 kB
+dist/cjs/rule.cjs                                0.48 kB │ gzip: 0.27 kB
 dist/cjs/api/.export.cjs                         0.53 kB │ gzip: 0.21 kB
 dist/cjs/ruleInput/.export.cjs                   0.57 kB │ gzip: 0.20 kB
 dist/cjs/api/delete/deleteAllRules.cjs           0.79 kB │ gzip: 0.41 kB
-dist/cjs/ruleRecord.cjs                          0.84 kB │ gzip: 0.36 kB
+dist/cjs/ruleRecord.cjs                          0.92 kB │ gzip: 0.39 kB
 dist/cjs/_virtual/_rolldown/runtime.cjs          1.00 kB │ gzip: 0.50 kB
 dist/cjs/api/read/getMissingIds.cjs              1.12 kB │ gzip: 0.51 kB
 dist/cjs/api/read/fetchRules.cjs                 1.22 kB │ gzip: 0.54 kB
@@ -56,24 +56,25 @@ dist/cjs/api/delete/deleteRuleGroups.cjs         1.43 kB │ gzip: 0.65 kB
 dist/cjs/classifyBrowser.cjs                     1.45 kB │ gzip: 0.73 kB
 dist/cjs/api/write/rehashRules.cjs               1.48 kB │ gzip: 0.56 kB
 dist/cjs/api/delete/deleteRules.cjs              1.52 kB │ gzip: 0.65 kB
-dist/cjs/mongoose/mongooseRuleSchema.cjs         1.57 kB │ gzip: 0.43 kB
 dist/cjs/api/read/findRuleIds.cjs                1.58 kB │ gzip: 0.66 kB
-dist/cjs/.export.cjs                             1.88 kB │ gzip: 0.45 kB
+dist/cjs/mongoose/mongooseRuleSchema.cjs         1.85 kB │ gzip: 0.46 kB
 dist/cjs/redis/redisClient.cjs                   1.92 kB │ gzip: 0.72 kB
 dist/cjs/classifyOs.cjs                          2.04 kB │ gzip: 1.05 kB
 dist/cjs/ruleInput/policyInput.cjs               2.09 kB │ gzip: 0.79 kB
 dist/cjs/ruleInput/ruleInput.cjs                 2.28 kB │ gzip: 0.69 kB
 dist/cjs/matchedRule.cjs                         2.29 kB │ gzip: 1.03 kB
-dist/cjs/ruleInput/userScopeInput.cjs            2.48 kB │ gzip: 0.78 kB
+dist/cjs/.export.cjs                             2.44 kB │ gzip: 0.57 kB
 dist/cjs/api/rulesApiClient.cjs                  2.53 kB │ gzip: 0.68 kB
 dist/cjs/redis/reader/redisAggregate.cjs         2.57 kB │ gzip: 1.04 kB
 dist/cjs/transformRule.cjs                       2.90 kB │ gzip: 1.03 kB
+dist/cjs/ruleInput/userScopeInput.cjs            3.02 kB │ gzip: 0.95 kB
 dist/cjs/api/write/insertRules.cjs               3.12 kB │ gzip: 1.09 kB
-dist/cjs/redis/redisRuleIndex.cjs                3.20 kB │ gzip: 0.83 kB
 dist/cjs/redis/redisRulesWriter.cjs              3.50 kB │ gzip: 1.15 kB
+dist/cjs/redis/redisRuleIndex.cjs                3.64 kB │ gzip: 0.87 kB
 dist/cjs/api/ruleApiRoutes.cjs                   4.14 kB │ gzip: 1.06 kB
 dist/cjs/redis/reader/redisRulesQuery.cjs        4.76 kB │ gzip: 1.58 kB
 dist/cjs/redis/reader/redisRulesSplitQuery.cjs   5.17 kB │ gzip: 2.17 kB
-dist/cjs/redis/reader/redisRulesReader.cjs      11.76 kB │ gzip: 2.85 kB
+dist/cjs/headerMatch.cjs                         5.74 kB │ gzip: 2.25 kB
+dist/cjs/redis/reader/redisRulesReader.cjs      11.85 kB │ gzip: 2.88 kB
 
-✓ built in 147ms
+✓ built in 99ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/user-access-policy@3.12.33 build:tsc
+> @prosopo/user-access-policy@3.14.0 build:tsc
 > tsc --build --verbose
 
-10:39:27 PM - Projects in this build: 
+11:40:48 AM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -15,27 +15,27 @@
     * ../api/tsconfig.json
     * tsconfig.json
 
-10:39:27 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/NodejsPolarsNativeFilePlugin.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/vite.backend.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/batches.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/error.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/index.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
+11:40:48 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-10:39:27 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+11:40:48 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-10:39:27 PM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
+11:40:48 AM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/user-access-policy@3.12.33 build
+> @prosopo/user-access-policy@3.14.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/user-access-policy@3.12.33 build:cross-env
+> @prosopo/user-access-policy@3.14.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -37,7 +37,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 39 modules transformed.
+✓ 40 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js          0.04 kB │ gzip: 0.06 kB
@@ -50,34 +50,35 @@ dist/redis/.export.js                       0.24 kB │ gzip: 0.14 kB
 dist/rulesStorage.js                        0.29 kB │ gzip: 0.19 kB
 dist/ruleInput/.export.js                   0.30 kB │ gzip: 0.14 kB
 dist/api/.export.js                         0.31 kB │ gzip: 0.16 kB
-dist/rule.js                                0.36 kB │ gzip: 0.23 kB
-dist/ruleRecord.js                          0.67 kB │ gzip: 0.33 kB
+dist/rule.js                                0.40 kB │ gzip: 0.24 kB
 dist/api/delete/deleteAllRules.js           0.73 kB │ gzip: 0.37 kB
+dist/ruleRecord.js                          0.76 kB │ gzip: 0.36 kB
 dist/api/read/getMissingIds.js              1.02 kB │ gzip: 0.48 kB
 dist/api/read/fetchRules.js                 1.07 kB │ gzip: 0.49 kB
-dist/.export.js                             1.09 kB │ gzip: 0.33 kB
 dist/redis/redisRulesStorage.js             1.22 kB │ gzip: 0.45 kB
 dist/api/delete/deleteRuleGroups.js         1.32 kB │ gzip: 0.61 kB
 dist/api/delete/deleteRules.js              1.36 kB │ gzip: 0.58 kB
 dist/classifyBrowser.js                     1.38 kB │ gzip: 0.71 kB
 dist/api/read/findRuleIds.js                1.39 kB │ gzip: 0.60 kB
 dist/api/write/rehashRules.js               1.42 kB │ gzip: 0.53 kB
-dist/mongoose/mongooseRuleSchema.js         1.52 kB │ gzip: 0.41 kB
+dist/.export.js                             1.43 kB │ gzip: 0.42 kB
 dist/redis/redisClient.js                   1.78 kB │ gzip: 0.68 kB
+dist/mongoose/mongooseRuleSchema.js         1.79 kB │ gzip: 0.44 kB
 dist/ruleInput/ruleInput.js                 1.80 kB │ gzip: 0.63 kB
 dist/ruleInput/policyInput.js               1.84 kB │ gzip: 0.73 kB
 dist/classifyOs.js                          1.98 kB │ gzip: 1.03 kB
 dist/api/rulesApiClient.js                  2.12 kB │ gzip: 0.62 kB
-dist/ruleInput/userScopeInput.js            2.13 kB │ gzip: 0.68 kB
 dist/matchedRule.js                         2.22 kB │ gzip: 1.00 kB
 dist/redis/reader/redisAggregate.js         2.35 kB │ gzip: 0.99 kB
 dist/transformRule.js                       2.40 kB │ gzip: 0.94 kB
-dist/redis/redisRuleIndex.js                2.58 kB │ gzip: 0.75 kB
+dist/ruleInput/userScopeInput.js            2.65 kB │ gzip: 0.85 kB
 dist/api/write/insertRules.js               2.87 kB │ gzip: 1.03 kB
+dist/redis/redisRuleIndex.js                2.95 kB │ gzip: 0.79 kB
 dist/redis/redisRulesWriter.js              3.03 kB │ gzip: 1.07 kB
 dist/api/ruleApiRoutes.js                   3.68 kB │ gzip: 0.99 kB
 dist/redis/reader/redisRulesQuery.js        4.53 kB │ gzip: 1.54 kB
 dist/redis/reader/redisRulesSplitQuery.js   4.98 kB │ gzip: 2.14 kB
-dist/redis/reader/redisRulesReader.js      10.34 kB │ gzip: 2.71 kB
+dist/headerMatch.js                         5.51 kB │ gzip: 2.22 kB
+dist/redis/reader/redisRulesReader.js      10.44 kB │ gzip: 2.74 kB
 
-✓ built in 274ms
+✓ built in 239ms

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # @prosopo/user-access-policy
 
+## 3.14.0
+### Minor Changes
+
+- af267c2: Web Bot Auth verifier and an authenticated frictionless flow for pre-verified agents.
+  
+  **`@prosopo/web-bot-auth`** — a new package: an RFC 9421 HTTP Message Signatures verifier built on `@noble/curves/ed25519`, with no Cloudflare dependency. It parses `Signature-Agent` in both its bare-string and dictionary forms, resolves the signer's JWKS at `/.well-known/http-message-signatures-directory` honouring the response's cache-control TTL, and verifies the Ed25519 signature over the RFC 9421 signature base.
+  
+  **Provider fast path.** `/captcha/frictionless` returns `captchaType: authenticated` when a non-`deferToVerify` `AccessPolicyType.Allow` rule matches the request's user scope, and writes a session with `serverChecked: false`, `agent: true` and the issuing IP frozen for verify-time binding. Decrypt, bot score and the decision machine are all skipped. A verified `Signature-Agent` is one way to qualify — the userScope gains a `webBotAuthAgent` field, set only when signature verification succeeded so a rule scoped to a signer can never be matched by a spoofed header — but an IP CIDR, JA4, user agent, ASN or country rule qualifies the same way. A `Block` or `Restrict` on the same match set always wins, because severity outranks Allow.
+  
+  **`/client/authenticated/verify`.** A separate router with mandatory IP binding — the operator must forward the client IP (`API.AUTHENTICATED_IP_REQUIRED`) and it must match the one the session was issued to (`API.AUTHENTICATED_IP_MISMATCH`), so a leaked token cannot be replayed from elsewhere. Single use is enforced through `serverChecked`, and `captchaType` is checked so an ordinary captcha token cannot be redeemed on this route. `clientSessionId` correlation goes through the same `isClientSessionMismatch` helper as pow / image / puzzle, so the authenticated path cannot drift from the others.
+  
+  **Surface.** `AccessPolicyType.Allow` and `CaptchaType.authenticated`; `webBotAuthAgent` on the user scope (indexed, normalised at parse time to a lowercase scheme+host with no trailing slash); `Session.agent` / `Session.webBotAuthAgent` for the Traffic view's "pre-verified pass" filter; `submitAuthenticatedCaptchaVerify` on `ProviderApi` and the matching branch in `@prosopo/server.verifyProvider`; `AuthenticatedBadge` and a dispatch branch in `procaptcha-frictionless`.
+  
+  Three fixes the new end-to-end coverage turned up, each of which broke the flow outright:
+  
+  - `ipMatchesSession` compared the operator's parsed IP against the session's composite halves with `===`. A session read back from Mongo carries BSON (`Decimal128`, or `Long` on pre-migration records), not the `bigint` the type claims, so the comparison was false for every session that had been through the database — every legitimate redemption was rejected as `API.AUTHENTICATED_IP_MISMATCH`. Both halves are now normalised before comparison, and an unparseable half fails closed rather than defaulting to `0n`, so garbage still cannot match garbage.
+  - `serverChecked` was never written onto the authenticated session, so "never set" and "consumed" were distinguishable only by an absence. It is now written as `false` at issuance.
+  - `serverChecked` was missing from `SESSION_PROJECTION`. Left out, the single-use check reads `undefined` and an authenticated token verifies an unlimited number of times.
+
+### Patch Changes
+
+- Updated dependencies [929d99b]
+- Updated dependencies [934fa5d]
+- Updated dependencies [27f525e]
+- Updated dependencies [af267c2]
+  - @prosopo/types@5.8.0
+  - @prosopo/api@4.2.0
+
+## 3.13.0
+### Minor Changes
+
+- e22d5fb: Add an arbitrary-header match dimension to user access policies.
+  
+  A `Block` or `Restrict` rule can now target a named request header with an `equals`, `contains`, `notEquals`, `notContains`, `notEqualsAny` or `notContainsAny` operator. The negated operators back the portal's allow-list mode — block unless the header matches; the `*Any` pair carries a list of accepted values in `headerValue` so an allow-list over several values of the same header fires only when the header matches none of them (separate single-value rules would each fire on the other's value and block everything). Because substring `contains` and per-rule operators can't be expressed as a Redis TAG query — and an allow-list rule must still fire on a request that omits the header — the header condition is carried on the rule as `headerName`/`headerValue`/`headerOperator` and evaluated in code against the raw request headers, while an indexed `headerMatch` sentinel makes every header rule a matching candidate for every request. Header rules contribute one point to rule specificity ranking, mirroring the other scalar dimensions.
+  
+  The raw request headers are a **required** argument of `getPrioritisedAccessRule` / `CaptchaManager.getPrioritisedAccessPolicies`, with no default. A negated header operator treats a missing header as "does not match", so a lookup that quietly ran with an empty header map would fire every allow-list rule on every request. Every lookup now passes them: the request-time block middleware, the verify-path hard-block check, the `/frictionless` policy and dedup lookups, and the image / PoW / puzzle challenge endpoints.
+  
+  `getPrioritisedAccessRule` now caches only the candidate fetch and ranks per request, because the header verdict depends on data that is not part of the cache key. This also closes a latent gap where `os` was never part of `hardBlockCacheKey`, so a cached ranked list could serve one operating system's verdict to a request from another.
+
+### Patch Changes
+
+- 6f57ee9: chore(deps): bump yargs from 17.7.2 to 18.1.0
+- 6f57ee9: chore(deps): bump the npm-minor-and-patch group across 1 directory with 3 updates
+- Updated dependencies [6f57ee9]
+- Updated dependencies [d288371]
+  - @prosopo/types@5.7.0
+  - @prosopo/util@3.3.9
+  - @prosopo/api@4.1.6
+  - @prosopo/api-route@2.6.58
+  - @prosopo/common@3.1.54
+  - @prosopo/logger@2.0.9
+  - @prosopo/redis-client@1.0.35
+
 ## 3.12.33
 ### Patch Changes
 

package/dist/.export.d.ts

@@ -4,6 +4,7 @@ export { type AccessRule, type AccessPolicy, type PolicyScope, type UserScope, A
 export { describeMatchedRule } from "./matchedRule.js";
 export { classifyOs, OS_NAMES, type OsName } from "./classifyOs.js";
 export { classifyBrowser, BROWSER_NAMES, type BrowserName, } from "./classifyBrowser.js";
+export { HEADER_OPERATORS, type HeaderOperator, HEADER_RULE_MARKER, isHeaderOperator, evaluateHeaderCondition, accessRuleHeaderMatches, encodeHeaderValueList, decodeHeaderValueList, } from "./headerMatch.js";
 export { type AccessRulesFilter, type AccessRulesStorage, type AccessRuleEntry, FilterScopeMatch, } from "./rulesStorage.js";
 export { type AccessRuleRecord, type UserScopeRecord, type UserScopeRecordField, userScopeRecordFields, getUserScopeRecordFromAccessRuleRecord, } from "./ruleRecord.js";
 //# sourceMappingURL=.export.d.ts.map

package/dist/.export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,eAAe,EACf,aAAa,EACb,KAAK,WAAW,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,eAAe,EACf,aAAa,EACb,KAAK,WAAW,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,gBAAgB,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}

package/dist/.export.js

@@ -9,4 +9,5 @@ import { getUserScopeRecordFromAccessRuleRecord, userScopeRecordFields } from ".
 import { describeMatchedRule } from "./matchedRule.js";
 import { OS_NAMES, classifyOs } from "./classifyOs.js";
 import { BROWSER_NAMES, classifyBrowser } from "./classifyBrowser.js";
-export { AccessPolicyType, BROWSER_NAMES, FilterScopeMatch, OS_NAMES, accessPolicyInput, accessRuleInput, classifyBrowser, classifyOs, describeMatchedRule, getUserScopeRecordFromAccessRuleRecord, makeAccessRuleHash, policyScopeInput, transformAccessRuleIntoRecord, transformAccessRuleRecordIntoRule, userScopeInput, userScopeRecordFields };
+import { HEADER_OPERATORS, HEADER_RULE_MARKER, accessRuleHeaderMatches, decodeHeaderValueList, encodeHeaderValueList, evaluateHeaderCondition, isHeaderOperator } from "./headerMatch.js";
+export { AccessPolicyType, BROWSER_NAMES, FilterScopeMatch, HEADER_OPERATORS, HEADER_RULE_MARKER, OS_NAMES, accessPolicyInput, accessRuleHeaderMatches, accessRuleInput, classifyBrowser, classifyOs, decodeHeaderValueList, describeMatchedRule, encodeHeaderValueList, evaluateHeaderCondition, getUserScopeRecordFromAccessRuleRecord, isHeaderOperator, makeAccessRuleHash, policyScopeInput, transformAccessRuleIntoRecord, transformAccessRuleRecordIntoRule, userScopeInput, userScopeRecordFields };

package/dist/.export.js.map

@@ -1 +1 @@
-{"version":3,"file":".export.js","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAKN,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAe,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,eAAe,EACf,aAAa,GAEb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAIN,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAIN,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":".export.js","sourceRoot":"","sources":["../src/.export.ts"],"names":[],"mappings":"AAcA,cAAc,wBAAwB,CAAC;AAEvC,OAAO,EACN,kBAAkB,EAClB,iCAAiC,EACjC,6BAA6B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAKN,gBAAgB,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAe,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EACN,eAAe,EACf,aAAa,GAEb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,gBAAgB,EAEhB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAIN,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAIN,qBAAqB,EACrB,sCAAsC,GACtC,MAAM,iBAAiB,CAAC"}

package/dist/cjs/.export.cjs

@@ -9,16 +9,24 @@ const require_ruleRecord = require("./ruleRecord.cjs");
 const require_matchedRule = require("./matchedRule.cjs");
 const require_classifyOs = require("./classifyOs.cjs");
 const require_classifyBrowser = require("./classifyBrowser.cjs");
+const require_headerMatch = require("./headerMatch.cjs");
 exports.AccessPolicyType = require_rule.AccessPolicyType;
 exports.BROWSER_NAMES = require_classifyBrowser.BROWSER_NAMES;
 exports.FilterScopeMatch = require_rulesStorage.FilterScopeMatch;
+exports.HEADER_OPERATORS = require_headerMatch.HEADER_OPERATORS;
+exports.HEADER_RULE_MARKER = require_headerMatch.HEADER_RULE_MARKER;
 exports.OS_NAMES = require_classifyOs.OS_NAMES;
 exports.accessPolicyInput = require_ruleInput_policyInput.accessPolicyInput;
+exports.accessRuleHeaderMatches = require_headerMatch.accessRuleHeaderMatches;
 exports.accessRuleInput = require_ruleInput_ruleInput.accessRuleInput;
 exports.classifyBrowser = require_classifyBrowser.classifyBrowser;
 exports.classifyOs = require_classifyOs.classifyOs;
+exports.decodeHeaderValueList = require_headerMatch.decodeHeaderValueList;
 exports.describeMatchedRule = require_matchedRule.describeMatchedRule;
+exports.encodeHeaderValueList = require_headerMatch.encodeHeaderValueList;
+exports.evaluateHeaderCondition = require_headerMatch.evaluateHeaderCondition;
 exports.getUserScopeRecordFromAccessRuleRecord = require_ruleRecord.getUserScopeRecordFromAccessRuleRecord;
+exports.isHeaderOperator = require_headerMatch.isHeaderOperator;
 exports.makeAccessRuleHash = require_transformRule.makeAccessRuleHash;
 exports.policyScopeInput = require_ruleInput_policyInput.policyScopeInput;
 exports.transformAccessRuleIntoRecord = require_transformRule.transformAccessRuleIntoRecord;

package/dist/cjs/headerMatch.cjs

@@ -0,0 +1,122 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/headerMatch.ts
+/**
+* Operators for an access rule's arbitrary-header condition.
+*
+* `equals` / `contains` are the deny-list operators (block when the request's
+* header matches). `notEquals` / `notContains` are their allow-list negations
+* (block when the request's header does NOT match — including when the header
+* is absent), so an allow-list card that says "only let requests with header X
+* through" desugars to `notEquals` / `notContains` Block rules, exactly the way
+* the OS allow-list desugars to Block rules on the complement.
+*
+* `notEqualsAny` / `notContainsAny` are the multi-value form of those two: the
+* rule's `headerValue` holds a list (see `encodeHeaderValueList`) and the rule
+* blocks unless the request's header matches *one of* the listed values. They
+* exist because an allow-list over several values of the SAME header cannot be
+* expressed as several single-value rules — each rule fires independently, so
+* `notEquals ios` + `notEquals android` blocks both an iOS and an Android
+* request. One rule holding both values is the only way to get the "any of"
+* semantics the allow-list needs.
+*/
+var HEADER_OPERATORS = [
+	"equals",
+	"contains",
+	"notEquals",
+	"notContains",
+	"notEqualsAny",
+	"notContainsAny"
+];
+var isHeaderOperator = (value) => value !== void 0 && HEADER_OPERATORS.includes(value);
+/**
+* Sentinel value carried both on every request's user scope (see
+* `getRequestUserScope`) and on every header-restriction rule. Header rules
+* match on data (`headerName` / `headerValue` / `headerOperator`) that Redis
+* cannot evaluate — substring `contains` and per-rule operators aren't
+* expressible as a TAG query, and an allow-list rule must still fire on a
+* request that OMITS the target header, so candidate selection can't key off
+* header presence. Redis returns header rules via the reader's
+* `no-user-scope` fall-through probe (they constrain none of the indexed
+* scope dimensions); this marker is what keeps them candidates through the
+* JS-side `ruleApplies` scalar check, which would otherwise drop a rule
+* carrying a scope field the request lacks. The concrete condition is then
+* checked by `accessRuleHeaderMatches`.
+*/
+var HEADER_RULE_MARKER = "1";
+/**
+* Encode the value list carried by a multi-value operator (`notEqualsAny` /
+* `notContainsAny`) into the single `headerValue` string an access rule can
+* store. JSON rather than a delimiter because header values are arbitrary
+* text — any separator we picked could legitimately occur inside a value.
+*/
+var encodeHeaderValueList = (values) => JSON.stringify(values);
+/**
+* Inverse of {@link encodeHeaderValueList}, tolerant of rules written by hand
+* (e.g. via the access-policy CLI) that carry a single literal value instead of
+* an encoded list.
+*
+* Returns `undefined` for a value that looks list-encoded but isn't usable — an
+* empty list, a non-array, non-string members, or malformed JSON. Callers treat
+* that as a malformed rule and decline to fire it, so a garbled list can't
+* silently block all traffic.
+*/
+var decodeHeaderValueList = (value) => {
+	if (!value.trimStart().startsWith("[")) return [value];
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return;
+	}
+	if (!Array.isArray(parsed) || parsed.length === 0 || !parsed.every((entry) => typeof entry === "string")) return;
+	return parsed;
+};
+/**
+* Evaluate a single header condition against a request's headers. Returns
+* `true` when the condition is satisfied — i.e. when a Block rule carrying it
+* should fire for this request.
+*
+* `headers` is expected to be keyed by lower-cased header name (HTTP header
+* names are case-insensitive); `headerName` is lower-cased here defensively.
+* The negated operators treat an absent header as "not matching the value",
+* which is what makes an allow-list block a request that drops the header.
+*/
+var evaluateHeaderCondition = (headerName, operator, value, headers) => {
+	const actual = headers[headerName.toLowerCase()];
+	switch (operator) {
+		case "equals": return actual !== void 0 && actual === value;
+		case "contains": return actual?.includes(value) ?? false;
+		case "notEquals": return actual === void 0 || actual !== value;
+		case "notContains": return actual === void 0 || !actual.includes(value);
+		case "notEqualsAny": {
+			const values = decodeHeaderValueList(value);
+			if (values === void 0) return false;
+			return actual === void 0 || !values.includes(actual);
+		}
+		case "notContainsAny": {
+			const values = decodeHeaderValueList(value);
+			if (values === void 0) return false;
+			return actual === void 0 || !values.some((candidate) => actual.includes(candidate));
+		}
+	}
+};
+/**
+* Whether a rule's header condition (if any) is satisfied by the request's
+* headers. A rule with no `headerName` carries no header constraint, so it is
+* treated as satisfied and the rule's other dimensions decide the match. A
+* rule with a `headerName` but an unrecognised operator is malformed and never
+* matches (fail-safe: a garbled rule must not silently block traffic).
+*/
+var accessRuleHeaderMatches = (rule, headers) => {
+	if (rule.headerName === void 0) return true;
+	if (!isHeaderOperator(rule.headerOperator)) return false;
+	return evaluateHeaderCondition(rule.headerName, rule.headerOperator, rule.headerValue ?? "", headers);
+};
+//#endregion
+exports.HEADER_OPERATORS = HEADER_OPERATORS;
+exports.HEADER_RULE_MARKER = HEADER_RULE_MARKER;
+exports.accessRuleHeaderMatches = accessRuleHeaderMatches;
+exports.decodeHeaderValueList = decodeHeaderValueList;
+exports.encodeHeaderValueList = encodeHeaderValueList;
+exports.evaluateHeaderCondition = evaluateHeaderCondition;
+exports.isHeaderOperator = isHeaderOperator;

package/dist/cjs/mongoose/mongooseRuleSchema.cjs

@@ -40,6 +40,26 @@ var userAttributesSchema = {
 	browser: {
 		type: String,
 		required: false
+	},
+	headerMatch: {
+		type: String,
+		required: false
+	},
+	headerName: {
+		type: String,
+		required: false
+	},
+	headerValue: {
+		type: String,
+		required: false
+	},
+	headerOperator: {
+		type: String,
+		required: false
+	},
+	webBotAuthAgent: {
+		type: String,
+		required: false
 	}
 };
 var userIpSchema = {

package/dist/cjs/redis/reader/redisRulesReader.cjs

@@ -26,6 +26,7 @@ var SPECIFICITY_EXPR = [
 	"exists(@asn)",
 	"exists(@os)",
 	"exists(@browser)",
+	"exists(@headerMatch)",
 	"exists(@numericIp)",
 	"exists(@numericIpMaskMin)"
 ].join(" + ");
@@ -54,6 +55,10 @@ var RULE_LOAD_FIELDS = [
 	"@asn",
 	"@os",
 	"@browser",
+	"@headerMatch",
+	"@headerName",
+	"@headerValue",
+	"@headerOperator",
 	"@numericIp",
 	"@numericIpMaskMin",
 	"@numericIpMaskMax"

package/dist/cjs/redis/redisRuleIndex.cjs

@@ -58,6 +58,26 @@ var userAttributesRedisSchema = {
 	browser: {
 		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
 		INDEXMISSING: true
+	},
+	headerMatch: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headerName: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headerValue: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headerOperator: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	webBotAuthAgent: {
+		type: _redis_search.SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
 	}
 };
 var userScopeRedisSchema = {

package/dist/cjs/rule.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 var AccessPolicyType = /* @__PURE__ */ function(AccessPolicyType) {
 	AccessPolicyType["Block"] = "block";
 	AccessPolicyType["Restrict"] = "restrict";
+	AccessPolicyType["Allow"] = "allow";
 	return AccessPolicyType;
 }({});
 var GLOBAL_CLIENT_SCOPE_SENTINEL = "global";

package/dist/cjs/ruleInput/userScopeInput.cjs

@@ -6,6 +6,13 @@ node_crypto = require_runtime.__toESM(node_crypto, 1);
 let _prosopo_util = require("@prosopo/util");
 let ip_address = require("ip-address");
 //#region src/ruleInput/userScopeInput.ts
+function normaliseSignatureAgentUrl(raw) {
+	const url = new URL(raw);
+	url.hostname = url.hostname.toLowerCase();
+	url.protocol = url.protocol.toLowerCase();
+	if (url.pathname === "/") url.pathname = "";
+	return url.toString().replace(/\/$/, "");
+}
 var userAttributesSchema = zod.z.object({
 	userId: zod.z.coerce.string().optional(),
 	ja4Hash: zod.z.coerce.string().optional(),
@@ -16,7 +23,12 @@ var userAttributesSchema = zod.z.object({
 	countryCode: zod.z.coerce.string().optional(),
 	asn: zod.z.coerce.number().int().nonnegative().optional(),
 	os: zod.z.coerce.string().optional(),
-	browser: zod.z.coerce.string().optional()
+	browser: zod.z.coerce.string().optional(),
+	headerMatch: zod.z.coerce.string().optional(),
+	headerName: zod.z.coerce.string().optional(),
+	headerValue: zod.z.coerce.string().optional(),
+	headerOperator: zod.z.coerce.string().optional(),
+	webBotAuthAgent: zod.z.coerce.string().url().transform(normaliseSignatureAgentUrl).optional()
 });
 var userAttributesInput = zod.z.object({
 	...userAttributesSchema.shape,

package/dist/cjs/ruleRecord.cjs

@@ -10,7 +10,12 @@ var userAttributesRecordFields = [
 	"countryCode",
 	"asn",
 	"os",
-	"browser"
+	"browser",
+	"headerMatch",
+	"headerName",
+	"headerValue",
+	"headerOperator",
+	"webBotAuthAgent"
 ];
 var userIpRecordFields = ["ip", "ipMask"];
 var userScopeRecordFields = [...userAttributesRecordFields, ...userIpRecordFields];

package/dist/headerMatch.d.ts

@@ -0,0 +1,13 @@
+export declare const HEADER_OPERATORS: readonly ["equals", "contains", "notEquals", "notContains", "notEqualsAny", "notContainsAny"];
+export type HeaderOperator = (typeof HEADER_OPERATORS)[number];
+export declare const isHeaderOperator: (value: string | undefined) => value is HeaderOperator;
+export declare const HEADER_RULE_MARKER = "1";
+export declare const encodeHeaderValueList: (values: ReadonlyArray<string>) => string;
+export declare const decodeHeaderValueList: (value: string) => string[] | undefined;
+export declare const evaluateHeaderCondition: (headerName: string, operator: HeaderOperator, value: string, headers: Record<string, string>) => boolean;
+export declare const accessRuleHeaderMatches: (rule: {
+    headerName?: string;
+    headerValue?: string;
+    headerOperator?: string;
+}, headers: Record<string, string>) => boolean;
+//# sourceMappingURL=headerMatch.d.ts.map

package/dist/headerMatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headerMatch.d.ts","sourceRoot":"","sources":["../src/headerMatch.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,gBAAgB,+FAOnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,eAAO,MAAM,gBAAgB,UACrB,MAAM,GAAG,SAAS,KACvB,KAAK,IAAI,cAEgD,CAAC;AAgB7D,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAQtC,eAAO,MAAM,qBAAqB,WAAY,aAAa,CAAC,MAAM,CAAC,KAAG,MAC/C,CAAC;AAYxB,eAAO,MAAM,qBAAqB,UAAW,MAAM,KAAG,MAAM,EAAE,GAAG,SAmBhE,CAAC;AAYF,eAAO,MAAM,uBAAuB,eACvB,MAAM,YACR,cAAc,SACjB,MAAM,WACJ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OA6BF,CAAC;AASF,eAAO,MAAM,uBAAuB,SAC7B;IACL,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB,WACQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAaF,CAAC"}