@prosopo/user-access-policy 3.12.7 → 3.12.9

package/dist/redis/redisRulesWriter.js

@@ -1,117 +1,86 @@
-import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
-import { REDIS_BATCH_SIZE } from "./redisClient.js";
+import "../_virtual/_rolldown/runtime.js";
 import { GLOBAL_CLIENT_SCOPE_SENTINEL } from "../rule.js";
+import { REDIS_BATCH_SIZE } from "./redisClient.js";
 import { ACCESS_RULE_REDIS_KEY_PREFIX, getAccessRuleRedisKey } from "./redisRuleIndex.js";
-class RedisRulesWriter {
-  constructor(client, logger) {
-    this.client = client;
-    this.logger = logger;
-  }
-  async insertRules(ruleEntries) {
-    const entryBatches = chunkIntoBatches(ruleEntries, REDIS_BATCH_SIZE);
-    const keyBatches = await executeBatchesSequentially(
-      entryBatches,
-      async (entriesBatch) => this.insertRuleEntries(entriesBatch)
-    );
-    return keyBatches.flatMap(
-      (ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length)
-    );
-  }
-  async deleteRules(ruleIds) {
-    const ruleKeys = ruleIds.map(
-      (ruleId) => ACCESS_RULE_REDIS_KEY_PREFIX + ruleId
-    );
-    const keyBatches = chunkIntoBatches(ruleKeys, REDIS_BATCH_SIZE);
-    await executeBatchesSequentially(keyBatches, async (keysBatch) => {
-      const queries = this.client.multi();
-      for (const ruleKey of keysBatch) {
-        queries.del(ruleKey);
-      }
-      await queries.exec();
-    });
-  }
-  async deleteAllRules() {
-    let cursor = "0";
-    let total = 0;
-    do {
-      const reply = await this.client.scan(cursor, {
-        MATCH: `${ACCESS_RULE_REDIS_KEY_PREFIX}*`,
-        COUNT: REDIS_BATCH_SIZE
-      });
-      const ids = reply.keys.map(
-        (key) => key.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length)
-      );
-      await this.deleteRules(ids);
-      total += ids.length;
-      cursor = reply.cursor;
-    } while ("0" !== cursor);
-    return total;
-  }
-  async insertRuleEntries(ruleEntries) {
-    const queries = this.client.multi();
-    const ruleKeys = ruleEntries.map((ruleEntry) => {
-      const { rule, expiresUnixTimestamp } = ruleEntry;
-      const ruleKey = getAccessRuleRedisKey(rule);
-      const ruleValue = getRedisRuleValue(rule);
-      queries.hSet(ruleKey, ruleValue);
-      if (expiresUnixTimestamp) {
-        const MILLISECOND_THRESHOLD = 1e10;
-        if (expiresUnixTimestamp > MILLISECOND_THRESHOLD) {
-          throw new Error(
-            `Invalid expiry timestamp: ${expiresUnixTimestamp}. Timestamp must be in seconds, not milliseconds.`
-          );
-        }
-        queries.expireAt(ruleKey, expiresUnixTimestamp);
-      }
-      return ruleKey;
-    });
-    await queries.exec();
-    return ruleKeys;
-  }
-}
-const getRedisRuleValue = (rule) => {
-  const record = {};
-  for (const [key, value] of Object.entries(rule)) {
-    if (value === void 0) {
-      continue;
-    }
-    record[key] = String(value);
-  }
-  if (record.clientId === void 0) {
-    record.clientId = GLOBAL_CLIENT_SCOPE_SENTINEL;
-  }
-  return record;
+import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
+//#region src/redis/redisRulesWriter.ts
+var RedisRulesWriter = class {
+	constructor(client, logger) {
+		this.client = client;
+		this.logger = logger;
+	}
+	async insertRules(ruleEntries) {
+		return (await executeBatchesSequentially(chunkIntoBatches(ruleEntries, REDIS_BATCH_SIZE), async (entriesBatch) => this.insertRuleEntries(entriesBatch))).flatMap((ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length));
+	}
+	async deleteRules(ruleIds) {
+		await executeBatchesSequentially(chunkIntoBatches(ruleIds.map((ruleId) => ACCESS_RULE_REDIS_KEY_PREFIX + ruleId), REDIS_BATCH_SIZE), async (keysBatch) => {
+			const queries = this.client.multi();
+			for (const ruleKey of keysBatch) queries.del(ruleKey);
+			await queries.exec();
+		});
+	}
+	async deleteAllRules() {
+		let cursor = "0";
+		let total = 0;
+		do {
+			const reply = await this.client.scan(cursor, {
+				MATCH: `${ACCESS_RULE_REDIS_KEY_PREFIX}*`,
+				COUNT: REDIS_BATCH_SIZE
+			});
+			const ids = reply.keys.map((key) => key.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length));
+			await this.deleteRules(ids);
+			total += ids.length;
+			cursor = reply.cursor;
+		} while ("0" !== cursor);
+		return total;
+	}
+	async insertRuleEntries(ruleEntries) {
+		const queries = this.client.multi();
+		const ruleKeys = ruleEntries.map((ruleEntry) => {
+			const { rule, expiresUnixTimestamp } = ruleEntry;
+			const ruleKey = getAccessRuleRedisKey(rule);
+			const ruleValue = getRedisRuleValue(rule);
+			queries.hSet(ruleKey, ruleValue);
+			if (expiresUnixTimestamp) {
+				if (expiresUnixTimestamp > 1e10) throw new Error(`Invalid expiry timestamp: ${expiresUnixTimestamp}. Timestamp must be in seconds, not milliseconds.`);
+				queries.expireAt(ruleKey, expiresUnixTimestamp);
+			}
+			return ruleKey;
+		});
+		await queries.exec();
+		return ruleKeys;
+	}
+};
+var getRedisRuleValue = (rule) => {
+	const record = {};
+	for (const [key, value] of Object.entries(rule)) {
+		if (value === void 0) continue;
+		record[key] = String(value);
+	}
+	if (record.clientId === void 0) record.clientId = GLOBAL_CLIENT_SCOPE_SENTINEL;
+	return record;
 };
-class DummyRedisRulesWriter {
-  constructor(logger) {
-    this.logger = logger;
-  }
-  async insertRules(ruleEntries) {
-    this.logger.info(() => ({
-      msg: "Dummy insertRules() has no effect (redis is not ready)",
-      data: {
-        ruleEntries
-      }
-    }));
-    return [];
-  }
-  async deleteRules(ruleIds) {
-    this.logger.info(() => ({
-      msg: "Dummy deleteRules() has no effect (redis is not ready)",
-      data: {
-        ruleIds
-      }
-    }));
-  }
-  async deleteAllRules() {
-    this.logger.info(() => ({
-      msg: "Dummy deleteAllRules() has no effect (redis is not ready)"
-    }));
-    return 0;
-  }
-}
-export {
-  DummyRedisRulesWriter,
-  RedisRulesWriter,
-  getRedisRuleValue
+var DummyRedisRulesWriter = class {
+	constructor(logger) {
+		this.logger = logger;
+	}
+	async insertRules(ruleEntries) {
+		this.logger.info(() => ({
+			msg: "Dummy insertRules() has no effect (redis is not ready)",
+			data: { ruleEntries }
+		}));
+		return [];
+	}
+	async deleteRules(ruleIds) {
+		this.logger.info(() => ({
+			msg: "Dummy deleteRules() has no effect (redis is not ready)",
+			data: { ruleIds }
+		}));
+	}
+	async deleteAllRules() {
+		this.logger.info(() => ({ msg: "Dummy deleteAllRules() has no effect (redis is not ready)" }));
+		return 0;
+	}
 };
+//#endregion
+export { DummyRedisRulesWriter, RedisRulesWriter, getRedisRuleValue };

package/dist/rule.js

@@ -1,10 +1,10 @@
-var AccessPolicyType = /* @__PURE__ */ ((AccessPolicyType2) => {
-  AccessPolicyType2["Block"] = "block";
-  AccessPolicyType2["Restrict"] = "restrict";
-  return AccessPolicyType2;
-})(AccessPolicyType || {});
-const GLOBAL_CLIENT_SCOPE_SENTINEL = "global";
-export {
-  AccessPolicyType,
-  GLOBAL_CLIENT_SCOPE_SENTINEL
-};
+import "./_virtual/_rolldown/runtime.js";
+//#region src/rule.ts
+var AccessPolicyType = /* @__PURE__ */ function(AccessPolicyType) {
+	AccessPolicyType["Block"] = "block";
+	AccessPolicyType["Restrict"] = "restrict";
+	return AccessPolicyType;
+}({});
+var GLOBAL_CLIENT_SCOPE_SENTINEL = "global";
+//#endregion
+export { AccessPolicyType, GLOBAL_CLIENT_SCOPE_SENTINEL };

package/dist/ruleInput/.export.js

@@ -1,9 +1,5 @@
-import { accessRuleInput } from "./ruleInput.js";
+import "../_virtual/_rolldown/runtime.js";
 import { accessPolicyInput, policyScopeInput } from "./policyInput.js";
 import { userScopeInput } from "./userScopeInput.js";
-export {
-  accessPolicyInput,
-  accessRuleInput,
-  policyScopeInput,
-  userScopeInput
-};
+import { accessRuleInput } from "./ruleInput.js";
+export { accessPolicyInput, accessRuleInput, policyScopeInput, userScopeInput };

package/dist/ruleInput/policyInput.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { type AccessPolicy, AccessPolicyType } from "#policy/rule.js";
-export declare const accessPolicyInput: z.ZodObject<{
+export declare const accessPolicyInputShape: z.ZodObject<{
     type: z.ZodNativeEnum<typeof AccessPolicyType>;
     captchaType: z.ZodOptional<z.ZodNativeEnum<typeof import("@prosopo/types").CaptchaType>>;
     description: z.ZodOptional<z.ZodString>;
@@ -31,6 +31,57 @@ export declare const accessPolicyInput: z.ZodObject<{
     frictionlessScore?: number | undefined;
     deferToVerify?: unknown;
 }>;
+export declare const accessPolicyInput: z.ZodEffects<z.ZodObject<{
+    type: z.ZodNativeEnum<typeof AccessPolicyType>;
+    captchaType: z.ZodOptional<z.ZodNativeEnum<typeof import("@prosopo/types").CaptchaType>>;
+    description: z.ZodOptional<z.ZodString>;
+    solvedImagesCount: z.ZodOptional<z.ZodNumber>;
+    imageThreshold: z.ZodOptional<z.ZodNumber>;
+    powDifficulty: z.ZodOptional<z.ZodNumber>;
+    unsolvedImagesCount: z.ZodOptional<z.ZodNumber>;
+    frictionlessScore: z.ZodOptional<z.ZodNumber>;
+    deferToVerify: z.ZodOptional<z.ZodEffects<z.ZodBoolean, boolean, unknown>>;
+}, "strip", z.ZodTypeAny, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: boolean | undefined;
+}, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: unknown;
+}>, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: boolean | undefined;
+}, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: unknown;
+}>;
 export declare const sanitizeAccessPolicy: (policy: AccessPolicy) => AccessPolicy;
 export declare const policyScopeInput: z.ZodObject<{
     clientId: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, unknown>;

package/dist/ruleInput/policyInput.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policyInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,KAAK,YAAY,EACjB,gBAAgB,EAGhB,MAAM,iBAAiB,CAAC;AAOzB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBI,CAAC;AAGnC,eAAO,MAAM,oBAAoB,WAAY,YAAY,KAAG,YAM3D,CAAC;AAOF,eAAO,MAAM,gBAAgB;;;;;;EAUI,CAAC"}
+{"version":3,"file":"policyInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,KAAK,YAAY,EACjB,gBAAgB,EAGhB,MAAM,iBAAiB,CAAC;AAwBzB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBD,CAAC;AAEnC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB7B,CAAC;AAOF,eAAO,MAAM,oBAAoB,WAAY,YAAY,KAAG,YAM3D,CAAC;AAOF,eAAO,MAAM,gBAAgB;;;;;;EAUI,CAAC"}

package/dist/ruleInput/policyInput.js

@@ -1,45 +1,39 @@
-import { CaptchaTypeSchema } from "@prosopo/types";
+import "../_virtual/_rolldown/runtime.js";
+import { AccessPolicyType } from "../rule.js";
 import { z } from "zod";
-import { AccessPolicyType, GLOBAL_CLIENT_SCOPE_SENTINEL } from "../rule.js";
-const accessPolicyInput = z.object({
-  type: z.nativeEnum(AccessPolicyType),
-  captchaType: CaptchaTypeSchema.optional(),
-  description: z.coerce.string().optional(),
-  // Redis stores values as strings, so coerce is needed to parse properly
-  solvedImagesCount: z.coerce.number().optional(),
-  // the percentage of image panels that must be solved per image CAPTCHA
-  imageThreshold: z.coerce.number().optional(),
-  // the Proof-of-Work difficulty level
-  powDifficulty: z.coerce.number().optional(),
-  // the number of unsolved image CAPTCHA challenges to serve
-  unsolvedImagesCount: z.coerce.number().optional(),
-  // used to increase the user's score
-  frictionlessScore: z.coerce.number().optional(),
-  // Skip the request-time block middleware and only fire at verify.
-  // Redis stores booleans as strings — preprocess so "true"/"false"
-  // round-trip to the JS boolean the matcher expects.
-  deferToVerify: z.preprocess((v) => typeof v === "string" ? v === "true" : v, z.boolean()).optional()
+import { CaptchaTypeSchema } from "@prosopo/types";
+//#region src/ruleInput/policyInput.ts
+var accessPolicyInputShape = z.object({
+	type: z.nativeEnum(AccessPolicyType),
+	captchaType: CaptchaTypeSchema.optional(),
+	description: z.coerce.string().optional(),
+	solvedImagesCount: z.coerce.number().optional(),
+	imageThreshold: z.coerce.number().optional(),
+	powDifficulty: z.coerce.number().optional(),
+	unsolvedImagesCount: z.coerce.number().optional(),
+	frictionlessScore: z.coerce.number().optional(),
+	deferToVerify: z.preprocess((v) => typeof v === "string" ? v === "true" : v, z.boolean()).optional()
 });
-const sanitizeAccessPolicy = (policy) => {
-  if (policy.type === AccessPolicyType.Block) {
-    const { captchaType, solvedImagesCount, ...blockPolicy } = policy;
-    return blockPolicy;
-  }
-  return policy;
-};
-const policyScopeInput = z.object({
-  // `getRedisRuleValue` stamps a sentinel string on global rules so the
-  // read-time query can probe `@clientId:{global}` cheaply. Undo the
-  // stamp here so consumers (rankCandidateRules, response payloads,
-  // tests) continue to see `undefined` for global rules — the mongoose
-  // side and the API input side never emit the sentinel.
-  clientId: z.preprocess(
-    (v) => v === GLOBAL_CLIENT_SCOPE_SENTINEL ? void 0 : v,
-    z.coerce.string().optional()
-  )
+var accessPolicyInput = accessPolicyInputShape.superRefine((policy, ctx) => {
+	if (policy.type !== AccessPolicyType.Block) return;
+	if (policy.captchaType !== void 0) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["captchaType"],
+		message: "Block policies cannot pin a captchaType — Block always applies to every captcha type. Use a Restrict policy if you want to narrow the effect to one captcha type."
+	});
+	if (policy.solvedImagesCount !== void 0) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["solvedImagesCount"],
+		message: "Block policies cannot set solvedImagesCount — the field only applies to Restrict policies that adjust image-captcha rounds."
+	});
 });
-export {
-  accessPolicyInput,
-  policyScopeInput,
-  sanitizeAccessPolicy
+var sanitizeAccessPolicy = (policy) => {
+	if (policy.type === AccessPolicyType.Block) {
+		const { captchaType, solvedImagesCount, ...blockPolicy } = policy;
+		return blockPolicy;
+	}
+	return policy;
 };
+var policyScopeInput = z.object({ clientId: z.preprocess((v) => v === "global" ? void 0 : v, z.coerce.string().optional()) });
+//#endregion
+export { accessPolicyInput, accessPolicyInputShape, policyScopeInput, sanitizeAccessPolicy };

package/dist/ruleInput/policyInput.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyInput.js","sourceRoot":"","sources":["../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEN,gBAAgB,EAChB,4BAA4B,GAE5B,MAAM,iBAAiB,CAAC;AAOzB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACpC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAI/C,aAAa,EAAE,CAAC;SACd,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC1E,QAAQ,EAAE;CACoB,CAAC,CAAC;AAGnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAoB,EAAgB,EAAE;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC;QAClE,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAMxC,QAAQ,EAAE,CAAC,CAAC,UAAU,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3D,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAC5B;CAC8B,CAAC,CAAC"}
+{"version":3,"file":"policyInput.js","sourceRoot":"","sources":["../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEN,gBAAgB,EAChB,4BAA4B,GAE5B,MAAM,iBAAiB,CAAC;AAwBzB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACpC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAI/C,aAAa,EAAE,CAAC;SACd,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC1E,QAAQ,EAAE;CACoB,CAAC,CAAC;AAEnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,WAAW,CAClE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IACf,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO;IACnD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,GAAG,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACN,mKAAmK;SACpK,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EACN,6HAA6H;SAC9H,CAAC,CAAC;IACJ,CAAC;AACF,CAAC,CACD,CAAC;AAOF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAoB,EAAgB,EAAE;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC;QAClE,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAMxC,QAAQ,EAAE,CAAC,CAAC,UAAU,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3D,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAC5B;CAC8B,CAAC,CAAC"}

package/dist/ruleInput/ruleInput.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruleInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,KAAK,cAAc,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,YAAY,GACzC,WAAW,GACX,cAAc,GACd,cAAc,CAAC;AAsBhB,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAOL,CAAC;AAEnE,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAIrC,CAAC;AAEvC,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG;IACxD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B,CAAC;AAQF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYS,CAAC;AAE7C,eAAO,MAAM,6BAA6B,gBAC5B,sBAAsB,KACjC,iBAAiB,EAiBnB,CAAC"}
+{"version":3,"file":"ruleInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,KAAK,cAAc,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,YAAY,GACzC,WAAW,GACX,cAAc,GACd,cAAc,CAAC;AA6BhB,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAOL,CAAC;AAEnE,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAIrC,CAAC;AAEvC,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG;IACxD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B,CAAC;AAQF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYS,CAAC;AAE7C,eAAO,MAAM,6BAA6B,gBAC5B,sBAAsB,KACjC,iBAAiB,EAiBnB,CAAC"}

package/dist/ruleInput/ruleInput.js

@@ -1,51 +1,43 @@
-import { z } from "zod";
+import "../_virtual/_rolldown/runtime.js";
 import { FilterScopeMatch } from "../rulesStorage.js";
-import { policyScopeInput, accessPolicyInput } from "./policyInput.js";
+import { accessPolicyInputShape, policyScopeInput } from "./policyInput.js";
 import { userScopeInput } from "./userScopeInput.js";
-const ruleGroupInput = z.object({
-  groupId: z.coerce.string().optional(),
-  ruleGroupId: z.coerce.string().optional()
-}).transform((ruleGroupInput2) => {
-  const { ruleGroupId, ...ruleGroup } = ruleGroupInput2;
-  if ("string" === typeof ruleGroupId) {
-    ruleGroup.groupId = ruleGroupId;
-  }
-  return ruleGroup;
+import { z } from "zod";
+//#region src/ruleInput/ruleInput.ts
+var ruleGroupInput = z.object({
+	groupId: z.coerce.string().optional(),
+	ruleGroupId: z.coerce.string().optional()
+}).transform((ruleGroupInput) => {
+	const { ruleGroupId, ...ruleGroup } = ruleGroupInput;
+	if ("string" === typeof ruleGroupId) ruleGroup.groupId = ruleGroupId;
+	return ruleGroup;
 });
-const accessRuleInput = z.object({
-  ...accessPolicyInput.shape,
-  ...policyScopeInput.shape
+var accessRuleInput = z.object({
+	...accessPolicyInputShape.shape,
+	...policyScopeInput.shape
 }).and(userScopeInput).and(ruleGroupInput).transform((ruleInput) => ruleInput);
-const ruleEntryInput = z.object({
-  rule: accessRuleInput,
-  expiresUnixTimestamp: z.coerce.number().optional()
+var ruleEntryInput = z.object({
+	rule: accessRuleInput,
+	expiresUnixTimestamp: z.coerce.number().optional()
 });
-const accessRulesFilterInput = z.object({
-  policyScope: policyScopeInput.optional(),
-  policyScopes: z.array(policyScopeInput).optional(),
-  policyScopeMatch: z.nativeEnum(FilterScopeMatch).default(FilterScopeMatch.Exact),
-  userScope: userScopeInput.optional(),
-  userScopeMatch: z.nativeEnum(FilterScopeMatch).default(FilterScopeMatch.Exact),
-  groupId: z.string().optional(),
-  blockOnly: z.boolean().optional()
+var accessRulesFilterInput = z.object({
+	policyScope: policyScopeInput.optional(),
+	policyScopes: z.array(policyScopeInput).optional(),
+	policyScopeMatch: z.nativeEnum(FilterScopeMatch).default(FilterScopeMatch.Exact),
+	userScope: userScopeInput.optional(),
+	userScopeMatch: z.nativeEnum(FilterScopeMatch).default(FilterScopeMatch.Exact),
+	groupId: z.string().optional(),
+	blockOnly: z.boolean().optional()
 });
-const getAccessRuleFiltersFromInput = (filterInput) => {
-  const { policyScopes, policyScope, ...filterBase } = filterInput;
-  const allPolicyScopes = policyScopes || [];
-  if (policyScope) {
-    allPolicyScopes.push(policyScope);
-  }
-  if (allPolicyScopes.length > 0) {
-    return allPolicyScopes.map((policyScope2) => ({
-      ...filterBase,
-      policyScope: policyScope2
-    }));
-  }
-  return [filterBase];
-};
-export {
-  accessRuleInput,
-  accessRulesFilterInput,
-  getAccessRuleFiltersFromInput,
-  ruleEntryInput
+var getAccessRuleFiltersFromInput = (filterInput) => {
+	const { policyScopes, policyScope, ...filterBase } = filterInput;
+	const allPolicyScopes = policyScopes || [];
+	if (policyScope) allPolicyScopes.push(policyScope);
+	if (allPolicyScopes.length > 0) return allPolicyScopes.map((policyScope) => ({
+		...filterBase,
+		policyScope
+	}));
+	return [filterBase];
 };
+//#endregion
+export { accessRuleInput, accessRulesFilterInput, getAccessRuleFiltersFromInput, ruleEntryInput };

package/dist/ruleInput/ruleInput.js.map

@@ -1 +1 @@
-{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAOJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,iBAAiB,CAAC,KAAK;IAC1B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACS,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}
+{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAcJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,sBAAsB,CAAC,KAAK;IAC/B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACS,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}

package/dist/ruleInput/userScopeInput.js

@@ -1,63 +1,52 @@
+import "../_virtual/_rolldown/runtime.js";
+import { z } from "zod";
 import crypto from "node:crypto";
 import { getIPAddress } from "@prosopo/util";
 import { Address4, Address6 } from "ip-address";
-import { z } from "zod";
-const userAttributesSchema = z.object({
-  // coerce is used for safety, as e.g., incoming userId can be digital
-  userId: z.coerce.string().optional(),
-  ja4Hash: z.coerce.string().optional(),
-  headersHash: z.coerce.string().optional(),
-  userAgentHash: z.coerce.string().optional(),
-  headHash: z.coerce.string().optional(),
-  coords: z.coerce.string().optional(),
-  countryCode: z.coerce.string().optional(),
-  asn: z.coerce.number().int().nonnegative().optional(),
-  // Plain lowercase OS tag (see `classifyOs`). Loose `string` like
-  // countryCode: a stale/unknown value just never matches a request rather
-  // than failing the whole rule parse.
-  os: z.coerce.string().optional()
+//#region src/ruleInput/userScopeInput.ts
+var userAttributesSchema = z.object({
+	userId: z.coerce.string().optional(),
+	ja4Hash: z.coerce.string().optional(),
+	headersHash: z.coerce.string().optional(),
+	userAgentHash: z.coerce.string().optional(),
+	headHash: z.coerce.string().optional(),
+	coords: z.coerce.string().optional(),
+	countryCode: z.coerce.string().optional(),
+	asn: z.coerce.number().int().nonnegative().optional(),
+	os: z.coerce.string().optional()
 });
-const userAttributesInput = z.object({
-  ...userAttributesSchema.shape,
-  userAgent: z.coerce.string().optional()
-}).transform((userAttributesInput2) => {
-  const { userAgent, ...userScope } = userAttributesInput2;
-  if ("string" === typeof userAgent) {
-    userScope.userAgentHash = hashUserAgent(userAgent);
-  }
-  return userScope;
+var userAttributesInput = z.object({
+	...userAttributesSchema.shape,
+	userAgent: z.coerce.string().optional()
+}).transform((userAttributesInput) => {
+	const { userAgent, ...userScope } = userAttributesInput;
+	if ("string" === typeof userAgent) userScope.userAgentHash = hashUserAgent(userAgent);
+	return userScope;
 });
-const hashUserAgent = (userAgent) => crypto.createHash("sha256").update(userAgent).digest("hex");
-const userIpSchema = z.object({
-  numericIp: z.coerce.bigint().optional(),
-  numericIpMaskMin: z.coerce.bigint().optional(),
-  numericIpMaskMax: z.coerce.bigint().optional()
+var hashUserAgent = (userAgent) => crypto.createHash("sha256").update(userAgent).digest("hex");
+var userIpSchema = z.object({
+	numericIp: z.coerce.bigint().optional(),
+	numericIpMaskMin: z.coerce.bigint().optional(),
+	numericIpMaskMax: z.coerce.bigint().optional()
 });
-const userIpInput = z.object({
-  ...userIpSchema.shape,
-  ip: z.string().optional(),
-  ipMask: z.string().optional()
-}).transform((userIpInput2) => {
-  const { ip, ipMask, ...numericUserIp } = userIpInput2;
-  if ("string" === typeof ip) {
-    numericUserIp.numericIp = getIPAddress(ip).bigInt();
-  }
-  if ("string" === typeof ipMask) {
-    const ipObject = Address4.isValid(ipMask) ? new Address4(ipMask) : new Address6(ipMask);
-    numericUserIp.numericIpMaskMin = ipObject.startAddress().bigInt();
-    numericUserIp.numericIpMaskMax = ipObject.endAddress().bigInt();
-  }
-  return numericUserIp;
+var userIpInput = z.object({
+	...userIpSchema.shape,
+	ip: z.string().optional(),
+	ipMask: z.string().optional()
+}).transform((userIpInput) => {
+	const { ip, ipMask, ...numericUserIp } = userIpInput;
+	if ("string" === typeof ip) numericUserIp.numericIp = getIPAddress(ip).bigInt();
+	if ("string" === typeof ipMask) {
+		const ipObject = Address4.isValid(ipMask) ? new Address4(ipMask) : new Address6(ipMask);
+		numericUserIp.numericIpMaskMin = ipObject.startAddress().bigInt();
+		numericUserIp.numericIpMaskMax = ipObject.endAddress().bigInt();
+	}
+	return numericUserIp;
 });
-const userScopeSchema = z.object({
-  ...userIpSchema.shape,
-  ...userAttributesSchema.shape
+var userScopeSchema = z.object({
+	...userIpSchema.shape,
+	...userAttributesSchema.shape
 });
-const userScopeInput = z.object({}).and(userIpInput).and(userAttributesInput).transform(
-  // transform is used for type safety only - plain "satisfies ZodType<x>" doesn't work after ".and()"
-  (userScopeInput2) => userScopeInput2
-);
-export {
-  userScopeInput,
-  userScopeSchema
-};
+var userScopeInput = z.object({}).and(userIpInput).and(userAttributesInput).transform((userScopeInput) => userScopeInput);
+//#endregion
+export { userScopeInput, userScopeSchema };