@prosopo/user-access-policy 3.12.7 → 3.12.9

package/dist/cjs/redis/redisRulesWriter.cjs

@@ -1,117 +1,91 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const common = require("@prosopo/common");
-const redisClient = require("./redisClient.cjs");
-const rule = require("../rule.cjs");
-const redisRuleIndex = require("./redisRuleIndex.cjs");
-class RedisRulesWriter {
-  constructor(client, logger) {
-    this.client = client;
-    this.logger = logger;
-  }
-  async insertRules(ruleEntries) {
-    const entryBatches = common.chunkIntoBatches(ruleEntries, redisClient.REDIS_BATCH_SIZE);
-    const keyBatches = await common.executeBatchesSequentially(
-      entryBatches,
-      async (entriesBatch) => this.insertRuleEntries(entriesBatch)
-    );
-    return keyBatches.flatMap(
-      (ruleKey) => ruleKey.slice(redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX.length)
-    );
-  }
-  async deleteRules(ruleIds) {
-    const ruleKeys = ruleIds.map(
-      (ruleId) => redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX + ruleId
-    );
-    const keyBatches = common.chunkIntoBatches(ruleKeys, redisClient.REDIS_BATCH_SIZE);
-    await common.executeBatchesSequentially(keyBatches, async (keysBatch) => {
-      const queries = this.client.multi();
-      for (const ruleKey of keysBatch) {
-        queries.del(ruleKey);
-      }
-      await queries.exec();
-    });
-  }
-  async deleteAllRules() {
-    let cursor = "0";
-    let total = 0;
-    do {
-      const reply = await this.client.scan(cursor, {
-        MATCH: `${redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX}*`,
-        COUNT: redisClient.REDIS_BATCH_SIZE
-      });
-      const ids = reply.keys.map(
-        (key) => key.slice(redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX.length)
-      );
-      await this.deleteRules(ids);
-      total += ids.length;
-      cursor = reply.cursor;
-    } while ("0" !== cursor);
-    return total;
-  }
-  async insertRuleEntries(ruleEntries) {
-    const queries = this.client.multi();
-    const ruleKeys = ruleEntries.map((ruleEntry) => {
-      const { rule: rule2, expiresUnixTimestamp } = ruleEntry;
-      const ruleKey = redisRuleIndex.getAccessRuleRedisKey(rule2);
-      const ruleValue = getRedisRuleValue(rule2);
-      queries.hSet(ruleKey, ruleValue);
-      if (expiresUnixTimestamp) {
-        const MILLISECOND_THRESHOLD = 1e10;
-        if (expiresUnixTimestamp > MILLISECOND_THRESHOLD) {
-          throw new Error(
-            `Invalid expiry timestamp: ${expiresUnixTimestamp}. Timestamp must be in seconds, not milliseconds.`
-          );
-        }
-        queries.expireAt(ruleKey, expiresUnixTimestamp);
-      }
-      return ruleKey;
-    });
-    await queries.exec();
-    return ruleKeys;
-  }
-}
-const getRedisRuleValue = (rule$1) => {
-  const record = {};
-  for (const [key, value] of Object.entries(rule$1)) {
-    if (value === void 0) {
-      continue;
-    }
-    record[key] = String(value);
-  }
-  if (record.clientId === void 0) {
-    record.clientId = rule.GLOBAL_CLIENT_SCOPE_SENTINEL;
-  }
-  return record;
+const require_rule = require("../rule.cjs");
+const require_redis_redisClient = require("./redisClient.cjs");
+const require_redis_redisRuleIndex = require("./redisRuleIndex.cjs");
+let _prosopo_common = require("@prosopo/common");
+//#region src/redis/redisRulesWriter.ts
+var RedisRulesWriter = class {
+	constructor(client, logger) {
+		this.client = client;
+		this.logger = logger;
+	}
+	async insertRules(ruleEntries) {
+		const entryBatches = (0, _prosopo_common.chunkIntoBatches)(ruleEntries, require_redis_redisClient.REDIS_BATCH_SIZE);
+		return (await (0, _prosopo_common.executeBatchesSequentially)(entryBatches, async (entriesBatch) => this.insertRuleEntries(entriesBatch))).flatMap((ruleKey) => ruleKey.slice(require_redis_redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX.length));
+	}
+	async deleteRules(ruleIds) {
+		const ruleKeys = ruleIds.map((ruleId) => require_redis_redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX + ruleId);
+		const keyBatches = (0, _prosopo_common.chunkIntoBatches)(ruleKeys, require_redis_redisClient.REDIS_BATCH_SIZE);
+		await (0, _prosopo_common.executeBatchesSequentially)(keyBatches, async (keysBatch) => {
+			const queries = this.client.multi();
+			for (const ruleKey of keysBatch) queries.del(ruleKey);
+			await queries.exec();
+		});
+	}
+	async deleteAllRules() {
+		let cursor = "0";
+		let total = 0;
+		do {
+			const reply = await this.client.scan(cursor, {
+				MATCH: `${require_redis_redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX}*`,
+				COUNT: require_redis_redisClient.REDIS_BATCH_SIZE
+			});
+			const ids = reply.keys.map((key) => key.slice(require_redis_redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX.length));
+			await this.deleteRules(ids);
+			total += ids.length;
+			cursor = reply.cursor;
+		} while ("0" !== cursor);
+		return total;
+	}
+	async insertRuleEntries(ruleEntries) {
+		const queries = this.client.multi();
+		const ruleKeys = ruleEntries.map((ruleEntry) => {
+			const { rule, expiresUnixTimestamp } = ruleEntry;
+			const ruleKey = require_redis_redisRuleIndex.getAccessRuleRedisKey(rule);
+			const ruleValue = getRedisRuleValue(rule);
+			queries.hSet(ruleKey, ruleValue);
+			if (expiresUnixTimestamp) {
+				if (expiresUnixTimestamp > 1e10) throw new Error(`Invalid expiry timestamp: ${expiresUnixTimestamp}. Timestamp must be in seconds, not milliseconds.`);
+				queries.expireAt(ruleKey, expiresUnixTimestamp);
+			}
+			return ruleKey;
+		});
+		await queries.exec();
+		return ruleKeys;
+	}
 };
-class DummyRedisRulesWriter {
-  constructor(logger) {
-    this.logger = logger;
-  }
-  async insertRules(ruleEntries) {
-    this.logger.info(() => ({
-      msg: "Dummy insertRules() has no effect (redis is not ready)",
-      data: {
-        ruleEntries
-      }
-    }));
-    return [];
-  }
-  async deleteRules(ruleIds) {
-    this.logger.info(() => ({
-      msg: "Dummy deleteRules() has no effect (redis is not ready)",
-      data: {
-        ruleIds
-      }
-    }));
-  }
-  async deleteAllRules() {
-    this.logger.info(() => ({
-      msg: "Dummy deleteAllRules() has no effect (redis is not ready)"
-    }));
-    return 0;
-  }
-}
+var getRedisRuleValue = (rule) => {
+	const record = {};
+	for (const [key, value] of Object.entries(rule)) {
+		if (value === void 0) continue;
+		record[key] = String(value);
+	}
+	if (record.clientId === void 0) record.clientId = require_rule.GLOBAL_CLIENT_SCOPE_SENTINEL;
+	return record;
+};
+var DummyRedisRulesWriter = class {
+	constructor(logger) {
+		this.logger = logger;
+	}
+	async insertRules(ruleEntries) {
+		this.logger.info(() => ({
+			msg: "Dummy insertRules() has no effect (redis is not ready)",
+			data: { ruleEntries }
+		}));
+		return [];
+	}
+	async deleteRules(ruleIds) {
+		this.logger.info(() => ({
+			msg: "Dummy deleteRules() has no effect (redis is not ready)",
+			data: { ruleIds }
+		}));
+	}
+	async deleteAllRules() {
+		this.logger.info(() => ({ msg: "Dummy deleteAllRules() has no effect (redis is not ready)" }));
+		return 0;
+	}
+};
+//#endregion
 exports.DummyRedisRulesWriter = DummyRedisRulesWriter;
 exports.RedisRulesWriter = RedisRulesWriter;
 exports.getRedisRuleValue = getRedisRuleValue;

package/dist/cjs/rule.cjs

@@ -1,10 +1,11 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-var AccessPolicyType = /* @__PURE__ */ ((AccessPolicyType2) => {
-  AccessPolicyType2["Block"] = "block";
-  AccessPolicyType2["Restrict"] = "restrict";
-  return AccessPolicyType2;
-})(AccessPolicyType || {});
-const GLOBAL_CLIENT_SCOPE_SENTINEL = "global";
+//#region src/rule.ts
+var AccessPolicyType = /* @__PURE__ */ function(AccessPolicyType) {
+	AccessPolicyType["Block"] = "block";
+	AccessPolicyType["Restrict"] = "restrict";
+	return AccessPolicyType;
+}({});
+var GLOBAL_CLIENT_SCOPE_SENTINEL = "global";
+//#endregion
 exports.AccessPolicyType = AccessPolicyType;
 exports.GLOBAL_CLIENT_SCOPE_SENTINEL = GLOBAL_CLIENT_SCOPE_SENTINEL;

package/dist/cjs/ruleInput/.export.cjs

@@ -1,9 +1,8 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const ruleInput = require("./ruleInput.cjs");
-const policyInput = require("./policyInput.cjs");
-const userScopeInput = require("./userScopeInput.cjs");
-exports.accessRuleInput = ruleInput.accessRuleInput;
-exports.accessPolicyInput = policyInput.accessPolicyInput;
-exports.policyScopeInput = policyInput.policyScopeInput;
-exports.userScopeInput = userScopeInput.userScopeInput;
+const require_ruleInput_policyInput = require("./policyInput.cjs");
+const require_ruleInput_userScopeInput = require("./userScopeInput.cjs");
+const require_ruleInput_ruleInput = require("./ruleInput.cjs");
+exports.accessPolicyInput = require_ruleInput_policyInput.accessPolicyInput;
+exports.accessRuleInput = require_ruleInput_ruleInput.accessRuleInput;
+exports.policyScopeInput = require_ruleInput_policyInput.policyScopeInput;
+exports.userScopeInput = require_ruleInput_userScopeInput.userScopeInput;

package/dist/cjs/ruleInput/policyInput.cjs

@@ -1,45 +1,42 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const types = require("@prosopo/types");
-const zod = require("zod");
-const rule = require("../rule.cjs");
-const accessPolicyInput = zod.z.object({
-  type: zod.z.nativeEnum(rule.AccessPolicyType),
-  captchaType: types.CaptchaTypeSchema.optional(),
-  description: zod.z.coerce.string().optional(),
-  // Redis stores values as strings, so coerce is needed to parse properly
-  solvedImagesCount: zod.z.coerce.number().optional(),
-  // the percentage of image panels that must be solved per image CAPTCHA
-  imageThreshold: zod.z.coerce.number().optional(),
-  // the Proof-of-Work difficulty level
-  powDifficulty: zod.z.coerce.number().optional(),
-  // the number of unsolved image CAPTCHA challenges to serve
-  unsolvedImagesCount: zod.z.coerce.number().optional(),
-  // used to increase the user's score
-  frictionlessScore: zod.z.coerce.number().optional(),
-  // Skip the request-time block middleware and only fire at verify.
-  // Redis stores booleans as strings — preprocess so "true"/"false"
-  // round-trip to the JS boolean the matcher expects.
-  deferToVerify: zod.z.preprocess((v) => typeof v === "string" ? v === "true" : v, zod.z.boolean()).optional()
+const require_rule = require("../rule.cjs");
+let zod = require("zod");
+let _prosopo_types = require("@prosopo/types");
+//#region src/ruleInput/policyInput.ts
+var accessPolicyInputShape = zod.z.object({
+	type: zod.z.nativeEnum(require_rule.AccessPolicyType),
+	captchaType: _prosopo_types.CaptchaTypeSchema.optional(),
+	description: zod.z.coerce.string().optional(),
+	solvedImagesCount: zod.z.coerce.number().optional(),
+	imageThreshold: zod.z.coerce.number().optional(),
+	powDifficulty: zod.z.coerce.number().optional(),
+	unsolvedImagesCount: zod.z.coerce.number().optional(),
+	frictionlessScore: zod.z.coerce.number().optional(),
+	deferToVerify: zod.z.preprocess((v) => typeof v === "string" ? v === "true" : v, zod.z.boolean()).optional()
 });
-const sanitizeAccessPolicy = (policy) => {
-  if (policy.type === rule.AccessPolicyType.Block) {
-    const { captchaType, solvedImagesCount, ...blockPolicy } = policy;
-    return blockPolicy;
-  }
-  return policy;
-};
-const policyScopeInput = zod.z.object({
-  // `getRedisRuleValue` stamps a sentinel string on global rules so the
-  // read-time query can probe `@clientId:{global}` cheaply. Undo the
-  // stamp here so consumers (rankCandidateRules, response payloads,
-  // tests) continue to see `undefined` for global rules — the mongoose
-  // side and the API input side never emit the sentinel.
-  clientId: zod.z.preprocess(
-    (v) => v === rule.GLOBAL_CLIENT_SCOPE_SENTINEL ? void 0 : v,
-    zod.z.coerce.string().optional()
-  )
+var accessPolicyInput = accessPolicyInputShape.superRefine((policy, ctx) => {
+	if (policy.type !== require_rule.AccessPolicyType.Block) return;
+	if (policy.captchaType !== void 0) ctx.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["captchaType"],
+		message: "Block policies cannot pin a captchaType — Block always applies to every captcha type. Use a Restrict policy if you want to narrow the effect to one captcha type."
+	});
+	if (policy.solvedImagesCount !== void 0) ctx.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["solvedImagesCount"],
+		message: "Block policies cannot set solvedImagesCount — the field only applies to Restrict policies that adjust image-captcha rounds."
+	});
 });
+var sanitizeAccessPolicy = (policy) => {
+	if (policy.type === require_rule.AccessPolicyType.Block) {
+		const { captchaType, solvedImagesCount, ...blockPolicy } = policy;
+		return blockPolicy;
+	}
+	return policy;
+};
+var policyScopeInput = zod.z.object({ clientId: zod.z.preprocess((v) => v === "global" ? void 0 : v, zod.z.coerce.string().optional()) });
+//#endregion
 exports.accessPolicyInput = accessPolicyInput;
+exports.accessPolicyInputShape = accessPolicyInputShape;
 exports.policyScopeInput = policyScopeInput;
 exports.sanitizeAccessPolicy = sanitizeAccessPolicy;

package/dist/cjs/ruleInput/ruleInput.cjs

@@ -1,50 +1,45 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const zod = require("zod");
-const rulesStorage = require("../rulesStorage.cjs");
-const policyInput = require("./policyInput.cjs");
-const userScopeInput = require("./userScopeInput.cjs");
-const ruleGroupInput = zod.z.object({
-  groupId: zod.z.coerce.string().optional(),
-  ruleGroupId: zod.z.coerce.string().optional()
-}).transform((ruleGroupInput2) => {
-  const { ruleGroupId, ...ruleGroup } = ruleGroupInput2;
-  if ("string" === typeof ruleGroupId) {
-    ruleGroup.groupId = ruleGroupId;
-  }
-  return ruleGroup;
+const require_rulesStorage = require("../rulesStorage.cjs");
+const require_ruleInput_policyInput = require("./policyInput.cjs");
+const require_ruleInput_userScopeInput = require("./userScopeInput.cjs");
+let zod = require("zod");
+//#region src/ruleInput/ruleInput.ts
+var ruleGroupInput = zod.z.object({
+	groupId: zod.z.coerce.string().optional(),
+	ruleGroupId: zod.z.coerce.string().optional()
+}).transform((ruleGroupInput) => {
+	const { ruleGroupId, ...ruleGroup } = ruleGroupInput;
+	if ("string" === typeof ruleGroupId) ruleGroup.groupId = ruleGroupId;
+	return ruleGroup;
 });
-const accessRuleInput = zod.z.object({
-  ...policyInput.accessPolicyInput.shape,
-  ...policyInput.policyScopeInput.shape
-}).and(userScopeInput.userScopeInput).and(ruleGroupInput).transform((ruleInput) => ruleInput);
-const ruleEntryInput = zod.z.object({
-  rule: accessRuleInput,
-  expiresUnixTimestamp: zod.z.coerce.number().optional()
+var accessRuleInput = zod.z.object({
+	...require_ruleInput_policyInput.accessPolicyInputShape.shape,
+	...require_ruleInput_policyInput.policyScopeInput.shape
+}).and(require_ruleInput_userScopeInput.userScopeInput).and(ruleGroupInput).transform((ruleInput) => ruleInput);
+var ruleEntryInput = zod.z.object({
+	rule: accessRuleInput,
+	expiresUnixTimestamp: zod.z.coerce.number().optional()
 });
-const accessRulesFilterInput = zod.z.object({
-  policyScope: policyInput.policyScopeInput.optional(),
-  policyScopes: zod.z.array(policyInput.policyScopeInput).optional(),
-  policyScopeMatch: zod.z.nativeEnum(rulesStorage.FilterScopeMatch).default(rulesStorage.FilterScopeMatch.Exact),
-  userScope: userScopeInput.userScopeInput.optional(),
-  userScopeMatch: zod.z.nativeEnum(rulesStorage.FilterScopeMatch).default(rulesStorage.FilterScopeMatch.Exact),
-  groupId: zod.z.string().optional(),
-  blockOnly: zod.z.boolean().optional()
+var accessRulesFilterInput = zod.z.object({
+	policyScope: require_ruleInput_policyInput.policyScopeInput.optional(),
+	policyScopes: zod.z.array(require_ruleInput_policyInput.policyScopeInput).optional(),
+	policyScopeMatch: zod.z.nativeEnum(require_rulesStorage.FilterScopeMatch).default(require_rulesStorage.FilterScopeMatch.Exact),
+	userScope: require_ruleInput_userScopeInput.userScopeInput.optional(),
+	userScopeMatch: zod.z.nativeEnum(require_rulesStorage.FilterScopeMatch).default(require_rulesStorage.FilterScopeMatch.Exact),
+	groupId: zod.z.string().optional(),
+	blockOnly: zod.z.boolean().optional()
 });
-const getAccessRuleFiltersFromInput = (filterInput) => {
-  const { policyScopes, policyScope, ...filterBase } = filterInput;
-  const allPolicyScopes = policyScopes || [];
-  if (policyScope) {
-    allPolicyScopes.push(policyScope);
-  }
-  if (allPolicyScopes.length > 0) {
-    return allPolicyScopes.map((policyScope2) => ({
-      ...filterBase,
-      policyScope: policyScope2
-    }));
-  }
-  return [filterBase];
+var getAccessRuleFiltersFromInput = (filterInput) => {
+	const { policyScopes, policyScope, ...filterBase } = filterInput;
+	const allPolicyScopes = policyScopes || [];
+	if (policyScope) allPolicyScopes.push(policyScope);
+	if (allPolicyScopes.length > 0) return allPolicyScopes.map((policyScope) => ({
+		...filterBase,
+		policyScope
+	}));
+	return [filterBase];
 };
+//#endregion
 exports.accessRuleInput = accessRuleInput;
 exports.accessRulesFilterInput = accessRulesFilterInput;
 exports.getAccessRuleFiltersFromInput = getAccessRuleFiltersFromInput;

package/dist/cjs/ruleInput/userScopeInput.cjs

@@ -1,63 +1,55 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const crypto = require("node:crypto");
-const util = require("@prosopo/util");
-const ipAddress = require("ip-address");
-const zod = require("zod");
-const userAttributesSchema = zod.z.object({
-  // coerce is used for safety, as e.g., incoming userId can be digital
-  userId: zod.z.coerce.string().optional(),
-  ja4Hash: zod.z.coerce.string().optional(),
-  headersHash: zod.z.coerce.string().optional(),
-  userAgentHash: zod.z.coerce.string().optional(),
-  headHash: zod.z.coerce.string().optional(),
-  coords: zod.z.coerce.string().optional(),
-  countryCode: zod.z.coerce.string().optional(),
-  asn: zod.z.coerce.number().int().nonnegative().optional(),
-  // Plain lowercase OS tag (see `classifyOs`). Loose `string` like
-  // countryCode: a stale/unknown value just never matches a request rather
-  // than failing the whole rule parse.
-  os: zod.z.coerce.string().optional()
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+let zod = require("zod");
+let node_crypto = require("node:crypto");
+node_crypto = require_runtime.__toESM(node_crypto, 1);
+let _prosopo_util = require("@prosopo/util");
+let ip_address = require("ip-address");
+//#region src/ruleInput/userScopeInput.ts
+var userAttributesSchema = zod.z.object({
+	userId: zod.z.coerce.string().optional(),
+	ja4Hash: zod.z.coerce.string().optional(),
+	headersHash: zod.z.coerce.string().optional(),
+	userAgentHash: zod.z.coerce.string().optional(),
+	headHash: zod.z.coerce.string().optional(),
+	coords: zod.z.coerce.string().optional(),
+	countryCode: zod.z.coerce.string().optional(),
+	asn: zod.z.coerce.number().int().nonnegative().optional(),
+	os: zod.z.coerce.string().optional()
 });
-const userAttributesInput = zod.z.object({
-  ...userAttributesSchema.shape,
-  userAgent: zod.z.coerce.string().optional()
-}).transform((userAttributesInput2) => {
-  const { userAgent, ...userScope } = userAttributesInput2;
-  if ("string" === typeof userAgent) {
-    userScope.userAgentHash = hashUserAgent(userAgent);
-  }
-  return userScope;
+var userAttributesInput = zod.z.object({
+	...userAttributesSchema.shape,
+	userAgent: zod.z.coerce.string().optional()
+}).transform((userAttributesInput) => {
+	const { userAgent, ...userScope } = userAttributesInput;
+	if ("string" === typeof userAgent) userScope.userAgentHash = hashUserAgent(userAgent);
+	return userScope;
 });
-const hashUserAgent = (userAgent) => crypto.createHash("sha256").update(userAgent).digest("hex");
-const userIpSchema = zod.z.object({
-  numericIp: zod.z.coerce.bigint().optional(),
-  numericIpMaskMin: zod.z.coerce.bigint().optional(),
-  numericIpMaskMax: zod.z.coerce.bigint().optional()
+var hashUserAgent = (userAgent) => node_crypto.default.createHash("sha256").update(userAgent).digest("hex");
+var userIpSchema = zod.z.object({
+	numericIp: zod.z.coerce.bigint().optional(),
+	numericIpMaskMin: zod.z.coerce.bigint().optional(),
+	numericIpMaskMax: zod.z.coerce.bigint().optional()
 });
-const userIpInput = zod.z.object({
-  ...userIpSchema.shape,
-  ip: zod.z.string().optional(),
-  ipMask: zod.z.string().optional()
-}).transform((userIpInput2) => {
-  const { ip, ipMask, ...numericUserIp } = userIpInput2;
-  if ("string" === typeof ip) {
-    numericUserIp.numericIp = util.getIPAddress(ip).bigInt();
-  }
-  if ("string" === typeof ipMask) {
-    const ipObject = ipAddress.Address4.isValid(ipMask) ? new ipAddress.Address4(ipMask) : new ipAddress.Address6(ipMask);
-    numericUserIp.numericIpMaskMin = ipObject.startAddress().bigInt();
-    numericUserIp.numericIpMaskMax = ipObject.endAddress().bigInt();
-  }
-  return numericUserIp;
+var userIpInput = zod.z.object({
+	...userIpSchema.shape,
+	ip: zod.z.string().optional(),
+	ipMask: zod.z.string().optional()
+}).transform((userIpInput) => {
+	const { ip, ipMask, ...numericUserIp } = userIpInput;
+	if ("string" === typeof ip) numericUserIp.numericIp = (0, _prosopo_util.getIPAddress)(ip).bigInt();
+	if ("string" === typeof ipMask) {
+		const ipObject = ip_address.Address4.isValid(ipMask) ? new ip_address.Address4(ipMask) : new ip_address.Address6(ipMask);
+		numericUserIp.numericIpMaskMin = ipObject.startAddress().bigInt();
+		numericUserIp.numericIpMaskMax = ipObject.endAddress().bigInt();
+	}
+	return numericUserIp;
 });
-const userScopeSchema = zod.z.object({
-  ...userIpSchema.shape,
-  ...userAttributesSchema.shape
+var userScopeSchema = zod.z.object({
+	...userIpSchema.shape,
+	...userAttributesSchema.shape
 });
-const userScopeInput = zod.z.object({}).and(userIpInput).and(userAttributesInput).transform(
-  // transform is used for type safety only - plain "satisfies ZodType<x>" doesn't work after ".and()"
-  (userScopeInput2) => userScopeInput2
-);
+var userScopeInput = zod.z.object({}).and(userIpInput).and(userAttributesInput).transform((userScopeInput) => userScopeInput);
+//#endregion
 exports.userScopeInput = userScopeInput;
 exports.userScopeSchema = userScopeSchema;

package/dist/cjs/ruleRecord.cjs

@@ -1,27 +1,20 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const userAttributesRecordFields = [
-  "userId",
-  "ja4Hash",
-  "headersHash",
-  "userAgent",
-  "headHash",
-  "coords",
-  "countryCode",
-  "asn",
-  "os"
+//#region src/ruleRecord.ts
+var userAttributesRecordFields = [
+	"userId",
+	"ja4Hash",
+	"headersHash",
+	"userAgent",
+	"headHash",
+	"coords",
+	"countryCode",
+	"asn",
+	"os"
 ];
-const userIpRecordFields = [
-  "ip",
-  "ipMask"
-];
-const userScopeRecordFields = [
-  ...userAttributesRecordFields,
-  ...userIpRecordFields
-];
-const getUserScopeRecordFromAccessRuleRecord = (ruleRecord) => Object.fromEntries(
-  userScopeRecordFields.map((field) => [field, ruleRecord[field]]).filter(([, value]) => value !== void 0)
-);
+var userIpRecordFields = ["ip", "ipMask"];
+var userScopeRecordFields = [...userAttributesRecordFields, ...userIpRecordFields];
+var getUserScopeRecordFromAccessRuleRecord = (ruleRecord) => Object.fromEntries(userScopeRecordFields.map((field) => [field, ruleRecord[field]]).filter(([, value]) => value !== void 0));
+//#endregion
 exports.getUserScopeRecordFromAccessRuleRecord = getUserScopeRecordFromAccessRuleRecord;
 exports.userAttributesRecordFields = userAttributesRecordFields;
 exports.userIpRecordFields = userIpRecordFields;

package/dist/cjs/rulesStorage.cjs

@@ -1,8 +1,9 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-var FilterScopeMatch = /* @__PURE__ */ ((FilterScopeMatch2) => {
-  FilterScopeMatch2["Exact"] = "exact";
-  FilterScopeMatch2["Greedy"] = "greedy";
-  return FilterScopeMatch2;
-})(FilterScopeMatch || {});
+//#region src/rulesStorage.ts
+var FilterScopeMatch = /* @__PURE__ */ function(FilterScopeMatch) {
+	FilterScopeMatch["Exact"] = "exact";
+	FilterScopeMatch["Greedy"] = "greedy";
+	return FilterScopeMatch;
+}({});
+//#endregion
 exports.FilterScopeMatch = FilterScopeMatch;