@prosopo/load-balancer 2.10.49 → 2.10.50

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/load-balancer@2.10.49 build:cjs
+> @prosopo/load-balancer@2.10.50 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -7,8 +7,8 @@ ViteCommonJSConfig: .
   tsConfigPaths: [
     '/home/runner/work/captcha/captcha/packages/common/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/locale/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/logger/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/util/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/logger/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/types/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/util-crypto/tsconfig.json'
   ]
@@ -17,8 +17,8 @@ ViteCommonJSConfig: .
   externals: [
     '@prosopo/common',
     '@prosopo/locale',
-    '@prosopo/logger',
     '@prosopo/util',
+    '@prosopo/logger',
     '@prosopo/types',
     '@prosopo/util-crypto'
   ]
@@ -33,7 +33,7 @@ computing gzip size...
 dist/cjs/retry.cjs                   1.13 kB │ gzip: 0.56 kB
 dist/cjs/index.cjs                   1.39 kB │ gzip: 0.39 kB
 dist/cjs/developmentProviderUrl.cjs  1.81 kB │ gzip: 0.88 kB
-dist/cjs/balancer.cjs                2.08 kB │ gzip: 0.97 kB
+dist/cjs/balancer.cjs                2.56 kB │ gzip: 1.17 kB
 dist/cjs/providers.cjs               5.92 kB │ gzip: 2.04 kB
 
-✓ built in 78ms
+✓ built in 51ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,32 +1,32 @@
 
-> @prosopo/load-balancer@2.10.49 build:tsc
+> @prosopo/load-balancer@2.10.50 build:tsc
 > tsc --build --verbose
 
-11:04:05 AM - Projects in this build: 
+3:28:37 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
-    * ../locale/tsconfig.json
     * ../util/tsconfig.json
+    * ../locale/tsconfig.json
     * ../logger/tsconfig.json
     * ../util-crypto/tsconfig.json
     * ../types/tsconfig.json
     * ../common/tsconfig.json
     * tsconfig.json
 
-11:04:05 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/NodejsPolarsDirnamePlugin.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+3:28:37 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-11:04:05 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/process.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+3:28:37 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-11:04:05 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/ofLen.ts' is older than output '../util/tsconfig.tsbuildinfo'
+3:28:37 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-11:04:05 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+3:28:37 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-11:04:05 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+3:28:37 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-11:04:05 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+3:28:37 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-11:04:05 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/utils/batches.ts' is older than output '../common/tsconfig.tsbuildinfo'
+3:28:37 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-11:04:05 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+3:28:37 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-11:04:05 AM - Building project '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json'...
+3:28:37 PM - Building project '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/load-balancer@2.10.49 build
+> @prosopo/load-balancer@2.10.50 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/load-balancer@2.10.49 build:cross-env
+> @prosopo/load-balancer@2.10.50 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -11,23 +11,23 @@ ViteEsmConfig: .
   tsConfigPaths: [
     '/home/runner/work/captcha/captcha/packages/common/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/locale/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/logger/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/util/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/logger/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/types/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/util-crypto/tsconfig.json'
   ]
 }
 {
+The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
   externals: [
     '@prosopo/common',
     '@prosopo/locale',
-    '@prosopo/logger',
     '@prosopo/util',
+    '@prosopo/logger',
     '@prosopo/types',
     '@prosopo/util-crypto'
   ]
 }
-The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
@@ -38,7 +38,7 @@ dist/_virtual/_rolldown/runtime.js  0.04 kB │ gzip: 0.06 kB
 dist/index.js                       0.86 kB │ gzip: 0.30 kB
 dist/retry.js                       1.09 kB │ gzip: 0.55 kB
 dist/developmentProviderUrl.js      1.70 kB │ gzip: 0.87 kB
-dist/balancer.js                    1.88 kB │ gzip: 0.94 kB
+dist/balancer.js                    2.38 kB │ gzip: 1.15 kB
 dist/providers.js                   5.64 kB │ gzip: 2.01 kB
 
-✓ built in 61ms
+✓ built in 108ms

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @prosopo/load-balancer
 
+## 2.10.50
+### Patch Changes
+
+- a9141c3: Stop loading zod before the widget can draw itself. Takes another 13KB gzipped off the critical path.
+  
+  zod is 14KB gzipped and it was being downloaded and parsed before the checkbox appeared, because six small things on the startup path happened to use it:
+  
+  - two lists of strings in `@prosopo/logger` (log levels, output format)
+  - two lists of strings in `@prosopo/locale` (language codes, translation keys)
+  - two lists of two strings in `@prosopo/types` (start mode, challenge placement)
+  - one four-field object in `@prosopo/load-balancer` (a provider entry)
+  - an `instanceof ZodError` check in `@prosopo/common`
+  - `INPUT_LIMITS`, a plain table of numbers, that happened to live in the same file as zod-based string builders
+  
+  None of these need a validation library. They are now plain TypeScript: a list, a type, and where input is untrusted, a one-line guard. `INPUT_LIMITS` moved to its own file so reading it no longer drags the builders along.
+  
+  zod has not gone anywhere — the real request and response schemas in `@prosopo/types` still use it, and still validate exactly as before. It now arrives with the code that needs it, after the widget is on screen, rather than in front of it.
+  
+  Two API changes for anyone importing these directly:
+  
+  - `LanguageSchema`, `TranslationKeysSchema`, `StartModeSchema` and `Placement` are no longer exported as zod schemas. Use `isLanguage()`, `isStartMode()`, `isPlacement()` to check a value, and `LanguageCodes`, `translationKeys`, `StartModes`, `Placements` for the lists.
+  - `isZodError()` now recognises a zod error by its name rather than `instanceof`. That is strictly more tolerant: the name still matches when an error crosses a realm boundary or comes from a second copy of zod, which `instanceof` misses — it was already the fallback arm of the same check.
+  
+  Two behaviour notes: a malformed entry in the fetched provider list now throws a plain `Error` naming the entry, where it used to throw an untranslated zod error; and the language codes accepted are unchanged.
+  
+  Covered by the existing suites for every package touched (types, types-database, locale, logger, common, load-balancer, all five procaptcha packages, api, cli, api-express-router, server, and the provider's 1322 unit tests), all passing. The built bundle was also loaded in a real browser: the widget renders from the first eight chunks, zod arrives in the second wave, and the provider's error came back translated into German.
+- Updated dependencies [a9141c3]
+- Updated dependencies [a9141c3]
+  - @prosopo/common@3.1.59
+  - @prosopo/types@5.10.0
+
 ## 2.10.49
 ### Patch Changes
 

package/dist/balancer.d.ts

@@ -1,22 +1,10 @@
 import type { EnvironmentTypes } from "@prosopo/types";
-import { z } from "zod";
-declare const HardcodedProviderSchema: z.ZodObject<{
-    address: z.ZodString;
-    url: z.ZodString;
-    datasetId: z.ZodString;
-    weight: z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodNumber>>, number, number | undefined>;
-}, "strip", z.ZodTypeAny, {
+export interface HardcodedProvider {
     address: string;
     url: string;
     datasetId: string;
     weight: number;
-}, {
-    address: string;
-    url: string;
-    datasetId: string;
-    weight?: number | undefined;
-}>;
-export type HardcodedProvider = z.infer<typeof HardcodedProviderSchema>;
+}
 export type IpMode = "ipv4" | "ipv6";
 type hostedProviders = Record<string, unknown>;
 export declare const convertHostedProvider: (provider: hostedProviders, ipMode?: IpMode) => HardcodedProvider[];

package/dist/balancer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"balancer.d.ts","sourceRoot":"","sources":["../src/balancer.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;EAa3B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAQrC,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAK/C,eAAO,MAAM,qBAAqB,aACvB,eAAe,WAChB,MAAM,KACb,iBAAiB,EAUnB,CAAC;AAKF,eAAO,MAAM,gBAAgB,aAAc,MAAM,KAAG,MACjB,CAAC;AAEpC,eAAO,MAAM,mBAAmB,aAAc,iBAAiB,KAAG,MACjB,CAAC;AAElD,eAAO,MAAM,kBAAkB,gBAAiB,gBAAgB,KAAG,MAUlE,CAAC;AAEF,eAAO,MAAM,YAAY,gBACX,gBAAgB,WACpB,MAAM,KACb,OAAO,CAAC,iBAAiB,EAAE,CAyB7B,CAAC"}
+{"version":3,"file":"balancer.d.ts","sourceRoot":"","sources":["../src/balancer.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CACf;AAkCD,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAQrC,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAK/C,eAAO,MAAM,qBAAqB,aACvB,eAAe,WAChB,MAAM,KACb,iBAAiB,EAUnB,CAAC;AAKF,eAAO,MAAM,gBAAgB,aAAc,MAAM,KAAG,MACjB,CAAC;AAEpC,eAAO,MAAM,mBAAmB,aAAc,iBAAiB,KAAG,MACjB,CAAC;AAElD,eAAO,MAAM,kBAAkB,gBAAiB,gBAAgB,KAAG,MAUlE,CAAC;AAEF,eAAO,MAAM,YAAY,gBACX,gBAAgB,WACpB,MAAM,KACb,OAAO,CAAC,iBAAiB,EAAE,CAyB7B,CAAC"}

package/dist/balancer.js

@@ -1,20 +1,27 @@
 import { getDevelopmentProviderUrl } from "./developmentProviderUrl.js";
 import { ProsopoEnvError } from "@prosopo/common";
-import { z } from "zod";
 //#region src/balancer.ts
-var HardcodedProviderSchema = z.object({
-	address: z.string(),
-	url: z.string(),
-	datasetId: z.string(),
-	weight: z.number().optional().default(1).transform((val) => {
-		return Math.max(1, Math.min(100, Math.round(val)));
-	})
-});
+/**
+* The provider list is fetched JSON, so entries are checked rather than
+* trusted. Hand-written rather than a zod schema: this module is on the
+* widget's critical path and zod costs 14KB gzipped to validate three strings
+* and a number.
+*/
+var parseHardcodedProvider = (value) => {
+	const entry = value;
+	if (!isProviderRecord(value) || typeof entry.address !== "string" || typeof entry.url !== "string" || typeof entry.datasetId !== "string" || entry.weight !== void 0 && typeof entry.weight !== "number") throw new Error(`Malformed provider entry in the provider list: ${JSON.stringify(value)}`);
+	return {
+		address: entry.address,
+		url: entry.url,
+		datasetId: entry.datasetId,
+		weight: Math.max(1, Math.min(100, Math.round(entry.weight ?? 1)))
+	};
+};
 var IP_MODE_KEYS = ["ipv4", "ipv6"];
 var isProviderRecord = (value) => typeof value === "object" && value !== null;
 var convertHostedProvider = (provider, ipMode) => {
 	const source = ipMode && isProviderRecord(provider[ipMode]) ? provider[ipMode] : provider;
-	return Object.entries(source).filter(([key]) => !IP_MODE_KEYS.includes(key)).map(([, value]) => HardcodedProviderSchema.parse(value)).sort((a, b) => a.url.localeCompare(b.url));
+	return Object.entries(source).filter(([key]) => !IP_MODE_KEYS.includes(key)).map(([, value]) => parseHardcodedProvider(value)).sort((a, b) => a.url.localeCompare(b.url));
 };
 var stripIpModeLabel = (hostname) => hostname.replace(/^ipv[46]\./, "");
 var getProviderHostname = (provider) => stripIpModeLabel(new URL(provider.url).hostname);

package/dist/balancer.js.map

@@ -1 +1 @@
-{"version":3,"file":"balancer.js","sourceRoot":"","sources":["../src/balancer.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,CAAC;SACV,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;QAElB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC;CACH,CAAC,CAAC;AAUH,MAAM,YAAY,GAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAI7D,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAA4B,EAAE,CACrE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAE7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACpC,QAAyB,EACzB,MAAe,EACO,EAAE;IACxB,MAAM,MAAM,GACX,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAqB;QACvC,CAAC,CAAC,QAAQ,CAAC;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAa,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAC5D,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAA2B,EAAU,EAAE,CAC1E,gBAAgB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAA6B,EAAU,EAAE;IAC3E,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,mCAAmC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,+CAA+C,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,4BAA4B,EAAE;QACvD,OAAO,EAAE,EAAE,WAAW,EAAE;KACxB,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAChC,WAA6B,EAC7B,MAAe,EACgB,EAAE;IACjC,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO;YACN;gBACC,OAAO,EAAE,kDAAkD;gBAC3D,GAAG,EAAE,yBAAyB,EAAE;gBAChC,SAAS,EACR,oEAAoE;gBACrE,MAAM,EAAE,CAAC;aACT;SACD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAoB,MAAM,KAAK,CAC7C,kBAAkB,CAAC,WAAW,CAAC,EAC/B;QACC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACZ,CACD,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAK5B,OAAO,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC,CAAC"}
+{"version":3,"file":"balancer.js","sourceRoot":"","sources":["../src/balancer.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAexE,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAqB,EAAE;IACpE,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IACC,CAAC,gBAAgB,CAAC,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,EAC/D,CAAC;QAIF,MAAM,IAAI,KAAK,CACd,kDAAkD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACzE,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAE1B,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;KACjE,CAAC;AACH,CAAC,CAAC;AAQF,MAAM,YAAY,GAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAI7D,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAA4B,EAAE,CACrE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAE7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACpC,QAAyB,EACzB,MAAe,EACO,EAAE;IACxB,MAAM,MAAM,GACX,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAqB;QACvC,CAAC,CAAC,QAAQ,CAAC;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAa,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAC5D,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAA2B,EAAU,EAAE,CAC1E,gBAAgB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAA6B,EAAU,EAAE;IAC3E,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,mCAAmC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,+CAA+C,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,4BAA4B,EAAE;QACvD,OAAO,EAAE,EAAE,WAAW,EAAE;KACxB,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAChC,WAA6B,EAC7B,MAAe,EACgB,EAAE;IACjC,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO;YACN;gBACC,OAAO,EAAE,kDAAkD;gBAC3D,GAAG,EAAE,yBAAyB,EAAE;gBAChC,SAAS,EACR,oEAAoE;gBACrE,MAAM,EAAE,CAAC;aACT;SACD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAoB,MAAM,KAAK,CAC7C,kBAAkB,CAAC,WAAW,CAAC,EAC/B;QACC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACZ,CACD,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAK5B,OAAO,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC,CAAC"}

package/dist/cjs/balancer.cjs

@@ -1,20 +1,27 @@
 const require_developmentProviderUrl = require("./developmentProviderUrl.cjs");
 let _prosopo_common = require("@prosopo/common");
-let zod = require("zod");
 //#region src/balancer.ts
-var HardcodedProviderSchema = zod.z.object({
-	address: zod.z.string(),
-	url: zod.z.string(),
-	datasetId: zod.z.string(),
-	weight: zod.z.number().optional().default(1).transform((val) => {
-		return Math.max(1, Math.min(100, Math.round(val)));
-	})
-});
+/**
+* The provider list is fetched JSON, so entries are checked rather than
+* trusted. Hand-written rather than a zod schema: this module is on the
+* widget's critical path and zod costs 14KB gzipped to validate three strings
+* and a number.
+*/
+var parseHardcodedProvider = (value) => {
+	const entry = value;
+	if (!isProviderRecord(value) || typeof entry.address !== "string" || typeof entry.url !== "string" || typeof entry.datasetId !== "string" || entry.weight !== void 0 && typeof entry.weight !== "number") throw new Error(`Malformed provider entry in the provider list: ${JSON.stringify(value)}`);
+	return {
+		address: entry.address,
+		url: entry.url,
+		datasetId: entry.datasetId,
+		weight: Math.max(1, Math.min(100, Math.round(entry.weight ?? 1)))
+	};
+};
 var IP_MODE_KEYS = ["ipv4", "ipv6"];
 var isProviderRecord = (value) => typeof value === "object" && value !== null;
 var convertHostedProvider = (provider, ipMode) => {
 	const source = ipMode && isProviderRecord(provider[ipMode]) ? provider[ipMode] : provider;
-	return Object.entries(source).filter(([key]) => !IP_MODE_KEYS.includes(key)).map(([, value]) => HardcodedProviderSchema.parse(value)).sort((a, b) => a.url.localeCompare(b.url));
+	return Object.entries(source).filter(([key]) => !IP_MODE_KEYS.includes(key)).map(([, value]) => parseHardcodedProvider(value)).sort((a, b) => a.url.localeCompare(b.url));
 };
 var stripIpModeLabel = (hostname) => hostname.replace(/^ipv[46]\./, "");
 var getProviderHostname = (provider) => stripIpModeLabel(new URL(provider.url).hostname);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/load-balancer",
-	"version": "2.10.49",
+	"version": "2.10.50",
 	"description": "Provider load balancer",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -37,9 +37,8 @@
 	},
 	"homepage": "https://github.com/prosopo/captcha#readme",
 	"dependencies": {
-		"@prosopo/common": "3.1.58",
-		"@prosopo/types": "5.9.2",
-		"zod": "3.23.8"
+		"@prosopo/common": "3.1.59",
+		"@prosopo/types": "5.10.0"
 	},
 	"devDependencies": {
 		"@prosopo/config": "3.4.0",

package/src/balancer.ts

@@ -13,25 +13,46 @@
 // limitations under the License.
 import { ProsopoEnvError } from "@prosopo/common";
 import type { EnvironmentTypes } from "@prosopo/types";
-import { z } from "zod";
 import { getDevelopmentProviderUrl } from "./developmentProviderUrl.js";
 
-const HardcodedProviderSchema = z.object({
-	address: z.string(),
-	url: z.string(),
-	datasetId: z.string(),
-	weight: z
-		.number()
-		.optional()
-		.default(1)
-		.transform((val) => {
-			// weight coerced to int 1-100
-			const weight = Math.round(val);
-			return Math.max(1, Math.min(100, weight));
-		}),
-});
+export interface HardcodedProvider {
+	address: string;
+	url: string;
+	datasetId: string;
+	weight: number;
+}
 
-export type HardcodedProvider = z.infer<typeof HardcodedProviderSchema>;
+/**
+ * The provider list is fetched JSON, so entries are checked rather than
+ * trusted. Hand-written rather than a zod schema: this module is on the
+ * widget's critical path and zod costs 14KB gzipped to validate three strings
+ * and a number.
+ */
+const parseHardcodedProvider = (value: unknown): HardcodedProvider => {
+	const entry = value as Record<string, unknown>;
+	if (
+		!isProviderRecord(value) ||
+		typeof entry.address !== "string" ||
+		typeof entry.url !== "string" ||
+		typeof entry.datasetId !== "string" ||
+		(entry.weight !== undefined && typeof entry.weight !== "number")
+	) {
+		// A plain Error, as before: zod threw an untranslated ZodError here,
+		// and a malformed provider list is a deployment fault rather than
+		// something to show a visitor.
+		throw new Error(
+			`Malformed provider entry in the provider list: ${JSON.stringify(value)}`,
+		);
+	}
+
+	return {
+		address: entry.address,
+		url: entry.url,
+		datasetId: entry.datasetId,
+		// weight coerced to int 1-100
+		weight: Math.max(1, Math.min(100, Math.round(entry.weight ?? 1))),
+	};
+};
 
 export type IpMode = "ipv4" | "ipv6";
 
@@ -57,7 +78,7 @@ export const convertHostedProvider = (
 
 	const providers = Object.entries(source)
 		.filter(([key]) => !IP_MODE_KEYS.includes(key as IpMode))
-		.map(([, value]) => HardcodedProviderSchema.parse(value));
+		.map(([, value]) => parseHardcodedProvider(value));
 	return providers.sort((a, b) => a.url.localeCompare(b.url));
 };