@prosopo/procaptcha-bundle 4.1.61 → 4.2.1

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/procaptcha-bundle@4.1.61 build:cjs
+> @prosopo/procaptcha-bundle@4.2.1 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -57,7 +57,7 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 10 modules transformed.
+✓ 11 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/util/widgetThemeResolver.cjs               0.57 kB │ gzip: 0.29 kB
@@ -66,11 +66,12 @@ dist/cjs/util/config.cjs                            0.66 kB │ gzip: 0.33 kB
 dist/cjs/util/captcha/components/bundleCaptcha.cjs  0.82 kB │ gzip: 0.39 kB
 dist/cjs/util/configCreator.cjs                     0.88 kB │ gzip: 0.46 kB
 dist/cjs/_virtual/_rolldown/runtime.cjs             1.00 kB │ gzip: 0.50 kB
+dist/cjs/util/clientSession.cjs                     1.08 kB │ gzip: 0.56 kB
 dist/cjs/util/language.cjs                          1.08 kB │ gzip: 0.45 kB
-dist/cjs/util/captcha/captchaRenderer.cjs           2.26 kB │ gzip: 0.78 kB
+dist/cjs/util/captcha/captchaRenderer.cjs           2.40 kB │ gzip: 0.80 kB
 dist/cjs/util/widgetFactory.cjs                     2.73 kB │ gzip: 0.89 kB
 dist/cjs/index.cjs                                  9.20 kB │ gzip: 3.22 kB
 
 [MIXED_EXPORTS] Entry module "src/index.ts" is using named (including "default", "execute", "remove", "render", "reset") and default exports together. Consumers of your bundle will have to use `..default` to access the default export, which may not be what you want. Use `output.exports: "named"` to disable this warning.
 
-✓ built in 52ms
+✓ built in 44ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/procaptcha-bundle@4.1.61 build:tsc
+> @prosopo/procaptcha-bundle@4.2.1 build:tsc
 > tsc --build --verbose
 
-12:32:51 PM - Projects in this build: 
+6:42:56 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -27,51 +27,51 @@
     * ../procaptcha-frictionless/tsconfig.json
     * tsconfig.json
 
-12:32:51 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/tests/loggerBrowser.unit.test.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../dotenv/tsconfig.json' is up to date because newest input '../dotenv/src/env.ts' is older than output '../dotenv/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../dotenv/tsconfig.json' is up to date because newest input '../dotenv/src/env.ts' is older than output '../dotenv/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/objectUtils.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/error.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/providers.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/index.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/webComponent/createWidget.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
+6:42:56 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/theme.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../account/tsconfig.json' is up to date because newest input '../account/src/custom.d.ts' is older than output '../account/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../account/tsconfig.json' is up to date because newest input '../account/src/index.ts' is older than output '../account/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../procaptcha-common/tsconfig.json' is up to date because newest input '../procaptcha-common/src/tests/defaultEvents.test.ts' is older than output '../procaptcha-common/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../procaptcha-common/tsconfig.json' is up to date because newest input '../procaptcha-common/src/clientMetaData.ts' is older than output '../procaptcha-common/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../procaptcha-pow/tsconfig.json' is up to date because newest input '../procaptcha-pow/src/index.ts' is older than output '../procaptcha-pow/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../procaptcha-pow/tsconfig.json' is up to date because newest input '../procaptcha-pow/src/index.ts' is older than output '../procaptcha-pow/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../procaptcha-puzzle/tsconfig.json' is up to date because newest input '../procaptcha-puzzle/src/tests/managerHarness.ts' is older than output '../procaptcha-puzzle/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../procaptcha-puzzle/tsconfig.json' is up to date because newest input '../procaptcha-puzzle/src/tests/managerHarness.ts' is older than output '../procaptcha-puzzle/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/mocks/data/captchas.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../procaptcha/tsconfig.json' is up to date because newest input '../procaptcha/src/modules/ProsopoCaptchaApi.ts' is older than output '../procaptcha/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../procaptcha/tsconfig.json' is up to date because newest input '../procaptcha/src/modules/Manager.ts' is older than output '../procaptcha/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../procaptcha-react/tsconfig.json' is up to date because newest input '../procaptcha-react/src/index.ts' is older than output '../procaptcha-react/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../procaptcha-react/tsconfig.json' is up to date because newest input '../procaptcha-react/src/tests/captchaComponent.unit.test.tsx' is older than output '../procaptcha-react/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project '../procaptcha-frictionless/tsconfig.json' is up to date because newest input '../procaptcha-frictionless/src/ProcaptchaFrictionless.tsx' is older than output '../procaptcha-frictionless/tsconfig.tsbuildinfo'
+6:42:57 PM - Project '../procaptcha-frictionless/tsconfig.json' is up to date because newest input '../procaptcha-frictionless/src/ProcaptchaFrictionless.tsx' is older than output '../procaptcha-frictionless/tsconfig.tsbuildinfo'
 
-12:32:51 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+6:42:57 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-12:32:51 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-bundle/tsconfig.json'...
+6:42:57 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-bundle/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/procaptcha-bundle@4.1.61 build
+> @prosopo/procaptcha-bundle@4.2.1 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/procaptcha-bundle@4.1.61 build:cross-env
+> @prosopo/procaptcha-bundle@4.2.1 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -61,7 +61,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 10 modules transformed.
+✓ 11 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js             0.04 kB │ gzip: 0.06 kB
@@ -71,8 +71,9 @@ dist/util/config.js                            0.62 kB │ gzip: 0.33 kB
 dist/util/captcha/components/bundleCaptcha.js  0.68 kB │ gzip: 0.35 kB
 dist/util/configCreator.js                     0.86 kB │ gzip: 0.45 kB
 dist/util/language.js                          1.01 kB │ gzip: 0.44 kB
-dist/util/captcha/captchaRenderer.js           1.93 kB │ gzip: 0.70 kB
+dist/util/clientSession.js                     1.03 kB │ gzip: 0.55 kB
+dist/util/captcha/captchaRenderer.js           2.04 kB │ gzip: 0.72 kB
 dist/util/widgetFactory.js                     2.52 kB │ gzip: 0.85 kB
 dist/index.js                                  8.85 kB │ gzip: 3.14 kB
 
-✓ built in 60ms
+✓ built in 59ms

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @prosopo/procaptcha-bundle
 
+## 4.2.1
+### Patch Changes
+
+- Updated dependencies [eb34de6]
+  - @prosopo/types@5.5.0
+  - @prosopo/procaptcha-common@2.12.1
+  - @prosopo/procaptcha-frictionless@2.13.19
+
+## 4.2.0
+### Minor Changes
+
+- 4b1cb19: Correlate a site-supplied session id across render and verify.
+  
+  A site can now hand the widget its own session identifier — Protect's JTI, or any per-user session id it already holds — and have the provider confirm at verify time that the token was earned in that same session. Render it with `data-sessionid="..."` or `renderOptions.sessionId`, resolved the same way `mode` and `language` already are, so implicit, explicit and invisible-button renders all pick it up. Pass the same value as the new trailing `clientSessionId` argument to `ProsopoServer.isVerified`.
+  
+  The widget attaches it to the solution as `clientMetaData.clientSessionId`. It is persisted on the captcha record (PoW, puzzle and image alike) and mirrored to a new top-level `clientMetaData` key on the session record — an object rather than a flat field, because more render-time metadata is expected to land there. It survives the PoW→image/puzzle escalation handoff, since the escalated widget is mounted with the same config.
+  
+  At verify, when the value is supplied and the solve does not carry exactly that value — including carrying none at all, which is what a token minted outside the site's session looks like — the token is disapproved with the new `ResultReason.CLIENT_SESSION_MISMATCH` (`API.CLIENT_SESSION_MISMATCH`, translated in all 31 locales), recorded on both the captcha record and the session.
+  
+  Omitting the id preserves existing behaviour, so this is opt-in and backward compatible. The verify request field is `clientSessionId` rather than `sessionId` because `VerificationResponse.sessionId` already means the provider's own frictionless session; same-named request and response fields meaning different things would be a trap for integrators.
+
+### Patch Changes
+
+- Updated dependencies [4b1cb19]
+  - @prosopo/types@5.4.0
+  - @prosopo/locale@3.4.0
+  - @prosopo/procaptcha-common@2.12.0
+  - @prosopo/procaptcha-frictionless@2.13.18
+
 ## 4.1.61
 ### Patch Changes
 

package/dist/cjs/util/captcha/captchaRenderer.cjs

@@ -1,5 +1,6 @@
 const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
 const require_language = require("../language.cjs");
+const require_clientSession = require("../clientSession.cjs");
 const require_configCreator = require("../configCreator.cjs");
 const require_timeout = require("../timeout.cjs");
 const require_bundleCaptcha = require("./components/bundleCaptcha.cjs");
@@ -27,6 +28,7 @@ var CaptchaRenderer = class {
 	readAndValidateSettings(element, config, renderOptions) {
 		require_timeout.setValidChallengeLength(renderOptions, element, config);
 		require_language.setLanguage(renderOptions, element, config);
+		require_clientSession.setClientSessionId(renderOptions, element, config);
 	}
 	makeEmotionCache(cacheKey, container) {
 		return (0, _emotion_cache.default)({

package/dist/cjs/util/clientSession.cjs

@@ -0,0 +1,28 @@
+let _prosopo_types = require("@prosopo/types");
+//#region src/util/clientSession.ts
+/**
+* Resolves the site's own session identifier for this widget, from either:
+* 1. renderOptions.sessionId
+* 2. the element's data-sessionid attribute
+*
+* The widget forwards the resolved value to the provider as
+* `clientMetaData.clientSessionId` when the solution is submitted; the dapp
+* server passes the same value to its verify call and the provider rejects the
+* token if the two disagree. Left undefined when the site doesn't use sessions,
+* in which case no correlation is performed.
+*
+* @param renderOptions
+* @param element
+* @param config
+*/
+var setClientSessionId = (renderOptions, element, config) => {
+	const sessionId = renderOptions?.sessionId || element.getAttribute("data-sessionid");
+	if (!sessionId) return;
+	if (sessionId.length > _prosopo_types.INPUT_LIMITS.ID) {
+		console.error(`Ignoring session id longer than ${_prosopo_types.INPUT_LIMITS.ID} characters`);
+		return;
+	}
+	config.clientSessionId = sessionId;
+};
+//#endregion
+exports.setClientSessionId = setClientSessionId;

package/dist/tests/util/clientSession.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=clientSession.test.d.ts.map

package/dist/tests/util/clientSession.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientSession.test.d.ts","sourceRoot":"","sources":["../../../src/tests/util/clientSession.test.ts"],"names":[],"mappings":""}

package/dist/tests/util/clientSession.test.js

@@ -0,0 +1,61 @@
+import { INPUT_LIMITS, ProcaptchaConfigSchema, } from "@prosopo/types";
+import { JSDOM } from "jsdom";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { setClientSessionId } from "../../util/clientSession.js";
+const SITE_KEY = "5site";
+const makeConfig = () => ProcaptchaConfigSchema.parse({ account: { address: SITE_KEY } });
+const makeElement = (attributes = {}) => {
+    const dom = new JSDOM("<!DOCTYPE html><html><body></body></html>");
+    const element = dom.window.document.createElement("div");
+    for (const [name, value] of Object.entries(attributes)) {
+        element.setAttribute(name, value);
+    }
+    return element;
+};
+const renderOptions = (overrides = {}) => ({ siteKey: SITE_KEY, ...overrides });
+describe("setClientSessionId", () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+    });
+    it("leaves the config untouched when the site uses no sessions", () => {
+        const config = makeConfig();
+        setClientSessionId(renderOptions(), makeElement(), config);
+        expect(config.clientSessionId).toBeUndefined();
+    });
+    it("reads the session id from the render options", () => {
+        const config = makeConfig();
+        setClientSessionId(renderOptions({ sessionId: "jti-from-options" }), makeElement(), config);
+        expect(config.clientSessionId).toBe("jti-from-options");
+    });
+    it("falls back to the data-sessionid attribute", () => {
+        const config = makeConfig();
+        setClientSessionId(renderOptions(), makeElement({ "data-sessionid": "jti-from-attribute" }), config);
+        expect(config.clientSessionId).toBe("jti-from-attribute");
+    });
+    it("prefers the render option over the attribute", () => {
+        const config = makeConfig();
+        setClientSessionId(renderOptions({ sessionId: "jti-from-options" }), makeElement({ "data-sessionid": "jti-from-attribute" }), config);
+        expect(config.clientSessionId).toBe("jti-from-options");
+    });
+    it("works when renderOptions are absent entirely (implicit render)", () => {
+        const config = makeConfig();
+        setClientSessionId(undefined, makeElement({ "data-sessionid": "jti-implicit" }), config);
+        expect(config.clientSessionId).toBe("jti-implicit");
+    });
+    it("drops an oversized session id the provider would reject", () => {
+        const error = vi
+            .spyOn(console, "error")
+            .mockImplementation(() => undefined);
+        const config = makeConfig();
+        setClientSessionId(renderOptions({ sessionId: "x".repeat(INPUT_LIMITS.ID + 1) }), makeElement(), config);
+        expect(config.clientSessionId).toBeUndefined();
+        expect(error).toHaveBeenCalled();
+    });
+    it("keeps a session id exactly at the limit", () => {
+        const config = makeConfig();
+        const atLimit = "x".repeat(INPUT_LIMITS.ID);
+        setClientSessionId(renderOptions({ sessionId: atLimit }), makeElement(), config);
+        expect(config.clientSessionId).toBe(atLimit);
+    });
+});
+//# sourceMappingURL=clientSession.test.js.map

package/dist/tests/util/clientSession.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientSession.test.js","sourceRoot":"","sources":["../../../src/tests/util/clientSession.test.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,YAAY,EAEZ,sBAAsB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,QAAQ,GAAG,OAAO,CAAC;AAEzB,MAAM,UAAU,GAAG,GAAiC,EAAE,CACrD,sBAAsB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAElE,MAAM,WAAW,GAAG,CAAC,aAAqC,EAAE,EAAW,EAAE;IACxE,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACrB,YAA8C,EAAE,EACtB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAEpE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,UAAU,CAAC,GAAG,EAAE;QACf,EAAE,CAAC,eAAe,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,kBAAkB,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,kBAAkB,CACjB,aAAa,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,EAChD,WAAW,EAAE,EACb,MAAM,CACN,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,kBAAkB,CACjB,aAAa,EAAE,EACf,WAAW,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,EACvD,MAAM,CACN,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,kBAAkB,CACjB,aAAa,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,EAChD,WAAW,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,EACvD,MAAM,CACN,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,kBAAkB,CACjB,SAAS,EACT,WAAW,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,EACjD,MAAM,CACN,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,EAAE;aACd,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;aACvB,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,kBAAkB,CACjB,aAAa,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAC7D,WAAW,EAAE,EACb,MAAM,CACN,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,kBAAkB,CACjB,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EACrC,WAAW,EAAE,EACb,MAAM,CACN,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/util/captcha/captchaRenderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captchaRenderer.d.ts","sourceRoot":"","sources":["../../../src/util/captcha/captchaRenderer.tsx"],"names":[],"mappings":"AAcA,OAAoB,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,EACX,SAAS,EACT,4BAA4B,EAC5B,uBAAuB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAAE,KAAK,IAAI,EAAc,MAAM,kBAAkB,CAAC;AAMzD,UAAU,cAAc;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,cAAM,eAAe;IACb,aAAa,CACnB,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,uBAAuB,EACtC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,SAAS,EAAE,OAAO,EAClB,eAAe,EAAE,WAAW,EAC5B,aAAa,CAAC,EAAE,OAAO,GACrB,IAAI;IAyCP,SAAS,CAAC,uBAAuB,CAChC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,4BAA4B,EACpC,aAAa,EAAE,uBAAuB,GACpC,IAAI;IAKP,SAAS,CAAC,gBAAgB,CACzB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,WAAW,GACpB,YAAY;IAQf,SAAS,CAAC,eAAe,CACxB,SAAS,EAAE,WAAW,EACtB,gBAAgB,EAAE,MAAM,GACtB,IAAI;IAMP,SAAS,CAAC,sBAAsB,CAC/B,SAAS,EAAE,IAAI,EACf,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,SAAS,GACzB,IAAI;CAKP;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"captchaRenderer.d.ts","sourceRoot":"","sources":["../../../src/util/captcha/captchaRenderer.tsx"],"names":[],"mappings":"AAcA,OAAoB,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,EACX,SAAS,EACT,4BAA4B,EAC5B,uBAAuB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAAE,KAAK,IAAI,EAAc,MAAM,kBAAkB,CAAC;AAOzD,UAAU,cAAc;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,cAAM,eAAe;IACb,aAAa,CACnB,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,uBAAuB,EACtC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,SAAS,EAAE,OAAO,EAClB,eAAe,EAAE,WAAW,EAC5B,aAAa,CAAC,EAAE,OAAO,GACrB,IAAI;IAyCP,SAAS,CAAC,uBAAuB,CAChC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,4BAA4B,EACpC,aAAa,EAAE,uBAAuB,GACpC,IAAI;IAMP,SAAS,CAAC,gBAAgB,CACzB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,WAAW,GACpB,YAAY;IAQf,SAAS,CAAC,eAAe,CACxB,SAAS,EAAE,WAAW,EACtB,gBAAgB,EAAE,MAAM,GACtB,IAAI;IAMP,SAAS,CAAC,sBAAsB,CAC/B,SAAS,EAAE,IAAI,EACf,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,SAAS,GACzB,IAAI;CAKP;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/util/captcha/captchaRenderer.js

@@ -1,5 +1,6 @@
 import "../../_virtual/_rolldown/runtime.js";
 import { setLanguage } from "../language.js";
+import { setClientSessionId } from "../clientSession.js";
 import { createConfig } from "../configCreator.js";
 import { setValidChallengeLength } from "../timeout.js";
 import { BundleCaptcha } from "./components/bundleCaptcha.js";
@@ -26,6 +27,7 @@ var CaptchaRenderer = class {
 	readAndValidateSettings(element, config, renderOptions) {
 		setValidChallengeLength(renderOptions, element, config);
 		setLanguage(renderOptions, element, config);
+		setClientSessionId(renderOptions, element, config);
 	}
 	makeEmotionCache(cacheKey, container) {
 		return createCache({

package/dist/util/captcha/captchaRenderer.js.map

@@ -1 +1 @@
-{"version":3,"file":"captchaRenderer.js","sourceRoot":"","sources":["../../../src/util/captcha/captchaRenderer.tsx"],"names":[],"mappings":";AAcA,OAAO,WAAkC,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAQ/C,OAAO,EAAa,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAQ9D,MAAM,eAAe;IACb,aAAa,CACnB,QAAwB,EACxB,SAAsB,EACtB,aAAsC,EACtC,SAAoB,EACpB,MAAe,EACf,IAAW,EACX,SAAkB,EAClB,eAA4B,EAC5B,aAAuB;QAEvB,MAAM,MAAM,GAAG,YAAY,CAC1B,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,EACnB,aAAa,CAAC,QAAQ,EACtB,MAAM,EACN,SAAS,EACT,aAAa,CAAC,kBAAkB,EAChC,aAAa,CAAC,IAAI,EAClB,aAAa,CAAC,IAAI,CAClB,CAAC;QACF,IAAI,CAAC,uBAAuB,CAC3B,aAAa,IAAI,SAAS,EAC1B,MAAM,EACN,aAAa,CACb,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CACrC,SAAS,EACT,QAAQ,CAAC,gBAAgB,CACzB,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CACzC,QAAQ,CAAC,eAAe,EACxB,SAAS,CACT,CAAC;QAEF,MAAM,gBAAgB,GAAG,CACxB,KAAC,aAAa,IACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,eAAe,GACzB,CACF,CAAC;QAEF,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAEvE,OAAO,SAAS,CAAC;IAClB,CAAC;IAES,uBAAuB,CAChC,OAAgB,EAChB,MAAoC,EACpC,aAAsC;QAEtC,uBAAuB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAES,gBAAgB,CACzB,QAAgB,EAChB,SAAsB;QAEtB,OAAO,WAAW,CAAC;YAClB,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,SAAS;SACpB,CAAC,CAAC;IACJ,CAAC;IAES,eAAe,CACxB,SAAsB,EACtB,gBAAwB;QAExB,OAAO,UAAU,CAAC,SAAS,EAAE;YAC5B,gBAAgB,EAAE,gBAAgB;SAClC,CAAC,CAAC;IACJ,CAAC;IAES,sBAAsB,CAC/B,SAAe,EACf,YAA0B,EAC1B,gBAA2B;QAE3B,SAAS,CAAC,MAAM,CACf,KAAC,aAAa,IAAC,KAAK,EAAE,YAAY,YAAG,gBAAgB,GAAiB,CACtE,CAAC;IACH,CAAC;CACD;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"captchaRenderer.js","sourceRoot":"","sources":["../../../src/util/captcha/captchaRenderer.tsx"],"names":[],"mappings":";AAcA,OAAO,WAAkC,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAQ/C,OAAO,EAAa,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAQ9D,MAAM,eAAe;IACb,aAAa,CACnB,QAAwB,EACxB,SAAsB,EACtB,aAAsC,EACtC,SAAoB,EACpB,MAAe,EACf,IAAW,EACX,SAAkB,EAClB,eAA4B,EAC5B,aAAuB;QAEvB,MAAM,MAAM,GAAG,YAAY,CAC1B,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,EACnB,aAAa,CAAC,QAAQ,EACtB,MAAM,EACN,SAAS,EACT,aAAa,CAAC,kBAAkB,EAChC,aAAa,CAAC,IAAI,EAClB,aAAa,CAAC,IAAI,CAClB,CAAC;QACF,IAAI,CAAC,uBAAuB,CAC3B,aAAa,IAAI,SAAS,EAC1B,MAAM,EACN,aAAa,CACb,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CACrC,SAAS,EACT,QAAQ,CAAC,gBAAgB,CACzB,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CACzC,QAAQ,CAAC,eAAe,EACxB,SAAS,CACT,CAAC;QAEF,MAAM,gBAAgB,GAAG,CACxB,KAAC,aAAa,IACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,eAAe,GACzB,CACF,CAAC;QAEF,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAEvE,OAAO,SAAS,CAAC;IAClB,CAAC;IAES,uBAAuB,CAChC,OAAgB,EAChB,MAAoC,EACpC,aAAsC;QAEtC,uBAAuB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,kBAAkB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAES,gBAAgB,CACzB,QAAgB,EAChB,SAAsB;QAEtB,OAAO,WAAW,CAAC;YAClB,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,SAAS;SACpB,CAAC,CAAC;IACJ,CAAC;IAES,eAAe,CACxB,SAAsB,EACtB,gBAAwB;QAExB,OAAO,UAAU,CAAC,SAAS,EAAE;YAC5B,gBAAgB,EAAE,gBAAgB;SAClC,CAAC,CAAC;IACJ,CAAC;IAES,sBAAsB,CAC/B,SAAe,EACf,YAA0B,EAC1B,gBAA2B;QAE3B,SAAS,CAAC,MAAM,CACf,KAAC,aAAa,IAAC,KAAK,EAAE,YAAY,YAAG,gBAAgB,GAAiB,CACtE,CAAC;IACH,CAAC;CACD;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/util/clientSession.d.ts

@@ -0,0 +1,3 @@
+import type { ProcaptchaClientConfigOutput, ProcaptchaRenderOptions } from "@prosopo/types";
+export declare const setClientSessionId: (renderOptions: ProcaptchaRenderOptions | undefined, element: Element, config: ProcaptchaClientConfigOutput) => void;
+//# sourceMappingURL=clientSession.d.ts.map

package/dist/util/clientSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientSession.d.ts","sourceRoot":"","sources":["../../src/util/clientSession.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACX,4BAA4B,EAC5B,uBAAuB,EACvB,MAAM,gBAAgB,CAAC;AAiBxB,eAAO,MAAM,kBAAkB,kBACf,uBAAuB,GAAG,SAAS,WACzC,OAAO,UACR,4BAA4B,KAClC,IAmBF,CAAC"}

package/dist/util/clientSession.js

@@ -0,0 +1,28 @@
+import { INPUT_LIMITS } from "@prosopo/types";
+//#region src/util/clientSession.ts
+/**
+* Resolves the site's own session identifier for this widget, from either:
+* 1. renderOptions.sessionId
+* 2. the element's data-sessionid attribute
+*
+* The widget forwards the resolved value to the provider as
+* `clientMetaData.clientSessionId` when the solution is submitted; the dapp
+* server passes the same value to its verify call and the provider rejects the
+* token if the two disagree. Left undefined when the site doesn't use sessions,
+* in which case no correlation is performed.
+*
+* @param renderOptions
+* @param element
+* @param config
+*/
+var setClientSessionId = (renderOptions, element, config) => {
+	const sessionId = renderOptions?.sessionId || element.getAttribute("data-sessionid");
+	if (!sessionId) return;
+	if (sessionId.length > INPUT_LIMITS.ID) {
+		console.error(`Ignoring session id longer than ${INPUT_LIMITS.ID} characters`);
+		return;
+	}
+	config.clientSessionId = sessionId;
+};
+//#endregion
+export { setClientSessionId };

package/dist/util/clientSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientSession.js","sourceRoot":"","sources":["../../src/util/clientSession.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAqB9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,aAAkD,EAClD,OAAgB,EAChB,MAAoC,EAC7B,EAAE;IACT,MAAM,SAAS,GACd,aAAa,EAAE,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAEpE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO;IACR,CAAC;IAKD,IAAI,SAAS,CAAC,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC;QACxC,OAAO,CAAC,KAAK,CACZ,mCAAmC,YAAY,CAAC,EAAE,aAAa,CAC/D,CAAC;QACF,OAAO;IACR,CAAC;IAED,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC;AACpC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/procaptcha-bundle",
-	"version": "4.1.61",
+	"version": "4.2.1",
 	"author": "PROSOPO LIMITED <info@prosopo.io>",
 	"license": "Apache-2.0",
 	"main": "dist/index.js",
@@ -40,10 +40,10 @@
 	"browserslist": ["> 0.5%, last 2 versions, not dead"],
 	"dependencies": {
 		"@prosopo/dotenv": "3.0.53",
-		"@prosopo/locale": "3.3.1",
-		"@prosopo/procaptcha-common": "2.11.35",
-		"@prosopo/procaptcha-frictionless": "2.13.17",
-		"@prosopo/types": "5.3.0",
+		"@prosopo/locale": "3.4.0",
+		"@prosopo/procaptcha-common": "2.12.1",
+		"@prosopo/procaptcha-frictionless": "2.13.19",
+		"@prosopo/types": "5.5.0",
 		"@prosopo/util": "3.3.7",
 		"@prosopo/widget-skeleton": "2.8.6",
 		"dotenv": "16.4.5",

package/src/tests/util/clientSession.test.ts

@@ -0,0 +1,118 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import {
+	INPUT_LIMITS,
+	type ProcaptchaClientConfigOutput,
+	ProcaptchaConfigSchema,
+	type ProcaptchaRenderOptions,
+} from "@prosopo/types";
+import { JSDOM } from "jsdom";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { setClientSessionId } from "../../util/clientSession.js";
+
+const SITE_KEY = "5site";
+
+const makeConfig = (): ProcaptchaClientConfigOutput =>
+	ProcaptchaConfigSchema.parse({ account: { address: SITE_KEY } });
+
+const makeElement = (attributes: Record<string, string> = {}): Element => {
+	const dom = new JSDOM("<!DOCTYPE html><html><body></body></html>");
+	const element = dom.window.document.createElement("div");
+	for (const [name, value] of Object.entries(attributes)) {
+		element.setAttribute(name, value);
+	}
+	return element;
+};
+
+const renderOptions = (
+	overrides: Partial<ProcaptchaRenderOptions> = {},
+): ProcaptchaRenderOptions => ({ siteKey: SITE_KEY, ...overrides });
+
+describe("setClientSessionId", () => {
+	beforeEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("leaves the config untouched when the site uses no sessions", () => {
+		const config = makeConfig();
+		setClientSessionId(renderOptions(), makeElement(), config);
+		expect(config.clientSessionId).toBeUndefined();
+	});
+
+	it("reads the session id from the render options", () => {
+		const config = makeConfig();
+		setClientSessionId(
+			renderOptions({ sessionId: "jti-from-options" }),
+			makeElement(),
+			config,
+		);
+		expect(config.clientSessionId).toBe("jti-from-options");
+	});
+
+	it("falls back to the data-sessionid attribute", () => {
+		const config = makeConfig();
+		setClientSessionId(
+			renderOptions(),
+			makeElement({ "data-sessionid": "jti-from-attribute" }),
+			config,
+		);
+		expect(config.clientSessionId).toBe("jti-from-attribute");
+	});
+
+	it("prefers the render option over the attribute", () => {
+		const config = makeConfig();
+		setClientSessionId(
+			renderOptions({ sessionId: "jti-from-options" }),
+			makeElement({ "data-sessionid": "jti-from-attribute" }),
+			config,
+		);
+		expect(config.clientSessionId).toBe("jti-from-options");
+	});
+
+	it("works when renderOptions are absent entirely (implicit render)", () => {
+		const config = makeConfig();
+		setClientSessionId(
+			undefined,
+			makeElement({ "data-sessionid": "jti-implicit" }),
+			config,
+		);
+		expect(config.clientSessionId).toBe("jti-implicit");
+	});
+
+	it("drops an oversized session id the provider would reject", () => {
+		const error = vi
+			.spyOn(console, "error")
+			.mockImplementation(() => undefined);
+		const config = makeConfig();
+		setClientSessionId(
+			renderOptions({ sessionId: "x".repeat(INPUT_LIMITS.ID + 1) }),
+			makeElement(),
+			config,
+		);
+		expect(config.clientSessionId).toBeUndefined();
+		expect(error).toHaveBeenCalled();
+	});
+
+	it("keeps a session id exactly at the limit", () => {
+		const config = makeConfig();
+		const atLimit = "x".repeat(INPUT_LIMITS.ID);
+		setClientSessionId(
+			renderOptions({ sessionId: atLimit }),
+			makeElement(),
+			config,
+		);
+		expect(config.clientSessionId).toBe(atLimit);
+	});
+});

package/src/util/captcha/captchaRenderer.tsx

@@ -22,6 +22,7 @@ import type {
 } from "@prosopo/types";
 import type { ReactNode } from "react";
 import { type Root, createRoot } from "react-dom/client";
+import { setClientSessionId } from "../clientSession.js";
 import { createConfig } from "../configCreator.js";
 import { setLanguage } from "../language.js";
 import { setValidChallengeLength } from "../timeout.js";
@@ -92,6 +93,7 @@ class CaptchaRenderer {
 	): void {
 		setValidChallengeLength(renderOptions, element, config);
 		setLanguage(renderOptions, element, config);
+		setClientSessionId(renderOptions, element, config);
 	}
 
 	protected makeEmotionCache(

package/src/util/clientSession.ts

@@ -0,0 +1,59 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { INPUT_LIMITS } from "@prosopo/types";
+import type {
+	ProcaptchaClientConfigOutput,
+	ProcaptchaRenderOptions,
+} from "@prosopo/types";
+
+/**
+ * Resolves the site's own session identifier for this widget, from either:
+ * 1. renderOptions.sessionId
+ * 2. the element's data-sessionid attribute
+ *
+ * The widget forwards the resolved value to the provider as
+ * `clientMetaData.clientSessionId` when the solution is submitted; the dapp
+ * server passes the same value to its verify call and the provider rejects the
+ * token if the two disagree. Left undefined when the site doesn't use sessions,
+ * in which case no correlation is performed.
+ *
+ * @param renderOptions
+ * @param element
+ * @param config
+ */
+export const setClientSessionId = (
+	renderOptions: ProcaptchaRenderOptions | undefined,
+	element: Element,
+	config: ProcaptchaClientConfigOutput,
+): void => {
+	const sessionId =
+		renderOptions?.sessionId || element.getAttribute("data-sessionid");
+
+	if (!sessionId) {
+		return;
+	}
+
+	// The provider bounds this field at INPUT_LIMITS.ID and would reject the
+	// whole solution body if it were longer, so drop an oversized value here
+	// rather than failing the solve over metadata.
+	if (sessionId.length > INPUT_LIMITS.ID) {
+		console.error(
+			`Ignoring session id longer than ${INPUT_LIMITS.ID} characters`,
+		);
+		return;
+	}
+
+	config.clientSessionId = sessionId;
+};